From ccdbba175b3550aedd5d4795f91d6acf45184579 Mon Sep 17 00:00:00 2001 From: Olaf Hering Date: Jun 08 2022 11:21:16 +0000 Subject: Merge remote-tracking branch 'kerncvs/SLE12-SP5-AZURE' into SLE12-SP5-AZURE_EMBARGO --- diff --git a/blacklist.conf b/blacklist.conf index bd19e91..2d02a7f 100644 --- a/blacklist.conf +++ b/blacklist.conf @@ -1828,6 +1828,9 @@ c915ef890d5dc79f483e1ca3b3a5b5f1a170690c # Affected code does not exist: drm/amd bbda4b6c7d7c7f79da71f95c92a5d76be22c3efd # depends on 4.14 sstep.c rewrite 04b38d012556199ba4c31195940160e0c44c64f0 # touches ifdeffed out code, all configs have CONFIG_SECCOMP_FILTER=y 3c4fa46b30c551b1df2fb1574a684f68bc22067c # unlikely to be used on SLE kernels +dda44eb29c235735a5ceae283dc521cfca27885c # requires c420644c0a8f8839ca7269acbb8a3fc7fe1ec97d powerpc: Use mm_context vas_windows counter to issue CP_ABORT +c420644c0a8f8839ca7269acbb8a3fc7fe1ec97d # only required for dda44eb29c235735a5ceae283dc521cfca27885c +f35d2f249ef05b9671e7898f09ad89aa78f99122 # Only relevant since dda44eb29c235735a5ceae283dc521cfca27885c 66c1b6d74cd7035e85c426f0af4aede19e805c8a # not really needed define move 1faba27f11c8da244e793546a1b35a9b1da8208e # not relevant in our kernel configs 08685be7761d69914f08c3d6211c543a385a5b9c # no scv support @@ -2114,3 +2117,45 @@ cb8fac6d2727f79f211e745b16c9abbf4d8be652 # cosmetic 6e4d56db30a5feb83ba233a68841ba79483e7731 # depends on updates in tipd driver e8a62f363661d824495737427d59ba3fce91ae34 # cosmetic 313bbd1990b6ddfdaa7da098d0c56b098a833572 # misattributed, introduced in 77dcc6233e0def71e104d728ab5a39c2fca51127 we do not have +a5359ddd052860bacf957e65fe819c63e974b3a6 # only needed for GCC 10+ which we do not have +7f0f1f3ef62ed7a40e30aff28115bd94c4211d1d # we don't have ARCH_NOMADIK +117b4e96c7f362eb6459543883fc07f77662472c # no gadget mode in SLE12 +14073ce951b5919da450022c050772902f24f054 # optimization that breaks kABI +393dcd1f2b75e50783c805814a96bf6c8e11fe03 # optimization that breaks kABI +a08ad6339e0441ca12533969ed94a87e3655426e # cleanup, no code change +5d4fa2c50125c9cda9e380d89268757cc5fa743d # duplicate of 27c3943683f74e35e1d390ceb2e3639eff616ad6 +e4625044d656f3c33ece0cc9da22577bc10ca5d3 # build fix irrelevant in our config +44870a9e7a3c24acbb3f888b2a7cc22c9bdf7e7f # misattributed, bug introduced in 8572211842afc53c8450fb470f2b8d02ba7592e0 which we don't have +e9ba4032a2568ef5b360de95eb6e09195a1b2efd # cleanup, not a bugfix +09fdc98577120d4f47601c3127efde726a2300c6 # irrelevant in our configs +4ebd47037027c4beae99680bff3b20fdee5d7c1e # cleanup breaking kABI +860dafa902595fb5f1d23bbcce1215188c3341e6 # does not apply: vt: Fix character height handling with VT_RESIZEX +3dfac26e2ef29ff2abc2a75aa4cd48fce25a2c4b # does not apply: vgacon: Propagate console boot parameters before calling `vc_resize' +5ada78b26f935f8751852dffa24f6b545b1d2517 # patched code does not exist: backlight: qcom-wled: Fix off-by-one maximum with default num_strings +b1ce45e86b81e8ce354c47a7440d263e4cd5dc56 # Fixes in source code comments +84ff7a09c371bc7417eabfda19bf7f113ec917b6 # Duplicate of 045afc24124d80c6998d9c770844c67912083506; suse-commit: 11424e589f5b7485696599398be75907c7060ad7 +6f496a555d93db7a11d4860b9220d904822f586a # CONFIG_KASAN is not set +6f5459da2b8736720afdbd67c4bd2d1edba7d0e3 # Needed by clang's integrated assembler +feefd39ab6bb6a746364ef00c39cce2e33a0fde7 # Does not do any practical difference +ef0e3b650f8ddc54bb70868852f50642ee3ae765 # no P10 PMU support +173ee3962959a1985a109f81539a403b5cd07ae7 # only adds exports +4f03d537ce08f93d8dc3dd1273a32f2551599000 # breaks API in a way visible to user space +31a099dbd91e69fcab55eef4be15ed7a8c984918 # Can not find file to patch. No livepatching on aarch64, still. +a02dcde595f7cbd240ccd64de96034ad91cffc40 # cosmetic +a88638c4e69cfcbfebc7523d777d1273f2fce806 # cosmetic +7d613f9f72ec8f90ddefcae038fdae5adb8404b3 # patches dead code on our archs, bsc#1199622 +cb011044e34c293e139570ce5c01aed66a34345c # Caused a regression, was reverted later +cf7f34777a5b4100a3a44ff95f3d949c62892bdd # extremely intrusive prerequisites +84918a89d6efaff075de570b55642b6f4ceeac6d # no gadget mode in SLE12 +29009604ad4e3ef784fd9b9fef6f23610ddf633d # STM32 not supported in SLE12 +10b89c43a64eb0d236903b79a3bc9d8f6cbfd9c7 # STM32 not supported in SLE12 +a8cc3128bf2c01c4d448fe17149e87132113b445 # STM32 not supported in SLE12 +b756f1c8fc9d84e3f546d7ffe056c5352f4aab05 # CRYPTO_DEV_SUN4I_SS depends on ARCH_SUNXI && !64BI => not in SLE12 +1e02e6fbdadb3a0cb56294ff37eeeb8109e1f493 # CRYPTO_DEV_SUN4I_SS depends on ARCH_SUNXI && !64BI => not in SLE12 +7bdcd851fa7eb66e8922aa7f6cba9e2f2427a7cf # CRYPTO_DEV_SUN4I_SS depends on ARCH_SUNXI && !64BI => not in SLE12 +d1d787bcebfe122a5bd443ae565696661e2e9656 # CRYPTO_DEV_SUN4I_SS depends on ARCH_SUNXI && !64BI => not in SLE12 +9bc3dd24e7dccd50757db743a3635ad5b0497e6e # CRYPTO_DEV_SUN4I_SS depends on ARCH_SUNXI && !64BI => not in SLE12 +5ab6177fa02df15cd8a02a1f1fb361d2d5d8b946 # CRYPTO_DEV_SUN4I_SS depends on ARCH_SUNXI && !64BI => not in SLE12 +cdb07bdea28ebf1286a979501620745680596365 # cleanup patch not applicable +40fdea0284bb20814399da0484a658a96c735d90 # requires 8480ed9c2bbd56 +03e607cbb2931374db1825f371e9c7f28526d3f4 # relevant only if CONFIG_REGULATOR is set and buggy upstream that it does not compile without it diff --git a/config/arm64/default b/config/arm64/default index 620d185..38ba2ec 100644 --- a/config/arm64/default +++ b/config/arm64/default @@ -6808,6 +6808,8 @@ CONFIG_CLKSRC_OF=y CONFIG_CLKSRC_ACPI=y CONFIG_CLKSRC_PROBE=y CONFIG_CLKSRC_MMIO=y +CONFIG_DW_APB_TIMER=y +CONFIG_DW_APB_TIMER_OF=y CONFIG_ROCKCHIP_TIMER=y CONFIG_ARM_ARCH_TIMER=y CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y diff --git a/patches.kabi/NFSv4-Fix-OPEN-CLOSE-race-FIX.patch b/patches.kabi/NFSv4-Fix-OPEN-CLOSE-race-FIX.patch index edda14e..942a544 100644 --- a/patches.kabi/NFSv4-Fix-OPEN-CLOSE-race-FIX.patch +++ b/patches.kabi/NFSv4-Fix-OPEN-CLOSE-race-FIX.patch @@ -17,7 +17,7 @@ Signed-off-by: NeilBrown --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c -@@ -1501,6 +1501,7 @@ static void nfs_clear_open_stateid(struc +@@ -1502,6 +1502,7 @@ static void nfs_clear_open_stateid(struc static void nfs_set_open_stateid_locked(struct nfs4_state *state, const nfs4_stateid *stateid, nfs4_stateid *freeme) { @@ -25,10 +25,10 @@ Signed-off-by: NeilBrown DEFINE_WAIT(wait); struct wait_queue_head *wq_head = bit_waitqueue(&state->flags, NFS_STATE_CHANGE_WAIT); -@@ -1528,7 +1529,8 @@ static void nfs_set_open_stateid_locked( +@@ -1529,7 +1530,8 @@ static void nfs_set_open_stateid_locked( rcu_read_unlock(); - if (!signal_pending(current)) { + if (!fatal_signal_pending(current)) { - if (schedule_timeout(5*HZ) == 0) + if (schedule_timeout(5*HZ) == 0 || + time_after(jiffies, deadline)) diff --git a/patches.kabi/Revert-NFSv4-Handle-the-special-Linux-file-open-acce.kabi b/patches.kabi/Revert-NFSv4-Handle-the-special-Linux-file-open-acce.kabi new file mode 100644 index 0000000..6a94697 --- /dev/null +++ b/patches.kabi/Revert-NFSv4-Handle-the-special-Linux-file-open-acce.kabi @@ -0,0 +1,22 @@ +From: NeilBrown +Subject: Report kabi after Revert "NFSv4: Handle the special Linux file open access mode" +Patch-mainline: Never, kabi +References: git-fixes + +Restore the export + +Signed-off-by: NeilBrown +--- + fs/nfs/inode.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -1002,6 +1002,7 @@ int nfs_open(struct inode *inode, struct + nfs_fscache_open_file(inode, filp); + return 0; + } ++EXPORT_SYMBOL_GPL(nfs_open); + + /* + * This function is called whenever some part of NFS notices that diff --git a/patches.kabi/fuse-handle-kabi-change-in-struct-fuse_req.patch b/patches.kabi/fuse-handle-kabi-change-in-struct-fuse_req.patch new file mode 100644 index 0000000..6f51cbd --- /dev/null +++ b/patches.kabi/fuse-handle-kabi-change-in-struct-fuse_req.patch @@ -0,0 +1,39 @@ +From: Luís Henriques +Subject: fuse: handle kABI change in struct fuse_req +Patch-mainline: Never, kABI fix +References: bsc#1197343 CVE-2022-1011 + +The backport of commit 0c4bcfdecb1a ("fuse: fix pipe buffer lifetime for +direct_io") requires a kABI fix as it adds a field to struct fuse_reg. +Fortunately, that struct has a hole immediately after the count field, so +using the __GENKSYMS__ magic seems appropriate. Here's the pahole output: + +pahole -C fuse_req fs/fuse/fuse.ko +struct fuse_req { + struct list_head list; /* 0 16 */ + struct list_head intr_entry; /* 16 16 */ + refcount_t count; /* 32 4 */ + + /* XXX 4 bytes hole, try to pack */ + + u64 intr_unique; /* 40 8 */ +... + +Signed-off-by: Luís Henriques + +--- + fs/fuse/fuse_i.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/fuse/fuse_i.h ++++ b/fs/fuse/fuse_i.h +@@ -312,7 +312,9 @@ struct fuse_req { + /** refcount */ + refcount_t count; + ++#ifndef __GENKSYMS__ + bool user_pages; ++#endif + + /** Unique ID for the interrupt request */ + u64 intr_unique; diff --git a/patches.kabi/tcp-fix-race-condition-when-creating-child-sockets-from-syncookies-kABI-fix.patch b/patches.kabi/tcp-fix-race-condition-when-creating-child-sockets-from-syncookies-kABI-fix.patch index b11f480..39e4e47 100644 --- a/patches.kabi/tcp-fix-race-condition-when-creating-child-sockets-from-syncookies-kABI-fix.patch +++ b/patches.kabi/tcp-fix-race-condition-when-creating-child-sockets-from-syncookies-kABI-fix.patch @@ -1,22 +1,22 @@ From: João Silva Subject: kABI fix for tcp: fix race condition when creating child sockets from syncookies -References: bsc#1197075 +References: bsc#1197075 bsc#1199671 Patch-mainline: Never, kABI breakage workaround --- include/net/inet_hashtables.h | 5 +++-- net/dccp/ipv4.c | 2 +- net/dccp/ipv6.c | 2 +- - net/ipv4/inet_hashtables.c | 15 ++++++++++----- + net/ipv4/inet_hashtables.c | 17 ++++++++++++----- net/ipv4/tcp_ipv4.c | 4 ++-- net/ipv6/tcp_ipv6.c | 4 ++-- - 6 files changed, 19 insertions(+), 13 deletions(-) + 6 files changed, 21 insertions(+), 13 deletions(-) --- a/include/net/inet_hashtables.h +++ b/include/net/inet_hashtables.h @@ -210,8 +210,9 @@ void inet_put_port(struct sock *sk); void inet_hashinfo_init(struct inet_hashinfo *h); - + bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk); -bool inet_ehash_nolisten(struct sock *sk, struct sock *osk, - bool *found_dup_sk); @@ -29,7 +29,7 @@ Patch-mainline: Never, kABI breakage workaround --- a/net/dccp/ipv4.c +++ b/net/dccp/ipv4.c @@ -428,7 +428,7 @@ struct sock *dccp_v4_request_recv_sock(c - + if (__inet_inherit_port(sk, newsk) < 0) goto put_and_exit; - *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash), NULL); @@ -53,7 +53,7 @@ Patch-mainline: Never, kABI breakage workaround @@ -478,7 +478,13 @@ bool inet_ehash_insert(struct sock *sk, return ret; } - + -bool inet_ehash_nolisten(struct sock *sk, struct sock *osk, bool *found_dup_sk) +bool inet_ehash_nolisten(struct sock *sk, struct sock *osk) +{ @@ -64,25 +64,27 @@ Patch-mainline: Never, kABI breakage workaround +bool inet_ehash_nolisten3(struct sock *sk, struct sock *osk, bool *found_dup_sk) { bool ok = inet_ehash_insert(sk, osk, found_dup_sk); - -@@ -492,7 +498,6 @@ bool inet_ehash_nolisten(struct sock *sk + +@@ -492,7 +498,8 @@ bool inet_ehash_nolisten(struct sock *sk } return ok; } -EXPORT_SYMBOL_GPL(inet_ehash_nolisten); - ++ ++EXPORT_SYMBOL_GPL(inet_ehash_nolisten3); + static int inet_reuseport_add_sock(struct sock *sk, struct inet_listen_hashbucket *ilb) -@@ -522,7 +527,7 @@ int __inet_hash(struct sock *sk, struct +@@ -522,7 +529,7 @@ int __inet_hash(struct sock *sk, struct int err = 0; - + if (sk->sk_state != TCP_LISTEN) { - inet_ehash_nolisten(sk, osk, NULL); + inet_ehash_nolisten(sk, osk); return 0; } WARN_ON(!sk_unhashed(sk)); -@@ -612,7 +617,7 @@ int __inet_hash_connect(struct inet_time +@@ -623,7 +630,7 @@ int __inet_hash_connect(struct inet_time tb = inet_csk(sk)->icsk_bind_hash; spin_lock_bh(&head->lock); if (sk_head(&tb->owners) == sk && !sk->sk_bind_node.next) { @@ -91,7 +93,7 @@ Patch-mainline: Never, kABI breakage workaround spin_unlock_bh(&head->lock); return 0; } -@@ -688,7 +693,7 @@ ok: +@@ -707,7 +714,7 @@ ok: inet_bind_hash(sk, tb, port); if (sk_unhashed(sk)) { inet_sk(sk)->inet_sport = htons(port); @@ -103,7 +105,7 @@ Patch-mainline: Never, kABI breakage workaround --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -1376,8 +1376,8 @@ struct sock *tcp_v4_syn_recv_sock(const - + if (__inet_inherit_port(sk, newsk) < 0) goto put_and_exit; - *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash), @@ -125,4 +127,4 @@ Patch-mainline: Never, kABI breakage workaround + &found_dup_sk); if (*own_req) { tcp_move_syn(newtp, req); - + diff --git a/patches.rpmify/elfcore-correct-reference-to-CONFIG_UML.patch b/patches.rpmify/elfcore-correct-reference-to-CONFIG_UML.patch new file mode 100644 index 0000000..eb3dc3e --- /dev/null +++ b/patches.rpmify/elfcore-correct-reference-to-CONFIG_UML.patch @@ -0,0 +1,54 @@ +From: Lukas Bulwahn +Date: Mon, 18 Oct 2021 15:16:09 -0700 +Subject: elfcore: correct reference to CONFIG_UML +Git-commit: b0e901280d9860a0a35055f220e8e457f300f40a +Patch-mainline: v5.15-rc7 +References: git-fixes + +Commit 6e7b64b9dd6d ("elfcore: fix building with clang") introduces +special handling for two architectures, ia64 and User Mode Linux. +However, the wrong name, i.e., CONFIG_UM, for the intended Kconfig +symbol for User-Mode Linux was used. + +Although the directory for User Mode Linux is ./arch/um; the Kconfig +symbol for this architecture is called CONFIG_UML. + +Luckily, ./scripts/checkkconfigsymbols.py warns on non-existing configs: + + UM + Referencing files: include/linux/elfcore.h + Similar symbols: UML, NUMA + +Correct the name of the config to the intended one. + +[akpm@linux-foundation.org: fix um/x86_64, per Catalin] + Link: https://lkml.kernel.org/r/20211006181119.2851441-1-catalin.marinas@arm.com + Link: https://lkml.kernel.org/r/YV6pejGzLy5ppEpt@arm.com + +Link: https://lkml.kernel.org/r/20211006082209.417-1-lukas.bulwahn@gmail.com +Fixes: 6e7b64b9dd6d ("elfcore: fix building with clang") +Signed-off-by: Lukas Bulwahn +Cc: Arnd Bergmann +Cc: Nathan Chancellor +Cc: Nick Desaulniers +Cc: Catalin Marinas +Cc: Barret Rhoden +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Acked-by: Miroslav Benes +--- + include/linux/elfcore.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/elfcore.h ++++ b/include/linux/elfcore.h +@@ -57,7 +57,7 @@ static inline int elf_core_copy_task_xfp + } + #endif + +-#if defined(CONFIG_UM) || defined(CONFIG_IA64) ++#if (defined(CONFIG_UML) && defined(CONFIG_X86_32)) || defined(CONFIG_IA64) + /* + * These functions parameterize elf_core_dump in fs/binfmt_elf.c to write out + * extra segments containing the gate DSO contents. Dumping its diff --git a/patches.rpmify/elfcore-fix-building-with-clang.patch b/patches.rpmify/elfcore-fix-building-with-clang.patch new file mode 100644 index 0000000..b274120 --- /dev/null +++ b/patches.rpmify/elfcore-fix-building-with-clang.patch @@ -0,0 +1,105 @@ +From: Arnd Bergmann +Date: Fri, 11 Dec 2020 13:36:46 -0800 +Subject: elfcore: fix building with clang +Git-commit: 6e7b64b9dd6d96537d816ea07ec26b7dedd397b9 +Patch-mainline: v5.10 +References: bsc#1169514 + +kernel/elfcore.c only contains weak symbols, which triggers a bug with +clang in combination with recordmcount: + + Cannot find symbol for section 2: .text. + kernel/elfcore.o: failed + +Move the empty stubs into linux/elfcore.h as inline functions. As only +two architectures use these, just use the architecture specific Kconfig +symbols to key off the declaration. + +Link: https://lkml.kernel.org/r/20201204165742.3815221-2-arnd@kernel.org +Signed-off-by: Arnd Bergmann +Cc: Nathan Chancellor +Cc: Nick Desaulniers +Cc: Barret Rhoden +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Acked-by: Miroslav Benes +--- + include/linux/elfcore.h | 22 ++++++++++++++++++++++ + kernel/Makefile | 1 - + kernel/elfcore.c | 24 ------------------------ + 3 files changed, 22 insertions(+), 25 deletions(-) + +--- a/include/linux/elfcore.h ++++ b/include/linux/elfcore.h +@@ -57,6 +57,7 @@ static inline int elf_core_copy_task_xfp + } + #endif + ++#if defined(CONFIG_UM) || defined(CONFIG_IA64) + /* + * These functions parameterize elf_core_dump in fs/binfmt_elf.c to write out + * extra segments containing the gate DSO contents. Dumping its +@@ -71,5 +72,26 @@ elf_core_write_extra_phdrs(struct coredu + extern int + elf_core_write_extra_data(struct coredump_params *cprm); + extern size_t elf_core_extra_data_size(void); ++#else ++static inline Elf_Half elf_core_extra_phdrs(void) ++{ ++ return 0; ++} ++ ++static inline int elf_core_write_extra_phdrs(struct coredump_params *cprm, loff_t offset) ++{ ++ return 1; ++} ++ ++static inline int elf_core_write_extra_data(struct coredump_params *cprm) ++{ ++ return 1; ++} ++ ++static inline size_t elf_core_extra_data_size(void) ++{ ++ return 0; ++} ++#endif + + #endif /* _LINUX_ELFCORE_H */ +--- a/kernel/Makefile ++++ b/kernel/Makefile +@@ -90,7 +90,6 @@ obj-$(CONFIG_TASK_DELAY_ACCT) += delayac + obj-$(CONFIG_TASKSTATS) += taskstats.o tsacct.o + obj-$(CONFIG_TRACEPOINTS) += tracepoint.o + obj-$(CONFIG_LATENCYTOP) += latencytop.o +-obj-$(CONFIG_ELFCORE) += elfcore.o + obj-$(CONFIG_FUNCTION_TRACER) += trace/ + obj-$(CONFIG_TRACING) += trace/ + obj-$(CONFIG_TRACE_CLOCK) += trace/ +--- a/kernel/elfcore.c ++++ /dev/null +@@ -1,24 +0,0 @@ +-#include +-#include +-#include +-#include +- +-Elf_Half __weak elf_core_extra_phdrs(void) +-{ +- return 0; +-} +- +-int __weak elf_core_write_extra_phdrs(struct coredump_params *cprm, loff_t offset) +-{ +- return 1; +-} +- +-int __weak elf_core_write_extra_data(struct coredump_params *cprm) +-{ +- return 1; +-} +- +-size_t __weak elf_core_extra_data_size(void) +-{ +- return 0; +-} diff --git a/patches.suse/0001-ARM-9110-1-oabi-compat-fix-oabi-epoll-sparse-warning.patch b/patches.suse/0001-ARM-9110-1-oabi-compat-fix-oabi-epoll-sparse-warning.patch new file mode 100644 index 0000000..3779c6a --- /dev/null +++ b/patches.suse/0001-ARM-9110-1-oabi-compat-fix-oabi-epoll-sparse-warning.patch @@ -0,0 +1,48 @@ +From da0b9ee43c152401f711e522c19b1468c84907bf Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Wed, 11 Aug 2021 08:30:27 +0100 +Subject: ARM: 9110/1: oabi-compat: fix oabi epoll sparse warning +Git-commit: da0b9ee43c152401f711e522c19b1468c84907bf +Patch-mainline: v5.15-rc1 +References: bsc#1129770 + +As my patches change the oabi epoll definition, I received a report +from the kernel test robot about a pre-existing issue with a mismatched +__poll_t type. + +The OABI code was correct when it was initially added in linux-2.16, +but a later (also correct) change to the generic __poll_t triggered a +type mismatch warning from sparse. + +As __poll_t is always 32-bit bits wide and otherwise compatible, using +this instead of __u32 in the oabi_epoll_event definition is a valid +workaround. + +Reported-by: kernel test robot +Fixes: 8ced390c2b18 ("define __poll_t, annotate constants") +Fixes: ee219b946e4b ("uapi: turn __poll_t sparse checks on by default") +Fixes: 687ad0191488 ("[ARM] 3109/1: old ABI compat: syscall wrappers for ABI impedance matching") +Acked-by: Christoph Hellwig +Signed-off-by: Arnd Bergmann +Signed-off-by: Russell King (Oracle) +Acked-by: Thomas Zimmermann +--- + arch/arm/kernel/sys_oabi-compat.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c +index 223ee46b6e75e..68112c172025c 100644 +--- a/arch/arm/kernel/sys_oabi-compat.c ++++ b/arch/arm/kernel/sys_oabi-compat.c +@@ -274,7 +274,7 @@ asmlinkage long sys_oabi_fcntl64(unsigned int fd, unsigned int cmd, + } + + struct oabi_epoll_event { +- __u32 events; ++ __poll_t events; + __u64 data; + } __attribute__ ((packed,aligned(4))); + +-- +2.36.0 + diff --git a/patches.suse/0001-btrfs-extent-tree-kill-BUG_ON-in-__btrfs_free_extent.patch b/patches.suse/0001-btrfs-extent-tree-kill-BUG_ON-in-__btrfs_free_extent.patch new file mode 100644 index 0000000..ea89521 --- /dev/null +++ b/patches.suse/0001-btrfs-extent-tree-kill-BUG_ON-in-__btrfs_free_extent.patch @@ -0,0 +1,293 @@ +From 1c2a07f598d526e39acbf1837b8d521fc0dab9c5 Mon Sep 17 00:00:00 2001 +References: CVE-2019-19377 bsc#1158266 +Git-commit: 1c2a07f598d526e39acbf1837b8d521fc0dab9c5 +Patch-mainline: v5.10 +From: Qu Wenruo +Date: Wed, 19 Aug 2020 14:35:48 +0800 +Subject: [PATCH 1/2] btrfs: extent-tree: kill BUG_ON() in + __btrfs_free_extent() + +__btrfs_free_extent() is doing two things: + +1. Reduce the refs number of an extent backref + Either it's an inline extent backref (inside EXTENT/METADATA item) or + a keyed extent backref (SHARED_* item). + We only need to locate that backref line, either reduce the number or + remove the backref line completely. + +2. Update the refs count in EXTENT/METADATA_ITEM + +During step 1), we will try to locate the EXTENT/METADATA_ITEM without +triggering another btrfs_search_slot() as fast path. + +Only when we fail to locate that item, we will trigger another +btrfs_search_slot() to get that EXTENT/METADATA_ITEM after we +updated/deleted the backref line. + +And we have a lot of strict checks on things like refs_to_drop against +extent refs and special case checks for single ref extents. + +There are 7 BUG_ON()s, although they're doing correct checks, they can +be triggered by crafted images. + +This patch improves the function: + +- Introduce two examples to show what __btrfs_free_extent() is doing + One inline backref case and one keyed case. Should cover most cases. + +- Kill all BUG_ON()s with proper error message and optional leaf dump + +- Add comment to show the overall flow + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=202819 +[ The report triggers one BUG_ON() in __btrfs_free_extent() ] +Reviewed-by: Nikolay Borisov +Reviewed-by: Josef Bacik +Signed-off-by: Qu Wenruo +Signed-off-by: David Sterba +--- + fs/btrfs/extent-tree.c | 160 +++++++++++++++++++++++++++++++++++++++++++++---- + 1 file changed, 147 insertions(+), 13 deletions(-) + +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -6892,6 +6892,65 @@ int btrfs_finish_extent_commit(struct bt + return 0; + } + ++/* ++ * Drop one or more refs of @node. ++ * ++ * 1. Locate the extent refs. ++ * It's either inline in EXTENT/METADATA_ITEM or in keyed SHARED_* item. ++ * Locate it, then reduce the refs number or remove the ref line completely. ++ * ++ * 2. Update the refs count in EXTENT/METADATA_ITEM ++ * ++ * Inline backref case: ++ * ++ * in extent tree we have: ++ * ++ * item 0 key (13631488 EXTENT_ITEM 1048576) itemoff 16201 itemsize 82 ++ * refs 2 gen 6 flags DATA ++ * extent data backref root FS_TREE objectid 258 offset 0 count 1 ++ * extent data backref root FS_TREE objectid 257 offset 0 count 1 ++ * ++ * This function gets called with: ++ * ++ * node->bytenr = 13631488 ++ * node->num_bytes = 1048576 ++ * root_objectid = FS_TREE ++ * owner_objectid = 257 ++ * owner_offset = 0 ++ * refs_to_drop = 1 ++ * ++ * Then we should get some like: ++ * ++ * item 0 key (13631488 EXTENT_ITEM 1048576) itemoff 16201 itemsize 82 ++ * refs 1 gen 6 flags DATA ++ * extent data backref root FS_TREE objectid 258 offset 0 count 1 ++ * ++ * Keyed backref case: ++ * ++ * in extent tree we have: ++ * ++ * item 0 key (13631488 EXTENT_ITEM 1048576) itemoff 3971 itemsize 24 ++ * refs 754 gen 6 flags DATA ++ * [...] ++ * item 2 key (13631488 EXTENT_DATA_REF ) itemoff 3915 itemsize 28 ++ * extent data backref root FS_TREE objectid 866 offset 0 count 1 ++ * ++ * This function get called with: ++ * ++ * node->bytenr = 13631488 ++ * node->num_bytes = 1048576 ++ * root_objectid = FS_TREE ++ * owner_objectid = 866 ++ * owner_offset = 0 ++ * refs_to_drop = 1 ++ * ++ * Then we should get some like: ++ * ++ * item 0 key (13631488 EXTENT_ITEM 1048576) itemoff 3971 itemsize 24 ++ * refs 753 gen 6 flags DATA ++ * ++ * And that (13631488 EXTENT_DATA_REF ) gets removed. ++ */ + static int __btrfs_free_extent(struct btrfs_trans_handle *trans, + struct btrfs_fs_info *info, + struct btrfs_delayed_ref_node *node, u64 parent, +@@ -6925,7 +6984,15 @@ static int __btrfs_free_extent(struct bt + path->leave_spinning = 1; + + is_data = owner_objectid >= BTRFS_FIRST_FREE_OBJECTID; +- BUG_ON(!is_data && refs_to_drop != 1); ++ ++ if (!is_data && refs_to_drop != 1) { ++ btrfs_crit(info, ++"invalid refs_to_drop, dropping more than 1 refs for tree block %llu refs_to_drop %u", ++ node->bytenr, refs_to_drop); ++ ret = -EINVAL; ++ btrfs_abort_transaction(trans, ret); ++ goto out; ++ } + + if (is_data) + skinny_metadata = 0; +@@ -6935,6 +7002,13 @@ static int __btrfs_free_extent(struct bt + root_objectid, owner_objectid, + owner_offset); + if (ret == 0) { ++ /* ++ * Either the inline backref or the SHARED_DATA_REF/ ++ * SHARED_BLOCK_REF is found ++ * ++ * Here is a quick path to locate EXTENT/METADATA_ITEM. ++ * It's possible the EXTENT/METADATA_ITEM is near current slot. ++ */ + extent_slot = path->slots[0]; + while (extent_slot >= 0) { + btrfs_item_key_to_cpu(path->nodes[0], &key, +@@ -6951,6 +7025,8 @@ static int __btrfs_free_extent(struct bt + found_extent = 1; + break; + } ++ ++ /* Quick path didn't find the EXTEMT/METADATA_ITEM */ + if (path->slots[0] - extent_slot > 5) + break; + extent_slot--; +@@ -6961,7 +7037,13 @@ static int __btrfs_free_extent(struct bt + found_extent = 0; + #endif + if (!found_extent) { +- BUG_ON(iref); ++ if (iref) { ++ btrfs_crit(info, ++"invalid iref, no EXTENT/METADATA_ITEM found but has inline extent ref"); ++ btrfs_abort_transaction(trans, -EUCLEAN); ++ goto err_dump; ++ } ++ /* Must be SHARED_* item, remove the backref first */ + ret = remove_extent_backref(trans, info, path, NULL, + refs_to_drop, + is_data, &last_ref); +@@ -6972,6 +7054,7 @@ static int __btrfs_free_extent(struct bt + btrfs_release_path(path); + path->leave_spinning = 1; + ++ /* Slow path to locate EXTENT/METADATA_ITEM */ + key.objectid = bytenr; + key.type = BTRFS_EXTENT_ITEM_KEY; + key.offset = num_bytes; +@@ -7076,19 +7159,26 @@ static int __btrfs_free_extent(struct bt + if (owner_objectid < BTRFS_FIRST_FREE_OBJECTID && + key.type == BTRFS_EXTENT_ITEM_KEY) { + struct btrfs_tree_block_info *bi; +- BUG_ON(item_size < sizeof(*ei) + sizeof(*bi)); ++ if (item_size < sizeof(*ei) + sizeof(*bi)) { ++ btrfs_crit(info, ++"invalid extent item size for key (%llu, %u, %llu) owner %llu, has %u expect >= %lu", ++ key.objectid, key.type, key.offset, ++ owner_objectid, item_size, ++ sizeof(*ei) + sizeof(*bi)); ++ btrfs_abort_transaction(trans, -EUCLEAN); ++ goto err_dump; ++ } + bi = (struct btrfs_tree_block_info *)(ei + 1); + WARN_ON(owner_objectid != btrfs_tree_block_level(leaf, bi)); + } + + refs = btrfs_extent_refs(leaf, ei); + if (refs < refs_to_drop) { +- btrfs_err(info, +- "trying to drop %d refs but we only have %Lu for bytenr %Lu", ++ btrfs_crit(info, ++ "trying to drop %d refs but we only have %llu for bytenr %llu", + refs_to_drop, refs, bytenr); +- ret = -EINVAL; +- btrfs_abort_transaction(trans, ret); +- goto out; ++ btrfs_abort_transaction(trans, -EUCLEAN); ++ goto err_dump; + } + refs -= refs_to_drop; + +@@ -7100,7 +7190,12 @@ static int __btrfs_free_extent(struct bt + * be updated by remove_extent_backref + */ + if (iref) { +- BUG_ON(!found_extent); ++ if (!found_extent) { ++ btrfs_crit(info, ++"invalid iref, got inlined extent ref but no EXTENT/METADATA_ITEM found"); ++ btrfs_abort_transaction(trans, -EUCLEAN); ++ goto err_dump; ++ } + } else { + btrfs_set_extent_refs(leaf, ei, refs); + btrfs_mark_buffer_dirty(leaf); +@@ -7115,13 +7210,39 @@ static int __btrfs_free_extent(struct bt + } + } + } else { ++ /* In this branch refs == 1 */ + if (found_extent) { +- BUG_ON(is_data && refs_to_drop != +- extent_data_ref_count(path, iref)); ++ if (is_data && refs_to_drop != ++ extent_data_ref_count(path, iref)) { ++ btrfs_crit(info, ++ "invalid refs_to_drop, current refs %u refs_to_drop %u", ++ extent_data_ref_count(path, iref), ++ refs_to_drop); ++ btrfs_abort_transaction(trans, -EUCLEAN); ++ goto err_dump; ++ } + if (iref) { +- BUG_ON(path->slots[0] != extent_slot); ++ if (path->slots[0] != extent_slot) { ++ btrfs_crit(info, ++"invalid iref, extent item key (%llu %u %llu) doesn't have wanted iref", ++ key.objectid, key.type, ++ key.offset); ++ btrfs_abort_transaction(trans, -EUCLEAN); ++ goto err_dump; ++ } + } else { +- BUG_ON(path->slots[0] != extent_slot + 1); ++ /* ++ * No inline ref, we must be at SHARED_* item, ++ * And it's single ref, it must be: ++ * | extent_slot ||extent_slot + 1| ++ * [ EXTENT/METADATA_ITEM ][ SHARED_* ITEM ] ++ */ ++ if (path->slots[0] != extent_slot + 1) { ++ btrfs_crit(info, ++ "invalid SHARED_* item, previous item is not EXTENT/METADATA_ITEM"); ++ btrfs_abort_transaction(trans, -EUCLEAN); ++ goto err_dump; ++ } + path->slots[0] = extent_slot; + num_to_del = 2; + } +@@ -7162,6 +7283,19 @@ static int __btrfs_free_extent(struct bt + out: + btrfs_free_path(path); + return ret; ++err_dump: ++ /* ++ * Leaf dump can take up a lot of log buffer, so we only do full leaf ++ * dump for debug build. ++ */ ++ if (IS_ENABLED(CONFIG_BTRFS_DEBUG)) { ++ btrfs_crit(info, "path->slots[0]=%d extent_slot=%d", ++ path->slots[0], extent_slot); ++ btrfs_print_leaf(info, path->nodes[0]); ++ } ++ ++ btrfs_free_path(path); ++ return -EUCLEAN; + } + + /* diff --git a/patches.suse/0001-drm-vgem-Close-use-after-free-race-in-vgem_gem_creat.patch b/patches.suse/0001-drm-vgem-Close-use-after-free-race-in-vgem_gem_creat.patch new file mode 100644 index 0000000..1b0e01b --- /dev/null +++ b/patches.suse/0001-drm-vgem-Close-use-after-free-race-in-vgem_gem_creat.patch @@ -0,0 +1,70 @@ +From 4b848f20eda5974020f043ca14bacf7a7e634fc8 Mon Sep 17 00:00:00 2001 +From: Daniel Vetter +Date: Sun, 2 Feb 2020 14:21:33 +0100 +Subject: drm/vgem: Close use-after-free race in vgem_gem_create +Git-commit: 4b848f20eda5974020f043ca14bacf7a7e634fc8 +Patch-mainline: v5.6-rc2 +References: CVE-2022-1419 bsc#1198742 + +There's two references floating around here (for the object reference, +not the handle_count reference, that's a different thing): + +- The temporary reference held by vgem_gem_create, acquired by + creating the object and released by calling + drm_gem_object_put_unlocked. + +- The reference held by the object handle, created by + drm_gem_handle_create. This one generally outlives the function, + except if a 2nd thread races with a GEM_CLOSE ioctl call. + +So usually everything is correct, except in that race case, where the +access to gem_object->size could be looking at freed data already. +Which again isn't a real problem (userspace shot its feet off already +with the race, we could return garbage), but maybe someone can exploit +this as an information leak. + +Cc: Dan Carpenter +Cc: Hillf Danton +Reported-by: syzbot+0dc4444774d419e916c8@syzkaller.appspotmail.com +Cc: stable@vger.kernel.org +Cc: Emil Velikov +Cc: Daniel Vetter +Cc: Sean Paul +Cc: Chris Wilson +Cc: Eric Anholt +Cc: Sam Ravnborg +Cc: Rob Clark +Reviewed-by: Chris Wilson +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20200202132133.1891846-1-daniel.vetter@ffwll.ch +Acked-by: Thomas Zimmermann +--- + drivers/gpu/drm/vgem/vgem_drv.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/vgem/vgem_drv.c ++++ b/drivers/gpu/drm/vgem/vgem_drv.c +@@ -190,9 +190,10 @@ static struct drm_gem_object *vgem_gem_c + return ERR_CAST(obj); + + ret = drm_gem_handle_create(file, &obj->base, handle); +- drm_gem_object_put_unlocked(&obj->base); +- if (ret) ++ if (ret) { ++ drm_gem_object_put_unlocked(&obj->base); + return ERR_PTR(ret); ++ } + + return &obj->base; + } +@@ -215,7 +216,9 @@ static int vgem_gem_dumb_create(struct d + args->size = gem_object->size; + args->pitch = pitch; + +- DRM_DEBUG_DRIVER("Created object of size %lld\n", size); ++ drm_gem_object_put_unlocked(gem_object); ++ ++ DRM_DEBUG_DRIVER("Created object of size %llu\n", args->size); + + return 0; + } diff --git a/patches.suse/0002-PCI-Do-not-enable-AtomicOps-on-VFs.patch b/patches.suse/0002-PCI-Do-not-enable-AtomicOps-on-VFs.patch new file mode 100644 index 0000000..3518e31 --- /dev/null +++ b/patches.suse/0002-PCI-Do-not-enable-AtomicOps-on-VFs.patch @@ -0,0 +1,68 @@ +From 5ec0a6fcb60ea430f8ee7e0bec22db9b22f856d3 Mon Sep 17 00:00:00 2001 +From: Selvin Xavier +Date: Sat, 11 Sep 2021 03:03:05 -0700 +Subject: PCI: Do not enable AtomicOps on VFs +Git-commit: 5ec0a6fcb60ea430f8ee7e0bec22db9b22f856d3 +Patch-mainline: v5.16-rc1 +References: bsc#1129770 + +Host crashes when pci_enable_atomic_ops_to_root() is called for VFs with +virtual buses. The virtual buses added to SR-IOV have bus->self set to NULL +and host crashes due to this. + + PID: 4481 TASK: ffff89c6941b0000 CPU: 53 COMMAND: "bash" + ... + #3 [ffff9a9481713808] oops_end at ffffffffb9025cd6 + #4 [ffff9a9481713828] page_fault_oops at ffffffffb906e417 + #5 [ffff9a9481713888] exc_page_fault at ffffffffb9a0ad14 + #6 [ffff9a94817138b0] asm_exc_page_fault at ffffffffb9c00ace + [exception RIP: pcie_capability_read_dword+28] + RIP: ffffffffb952fd5c RSP: ffff9a9481713960 RFLAGS: 00010246 + RAX: 0000000000000001 RBX: ffff89c6b1096000 RCX: 0000000000000000 + RDX: ffff9a9481713990 RSI: 0000000000000024 RDI: 0000000000000000 + RBP: 0000000000000080 R8: 0000000000000008 R9: ffff89c64341a2f8 + R10: 0000000000000002 R11: 0000000000000000 R12: ffff89c648bab000 + R13: 0000000000000000 R14: 0000000000000000 R15: ffff89c648bab0c8 + ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 + #7 [ffff9a9481713988] pci_enable_atomic_ops_to_root at ffffffffb95359a6 + #8 [ffff9a94817139c0] bnxt_qplib_determine_atomics at ffffffffc08c1a33 [bnxt_re] + #9 [ffff9a94817139d0] bnxt_re_dev_init at ffffffffc08ba2d1 [bnxt_re] + +Per PCIe r5.0, sec 9.3.5.10, the AtomicOp Requester Enable bit in Device +Control 2 is reserved for VFs. The PF value applies to all associated VFs. + +Return -EINVAL if pci_enable_atomic_ops_to_root() is called for a VF. + +Link: https://lore.kernel.org/r/1631354585-16597-1-git-send-email-selvin.xavier@broadcom.com +Fixes: 35f5ace5dea4 ("RDMA/bnxt_re: Enable global atomic ops if platform supports") +Fixes: 430a23689dea ("PCI: Add pci_enable_atomic_ops_to_root()") +Signed-off-by: Selvin Xavier +Signed-off-by: Bjorn Helgaas +Reviewed-by: Andy Gospodarek +Acked-by: Thomas Zimmermann +--- + drivers/pci/pci.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index c63598c1cdd85..e55d944ff30f1 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -3719,6 +3719,14 @@ int pci_enable_atomic_ops_to_root(struct pci_dev *dev, u32 cap_mask) + struct pci_dev *bridge; + u32 cap, ctl2; + ++ /* ++ * Per PCIe r5.0, sec 9.3.5.10, the AtomicOp Requester Enable bit ++ * in Device Control 2 is reserved in VFs and the PF value applies ++ * to all associated VFs. ++ */ ++ if (dev->is_virtfn) ++ return -EINVAL; ++ + if (!pci_is_pcie(dev)) + return -EINVAL; + +-- +2.36.0 + diff --git a/patches.suse/0002-backlight-pwm_bl-Improve-bootloader-kernel-device-ha.patch b/patches.suse/0002-backlight-pwm_bl-Improve-bootloader-kernel-device-ha.patch new file mode 100644 index 0000000..0852e60 --- /dev/null +++ b/patches.suse/0002-backlight-pwm_bl-Improve-bootloader-kernel-device-ha.patch @@ -0,0 +1,113 @@ +From 79fad92f2e596f5a8dd085788a24f540263ef887 Mon Sep 17 00:00:00 2001 +From: Daniel Thompson +Date: Thu, 22 Jul 2021 15:46:23 +0100 +Subject: backlight: pwm_bl: Improve bootloader/kernel device handover +Git-commit: 79fad92f2e596f5a8dd085788a24f540263ef887 +Patch-mainline: v5.15-rc1 +References: bsc#1129770 + +Currently there are (at least) two problems in the way pwm_bl starts +managing the enable_gpio pin. Both occur when the backlight is initially +off and the driver finds the pin not already in output mode and, as a +result, unconditionally switches it to output-mode and asserts the signal. + +Problem 1: This could cause the backlight to flicker since, at this stage +in driver initialisation, we have no idea what the PWM and regulator are +doing (an unconfigured PWM could easily "rest" at 100% duty cycle). + +Problem 2: This will cause us not to correctly honour the +post_pwm_on_delay (which also risks flickers). + +Fix this by moving the code to configure the GPIO output mode until after +we have examines the handover state. That allows us to initialize +enable_gpio to off if the backlight is currently off and on if the +backlight is on. + +Cc: stable@vger.kernel.org +Reported-by: Marek Vasut +Signed-off-by: Daniel Thompson +Acked-by: Marek Vasut +Tested-by: Marek Vasut +Signed-off-by: Lee Jones +Acked-by: Thomas Zimmermann +--- + drivers/video/backlight/pwm_bl.c | 54 ++++++++++++++++++++------------------- + 1 file changed, 28 insertions(+), 26 deletions(-) + +--- a/drivers/video/backlight/pwm_bl.c ++++ b/drivers/video/backlight/pwm_bl.c +@@ -199,6 +199,33 @@ static int pwm_backlight_parse_dt(struct + static int pwm_backlight_initial_power_state(const struct pwm_bl_data *pb) + { + struct device_node *node = pb->dev->of_node; ++ bool active = true; ++ ++ /* ++ * If the enable GPIO is present, observable (either as input ++ * or output) and off then the backlight is not currently active. ++ * */ ++ if (pb->enable_gpio && gpiod_get_value_cansleep(pb->enable_gpio) == 0) ++ active = false; ++ ++ if (!regulator_is_enabled(pb->power_supply)) ++ active = false; ++ ++ if (!pwm_is_enabled(pb->pwm)) ++ active = false; ++ ++ /* ++ * Synchronize the enable_gpio with the observed state of the ++ * hardware. ++ */ ++ if (pb->enable_gpio) ++ gpiod_direction_output(pb->enable_gpio, active); ++ ++ /* ++ * Do not change pb->enabled here! pb->enabled essentially ++ * tells us if we own one of the regulator's use counts and ++ * right now we do not. ++ */ + + /* Not booted with device tree or no phandle link to the node */ + if (!node || !node->phandle) +@@ -210,20 +237,7 @@ static int pwm_backlight_initial_power_s + * assume that another driver will enable the backlight at the + * appropriate time. Therefore, if it is disabled, keep it so. + */ +- +- /* if the enable GPIO is disabled, do not enable the backlight */ +- if (pb->enable_gpio && gpiod_get_value_cansleep(pb->enable_gpio) == 0) +- return FB_BLANK_POWERDOWN; +- +- /* The regulator is disabled, do not enable the backlight */ +- if (!regulator_is_enabled(pb->power_supply)) +- return FB_BLANK_POWERDOWN; +- +- /* The PWM is disabled, keep it like this */ +- if (!pwm_is_enabled(pb->pwm)) +- return FB_BLANK_POWERDOWN; +- +- return FB_BLANK_UNBLANK; ++ return active ? FB_BLANK_UNBLANK: FB_BLANK_POWERDOWN; + } + + static int pwm_backlight_probe(struct platform_device *pdev) +@@ -300,18 +314,6 @@ static int pwm_backlight_probe(struct pl + pb->enable_gpio = gpio_to_desc(data->enable_gpio); + } + +- /* +- * If the GPIO is not known to be already configured as output, that +- * is, if gpiod_get_direction returns either 1 or -EINVAL, change the +- * direction to output and set the GPIO as active. +- * Do not force the GPIO to active when it was already output as it +- * could cause backlight flickering or we would enable the backlight too +- * early. Leave the decision of the initial backlight state for later. +- */ +- if (pb->enable_gpio && +- gpiod_get_direction(pb->enable_gpio) != 0) +- gpiod_direction_output(pb->enable_gpio, 1); +- + pb->power_supply = devm_regulator_get(&pdev->dev, "power"); + if (IS_ERR(pb->power_supply)) { + ret = PTR_ERR(pb->power_supply); diff --git a/patches.suse/0002-btrfs-extent-tree-kill-the-BUG_ON-in-insert_inline_e.patch b/patches.suse/0002-btrfs-extent-tree-kill-the-BUG_ON-in-insert_inline_e.patch new file mode 100644 index 0000000..df4c8b6 --- /dev/null +++ b/patches.suse/0002-btrfs-extent-tree-kill-the-BUG_ON-in-insert_inline_e.patch @@ -0,0 +1,93 @@ +From 07cce5cf3b489419aa8e87f48a55f4e190a30876 Mon Sep 17 00:00:00 2001 +References: CVE-2019-19377 bsc#1158266 +Git-commit: 07cce5cf3b489419aa8e87f48a55f4e190a30876 +Patch-mainline: v5.10 +From: Qu Wenruo +Date: Wed, 19 Aug 2020 14:35:49 +0800 +Subject: [PATCH 2/2] btrfs: extent-tree: kill the BUG_ON() in + insert_inline_extent_backref() + +[BUG] +With a crafted image, btrfs can panic at insert_inline_extent_backref(): + + kernel BUG at fs/btrfs/extent-tree.c:1857! + invalid opcode: 0000 [#1] SMP PTI + CPU: 0 PID: 1117 Comm: btrfs-transacti Not tainted 5.0.0-rc8+ #9 + RIP: 0010:insert_inline_extent_backref+0xcc/0xe0 + RSP: 0018:ffffac4dc1287be8 EFLAGS: 00010293 + RAX: 0000000000000000 RBX: 0000000000000007 RCX: 0000000000000001 + RDX: 0000000000001000 RSI: 0000000000000000 RDI: 0000000000000000 + RBP: ffffac4dc1287c28 R08: ffffac4dc1287ab8 R09: ffffac4dc1287ac0 + R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 + R13: ffff8febef88a540 R14: ffff8febeaa7bc30 R15: 0000000000000000 + FS: 0000000000000000(0000) GS:ffff8febf7a00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007f663ace94c0 CR3: 0000000235698006 CR4: 00000000000206f0 + Call Trace: + ? _cond_resched+0x1a/0x50 + __btrfs_inc_extent_ref.isra.64+0x7e/0x240 + ? btrfs_merge_delayed_refs+0xa5/0x330 + __btrfs_run_delayed_refs+0x653/0x1120 + btrfs_run_delayed_refs+0xdb/0x1b0 + btrfs_commit_transaction+0x52/0x950 + ? start_transaction+0x94/0x450 + transaction_kthread+0x163/0x190 + kthread+0x105/0x140 + ? btrfs_cleanup_transaction+0x560/0x560 + ? kthread_destroy_worker+0x50/0x50 + ret_from_fork+0x35/0x40 + Modules linked in: + ---[ end trace 2ad8b3de903cf825 ]--- + +[CAUSE] +Due to extent tree corruption (still valid by itself, but bad cross +ref), we can allocate an extent which is still in extent tree. The +offending tree block of that case is from csum tree. The newly +allocated tree block is also for csum tree. + +Then we will try to insert a tree block ref for the existing tree block +ref. + +For a tree extent item, tree block can never be shared directly by the +same tree twice. We have such BUG_ON() to prevent such problem, but +this is not a proper error handling. + +[FIX] +Replace that BUG_ON() with proper error message and leaf dump for debug +build. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=202829 +Reviewed-by: Nikolay Borisov +Reviewed-by: Josef Bacik +Signed-off-by: Qu Wenruo +Signed-off-by: David Sterba +--- + fs/btrfs/extent-tree.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -2008,7 +2008,22 @@ int insert_inline_extent_backref(struct + bytenr, num_bytes, parent, + root_objectid, owner, offset, 1); + if (ret == 0) { +- BUG_ON(owner < BTRFS_FIRST_FREE_OBJECTID); ++ /* ++ * We're adding refs to a tree block we already own, this ++ * should not happen at all. ++ */ ++ if (owner < BTRFS_FIRST_FREE_OBJECTID) { ++ btrfs_crit(trans->fs_info, ++"adding refs to an existing tree ref, bytenr %llu num_bytes %llu root_objectid %llu", ++ bytenr, num_bytes, root_objectid); ++ if (IS_ENABLED(CONFIG_BTRFS_DEBUG)) { ++ WARN_ON(1); ++ btrfs_crit(trans->fs_info, ++ "path->slots[0]=%d path->nodes[0]:", path->slots[0]); ++ btrfs_print_leaf(trans->fs_info, path->nodes[0]); ++ } ++ return -EUCLEAN; ++ } + update_inline_extent_backref(fs_info, path, iref, + refs_to_add, extent_op, NULL); + } else if (ret == -ENOENT) { diff --git a/patches.suse/0003-fbmem-don-t-allow-too-huge-resolutions.patch b/patches.suse/0003-fbmem-don-t-allow-too-huge-resolutions.patch new file mode 100644 index 0000000..21ca5cd --- /dev/null +++ b/patches.suse/0003-fbmem-don-t-allow-too-huge-resolutions.patch @@ -0,0 +1,63 @@ +From 8c28051cdcbe9dfcec6bd0a4709d67a09df6edae Mon Sep 17 00:00:00 2001 +From: Tetsuo Handa +Date: Wed, 8 Sep 2021 19:27:49 +0900 +Subject: fbmem: don't allow too huge resolutions +Git-commit: 8c28051cdcbe9dfcec6bd0a4709d67a09df6edae +Patch-mainline: v5.15-rc1 +References: bsc#1129770 + +syzbot is reporting page fault at vga16fb_fillrect() [1], for +vga16fb_check_var() is failing to detect multiplication overflow. + + if (vxres * vyres > maxmem) { + vyres = maxmem / vxres; + if (vyres < yres) + return -ENOMEM; + } + +Since no module would accept too huge resolutions where multiplication +overflow happens, let's reject in the common path. + +Link: https://syzkaller.appspot.com/bug?extid=04168c8063cfdde1db5e [1] +Reported-by: syzbot +Debugged-by: Randy Dunlap +Signed-off-by: Tetsuo Handa +Reviewed-by: Geert Uytterhoeven +Cc: stable@vger.kernel.org +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/185175d6-227a-7b55-433d-b070929b262c@i-love.sakura.ne.jp +Acked-by: Thomas Zimmermann +--- + drivers/video/fbdev/core/fbmem.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/video/fbdev/core/fbmem.c ++++ b/drivers/video/fbdev/core/fbmem.c +@@ -954,6 +954,7 @@ fb_set_var(struct fb_info *info, struct + { + int flags = info->flags; + int ret = 0; ++ u32 unused; + + if (var->activate & FB_ACTIVATE_INV_MODE) { + struct fb_videomode mode1, mode2; +@@ -1006,6 +1007,11 @@ fb_set_var(struct fb_info *info, struct + if (var->xres < 8 || var->yres < 8) + return -EINVAL; + ++ /* Too huge resolution causes multiplication overflow. */ ++ if (check_mul_overflow(var->xres, var->yres, &unused) || ++ check_mul_overflow(var->xres_virtual, var->yres_virtual, &unused)) ++ return -EINVAL; ++ + ret = info->fbops->fb_check_var(var, info); + + if (ret) +@@ -1895,6 +1901,7 @@ EXPORT_SYMBOL(unregister_framebuffer); + void fb_set_suspend(struct fb_info *info, int state) + { + struct fb_event event; ++ u32 unused; + + event.info = info; + if (state) { diff --git a/patches.suse/0003-video-backlight-Drop-maximum-brightness-override-for.patch b/patches.suse/0003-video-backlight-Drop-maximum-brightness-override-for.patch new file mode 100644 index 0000000..bbe91da --- /dev/null +++ b/patches.suse/0003-video-backlight-Drop-maximum-brightness-override-for.patch @@ -0,0 +1,54 @@ +From 33a5471f8da976bf271a1ebbd6b9d163cb0cb6aa Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Tue, 21 Sep 2021 19:35:06 +0200 +Subject: video: backlight: Drop maximum brightness override for brightness + zero +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Git-commit: 33a5471f8da976bf271a1ebbd6b9d163cb0cb6aa +Patch-mainline: v5.16-rc1 +References: bsc#1129770 + +The note in c2adda27d202f ("video: backlight: Add of_find_backlight helper +in backlight.c") says that gpio-backlight uses brightness as power state. +This has been fixed since in ec665b756e6f7 ("backlight: gpio-backlight: +Correct initial power state handling") and other backlight drivers do not +require this workaround. Drop the workaround. + +This fixes the case where e.g. pwm-backlight can perfectly well be set to +brightness 0 on boot in DT, which without this patch leads to the display +brightness to be max instead of off. + +Fixes: c2adda27d202f ("video: backlight: Add of_find_backlight helper in backlight.c") +Cc: # 5.4+ +Cc: # 4.19.x: ec665b756e6f7: backlight: gpio-backlight: Correct initial power state handling +Signed-off-by: Marek Vasut +Acked-by: Noralf Trønnes +Reviewed-by: Daniel Thompson +Signed-off-by: Lee Jones +Acked-by: Thomas Zimmermann +--- + drivers/video/backlight/backlight.