From 608f34f656856043658c31c4a07e71e1aaea32c8 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Thu, 8 Sep 2022 22:31:36 -0400 Subject: [PATCH] Fixes for 5.19 Signed-off-by: Sasha Levin --- ...-detection-for-amevcntr01-incrementi.patch | 206 ++++++++++++++++++ ...4-signal-raise-limit-on-stack-frames.patch | 44 ++++ ...ck-only-freq_table-in-__resolve_freq.patch | 41 ++++ ...d-sdma-instance-check-for-gfx11-cgcg.patch | 59 +++++ ...-num_gfx_rings-for-gfx-v9_0-rb-setup.patch | 36 +++ ...ive-reference-leak-when-adding-xgmi-.patch | 42 ++++ ...l2_cntl3-register-not-initialized-co.patch | 33 +++ ...psp_xgmi_terminate-call-from-amdgpu_.patch | 60 +++++ ...e-the-additional-kfd-pre-reset-call-.patch | 35 +++ ...rm-gem-fix-gem-handle-release-errors.patch | 137 ++++++++++++ ...-force-flush-to-delay-work-when-rade.patch | 78 +++++++ ...d-missing-pci_disable_device-in-chip.patch | 34 +++ ...troy-mutex-on-freeing-struct-fb_info.patch | 38 ++++ ...x-tests-for-platform_get_irq-failure.patch | 43 ++++ ...orkqueue-md_rdev_misc_wq-in-md_alloc.patch | 46 ++++ ...check-the-return-value-of-skb_copy_b.patch | 38 ++++ ...ack-work-around-exceeded-receive-win.patch | 136 ++++++++++++ ...me-check-to-prevent-pa2.0-kernels-on.patch | 83 +++++++ ...handle-kmalloc-failure-in-ccio_init_.patch | 58 +++++ ...ow-error-if-wrong-32-64-bit-compiler.patch | 43 ++++ ...the-alua-transitioning-state-enough-.patch | 156 +++++++++++++ .../scsi-megaraid_sas-fix-double-kfree.patch | 36 +++ ...able-atio-interrupt-coalesce-for-qua.patch | 54 +++++ ...reduce-the-power-mode-change-timeout.patch | 54 +++++ queue-5.19/series | 26 +++ ...thermal-handle-data_vault-when-the-v.patch | 73 +++++++ .../x86-sev-mark-snp_abort-noreturn.patch | 115 ++++++++++ 27 files changed, 1804 insertions(+) create mode 100644 queue-5.19/arm64-errata-add-detection-for-amevcntr01-incrementi.patch create mode 100644 queue-5.19/arm64-signal-raise-limit-on-stack-frames.patch create mode 100644 queue-5.19/cpufreq-check-only-freq_table-in-__resolve_freq.patch create mode 100644 queue-5.19/drm-amdgpu-add-sdma-instance-check-for-gfx11-cgcg.patch create mode 100644 queue-5.19/drm-amdgpu-check-num_gfx_rings-for-gfx-v9_0-rb-setup.patch create mode 100644 queue-5.19/drm-amdgpu-fix-hive-reference-leak-when-adding-xgmi-.patch create mode 100644 queue-5.19/drm-amdgpu-mmvm_l2_cntl3-register-not-initialized-co.patch create mode 100644 queue-5.19/drm-amdgpu-move-psp_xgmi_terminate-call-from-amdgpu_.patch create mode 100644 queue-5.19/drm-amdgpu-remove-the-additional-kfd-pre-reset-call-.patch create mode 100644 queue-5.19/drm-gem-fix-gem-handle-release-errors.patch create mode 100644 queue-5.19/drm-radeon-add-a-force-flush-to-delay-work-when-rade.patch create mode 100644 queue-5.19/fbdev-chipsfb-add-missing-pci_disable_device-in-chip.patch create mode 100644 queue-5.19/fbdev-fbcon-destroy-mutex-on-freeing-struct-fb_info.patch create mode 100644 queue-5.19/fbdev-omapfb-fix-tests-for-platform_get_irq-failure.patch create mode 100644 queue-5.19/md-flush-workqueue-md_rdev_misc_wq-in-md_alloc.patch create mode 100644 queue-5.19/net-core-skbuff-check-the-return-value-of-skb_copy_b.patch create mode 100644 queue-5.19/netfilter-conntrack-work-around-exceeded-receive-win.patch create mode 100644 queue-5.19/parisc-add-runtime-check-to-prevent-pa2.0-kernels-on.patch create mode 100644 queue-5.19/parisc-ccio-dma-handle-kmalloc-failure-in-ccio_init_.patch create mode 100644 queue-5.19/revert-parisc-show-error-if-wrong-32-64-bit-compiler.patch create mode 100644 queue-5.19/scsi-core-allow-the-alua-transitioning-state-enough-.patch create mode 100644 queue-5.19/scsi-megaraid_sas-fix-double-kfree.patch create mode 100644 queue-5.19/scsi-qla2xxx-disable-atio-interrupt-coalesce-for-qua.patch create mode 100644 queue-5.19/scsi-ufs-core-reduce-the-power-mode-change-timeout.patch create mode 100644 queue-5.19/thermal-int340x_thermal-handle-data_vault-when-the-v.patch create mode 100644 queue-5.19/x86-sev-mark-snp_abort-noreturn.patch diff --git a/queue-5.19/arm64-errata-add-detection-for-amevcntr01-incrementi.patch b/queue-5.19/arm64-errata-add-detection-for-amevcntr01-incrementi.patch new file mode 100644 index 00000000000..8fa1c96e5a4 --- /dev/null +++ b/queue-5.19/arm64-errata-add-detection-for-amevcntr01-incrementi.patch @@ -0,0 +1,206 @@ +From 0a0ab96ce86e837b140d282f882c86f79d96ca2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Aug 2022 11:30:50 +0100 +Subject: arm64: errata: add detection for AMEVCNTR01 incrementing incorrectly + +From: Ionela Voinescu + +[ Upstream commit e89d120c4b720e232cc6a94f0fcbd59c15d41489 ] + +The AMU counter AMEVCNTR01 (constant counter) should increment at the same +rate as the system counter. On affected Cortex-A510 cores, AMEVCNTR01 +increments incorrectly giving a significantly higher output value. This +results in inaccurate task scheduler utilization tracking and incorrect +feedback on CPU frequency. + +Work around this problem by returning 0 when reading the affected counter +in key locations that results in disabling all users of this counter from +using it either for frequency invariance or as FFH reference counter. This +effect is the same to firmware disabling affected counters. + +Details on how the two features are affected by this erratum: + + - AMU counters will not be used for frequency invariance for affected + CPUs and CPUs in the same cpufreq policy. AMUs can still be used for + frequency invariance for unaffected CPUs in the system. Although + unlikely, if no alternative method can be found to support frequency + invariance for affected CPUs (cpufreq based or solution based on + platform counters) frequency invariance will be disabled. Please check + the chapter on frequency invariance at + Documentation/scheduler/sched-capacity.rst for details of its effect. + + - Given that FFH can be used to fetch either the core or constant counter + values, restrictions are lifted regarding any of these counters + returning a valid (!0) value. Therefore FFH is considered supported + if there is a least one CPU that support AMUs, independent of any + counters being disabled or affected by this erratum. Clarifying + comments are now added to the cpc_ffh_supported(), cpu_read_constcnt() + and cpu_read_corecnt() functions. + +The above is achieved through adding a new erratum: ARM64_ERRATUM_2457168. + +Signed-off-by: Ionela Voinescu +Reviewed-by: Catalin Marinas +Cc: Catalin Marinas +Cc: Will Deacon +Cc: James Morse +Link: https://lore.kernel.org/r/20220819103050.24211-1-ionela.voinescu@arm.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + Documentation/arm64/silicon-errata.rst | 2 ++ + arch/arm64/Kconfig | 17 ++++++++++++++ + arch/arm64/kernel/cpu_errata.c | 10 ++++++++ + arch/arm64/kernel/cpufeature.c | 5 +++- + arch/arm64/kernel/topology.c | 32 ++++++++++++++++++++++++-- + arch/arm64/tools/cpucaps | 1 + + 6 files changed, 64 insertions(+), 3 deletions(-) + +diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst +index 33b04db8408f9..fda97b3fcf018 100644 +--- a/Documentation/arm64/silicon-errata.rst ++++ b/Documentation/arm64/silicon-errata.rst +@@ -52,6 +52,8 @@ stable kernels. + | Allwinner | A64/R18 | UNKNOWN1 | SUN50I_ERRATUM_UNKNOWN1 | + +----------------+-----------------+-----------------+-----------------------------+ + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-A510 | #2457168 | ARM64_ERRATUM_2457168 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A510 | #2064142 | ARM64_ERRATUM_2064142 | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A510 | #2038923 | ARM64_ERRATUM_2038923 | +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index 001eaba5a6b4b..21f33d8d66685 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -914,6 +914,23 @@ config ARM64_ERRATUM_1902691 + + If unsure, say Y. + ++config ARM64_ERRATUM_2457168 ++ bool "Cortex-A510: 2457168: workaround for AMEVCNTR01 incrementing incorrectly" ++ depends on ARM64_AMU_EXTN ++ default y ++ help ++ This option adds the workaround for ARM Cortex-A510 erratum 2457168. ++ ++ The AMU counter AMEVCNTR01 (constant counter) should increment at the same rate ++ as the system counter. On affected Cortex-A510 cores AMEVCNTR01 increments ++ incorrectly giving a significantly higher output value. ++ ++ Work around this problem by returning 0 when reading the affected counter in ++ key locations that results in disabling all users of this counter. This effect ++ is the same to firmware disabling affected counters. ++ ++ If unsure, say Y. ++ + config CAVIUM_ERRATUM_22375 + bool "Cavium erratum 22375, 24313" + default y +diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c +index 5f4117dae8888..af137f91607da 100644 +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@ -656,6 +656,16 @@ const struct arm64_cpu_capabilities arm64_errata[] = { + ERRATA_MIDR_REV_RANGE(MIDR_CORTEX_A510, 0, 0, 2) + }, + #endif ++#ifdef CONFIG_ARM64_ERRATUM_2457168 ++ { ++ .desc = "ARM erratum 2457168", ++ .capability = ARM64_WORKAROUND_2457168, ++ .type = ARM64_CPUCAP_WEAK_LOCAL_CPU_FEATURE, ++ ++ /* Cortex-A510 r0p0-r1p1 */ ++ CAP_MIDR_RANGE(MIDR_CORTEX_A510, 0, 0, 1, 1) ++ }, ++#endif + #ifdef CONFIG_ARM64_ERRATUM_2038923 + { + .desc = "ARM erratum 2038923", +diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c +index ebdfbd1cf207b..f34c9f8b9ee0a 100644 +--- a/arch/arm64/kernel/cpufeature.c ++++ b/arch/arm64/kernel/cpufeature.c +@@ -1798,7 +1798,10 @@ static void cpu_amu_enable(struct arm64_cpu_capabilities const *cap) + pr_info("detected CPU%d: Activity Monitors Unit (AMU)\n", + smp_processor_id()); + cpumask_set_cpu(smp_processor_id(), &amu_cpus); +- update_freq_counters_refs(); ++ ++ /* 0 reference values signal broken/disabled counters */ ++ if (!this_cpu_has_cap(ARM64_WORKAROUND_2457168)) ++ update_freq_counters_refs(); + } + } + +diff --git a/arch/arm64/kernel/topology.c b/arch/arm64/kernel/topology.c +index 9ab78ad826e2a..707b5451929d4 100644 +--- a/arch/arm64/kernel/topology.c ++++ b/arch/arm64/kernel/topology.c +@@ -310,12 +310,25 @@ core_initcall(init_amu_fie); + + static void cpu_read_corecnt(void *val) + { ++ /* ++ * A value of 0 can be returned if the current CPU does not support AMUs ++ * or if the counter is disabled for this CPU. A return value of 0 at ++ * counter read is properly handled as an error case by the users of the ++ * counter. ++ */ + *(u64 *)val = read_corecnt(); + } + + static void cpu_read_constcnt(void *val) + { +- *(u64 *)val = read_constcnt(); ++ /* ++ * Return 0 if the current CPU is affected by erratum 2457168. A value ++ * of 0 is also returned if the current CPU does not support AMUs or if ++ * the counter is disabled. A return value of 0 at counter read is ++ * properly handled as an error case by the users of the counter. ++ */ ++ *(u64 *)val = this_cpu_has_cap(ARM64_WORKAROUND_2457168) ? ++ 0UL : read_constcnt(); + } + + static inline +@@ -342,7 +355,22 @@ int counters_read_on_cpu(int cpu, smp_call_func_t func, u64 *val) + */ + bool cpc_ffh_supported(void) + { +- return freq_counters_valid(get_cpu_with_amu_feat()); ++ int cpu = get_cpu_with_amu_feat(); ++ ++ /* ++ * FFH is considered supported if there is at least one present CPU that ++ * supports AMUs. Using FFH to read core and reference counters for CPUs ++ * that do not support AMUs, have counters disabled or that are affected ++ * by errata, will result in a return value of 0. ++ * ++ * This is done to allow any enabled and valid counters to be read ++ * through FFH, knowing that potentially returning 0 as counter value is ++ * properly handled by the users of these counters. ++ */ ++ if ((cpu >= nr_cpu_ids) || !cpumask_test_cpu(cpu, cpu_present_mask)) ++ return false; ++ ++ return true; + } + + int cpc_read_ffh(int cpu, struct cpc_reg *reg, u64 *val) +diff --git a/arch/arm64/tools/cpucaps b/arch/arm64/tools/cpucaps +index 8809e14cf86a2..18999f46df19f 100644 +--- a/arch/arm64/tools/cpucaps ++++ b/arch/arm64/tools/cpucaps +@@ -66,6 +66,7 @@ WORKAROUND_1902691 + WORKAROUND_2038923 + WORKAROUND_2064142 + WORKAROUND_2077057 ++WORKAROUND_2457168 + WORKAROUND_TRBE_OVERWRITE_FILL_MODE + WORKAROUND_TSB_FLUSH_FAILURE + WORKAROUND_TRBE_WRITE_OUT_OF_RANGE +-- +2.35.1 + diff --git a/queue-5.19/arm64-signal-raise-limit-on-stack-frames.patch b/queue-5.19/arm64-signal-raise-limit-on-stack-frames.patch new file mode 100644 index 00000000000..f981e6cdcbe --- /dev/null +++ b/queue-5.19/arm64-signal-raise-limit-on-stack-frames.patch @@ -0,0 +1,44 @@ +From c8a1c0e8a9b689271a181d7ddbce1bf5cbd17f3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Aug 2022 19:23:21 +0100 +Subject: arm64/signal: Raise limit on stack frames + +From: Mark Brown + +[ Upstream commit 7ddcaf78e93c9282b4d92184f511b4d5bee75355 ] + +The signal code has a limit of 64K on the size of a stack frame that it +will generate, if this limit is exceeded then a process will be killed if +it receives a signal. Unfortunately with the advent of SME this limit is +too small - the maximum possible size of the ZA register alone is 64K. This +is not an issue for practical systems at present but is easily seen using +virtual platforms. + +Raise the limit to 256K, this is substantially more than could be used by +any current architecture extension. + +Signed-off-by: Mark Brown +Acked-by: Catalin Marinas +Link: https://lore.kernel.org/r/20220817182324.638214-2-broonie@kernel.org +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/signal.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c +index 8bb631bf9464c..e8e1f46d383da 100644 +--- a/arch/arm64/kernel/signal.c ++++ b/arch/arm64/kernel/signal.c +@@ -91,7 +91,7 @@ static size_t sigframe_size(struct rt_sigframe_user_layout const *user) + * not taken into account. This limit is not a guarantee and is + * NOT ABI. + */ +-#define SIGFRAME_MAXSZ SZ_64K ++#define SIGFRAME_MAXSZ SZ_256K + + static int __sigframe_alloc(struct rt_sigframe_user_layout *user, + unsigned long *offset, size_t size, bool extend) +-- +2.35.1 + diff --git a/queue-5.19/cpufreq-check-only-freq_table-in-__resolve_freq.patch b/queue-5.19/cpufreq-check-only-freq_table-in-__resolve_freq.patch new file mode 100644 index 00000000000..70b35e86859 --- /dev/null +++ b/queue-5.19/cpufreq-check-only-freq_table-in-__resolve_freq.patch @@ -0,0 +1,41 @@ +From f5cb110121e25faddb2f0f4a6bfcae0901e0ebc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Aug 2022 13:01:57 +0100 +Subject: cpufreq: check only freq_table in __resolve_freq() + +From: Lukasz Luba + +[ Upstream commit 6ca7076fbfaeccce173aeab832d76b9e49e1034b ] + +There is no need to check if the cpufreq driver implements callback +cpufreq_driver::target_index. The logic in the __resolve_freq uses +the frequency table available in the policy. It doesn't matter if the +driver provides 'target_index' or 'target' callback. It just has to +populate the 'policy->freq_table'. + +Thus, check only frequency table during the frequency resolving call. + +Acked-by: Viresh Kumar +Signed-off-by: Lukasz Luba +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index 2cad427741647..f9fd1b6c15d42 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -532,7 +532,7 @@ static unsigned int __resolve_freq(struct cpufreq_policy *policy, + + target_freq = clamp_val(target_freq, policy->min, policy->max); + +- if (!cpufreq_driver->target_index) ++ if (!policy->freq_table) + return target_freq; + + idx = cpufreq_frequency_table_target(policy, target_freq, relation); +-- +2.35.1 + diff --git a/queue-5.19/drm-amdgpu-add-sdma-instance-check-for-gfx11-cgcg.patch b/queue-5.19/drm-amdgpu-add-sdma-instance-check-for-gfx11-cgcg.patch new file mode 100644 index 00000000000..6e42e2098b8 --- /dev/null +++ b/queue-5.19/drm-amdgpu-add-sdma-instance-check-for-gfx11-cgcg.patch @@ -0,0 +1,59 @@ +From a0835a3395f97e48e4da5c2f6fdaa2e6984c7f97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Aug 2022 13:30:44 +0800 +Subject: drm/amdgpu: add sdma instance check for gfx11 CGCG + +From: Tim Huang + +[ Upstream commit 00047c3d967d7ef8adf8bac3c3579294a3bc0bb1 ] + +For some ASICs, like GFX IP v11.0.1, only have one SDMA instance, +so not need to configure SDMA1_RLC_CGCG_CTRL for this case. + +Signed-off-by: Tim Huang +Reviewed-by: Yifan Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +index a4a6751b1e449..30998ac47707c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +@@ -5090,9 +5090,12 @@ static void gfx_v11_0_update_coarse_grain_clock_gating(struct amdgpu_device *ade + data = REG_SET_FIELD(data, SDMA0_RLC_CGCG_CTRL, CGCG_INT_ENABLE, 1); + WREG32_SOC15(GC, 0, regSDMA0_RLC_CGCG_CTRL, data); + +- data = RREG32_SOC15(GC, 0, regSDMA1_RLC_CGCG_CTRL); +- data = REG_SET_FIELD(data, SDMA1_RLC_CGCG_CTRL, CGCG_INT_ENABLE, 1); +- WREG32_SOC15(GC, 0, regSDMA1_RLC_CGCG_CTRL, data); ++ /* Some ASICs only have one SDMA instance, not need to configure SDMA1 */ ++ if (adev->sdma.num_instances > 1) { ++ data = RREG32_SOC15(GC, 0, regSDMA1_RLC_CGCG_CTRL); ++ data = REG_SET_FIELD(data, SDMA1_RLC_CGCG_CTRL, CGCG_INT_ENABLE, 1); ++ WREG32_SOC15(GC, 0, regSDMA1_RLC_CGCG_CTRL, data); ++ } + } else { + /* Program RLC_CGCG_CGLS_CTRL */ + def = data = RREG32_SOC15(GC, 0, regRLC_CGCG_CGLS_CTRL); +@@ -5121,9 +5124,12 @@ static void gfx_v11_0_update_coarse_grain_clock_gating(struct amdgpu_device *ade + data &= ~SDMA0_RLC_CGCG_CTRL__CGCG_INT_ENABLE_MASK; + WREG32_SOC15(GC, 0, regSDMA0_RLC_CGCG_CTRL, data); + +- data = RREG32_SOC15(GC, 0, regSDMA1_RLC_CGCG_CTRL); +- data &= ~SDMA1_RLC_CGCG_CTRL__CGCG_INT_ENABLE_MASK; +- WREG32_SOC15(GC, 0, regSDMA1_RLC_CGCG_CTRL, data); ++ /* Some ASICs only have one SDMA instance, not need to configure SDMA1 */ ++ if (adev->sdma.num_instances > 1) { ++ data = RREG32_SOC15(GC, 0, regSDMA1_RLC_CGCG_CTRL); ++ data &= ~SDMA1_RLC_CGCG_CTRL__CGCG_INT_ENABLE_MASK; ++ WREG32_SOC15(GC, 0, regSDMA1_RLC_CGCG_CTRL, data); ++ } + } + } + +-- +2.35.1 + diff --git