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/video/backlight/backlight.c b/drivers/video/backlight/backlight.c +index 537fe1b376ad7..fc990e576340b 100644 +--- a/drivers/video/backlight/backlight.c ++++ b/drivers/video/backlight/backlight.c +@@ -688,12 +688,6 @@ static struct backlight_device *of_find_backlight(struct device *dev) + of_node_put(np); + if (!bd) + return ERR_PTR(-EPROBE_DEFER); +- /* +- * Note: gpio_backlight uses brightness as +- * power state during probe +- */ +- if (!bd->props.brightness) +- bd->props.brightness = bd->props.max_brightness; + } + } + +-- +2.36.0 + diff --git a/patches.suse/0004-video-fbdev-chipsfb-use-memset_io-instead-of-memset.patch b/patches.suse/0004-video-fbdev-chipsfb-use-memset_io-instead-of-memset.patch new file mode 100644 index 0000000..5edf577 --- /dev/null +++ b/patches.suse/0004-video-fbdev-chipsfb-use-memset_io-instead-of-memset.patch @@ -0,0 +1,83 @@ +From f2719b26ae27282c145202ffd656d5ff1fe737cc Mon Sep 17 00:00:00 2001 +From: Christophe Leroy +Date: Wed, 15 Sep 2021 15:34:35 +0200 +Subject: video: fbdev: chipsfb: use memset_io() instead of memset() +Git-commit: f2719b26ae27282c145202ffd656d5ff1fe737cc +Patch-mainline: v5.16-rc1 +References: bsc#1129770 + +While investigating a lockup at startup on Powerbook 3400C, it was +identified that the fbdev driver generates alignment exception at +startup: + + --- interrupt: 600 at memset+0x60/0xc0 + NIP: c0021414 LR: c03fc49c CTR: 00007fff + REGS: ca021c10 TRAP: 0600 Tainted: G W (5.14.2-pmac-00727-g12a41fa69492) + MSR: 00009032 CR: 44008442 XER: 20000100 + DAR: cab80020 DSISR: 00017c07 + GPR00: 00000007 ca021cd0 c14412e0 cab80000 00000000 00100000 cab8001c 00000004 + GPR08: 00100000 00007fff 00000000 00000000 84008442 00000000 c0006fb4 00000000 + GPR16: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00100000 + GPR24: 00000000 81800000 00000320 c15fa400 c14d1878 00000000 c14d1800 c094e19c + NIP [c0021414] memset+0x60/0xc0 + LR [c03fc49c] chipsfb_pci_init+0x160/0x580 + --- interrupt: 600 + [ca021cd0] [c03fc46c] chipsfb_pci_init+0x130/0x580 (unreliable) + [ca021d20] [c03a3a70] pci_device_probe+0xf8/0x1b8 + [ca021d50] [c043d584] really_probe.part.0+0xac/0x388 + [ca021d70] [c043d914] __driver_probe_device+0xb4/0x170 + [ca021d90] [c043da18] driver_probe_device+0x48/0x144 + [ca021dc0] [c043e318] __driver_attach+0x11c/0x1c4 + [ca021de0] [c043ad30] bus_for_each_dev+0x88/0xf0 + [ca021e10] [c043c724] bus_add_driver+0x190/0x22c + [ca021e40] [c043ee94] driver_register+0x9c/0x170 + [ca021e60] [c0006c28] do_one_initcall+0x54/0x1ec + [ca021ed0] [c08246e4] kernel_init_freeable+0x1c0/0x270 + [ca021f10] [c0006fdc] kernel_init+0x28/0x11c + [ca021f30] [c0017148] ret_from_kernel_thread+0x14/0x1c + Instruction dump: + 7d4601a4 39490777 7d4701a4 39490888 7d4801a4 39490999 7d4901a4 39290aaa + 7d2a01a4 4c00012c 4bfffe88 0fe00000 <4bfffe80> 9421fff0 38210010 48001970 + +This is due to 'dcbz' instruction being used on non-cached memory. +'dcbz' instruction is used by memset() to zeroize a complete +cacheline at once, and memset() is not expected to be used on non +cached memory. + +When performing a 'sparse' check on fbdev driver, it also appears +that the use of memset() is unexpected: + + drivers/video/fbdev/chipsfb.c:334:17: warning: incorrect type in argument 1 (different address spaces) + drivers/video/fbdev/chipsfb.c:334:17: expected void * + drivers/video/fbdev/chipsfb.c:334:17: got char [noderef] __iomem *screen_base + drivers/video/fbdev/chipsfb.c:334:15: warning: memset with byte count of 1048576 + +Use fb_memset() instead of memset(). fb_memset() is defined as +memset_io() for powerpc. + +Fixes: 8c8709334cec ("[PATCH] ppc32: Remove CONFIG_PMAC_PBOOK") +Reported-by: Stan Johnson +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/884a54f1e5cb774c1d9b4db780209bee5d4f6718.1631712563.git.christophe.leroy@csgroup.eu +Acked-by: Thomas Zimmermann +--- + drivers/video/fbdev/chipsfb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c +index 998067b701fa0..393894af26f84 100644 +--- a/drivers/video/fbdev/chipsfb.c ++++ b/drivers/video/fbdev/chipsfb.c +@@ -331,7 +331,7 @@ static const struct fb_var_screeninfo chipsfb_var = { + + static void init_chips(struct fb_info *p, unsigned long addr) + { +- memset(p->screen_base, 0, 0x100000); ++ fb_memset(p->screen_base, 0, 0x100000); + + p->fix = chipsfb_fix; + p->fix.smem_start = addr; +-- +2.36.0 + diff --git a/patches.suse/0005-parisc-sticon-fix-reverse-colors.patch b/patches.suse/0005-parisc-sticon-fix-reverse-colors.patch new file mode 100644 index 0000000..e803d3b --- /dev/null +++ b/patches.suse/0005-parisc-sticon-fix-reverse-colors.patch @@ -0,0 +1,44 @@ +From bec05f33ebc1006899c6d3e59a00c58881fe7626 Mon Sep 17 00:00:00 2001 +From: Sven Schnelle +Date: Sun, 14 Nov 2021 17:08:17 +0100 +Subject: parisc/sticon: fix reverse colors +Git-commit: bec05f33ebc1006899c6d3e59a00c58881fe7626 +Patch-mainline: v5.16-rc2 +References: bsc#1129770 + +sticon_build_attr() checked the reverse argument and flipped +background and foreground color, but returned the non-reverse +value afterwards. Fix this and also add two local variables +for foreground and background color to make the code easier +to read. + +Signed-off-by: Sven Schnelle +Cc: +Signed-off-by: Helge Deller +Acked-by: Thomas Zimmermann +--- + drivers/video/console/sticon.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/video/console/sticon.c ++++ b/drivers/video/console/sticon.c +@@ -291,13 +291,13 @@ static unsigned long sticon_getxy(struct + static u8 sticon_build_attr(struct vc_data *conp, u8 color, u8 intens, + u8 blink, u8 underline, u8 reverse, u8 italic) + { +- u8 attr = ((color & 0x70) >> 1) | ((color & 7)); ++ u8 fg = color & 7; ++ u8 bg = (color & 0x70) >> 4; + +- if (reverse) { +- color = ((color >> 3) & 0x7) | ((color & 0x7) << 3); +- } +- +- return attr; ++ if (reverse) ++ return (fg << 3) | bg; ++ else ++ return (bg << 3) | fg; + } + + static void sticon_invert_region(struct vc_data *conp, u16 *p, int count) diff --git a/patches.suse/0005-video-hyperv_fb-Fix-validation-of-screen-resolution.patch b/patches.suse/0005-video-hyperv_fb-Fix-validation-of-screen-resolution.patch new file mode 100644 index 0000000..9e16b5b --- /dev/null +++ b/patches.suse/0005-video-hyperv_fb-Fix-validation-of-screen-resolution.patch @@ -0,0 +1,98 @@ +From 9ff5549b1d1d3c3a9d71220d44bd246586160f1d Mon Sep 17 00:00:00 2001 +From: Michael Kelley +Date: Sun, 16 Jan 2022 11:18:31 -0800 +Subject: video: hyperv_fb: Fix validation of screen resolution +Git-commit: 9ff5549b1d1d3c3a9d71220d44bd246586160f1d +Patch-mainline: v5.17-rc2 +References: bsc#1129770 + +In the WIN10 version of the Synthetic Video protocol with Hyper-V, +Hyper-V reports a list of supported resolutions as part of the protocol +negotiation. The driver calculates the maximum width and height from +the list of resolutions, and uses those maximums to validate any screen +resolution specified in the video= option on the kernel boot line. + +This method of validation is incorrect. For example, the list of +supported resolutions could contain 1600x1200 and 1920x1080, both of +which fit in an 8 Mbyte frame buffer. But calculating the max width +and height yields 1920 and 1200, and 1920x1200 resolution does not fit +in an 8 Mbyte frame buffer. Unfortunately, this resolution is accepted, +causing a kernel fault when the driver accesses memory outside the +frame buffer. + +Instead, validate the specified screen resolution by calculating +its size, and comparing against the frame buffer size. Delete the +code for calculating the max width and height from the list of +resolutions, since these max values have no use. Also add the +frame buffer size to the info message to aid in understanding why +a resolution might be rejected. + +Fixes: 67e7cdb4829d ("video: hyperv: hyperv_fb: Obtain screen resolution from Hyper-V host") +Signed-off-by: Michael Kelley +Reviewed-by: Haiyang Zhang +Acked-by: Helge Deller +Link: https://lore.kernel.org/r/1642360711-2335-1-git-send-email-mikelley@microsoft.com +Signed-off-by: Wei Liu +Acked-by: Thomas Zimmermann +--- + drivers/video/fbdev/hyperv_fb.c | 16 +++------------- + 1 file changed, 3 insertions(+), 13 deletions(-) + +diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c +index 23999df527393..c8e0ea27caf1d 100644 +--- a/drivers/video/fbdev/hyperv_fb.c ++++ b/drivers/video/fbdev/hyperv_fb.c +@@ -287,8 +287,6 @@ struct hvfb_par { + + static uint screen_width = HVFB_WIDTH; + static uint screen_height = HVFB_HEIGHT; +-static uint screen_width_max = HVFB_WIDTH; +-static uint screen_height_max = HVFB_HEIGHT; + static uint screen_depth; + static uint screen_fb_size; + static uint dio_fb_size; /* FB size for deferred IO */ +@@ -582,7 +580,6 @@ static int synthvid_get_supported_resolution(struct hv_device *hdev) + int ret = 0; + unsigned long t; + u8 index; +- int i; + + memset(msg, 0, sizeof(struct synthvid_msg)); + msg->vid_hdr.type = SYNTHVID_RESOLUTION_REQUEST; +@@ -613,13 +610,6 @@ static int synthvid_get_supported_resolution(struct hv_device *hdev) + goto out; + } + +- for (i = 0; i < msg->resolution_resp.resolution_count; i++) { +- screen_width_max = max_t(unsigned int, screen_width_max, +- msg->resolution_resp.supported_resolution[i].width); +- screen_height_max = max_t(unsigned int, screen_height_max, +- msg->resolution_resp.supported_resolution[i].height); +- } +- + screen_width = + msg->resolution_resp.supported_resolution[index].width; + screen_height = +@@ -941,7 +931,7 @@ static void hvfb_get_option(struct fb_info *info) + + if (x < HVFB_WIDTH_MIN || y < HVFB_HEIGHT_MIN || + (synthvid_ver_ge(par->synthvid_version, SYNTHVID_VERSION_WIN10) && +- (x > screen_width_max || y > screen_height_max)) || ++ (x * y * screen_depth / 8 > screen_fb_size)) || + (par->synthvid_version == SYNTHVID_VERSION_WIN8 && + x * y * screen_depth / 8 > SYNTHVID_FB_SIZE_WIN8) || + (par->synthvid_version == SYNTHVID_VERSION_WIN7 && +@@ -1194,8 +1184,8 @@ static int hvfb_probe(struct hv_device *hdev, + } + + hvfb_get_option(info); +- pr_info("Screen resolution: %dx%d, Color depth: %d\n", +- screen_width, screen_height, screen_depth); ++ pr_info("Screen resolution: %dx%d, Color depth: %d, Frame buffer size: %d\n", ++ screen_width, screen_height, screen_depth, screen_fb_size); + + ret = hvfb_getmem(hdev, info); + if (ret) { +-- +2.36.0 + diff --git a/patches.suse/0006-drm-fb-helper-Mark-screen-buffers-in-system-memory-w.patch b/patches.suse/0006-drm-fb-helper-Mark-screen-buffers-in-system-memory-w.patch new file mode 100644 index 0000000..408f90b --- /dev/null +++ b/patches.suse/0006-drm-fb-helper-Mark-screen-buffers-in-system-memory-w.patch @@ -0,0 +1,50 @@ +From cd9f7f7ac5932129fe81b4c7559cfcb226ec7c5c Mon Sep 17 00:00:00 2001 +From: Thomas Zimmermann +Date: Tue, 1 Feb 2022 12:53:05 +0100 +Subject: drm/fb-helper: Mark screen buffers in system memory with + FBINFO_VIRTFB +Git-commit: cd9f7f7ac5932129fe81b4c7559cfcb226ec7c5c +Patch-mainline: v5.18-rc1 +References: bsc#1129770 + +Mark screen buffers in system memory with FBINFO_VIRTFB. Otherwise, fbdev +deferred I/O marks mmap'ed areas of system memory with VM_IO. (There's an +inverse relationship between the two flags.) + +For shadow buffers, also set the FBINFO_READS_FAST hint. + +v3: + * change FB_ to FBINFO_ in commit description +v2: + * updated commit description (Daniel) + * added Fixes tag + +Signed-off-by: Thomas Zimmermann +Fixes: d536540f304c ("drm/fb-helper: Add generic fbdev emulation .fb_probe function") +Reviewed-by: Daniel Vetter +Cc: dri-devel@lists.freedesktop.org +Cc: # v4.19+ +Link: https://patchwork.freedesktop.org/patch/msgid/20220201115305.9333-1-tzimmermann@suse.de +Acked-by: Thomas Zimmermann +--- + drivers/gpu/drm/drm_fb_helper.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/drm_fb_helper.c ++++ b/drivers/gpu/drm/drm_fb_helper.c +@@ -3083,6 +3083,7 @@ int drm_fb_helper_generic_probe(struct d + fbi->fix.smem_len = fbi->screen_size; + fbi->screen_buffer = buffer->vaddr; + strcpy(fbi->fix.id, "DRM emulated"); ++ fbi->flags = FBINFO_DEFAULT; + + drm_fb_helper_fill_fix(fbi, fb->pitches[0], fb->format->depth); + drm_fb_helper_fill_var(fbi, fb_helper, sizes->fb_width, sizes->fb_height); +@@ -3106,6 +3107,7 @@ int drm_fb_helper_generic_probe(struct d + *fbops = *fbi->fbops; + fbi->fbops = fbops; + fbi->screen_buffer = shadow; ++ fbi->flags |= FBINFO_VIRTFB | FBINFO_READS_FAST; + fbi->fbdefio = &drm_fbdev_defio; + + fb_deferred_io_init(fbi); diff --git a/patches.suse/0008-video-fbdev-smscufx-Fix-null-ptr-deref-in-ufx_usb_pr.patch b/patches.suse/0008-video-fbdev-smscufx-Fix-null-ptr-deref-in-ufx_usb_pr.patch new file mode 100644 index 0000000..0cb6043 --- /dev/null +++ b/patches.suse/0008-video-fbdev-smscufx-Fix-null-ptr-deref-in-ufx_usb_pr.patch @@ -0,0 +1,61 @@ +From 1791f487f877a9e83d81c8677bd3e7b259e7cb27 Mon Sep 17 00:00:00 2001 +From: Wang Hai +Date: Thu, 14 Oct 2021 21:22:31 +0800 +Subject: video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() +Git-commit: 1791f487f877a9e83d81c8677bd3e7b259e7cb27 +Patch-mainline: v5.18-rc1 +References: bsc#1129770 + +I got a null-ptr-deref report: + +BUG: kernel NULL pointer dereference, address: 0000000000000000 +... +RIP: 0010:fb_destroy_modelist+0x38/0x100 +... +Call Trace: + ufx_usb_probe.cold+0x2b5/0xac1 [smscufx] + usb_probe_interface+0x1aa/0x3c0 [usbcore] + really_probe+0x167/0x460 +... + ret_from_fork+0x1f/0x30 + +If fb_alloc_cmap() fails in ufx_usb_probe(), fb_destroy_modelist() will +be called to destroy modelist in the error handling path. But modelist +has not been initialized yet, so it will result in null-ptr-deref. + +Initialize modelist before calling fb_alloc_cmap() to fix this bug. + +Fixes: 3c8a63e22a08 ("Add support for SMSC UFX6000/7000 USB display adapters") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Acked-by: Thomas Zimmermann +Signed-off-by: Helge Deller +Acked-by: Thomas Zimmermann +--- + drivers/video/fbdev/smscufx.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c +index bfac3ee4a6422..28768c272b73d 100644 +--- a/drivers/video/fbdev/smscufx.c ++++ b/drivers/video/fbdev/smscufx.c +@@ -1656,6 +1656,7 @@ static int ufx_usb_probe(struct usb_interface *interface, + info->par = dev; + info->pseudo_palette = dev->pseudo_palette; + info->fbops = &ufx_ops; ++ INIT_LIST_HEAD(&info->modelist); + + retval = fb_alloc_cmap(&info->cmap, 256, 0); + if (retval < 0) { +@@ -1666,8 +1667,6 @@ static int ufx_usb_probe(struct usb_interface *interface, + INIT_DELAYED_WORK(&dev->free_framebuffer_work, + ufx_free_framebuffer_work); + +- INIT_LIST_HEAD(&info->modelist); +- + retval = ufx_reg_read(dev, 0x3000, &id_rev); + check_warn_goto_error(retval, "error %d reading 0x3000 register from device", retval); + dev_dbg(dev->gdev, "ID_REV register value 0x%08x", id_rev); +-- +2.36.0 + diff --git a/patches.suse/0009-video-fbdev-atmel_lcdfb-fix-an-error-code-in-atmel_l.patch b/patches.suse/0009-video-fbdev-atmel_lcdfb-fix-an-error-code-in-atmel_l.patch new file mode 100644 index 0000000..31b07b4 --- /dev/null +++ b/patches.suse/0009-video-fbdev-atmel_lcdfb-fix-an-error-code-in-atmel_l.patch @@ -0,0 +1,30 @@ +From fee5c1e4b789e41719af9fee0e2dd397cd31988f Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 3 Dec 2021 12:58:08 +0300 +Subject: video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe() +Git-commit: fee5c1e4b789e41719af9fee0e2dd397cd31988f +Patch-mainline: v5.18-rc1 +References: bsc#1129770 + +If "sinfo->config" is not found, then return -ENODEV. Don't +return success. + +Fixes: b985172b328a ("video: atmel_lcdfb: add device tree suport") +Signed-off-by: Dan Carpenter +Acked-by: Nicolas Ferre +Signed-off-by: Helge Deller +Acked-by: Thomas Zimmermann +--- + drivers/video/fbdev/atmel_lcdfb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/video/fbdev/atmel_lcdfb.c ++++ b/drivers/video/fbdev/atmel_lcdfb.c +@@ -1211,6 +1211,7 @@ static int __init atmel_lcdfb_probe(stru + goto free_info; + } + ++ ret = -ENODEV; + if (!sinfo->config) + goto free_info; + diff --git a/patches.suse/0010-video-fbdev-fbcvt.c-fix-printing-in-fb_cvt_print_nam.patch b/patches.suse/0010-video-fbdev-fbcvt.c-fix-printing-in-fb_cvt_print_nam.patch new file mode 100644 index 0000000..fd4bdeb --- /dev/null +++ b/patches.suse/0010-video-fbdev-fbcvt.c-fix-printing-in-fb_cvt_print_nam.patch @@ -0,0 +1,110 @@ +From 78482af095abd9f4f29f1aa3fe575d25c6ae3028 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 16 Sep 2021 16:29:19 +0300 +Subject: video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() +Git-commit: 78482af095abd9f4f29f1aa3fe575d25c6ae3028 +Patch-mainline: v5.18-rc1 +References: bsc#1129770 + +This code has two bugs: +1) "cnt" is 255 but the size of the buffer is 256 so the last byte is + not used. +2) If we try to print more than 255 characters then "cnt" will be + negative and that will trigger a WARN() in snprintf(). The fix for + this is to use scnprintf() instead of snprintf(). + +We can re-write this code to be cleaner: +1) Rename "offset" to "off" because that's shorter. +2) Get rid of the "cnt" variable and just use "size - off" directly. +3) Get rid of the "read" variable and just increment "off" directly. + +Fixes: 96fe6a2109db ("fbdev: Add VESA Coordinated Video Timings (CVT) support") +Signed-off-by: Dan Carpenter +Signed-off-by: Helge Deller +Acked-by: Thomas Zimmermann +--- + drivers/video/fbdev/core/fbcvt.c | 53 +++++++++++++------------------- + 1 file changed, 21 insertions(+), 32 deletions(-) + +diff --git a/drivers/video/fbdev/core/fbcvt.c b/drivers/video/fbdev/core/fbcvt.c +index 55d2bd0ce5c02..64843464c6613 100644 +--- a/drivers/video/fbdev/core/fbcvt.c ++++ b/drivers/video/fbdev/core/fbcvt.c +@@ -214,9 +214,11 @@ static u32 fb_cvt_aspect_ratio(struct fb_cvt_data *cvt) + static void fb_cvt_print_name(struct fb_cvt_data *cvt) + { + u32 pixcount, pixcount_mod; +- int cnt = 255, offset = 0, read = 0; +- u8 *buf = kzalloc(256, GFP_KERNEL); ++ int size = 256; ++ int off = 0; ++ u8 *buf; + ++ buf = kzalloc(size, GFP_KERNEL); + if (!buf) + return; + +@@ -224,43 +226,30 @@ static void fb_cvt_print_name(struct fb_cvt_data *cvt) + pixcount_mod = (cvt->xres * (cvt->yres/cvt->interlace)) % 1000000; + pixcount_mod /= 1000; + +- read = snprintf(buf+offset, cnt, "fbcvt: %dx%d@%d: CVT Name - ", +- cvt->xres, cvt->yres, cvt->refresh); +- offset += read; +- cnt -= read; ++ off += scnprintf(buf + off, size - off, "fbcvt: %dx%d@%d: CVT Name - ", ++ cvt->xres, cvt->yres, cvt->refresh); + +- if (cvt->status) +- snprintf(buf+offset, cnt, "Not a CVT standard - %d.%03d Mega " +- "Pixel Image\n", pixcount, pixcount_mod); +- else { +- if (pixcount) { +- read = snprintf(buf+offset, cnt, "%d", pixcount); +- cnt -= read; +- offset += read; +- } ++ if (cvt->status) { ++ off += scnprintf(buf + off, size - off, ++ "Not a CVT standard - %d.%03d Mega Pixel Image\n", ++ pixcount, pixcount_mod); ++ } else { ++ if (pixcount) ++ off += scnprintf(buf + off, size - off, "%d", pixcount); + +- read = snprintf(buf+offset, cnt, ".%03dM", pixcount_mod); +- cnt -= read; +- offset += read; ++ off += scnprintf(buf + off, size - off, ".%03dM", pixcount_mod); + + if (cvt->aspect_ratio == 0) +- read = snprintf(buf+offset, cnt, "3"); ++ off += scnprintf(buf + off, size - off, "3"); + else if (cvt->aspect_ratio == 3) +- read = snprintf(buf+offset, cnt, "4"); ++ off += scnprintf(buf + off, size - off, "4"); + else if (cvt->aspect_ratio == 1 || cvt->aspect_ratio == 4) +- read = snprintf(buf+offset, cnt, "9"); ++ off += scnprintf(buf + off, size - off, "9"); + else if (cvt->aspect_ratio == 2) +- read = snprintf(buf+offset, cnt, "A"); +- else +- read = 0; +- cnt -= read; +- offset += read; +- +- if (cvt->flags & FB_CVT_FLAG_REDUCED_BLANK) { +- read = snprintf(buf+offset, cnt, "-R"); +- cnt -= read; +- offset += read; +- } ++ off += scnprintf(buf + off, size - off, "A"); ++ ++ if (cvt->flags & FB_CVT_FLAG_REDUCED_BLANK) ++ off += scnprintf(buf + off, size - off, "-R"); + } + + printk(KERN_INFO "%s\n", buf); +-- +2.36.0 + diff --git a/patches.suse/0011-video-fbdev-atari-Atari-2-bpp-STe-palette-bugfix.patch b/patches.suse/0011-video-fbdev-atari-Atari-2-bpp-STe-palette-bugfix.patch new file mode 100644 index 0000000..9d6bd9d --- /dev/null +++ b/patches.suse/0011-video-fbdev-atari-Atari-2-bpp-STe-palette-bugfix.patch @@ -0,0 +1,66 @@ +From c8be5edbd36ceed2ff3d6b8f8e40643c3f396ea3 Mon Sep 17 00:00:00 2001 +From: Michael Schmitz +Date: Wed, 16 Feb 2022 20:26:25 +1300 +Subject: video: fbdev: atari: Atari 2 bpp (STe) palette bugfix +Git-commit: c8be5edbd36ceed2ff3d6b8f8e40643c3f396ea3 +Patch-mainline: v5.18-rc1 +References: bsc#1129770 + +The code to set the shifter STe palette registers has a long +standing operator precedence bug, manifesting as colors set +on a 2 bits per pixel frame buffer coming up with a distinctive +blue tint. + +Add parentheses around the calculation of the per-color palette +data before shifting those into their respective bit field position. + +This bug goes back a long way (2.4 days at the very least) so there +won't be a Fixes: tag. + +Tested on ARAnyM as well on Falcon030 hardware. + +Cc: stable@vger.kernel.org +Reported-by: Geert Uytterhoeven +Link: https://lore.kernel.org/all/CAMuHMdU3ievhXxKR_xi_v3aumnYW7UNUO6qMdhgfyWTyVSsCkQ@mail.gmail.com +Tested-by: Michael Schmitz +Tested-by: Geert Uytterhoeven +Signed-off-by: Michael Schmitz +Signed-off-by: Helge Deller +Acked-by: Thomas Zimmermann +--- + drivers/video/fbdev/atafb.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/video/fbdev/atafb.c b/drivers/video/fbdev/atafb.c +index e95333e004744..52a35b6616438 100644 +--- a/drivers/video/fbdev/atafb.c ++++ b/drivers/video/fbdev/atafb.c +@@ -1681,9 +1681,9 @@ static int falcon_setcolreg(unsigned int regno, unsigned int red, + ((blue & 0xfc00) >> 8)); + if (regno < 16) { + shifter_tt.color_reg[regno] = +- (((red & 0xe000) >> 13) | ((red & 0x1000) >> 12) << 8) | +- (((green & 0xe000) >> 13) | ((green & 0x1000) >> 12) << 4) | +- ((blue & 0xe000) >> 13) | ((blue & 0x1000) >> 12); ++ ((((red & 0xe000) >> 13) | ((red & 0x1000) >> 12)) << 8) | ++ ((((green & 0xe000) >> 13) | ((green & 0x1000) >> 12)) << 4) | ++ ((blue & 0xe000) >> 13) | ((blue & 0x1000) >> 12); + ((u32 *)info->pseudo_palette)[regno] = ((red & 0xf800) | + ((green & 0xfc00) >> 5) | + ((blue & 0xf800) >> 11)); +@@ -1969,9 +1969,9 @@ static int stste_setcolreg(unsigned int regno, unsigned int red, + green >>= 12; + if (ATARIHW_PRESENT(EXTD_SHIFTER)) + shifter_tt.color_reg[regno] = +- (((red & 0xe) >> 1) | ((red & 1) << 3) << 8) | +- (((green & 0xe) >> 1) | ((green & 1) << 3) << 4) | +- ((blue & 0xe) >> 1) | ((blue & 1) << 3); ++ ((((red & 0xe) >> 1) | ((red & 1) << 3)) << 8) | ++ ((((green & 0xe) >> 1) | ((green & 1) << 3)) << 4) | ++ ((blue & 0xe) >> 1) | ((blue & 1) << 3); + else + shifter_tt.color_reg[regno] = + ((red & 0xe) << 7) | +-- +2.36.0 + diff --git a/patches.suse/0012-video-fbdev-sm712fb-Fix-crash-in-smtcfb_read.patch b/patches.suse/0012-video-fbdev-sm712fb-Fix-crash-in-smtcfb_read.patch new file mode 100644 index 0000000..7766415 --- /dev/null +++ b/patches.suse/0012-video-fbdev-sm712fb-Fix-crash-in-smtcfb_read.patch @@ -0,0 +1,79 @@ +From bd771cf5c4254511cc4abb88f3dab3bd58bdf8e8 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sun, 27 Feb 2022 08:43:56 +0100 +Subject: video: fbdev: sm712fb: Fix crash in smtcfb_read() +Git-commit: bd771cf5c4254511cc4abb88f3dab3bd58bdf8e8 +Patch-mainline: v5.18-rc1 +References: bsc#1129770 + +Zheyu Ma reported this crash in the sm712fb driver when reading +three bytes from the framebuffer: + + BUG: unable to handle page fault for address: ffffc90001ffffff + RIP: 0010:smtcfb_read+0x230/0x3e0 + Call Trace: + vfs_read+0x198/0xa00 + ? do_sys_openat2+0x27d/0x350 + ? __fget_light+0x54/0x340 + ksys_read+0xce/0x190 + do_syscall_64+0x43/0x90 + +Fix it by removing the open-coded endianess fixup-code and +by moving the pointer post decrement out the fb_readl() function. + +Reported-by: Zheyu Ma +Signed-off-by: Helge Deller +Tested-by: Zheyu Ma +Cc: stable@vger.kernel.org +Acked-by: Thomas Zimmermann +--- + drivers/video/fbdev/sm712fb.c | 25 +++++++------------------ + 1 file changed, 7 insertions(+), 18 deletions(-) + +diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c +index 0dbc6bf8268ac..b60a2730f0a8a 100644 +--- a/drivers/video/fbdev/sm712fb.c ++++ b/drivers/video/fbdev/sm712fb.c +@@ -1047,7 +1047,7 @@ static ssize_t smtcfb_read(struct fb_info *info, char __user *buf, + if (count + p > total_size) + count = total_size - p; + +- buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count, GFP_KERNEL); ++ buffer = kmalloc(PAGE_SIZE, GFP_KERNEL); + if (!buffer) + return -ENOMEM; + +@@ -1059,24 +1059,13 @@ static ssize_t smtcfb_read(struct fb_info *info, char __user *buf, + while (count) { + c = (count > PAGE_SIZE) ? PAGE_SIZE : count; + dst = buffer; +- for (i = c >> 2; i--;) { +- *dst = fb_readl(src++); +- *dst = big_swap(*dst); +- dst++; +- } +- if (c & 3) { +- u8 *dst8 = (u8 *)dst; +- u8 __iomem *src8 = (u8 __iomem *)src; ++ for (i = (c + 3) >> 2; i--;) { ++ u32 val; + +- for (i = c & 3; i--;) { +- if (i & 1) { +- *dst8++ = fb_readb(++src8); +- } else { +- *dst8++ = fb_readb(--src8); +- src8 += 2; +- } +- } +- src = (u32 __iomem *)src8; ++ val = fb_readl(src); ++ *dst = big_swap(val); ++ src++; ++ dst++; + } + + if (copy_to_user(buf, buffer, c)) { +-- +2.36.0 + diff --git a/patches.suse/0013-video-fbdev-omapfb-Add-missing-of_node_put-in-dvic_p.patch b/patches.suse/0013-video-fbdev-omapfb-Add-missing-of_node_put-in-dvic_p.patch new file mode 100644 index 0000000..303959e --- /dev/null +++ b/patches.suse/0013-video-fbdev-omapfb-Add-missing-of_node_put-in-dvic_p.patch @@ -0,0 +1,34 @@ +From a58c22cfbbf62fefca090334bbd35fd132e92a23 Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Mon, 7 Mar 2022 12:38:12 +0000 +Subject: video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of +Git-commit: a58c22cfbbf62fefca090334bbd35fd132e92a23 +Patch-mainline: v5.18-rc1 +References: bsc#1129770 + +The device_node pointer is returned by of_parse_phandle() with refcount +incremented. We should use of_node_put() on it when done. + +Fixes: f76ee892a99e ("omapfb: copy omapdss & displays for omapfb") +Signed-off-by: Miaoqian Lin +Signed-off-by: Helge Deller +Acked-by: Thomas Zimmermann +--- + drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c b/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c +index 2fa436475b406..c8ad3ef42bd31 100644 +--- a/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c ++++ b/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c +@@ -246,6 +246,7 @@ static int dvic_probe_of(struct platform_device *pdev) + adapter_node = of_parse_phandle(node, "ddc-i2c-bus", 0); + if (adapter_node) { + adapter = of_get_i2c_adapter_by_node(adapter_node); ++ of_node_put(adapter_node); + if (adapter == NULL) { + dev_err(&pdev->dev, "failed to parse ddc-i2c-bus\n"); + omap_dss_put_device(ddata->in); +-- +2.36.0 + diff --git a/patches.suse/0014-video-fbdev-udlfb-properly-check-endpoint-type.patch b/patches.suse/0014-video-fbdev-udlfb-properly-check-endpoint-type.patch new file mode 100644 index 0000000..41cb9e7 --- /dev/null +++ b/patches.suse/0014-video-fbdev-udlfb-properly-check-endpoint-type.patch @@ -0,0 +1,71 @@ +From aaf7dbe07385e0b8deb7237eca2a79926bbc7091 Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Tue, 22 Mar 2022 23:04:38 +0300 +Subject: video: fbdev: udlfb: properly check endpoint type +Git-commit: aaf7dbe07385e0b8deb7237eca2a79926bbc7091 +Patch-mainline: v5.18-rc5 +References: bsc#1129770 + +syzbot reported warning in usb_submit_urb, which is caused by wrong +endpoint type. + +This driver uses out bulk endpoint for communication, so +let's check if this endpoint is present and bail out early if not. + +Fail log: + +usb 1-1: BOGUS urb xfer, pipe 3 != type 1 +WARNING: CPU: 0 PID: 4822 at drivers/usb/core/urb.c:493 usb_submit_urb+0xd27/0x1540 drivers/usb/core/urb.c:493 +Modules linked in: +CPU: 0 PID: 4822 Comm: kworker/0:3 Tainted: G W 5.13.0-syzkaller #0 +... +Workqueue: usb_hub_wq hub_event +RIP: 0010:usb_submit_urb+0xd27/0x1540 drivers/usb/core/urb.c:493 +... +Call Trace: + dlfb_submit_urb+0x89/0x160 drivers/video/fbdev/udlfb.c:1969 + dlfb_set_video_mode+0x21f0/0x2950 drivers/video/fbdev/udlfb.c:315 + dlfb_ops_set_par+0x2a3/0x840 drivers/video/fbdev/udlfb.c:1110 + dlfb_usb_probe.cold+0x113e/0x1f4a drivers/video/fbdev/udlfb.c:1732 + usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396 + +Fixes: 88e58b1a42f8 ("Staging: add udlfb driver") +Reported-and-tested-by: syzbot+53ce4a4246d0fe0fee34@syzkaller.appspotmail.com +Signed-off-by: Pavel Skripkin +Signed-off-by: Helge Deller +Acked-by: Thomas Zimmermann +--- + drivers/video/fbdev/udlfb.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/video/fbdev/udlfb.c ++++ b/drivers/video/fbdev/udlfb.c +@@ -1593,6 +1593,7 @@ static int dlfb_usb_probe(struct usb_int + struct usb_device *usbdev; + struct dlfb_data *dev; + int retval = -ENOMEM; ++ struct usb_endpoint_descriptor *out; + + /* usb initialization */ + +@@ -1610,6 +1611,12 @@ static int dlfb_usb_probe(struct usb_int + dev->gdev = &usbdev->dev; /* our generic struct device * */ + usb_set_intfdata(interface, dev); + ++ retval = usb_find_common_endpoints(intf->cur_altsetting, NULL, &out, NULL, NULL); ++ if (retval) { ++ dev_err(&intf->dev, "Device should have at lease 1 bulk endpoint!\n"); ++ goto error; ++ } ++ + pr_info("%s %s - serial #%s\n", + usbdev->manufacturer, usbdev->product, usbdev->serial); + pr_info("vid_%04x&pid_%04x&rev_%04x driver's dlfb_data struct at %p\n", +@@ -1624,6 +1631,7 @@ static int dlfb_usb_probe(struct usb_int + + if (!dlfb_parse_vendor_descriptor(dev, interface)) { + pr_err("firmware not recognized. Assume incompatible device\n"); ++ retval = -ENODEV; + goto error; + } + diff --git a/patches.suse/ACPI-property-Release-subnode-properties-with-data-n.patch b/patches.suse/ACPI-property-Release-subnode-properties-with-data-n.patch new file mode 100644 index 0000000..5b3565b --- /dev/null +++ b/patches.suse/ACPI-property-Release-subnode-properties-with-data-n.patch @@ -0,0 +1,69 @@ +From 3bd561e1572ee02a50cd1a5be339abf1a5b78d56 Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Wed, 6 Apr 2022 16:12:08 +0300 +Subject: [PATCH] ACPI: property: Release subnode properties with data nodes +Git-commit: 3bd561e1572ee02a50cd1a5be339abf1a5b78d56 +References: git-fixes +Patch-mainline: v5.19-rc1 + +struct acpi_device_properties describes one source of properties present +on either struct acpi_device or struct acpi_data_node. When properties are +parsed, both are populated but when released, only those properties that +are associated with the device node are freed. + +Fix this by also releasing memory of the data node properties. + +Fixes: 5f5e4890d57a ("ACPI / property: Allow multiple property compatible _DSD entries") +Cc: 4.20+ # 4.20+ +Signed-off-by: Sakari Ailus +Reviewed-by: Andy Shevchenko +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Oliver Neukum +--- + drivers/acpi/property.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +--- a/drivers/acpi/property.c ++++ b/drivers/acpi/property.c +@@ -421,6 +421,16 @@ void acpi_init_properties(struct acpi_de + ACPI_DT_NAMESPACE_HID " requires 'compatible' property\n"); + } + ++static void acpi_free_device_properties(struct list_head *list) ++{ ++ struct acpi_device_properties *props, *tmp; ++ ++ list_for_each_entry_safe(props, tmp, list, list) { ++ list_del(&props->list); ++ kfree(props); ++ } ++} ++ + static void acpi_destroy_nondev_subnodes(struct list_head *list) + { + struct acpi_data_node *dn, *next; +@@ -433,22 +443,18 @@ static void acpi_destroy_nondev_subnodes + wait_for_completion(&dn->kobj_done); + list_del(&dn->sibling); + ACPI_FREE((void *)dn->data.pointer); ++ acpi_free_device_properties(&dn->data.properties); + kfree(dn); + } + } + + void acpi_free_properties(struct acpi_device *adev) + { +- struct acpi_device_properties *props, *tmp; +- + acpi_destroy_nondev_subnodes(&adev->data.subnodes); + ACPI_FREE((void *)adev->data.pointer); + adev->data.of_compatible = NULL; + adev->data.pointer = NULL; +- list_for_each_entry_safe(props, tmp, &adev->data.properties, list) { +- list_del(&props->list); +- kfree(props); +- } ++ acpi_free_device_properties(&adev->data.properties); + } + + /** diff --git a/patches.suse/ACPICA-acpi-acpica-fix-acpi-operand-cache-leak-in-ns b/patches.suse/ACPICA-acpi-acpica-fix-acpi-operand-cache-leak-in-ns index 44731d8..d46b588 100644 --- a/patches.suse/ACPICA-acpi-acpica-fix-acpi-operand-cache-leak-in-ns +++ b/patches.suse/ACPICA-acpi-acpica-fix-acpi-operand-cache-leak-in-ns @@ -4,7 +4,7 @@ Date: Wed, 14 Mar 2018 16:12:56 -0700 Subject: [PATCH] ACPICA: acpi: acpica: fix acpi operand cache leak in nseval.c Git-commit: 97f3c0a4b0579b646b6b10ae5a3d59f0441cc12c Patch-mainline: v4.17-rc1 -References: bsc#1051510 +References: CVE-2017-13695 bsc#1055710 bsc#1051510 I found an ACPI cache leak in ACPI early termination and boot continuing case. diff --git a/patches.suse/Input-aiptek-properly-check-endpoint-type.patch b/patches.suse/Input-aiptek-properly-check-endpoint-type.patch new file mode 100644 index 0000000..e14b8e9 --- /dev/null +++ b/patches.suse/Input-aiptek-properly-check-endpoint-type.patch @@ -0,0 +1,67 @@ +From 5600f6986628dde8881734090588474f54a540a8 Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Sun, 13 Mar 2022 22:56:32 -0700 +Subject: [PATCH] Input: aiptek - properly check endpoint type +Git-commit: 5600f6986628dde8881734090588474f54a540a8 +References: git-fixes +Patch-mainline: v5.17 + +Syzbot reported warning in usb_submit_urb() which is caused by wrong +endpoint type. There was a check for the number of endpoints, but not +for the type of endpoint. + +Fix it by replacing old desc.bNumEndpoints check with +usb_find_common_endpoints() helper for finding endpoints + +Fail log: + +usb 5-1: BOGUS urb xfer, pipe 1 != type 3 +WARNING: CPU: 2 PID: 48 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502 +Modules linked in: +CPU: 2 PID: 48 Comm: kworker/2:2 Not tainted 5.17.0-rc6-syzkaller-00226-g07ebd38a0da2 #0 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 +Workqueue: usb_hub_wq hub_event +... +Call Trace: + + aiptek_open+0xd5/0x130 drivers/input/tablet/aiptek.c:830 + input_open_device+0x1bb/0x320 drivers/input/input.c:629 + kbd_connect+0xfe/0x160 drivers/tty/vt/keyboard.c:1593 + +Fixes: 8e20cf2bce12 ("Input: aiptek - fix crash on detecting device without endpoints") +Reported-and-tested-by: syzbot+75cccf2b7da87fb6f84b@syzkaller.appspotmail.com +Signed-off-by: Pavel Skripkin +Link: https://lore.kernel.org/r/20220308194328.26220-1-paskripkin@gmail.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Oliver Neukum +--- + drivers/input/tablet/aiptek.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c +index fcb1b646436a..1581f6ef0927 100644 +--- a/drivers/input/tablet/aiptek.c ++++ b/drivers/input/tablet/aiptek.c +@@ -1787,15 +1787,13 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id) + input_set_abs_params(inputdev, ABS_TILT_Y, AIPTEK_TILT_MIN, AIPTEK_TILT_MAX, 0, 0); + input_set_abs_params(inputdev, ABS_WHEEL, AIPTEK_WHEEL_MIN, AIPTEK_WHEEL_MAX - 1, 0, 0); + +- /* Verify that a device really has an endpoint */ +- if (intf->cur_altsetting->desc.bNumEndpoints < 1) { ++ err = usb_find_common_endpoints(intf->cur_altsetting, ++ NULL, NULL, &endpoint, NULL); ++ if (err) { + dev_err(&intf->dev, +- "interface has %d endpoints, but must have minimum 1\n", +- intf->cur_altsetting->desc.bNumEndpoints); +- err = -EINVAL; ++ "interface has no int in endpoints, but must have minimum 1\n"); + goto fail3; + } +- endpoint = &intf->cur_altsetting->endpoint[0].desc; + + /* Go set up our URB, which is called when the tablet receives + * input. +-- +2.35.3 + diff --git a/patches.suse/Input-appletouch-initialize-work-before-device-regis.patch b/patches.suse/Input-appletouch-initialize-work-before-device-regis.patch new file mode 100644 index 0000000..7a35f90 --- /dev/null +++ b/patches.suse/Input-appletouch-initialize-work-before-device-regis.patch @@ -0,0 +1,55 @@ +From 9f3ccdc3f6ef10084ceb3a47df0961bec6196fd0 Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Thu, 30 Dec 2021 20:57:46 -0800 +Subject: [PATCH] Input: appletouch - initialize work before device + registration +Git-commit: 9f3ccdc3f6ef10084ceb3a47df0961bec6196fd0 +References: git-fixes +Patch-mainline: v5.16-rc8 + +Syzbot has reported warning in __flush_work(). This warning is caused by +work->func == NULL, which means missing work initialization. + +This may happen, since input_dev->close() calls +cancel_work_sync(&dev->work), but dev->work initalization happens _after_ +input_register_device() call. + +So this patch moves dev->work initialization before registering input +device + +Fixes: 5a6eb676d3bc ("Input: appletouch - improve powersaving for Geyser3 devices") +Reported-and-tested-by: syzbot+b88c5eae27386b252bbd@syzkaller.appspotmail.com +Signed-off-by: Pavel Skripkin +Link: https://lore.kernel.org/r/20211230141151.17300-1-paskripkin@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Oliver Neukum +--- + drivers/input/mouse/appletouch.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/input/mouse/appletouch.c b/drivers/input/mouse/appletouch.c +index bfa26651c0be..627048bc6a12 100644 +--- a/drivers/input/mouse/appletouch.c ++++ b/drivers/input/mouse/appletouch.c +@@ -916,6 +916,8 @@ static int atp_probe(struct usb_interface *iface, + set_bit(BTN_TOOL_TRIPLETAP, input_dev->keybit); + set_bit(BTN_LEFT, input_dev->keybit); + ++ INIT_WORK(&dev->work, atp_reinit); ++ + error = input_register_device(dev->input); + if (error) + goto err_free_buffer; +@@ -923,8 +925,6 @@ static int atp_probe(struct usb_interface *iface, + /* save our data pointer in this interface device */ + usb_set_intfdata(iface, dev); + +- INIT_WORK(&dev->work, atp_reinit); +- + return 0; + + err_free_buffer: +-- +2.35.3 + diff --git a/patches.suse/Input-elantench-fix-misreporting-trackpoint-coordina.patch b/patches.suse/Input-elantench-fix-misreporting-trackpoint-coordina.patch new file mode 100644 index 0000000..0f1a3a4 --- /dev/null +++ b/patches.suse/Input-elantench-fix-misreporting-trackpoint-coordina.patch @@ -0,0 +1,49 @@ +From be896bd3b72b44126c55768f14c22a8729b0992e Mon Sep 17 00:00:00 2001 +From: Phoenix Huang +Date: Sun, 7 Nov 2021 22:00:03 -0800 +Subject: [PATCH] Input: elantench - fix misreporting trackpoint coordinates +Git-commit: be896bd3b72b44126c55768f14c22a8729b0992e +References: git-fixes +Patch-mainline: v5.16-rc1 + +Some firmwares occasionally report bogus data from trackpoint, with X or Y +displacement being too large (outside of [-127, 127] range). Let's drop such +packets so that we do not generate jumps. + +Signed-off-by: Phoenix Huang +Tested-by: Yufei Du +Link: https://lore.kernel.org/r/20210729010940.5752-1-phoenix@emc.com.tw +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Oliver Neukum +--- + drivers/input/mouse/elantech.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 2d0bc029619f..956d9cd34796 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -517,6 +517,19 @@ static void elantech_report_trackpoint(struct psmouse *psmouse, + case 0x16008020U: + case 0x26800010U: + case 0x36808000U: ++ ++ /* ++ * This firmware misreport coordinates for trackpoint ++ * occasionally. Discard packets outside of [-127, 127] range ++ * to prevent cursor jumps. ++ */ ++ if (packet[4] == 0x80 || packet[5] == 0x80 || ++ packet[1] >> 7 == packet[4] >> 7 || ++ packet[2] >> 7 == packet[5] >> 7) { ++ elantech_debug("discarding packet [%6ph]\n", packet); ++ break; ++ ++ } + x = packet[4] - (int)((packet[1]^0x80) << 1); + y = (int)((packet[2]^0x80) << 1) - packet[5]; + +-- +2.35.3 + diff --git a/patches.suse/Input-spaceball-fix-parsing-of-movement-data-packets.patch b/patches.suse/Input-spaceball-fix-parsing-of-movement-data-packets.patch new file mode 100644 index 0000000..6a8a0da --- /dev/null +++ b/patches.suse/Input-spaceball-fix-parsing-of-movement-data-packets.patch @@ -0,0 +1,61 @@ +From bc7ec91718c49d938849697cfad98fcd9877cc26 Mon Sep 17 00:00:00 2001 +From: "Leo L. Schwab" +Date: Thu, 30 Dec 2021 21:05:00 -0800 +Subject: [PATCH] Input: spaceball - fix parsing of movement data packets +Git-commit: bc7ec91718c49d938849697cfad98fcd9877cc26 +References: git-fixes +Patch-mainline: v5.16-rc8 + +The spaceball.c module was not properly parsing the movement reports +coming from the device. The code read axis data as signed 16-bit +little-endian values starting at offset 2. + +In fact, axis data in Spaceball movement reports are signed 16-bit +big-endian values starting at offset 3. This was determined first by +visually inspecting the data packets, and later verified by consulting: +http://spacemice.org/pdf/SpaceBall_2003-3003_Protocol.pdf + +If this ever worked properly, it was in the time before Git... + +Signed-off-by: Leo L. Schwab +Link: https://lore.kernel.org/r/20211221101630.1146385-1-ewhac@ewhac.org +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Oliver Neukum +--- + drivers/input/joystick/spaceball.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/input/joystick/spaceball.c b/drivers/input/joystick/spaceball.c +index 429411c6c0a8..a85a4f33aea8 100644 +--- a/drivers/input/joystick/spaceball.c ++++ b/drivers/input/joystick/spaceball.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + + #define DRIVER_DESC "SpaceTec SpaceBall 2003/3003/4000 FLX driver" + +@@ -75,9 +76,15 @@ static void spaceball_process_packet(struct spaceball* spaceball) + + case 'D': /* Ball data */ + if (spaceball->idx != 15) return; +- for (i = 0; i < 6; i++) ++ /* ++ * Skip first three bytes; read six axes worth of data. ++ * Axis values are signed 16-bit big-endian. ++ */ ++ data += 3; ++ for (i = 0; i < ARRAY_SIZE(spaceball_axes); i++) { + input_report_abs(dev, spaceball_axes[i], +- (__s16)((data[2 * i + 3] << 8) | data[2 * i + 2])); ++ (__s16)get_unaligned_be16(&data[i * 2])); ++ } + break; + + case 'K': /* Button data */ +-- +2.35.3 + diff --git a/patches.suse/Input-ti_am335x_tsc-fix-STEPCONFIG-setup-for-Z2.patch b/patches.suse/Input-ti_am335x_tsc-fix-STEPCONFIG-setup-for-Z2.patch new file mode 100644 index 0000000..1a89f40 --- /dev/null +++ b/patches.suse/Input-ti_am335x_tsc-fix-STEPCONFIG-setup-for-Z2.patch @@ -0,0 +1,40 @@ +From 6bfeb6c21e1bdc11c328b7d996d20f0f73c6b9b0 Mon Sep 17 00:00:00 2001 +From: Dario Binacchi +Date: Sun, 12 Dec 2021 21:14:48 -0800 +Subject: [PATCH] Input: ti_am335x_tsc - fix STEPCONFIG setup for Z2 +Git-commit: 6bfeb6c21e1bdc11c328b7d996d20f0f73c6b9b0 +References: git-fixes +Patch-mainline: v5.17-rc1 + +The Z2 step configuration doesn't erase the SEL_INP_SWC_3_0 bit-field +before setting the ADC channel. This way its value could be corrupted by +the ADC channel selected for the Z1 coordinate. + +Fixes: 8c896308feae ("input: ti_am335x_adc: use only FIFO0 and clean up a little") +Signed-off-by: Dario Binacchi +Link: https://lore.kernel.org/r/20211212125358.14416-3-dariobin@libero.it +Signed-off-by: Dmitry Torokhov +Signed-off-by: Oliver Neukum +--- + drivers/input/touchscreen/ti_am335x_tsc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/input/touchscreen/ti_am335x_tsc.c b/drivers/input/touchscreen/ti_am335x_tsc.c +index fd3ffdd23470..cfc943423241 100644 +--- a/drivers/input/touchscreen/ti_am335x_tsc.c ++++ b/drivers/input/touchscreen/ti_am335x_tsc.c +@@ -196,7 +196,10 @@ static void titsc_step_config(struct titsc *ts_dev) + STEPCONFIG_OPENDLY); + + end_step++; +- config |= STEPCONFIG_INP(ts_dev->inp_yn); ++ config = STEPCONFIG_MODE_HWSYNC | ++ STEPCONFIG_AVG_16 | ts_dev->bit_yp | ++ ts_dev->bit_xn | STEPCONFIG_INM_ADCREFM | ++ STEPCONFIG_INP(ts_dev->inp_yn); + titsc_writel(ts_dev, REG_STEPCONFIG(end_step), config); + titsc_writel(ts_dev, REG_STEPDELAY(end_step), + STEPCONFIG_OPENDLY); +-- +2.35.3 + diff --git a/patches.suse/Input-ti_am335x_tsc-set-ADCREFM-for-X-configuration.patch b/patches.suse/Input-ti_am335x_tsc-set-ADCREFM-for-X-configuration.patch new file mode 100644 index 0000000..1121b71 --- /dev/null +++ b/patches.suse/Input-ti_am335x_tsc-set-ADCREFM-for-X-configuration.patch @@ -0,0 +1,41 @@ +From 73cca71a903202cddc8279fc76b2da4995da5bea Mon Sep 17 00:00:00 2001 +From: Dario Binacchi +Date: Sun, 12 Dec 2021 21:14:35 -0800 +Subject: [PATCH] Input: ti_am335x_tsc - set ADCREFM for X configuration +Git-commit: 73cca71a903202cddc8279fc76b2da4995da5bea +References: git-fixes +Patch-mainline: v5.17-rc1 + +As reported by the STEPCONFIG[1-16] registered field descriptions of the +TI reference manual, for the ADC "in single ended, SEL_INM_SWC_3_0 must +be 1xxx". + +Unlike the Y and Z coordinates, this bit has not been set for the step +configuration registers used to sample the X coordinate. + +Fixes: 1b8be32e6914 ("Input: add support for TI Touchscreen controller") +Signed-off-by: Dario Binacchi +Link: https://lore.kernel.org/r/20211212125358.14416-2-dariobin@libero.it +Signed-off-by: Dmitry Torokhov +Signed-off-by: Oliver Neukum +--- + drivers/input/touchscreen/ti_am335x_tsc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/input/touchscreen/ti_am335x_tsc.c b/drivers/input/touchscreen/ti_am335x_tsc.c +index 83e685557a19..fd3ffdd23470 100644 +--- a/drivers/input/touchscreen/ti_am335x_tsc.c ++++ b/drivers/input/touchscreen/ti_am335x_tsc.c +@@ -131,7 +131,8 @@ static void titsc_step_config(struct titsc *ts_dev) + u32 stepenable; + + config = STEPCONFIG_MODE_HWSYNC | +- STEPCONFIG_AVG_16 | ts_dev->bit_xp; ++ STEPCONFIG_AVG_16 | ts_dev->bit_xp | ++ STEPCONFIG_INM_ADCREFM; + switch (ts_dev->wires) { + case 4: + config |= STEPCONFIG_INP(ts_dev->inp_yp) | ts_dev->bit_xn; +-- +2.35.3 + diff --git a/patches.suse/Input-xpad-add-support-for-another-USB-ID-of-Nacon-G.patch b/patches.suse/Input-xpad-add-support-for-another-USB-ID-of-Nacon-G.patch new file mode 100644 index 0000000..048a9ad --- /dev/null +++ b/patches.suse/Input-xpad-add-support-for-another-USB-ID-of-Nacon-G.patch @@ -0,0 +1,43 @@ +From 3378a07daa6cdd11e042797454c706d1c69f9ca6 Mon Sep 17 00:00:00 2001 +From: Michael Cullen +Date: Fri, 15 Oct 2021 13:17:50 -0700 +Subject: [PATCH] Input: xpad - add support for another USB ID of Nacon GC-100 +Git-commit: 3378a07daa6cdd11e042797454c706d1c69f9ca6 +References: git-fixes +Patch-mainline: v5.15-rc6 + +The Nacon GX100XF is already mapped, but it seems there is a Nacon +GC-100 (identified as NC5136Wht PCGC-100WHITE though I believe other +colours exist) with a different USB ID when in XInput mode. + +Signed-off-by: Michael Cullen +Link: https://lore.kernel.org/r/20211015192051.5196-1-michael@michaelcullen.name +Signed-off-by: Dmitry Torokhov +Signed-off-by: Oliver Neukum +--- + drivers/input/joystick/xpad.