a/queue-5.19/drm-amdgpu-check-num_gfx_rings-for-gfx-v9_0-rb-setup.patch b/queue-5.19/drm-amdgpu-check-num_gfx_rings-for-gfx-v9_0-rb-setup.patch new file mode 100644 index 00000000000..6cd8cf4cdee --- /dev/null +++ b/queue-5.19/drm-amdgpu-check-num_gfx_rings-for-gfx-v9_0-rb-setup.patch @@ -0,0 +1,36 @@ +From 757c9c9663a13918459691cd60f9fce38d3792b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Aug 2022 10:47:09 +0800 +Subject: drm/amdgpu: Check num_gfx_rings for gfx v9_0 rb setup. + +From: Candice Li + +[ Upstream commit c351938350ab9b5e978dede2c321da43de7eb70c ] + +No need to set up rb when no gfx rings. + +Signed-off-by: Candice Li +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +index 5349ca4d19e38..6d8ff3b099422 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -2587,7 +2587,8 @@ static void gfx_v9_0_constants_init(struct amdgpu_device *adev) + + gfx_v9_0_tiling_mode_table_init(adev); + +- gfx_v9_0_setup_rb(adev); ++ if (adev->gfx.num_gfx_rings) ++ gfx_v9_0_setup_rb(adev); + gfx_v9_0_get_cu_info(adev, &adev->gfx.cu_info); + adev->gfx.config.db_debug2 = RREG32_SOC15(GC, 0, mmDB_DEBUG2); + +-- +2.35.1 + diff --git a/queue-5.19/drm-amdgpu-fix-hive-reference-leak-when-adding-xgmi-.patch b/queue-5.19/drm-amdgpu-fix-hive-reference-leak-when-adding-xgmi-.patch new file mode 100644 index 00000000000..c2baf56aee7 --- /dev/null +++ b/queue-5.19/drm-amdgpu-fix-hive-reference-leak-when-adding-xgmi-.patch @@ -0,0 +1,42 @@ +From cdd6e80a35ee40ac531fda9cf9d96e01e1c613ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Aug 2022 14:34:35 +0800 +Subject: drm/amdgpu: fix hive reference leak when adding xgmi device + +From: YiPeng Chai + +[ Upstream commit f5994da72ba124a3d0463672fdfbec073e3bb72f ] + +Only amdgpu_get_xgmi_hive but no amdgpu_put_xgmi_hive +which will leak the hive reference. + +Signed-off-by: YiPeng Chai +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index 3adebb63680e0..ea2b74c0fd229 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -2482,12 +2482,14 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev) + if (!hive->reset_domain || + !amdgpu_reset_get_reset_domain(hive->reset_domain)) { + r = -ENOENT; ++ amdgpu_put_xgmi_hive(hive); + goto init_failed; + } + + /* Drop the early temporary reset domain we created for device */ + amdgpu_reset_put_reset_domain(adev->reset_domain); + adev->reset_domain = hive->reset_domain; ++ amdgpu_put_xgmi_hive(hive); + } + } + +-- +2.35.1 + diff --git a/queue-5.19/drm-amdgpu-mmvm_l2_cntl3-register-not-initialized-co.patch b/queue-5.19/drm-amdgpu-mmvm_l2_cntl3-register-not-initialized-co.patch new file mode 100644 index 00000000000..0b2d61aab26 --- /dev/null +++ b/queue-5.19/drm-amdgpu-mmvm_l2_cntl3-register-not-initialized-co.patch @@ -0,0 +1,33 @@ +From 608b83deb55457627ffaeb6557d8652df74068b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Aug 2022 14:44:06 +0800 +Subject: drm/amdgpu: mmVM_L2_CNTL3 register not initialized correctly + +From: Qu Huang + +[ Upstream commit b8983d42524f10ac6bf35bbce6a7cc8e45f61e04 ] + +The mmVM_L2_CNTL3 register is not assigned an initial value + +Signed-off-by: Qu Huang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c +index 3f44a099c52a4..3e51e773f92be 100644 +--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c +@@ -176,6 +176,7 @@ static void mmhub_v1_0_init_cache_regs(struct amdgpu_device *adev) + tmp = REG_SET_FIELD(tmp, VM_L2_CNTL2, INVALIDATE_L2_CACHE, 1); + WREG32_SOC15(MMHUB, 0, mmVM_L2_CNTL2, tmp); + ++ tmp = mmVM_L2_CNTL3_DEFAULT; + if (adev->gmc.translate_further) { + tmp = REG_SET_FIELD(tmp, VM_L2_CNTL3, BANK_SELECT, 12); + tmp = REG_SET_FIELD(tmp, VM_L2_CNTL3, +-- +2.35.1 + diff --git a/queue-5.19/drm-amdgpu-move-psp_xgmi_terminate-call-from-amdgpu_.patch b/queue-5.19/drm-amdgpu-move-psp_xgmi_terminate-call-from-amdgpu_.patch new file mode 100644 index 00000000000..75bd86c2e23 --- /dev/null +++ b/queue-5.19/drm-amdgpu-move-psp_xgmi_terminate-call-from-amdgpu_.patch @@ -0,0 +1,60 @@ +From a4376ebbf2799fe677bcae02ed6d9713dab91d82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Aug 2022 13:38:34 +0800 +Subject: drm/amdgpu: Move psp_xgmi_terminate call from + amdgpu_xgmi_remove_device to psp_hw_fini + +From: YiPeng Chai + +[ Upstream commit 9d705d7741ae70764f3d6d87e67fad3b5c30ffd0 ] + +V1: +The amdgpu_xgmi_remove_device function will send unload command +to psp through psp ring to terminate xgmi, but psp ring has been +destroyed in psp_hw_fini. + +V2: +1. Change the commit title. +2. Restore amdgpu_xgmi_remove_device to its original calling location. + Move psp_xgmi_terminate call from amdgpu_xgmi_remove_device to + psp_hw_fini. + +Signed-off-by: YiPeng Chai +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 3 +++ + drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c | 2 +- + 2 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index e9411c28d88ba..2b00f8fe15a89 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -2612,6 +2612,9 @@ static int psp_hw_fini(void *handle) + psp_rap_terminate(psp); + psp_dtm_terminate(psp); + psp_hdcp_terminate(psp); ++ ++ if (adev->gmc.xgmi.num_physical_nodes > 1) ++ psp_xgmi_terminate(psp); + } + + psp_asd_terminate(psp); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c +index 1b108d03e7859..f2aebbf3fbe38 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c +@@ -742,7 +742,7 @@ int amdgpu_xgmi_remove_device(struct amdgpu_device *adev) + amdgpu_put_xgmi_hive(hive); + } + +- return psp_xgmi_terminate(&adev->psp); ++ return 0; + } + + static int amdgpu_xgmi_ras_late_init(struct amdgpu_device *adev, struct ras_common_if *ras_block) +-- +2.35.1 + diff --git a/queue-5.19/drm-amdgpu-remove-the-additional-kfd-pre-reset-call-.patch b/queue-5.19/drm-amdgpu-remove-the-additional-kfd-pre-reset-call-.patch new file mode 100644 index 00000000000..0d9f2160db7 --- /dev/null +++ b/queue-5.19/drm-amdgpu-remove-the-additional-kfd-pre-reset-call-.patch @@ -0,0 +1,35 @@ +From e936b2c23a2a2183ce1f3188fd9e3da01772fcc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Aug 2022 14:13:52 -0400 +Subject: drm/amdgpu: Remove the additional kfd pre reset call for sriov + +From: shaoyunl + +[ Upstream commit 06671734881af2bcf7f453661b5f8616e32bb3fc ] + +The additional call is caused by merge conflict + +Reviewed-by: Felix Kuehling +Signed-off-by: shaoyunl +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index ea2b74c0fd229..67d4a3c13ed19 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -4475,8 +4475,6 @@ static int amdgpu_device_reset_sriov(struct amdgpu_device *adev, + retry: + amdgpu_amdkfd_pre_reset(adev); + +- amdgpu_amdkfd_pre_reset(adev); +- + if (from_hypervisor) + r = amdgpu_virt_request_full_gpu(adev, true); + else +-- +2.35.1 + diff --git a/queue-5.19/drm-gem-fix-gem-handle-release-errors.patch b/queue-5.19/drm-gem-fix-gem-handle-release-errors.patch new file mode 100644 index 00000000000..c4ce824ba8b --- /dev/null +++ b/queue-5.19/drm-gem-fix-gem-handle-release-errors.patch @@ -0,0 +1,137 @@ +From 178c824c3e84750a033b390d8facc9abfb1029ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Aug 2022 15:28:34 +0800 +Subject: drm/gem: Fix GEM handle release errors +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jeffy Chen + +[ Upstream commit ea2aa97ca37a9044ade001aef71dbc06318e8d44 ] + +Currently we are assuming a one to one mapping between dmabuf and +GEM handle when releasing GEM handles. + +But that is not always true, since we would create extra handles for the +GEM obj in cases like gem_open() and getfb{,2}(). + +A similar issue was reported at: +https://lore.kernel.org/all/20211105083308.392156-1-jay.xu@rock-chips.com/ + +Another problem is that the imported dmabuf might not always have +gem_obj->dma_buf set, which would cause leaks in +drm_gem_remove_prime_handles(). + +Let's fix these for now by using handle to find the exact map to remove. + +Signed-off-by: Jeffy Chen +Reviewed-by: Christian König +Signed-off-by: Christian König +Link: https://patchwork.freedesktop.org/patch/msgid/20220819072834.17888-1-jeffy.chen@rock-chips.