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index 29de8412e416..4c914f75a902 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -334,6 +334,7 @@ static const struct xpad_device { + { 0x24c6, 0x5b03, "Thrustmaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 }, + { 0x24c6, 0x5d04, "Razer Sabertooth", 0, XTYPE_XBOX360 }, + { 0x24c6, 0xfafe, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 }, ++ { 0x3285, 0x0607, "Nacon GC-100", 0, XTYPE_XBOX360 }, + { 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX }, + { 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX }, + { 0x0000, 0x0000, "Generic X-Box pad", 0, XTYPE_UNKNOWN } +@@ -451,6 +452,7 @@ static const struct usb_device_id xpad_table[] = { + XPAD_XBOXONE_VENDOR(0x24c6), /* PowerA Controllers */ + XPAD_XBOXONE_VENDOR(0x2e24), /* Hyperkin Duke X-Box One pad */ + XPAD_XBOX360_VENDOR(0x2f24), /* GameSir Controllers */ ++ XPAD_XBOX360_VENDOR(0x3285), /* Nacon GC-100 */ + { } + }; + +-- +2.35.3 + diff --git a/patches.suse/KVM-PPC-Fix-TCE-handling-for-VFIO.patch b/patches.suse/KVM-PPC-Fix-TCE-handling-for-VFIO.patch new file mode 100644 index 0000000..a080f0d --- /dev/null +++ b/patches.suse/KVM-PPC-Fix-TCE-handling-for-VFIO.patch @@ -0,0 +1,173 @@ +From 26a62b750a4e6364b0393562f66759b1494c3a01 Mon Sep 17 00:00:00 2001 +From: Alexey Kardashevskiy +Date: Wed, 20 Apr 2022 15:08:40 +1000 +Subject: [PATCH] KVM: PPC: Fix TCE handling for VFIO + +References: bsc#1061840 git-fixes +Patch-mainline: v5.18-rc4 +Git-commit: 26a62b750a4e6364b0393562f66759b1494c3a01 + +The LoPAPR spec defines a guest visible IOMMU with a variable page size. +Currently QEMU advertises 4K, 64K, 2M, 16MB pages, a Linux VM picks +the biggest (16MB). In the case of a passed though PCI device, there is +a hardware IOMMU which does not support all pages sizes from the above - +P8 cannot do 2MB and P9 cannot do 16MB. So for each emulated +16M IOMMU page we may create several smaller mappings ("TCEs") in +the hardware IOMMU. + +The code wrongly uses the emulated TCE index instead of hardware TCE +index in error handling. The problem is easier to see on POWER8 with +multi-level TCE tables (when only the first level is preallocated) +as hash mode uses real mode TCE hypercalls handlers. +The kernel starts using indirect tables when VMs get bigger than 128GB +(depends on the max page order). +The very first real mode hcall is going to fail with H_TOO_HARD as +in the real mode we cannot allocate memory for TCEs (we can in the virtual +mode) but on the way out the code attempts to clear hardware TCEs using +emulated TCE indexes which corrupts random kernel memory because +it_offset==1<<59 is subtracted from those indexes and the resulting index +is out of the TCE table bounds. + +This fixes kvmppc_clear_tce() to use the correct TCE indexes. + +While at it, this fixes TCE cache invalidation which uses emulated TCE +indexes instead of the hardware ones. This went unnoticed as 64bit DMA +is used these days and VMs map all RAM in one go and only then do DMA +and this is when the TCE cache gets populated. + +Potentially this could slow down mapping, however normally 16MB +emulated pages are backed by 64K hardware pages so it is one write to +the "TCE Kill" per 256 updates which is not that bad considering the size +of the cache (1024 TCEs or so). + +Fixes: ca1fc489cfa0 ("KVM: PPC: Book3S: Allow backing bigger guest IOMMU pages with smaller physical pages") + +[ms: this patch does multiple things. +We do not need to shuffle around the code added in +01b7d128b5a7 ("KVM: PPC: Book3S: Invalidate multiple TCEs at once") +because that commit is not present in SLE12 SP5 and 4.12 kernel lacks +the infrastructure for it. Clearing the wrong entries is a bug that +should be fixed, though] + +Signed-off-by: Alexey Kardashevskiy +Tested-by: David Gibson +Reviewed-by: Frederic Barrat +Reviewed-by: David Gibson +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220420050840.328223-1-aik@ozlabs.ru +Acked-by: Michal Suchanek +--- + arch/powerpc/kvm/book3s_64_vio.c | 45 +++++++++++++++-------------- + arch/powerpc/kvm/book3s_64_vio_hv.c | 44 ++++++++++++++-------------- + 2 files changed, 45 insertions(+), 44 deletions(-) + +diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c +--- a/arch/powerpc/kvm/book3s_64_vio.c ++++ b/arch/powerpc/kvm/book3s_64_vio.c +@@ -413,12 +413,18 @@ static long kvmppc_tce_validate(struct k + return H_SUCCESS; + } + +-static void kvmppc_clear_tce(struct iommu_table *tbl, unsigned long entry) ++static void kvmppc_clear_tce(struct kvmppc_spapr_tce_table *stt, struct iommu_table *tbl, unsigned long entry) + { +- unsigned long hpa = 0; +- enum dma_data_direction dir = DMA_NONE; ++ unsigned long i; ++ unsigned long subpages = 1ULL << (stt->page_shift - tbl->it_page_shift); ++ unsigned long io_entry = entry << (stt->page_shift - tbl->it_page_shift); ++ ++ for (i = 0; i < subpages; ++i) { ++ unsigned long hpa = 0; ++ enum dma_data_direction dir = DMA_NONE; + +- iommu_tce_xchg(tbl, entry, &hpa, &dir); ++ iommu_tce_xchg(tbl, io_entry + i, &hpa, &dir); ++ } + } + + static long kvmppc_tce_iommu_mapped_dec(struct kvm *kvm, +@@ -583,7 +589,7 @@ long kvmppc_h_put_tce(struct kvm_vcpu *v + entry, ua, dir); + + if (ret != H_SUCCESS) { +- kvmppc_clear_tce(stit->tbl, entry); ++ kvmppc_clear_tce(stt, stit->tbl, entry); + goto unlock_exit; + } + } +@@ -674,7 +680,7 @@ long kvmppc_h_put_tce_indirect(struct kv + iommu_tce_direction(tce)); + + if (ret != H_SUCCESS) { +- kvmppc_clear_tce(stit->tbl, entry); ++ kvmppc_clear_tce(stt, stit->tbl, entry + i); + goto unlock_exit; + } + } +@@ -723,7 +729,7 @@ long kvmppc_h_stuff_tce(struct kvm_vcpu + return ret; + + WARN_ON_ONCE(1); +- kvmppc_clear_tce(stit->tbl, entry); ++ kvmppc_clear_tce(stt, stit->tbl, entry + i); + } + } + +diff --git a/arch/powerpc/kvm/book3s_64_vio_hv.c b/arch/powerpc/kvm/book3s_64_vio_hv.c +--- a/arch/powerpc/kvm/book3s_64_vio_hv.c ++++ b/arch/powerpc/kvm/book3s_64_vio_hv.c +@@ -223,13 +223,19 @@ static long iommu_tce_xchg_rm(struct mm_ + return ret; + } + +-static void kvmppc_rm_clear_tce(struct kvm *kvm, struct iommu_table *tbl, +- unsigned long entry) ++static void kvmppc_rm_clear_tce(struct kvm *kvm, struct kvmppc_spapr_tce_table *stt, ++ struct iommu_table *tbl, unsigned long entry) + { +- unsigned long hpa = 0; +- enum dma_data_direction dir = DMA_NONE; ++ unsigned long i; ++ unsigned long subpages = 1ULL << (stt->page_shift - tbl->it_page_shift); ++ unsigned long io_entry = entry << (stt->page_shift - tbl->it_page_shift); ++ ++ for (i = 0; i < subpages; ++i) { ++ unsigned long hpa = 0; ++ enum dma_data_direction dir = DMA_NONE; + +- iommu_tce_xchg_rm(kvm->mm, tbl, entry, &hpa, &dir); ++ iommu_tce_xchg_rm(kvm->mm, tbl, io_entry + i, &hpa, &dir); ++ } + } + + static long kvmppc_rm_tce_iommu_mapped_dec(struct kvm *kvm, +@@ -401,7 +407,7 @@ long kvmppc_rm_h_put_tce(struct kvm_vcpu + stit->tbl, entry, ua, dir); + + if (ret != H_SUCCESS) { +- kvmppc_rm_clear_tce(vcpu->kvm, stit->tbl, entry); ++ kvmppc_rm_clear_tce(vcpu->kvm, stt, stit->tbl, entry); + return ret; + } + } +@@ -550,8 +556,8 @@ long kvmppc_rm_h_put_tce_indirect(struct + iommu_tce_direction(tce)); + + if (ret != H_SUCCESS) { +- kvmppc_rm_clear_tce(vcpu->kvm, stit->tbl, +- entry); ++ kvmppc_rm_clear_tce(vcpu->kvm, stt, stit->tbl, ++ entry + i); + goto unlock_exit; + } + } +@@ -604,7 +610,7 @@ long kvmppc_rm_h_stuff_tce(struct kvm_vc + return ret; + + WARN_ON_ONCE_RM(1); +- kvmppc_rm_clear_tce(vcpu->kvm, stit->tbl, entry); ++ kvmppc_rm_clear_tce(vcpu->kvm, stt, stit->tbl, entry + i); + } + } + diff --git a/patches.suse/KVM-PPC-Propagate-errors-to-the-guest-when-failed-in.patch b/patches.suse/KVM-PPC-Propagate-errors-to-the-guest-when-failed-in.patch new file mode 100644 index 0000000..f4c991d --- /dev/null +++ b/patches.suse/KVM-PPC-Propagate-errors-to-the-guest-when-failed-in.patch @@ -0,0 +1,117 @@ +From 2691f0ff3d96b471a69c7ef29f3340b91056845d Mon Sep 17 00:00:00 2001 +From: Alexey Kardashevskiy +Date: Mon, 10 Sep 2018 18:29:11 +1000 +Subject: [PATCH] KVM: PPC: Propagate errors to the guest when failed instead + of ignoring + +References: bsc#1061840 git-fixes +Patch-mainline: v4.20-rc1 +Git-commit: 2691f0ff3d96b471a69c7ef29f3340b91056845d + +At the moment if the PUT_TCE{_INDIRECT} handlers fail to update +the hardware tables, we print a warning once, clear the entry and +continue. This is so as at the time the assumption was that if +a VFIO device is hotplugged into the guest, and the userspace replays +virtual DMA mappings (i.e. TCEs) to the hardware tables and if this fails, +then there is nothing useful we can do about it. + +However the assumption is not valid as these handlers are not called for +TCE replay (VFIO ioctl interface is used for that) and these handlers +are for new TCEs. + +This returns an error to the guest if there is a request which cannot be +processed. By now the only possible failure must be H_TOO_HARD. + +Signed-off-by: Alexey Kardashevskiy +Reviewed-by: David Gibson +Signed-off-by: Michael Ellerman +Acked-by: Michal Suchanek +--- + arch/powerpc/kvm/book3s_64_vio.c | 20 ++++++-------------- + arch/powerpc/kvm/book3s_64_vio_hv.c | 21 +++++++-------------- + 2 files changed, 13 insertions(+), 28 deletions(-) + +diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c +index 01e1994daff0..8231b178eac6 100644 +--- a/arch/powerpc/kvm/book3s_64_vio.c ++++ b/arch/powerpc/kvm/book3s_64_vio.c +@@ -568,14 +568,10 @@ long kvmppc_h_put_tce(struct kvm_vcpu *vcpu, unsigned long liobn, + ret = kvmppc_tce_iommu_map(vcpu->kvm, stt, stit->tbl, + entry, ua, dir); + +- if (ret == H_SUCCESS) +- continue; +- +- if (ret == H_TOO_HARD) ++ if (ret != H_SUCCESS) { ++ kvmppc_clear_tce(stit->tbl, entry); + goto unlock_exit; +- +- WARN_ON_ONCE(1); +- kvmppc_clear_tce(stit->tbl, entry); ++ } + } + + kvmppc_tce_put(stt, entry, tce); +@@ -663,14 +659,10 @@ long kvmppc_h_put_tce_indirect(struct kvm_vcpu *vcpu, + stit->tbl, entry + i, ua, + iommu_tce_direction(tce)); + +- if (ret == H_SUCCESS) +- continue; +- +- if (ret == H_TOO_HARD) ++ if (ret != H_SUCCESS) { ++ kvmppc_clear_tce(stit->tbl, entry); + goto unlock_exit; +- +- WARN_ON_ONCE(1); +- kvmppc_clear_tce(stit->tbl, entry); ++ } + } + + kvmppc_tce_put(stt, entry + i, tce); +diff --git a/arch/powerpc/kvm/book3s_64_vio_hv.c b/arch/powerpc/kvm/book3s_64_vio_hv.c +index 3c05fc22de07..ae147b5c7571 100644 +--- a/arch/powerpc/kvm/book3s_64_vio_hv.c ++++ b/arch/powerpc/kvm/book3s_64_vio_hv.c +@@ -405,14 +405,10 @@ long kvmppc_rm_h_put_tce(struct kvm_vcpu *vcpu, unsigned long liobn, + ret = kvmppc_rm_tce_iommu_map(vcpu->kvm, stt, + stit->tbl, entry, ua, dir); + +- if (ret == H_SUCCESS) +- continue; +- +- if (ret == H_TOO_HARD) ++ if (ret != H_SUCCESS) { ++ kvmppc_rm_clear_tce(vcpu->kvm, stit->tbl, entry); + return ret; +- +- WARN_ON_ONCE_RM(1); +- kvmppc_rm_clear_tce(vcpu->kvm, stit->tbl, entry); ++ } + } + + kvmppc_tce_put(stt, entry, tce); +@@ -558,14 +554,11 @@ long kvmppc_rm_h_put_tce_indirect(struct kvm_vcpu *vcpu, + stit->tbl, entry + i, ua, + iommu_tce_direction(tce)); + +- if (ret == H_SUCCESS) +- continue; +- +- if (ret == H_TOO_HARD) ++ if (ret != H_SUCCESS) { ++ kvmppc_rm_clear_tce(vcpu->kvm, stit->tbl, ++ entry); + goto unlock_exit; +- +- WARN_ON_ONCE_RM(1); +- kvmppc_rm_clear_tce(vcpu->kvm, stit->tbl, entry); ++ } + } + + kvmppc_tce_put(stt, entry + i, tce); +-- +2.35.3 + diff --git a/patches.suse/KVM-arm64-Fix-definition-of-PAGE_HYP_DEVICE.patch b/patches.suse/KVM-arm64-Fix-definition-of-PAGE_HYP_DEVICE.patch new file mode 100644 index 0000000..bcc6e2e --- /dev/null +++ b/patches.suse/KVM-arm64-Fix-definition-of-PAGE_HYP_DEVICE.patch @@ -0,0 +1,38 @@ +From: Will Deacon +Date: Wed, 8 Jul 2020 17:25:46 +0100 +Subject: KVM: arm64: Fix definition of PAGE_HYP_DEVICE +Git-commit: 68cf617309b5f6f3a651165f49f20af1494753ae +Patch-mainline: v5.8-rc5 +References: git-fixes + +PAGE_HYP_DEVICE is intended to encode attribute bits for an EL2 stage-1 +pte mapping a device. Unfortunately, it includes PROT_DEVICE_nGnRE which +encodes attributes for EL1 stage-1 mappings such as UXN and nG, which are +RES0 for EL2, and DBM which is meaningless as TCR_EL2.HD is not set. + +Fix the definition of PAGE_HYP_DEVICE so that it doesn't set RES0 bits +at EL2. + +Acked-by: Marc Zyngier +Cc: Marc Zyngier +Cc: Catalin Marinas +Cc: James Morse +Cc: +Link: https://lore.kernel.org/r/20200708162546.26176-1-will@kernel.org +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/include/asm/pgtable-prot.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/include/asm/pgtable-prot.h ++++ b/arch/arm64/include/asm/pgtable-prot.h +@@ -65,7 +65,7 @@ + #define PAGE_HYP __pgprot(_HYP_PAGE_DEFAULT | PTE_HYP | PTE_HYP_XN) + #define PAGE_HYP_EXEC __pgprot(_HYP_PAGE_DEFAULT | PTE_HYP | PTE_RDONLY) + #define PAGE_HYP_RO __pgprot(_HYP_PAGE_DEFAULT | PTE_HYP | PTE_RDONLY | PTE_HYP_XN) +-#define PAGE_HYP_DEVICE __pgprot(PROT_DEVICE_nGnRE | PTE_HYP) ++#define PAGE_HYP_DEVICE __pgprot(_PROT_DEFAULT | PTE_ATTRINDX(MT_DEVICE_nGnRE) | PTE_HYP | PTE_HYP_XN) + + #define PAGE_S2 __pgprot(_PROT_DEFAULT | PTE_S2_MEMATTR(MT_S2_NORMAL) | PTE_S2_RDONLY | PTE_S2_XN) + #define PAGE_S2_DEVICE __pgprot(_PROT_DEFAULT | PTE_S2_MEMATTR(MT_S2_DEVICE_nGnRE) | PTE_S2_RDONLY | PTE_S2_XN) diff --git a/patches.suse/NFC-netlink-fix-sleep-in-atomic-bug-when-firmware-do.patch b/patches.suse/NFC-netlink-fix-sleep-in-atomic-bug-when-firmware-do.patch new file mode 100644 index 0000000..111cc7e --- /dev/null +++ b/patches.suse/NFC-netlink-fix-sleep-in-atomic-bug-when-firmware-do.patch @@ -0,0 +1,70 @@ +From 4071bf121d59944d5cd2238de0642f3d7995a997 Mon Sep 17 00:00:00 2001 +From: Duoming Zhou +Date: Wed, 4 May 2022 13:58:47 +0800 +Subject: [PATCH] NFC: netlink: fix sleep in atomic bug when firmware download timeout +Git-commit: 4071bf121d59944d5cd2238de0642f3d7995a997 +Patch-mainline: v5.18-rc6 +References: CVE-2022-1975 bsc#1200143 + +There are sleep in atomic bug that could cause kernel panic during +firmware download process. The root cause is that nlmsg_new with +GFP_KERNEL parameter is called in fw_dnld_timeout which is a timer +handler. The call trace is shown below: + +Bug: sleeping function called from invalid context at include/linux/sched/mm.h:265 +Call Trace: +kmem_cache_alloc_node +__alloc_skb +nfc_genl_fw_download_done +call_timer_fn +__run_timers.part.0 +run_timer_softirq +__do_softirq +... + +The nlmsg_new with GFP_KERNEL parameter may sleep during memory +allocation process, and the timer handler is run as the result of +a "software interrupt" that should not call any other function +that could sleep. + +This patch changes allocation mode of netlink message from GFP_KERNEL +to GFP_ATOMIC in order to prevent sleep in atomic bug. The GFP_ATOMIC +flag makes memory allocation operation could be used in atomic context. + +Fixes: 9674da8759df ("NFC: Add firmware upload netlink command") +Fixes: 9ea7187c53f6 ("NFC: netlink: Rename CMD_FW_UPLOAD to CMD_FW_DOWNLOAD") +Signed-off-by: Duoming Zhou +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20220504055847.38026-1-duoming@zju.edu.cn +Signed-off-by: Paolo Abeni +Acked-by: Takashi Iwai + +--- + net/nfc/netlink.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c +index f184b0db79d4..7c62417ccfd7 100644 +--- a/net/nfc/netlink.c ++++ b/net/nfc/netlink.c +@@ -1244,7 +1244,7 @@ int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name, + struct sk_buff *msg; + void *hdr; + +- msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); ++ msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); + if (!msg) + return -ENOMEM; + +@@ -1260,7 +1260,7 @@ int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name, + + genlmsg_end(msg, hdr); + +- genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL); ++ genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_ATOMIC); + + return 0; + +-- +2.35.3 + diff --git a/patches.suse/NFSD-prevent-underflow-in-nfssvc_decode_writeargs.patch b/patches.suse/NFSD-prevent-underflow-in-nfssvc_decode_writeargs.patch new file mode 100644 index 0000000..748522c --- /dev/null +++ b/patches.suse/NFSD-prevent-underflow-in-nfssvc_decode_writeargs.patch @@ -0,0 +1,46 @@ +From: Dan Carpenter +Date: Tue, 15 Mar 2022 13:30:09 +0300 +Subject: [PATCH] NFSD: prevent underflow in nfssvc_decode_writeargs() +Git-commit: 184416d4b98509fb4c3d8fc3d6dc1437896cc159 +Patch-mainline: v5.18 +References: git-fixes + +Smatch complains: + + fs/nfsd/nfsxdr.c:341 nfssvc_decode_writeargs() + warn: no lower bound on 'args->len' + +Change the type to unsigned to prevent this issue. + +Cc: stable@vger.kernel.org +Signed-off-by: Dan Carpenter +Signed-off-by: Chuck Lever +Acked-by: NeilBrown + +--- + fs/nfsd/nfsproc.c | 2 +- + fs/nfsd/xdr.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/nfsd/nfsproc.c ++++ b/fs/nfsd/nfsproc.c +@@ -221,7 +221,7 @@ nfsd_proc_write(struct svc_rqst *rqstp, + unsigned long cnt = argp->len; + unsigned int nvecs; + +- dprintk("nfsd: WRITE %s %d bytes at %d\n", ++ dprintk("nfsd: WRITE %s %u bytes at %d\n", + SVCFH_fmt(&argp->fh), + argp->len, argp->offset); + +--- a/fs/nfsd/xdr.h ++++ b/fs/nfsd/xdr.h +@@ -32,7 +32,7 @@ struct nfsd_readargs { + struct nfsd_writeargs { + svc_fh fh; + __u32 offset; +- int len; ++ __u32 len; + struct kvec first; + }; + diff --git a/patches.suse/NFSv4-Don-t-invalidate-inode-attributes-on-delegatio.patch b/patches.suse/NFSv4-Don-t-invalidate-inode-attributes-on-delegatio.patch new file mode 100644 index 0000000..96b6ab2 --- /dev/null +++ b/patches.suse/NFSv4-Don-t-invalidate-inode-attributes-on-delegatio.patch @@ -0,0 +1,50 @@ +From: Trond Myklebust +Date: Mon, 25 Apr 2022 18:04:27 -0400 +Subject: [PATCH] NFSv4: Don't invalidate inode attributes on delegation return +Git-commit: 00c94ebec5925593c0377b941289224469e72ac7 +Patch-mainline: v5.18-rc6 +References: git-fixes + +There is no need to declare attributes such as the ctime, mtime and +block size invalid when we're just returning a delegation, so it is +inappropriate to call nfs_post_op_update_inode_force_wcc(). +Instead, just call nfs_refresh_inode() after faking up the change +attribute. We know that the GETATTR op occurs before the DELEGRETURN, so +we are safe when doing this. + +Fixes: 0bc2c9b4dca9 ("NFSv4: Don't discard the attributes returned by asynchronous DELEGRETURN") +Signed-off-by: Trond Myklebust +Acked-by: NeilBrown + +--- + fs/nfs/nfs4proc.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -328,6 +328,14 @@ static void nfs4_setup_readdir(u64 cooki + kunmap_atomic(start); + } + ++static void nfs4_fattr_set_prechange(struct nfs_fattr *fattr, u64 version) ++{ ++ if (!(fattr->valid & NFS_ATTR_FATTR_PRECHANGE)) { ++ fattr->pre_change_attr = version; ++ fattr->valid |= NFS_ATTR_FATTR_PRECHANGE; ++ } ++} ++ + static void nfs4_test_and_free_stateid(struct nfs_server *server, + nfs4_stateid *stateid, + struct rpc_cred *cred) +@@ -5937,7 +5945,9 @@ static void nfs4_delegreturn_release(voi + if (data->lr.roc) + pnfs_roc_release(&data->lr.arg, &data->lr.res, + data->res.lr_ret); +- nfs_post_op_update_inode_force_wcc(inode, &data->fattr); ++ nfs4_fattr_set_prechange(&data->fattr, ++ inode_peek_iversion_raw(inode)); ++ nfs_refresh_inode(inode, &data->fattr); + nfs_iput_and_deactive(inode); + } + kfree(calldata); diff --git a/patches.suse/NFSv4-fix-open-failure-with-O_ACCMODE-flag.patch b/patches.suse/NFSv4-fix-open-failure-with-O_ACCMODE-flag.patch new file mode 100644 index 0000000..84cee8f --- /dev/null +++ b/patches.suse/NFSv4-fix-open-failure-with-O_ACCMODE-flag.patch @@ -0,0 +1,99 @@ +From: ChenXiaoSong +Date: Tue, 29 Mar 2022 19:32:08 +0800 +Subject: [PATCH] NFSv4: fix open failure with O_ACCMODE flag +Git-commit: b243874f6f9568b2daf1a00e9222cacdc15e159c +Patch-mainline: v5.18 +References: git-fixes + +open() with O_ACCMODE|O_DIRECT flags secondly will fail. + +Reproducer: 1. mount -t nfs -o vers=4.2 $server_ip:/ /mnt/ + 2. fd = open("/mnt/file", O_ACCMODE|O_DIRECT|O_CREAT) + 3. close(fd) + 4. fd = open("/mnt/file", O_ACCMODE|O_DIRECT) + +Server nfsd4_decode_share_access() will fail with error nfserr_bad_xdr when +client use incorrect share access mode of 0. + +Fix this by using NFS4_SHARE_ACCESS_BOTH share access mode in client, +just like firstly opening. + +Fixes: ce4ef7c0a8a05 ("NFS: Split out NFS v4 file operations") +Signed-off-by: ChenXiaoSong +Signed-off-by: Trond Myklebust +Acked-by: NeilBrown + +--- + fs/nfs/dir.c | 10 ---------- + fs/nfs/internal.h | 10 ++++++++++ + fs/nfs/nfs4file.c | 6 ++++-- + 3 files changed, 14 insertions(+), 12 deletions(-) + +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -1501,16 +1501,6 @@ const struct dentry_operations nfs4_dent + }; + EXPORT_SYMBOL_GPL(nfs4_dentry_operations); + +-static fmode_t flags_to_mode(int flags) +-{ +- fmode_t res = (__force fmode_t)flags & FMODE_EXEC; +- if ((flags & O_ACCMODE) != O_WRONLY) +- res |= FMODE_READ; +- if ((flags & O_ACCMODE) != O_RDONLY) +- res |= FMODE_WRITE; +- return res; +-} +- + static struct nfs_open_context *create_nfs_open_context(struct dentry *dentry, int open_flags, struct file *filp) + { + return alloc_nfs_open_context(dentry, flags_to_mode(open_flags), filp); +--- a/fs/nfs/internal.h ++++ b/fs/nfs/internal.h +@@ -48,6 +48,16 @@ struct nfs_clone_mount { + rpc_authflavor_t authflavor; + }; + ++static inline fmode_t flags_to_mode(int flags) ++{ ++ fmode_t res = (__force fmode_t)flags & FMODE_EXEC; ++ if ((flags & O_ACCMODE) != O_WRONLY) ++ res |= FMODE_READ; ++ if ((flags & O_ACCMODE) != O_RDONLY) ++ res |= FMODE_WRITE; ++ return res; ++} ++ + /* + * Note: RFC 1813 doesn't limit the number of auth flavors that + * a server can return, so make something up. +--- a/fs/nfs/nfs4file.c ++++ b/fs/nfs/nfs4file.c +@@ -30,6 +30,7 @@ nfs4_file_open(struct inode *inode, stru + struct dentry *parent = NULL; + struct inode *dir; + unsigned openflags = filp->f_flags; ++ fmode_t f_mode; + struct iattr attr; + int err; + +@@ -48,8 +49,9 @@ nfs4_file_open(struct inode *inode, stru + if (err) + return err; + ++ f_mode = filp->f_mode; + if ((openflags & O_ACCMODE) == 3) +- openflags--; ++ f_mode |= flags_to_mode(openflags); + + /* We can't create new files here */ + openflags &= ~(O_CREAT|O_EXCL); +@@ -57,7 +59,7 @@ nfs4_file_open(struct inode *inode, stru + parent = dget_parent(dentry); + dir = d_inode(parent); + +- ctx = alloc_nfs_open_context(file_dentry(filp), filp->f_mode, filp); ++ ctx = alloc_nfs_open_context(file_dentry(filp), f_mode, filp); + err = PTR_ERR(ctx); + if (IS_ERR(ctx)) + goto out; diff --git a/patches.suse/NFSv4.1-Don-t-rebind-to-the-same-source-port-when-re.patch b/patches.suse/NFSv4.1-Don-t-rebind-to-the-same-source-port-when-re.patch index 6998267..b13dba8 100644 --- a/patches.suse/NFSv4.1-Don-t-rebind-to-the-same-source-port-when-re.patch +++ b/patches.suse/NFSv4.1-Don-t-rebind-to-the-same-source-port-when-re.patch @@ -63,7 +63,7 @@ Acked-by: NeilBrown int error; --- a/fs/nfs/nfs4client.c +++ b/fs/nfs/nfs4client.c -@@ -865,8 +865,11 @@ static int nfs4_set_client(struct nfs_se +@@ -867,8 +867,11 @@ static int nfs4_set_client(struct nfs_se }; struct nfs_client *clp; @@ -87,14 +87,14 @@ Acked-by: NeilBrown char * cl_hostname; /* hostname of server */ --- a/include/linux/sunrpc/clnt.h +++ b/include/linux/sunrpc/clnt.h -@@ -153,6 +153,7 @@ struct rpc_add_xprt_test { +@@ -149,6 +149,7 @@ struct rpc_add_xprt_test { #define RPC_CLNT_CREATE_INFINITE_SLOTS (1UL << 7) #define RPC_CLNT_CREATE_NO_IDLE_TIMEOUT (1UL << 8) #define RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT (1UL << 9) +#define RPC_CLNT_CREATE_REUSEPORT (1UL << 11) + #define RPC_CLNT_CREATE_CONNECTED (1UL << 12) struct rpc_clnt *rpc_create(struct rpc_create_args *args); - struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *, --- a/include/linux/sunrpc/xprt.h +++ b/include/linux/sunrpc/xprt.h @@ -199,7 +199,8 @@ struct rpc_xprt { @@ -109,7 +109,7 @@ Acked-by: NeilBrown unsigned int bind_index; /* bind function index */ --- a/net/sunrpc/clnt.c +++ b/net/sunrpc/clnt.c -@@ -592,6 +592,9 @@ struct rpc_clnt *rpc_create(struct rpc_c +@@ -599,6 +599,9 @@ struct rpc_clnt *rpc_create(struct rpc_c xprt->resvport = 1; if (args->flags & RPC_CLNT_CREATE_NONPRIVPORT) xprt->resvport = 0; @@ -119,7 +119,7 @@ Acked-by: NeilBrown clnt = rpc_create_xprt(args, xprt); if (IS_ERR(clnt) || args->nconnect <= 1) -@@ -2732,7 +2735,7 @@ int rpc_clnt_add_xprt(struct rpc_clnt *c +@@ -2810,7 +2813,7 @@ int rpc_clnt_add_xprt(struct rpc_clnt *c struct rpc_xprt *xprt; unsigned long connect_timeout; unsigned long reconnect_timeout; @@ -128,7 +128,7 @@ Acked-by: NeilBrown int ret = 0; rcu_read_lock(); -@@ -2743,6 +2746,7 @@ int rpc_clnt_add_xprt(struct rpc_clnt *c +@@ -2821,6 +2824,7 @@ int rpc_clnt_add_xprt(struct rpc_clnt *c return -EAGAIN; } resvport = xprt->resvport; @@ -136,7 +136,7 @@ Acked-by: NeilBrown connect_timeout = xprt->connect_timeout; reconnect_timeout = xprt->max_reconnect_timeout; rcu_read_unlock(); -@@ -2753,6 +2757,7 @@ int rpc_clnt_add_xprt(struct rpc_clnt *c +@@ -2831,6 +2835,7 @@ int rpc_clnt_add_xprt(struct rpc_clnt *c goto out_put_switch; } xprt->resvport = resvport; diff --git a/patches.suse/PCI-ACPI-Mark-expected-switch-fall-through.patch b/patches.suse/PCI-ACPI-Mark-expected-switch-fall-through.patch new file mode 100644 index 0000000..6174cb5 --- /dev/null +++ b/patches.suse/PCI-ACPI-Mark-expected-switch-fall-through.patch @@ -0,0 +1,34 @@ +From fa295becc533234e4b1ea774caed2446a65ff695 Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Thu, 4 Oct 2018 17:40:41 +0200 +Subject: [PATCH] PCI / ACPI: Mark expected switch fall-through +Git-commit: fa295becc533234e4b1ea774caed2446a65ff695 +References: git-fixes +Patch-mainline: v4.20-rc1 + +In preparation to enabling -Wimplicit-fallthrough, mark switch cases +where we are expecting to fall through. + +Addresses-Coverity-ID: 1472052 ("Missing break in switch") +Signed-off-by: Gustavo A. R. Silva +Signed-off-by: Bjorn Helgaas +Signed-off-by: Oliver Neukum +--- + drivers/pci/pci-acpi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c +index c2ab57705043..deb96d1a4728 100644 +--- a/drivers/pci/pci-acpi.c ++++ b/drivers/pci/pci-acpi.c +@@ -548,6 +548,7 @@ static int acpi_pci_set_power_state(struct pci_dev *dev, pci_power_t state) + error = -EBUSY; + break; + } ++ /* Fall through */ + case PCI_D0: + case PCI_D1: + case PCI_D2: +-- +2.35.3 + diff --git a/patches.suse/PCI-Add-device-even-if-driver-attach-failed.patch b/patches.suse/PCI-Add-device-even-if-driver-attach-failed.patch new file mode 100644 index 0000000..7196cab --- /dev/null +++ b/patches.suse/PCI-Add-device-even-if-driver-attach-failed.patch @@ -0,0 +1,43 @@ +From: Rajat Jain +Date: Mon, 6 Jul 2020 16:32:40 -0700 +Subject: PCI: Add device even if driver attach failed +Git-commit: 2194bc7c39610be7cabe7456c5f63a570604f015 +Patch-mainline: 5.9-rc1 +References: git-fixes + +device_attach() returning failure indicates a driver error while trying to +probe the device. In such a scenario, the PCI device should still be added +in the system and be visible to the user. + +When device_attach() fails, merely warn about it and keep the PCI device in +the system. + +This partially reverts ab1a187bba5c ("PCI: Check device_attach() return +value always"). + +Link: https://lore.kernel.org/r/20200706233240.3245512-1-rajatja@google.com +Signed-off-by: Rajat Jain +Signed-off-by: Bjorn Helgaas +Reviewed-by: Greg Kroah-Hartman +Cc: stable@vger.kernel.org # v4.6+ +Signed-off-by: Jiri Slaby +--- + drivers/pci/bus.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/drivers/pci/bus.c ++++ b/drivers/pci/bus.c +@@ -324,12 +324,8 @@ void pci_bus_add_device(struct pci_dev * + + dev->match_driver = true; + retval = device_attach(&dev->dev); +- if (retval < 0 && retval != -EPROBE_DEFER) { ++ if (retval < 0 && retval != -EPROBE_DEFER) + pci_warn(dev, "device attach failed (%d)\n", retval); +- pci_proc_detach_device(dev); +- pci_remove_sysfs_dev_files(dev); +- return; +- } + + pci_dev_assign_added(dev, true); + } diff --git a/patches.suse/PCI-Fix-overflow-in-command-line-resource-alignment-.patch b/patches.suse/PCI-Fix-overflow-in-command-line-resource-alignment-.patch new file mode 100644 index 0000000..1769044 --- /dev/null +++ b/patches.suse/PCI-Fix-overflow-in-command-line-resource-alignment-.patch @@ -0,0 +1,44 @@ +From: Colin Ian King +Date: Sat, 14 Nov 2020 15:48:04 -0600 +Subject: PCI: Fix overflow in command-line resource alignment requests +Git-commit: cc73eb321d246776e5a9f7723d15708809aa3699 +Patch-mainline: 5.11-rc1 +References: git-fixes + +The shift of 1 by align_order is evaluated using 32 bit arithmetic and the +result is assigned to a resource_size_t type variable that is a 64 bit +unsigned integer on 64 bit platforms. Fix an overflow before widening issue +by making the 1 a ULL. + +[js] it's on two places in 4.12 + +Addresses-Coverity: ("Unintentional integer overflow") +Fixes: 32a9a682bef2 ("PCI: allow assignment of memory resources with a specified alignment") +Signed-off-by: Colin Ian King +Signed-off-by: Bjorn Helgaas +Reviewed-by: Logan Gunthorpe +Signed-off-by: Jiri Slaby +--- + drivers/pci/pci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -5661,7 +5661,7 @@ static resource_size_t pci_specified_res + if (align_order == -1) + align = PAGE_SIZE; + else +- align = 1 << align_order; ++ align = 1ULL << align_order; + /* Found */ + break; + } +@@ -5687,7 +5687,7 @@ static resource_size_t pci_specified_res + if (align_order == -1) + align = PAGE_SIZE; + else +- align = 1 << align_order; ++ align = 1ULL << align_order; + /* Found */ + break; + } diff --git a/patches.suse/PCI-hv-Do-not-set-PCI_COMMAND_MEMORY-to-reduce-VM-bo.patch b/patches.suse/PCI-hv-Do-not-set-PCI_COMMAND_MEMORY-to-reduce-VM-bo.patch new file mode 100644 index 0000000..3c79336 --- /dev/null +++ b/patches.suse/PCI-hv-Do-not-set-PCI_COMMAND_MEMORY-to-reduce-VM-bo.patch @@ -0,0 +1,60 @@ +From: Dexuan Cui +Date: Mon, 2 May 2022 00:42:55 -0700 +Patch-mainline: not yet, https://lore.kernel.org/lkml/20220419220007.26550-1-decui@microsoft.com/ +Subject: PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time +References: bsc#1199314 + +Currently when the pci-hyperv driver finishes probing and initializing the +PCI device, it sets the PCI_COMMAND_MEMORY bit; later when the PCI device +is registered to the core PCI subsystem, the core PCI driver's BAR detection +and initialization code toggles the bit multiple times, and each toggling of +the bit causes the hypervisor to unmap/map the virtual BARs from/to the +physical BARs, which can be slow if the BAR sizes are huge, e.g., a Linux VM +with 14 GPU devices has to spend more than 3 minutes on BAR detection and +initialization, causing a long boot time. + +Reduce the boot time by not setting the PCI_COMMAND_MEMORY bit when we +register the PCI device (there is no need to have it set in the first place). +The bit stays off till the PCI device driver calls pci_enable_device(). +With this change, the boot time of such a 14-GPU VM is reduced by almost +3 minutes. + +Link: https://lore.kernel.org/lkml/20220419220007.26550-1-decui@microsoft.com/ +Tested-by: Boqun Feng (Microsoft) +Signed-off-by: Dexuan Cui +Reviewed-by: Michael Kelley +Acked-by: Lorenzo Pieralisi +Cc: Jake Oshins +Link: https://lore.kernel.org/r/20220502074255.16901-1-decui@microsoft.com +Signed-off-by: Wei Liu +Acked-by: Olaf Hering +--- + drivers/pci/host/pci-hyperv.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +--- a/drivers/pci/host/pci-hyperv.c ++++ b/drivers/pci/host/pci-hyperv.c +@@ -2103,12 +2103,17 @@ static void prepopulate_bars(struct hv_pcibus_device *hbus) + } + } + if (high_size <= 1 && low_size <= 1) { +- /* Set the memory enable bit. */ +- _hv_pcifront_read_config(hpdev, PCI_COMMAND, 2, +- &command); +- command |= PCI_COMMAND_MEMORY; +- _hv_pcifront_write_config(hpdev, PCI_COMMAND, 2, +- command); ++ /* ++ * No need to set the PCI_COMMAND_MEMORY bit as ++ * the core PCI driver doesn't require the bit ++ * to be pre-set. Actually here we intentionally ++ * keep the bit off so that the PCI BAR probing ++ * in the core PCI driver doesn't cause Hyper-V ++ * to unnecessarily unmap/map the virtual BARs ++ * from/to the physical BARs multiple times. ++ * This reduces the VM boot time significantly ++ * if the BAR sizes are huge. ++ */ + break; + } + } diff --git a/patches.suse/PCI-iproc-Fix-out-of-bound-array-accesses.patch b/patches.suse/PCI-iproc-Fix-out-of-bound-array-accesses.patch new file mode 100644 index 0000000..4a32476 --- /dev/null +++ b/patches.suse/PCI-iproc-Fix-out-of-bound-array-accesses.patch @@ -0,0 +1,67 @@ +From: Bharat Gooty +Date: Thu, 1 Oct 2020 11:30:52 +0530 +Subject: PCI: iproc: Fix out-of-bound array accesses +Git-commit: a3ff529f5d368a17ff35ada8009e101162ebeaf9 +Patch-mainline: 5.11-rc1 +References: git-fixes + +Declare the full size array for all revisions of PAX register sets +to avoid potentially out of bound access of the register array +when they are being initialized in iproc_pcie_rev_init(). + +Link: https://lore.kernel.org/r/20201001060054.6616-2-srinath.mannam@broadcom.com +Fixes: 06324ede76cdf ("PCI: iproc: Improve core register population") +Signed-off-by: Bharat Gooty +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Jiri Slaby +--- + drivers/pci/host/pcie-iproc.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/pci/host/pcie-iproc.c ++++ b/drivers/pci/host/pcie-iproc.c +@@ -303,7 +303,7 @@ enum iproc_pcie_reg { + }; + + /* iProc PCIe PAXB BCMA registers */ +-static const u16 iproc_pcie_reg_paxb_bcma[] = { ++static const u16 iproc_pcie_reg_paxb_bcma[IPROC_PCIE_MAX_NUM_REG] = { + [IPROC_PCIE_CLK_CTRL] = 0x000, + [IPROC_PCIE_CFG_IND_ADDR] = 0x120, + [IPROC_PCIE_CFG_IND_DATA] = 0x124, +@@ -314,7 +314,7 @@ static const u16 iproc_pcie_reg_paxb_bcm + }; + + /* iProc PCIe PAXB registers */ +-static const u16 iproc_pcie_reg_paxb[] = { ++static const u16 iproc_pcie_reg_paxb[IPROC_PCIE_MAX_NUM_REG] = { + [IPROC_PCIE_CLK_CTRL] = 0x000, + [IPROC_PCIE_CFG_IND_ADDR] = 0x120, + [IPROC_PCIE_CFG_IND_DATA] = 0x124, +@@ -330,7 +330,7 @@ static const u16 iproc_pcie_reg_paxb[] = + }; + + /* iProc PCIe PAXB v2 registers */ +-static const u16 iproc_pcie_reg_paxb_v2[] = { ++static const u16 iproc_pcie_reg_paxb_v2[IPROC_PCIE_MAX_NUM_REG] = { + [IPROC_PCIE_CLK_CTRL] = 0x000, + [IPROC_PCIE_CFG_IND_ADDR] = 0x120, + [IPROC_PCIE_CFG_IND_DATA] = 0x124, +@@ -358,7 +358,7 @@ static const u16 iproc_pcie_reg_paxb_v2[ + }; + + /* iProc PCIe PAXC v1 registers */ +-static const u16 iproc_pcie_reg_paxc[] = { ++static const u16 iproc_pcie_reg_paxc[IPROC_PCIE_MAX_NUM_REG] = { + [IPROC_PCIE_CLK_CTRL] = 0x000, + [IPROC_PCIE_CFG_IND_ADDR] = 0x1f0, + [IPROC_PCIE_CFG_IND_DATA] = 0x1f4, +@@ -367,7 +367,7 @@ static const u16 iproc_pcie_reg_paxc[] = + }; + + /* iProc PCIe PAXC v2 registers */ +-static const u16 iproc_pcie_reg_paxc_v2[] = { ++static const u16 iproc_pcie_reg_paxc_v2[IPROC_PCIE_MAX_NUM_REG] = { + [IPROC_PCIE_MSI_GIC_MODE] = 0x050, + [IPROC_PCIE_MSI_BASE_ADDR] = 0x074, + [IPROC_PCIE_MSI_WINDOW_SIZE] = 0x078, diff --git a/patches.suse/PCI-iproc-Set-affinity-mask-on-MSI-interrupts.patch b/patches.suse/PCI-iproc-Set-affinity-mask-on-MSI-interrupts.patch new file mode 100644 index 0000000..d4ebd67 --- /dev/null +++ b/patches.suse/PCI-iproc-Set-affinity-mask-on-MSI-interrupts.patch @@ -0,0 +1,48 @@ +From: Mark Tomlinson +Date: Mon, 3 Aug 2020 15:52:40 +1200 +Subject: PCI: iproc: Set affinity mask on MSI interrupts +Git-commit: eb7eacaa5b9e4f665bd08d416c8f88e63d2f123c +Patch-mainline: 5.10-rc1 +References: git-fixes + +The core interrupt code expects the irq_set_affinity call to update the +effective affinity for the interrupt. This was not being done, so update +iproc_msi_irq_set_affinity() to do so. + +Link: https://lore.kernel.org/r/20200803035241.7737-1-mark.tomlinson@alliedtelesis.co.nz +Fixes: 3bc2b2348835 ("PCI: iproc: Add iProc PCIe MSI support") +Signed-off-by: Mark Tomlinson +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Ray Jui +Signed-off-by: Jiri Slaby +--- + drivers/pci/host/pcie-iproc-msi.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/drivers/pci/host/pcie-iproc-msi.c ++++ b/drivers/pci/host/pcie-iproc-msi.c +@@ -217,15 +217,20 @@ static int iproc_msi_irq_set_affinity(st + struct iproc_msi *msi = irq_data_get_irq_chip_data(data); + int target_cpu = cpumask_first(mask); + int curr_cpu; ++ int ret; + + curr_cpu = hwirq_to_cpu(msi, data->hwirq); + if (curr_cpu == target_cpu) +- return IRQ_SET_MASK_OK_DONE; ++ ret = IRQ_SET_MASK_OK_DONE; ++ else { ++ /* steer MSI to the target CPU */ ++ data->hwirq = hwirq_to_canonical_hwirq(msi, data->hwirq) + target_cpu; ++ ret = IRQ_SET_MASK_OK; ++ } + +- /* steer MSI to the target CPU */ +- data->hwirq = hwirq_to_canonical_hwirq(msi, data->hwirq) + target_cpu; ++ irq_data_update_effective_affinity(data, cpumask_of(target_cpu)); + +- return IRQ_SET_MASK_OK; ++ return ret; + } + + static void iproc_msi_irq_compose_msi_msg(struct irq_data *data, diff --git a/patches.suse/PCI-qcom-Add-missing-reset-for-ipq806x.patch b/patches.suse/PCI-qcom-Add-missing-reset-for-ipq806x.patch index 5591a3f..4838787 100644 --- a/patches.suse/PCI-qcom-Add-missing-reset-for-ipq806x.patch +++ b/patches.suse/PCI-qcom-Add-missing-reset-for-ipq806x.patch @@ -42,15 +42,15 @@ Signed-off-by: Jiri Slaby res->phy_reset = devm_reset_control_get_exclusive(dev, "phy"); return PTR_ERR_OR_ZERO(res->phy_reset); } -@@ -288,6 +293,7 @@ static void qcom_pcie_deinit_2_1_0(struc +@@ -289,6 +294,7 @@ static void qcom_pcie_deinit_2_1_0(struc reset_control_assert(res->axi_reset); reset_control_assert(res->ahb_reset); reset_control_assert(res->por_reset); + reset_control_assert(res->ext_reset); - reset_control_assert(res->pci_reset); + reset_control_assert(res->phy_reset); clk_disable_unprepare(res->iface_clk); clk_disable_unprepare(res->core_clk); -@@ -353,6 +359,12 @@ static int qcom_pcie_init_2_1_0(struct q +@@ -347,6 +353,12 @@ static int qcom_pcie_init_2_1_0(struct q goto err_deassert_ahb; } diff --git a/patches.suse/PCI-qcom-Change-duplicate-PCI-reset-to-phy-reset.patch b/patches.suse/PCI-qcom-Change-duplicate-PCI-reset-to-phy-reset.patch new file mode 100644 index 0000000..17c35f0 --- /dev/null +++ b/patches.suse/PCI-qcom-Change-duplicate-PCI-reset-to-phy-reset.patch @@ -0,0 +1,75 @@ +From: Abhishek Sahu +Date: Mon, 15 Jun 2020 23:05:59 +0200 +Subject: PCI: qcom: Change duplicate PCI reset to phy reset +Git-commit: dd58318c019f10bc94db36df66af6c55d4c0cbba +Patch-mainline: 5.9-rc1 +References: git-fixes + +The deinit issues reset_control_assert for PCI twice and does not contain +phy reset. + +Link: https://lore.kernel.org/r/20200615210608.21469-4-ansuelsmth@gmail.com +Signed-off-by: Abhishek Sahu +Signed-off-by: Ansuel Smith +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Rob Herring +Acked-by: Stanimir Varbanov +Signed-off-by: Jiri Slaby +--- + drivers/pci/dwc/pcie-qcom.c | 18 ++++++++---------- + 1 file changed, 8 insertions(+), 10 deletions(-) + +--- a/drivers/pci/dwc/pcie-qcom.c ++++ b/drivers/pci/dwc/pcie-qcom.c +@@ -284,14 +284,14 @@ static void qcom_pcie_deinit_2_1_0(struc + { + struct qcom_pcie_resources_2_1_0 *res = &pcie->res.v2_1_0; + ++ clk_disable_unprepare(res->phy_clk); + reset_control_assert(res->pci_reset); + reset_control_assert(res->axi_reset); + reset_control_assert(res->ahb_reset); + reset_control_assert(res->por_reset); +- reset_control_assert(res->pci_reset); ++ reset_control_assert(res->phy_reset); + clk_disable_unprepare(res->iface_clk); + clk_disable_unprepare(res->core_clk); +- clk_disable_unprepare(res->phy_clk); + clk_disable_unprepare(res->aux_clk); + clk_disable_unprepare(res->ref_clk); + regulator_bulk_disable(ARRAY_SIZE(res->supplies), res->supplies); +@@ -329,12 +329,6 @@ static int qcom_pcie_init_2_1_0(struct q + goto err_clk_core; + } + +- ret = clk_prepare_enable(res->phy_clk); +- if (ret) { +- dev_err(dev, "cannot prepare/enable phy clock\n"); +- goto err_clk_phy; +- } +- + ret = clk_prepare_enable(res->aux_clk); + if (ret) { + dev_err(dev, "cannot prepare/enable aux clock\n"); +@@ -387,6 +381,12 @@ static int qcom_pcie_init_2_1_0(struct q + return ret; + } + ++ ret = clk_prepare_enable(res->phy_clk); ++ if (ret) { ++ dev_err(dev, "cannot prepare/enable phy clock\n"); ++ goto err_deassert_ahb; ++ } ++ + /* wait for clock acquisition */ + usleep_range(1000, 1500); + +@@ -404,8 +404,6 @@ err_deassert_ahb: + err_clk_ref: + clk_disable_unprepare(res->aux_clk); + err_clk_aux: +- clk_disable_unprepare(res->phy_clk); +-err_clk_phy: + clk_disable_unprepare(res->core_clk); + err_clk_core: + clk_disable_unprepare(res->iface_clk); diff --git a/patches.suse/PCI-qcom-Make-sure-PCIe-is-reset-before-init-for-rev.patch b/patches.suse/PCI-qcom-Make-sure-PCIe-is-reset-before-init-for-rev.patch new file mode 100644 index 0000000..84233d4 --- /dev/null +++ b/patches.suse/PCI-qcom-Make-sure-PCIe-is-reset-before-init-for-rev.patch @@ -0,0 +1,52 @@ +From: Ansuel Smith +Date: Tue, 1 Sep 2020 14:49:54 +0200 +Subject: PCI: qcom: Make sure PCIe is reset before init for rev 2.1.0 +Git-commit: d3d4d028afb785e52c55024d779089654f8302e7 +Patch-mainline: 5.10-rc1 +References: git-fixes + +Qsdk U-Boot can incorrectly leave the PCIe interface in an undefined +state if bootm command is used instead of bootipq. This is caused by the +not deinit of PCIe when bootm is called. Reset the PCIe before init +anyway to fix this U-Boot bug. + +Link: https://lore.kernel.org/r/20200901124955.137-1-ansuelsmth@gmail.com +Fixes: 82a823833f4e ("PCI: qcom: Add Qualcomm PCIe controller driver") +Signed-off-by: Ansuel Smith +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Bjorn Andersson +Cc: stable@vger.kernel.org # v4.19+ +Signed-off-by: Jiri Slaby +--- + drivers/pci/dwc/pcie-qcom.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/drivers/pci/dwc/pcie-qcom.c ++++ b/drivers/pci/dwc/pcie-qcom.c +@@ -318,6 +318,9 @@ static void qcom_pcie_deinit_2_1_0(struc + clk_disable_unprepare(res->core_clk); + clk_disable_unprepare(res->aux_clk); + clk_disable_unprepare(res->ref_clk); ++ ++ writel(1, pcie->parf + PCIE20_PARF_PHY_CTRL); ++ + regulator_bulk_disable(ARRAY_SIZE(res->supplies), res->supplies); + } + +@@ -330,6 +333,16 @@ static int qcom_pcie_init_2_1_0(struct q + u32 val; + int ret; + ++ /* reset the PCIe interface as uboot can leave it undefined state */ ++ reset_control_assert(res->pci_reset); ++ reset_control_assert(res->axi_reset); ++ reset_control_assert(res->ahb_reset); ++ reset_control_assert(res->por_reset); ++ reset_control_assert(res->ext_reset); ++ reset_control_assert(res->phy_reset); ++ ++ writel(1, pcie->parf + PCIE20_PARF_PHY_CTRL); ++ + ret = regulator_bulk_enable(ARRAY_SIZE(res->supplies), res->supplies); + if (ret < 0) { + dev_err(dev, "cannot enable regulators\n"); diff --git a/patches.suse/PCI-switchtec-Read-all-64-bits-of-part_event_bitmap.patch b/patches.suse/PCI-switchtec-Read-all-64-bits-of-part_event_bitmap.patch new file mode 100644 index 0000000..afddf7f --- /dev/null +++ b/patches.suse/PCI-switchtec-Read-all-64-bits-of-part_event_bitmap.patch @@ -0,0 +1,43 @@ +From: Logan Gunthorpe +Date: Tue, 10 Sep 2019 13:58:33 -0600 +Subject: PCI/switchtec: Read all 64 bits of part_event_bitmap +Git-commit: 6acdf7e19b37cb3a9258603d0eab315079c19c5e +Patch-mainline: 5.5-rc1 +References: git-fixes + +The part_event_bitmap register is 64 bits wide, so read it with ioread64() +instead of the 32-bit ioread32(). + +[js] include also linux/io-64-nonatomic-lo-hi.h, it was added later + +Fixes: 52eabba5bcdb ("switchtec: Add IOCTLs to the Switchtec driver") +Link: https://lore.kernel.org/r/20190910195833.3891-1-logang@deltatee.com +Reported-by: Doug Meyer +Signed-off-by: Logan Gunthorpe +Signed-off-by: Bjorn Helgaas +Cc: stable@vger.kernel.org # v4.12+ +Cc: Kelvin Cao +Signed-off-by: Jiri Slaby +--- + drivers/pci/switch/switchtec.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/pci/switch/switchtec.c ++++ b/drivers/pci/switch/switchtec.c +@@ -24,6 +24,7 @@ + #include + #include + ++#include + #include + + MODULE_DESCRIPTION("Microsemi Switchtec(tm) PCIe Management Driver"); +@@ -876,7 +877,7 @@ static int ioctl_event_summary(struct sw + u32 reg; + + s.global = ioread32(&stdev->mmio_sw_event->global_summary); +- s.part_bitmap = ioread32(&stdev->mmio_sw_event->part_event_bitmap); ++ s.part_bitmap = ioread64(&stdev->mmio_sw_event->part_event_bitmap); + s.local_part = ioread32(&stdev->mmio_part_cfg->part_event_summary); + + for (i = 0; i < stdev->partition_count; i++) { diff --git a/patches.suse/Revert-NFSv4-Handle-the-special-Linux-file-open-acce.patch b/patches.suse/Revert-NFSv4-Handle-the-special-Linux-file-open-acce.patch new file mode 100644 index 0000000..6ffc0ef --- /dev/null +++ b/patches.suse/Revert-NFSv4-Handle-the-special-Linux-file-open-acce.patch @@ -0,0 +1,50 @@ +From: ChenXiaoSong +Date: Tue, 29 Mar 2022 19:32:07 +0800 +Subject: [PATCH] Revert "NFSv4: Handle the special Linux file open access + mode" +Git-commit: ab0fc21bc7105b54bafd85bd8b82742f9e68898a +Patch-mainline: v5.18 +References: git-fixes + +This reverts commit 44942b4e457beda00981f616402a1a791e8c616e. + +After secondly opening a file with O_ACCMODE|O_DIRECT flags, +nfs4_valid_open_stateid() will dereference NULL nfs4_state when lseek(). + +Reproducer: 1. mount -t nfs -o vers=4.2 $server_ip:/ /mnt/ + 2. fd = open("/mnt/file", O_ACCMODE|O_DIRECT|O_CREAT) + 3. close(fd) + 4. fd = open("/mnt/file", O_ACCMODE|O_DIRECT) + 5. lseek(fd) + +Reported-by: Lyu Tao +Signed-off-by: ChenXiaoSong +Signed-off-by: Trond Myklebust +Acked-by: NeilBrown + +--- + fs/nfs/inode.c | 1 - + fs/nfs/nfs4file.c | 2 +- + 2 files changed, 1 insertion(+), 2 deletions(-) + +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -1002,7 +1002,6 @@ int nfs_open(struct inode *inode, struct + nfs_fscache_open_file(inode, filp); + return 0; + } +-EXPORT_SYMBOL_GPL(nfs_open); + + /* + * This function is called whenever some part of NFS notices that +--- a/fs/nfs/nfs4file.c ++++ b/fs/nfs/nfs4file.c +@@ -49,7 +49,7 @@ nfs4_file_open(struct inode *inode, stru + return err; + + if ((openflags & O_ACCMODE) == 3) +- return nfs_open(inode, filp); ++ openflags--; + + /* We can't create new files here */ + openflags &= ~(O_CREAT|O_EXCL); diff --git a/patches.suse/Revert-SUNRPC-Ensure-gss-proxy-connects-on-setup.patch b/patches.suse/Revert-SUNRPC-Ensure-gss-proxy-connects-on-setup.patch new file mode 100644 index 0000000..eba0a3e --- /dev/null +++ b/patches.suse/Revert-SUNRPC-Ensure-gss-proxy-connects-on-setup.patch @@ -0,0 +1,56 @@ +From: Trond Myklebust +Date: Sat, 7 May 2022 13:48:21 -0400 +Subject: [PATCH] Revert "SUNRPC: Ensure gss-proxy connects on setup" +Git-commit: 3d1b0d351441c2be7de082b92f43d0bfdc95a8f3 +Patch-mainline: v5.18 +References: git-fixes + +This reverts commit 892de36fd4a98fab3298d417c051d9099af5448d. + +The gssproxy server is unresponsive when it calls into the kernel to +start the upcall service, so it will not reply to our RPC ping at all. + +Reported-by: "J.Bruce Fields" +Fixes: 892de36fd4a9 ("SUNRPC: Ensure gss-proxy connects on setup") +Signed-off-by: Trond Myklebust +Acked-by: NeilBrown + +--- + include/linux/sunrpc/clnt.h | 1 - + net/sunrpc/auth_gss/gss_rpc_upcall.c | 2 +- + net/sunrpc/clnt.c | 3 --- + 3 files changed, 1 insertion(+), 5 deletions(-) + +--- a/include/linux/sunrpc/clnt.h ++++ b/include/linux/sunrpc/clnt.h +@@ -142,7 +142,6 @@ struct rpc_add_xprt_test { + #define RPC_CLNT_CREATE_INFINITE_SLOTS (1UL << 7) + #define RPC_CLNT_CREATE_NO_IDLE_TIMEOUT (1UL << 8) + #define RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT (1UL << 9) +-#define RPC_CLNT_CREATE_IGNORE_NULL_UNAVAIL (1UL << 12) + + struct rpc_clnt *rpc_create(struct rpc_create_args *args); + struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *, +--- a/net/sunrpc/auth_gss/gss_rpc_upcall.c ++++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c +@@ -110,7 +110,7 @@ static int gssp_rpc_create(struct net *n + * timeout, which would result in reconnections being + * done without the correct namespace: + */ +- .flags = RPC_CLNT_CREATE_IGNORE_NULL_UNAVAIL | ++ .flags = RPC_CLNT_CREATE_NOPING | + RPC_CLNT_CREATE_NO_IDLE_TIMEOUT + }; + struct rpc_clnt *clnt; +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -477,9 +477,6 @@ static struct rpc_clnt *rpc_create_xprt( + + if (!(args->flags & RPC_CLNT_CREATE_NOPING)) { + int err = rpc_ping(clnt); +- if ((args->flags & RPC_CLNT_CREATE_IGNORE_NULL_UNAVAIL) && +- err == -EOPNOTSUPP) +- err = 0; + if (err != 0) { + rpc_shutdown_client(clnt); + return ERR_PTR(err); diff --git a/patches.suse/Revert-SUNRPC-attempt-AF_LOCAL-connect-on-setup.patch b/patches.suse/Revert-SUNRPC-attempt-AF_LOCAL-connect-on-setup.patch new file mode 100644 index 0000000..e278dcb --- /dev/null +++ b/patches.suse/Revert-SUNRPC-attempt-AF_LOCAL-connect-on-setup.patch @@ -0,0 +1,35 @@ +From: Trond Myklebust +Date: Fri, 29 Apr 2022 12:27:30 -0400 +Subject: [PATCH] Revert "SUNRPC: attempt AF_LOCAL connect on setup" +Git-commit: a3d0562d4dc039bca39445e1cddde7951662e17d +Patch-mainline: v5.16-rc6 +References: git-fixes + +This reverts commit 7073ea8799a8cf73db60270986f14e4aae20fa80. + +We must not try to connect the socket while the transport is under +construction, because the mechanisms to safely tear it down are not in +place. As the code stands, we end up leaking the sockets on a connection +error. + +Reported-by: wanghai (M) +Cc: stable@vger.kernel.org +Signed-off-by: Trond Myklebust +Acked-by: NeilBrown + +--- + net/sunrpc/xprtsock.