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_gem.c | 17 +---------------- + drivers/gpu/drm/drm_internal.h | 4 ++-- + drivers/gpu/drm/drm_prime.c | 20 ++++++++++++-------- + 3 files changed, 15 insertions(+), 26 deletions(-) + +diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c +index 86d670c712867..ad068865ba206 100644 +--- a/drivers/gpu/drm/drm_gem.c ++++ b/drivers/gpu/drm/drm_gem.c +@@ -168,21 +168,6 @@ void drm_gem_private_object_init(struct drm_device *dev, + } + EXPORT_SYMBOL(drm_gem_private_object_init); + +-static void +-drm_gem_remove_prime_handles(struct drm_gem_object *obj, struct drm_file *filp) +-{ +- /* +- * Note: obj->dma_buf can't disappear as long as we still hold a +- * handle reference in obj->handle_count. +- */ +- mutex_lock(&filp->prime.lock); +- if (obj->dma_buf) { +- drm_prime_remove_buf_handle_locked(&filp->prime, +- obj->dma_buf); +- } +- mutex_unlock(&filp->prime.lock); +-} +- + /** + * drm_gem_object_handle_free - release resources bound to userspace handles + * @obj: GEM object to clean up. +@@ -253,7 +238,7 @@ drm_gem_object_release_handle(int id, void *ptr, void *data) + if (obj->funcs->close) + obj->funcs->close(obj, file_priv); + +- drm_gem_remove_prime_handles(obj, file_priv); ++ drm_prime_remove_buf_handle(&file_priv->prime, id); + drm_vma_node_revoke(&obj->vma_node, file_priv); + + drm_gem_object_handle_put_unlocked(obj); +diff --git a/drivers/gpu/drm/drm_internal.h b/drivers/gpu/drm/drm_internal.h +index 1fbbc19f1ac09..7bb98e6a446d0 100644 +--- a/drivers/gpu/drm/drm_internal.h ++++ b/drivers/gpu/drm/drm_internal.h +@@ -74,8 +74,8 @@ int drm_prime_fd_to_handle_ioctl(struct drm_device *dev, void *data, + + void drm_prime_init_file_private(struct drm_prime_file_private *prime_fpriv); + void drm_prime_destroy_file_private(struct drm_prime_file_private *prime_fpriv); +-void drm_prime_remove_buf_handle_locked(struct drm_prime_file_private *prime_fpriv, +- struct dma_buf *dma_buf); ++void drm_prime_remove_buf_handle(struct drm_prime_file_private *prime_fpriv, ++ uint32_t handle); + + /* drm_drv.c */ + struct drm_minor *drm_minor_acquire(unsigned int minor_id); +diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c +index e3f09f18110c7..bd5366b16381b 100644 +--- a/drivers/gpu/drm/drm_prime.c ++++ b/drivers/gpu/drm/drm_prime.c +@@ -190,29 +190,33 @@ static int drm_prime_lookup_buf_handle(struct drm_prime_file_private *prime_fpri + return -ENOENT; + } + +-void drm_prime_remove_buf_handle_locked(struct drm_prime_file_private *prime_fpriv, +- struct dma_buf *dma_buf) ++void drm_prime_remove_buf_handle(struct drm_prime_file_private *prime_fpriv, ++ uint32_t handle) + { + struct rb_node *rb; + +- rb = prime_fpriv->dmabufs.rb_node; ++ mutex_lock(&prime_fpriv->lock); ++ ++ rb = prime_fpriv->handles.rb_node; + while (rb) { + struct drm_prime_member *member; + +- member = rb_entry(rb, struct drm_prime_member, dmabuf_rb); +- if (member->dma_buf == dma_buf) { ++ member = rb_entry(rb, struct drm_prime_member, handle_rb); ++ if (member->handle == handle) { + rb_erase(&member->handle_rb, &prime_fpriv->handles); + rb_erase(&member->dmabuf_rb, &prime_fpriv->dmabufs); + +- dma_buf_put(dma_buf); ++ dma_buf_put(member->dma_buf); + kfree(member); +- return; +- } else if (member->dma_buf < dma_buf) { ++ break; ++ } else if (member->handle < handle) { + rb = rb->rb_right; + } else { + rb = rb->rb_left; + } + } ++ ++ mutex_unlock(&prime_fpriv->lock); + } + + void drm_prime_init_file_private(struct drm_prime_file_private *prime_fpriv) +-- +2.35.1 + diff --git a/queue-5.19/drm-radeon-add-a-force-flush-to-delay-work-when-rade.patch b/queue-5.19/drm-radeon-add-a-force-flush-to-delay-work-when-rade.patch new file mode 100644 index 00000000000..db513eba9c3 --- /dev/null +++ b/queue-5.19/drm-radeon-add-a-force-flush-to-delay-work-when-rade.patch @@ -0,0 +1,78 @@ +From b0cd3e162020cc1c4964859ad1ce9e7574883d1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Aug 2022 15:25:40 +0800 +Subject: drm/radeon: add a force flush to delay work when radeon +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zhenneng Li + +[ Upstream commit f461950fdc374a3ada5a63c669d997de4600dffe ] + +Although radeon card fence and wait for gpu to finish processing current batch rings, +there is still a corner case that radeon lockup work queue may not be fully flushed, +and meanwhile the radeon_suspend_kms() function has called pci_set_power_state() to +put device in D3hot state. +Per PCI spec rev 4.0 on 5.3.1.4.1 D3hot State. +> Configuration and Message requests are the only TLPs accepted by a Function in +> the D3hot state. All other received Requests must be handled as Unsupported Requests, +> and all received Completions may optionally be handled as Unexpected Completions. +This issue will happen in following logs: +Unable to handle kernel paging request at virtual address 00008800e0008010 +CPU 0 kworker/0:3(131): Oops 0 +pc = [] ra = [] ps = 0000 Tainted: G W +pc is at si_gpu_check_soft_reset+0x3c/0x240 +ra is at si_dma_is_lockup+0x34/0xd0 +v0 = 0000000000000000 t0 = fff08800e0008010 t1 = 0000000000010000 +t2 = 0000000000008010 t3 = fff00007e3c00000 t4 = fff00007e3c00258 +t5 = 000000000000ffff t6 = 0000000000000001 t7 = fff00007ef078000 +s0 = fff00007e3c016e8 s1 = fff00007e3c00000 s2 = fff00007e3c00018 +s3 = fff00007e3c00000 s4 = fff00007fff59d80 s5 = 0000000000000000 +s6 = fff00007ef07bd98 +a0 = fff00007e3c00000 a1 = fff00007e3c016e8 a2 = 0000000000000008 +a3 = 0000000000000001 a4 = 8f5c28f5c28f5c29 a5 = ffffffff810f4338 +t8 = 0000000000000275 t9 = ffffffff809b66f8 t10 = ff6769c5d964b800 +t11= 000000000000b886 pv = ffffffff811bea20 at = 0000000000000000 +gp = ffffffff81d89690 sp = 00000000aa814126 +Disabling lock debugging due to kernel taint +Trace: +[] si_dma_is_lockup+0x34/0xd0 +[] radeon_fence_check_lockup+0xd0/0x290 +[] process_one_work+0x280/0x550 +[] worker_thread+0x70/0x7c0 +[] worker_thread+0x130/0x7c0 +[] kthread+0x200/0x210 +[] worker_thread+0x0/0x7c0 +[] kthread+0x14c/0x210 +[] ret_from_kernel_thread+0x18/0x20 +[] kthread+0x0/0x210 + Code: ad3e0008 43f0074a ad7e0018 ad9e0020 8c3001e8 40230101 + <88210000> 4821ed21 +So force lockup work queue flush to fix this problem. + +Acked-by: Christian König +Signed-off-by: Zhenneng Li +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/radeon_device.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c +index 429644d5ddc69..9fba16cb3f1e7 100644 +--- a/drivers/gpu/drm/radeon/radeon_device.c ++++ b/drivers/gpu/drm/radeon/radeon_device.c +@@ -1604,6 +1604,9 @@ int radeon_suspend_kms(struct drm_device *dev, bool suspend, + if (r) { + /* delay GPU reset to resume */ + radeon_fence_driver_force_completion(rdev, i); ++ } else { ++ /* finish executing delayed work */ ++ flush_delayed_work(&rdev->fence_drv[i].lockup_work); + } + } + +-- +2.35.1 + diff --git a/queue-5.19/fbdev-chipsfb-add-missing-pci_disable_device-in-chip.patch b/queue-5.19/fbdev-chipsfb-add-missing-pci_disable_device-in-chip.patch new file mode 100644 index 00000000000..3c5df553606 --- /dev/null +++ b/queue-5.19/fbdev-chipsfb-add-missing-pci_disable_device-in-chip.patch @@ -0,0 +1,34 @@ +From 6cd33465e68c48a3cab0e5ef7275205028bb20e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Aug 2022 16:57:52 +0800 +Subject: fbdev: chipsfb: Add missing pci_disable_device() in + chipsfb_pci_init() + +From: Yang Yingliang + +[ Upstream commit 07c55c9803dea748d17a054000cbf1913ce06399 ] + +Add missing pci_disable_device() in error path in chipsfb_pci_init(). + +Signed-off-by: Yang Yingliang +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/chipsfb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c +index 393894af26f84..2b00a9d554fc0 100644 +--- a/drivers/video/fbdev/chipsfb.c ++++ b/drivers/video/fbdev/chipsfb.c +@@ -430,6 +430,7 @@ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent) + err_release_fb: + framebuffer_release(p); + err_disable: ++ pci_disable_device(dp); + err_out: + return rc; + } +-- +2.35.1 + diff --git a/queue-5.19/fbdev-fbcon-destroy-mutex-on-freeing-struct-fb_info.patch b/queue-5.19/fbdev-fbcon-destroy-mutex-on-freeing-struct-fb_info.patch new file mode 100644 index 00000000000..908a887f896 --- /dev/null +++ b/queue-5.19/fbdev-fbcon-destroy-mutex-on-freeing-struct-fb_info.patch @@ -0,0 +1,38 @@ +From 9f8ed2b41bf789ea4aba760267189760515b50e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Aug 2022 20:17:31 +0900 +Subject: fbdev: fbcon: Destroy mutex on freeing struct fb_info + +From: Shigeru Yoshida + +[ Upstream commit 58559dfc1ebba2ae0c7627dc8f8991ae1984c6e3 ] + +It's needed to destroy bl_curve_mutex on freeing struct fb_info since +the mutex is embedded in the structure and initialized when it's +allocated. + +Signed-off-by: Shigeru Yoshida +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/core/fbsysfs.