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -2962,9 +2962,6 @@ static struct rpc_xprt *xs_setup_local(s + } + xprt_set_bound(xprt); + xs_format_peer_addresses(xprt, "local", RPCBIND_NETID_LOCAL); +- ret = ERR_PTR(xs_local_setup_socket(transport)); +- if (ret) +- goto out_err; + break; + default: + ret = ERR_PTR(-EAFNOSUPPORT); diff --git a/patches.suse/Revert-ibmvnic-Add-ethtool-private-flag-for-driver-d.patch b/patches.suse/Revert-ibmvnic-Add-ethtool-private-flag-for-driver-d.patch new file mode 100644 index 0000000..47b94cf --- /dev/null +++ b/patches.suse/Revert-ibmvnic-Add-ethtool-private-flag-for-driver-d.patch @@ -0,0 +1,258 @@ +From ea94e7b11702e12d44ba6b0525aee4a55e52c825 Mon Sep 17 00:00:00 2001 +From: Dany Madden +Date: Wed, 27 Apr 2022 18:51:46 -0500 +Subject: [PATCH] Revert "ibmvnic: Add ethtool private flag for driver-defined + queue limits" + +References: bsc#1121726 ltc#174633 git-fixes +Patch-mainline: v5.18-rc5 +Git-commit: aeaf59b78712c7a1827c76f086acff4f586e072f + +This reverts commit 723ad916134784b317b72f3f6cf0f7ba774e5dae + +When client requests channel or ring size larger than what the server +can support the server will cap the request to the supported max. So, +the client would not be able to successfully request resources that +exceed the server limit. + +Fixes: 723ad9161347 ("ibmvnic: Add ethtool private flag for driver-defined queue limits") +Signed-off-by: Dany Madden +Link: https://lore.kernel.org/r/20220427235146.23189-1-drt@linux.ibm.com +Signed-off-by: Jakub Kicinski +Acked-by: Michal Suchanek +--- + drivers/net/ethernet/ibm/ibmvnic.c | 129 ++++++++--------------------- + drivers/net/ethernet/ibm/ibmvnic.h | 6 -- + 2 files changed, 35 insertions(+), 100 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index a84d459f204f..13acff619cf4 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -2918,13 +2918,8 @@ static void ibmvnic_get_ringparam(struct net_device *netdev, + { + struct ibmvnic_adapter *adapter = netdev_priv(netdev); + +- if (adapter->priv_flags & IBMVNIC_USE_SERVER_MAXES) { +- ring->rx_max_pending = adapter->max_rx_add_entries_per_subcrq; +- ring->tx_max_pending = adapter->max_tx_entries_per_subcrq; +- } else { +- ring->rx_max_pending = IBMVNIC_MAX_QUEUE_SZ; +- ring->tx_max_pending = IBMVNIC_MAX_QUEUE_SZ; +- } ++ ring->rx_max_pending = adapter->max_rx_add_entries_per_subcrq; ++ ring->tx_max_pending = adapter->max_tx_entries_per_subcrq; + ring->rx_mini_max_pending = 0; + ring->rx_jumbo_max_pending = 0; + ring->rx_pending = adapter->req_rx_add_entries_per_subcrq; +@@ -2937,23 +2932,21 @@ static int ibmvnic_set_ringparam(struct net_device *netdev, + struct ethtool_ringparam *ring) + { + struct ibmvnic_adapter *adapter = netdev_priv(netdev); +- int ret; + +- ret = 0; ++ if (ring->rx_pending > adapter->max_rx_add_entries_per_subcrq || ++ ring->tx_pending > adapter->max_tx_entries_per_subcrq) { ++ netdev_err(netdev, "Invalid request.\n"); ++ netdev_err(netdev, "Max tx buffers = %llu\n", ++ adapter->max_rx_add_entries_per_subcrq); ++ netdev_err(netdev, "Max rx buffers = %llu\n", ++ adapter->max_tx_entries_per_subcrq); ++ return -EINVAL; ++ } ++ + adapter->desired.rx_entries = ring->rx_pending; + adapter->desired.tx_entries = ring->tx_pending; + +- ret = wait_for_reset(adapter); +- +- if (!ret && +- (adapter->req_rx_add_entries_per_subcrq != ring->rx_pending || +- adapter->req_tx_entries_per_subcrq != ring->tx_pending)) +- netdev_info(netdev, +- "Could not match full ringsize request. Requested: RX %d, TX %d; Allowed: RX %llu, TX %llu\n", +- ring->rx_pending, ring->tx_pending, +- adapter->req_rx_add_entries_per_subcrq, +- adapter->req_tx_entries_per_subcrq); +- return ret; ++ return wait_for_reset(adapter); + } + + static void ibmvnic_get_channels(struct net_device *netdev, +@@ -2961,14 +2954,8 @@ static void ibmvnic_get_channels(struct net_device *netdev, + { + struct ibmvnic_adapter *adapter = netdev_priv(netdev); + +- if (adapter->priv_flags & IBMVNIC_USE_SERVER_MAXES) { +- channels->max_rx = adapter->max_rx_queues; +- channels->max_tx = adapter->max_tx_queues; +- } else { +- channels->max_rx = IBMVNIC_MAX_QUEUES; +- channels->max_tx = IBMVNIC_MAX_QUEUES; +- } +- ++ channels->max_rx = adapter->max_rx_queues; ++ channels->max_tx = adapter->max_tx_queues; + channels->max_other = 0; + channels->max_combined = 0; + channels->rx_count = adapter->req_rx_queues; +@@ -2981,22 +2968,11 @@ static int ibmvnic_set_channels(struct net_device *netdev, + struct ethtool_channels *channels) + { + struct ibmvnic_adapter *adapter = netdev_priv(netdev); +- int ret; + +- ret = 0; + adapter->desired.rx_queues = channels->rx_count; + adapter->desired.tx_queues = channels->tx_count; + +- ret = wait_for_reset(adapter); +- +- if (!ret && +- (adapter->req_rx_queues != channels->rx_count || +- adapter->req_tx_queues != channels->tx_count)) +- netdev_info(netdev, +- "Could not match full channels request. Requested: RX %d, TX %d; Allowed: RX %llu, TX %llu\n", +- channels->rx_count, channels->tx_count, +- adapter->req_rx_queues, adapter->req_tx_queues); +- return ret; ++ return wait_for_reset(adapter); + } + + static void ibmvnic_get_strings(struct net_device *dev, u32 stringset, u8 *data) +@@ -3004,43 +2980,32 @@ static void ibmvnic_get_strings(struct net_device *dev, u32 stringset, u8 *data) + struct ibmvnic_adapter *adapter = netdev_priv(dev); + int i; + +- switch (stringset) { +- case ETH_SS_STATS: +- for (i = 0; i < ARRAY_SIZE(ibmvnic_stats); +- i++, data += ETH_GSTRING_LEN) +- memcpy(data, ibmvnic_stats[i].name, ETH_GSTRING_LEN); ++ if (stringset != ETH_SS_STATS) ++ return; + +- for (i = 0; i < adapter->req_tx_queues; i++) { +- snprintf(data, ETH_GSTRING_LEN, "tx%d_packets", i); +- data += ETH_GSTRING_LEN; ++ for (i = 0; i < ARRAY_SIZE(ibmvnic_stats); i++, data += ETH_GSTRING_LEN) ++ memcpy(data, ibmvnic_stats[i].name, ETH_GSTRING_LEN); + +- snprintf(data, ETH_GSTRING_LEN, "tx%d_bytes", i); +- data += ETH_GSTRING_LEN; ++ for (i = 0; i < adapter->req_tx_queues; i++) { ++ snprintf(data, ETH_GSTRING_LEN, "tx%d_packets", i); ++ data += ETH_GSTRING_LEN; + +- snprintf(data, ETH_GSTRING_LEN, +- "tx%d_dropped_packets", i); +- data += ETH_GSTRING_LEN; +- } ++ snprintf(data, ETH_GSTRING_LEN, "tx%d_bytes", i); ++ data += ETH_GSTRING_LEN; + +- for (i = 0; i < adapter->req_rx_queues; i++) { +- snprintf(data, ETH_GSTRING_LEN, "rx%d_packets", i); +- data += ETH_GSTRING_LEN; ++ snprintf(data, ETH_GSTRING_LEN, "tx%d_dropped_packets", i); ++ data += ETH_GSTRING_LEN; ++ } + +- snprintf(data, ETH_GSTRING_LEN, "rx%d_bytes", i); +- data += ETH_GSTRING_LEN; ++ for (i = 0; i < adapter->req_rx_queues; i++) { ++ snprintf(data, ETH_GSTRING_LEN, "rx%d_packets", i); ++ data += ETH_GSTRING_LEN; + +- snprintf(data, ETH_GSTRING_LEN, "rx%d_interrupts", i); +- data += ETH_GSTRING_LEN; +- } +- break; ++ snprintf(data, ETH_GSTRING_LEN, "rx%d_bytes", i); ++ data += ETH_GSTRING_LEN; + +- case ETH_SS_PRIV_FLAGS: +- for (i = 0; i < ARRAY_SIZE(ibmvnic_priv_flags); i++) +- strcpy(data + i * ETH_GSTRING_LEN, +- ibmvnic_priv_flags[i]); +- break; +- default: +- return; ++ snprintf(data, ETH_GSTRING_LEN, "rx%d_interrupts", i); ++ data += ETH_GSTRING_LEN; + } + } + +@@ -3053,8 +3018,6 @@ static int ibmvnic_get_sset_count(struct net_device *dev, int sset) + return ARRAY_SIZE(ibmvnic_stats) + + adapter->req_tx_queues * NUM_TX_STATS + + adapter->req_rx_queues * NUM_RX_STATS; +- case ETH_SS_PRIV_FLAGS: +- return ARRAY_SIZE(ibmvnic_priv_flags); + default: + return -EOPNOTSUPP; + } +@@ -3107,26 +3070,6 @@ static void ibmvnic_get_ethtool_stats(struct net_device *dev, + } + } + +-static u32 ibmvnic_get_priv_flags(struct net_device *netdev) +-{ +- struct ibmvnic_adapter *adapter = netdev_priv(netdev); +- +- return adapter->priv_flags; +-} +- +-static int ibmvnic_set_priv_flags(struct net_device *netdev, u32 flags) +-{ +- struct ibmvnic_adapter *adapter = netdev_priv(netdev); +- bool which_maxes = !!(flags & IBMVNIC_USE_SERVER_MAXES); +- +- if (which_maxes) +- adapter->priv_flags |= IBMVNIC_USE_SERVER_MAXES; +- else +- adapter->priv_flags &= ~IBMVNIC_USE_SERVER_MAXES; +- +- return 0; +-} +- + static const struct ethtool_ops ibmvnic_ethtool_ops = { + .get_drvinfo = ibmvnic_get_drvinfo, + .get_msglevel = ibmvnic_get_msglevel, +@@ -3140,8 +3083,6 @@ static const struct ethtool_ops ibmvnic_ethtool_ops = { + .get_sset_count = ibmvnic_get_sset_count, + .get_ethtool_stats = ibmvnic_get_ethtool_stats, + .get_link_ksettings = ibmvnic_get_link_ksettings, +- .get_priv_flags = ibmvnic_get_priv_flags, +- .set_priv_flags = ibmvnic_set_priv_flags, + }; + + /* Routines for managing CRQs/sCRQs */ +diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h +index 9fc4d3068018..d87f88d1552d 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.h ++++ b/drivers/net/ethernet/ibm/ibmvnic.h +@@ -52,11 +52,6 @@ + + #define IBMVNIC_RESET_DELAY 100 + +-static const char ibmvnic_priv_flags[][ETH_GSTRING_LEN] = { +-#define IBMVNIC_USE_SERVER_MAXES 0x1 +- "use-server-maxes" +-}; +- + struct ibmvnic_login_buffer { + __be32 len; + __be32 version; +@@ -895,7 +890,6 @@ struct ibmvnic_adapter { + struct ibmvnic_control_ip_offload_buffer ip_offload_ctrl; + dma_addr_t ip_offload_ctrl_tok; + u32 msg_enable; +- u32 priv_flags; + + /* Vital Product Data (VPD) */ + struct ibmvnic_vpd *vpd; +-- +2.34.1 + diff --git a/patches.suse/SUNRPC-Ensure-gss-proxy-connects-on-setup.patch b/patches.suse/SUNRPC-Ensure-gss-proxy-connects-on-setup.patch new file mode 100644 index 0000000..9e67b31 --- /dev/null +++ b/patches.suse/SUNRPC-Ensure-gss-proxy-connects-on-setup.patch @@ -0,0 +1,56 @@ +From: Trond Myklebust +Date: Fri, 29 Apr 2022 12:22:10 -0400 +Subject: [PATCH] SUNRPC: Ensure gss-proxy connects on setup +Git-commit: 892de36fd4a98fab3298d417c051d9099af5448d +Patch-mainline: v5.18-rc6 +References: git-fixes + +For reasons best known to the author, gss-proxy does not implement a +NULL procedure, and returns RPC_PROC_UNAVAIL. However we still want to +ensure that we connect to the service at setup time. +So add a quirk-flag specially for this case. + +Fixes: 1d658336b05f ("SUNRPC: Add RPC based upcall mechanism for RPCGSS auth") +Cc: stable@vger.kernel.org +Signed-off-by: Trond Myklebust +Acked-by: NeilBrown + +--- + include/linux/sunrpc/clnt.h | 1 + + net/sunrpc/auth_gss/gss_rpc_upcall.c | 2 +- + net/sunrpc/clnt.c | 3 +++ + 3 files changed, 5 insertions(+), 1 deletion(-) + +--- a/include/linux/sunrpc/clnt.h ++++ b/include/linux/sunrpc/clnt.h +@@ -142,6 +142,7 @@ struct rpc_add_xprt_test { + #define RPC_CLNT_CREATE_INFINITE_SLOTS (1UL << 7) + #define RPC_CLNT_CREATE_NO_IDLE_TIMEOUT (1UL << 8) + #define RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT (1UL << 9) ++#define RPC_CLNT_CREATE_IGNORE_NULL_UNAVAIL (1UL << 12) + + struct rpc_clnt *rpc_create(struct rpc_create_args *args); + struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *, +--- a/net/sunrpc/auth_gss/gss_rpc_upcall.c ++++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c +@@ -110,7 +110,7 @@ static int gssp_rpc_create(struct net *n + * timeout, which would result in reconnections being + * done without the correct namespace: + */ +- .flags = RPC_CLNT_CREATE_NOPING | ++ .flags = RPC_CLNT_CREATE_IGNORE_NULL_UNAVAIL | + RPC_CLNT_CREATE_NO_IDLE_TIMEOUT + }; + struct rpc_clnt *clnt; +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -477,6 +477,9 @@ static struct rpc_clnt *rpc_create_xprt( + + if (!(args->flags & RPC_CLNT_CREATE_NOPING)) { + int err = rpc_ping(clnt); ++ if ((args->flags & RPC_CLNT_CREATE_IGNORE_NULL_UNAVAIL) && ++ err == -EOPNOTSUPP) ++ err = 0; + if (err != 0) { + rpc_shutdown_client(clnt); + return ERR_PTR(err); diff --git a/patches.suse/SUNRPC-Ensure-that-the-gssproxy-client-can-start-in-.patch b/patches.suse/SUNRPC-Ensure-that-the-gssproxy-client-can-start-in-.patch new file mode 100644 index 0000000..659f7af --- /dev/null +++ b/patches.suse/SUNRPC-Ensure-that-the-gssproxy-client-can-start-in-.patch @@ -0,0 +1,124 @@ +From: Trond Myklebust +Date: Sat, 7 May 2022 13:53:59 -0400 +Subject: [PATCH] SUNRPC: Ensure that the gssproxy client can start in a + connected state +Git-commit: fd13359f54ee854f00134abc6be32da94ec53dbf +Patch-mainline: v5.18 +References: git-fixes + +Ensure that the gssproxy client connects to the server from the gssproxy +daemon process context so that the AF_LOCAL socket connection is done +using the correct path and namespaces. + +Fixes: 1d658336b05f ("SUNRPC: Add RPC based upcall mechanism for RPCGSS auth") +Cc: stable@vger.kernel.org +Signed-off-by: Trond Myklebust +Acked-by: NeilBrown + +--- + include/linux/sunrpc/clnt.h | 1 + net/sunrpc/auth_gss/gss_rpc_upcall.c | 1 + net/sunrpc/clnt.c | 51 +++++++++++++++++++++++++++++++++++ + 3 files changed, 53 insertions(+) + +--- a/include/linux/sunrpc/clnt.h ++++ b/include/linux/sunrpc/clnt.h +@@ -142,6 +142,7 @@ struct rpc_add_xprt_test { + #define RPC_CLNT_CREATE_INFINITE_SLOTS (1UL << 7) + #define RPC_CLNT_CREATE_NO_IDLE_TIMEOUT (1UL << 8) + #define RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT (1UL << 9) ++#define RPC_CLNT_CREATE_CONNECTED (1UL << 12) + + struct rpc_clnt *rpc_create(struct rpc_create_args *args); + struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *, +--- a/net/sunrpc/auth_gss/gss_rpc_upcall.c ++++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c +@@ -111,6 +111,7 @@ static int gssp_rpc_create(struct net *n + * done without the correct namespace: + */ + .flags = RPC_CLNT_CREATE_NOPING | ++ RPC_CLNT_CREATE_CONNECTED | + RPC_CLNT_CREATE_NO_IDLE_TIMEOUT + }; + struct rpc_clnt *clnt; +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -78,6 +78,7 @@ static void call_connect_status(struct r + + static __be32 *rpc_encode_header(struct rpc_task *task); + static __be32 *rpc_verify_header(struct rpc_task *task); ++static int rpc_ping_noreply(struct rpc_clnt *clnt); + static int rpc_ping(struct rpc_clnt *clnt); + + static void rpc_register_client(struct rpc_clnt *clnt) +@@ -481,6 +482,12 @@ static struct rpc_clnt *rpc_create_xprt( + rpc_shutdown_client(clnt); + return ERR_PTR(err); + } ++ } else if (args->flags & RPC_CLNT_CREATE_CONNECTED) { ++ int err = rpc_ping_noreply(clnt); ++ if (err != 0) { ++ rpc_shutdown_client(clnt); ++ return ERR_PTR(err); ++ } + } + + clnt->cl_softrtry = 1; +@@ -2542,6 +2549,10 @@ static void rpcproc_encode_null(void *rq + { + } + ++static struct rpc_procinfo rpcproc_null_noreply = { ++ .p_encode = rpcproc_encode_null, ++}; ++ + static int rpcproc_decode_null(void *rqstp, struct xdr_stream *xdr, void *obj) + { + return 0; +@@ -2591,6 +2602,46 @@ struct rpc_task *rpc_call_null(struct rp + } + EXPORT_SYMBOL_GPL(rpc_call_null); + ++static void ++rpc_null_call_prepare(struct rpc_task *task, void *data) ++{ ++ task->tk_flags &= ~RPC_TASK_NO_RETRANS_TIMEOUT; ++ rpc_call_start(task); ++} ++ ++static const struct rpc_call_ops rpc_null_ops = { ++ .rpc_call_prepare = rpc_null_call_prepare, ++ .rpc_call_done = rpc_default_callback, ++}; ++ ++static int rpc_ping_noreply(struct rpc_clnt *clnt) ++{ ++ struct rpc_message msg = { ++ .rpc_proc = &rpcproc_null_noreply, ++ }; ++ struct rpc_task_setup task_setup_data = { ++ .rpc_client = clnt, ++ .rpc_message = &msg, ++ .callback_ops = &rpc_null_ops, ++ .flags = RPC_TASK_SOFT | RPC_TASK_SOFTCONN, ++ }; ++ struct rpc_task *task; ++ struct rpc_cred *cred; ++ int status; ++ ++ cred = authnull_ops.lookup_cred(NULL, NULL, 0); ++ ++ task = rpc_run_task(&task_setup_data); ++ if (IS_ERR(task)) { ++ put_rpccred(cred); ++ return PTR_ERR(task); ++ } ++ put_rpccred(cred); ++ status = task->tk_status; ++ rpc_put_task(task); ++ return status; ++} ++ + struct rpc_cb_add_xprt_calldata { + struct rpc_xprt_switch *xps; + struct rpc_xprt *xprt; diff --git a/patches.suse/SUNRPC-Handle-low-memory-situations-in-call_status.patch b/patches.suse/SUNRPC-Handle-low-memory-situations-in-call_status.patch new file mode 100644 index 0000000..52bf37f --- /dev/null +++ b/patches.suse/SUNRPC-Handle-low-memory-situations-in-call_status.patch @@ -0,0 +1,35 @@ +From: Trond Myklebust +Date: Thu, 7 Apr 2022 09:50:19 -0400 +Subject: [PATCH] SUNRPC: Handle low memory situations in call_status() +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 9d82819d5b065348ce623f196bf601028e22ed00 +Patch-mainline: v5.18 +References: git-fixes + +We need to handle ENFILE, ENOBUFS, and ENOMEM, because +xprt_wake_pending_tasks() can be called with any one of these due to +socket creation failures. + +Fixes: b61d59fffd3e ("SUNRPC: xs_tcp_connect_worker{4,6}: merge common code") +Signed-off-by: Trond Myklebust +Acked-by: NeilBrown + +--- + net/sunrpc/clnt.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -2245,7 +2245,10 @@ call_status(struct rpc_task *task) + task->tk_action = call_bind; + break; + case -ENOBUFS: ++ case -ENFILE: ++ case -ENOMEM: + rpc_delay(task, HZ>>2); ++ break; + case -EAGAIN: + task->tk_action = call_transmit; + break; diff --git a/patches.suse/SUNRPC-avoid-race-between-mod_timer-and-del_timer_sy.patch b/patches.suse/SUNRPC-avoid-race-between-mod_timer-and-del_timer_sy.patch index 818cc11..28cd3e4 100644 --- a/patches.suse/SUNRPC-avoid-race-between-mod_timer-and-del_timer_sy.patch +++ b/patches.suse/SUNRPC-avoid-race-between-mod_timer-and-del_timer_sy.patch @@ -1,7 +1,8 @@ From: NeilBrown Date: Tue, 8 Mar 2022 13:20:57 +1100 Subject: [PATCH] SUNRPC: avoid race between mod_timer() and del_timer_sync() -Patch-mainline: Submitted, 08mar2022 - linux-nfs@vger.kernel.org +Patch-mainline: v5.18 +Git-commit: 3848e96edf4788f772d83990022fa7023a233d83 References: bnc#1195403 xprt_destory() claims XPRT_LOCKED and then calls del_timer_sync(). diff --git a/patches.suse/USB-Fix-slab-out-of-bounds-Write-bug-in-usb_hcd_poll.patch b/patches.suse/USB-Fix-slab-out-of-bounds-Write-bug-in-usb_hcd_poll.patch new file mode 100644 index 0000000..d33d15f --- /dev/null +++ b/patches.suse/USB-Fix-slab-out-of-bounds-Write-bug-in-usb_hcd_poll.patch @@ -0,0 +1,71 @@ +From 1d7d4c07932e04355d6e6528d44a2f2c9e354346 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Fri, 31 Dec 2021 21:07:12 -0500 +Subject: [PATCH] USB: Fix "slab-out-of-bounds Write" bug in + usb_hcd_poll_rh_status +Git-commit: 1d7d4c07932e04355d6e6528d44a2f2c9e354346 +References: git-fixes +Patch-mainline: v5.17-rc1 + +When the USB core code for getting root-hub status reports was +originally written, it was assumed that the hub driver would be its +only caller. But this isn't true now; user programs can use usbfs to +communicate with root hubs and get status reports. When they do this, +they may use a transfer_buffer that is smaller than the data returned +by the HCD, which will lead to a buffer overflow error when +usb_hcd_poll_rh_status() tries to store the status data. This was +discovered by syzbot: + +BUG: KASAN: slab-out-of-bounds in memcpy include/linux/fortify-string.h:225 [inline] +BUG: KASAN: slab-out-of-bounds in usb_hcd_poll_rh_status+0x5f4/0x780 drivers/usb/core/hcd.c:776 +Write of size 2 at addr ffff88801da403c0 by task syz-executor133/4062 + +This patch fixes the bug by reducing the amount of status data if it +won't fit in the transfer_buffer. If some data gets discarded then +the URB's completion status is set to -EOVERFLOW rather than 0, to let +the user know what happened. + +Reported-and-tested-by: syzbot+3ae6a2b06f131ab9849f@syzkaller.appspotmail.com +Signed-off-by: Alan Stern +Cc: +Link: https://lore.kernel.org/r/Yc+3UIQJ2STbxNua@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Oliver Neukum +--- + drivers/usb/core/hcd.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c +index 9ffc63ae65ac..3e01dd6e509b 100644 +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -753,6 +753,7 @@ void usb_hcd_poll_rh_status(struct usb_hcd *hcd) + { + struct urb *urb; + int length; ++ int status; + unsigned long flags; + char buffer[6]; /* Any root hubs with > 31 ports? */ + +@@ -770,11 +771,17 @@ void usb_hcd_poll_rh_status(struct usb_hcd *hcd) + if (urb) { + clear_bit(HCD_FLAG_POLL_PENDING, &hcd->flags); + hcd->status_urb = NULL; ++ if (urb->transfer_buffer_length >= length) { ++ status = 0; ++ } else { ++ status = -EOVERFLOW; ++ length = urb->transfer_buffer_length; ++ } + urb->actual_length = length; + memcpy(urb->transfer_buffer, buffer, length); + + usb_hcd_unlink_urb_from_ep(hcd, urb); +- usb_hcd_giveback_urb(hcd, urb, 0); ++ usb_hcd_giveback_urb(hcd, urb, status); + } else { + length = 0; + set_bit(HCD_FLAG_POLL_PENDING, &hcd->flags); +-- +2.34.1 + diff --git a/patches.suse/USB-Fix-xhci-event-ring-dequeue-pointer-ERDP-update-.patch b/patches.suse/USB-Fix-xhci-event-ring-dequeue-pointer-ERDP-update-.patch new file mode 100644 index 0000000..b2ee44f --- /dev/null +++ b/patches.suse/USB-Fix-xhci-event-ring-dequeue-pointer-ERDP-update-.patch @@ -0,0 +1,58 @@ +From e91ac20889d1a26d077cc511365cd7ff4346a6f3 Mon Sep 17 00:00:00 2001 +From: Weitao Wang +Date: Fri, 8 Apr 2022 16:48:21 +0300 +Subject: [PATCH] USB: Fix xhci event ring dequeue pointer ERDP update issue +Git-commit: e91ac20889d1a26d077cc511365cd7ff4346a6f3 +References: git-fixes +Patch-mainline: v5.18-rc5 + +In some situations software handles TRB events slower than adding TRBs. +If the number of TRB events to be processed in a given interrupt is exactly +the same as the event ring size 256, then the local variable +"event_ring_deq" that holds the initial dequeue position is equal to +software_dequeue after handling all 256 interrupts. + +It will cause driver to not update ERDP to hardware, + +Software dequeue pointer is out of sync with ERDP on interrupt exit. +On the next interrupt, the event ring may full but driver will not +update ERDP as software_dequeue is equal to ERDP. + +[ 536.377115] xhci_hcd 0000:00:12.0: ERROR unknown event type 37 +[ 566.933173] sd 8:0:0:0: [sdb] tag#27 uas_eh_abort_handler 0 uas-tag 7 inflight: CMD OUT +[ 566.933181] sd 8:0:0:0: [sdb] tag#27 CDB: Write(10) 2a 00 17 71 e6 78 00 00 08 00 +[ 572.041186] xhci_hcd On some situataions,the0000:00:12.0: xHCI host not responding to stop endpoint command. +[ 572.057193] xhci_hcd 0000:00:12.0: Host halt failed, -110 +[ 572.057196] xhci_hcd 0000:00:12.0: xHCI host controller not responding, assume dead +[ 572.057236] sd 8:0:0:0: [sdb] tag#26 uas_eh_abort_handler 0 uas-tag 6 inflight: CMD +[ 572.057240] sd 8:0:0:0: [sdb] tag#26 CDB: Write(10) 2a 00 38 eb cc d8 00 00 08 00 +[ 572.057244] sd 8:0:0:0: [sdb] tag#25 uas_eh_abort_handler 0 uas-tag 5 inflight: CMD + +Hardware ERDP is updated mid event handling if there are more than 128 +events in an interrupt (half of ring size). +Fix this by updating the software local variable at the same time as +hardware ERDP. + +[commit message rewording -Mathias] + +Fixes: dc0ffbea5729 ("usb: host: xhci: update event ring dequeue pointer on purpose") +Reviewed-by: Peter Chen +Signed-off-by: Weitao Wang +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20220408134823.2527272-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Oliver Neukum +--- + drivers/usb/host/xhci-ring.