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/video/fbdev/core/fbsysfs.c b/drivers/video/fbdev/core/fbsysfs.c +index c2a60b187467e..4d7f63892dcc4 100644 +--- a/drivers/video/fbdev/core/fbsysfs.c ++++ b/drivers/video/fbdev/core/fbsysfs.c +@@ -84,6 +84,10 @@ void framebuffer_release(struct fb_info *info) + if (WARN_ON(refcount_read(&info->count))) + return; + ++#if IS_ENABLED(CONFIG_FB_BACKLIGHT) ++ mutex_destroy(&info->bl_curve_mutex); ++#endif ++ + kfree(info->apertures); + kfree(info); + } +-- +2.35.1 + diff --git a/queue-5.19/fbdev-omapfb-fix-tests-for-platform_get_irq-failure.patch b/queue-5.19/fbdev-omapfb-fix-tests-for-platform_get_irq-failure.patch new file mode 100644 index 00000000000..7cb49032f9a --- /dev/null +++ b/queue-5.19/fbdev-omapfb-fix-tests-for-platform_get_irq-failure.patch @@ -0,0 +1,43 @@ +From 8039bb036f9c55168903c38d4221d5e0492b7f40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Aug 2022 14:52:23 +0800 +Subject: fbdev: omapfb: Fix tests for platform_get_irq() failure + +From: Yu Zhe + +[ Upstream commit acf4c6205e862304681234a6a4375b478af12552 ] + +The platform_get_irq() returns negative error codes. It can't actually +return zero. + +Signed-off-by: Yu Zhe +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/omap/omapfb_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/video/fbdev/omap/omapfb_main.c b/drivers/video/fbdev/omap/omapfb_main.c +index 292fcb0a24fc9..6ff237cee7f87 100644 +--- a/drivers/video/fbdev/omap/omapfb_main.c ++++ b/drivers/video/fbdev/omap/omapfb_main.c +@@ -1643,14 +1643,14 @@ static int omapfb_do_probe(struct platform_device *pdev, + goto cleanup; + } + fbdev->int_irq = platform_get_irq(pdev, 0); +- if (!fbdev->int_irq) { ++ if (fbdev->int_irq < 0) { + dev_err(&pdev->dev, "unable to get irq\n"); + r = ENXIO; + goto cleanup; + } + + fbdev->ext_irq = platform_get_irq(pdev, 1); +- if (!fbdev->ext_irq) { ++ if (fbdev->ext_irq < 0) { + dev_err(&pdev->dev, "unable to get irq\n"); + r = ENXIO; + goto cleanup; +-- +2.35.1 + diff --git a/queue-5.19/md-flush-workqueue-md_rdev_misc_wq-in-md_alloc.patch b/queue-5.19/md-flush-workqueue-md_rdev_misc_wq-in-md_alloc.patch new file mode 100644 index 00000000000..4940372aefc --- /dev/null +++ b/queue-5.19/md-flush-workqueue-md_rdev_misc_wq-in-md_alloc.patch @@ -0,0 +1,46 @@ +From 50ac70eb75205acea496b504855ae4342d00b5b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Aug 2022 11:14:13 -0600 +Subject: md: Flush workqueue md_rdev_misc_wq in md_alloc() + +From: David Sloan + +[ Upstream commit 5e8daf906f890560df430d30617c692a794acb73 ] + +A race condition still exists when removing and re-creating md devices +in test cases. However, it is only seen on some setups. + +The race condition was tracked down to a reference still being held +to the kobject by the rdev in the md_rdev_misc_wq which will be released +in rdev_delayed_delete(). + +md_alloc() waits for previous deletions by waiting on the md_misc_wq, +but the md_rdev_misc_wq may still be holding a reference to a recently +removed device. + +To fix this, also flush the md_rdev_misc_wq in md_alloc(). + +Signed-off-by: David Sloan +[logang@deltatee.com: rewrote commit message] +Signed-off-by: Logan Gunthorpe +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 91e7e80fce489..25d18b67a1620 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -5647,6 +5647,7 @@ static int md_alloc(dev_t dev, char *name) + * removed (mddev_delayed_delete). + */ + flush_workqueue(md_misc_wq); ++ flush_workqueue(md_rdev_misc_wq); + + mutex_lock(&disks_mutex); + mddev = mddev_alloc(dev); +-- +2.35.1 + diff --git a/queue-5.19/net-core-skbuff-check-the-return-value-of-skb_copy_b.patch b/queue-5.19/net-core-skbuff-check-the-return-value-of-skb_copy_b.patch new file mode 100644 index 00000000000..ca5196f5fca --- /dev/null +++ b/queue-5.19/net-core-skbuff-check-the-return-value-of-skb_copy_b.patch @@ -0,0 +1,38 @@ +From 5bcab1a3803d0c8c2b84284842f2ed9f6ef82434 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Aug 2022 22:44:11 -0700 +Subject: net/core/skbuff: Check the return value of skb_copy_bits() + +From: lily + +[ Upstream commit c624c58e08b15105662b9ab9be23d14a6b945a49 ] + +skb_copy_bits() could fail, which requires a check on the return +value. + +Signed-off-by: Li Zhong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/skbuff.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index bebf58464d667..4b2b07a9422cf 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -4179,9 +4179,8 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, + SKB_GSO_CB(nskb)->csum_start = + skb_headroom(nskb) + doffset; + } else { +- skb_copy_bits(head_skb, offset, +- skb_put(nskb, len), +- len); ++ if (skb_copy_bits(head_skb, offset, skb_put(nskb, len), len)) ++ goto err; + } + continue; + } +-- +2.35.1 + diff --git a/queue-5.19/netfilter-conntrack-work-around-exceeded-receive-win.patch b/queue-5.19/netfilter-conntrack-work-around-exceeded-receive-win.patch new file mode 100644 index 00000000000..03e944ffa4f --- /dev/null +++ b/queue-5.19/netfilter-conntrack-work-around-exceeded-receive-win.patch @@ -0,0 +1,136 @@ +From 7f159f1844280cfb41183684d22553ea428aba81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Aug 2022 00:42:31 +0200 +Subject: netfilter: conntrack: work around exceeded receive window + +From: Florian Westphal + +[ Upstream commit cf97769c761abfeac8931b35fe0e1a8d5fabc9d8 ] + +When a TCP sends more bytes than allowed by the receive window, all future +packets can be marked as invalid. +This can clog up the conntrack table because of 5-day default timeout. + +Sequence of packets: + 01 initiator > responder: [S], seq 171, win 5840, options [mss 1330,sackOK,TS val 63 ecr 0,nop,wscale 1] + 02 responder > initiator: [S.], seq 33211, ack 172, win 65535, options [mss 1460,sackOK,TS val 010 ecr 63,nop,wscale 8] + 03 initiator > responder: [.], ack 33212, win 2920, options [nop,nop,TS val 068 ecr 010], length 0 + 04 initiator > responder: [P.], seq 172:240, ack 33212, win 2920, options [nop,nop,TS val 279 ecr 010], length 68 + +Window is 5840 starting from 33212 -> 39052. + + 05 responder > initiator: [.], ack 240, win 256, options [nop,nop,TS val 872 ecr 279], length 0 + 06 responder > initiator: [.], seq 33212:34530, ack 240, win 256, options [nop,nop,TS val 892 ecr 279], length 1318 + +This is fine, conntrack will flag the connection as having outstanding +data (UNACKED), which lowers the conntrack timeout to 300s. + + 07 responder > initiator: [.], seq 34530:35848, ack 240, win 256, options [nop,nop,TS val 892 ecr 279], length 1318 + 08 responder > initiator: [.], seq 35848:37166, ack 240, win 256, options [nop,nop,TS val 892 ecr 279], length 1318 + 09 responder > initiator: [.], seq 37166:38484, ack 240, win 256, options [nop,nop,TS val 892 ecr 279], length 1318 + 10 responder > initiator: [.], seq 38484:39802, ack 240, win 256, options [nop,nop,TS val 892 ecr 279], length 1318 + +Packet 10 is already sending more than permitted, but conntrack doesn't +validate this (only seq is tested vs. maxend, not 'seq+len'). + +38484 is acceptable, but only up to 39052, so this packet should +not have been sent (or only 568 bytes, not 1318). + +At this point, connection is still in '300s' mode. + +Next packet however will get flagged: + 11 responder > initiator: [P.], seq 39802:40128, ack 240, win 256, options [nop,nop,TS val 892 ecr 279], length 326 + +nf_ct_proto_6: SEQ is over the upper bound (over the window of the receiver) .. LEN=378 .. SEQ=39802 ACK=240 ACK PSH .. + +Now, a couple of replies/acks comes in: + + 12 initiator > responder: [.], ack 34530, win 4368, +[.. irrelevant acks removed ] + 16 initiator > responder: [.], ack 39802, win 8712, options [nop,nop,TS val 296201291 ecr 2982371892], length 0 + +This ack is significant -- this acks the last packet send by the +responder that conntrack considered valid. + +This means that ack == td_end. This will withdraw the +'unacked data' flag, the connection moves back to the 5-day timeout +of established conntracks. + + 17 initiator > responder: ack 40128, win 10030, ... + +This packet is also flagged as invalid. + +Because conntrack only updates state based on packets that are +considered valid, packet 11 'did not exist' and that gets us: + +nf_ct_proto_6: ACK is over upper bound 39803 (ACKed data not seen yet) .. SEQ=240 ACK=40128 WINDOW=10030 RES=0x00 ACK URG + +Because this received and processed by the endpoints, the conntrack entry +remains in a bad state, no packets will ever be considered valid again: + + 30 responder > initiator: [F.], seq 40432, ack 2045, win 391, .. + 31 initiator > responder: [.], ack 40433, win 11348, .. + 32 initiator > responder: [F.], seq 2045, ack 40433, win 11348 .. + +... all trigger 'ACK is over bound' test and we end up with +non-early-evictable 5-day default timeout. + +NB: This patch triggers a bunch of checkpatch warnings because of silly +indent. I will resend the cleanup series linked below to reduce the +indent level once this change has propagated to net-next. + +I could route the cleanup via nf but that causes extra backport work for +stable maintainers. + +Link: https://lore.kernel.org/netfilter-devel/20220720175228.17880-1-fw@strlen.de/T/#mb1d7147d36294573cc4f81d00f9f8dadfdd06cd8 +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_proto_tcp.c | 31 ++++++++++++++++++++++++++ + 1 file changed, 31 insertions(+) + +diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c +index a63b51dceaf2c..a634c72b1ffcf 100644 +--- a/net/netfilter/nf_conntrack_proto_tcp.c ++++ b/net/netfilter/nf_conntrack_proto_tcp.c +@@ -655,6 +655,37 @@ static bool tcp_in_window(struct nf_conn *ct, + tn->tcp_be_liberal) + res = true; + if (!res) { ++ bool seq_ok = before(seq, sender->td_maxend + 1); ++ ++ if (!seq_ok) { ++ u32 overshot = end - sender->td_maxend + 1; ++ bool ack_ok; ++ ++ ack_ok = after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1); ++ ++ if (in_recv_win && ++ ack_ok && ++ overshot <= receiver->td_maxwin && ++ before(sack, receiver->td_end + 1)) { ++ /* Work around TCPs that send more bytes than allowed by ++ * the receive window. ++ * ++ * If the (marked as invalid) packet is allowed to pass by ++ * the ruleset and the peer acks this data, then its possible ++ * all future packets will trigger 'ACK is over upper bound' check. ++ * ++ * Thus if only the sequence check fails then do update td_end so ++ * possible ACK for this data can update internal state. ++ */ ++ sender->td_end = end; ++ sender->flags |= IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED; ++ ++ nf_ct_l4proto_log_invalid(skb, ct, hook_state, ++ "%u bytes more than expected", overshot); ++ return res; ++ } ++ } ++ + nf_ct_l4proto_log_invalid(skb, ct, hook_state, + "%s", + before(seq, sender->td_maxend + 1) ? +-- +2.35.1 + diff --git a/queue-5.19/parisc-add-runtime-check-to-prevent-pa2.0-kernels-on.patch b/queue-5.19/parisc-add-runtime-check-to-prevent-pa2.0-kernels-on.patch new file mode 100644 index 00000000000..1a8fe90e92f --- /dev/null +++ b/queue-5.19/parisc-add-runtime-check-to-prevent-pa2.0-kernels-on.patch @@ -0,0 +1,83 @@ +From f463f79a910ac7628552550a58268a0dd88d8112 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Aug 2022 14:49:58 +0200 +Subject: parisc: Add runtime check to prevent PA2.0 kernels on PA1.x machines + +From: Helge Deller + +[ Upstream commit 591d2108f3abc4db9f9073cae37cf3591fd250d6 ] + +If a 32-bit kernel was compiled for PA2.0 CPUs, it won't be able to run +on machines with PA1.x CPUs. Add a check and bail out early if a PA1.x +machine is detected. + +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/kernel/head.S | 43 ++++++++++++++++++++++++++++++++++++++- + 1 file changed, 42 insertions(+), 1 deletion(-) + +diff --git a/arch/parisc/kernel/head.S b/arch/parisc/kernel/head.S +index e0a9e96576221..fd15fd4bbb61b 100644 +--- a/arch/parisc/kernel/head.S ++++ b/arch/parisc/kernel/head.S +@@ -22,7 +22,7 @@ + #include + #include + +- .level PA_ASM_LEVEL ++ .level 1.1 + + __INITDATA + ENTRY(boot_args) +@@ -70,6 +70,47 @@ $bss_loop: + stw,ma %arg2,4(%r1) + stw,ma %arg3,4(%r1) + ++#if !defined(CONFIG_64BIT) && defined(CONFIG_PA20) ++ /* This 32-bit kernel was compiled for PA2.0 CPUs. Check current CPU ++ * and halt kernel if we detect a PA1.x CPU. */ ++ ldi 32,%r10 ++ mtctl %r10,%cr11 ++ .level 2.0 ++ mfctl,w %cr11,%r10 ++ .level 1.1 ++ comib,<>,n 0,%r10,$cpu_ok ++ ++ load32 PA(msg1),%arg0 ++ ldi msg1_end-msg1,%arg1 ++$iodc_panic: ++ copy %arg0, %r10 ++ copy %arg1, %r11 ++ load32 PA(init_stack),%sp ++#define MEM_CONS 0x3A0 ++ ldw MEM_CONS+32(%r0),%arg0 // HPA ++ ldi ENTRY_IO_COUT,%arg1 ++ ldw MEM_CONS+36(%r0),%arg2 // SPA ++ ldw MEM_CONS+8(%r0),%arg3 // layers ++ load32 PA(__bss_start),%r1 ++ stw %r1,-52(%sp) // arg4 ++ stw %r0,-56(%sp) // arg5 ++ stw %r10,-60(%sp) // arg6 = ptr to text ++ stw %r11,-64(%sp) // arg7 = len ++ stw %r0,-68(%sp) // arg8 ++ load32 PA(.iodc_panic_ret), %rp ++ ldw MEM_CONS+40(%r0),%r1 // ENTRY_IODC ++ bv,n (%r1) ++.iodc_panic_ret: ++ b . /* wait endless with ... */ ++ or %r10,%r10,%r10 /* qemu idle sleep */ ++msg1: .ascii "Can't boot kernel which was built for PA8x00 CPUs on this machine.\r\n" ++msg1_end: ++ ++$cpu_ok: ++#endif ++ ++ .level PA_ASM_LEVEL ++ + /* Initialize startup VM. Just map first 16/32 MB of memory */ + load32 PA(swapper_pg_dir),%r4 + mtctl %r4,%cr24 /* Initialize kernel root pointer */ +-- +2.35.1 + diff --git a/queue-5.19/parisc-ccio-dma-handle-kmalloc-failure-in-ccio_init_.patch b/queue-5.19/parisc-ccio-dma-handle-kmalloc-failure-in-ccio_init_.patch new file mode 100644 index 00000000000..3943c6a24b5 --- /dev/null +++ b/queue-5.19/parisc-ccio-dma-handle-kmalloc-failure-in-ccio_init_.patch @@ -0,0 +1,58 @@ +From d992bcc02a5eb26ace85453472b17d0f074f61db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Aug 2022 12:15:10 +0800 +Subject: parisc: ccio-dma: Handle kmalloc failure in ccio_init_resources() + +From: Li Qiong + +[ Upstream commit d46c742f827fa2326ab1f4faa1cccadb56912341 ] + +As the possible failure of the kmalloc(), it should be better +to fix this error path, check and return '-ENOMEM' error code. + +Signed-off-by: Li Qiong +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/parisc/ccio-dma.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c +index 9be007c9420f9..f69ab90b5e22d 100644 +--- a/drivers/parisc/ccio-dma.c ++++ b/drivers/parisc/ccio-dma.c +@@ -1380,15 +1380,17 @@ ccio_init_resource(struct resource *res, char *name, void __iomem *ioaddr) + } + } + +-static void __init ccio_init_resources(struct ioc *ioc) ++static int __init ccio_init_resources(struct ioc *ioc) + { + struct resource *res = ioc->mmio_region; + char *name = kmalloc(14, GFP_KERNEL); +- ++ if (unlikely(!name)) ++ return -ENOMEM; + snprintf(name, 14, "GSC Bus [%d/]", ioc->hw_path); + + ccio_init_resource(res, name, &ioc->ioc_regs->io_io_low); + ccio_init_resource(res + 1, name, &ioc->ioc_regs->io_io_low_hv); ++ return 0; + } + + static int new_ioc_area(struct resource *res, unsigned long size, +@@ -1543,7 +1545,10 @@ static int __init ccio_probe(struct parisc_device *dev) + return -ENOMEM; + } + ccio_ioc_init(ioc); +- ccio_init_resources(ioc); ++ if (ccio_init_resources(ioc)) { ++ kfree(ioc); ++ return -ENOMEM; ++ } + hppa_dma_ops = &ccio_ops; + + hba = kzalloc(sizeof(*hba), GFP_KERNEL); +-- +2.35.1 + diff --git a/queue-5.19/revert-parisc-show-error-if-wrong-32-64-bit-compiler.patch b/queue-5.19/revert-parisc-show-error-if-wrong-32-64-bit-compiler.patch new file mode 100644 index 00000000000..110ab343535 --- /dev/null +++ b/queue-5.19/revert-parisc-show-error-if-wrong-32-64-bit-compiler.patch @@ -0,0 +1,43 @@ +From 8ec4bbce9edfafa45b8c969ed42252ae20093b6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Aug 2022 08:12:19 +0200 +Subject: Revert "parisc: Show error if wrong 32/64-bit compiler is being used" + +From: Helge Deller + +[ Upstream commit b4b18f47f4f9682fbf5827682645da7c8dde8f80 ] + +This reverts commit b160628e9ebcdc85d0db9d7f423c26b3c7c179d0. + +There is no need any longer to have this sanity check, because the +previous commit ("parisc: Make CONFIG_64BIT available for ARCH=parisc64 +only") prevents that CONFIG_64BIT is set if ARCH==parisc. + +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/include/asm/bitops.h | 8 -------- + 1 file changed, 8 deletions(-) + +diff --git a/arch/parisc/include/asm/bitops.h b/arch/parisc/include/asm/bitops.h +index 56ffd260c669b..0ec9cfc5131fc 100644 +--- a/arch/parisc/include/asm/bitops.h ++++ b/arch/parisc/include/asm/bitops.h +@@ -12,14 +12,6 @@ + #include + #include + +-/* compiler build environment sanity checks: */ +-#if !defined(CONFIG_64BIT) && defined(__LP64__) +-#error "Please use 'ARCH=parisc' to build the 32-bit kernel." +-#endif +-#if defined(CONFIG_64BIT) && !defined(__LP64__) +-#error "Please use 'ARCH=parisc64' to build the 64-bit kernel." +-#endif +- + /* See http://marc.theaimsgroup.com/?t=108826637900003 for discussion + * on use of volatile and __*_bit() (set/clear/change): + * *_bit() want use of volatile. +-- +2.35.1 + diff --git a/queue-5.19/scsi-core-allow-the-alua-transitioning-state-enough-.patch b/queue-5.19/scsi-core-allow-the-alua-transitioning-state-enough-.patch new file mode 100644 index 00000000000..24e3e649079 --- /dev/null +++ b/queue-5.19/scsi-core-allow-the-alua-transitioning-state-enough-.patch @@ -0,0 +1,156 @@ +From ead5774450145690402e686e8cadd909f3249734 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Jul 2022 14:41:10 -0700 +Subject: scsi: core: Allow the ALUA transitioning state enough time + +From: Brian Bunker + +[ Upstream commit 54249306e2776774ccb827969e62d34570f991db ] + +The error path for the SCSI check condition of not ready, target in ALUA +state transition, will result in the failure of that path after the retries +are exhausted. In most cases that is well ahead of the transition timeout +established in the SCSI ALUA device handler. + +Instead, reprep the command and re-add it to the queue after a 1 second +delay. This will allow the handler to take care of the timeout and only +fail the path if the target has exceeded the transition expiry timeout +(default 60 seconds). If the expiry timeout is exceeded, the handler will +change the path state from transitioning to standby leading to a path +failure eliminating the potential of this re-prep to continue endlessly. In +most cases the target will exit the transitioning state well before the +expiry timeout but after the retries are exhausted as mentioned. + +Additionally remove the scsi_io_completion_reprep() function which provides +little value. + +Link: https://lore.kernel.org/r/20220729214110.58576-1-brian@purestorage.com +Reviewed-by: Martin Wilck +Acked-by: Krishna Kant +Acked-by: Seamus Connor +Signed-off-by: Brian Bunker +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_lib.c | 44 +++++++++++++++++++++++------------------ + 1 file changed, 25 insertions(+), 19 deletions(-) + +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index 78edb1ea4748d..f5c876d03c1ad 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -118,7 +118,7 @@ scsi_set_blocked(struct scsi_cmnd *cmd, int reason) + } + } + +-static void scsi_mq_requeue_cmd(struct scsi_cmnd *cmd) ++static void scsi_mq_requeue_cmd(struct scsi_cmnd *cmd, unsigned long msecs) + { + struct request *rq = scsi_cmd_to_rq(cmd); + +@@ -128,7 +128,12 @@ static void scsi_mq_requeue_cmd(struct scsi_cmnd *cmd) + } else { + WARN_ON_ONCE(true); + } +- blk_mq_requeue_request(rq, true); ++ ++ if (msecs) { ++ blk_mq_requeue_request(rq, false); ++ blk_mq_delay_kick_requeue_list(rq->q, msecs); ++ } else ++ blk_mq_requeue_request(rq, true); + } + + /** +@@ -658,14 +663,6 @@ static unsigned int scsi_rq_err_bytes(const struct request *rq) + return bytes; + } + +-/* Helper for scsi_io_completion() when "reprep" action required. */ +-static void scsi_io_completion_reprep(struct scsi_cmnd *cmd, +- struct request_queue *q) +-{ +- /* A new command will be prepared and issued. */ +- scsi_mq_requeue_cmd(cmd); +-} +- + static bool scsi_cmd_runtime_exceeced(struct scsi_cmnd *cmd) + { + struct request *req = scsi_cmd_to_rq(cmd); +@@ -683,14 +680,21 @@ static bool scsi_cmd_runtime_exceeced(struct scsi_cmnd *cmd) + return false; + } + ++/* ++ * When ALUA transition state is returned, reprep the cmd to ++ * use the ALUA handler's transition timeout. Delay the reprep ++ * 1 sec to avoid aggressive retries of the target in that ++ * state. ++ */ ++#define ALUA_TRANSITION_REPREP_DELAY 1000 ++ + /* Helper for scsi_io_completion() when special action required. */ + static void scsi_io_completion_action(struct scsi_cmnd *cmd, int result) + { +- struct request_queue *q = cmd->device->request_queue; + struct request *req = scsi_cmd_to_rq(cmd); + int level = 0; +- enum {ACTION_FAIL, ACTION_REPREP, ACTION_RETRY, +- ACTION_DELAYED_RETRY} action; ++ enum {ACTION_FAIL, ACTION_REPREP, ACTION_DELAYED_REPREP, ++ ACTION_RETRY, ACTION_DELAYED_RETRY} action; + struct scsi_sense_hdr sshdr; + bool sense_valid; + bool sense_current = true; /* false implies "deferred sense" */ +@@ -779,8 +783,8 @@ static void scsi_io_completion_action(struct scsi_cmnd *cmd, int result) + action = ACTION_DELAYED_RETRY; + break; + case 0x0a: /* ALUA state transition */ +- blk_stat = BLK_STS_TRANSPORT; +- fallthrough; ++ action = ACTION_DELAYED_REPREP; ++ break; + default: + action = ACTION_FAIL; + break; +@@ -839,7 +843,10 @@ static void scsi_io_completion_action(struct scsi_cmnd *cmd, int result) + return; + fallthrough; + case ACTION_REPREP: +- scsi_io_completion_reprep(cmd, q); ++ scsi_mq_requeue_cmd(cmd, 0); ++ break; ++ case ACTION_DELAYED_REPREP: ++ scsi_mq_requeue_cmd(cmd, ALUA_TRANSITION_REPREP_DELAY); + break; + case ACTION_RETRY: + /* Retry the same command immediately */ +@@ -933,7 +940,7 @@ static int scsi_io_completion_nz_result(struct scsi_cmnd *cmd, int result, + * command block will be released and the queue function will be goosed. If we + * are not done then we have to figure out what to do next: + * +- * a) We can call scsi_io_completion_reprep(). The request will be ++ * a) We can call scsi_mq_requeue_cmd(). The request will be + * unprepared and put back on the queue. Then a new command will + * be created for it. This should be used if we made forward + * progress, or if we want to switch from READ(10) to READ(6) for +@@ -949,7 +956,6 @@ static int scsi_io_completion_nz_result(struct scsi_cmnd *cmd, int result, + void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes) + { + int result = cmd->result; +- struct request_queue *q = cmd->device->request_queue; + struct request *req = scsi_cmd_to_rq(cmd); + blk_status_t blk_stat = BLK_STS_OK; + +@@ -986,7 +992,7 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes) + * request just queue the command up again. + */ + if (likely(result == 0)) +- scsi_io_completion_reprep(cmd, q); ++ scsi_mq_requeue_cmd(cmd, 0); + else + scsi_io_completion_action(cmd, result); + } +-- +2.35.1 + diff --git a/queue-5.19/scsi-megaraid_sas-fix-double-kfree.patch b/queue-5.19/scsi-megaraid_sas-fix-double-kfree.patch new file mode 100644 index 00000000000..0c29ab40787 --- /dev/null +++ b/queue-5.19/scsi-megaraid_sas-fix-double-kfree.patch @@ -0,0 +1,36 @@ +From 25aa86ee786fe9be54c8c90c8f3b995ac13b7955 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Aug 2022 15:18:49 +0800 +Subject: scsi: megaraid_sas: Fix double kfree() + +From: Guixin Liu + +[ Upstream commit 8c499e49240bd93628368c3588975cfb94169b8b ] + +When allocating log_to_span fails, kfree(instance->ctrl_context) is called +twice. Remove redundant call. + +Link: https://lore.kernel.org/r/1659424729-46502-1-git-send-email-kanie@linux.alibaba.com +Acked-by: Sumit Saxena +Signed-off-by: Guixin Liu +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/megaraid/megaraid_sas_fusion.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c +index 5b5885d9732b6..3e9b2b0099c7a 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -5311,7 +5311,6 @@ megasas_alloc_fusion_context(struct megasas_instance *instance) + if (!fusion->log_to_span) { + dev_err(&instance->pdev->dev, "Failed from %s %d\n", + __func__, __LINE__); +- kfree(instance->ctrl_context); + return -ENOMEM; + } + } +-- +2.35.1 + diff --git a/queue-5.19/scsi-qla2xxx-disable-atio-interrupt-coalesce-for-qua.patch b/queue-5.19/scsi-qla2xxx-disable-atio-interrupt-coalesce-for-qua.patch new file mode 100644 index 00000000000..6fbecf5da3c --- /dev/null +++ b/queue-5.19/scsi-qla2xxx-disable-atio-interrupt-coalesce-for-qua.patch @@ -0,0 +1,54 @@ +From 29db7a8736e25e199d647289c38d7f62585224a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Jul 2022 15:08:01 -0400 +Subject: scsi: qla2xxx: Disable ATIO interrupt coalesce for quad port ISP27XX + +From: Tony Battersby + +[ Upstream commit 53661ded2460b414644532de6b99bd87f71987e9 ] + +This partially reverts commit d2b292c3f6fd ("scsi: qla2xxx: Enable ATIO +interrupt handshake for ISP27XX") + +For some workloads where the host sends a batch of commands and then +pauses, ATIO interrupt coalesce can cause some incoming ATIO entries to be +ignored for extended periods of time, resulting in slow performance, +timeouts, and aborted commands. + +Disable interrupt coalesce and re-enable the dedicated ATIO MSI-X +interrupt. + +Link: https://lore.kernel.org/r/97dcf365-89ff-014d-a3e5-1404c6af511c@cybernetics.com +Reviewed-by: Himanshu Madhani +Reviewed-by: Nilesh Javali +Signed-off-by: Tony Battersby +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_target.c | 10 ++-------- + 1 file changed, 2 insertions(+), 8 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index 2b2f682883752..62666df1a59eb 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -6935,14 +6935,8 @@ qlt_24xx_config_rings(struct scsi_qla_host *vha) + + if (ha->flags.msix_enabled) { + if (IS_QLA83XX(ha) || IS_QLA27XX(ha) || IS_QLA28XX(ha)) { +- if (IS_QLA2071(ha)) { +- /* 4 ports Baker: Enable Interrupt Handshake */ +- icb->msix_atio = 0; +- icb->firmware_options_2 |= cpu_to_le32(BIT_26); +- } else { +- icb->msix_atio = cpu_to_le16(msix->entry); +- icb->firmware_options_2 &= cpu_to_le32(~BIT_26); +- } ++ icb->msix_atio = cpu_to_le16(msix->entry); ++ icb->firmware_options_2 &= cpu_to_le32(~BIT_26); + ql_dbg(ql_dbg_init, vha, 0xf072, + "Registering ICB vector 0x%x for atio que.\n", + msix->entry); +-- +2.35.1 + diff --git a/queue-5.19/scsi-ufs-core-reduce-the-power-mode-change-timeout.patch b/queue-5.19/scsi-ufs-core-reduce-the-power-mode-change-timeout.patch new file mode 100644 index 00000000000..74000a3f8a0 --- /dev/null +++ b/queue-5.19/scsi-ufs-core-reduce-the-power-mode-change-timeout.patch @@ -0,0 +1,54 @@ +From 74e5fbf4cdeff6916bd9ed98b2cc2bcf3903cdf2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Aug 2022 16:43:49 -0700 +Subject: scsi: ufs: core: Reduce the power mode change timeout + +From: Bart Van Assche + +[ Upstream commit 8f2c96420c6ec3dcb18c8be923e24c6feaa5ccf6 ] + +The current power mode change timeout (180 s) is so large that it can cause +a watchdog timer to fire. Reduce the power mode change timeout to 10 +seconds. + +Link: https://lore.kernel.org/r/20220811234401.1957911-1-bvanassche@acm.org +Reviewed-by: Stanley Chu +Signed-off-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index a51ca56a0ebe7..829da9cb14a86 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -8723,6 +8723,8 @@ static int ufshcd_set_dev_pwr_mode(struct ufs_hba *hba, + struct scsi_device *sdp; + unsigned long flags; + int ret, retries; ++ unsigned long deadline; ++ int32_t remaining; + + spin_lock_irqsave(hba->host->host_lock, flags); + sdp = hba->ufs_device_wlun; +@@ -8755,9 +8757,14 @@ static int ufshcd_set_dev_pwr_mode(struct ufs_hba *hba, + * callbacks hence set the RQF_PM flag so that it doesn't resume the + * already suspended childs. + */ ++ deadline = jiffies + 10 * HZ; + for (retries = 3; retries > 0; --retries) { ++ ret = -ETIMEDOUT; ++ remaining = deadline - jiffies; ++ if (remaining <= 0) ++ break; + ret = scsi_execute(sdp, cmd, DMA_NONE, NULL, 0, NULL, &sshdr, +- START_STOP_TIMEOUT, 0, 0, RQF_PM, NULL); ++ remaining / HZ, 0, 0, RQF_PM, NULL); + if (!scsi_status_is_check_condition(ret) || + !scsi_sense_valid(&sshdr) || + sshdr.sense_key != UNIT_ATTENTION) +-- +2.35.1 + diff --git a/queue-5.19/series b/queue-5.19/series index 7e51a031750..19d05f034e9 100644 --- a/queue-5.19/series +++ b/queue-5.19/series @@ -6,3 +6,29 @@ net-mvpp2-debugfs-fix-memory-leak-when-using-debugfs_lookup.patch fs-only-do-a-memory-barrier-for-the-first-set_buffer_uptodate.patch soc-fsl-select-fsl_guts-driver-for-dpio.patch revert-mm-kmemleak-take-a-full-lowmem-check-in-kmemleak_-_phys.patch +scsi-qla2xxx-disable-atio-interrupt-coalesce-for-qua.patch +scsi-core-allow-the-alua-transitioning-state-enough-.patch +scsi-megaraid_sas-fix-double-kfree.patch +drm-gem-fix-gem-handle-release-errors.patch +drm-amdgpu-move-psp_xgmi_terminate-call-from-amdgpu_.patch +drm-amdgpu-fix-hive-reference-leak-when-adding-xgmi-.patch +drm-amdgpu-check-num_gfx_rings-for-gfx-v9_0-rb-setup.patch +drm-amdgpu-remove-the-additional-kfd-pre-reset-call-.patch +drm-radeon-add-a-force-flush-to-delay-work-when-rade.patch +scsi-ufs-core-reduce-the-power-mode-change-timeout.patch +revert-parisc-show-error-if-wrong-32-64-bit-compiler.patch +parisc-ccio-dma-handle-kmalloc-failure-in-ccio_init_.patch +parisc-add-runtime-check-to-prevent-pa2.0-kernels-on.patch +arm64-errata-add-detection-for-amevcntr01-incrementi.patch +arm64-signal-raise-limit-on-stack-frames.patch +netfilter-conntrack-work-around-exceeded-receive-win.patch +thermal-int340x_thermal-handle-data_vault-when-the-v.patch +cpufreq-check-only-freq_table-in-__resolve_freq.patch +net-core-skbuff-check-the-return-value-of-skb_copy_b.patch +md-flush-workqueue-md_rdev_misc_wq-in-md_alloc.patch +fbdev-omapfb-fix-tests-for-platform_get_irq-failure.patch +fbdev-fbcon-destroy-mutex-on-freeing-struct-fb_info.patch +fbdev-chipsfb-add-missing-pci_disable_device-in-chip.patch +x86-sev-mark-snp_abort-noreturn.patch +drm-amdgpu-add-sdma-instance-check-for-gfx11-cgcg.patch +drm-amdgpu-mmvm_l2_cntl3-register-not-initialized-co.patch diff --git a/queue-5.19/thermal-int340x_thermal-handle-data_vault-when-the-v.patch b/queue-5.19/thermal-int340x_thermal-handle-data_vault-when-the-v.patch new file mode 100644 index 00000000000..786400f5a1a --- /dev/null +++ b/queue-5.19/thermal-int340x_thermal-handle-data_vault-when-the-v.patch @@ -0,0 +1,73 @@ +From 5fe215f96d924550a18545ee8b9bfca1da6d739d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Aug 2022 21:21:58 +0800 +Subject: thermal/int340x_thermal: handle data_vault when the value is + ZERO_SIZE_PTR + +From: Lee, Chun-Yi + +[ Upstream commit 7931e28098a4c1a2a6802510b0cbe57546d2049d ] + +In some case, the GDDV returns a package with a buffer which has +zero length. It causes that kmemdup() returns ZERO_SIZE_PTR (0x10). + +Then the data_vault_read() got NULL point dereference problem when +accessing the 0x10 value in data_vault. + +[ 71.024560] BUG: kernel NULL pointer dereference, address: +0000000000000010 + +This patch uses ZERO_OR_NULL_PTR() for checking ZERO_SIZE_PTR or +NULL value in data_vault. + +Signed-off-by: "Lee, Chun-Yi" +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/thermal/intel/int340x_thermal/int3400_thermal.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c +index 80d4e0676083a..365489bf4b8c1 100644 +--- a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c ++++ b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c +@@ -527,7 +527,7 @@ static void int3400_setup_gddv(struct int3400_thermal_priv *priv) + priv->data_vault = kmemdup(obj->package.elements[0].buffer.pointer, + obj->package.elements[0].buffer.length, + GFP_KERNEL); +- if (!priv->data_vault) ++ if (ZERO_OR_NULL_PTR(priv->data_vault)) + goto out_free; + + bin_attr_data_vault.private = priv->data_vault; +@@ -597,7 +597,7 @@ static int int3400_thermal_probe(struct platform_device *pdev) + goto free_imok; + } + +- if (priv->data_vault) { ++ if (!ZERO_OR_NULL_PTR(priv->data_vault)) { + result = sysfs_create_group(&pdev->dev.kobj, + &data_attribute_group); + if (result) +@@ -615,7 +615,8 @@ static int int3400_thermal_probe(struct platform_device *pdev) + free_sysfs: + cleanup_odvp(priv); + if (priv->data_vault) { +- sysfs_remove_group(&pdev->dev.kobj, &data_attribute_group); ++ if (!ZERO_OR_NULL_PTR(priv->data_vault)) ++ sysfs_remove_group(&pdev->dev.kobj, &data_attribute_group); + kfree(priv->data_vault); + } + free_uuid: +@@ -647,7 +648,7 @@ static int int3400_thermal_remove(struct platform_device *pdev) + if (!priv->rel_misc_dev_res) + acpi_thermal_rel_misc_device_remove(priv->adev->handle); + +- if (priv->data_vault) ++ if (!ZERO_OR_NULL_PTR(priv->data_vault)) + sysfs_remove_group(&pdev->dev.kobj, &data_attribute_group); + sysfs_remove_group(&pdev->dev.kobj, &uuid_attribute_group); + sysfs_remove_group(&pdev->dev.kobj, &imok_attribute_group); +-- +2.35.1 + diff --git a/queue-5.19/x86-sev-mark-snp_abort-noreturn.patch b/queue-5.19/x86-sev-mark-snp_abort-noreturn.patch new file mode 100644 index 00000000000..489756a6c61 --- /dev/null +++ b/queue-5.19/x86-sev-mark-snp_abort-noreturn.patch @@ -0,0 +1,115 @@ +From 0e152e92c52968cf66980a419b818c78fddabc19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Aug 2022 17:13:26 +0200 +Subject: x86/sev: Mark snp_abort() noreturn + +From: Borislav Petkov + +[ Upstream commit c93c296fff6b369a7115916145047c8a3db6e27f ] + +Mark both the function prototype and definition as noreturn in order to +prevent the compiler from doing transformations which confuse objtool +like so: + + vmlinux.o: warning: objtool: sme_enable+0x71: unreachable instruction + +This triggers with gcc-12. + +Add it and sev_es_terminate() to the objtool noreturn tracking array +too. Sort it while at it. + +Suggested-by: Michael Matz +Signed-off-by: Borislav Petkov +Acked-by: Peter Zijlstra +Link: https://lore.kernel.org/r/20220824152420.20547-1-bp@alien8.de +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/sev.h | 2 +- + arch/x86/kernel/sev.c | 2 +- + tools/objtool/check.c | 34 ++++++++++++++++++---------------- + 3 files changed, 20 insertions(+), 18 deletions(-) + +diff --git a/arch/x86/include/asm/sev.h b/arch/x86/include/asm/sev.h +index 4a23e52fe0ee1..ebc271bb6d8ed 100644 +--- a/arch/x86/include/asm/sev.h ++++ b/arch/x86/include/asm/sev.h +@@ -195,7 +195,7 @@ void snp_set_memory_shared(unsigned long vaddr, unsigned int npages); + void snp_set_memory_private(unsigned long vaddr, unsigned int npages); + void snp_set_wakeup_secondary_cpu(void); + bool snp_init(struct boot_params *bp); +-void snp_abort(void); ++void __init __noreturn snp_abort(void); + int snp_issue_guest_request(u64 exit_code, struct snp_req_data *input, unsigned long *fw_err); + #else + static inline void sev_es_ist_enter(struct pt_regs *regs) { } +diff --git a/arch/x86/kernel/sev.c b/arch/x86/kernel/sev.c +index 4f84c3f11af5b..a428c62330d37 100644 +--- a/arch/x86/kernel/sev.c ++++ b/arch/x86/kernel/sev.c +@@ -2112,7 +2112,7 @@ bool __init snp_init(struct boot_params *bp) + return true; + } + +-void __init snp_abort(void) ++void __init __noreturn snp_abort(void) + { + sev_es_terminate(SEV_TERM_SET_GEN, GHCB_SNP_UNSUPPORTED); + } +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index 31c719f99f66e..5d87e0b0d85f9 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -162,32 +162,34 @@ static bool __dead_end_function(struct objtool_file *file, struct symbol *func, + + /* + * Unfortunately these have to be hard coded because the noreturn +- * attribute isn't provided in ELF data. ++ * attribute isn't provided in ELF data. Keep 'em sorted. + */ + static const char * const global_noreturns[] = { ++ "__invalid_creds", ++ "__module_put_and_kthread_exit", ++ "__reiserfs_panic", + "__stack_chk_fail", +- "panic", ++ "__ubsan_handle_builtin_unreachable", ++ "cpu_bringup_and_idle", ++ "cpu_startup_entry", + "do_exit", ++ "do_group_exit", + "do_task_dead", +- "kthread_exit", +- "make_task_dead", +- "__module_put_and_kthread_exit", ++ "ex_handler_msr_mce", ++ "fortify_panic", + "kthread_complete_and_exit", +- "__reiserfs_panic", ++ "kthread_exit", ++ "kunit_try_catch_throw", + "lbug_with_loc", +- "fortify_panic", +- "usercopy_abort", + "machine_real_restart", ++ "make_task_dead", ++ "panic", + "rewind_stack_and_make_dead", +- "kunit_try_catch_throw", +- "xen_start_kernel", +- "cpu_bringup_and_idle", +- "do_group_exit", ++ "sev_es_terminate", ++ "snp_abort", + "stop_this_cpu", +- "__invalid_creds", +- "cpu_startup_entry", +- "__ubsan_handle_builtin_unreachable", +- "ex_handler_msr_mce", ++ "usercopy_abort", ++ "xen_start_kernel", + }; + + if (!func) +-- +2.35.1 + -- 2.47.3