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -2874,6 +2874,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd + } + + xhci_update_erst_dequeue(xhci, event_ring_deq); ++ event_ring_deq = xhci->event_ring->dequeue; + ret = IRQ_HANDLED; + + out: diff --git a/patches.suse/USB-core-Fix-bug-in-resuming-hub-s-handling-of-wakeu.patch b/patches.suse/USB-core-Fix-bug-in-resuming-hub-s-handling-of-wakeu.patch new file mode 100644 index 0000000..9e27ed6 --- /dev/null +++ b/patches.suse/USB-core-Fix-bug-in-resuming-hub-s-handling-of-wakeu.patch @@ -0,0 +1,75 @@ +From 0f663729bb4afc92a9986b66131ebd5b8a9254d1 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Sat, 1 Jan 2022 14:52:14 -0500 +Subject: [PATCH] USB: core: Fix bug in resuming hub's handling of wakeup + requests +Git-commit: 0f663729bb4afc92a9986b66131ebd5b8a9254d1 +References: git-fixes +Patch-mainline: v5.17-rc1 + +Bugzilla #213839 reports a 7-port hub that doesn't work properly when +devices are plugged into some of the ports; the kernel goes into an +unending disconnect/reinitialize loop as shown in the bug report. + +This "7-port hub" comprises two four-port hubs with one plugged into +the other; the failures occur when a device is plugged into one of the +downstream hub's ports. (These hubs have other problems too. For +example, they bill themselves as USB-2.0 compliant but they only run +at full speed.) + +It turns out that the failures are caused by bugs in both the kernel +and the hub. The hub's bug is that it reports a different +bmAttributes value in its configuration descriptor following a remote +wakeup (0xe0 before, 0xc0 after -- the wakeup-support bit has +changed). + +The kernel's bug is inside the hub driver's resume handler. When +hub_activate() sees that one of the hub's downstream ports got a +wakeup request from a child device, it notes this fact by setting the +corresponding bit in the hub->change_bits variable. But this variable +is meant for connection changes, not wakeup events; setting it causes +the driver to believe the downstream port has been disconnected and +then connected again (in addition to having received a wakeup +request). + +Because of this, the hub driver then tries to check whether the device +currently plugged into the downstream port is the same as the device +that had been attached there before. Normally this check succeeds and +wakeup handling continues with no harm done (which is why the bug +remained undetected until now). But with these dodgy hubs, the check +fails because the config descriptor has changed. This causes the hub +driver to reinitialize the child device, leading to the +disconnect/reinitialize loop described in the bug report. + +The proper way to note reception of a downstream wakeup request is +to set a bit in the hub->event_bits variable instead of +hub->change_bits. That way the hub driver will realize that something +has happened to the port but will not think the port and child device +have been disconnected. This patch makes that change. + +Cc: +Tested-by: Jonathan McDowell +Signed-off-by: Alan Stern +Link: https://lore.kernel.org/r/YdCw7nSfWYPKWQoD@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Oliver Neukum +--- + drivers/usb/core/hub.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 721794f0f494..47a1c8bddf86 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1228,7 +1228,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type) + */ + if (portchange || (hub_is_superspeed(hub->hdev) && + port_resumed)) +- set_bit(port1, hub->change_bits); ++ set_bit(port1, hub->event_bits); + + } else if (udev->persist_enabled) { + #ifdef CONFIG_PM +-- +2.34.1 + diff --git a/patches.suse/USB-quirks-add-STRING-quirk-for-VCOM-device.patch b/patches.suse/USB-quirks-add-STRING-quirk-for-VCOM-device.patch new file mode 100644 index 0000000..64a69af --- /dev/null +++ b/patches.suse/USB-quirks-add-STRING-quirk-for-VCOM-device.patch @@ -0,0 +1,35 @@ +From ec547af8a9ea6441864bad34172676b5652ceb96 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 14 Apr 2022 14:31:52 +0200 +Subject: [PATCH] USB: quirks: add STRING quirk for VCOM device +Git-commit: ec547af8a9ea6441864bad34172676b5652ceb96 +References: git-fixes +Patch-mainline: v5.18-rc5 + +This has been reported to stall if queried + +Cc: stable +Signed-off-by: Oliver Neukum +Link: https://lore.kernel.org/r/20220414123152.1700-1-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 8ce8c0d06c66..97b44a68668a 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -510,6 +510,9 @@ static const struct usb_device_id usb_quirk_list[] = { + /* DJI CineSSD */ + { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, + ++ /* VCOM device */ ++ { USB_DEVICE(0x4296, 0x7570), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS }, ++ + /* INTEL VALUE SSD */ + { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME }, + +-- +2.35.3 + diff --git a/patches.suse/USB-quirks-add-a-Realtek-card-reader.patch b/patches.suse/USB-quirks-add-a-Realtek-card-reader.patch new file mode 100644 index 0000000..3b7c331 --- /dev/null +++ b/patches.suse/USB-quirks-add-a-Realtek-card-reader.patch @@ -0,0 +1,30 @@ +From 2a7ccf6bb6f147f64c025ad68f4255d8e1e0ce6d Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 14 Apr 2022 13:02:09 +0200 +Subject: [PATCH] USB: quirks: add a Realtek card reader +Git-commit: 2a7ccf6bb6f147f64c025ad68f4255d8e1e0ce6d +References: git-fixes +Patch-mainline: v5.18-rc5 + +This device is reported to stall when enummerated. + +Cc: stable +Signed-off-by: Oliver Neukum +Link: https://lore.kernel.org/r/20220414110209.30924-1-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -251,6 +251,9 @@ static const struct usb_device_id usb_qu + { USB_DEVICE(0x0b05, 0x17e0), .driver_info = + USB_QUIRK_IGNORE_REMOTE_WAKEUP }, + ++ /* Realtek Semiconductor Corp. Mass Storage Device (Multicard Reader)*/ ++ { USB_DEVICE(0x0bda, 0x0151), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS }, ++ + /* Realtek hub in Dell WD19 (Type-C) */ + { USB_DEVICE(0x0bda, 0x0487), .driver_info = USB_QUIRK_NO_LPM }, + { USB_DEVICE(0x0bda, 0x5487), .driver_info = USB_QUIRK_RESET_RESUME }, diff --git a/patches.suse/USB-serial-cp210x-add-NCR-Retail-IO-box-id.patch b/patches.suse/USB-serial-cp210x-add-NCR-Retail-IO-box-id.patch new file mode 100644 index 0000000..a8feac9 --- /dev/null +++ b/patches.suse/USB-serial-cp210x-add-NCR-Retail-IO-box-id.patch @@ -0,0 +1,32 @@ +From b50f8f09c622297d3cf46e332e17ba8adedec9af Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 1 Feb 2022 11:42:52 +0100 +Subject: [PATCH] USB: serial: cp210x: add NCR Retail IO box id +Git-commit: b50f8f09c622297d3cf46e332e17ba8adedec9af +References: git-fixes +Patch-mainline: v5.17-rc4 + +Add the device id for NCR's Retail IO box (CP2105) used in NCR FastLane +SelfServ Checkout - R6C: + + https://www.ncr.com/product-catalog/ncr-fastlane-selfserv-checkout-r6c + +Reported-by: Scott Russell +Cc: stable@vger.kernel.org +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Oliver Neukum +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -55,6 +55,7 @@ static int cp210x_port_remove(struct usb + static void cp210x_dtr_rts(struct usb_serial_port *p, int on); + + static const struct usb_device_id id_table[] = { ++ { USB_DEVICE(0x0404, 0x034C) }, /* NCR Retail IO Box */ + { USB_DEVICE(0x045B, 0x0053) }, /* Renesas RX610 RX-Stick */ + { USB_DEVICE(0x0471, 0x066A) }, /* AKTAKOM ACE-1001 cable */ + { USB_DEVICE(0x0489, 0xE000) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */ diff --git a/patches.suse/USB-serial-cp210x-add-PIDs-for-Kamstrup-USB-Meter-Re.patch b/patches.suse/USB-serial-cp210x-add-PIDs-for-Kamstrup-USB-Meter-Re.patch new file mode 100644 index 0000000..4123111 --- /dev/null +++ b/patches.suse/USB-serial-cp210x-add-PIDs-for-Kamstrup-USB-Meter-Re.patch @@ -0,0 +1,42 @@ +From 35a923a0b329c343e9e81d79518e2937eba06fcd Mon Sep 17 00:00:00 2001 +From: Bruno Thomsen +Date: Thu, 14 Apr 2022 10:12:02 +0200 +Subject: [PATCH] USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader +Git-commit: 35a923a0b329c343e9e81d79518e2937eba06fcd +References: git-fixes +Patch-mainline: v5.18-rc5 + +Wireless reading of water and heat meters using 868 MHz wM-Bus mode C1. + +The two different product IDs allow detection of dongle antenna +solution: +- Internal antenna +- External antenna using SMA connector + +https://www.kamstrup.com/en-en/water-solutions/water-meter-reading/usb-meter-reader + +Signed-off-by: Bruno Thomsen +Link: https://lore.kernel.org/r/20220414081202.5591-1-bruno.thomsen@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Oliver Neukum +--- + drivers/usb/serial/cp210x.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index a27f7efcec6a..c374620a486f 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -194,6 +194,8 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x16DC, 0x0015) }, /* W-IE-NE-R Plein & Baus GmbH CML Control, Monitoring and Data Logger */ + { USB_DEVICE(0x17A8, 0x0001) }, /* Kamstrup Optical Eye/3-wire */ + { USB_DEVICE(0x17A8, 0x0005) }, /* Kamstrup M-Bus Master MultiPort 250D */ ++ { USB_DEVICE(0x17A8, 0x0101) }, /* Kamstrup 868 MHz wM-Bus C-Mode Meter Reader (Int Ant) */ ++ { USB_DEVICE(0x17A8, 0x0102) }, /* Kamstrup 868 MHz wM-Bus C-Mode Meter Reader (Ext Ant) */ + { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */ + { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */ + { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ +-- +2.35.3 + diff --git a/patches.suse/USB-serial-option-add-Fibocom-L610-modem.patch b/patches.suse/USB-serial-option-add-Fibocom-L610-modem.patch new file mode 100644 index 0000000..6117c01 --- /dev/null +++ b/patches.suse/USB-serial-option-add-Fibocom-L610-modem.patch @@ -0,0 +1,145 @@ +From 714adff9a6271b5f1664b04c944b598141ebfe73 Mon Sep 17 00:00:00 2001 +From: Sven Schwermer +Date: Mon, 25 Apr 2022 16:34:49 +0200 +Subject: [PATCH] USB: serial: option: add Fibocom L610 modem +Git-commit: 714adff9a6271b5f1664b04c944b598141ebfe73 +References: git-fixes +Patch-mainline: v5.18-rc7 + +The L610 modem has 3 USB configurations that are configurable via the AT +command AT+GTUSBMODE={31,32,33} which make the modem enumerate with the +following interfaces, respectively: + +31: Modem + NV + MOS + Diag + LOG + AT + AT +32: ECM + Modem + NV + MOS + Diag + LOG + AT + AT +33: RNDIS + Modem + NV + MOS + Diag + LOG + AT + AT + +A detailed description of the USB configuration for each mode follows: + ++GTUSBMODE: 31 +-------------- +T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#=124 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1782 ProdID=4d10 Rev= 0.00 +S: Manufacturer=FIBOCOM +S: Product=L610 +C:* #Ifs= 7 Cfg#= 1 Atr=e0 MxPwr=400mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + ++GTUSBMODE: 32 +-------------- +T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#=122 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1782 ProdID=4d11 Rev= 0.00 +S: Manufacturer=FIBOCOM +S: Product=L610 +C:* #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=400mA +A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=06 Prot=00 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + ++GTUSBMODE: 33 +-------------- +T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#=126 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1782 ProdID=4d11 Rev= 0.00 +S: Manufacturer=FIBOCOM +S: Product=L610 +C:* #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=400mA +A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=4096ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Sven Schwermer +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Oliver Neukum +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 1364ce7f0abf..cd82dd44f72d 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2123,6 +2123,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = RSVD(3) }, + { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */ + .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, ++ { USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */ ++ { USB_DEVICE_INTERFACE_CLASS(0x1782, 0x4d11, 0xff) }, /* Fibocom L610 (ECM/RNDIS mode) */ + { USB_DEVICE(0x2cb7, 0x0104), /* Fibocom NL678 series */ + .driver_info = RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ +-- +2.35.3 + diff --git a/patches.suse/USB-serial-option-add-Fibocom-MA510-modem.patch b/patches.suse/USB-serial-option-add-Fibocom-MA510-modem.patch new file mode 100644 index 0000000..5838d65 --- /dev/null +++ b/patches.suse/USB-serial-option-add-Fibocom-MA510-modem.patch @@ -0,0 +1,121 @@ +From 07989eb981d862f7f2be68d233d753f2e7ccc119 Mon Sep 17 00:00:00 2001 +From: Sven Schwermer +Date: Mon, 25 Apr 2022 16:34:50 +0200 +Subject: [PATCH] USB: serial: option: add Fibocom MA510 modem +Git-commit: 07989eb981d862f7f2be68d233d753f2e7ccc119 +References: git-fixes +Patch-mainline: v5.18-rc7 + +The MA510 modem has 3 USB configurations that are configurable via the AT +command AT+GTUSBMODE={30,31,32} which make the modem enumerate with the +following interfaces, respectively: + +30: Diag + QDSS + Modem + RMNET +31: Diag + Modem + AT + ECM +32: Modem + AT + ECM + +The first configuration (30) reuses u-blox R410M's VID/PID with +identical interface configuration. + +A detailed description of the USB configuration for each mode follows: + ++GTUSBMODE: 30 +-------------- +T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#= 19 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=05c6 ProdID=90b2 Rev= 0.00 +S: Manufacturer=Fibocom MA510 Modem +S: Product=Fibocom MA510 Modem +S: SerialNumber=55e2695b +C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + ++GTUSBMODE: 31 +-------------- +T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#= 99 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2cb7 ProdID=0106 Rev= 0.00 +S: Manufacturer=Fibocom MA510 Modem +S: Product=Fibocom MA510 Modem +S: SerialNumber=55e2695b +C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +A: FirstIf#= 3 IfCount= 2 Cls=02(comm.) Sub=00 Prot=00 +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option +E: Ad=84(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +I: If#= 4 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +I:* If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + ++GTUSBMODE: 32 +-------------- +T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#=100 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2cb7 ProdID=010a Rev= 0.00 +S: Manufacturer=Fibocom MA510 Modem +S: Product=Fibocom MA510 Modem +S: SerialNumber=55e2695b +C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA +A: FirstIf#= 2 IfCount= 2 Cls=02(comm.) Sub=00 Prot=00 +I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +I: If#= 3 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +I:* If#= 3 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Sven Schwermer +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Oliver Neukum +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index cd82dd44f72d..152ad882657d 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2129,6 +2129,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ + .driver_info = RSVD(6) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0106, 0xff) }, /* Fibocom MA510 (ECM mode w/ diag intf.) */ ++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x010a, 0xff) }, /* Fibocom MA510 (ECM mode) */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ +-- +2.35.3 + diff --git a/patches.suse/USB-serial-option-add-Telit-0x1057-0x1058-0x1075-com.patch b/patches.suse/USB-serial-option-add-Telit-0x1057-0x1058-0x1075-com.patch new file mode 100644 index 0000000..bfc34a5 --- /dev/null +++ b/patches.suse/USB-serial-option-add-Telit-0x1057-0x1058-0x1075-com.patch @@ -0,0 +1,51 @@ +From f32c5a0423400e01f4d7c607949fa3a1f006e8fa Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Wed, 6 Apr 2022 16:14:08 +0200 +Subject: [PATCH] USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 + compositions +Git-commit: f32c5a0423400e01f4d7c607949fa3a1f006e8fa +References: git-fixes +Patch-mainline: v5.18-rc5 + +Add support for the following Telit FN980 and FN990 compositions: + +0x1057: tty, adb, rmnet, tty, tty, tty, tty, tty +0x1058: tty, adb, tty, tty, tty, tty, tty +0x1075: adb, tty + +Signed-off-by: Daniele Palmas +Link: https://lore.kernel.org/r/20220406141408.580669-1-dnlplm@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Oliver Neukum +--- + drivers/usb/serial/option.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index e7755d9cfc61..8e2fc232da10 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1217,6 +1217,10 @@ static const struct usb_device_id option_ids[] = { + .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1056, 0xff), /* Telit FD980 */ + .driver_info = NCTRL(2) | RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1057, 0xff), /* Telit FN980 */ ++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1058, 0xff), /* Telit FN980 (PCIe) */ ++ .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1060, 0xff), /* Telit LN920 (rmnet) */ + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1061, 0xff), /* Telit LN920 (MBIM) */ +@@ -1233,6 +1237,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = NCTRL(2) | RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1073, 0xff), /* Telit FN990 (ECM) */ + .driver_info = NCTRL(0) | RSVD(1) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN990 (PCIe) */ ++ .driver_info = RSVD(0) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), +-- +2.35.3 + diff --git a/patches.suse/USB-serial-option-add-support-for-Cinterion-MV32-WA-.patch b/patches.suse/USB-serial-option-add-support-for-Cinterion-MV32-WA-.patch new file mode 100644 index 0000000..865804e --- /dev/null +++ b/patches.suse/USB-serial-option-add-support-for-Cinterion-MV32-WA-.patch @@ -0,0 +1,80 @@ +From b4a64ed6e7b857317070fcb9d87ff5d4a73be3e8 Mon Sep 17 00:00:00 2001 +From: Slark Xiao +Date: Thu, 14 Apr 2022 15:44:34 +0800 +Subject: [PATCH] USB: serial: option: add support for Cinterion + MV32-WA/MV32-WB +Git-commit: b4a64ed6e7b857317070fcb9d87ff5d4a73be3e8 +References: git-fixes +Patch-mainline: v5.18-rc5 + +Add support for Cinterion device MV32-WA/MV32-WB. MV32-WA PID is +0x00F1, and MV32-WB PID is 0x00F2. + +Test evidence as below: +T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 4 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 +P: Vendor=1e2d ProdID=00f1 Rev=05.04 +S: Manufacturer=Cinterion +S: Product=Cinterion PID 0x00F1 USB Mobile Broadband +S: SerialNumber=78ada8c4 +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA +I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +I: If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option + +T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 3 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 +P: Vendor=1e2d ProdID=00f2 Rev=05.04 +S: Manufacturer=Cinterion +S: Product=Cinterion PID 0x00F2 USB Mobile Broadband +S: SerialNumber=cdd06a78 +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA +I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +I: If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option + +Interface 0&1: MBIM, 2:Modem, 3: GNSS, 4: NMEA, 5: Diag +GNSS port don't use serial driver. + +Signed-off-by: Slark Xiao +Link: https://lore.kernel.org/r/20220414074434.5699-1-slark_xiao@163.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Oliver Neukum +--- + drivers/usb/serial/option.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 8e2fc232da10..1364ce7f0abf 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -432,6 +432,8 @@ static void option_instat_callback(struct urb *urb); + #define CINTERION_PRODUCT_CLS8 0x00b0 + #define CINTERION_PRODUCT_MV31_MBIM 0x00b3 + #define CINTERION_PRODUCT_MV31_RMNET 0x00b7 ++#define CINTERION_PRODUCT_MV32_WA 0x00f1 ++#define CINTERION_PRODUCT_MV32_WB 0x00f2 + + /* Olivetti products */ + #define OLIVETTI_VENDOR_ID 0x0b3c +@@ -1975,6 +1977,10 @@ static const struct usb_device_id option_ids[] = { + .driver_info = RSVD(3)}, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV31_RMNET, 0xff), + .driver_info = RSVD(0)}, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WA, 0xff), ++ .driver_info = RSVD(3)}, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WB, 0xff), ++ .driver_info = RSVD(3)}, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100), + .driver_info = RSVD(4) }, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120), +-- +2.35.3 + diff --git a/patches.suse/USB-serial-pl2303-add-IBM-device-IDs.patch b/patches.suse/USB-serial-pl2303-add-IBM-device-IDs.patch new file mode 100644 index 0000000..2beb270 --- /dev/null +++ b/patches.suse/USB-serial-pl2303-add-IBM-device-IDs.patch @@ -0,0 +1,53 @@ +From e1d15646565b284e9ef2433234d6cfdaf66695f1 Mon Sep 17 00:00:00 2001 +From: Eddie James +Date: Tue, 1 Mar 2022 16:44:46 -0600 +Subject: [PATCH] USB: serial: pl2303: add IBM device IDs +Git-commit: e1d15646565b284e9ef2433234d6cfdaf66695f1 +References: git-fixes +Patch-mainline: v5.18-rc1 + +IBM manufactures a PL2303 device for UPS communications. Add the vendor +and product IDs so that the PL2303 driver binds to the device. + +Signed-off-by: Eddie James +Signed-off-by: Joel Stanley +Signed-off-by: Eddie James +Link: https://lore.kernel.org/r/20220301224446.21236-1-eajames@linux.ibm.com +Cc: stable@vger.kernel.org +[ johan: amend the SoB chain ] +Signed-off-by: Johan Hovold +Signed-off-by: Oliver Neukum +--- + drivers/usb/serial/pl2303.c | 1 + + drivers/usb/serial/pl2303.h | 3 +++ + 2 files changed, 4 insertions(+) + +diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c +index a70fd86f735c..e2ef761ed39c 100644 +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -116,6 +116,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530GC_PRODUCT_ID) }, + { USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) }, + { USB_DEVICE(AT_VENDOR_ID, AT_VTKIT3_PRODUCT_ID) }, ++ { USB_DEVICE(IBM_VENDOR_ID, IBM_PRODUCT_ID) }, + { } /* Terminating entry */ + }; + +diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h +index 6097ee8fccb2..c5406452b774 100644 +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -35,6 +35,9 @@ + #define ATEN_PRODUCT_UC232B 0x2022 + #define ATEN_PRODUCT_ID2 0x2118 + ++#define IBM_VENDOR_ID 0x04b3 ++#define IBM_PRODUCT_ID 0x4016 ++ + #define IODATA_VENDOR_ID 0x04bb + #define IODATA_PRODUCT_ID 0x0a03 + #define IODATA_PRODUCT_ID_RSAQ5 0x0a0e +-- +2.34.1 + diff --git a/patches.suse/USB-serial-pl2303-add-device-id-for-HP-LM930-Display.patch b/patches.suse/USB-serial-pl2303-add-device-id-for-HP-LM930-Display.patch new file mode 100644 index 0000000..a892b19 --- /dev/null +++ b/patches.suse/USB-serial-pl2303-add-device-id-for-HP-LM930-Display.patch @@ -0,0 +1,47 @@ +From 26a08f8bad3e1f98d3153f939fb8cd330da4cb26 Mon Sep 17 00:00:00 2001 +From: Scott Chen +Date: Mon, 25 Apr 2022 17:00:20 +0800 +Subject: [PATCH] USB: serial: pl2303: add device id for HP LM930 Display +Git-commit: 26a08f8bad3e1f98d3153f939fb8cd330da4cb26 +References: git-fixes +Patch-mainline: v5.18-rc7 + +Add the device id for the HPLM930Display which is a PL2303GC based +device. + +Signed-off-by: Scott Chen +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Oliver Neukum +--- + drivers/usb/serial/pl2303.c | 1 + + drivers/usb/serial/pl2303.h | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c +index 88b284d61681..1d878d05a658 100644 +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -106,6 +106,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LCM960_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LM920_PRODUCT_ID) }, ++ { USB_DEVICE(HP_VENDOR_ID, HP_LM930_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LM940_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_TD620_PRODUCT_ID) }, + { USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) }, +diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h +index c5406452b774..732f9b13ad5d 100644 +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -135,6 +135,7 @@ + #define HP_TD620_PRODUCT_ID 0x0956 + #define HP_LD960_PRODUCT_ID 0x0b39 + #define HP_LD381_PRODUCT_ID 0x0f7f ++#define HP_LM930_PRODUCT_ID 0x0f9b + #define HP_LCM220_PRODUCT_ID 0x3139 + #define HP_LCM960_PRODUCT_ID 0x3239 + #define HP_LD220_PRODUCT_ID 0x3524 +-- +2.35.3 + diff --git a/patches.suse/USB-serial-qcserial-add-support-for-Sierra-Wireless-.patch b/patches.suse/USB-serial-qcserial-add-support-for-Sierra-Wireless-.patch new file mode 100644 index 0000000..14fd08d --- /dev/null +++ b/patches.suse/USB-serial-qcserial-add-support-for-Sierra-Wireless-.patch @@ -0,0 +1,35 @@ +From 870b1eee2d844727b06e238c121d260bc5645580 Mon Sep 17 00:00:00 2001 +From: Ethan Yang +Date: Mon, 25 Apr 2022 13:58:40 +0800 +Subject: [PATCH] USB: serial: qcserial: add support for Sierra Wireless EM7590 +Git-commit: 870b1eee2d844727b06e238c121d260bc5645580 +References: git-fixes +Patch-mainline: v5.18-rc7 + +Add support for Sierra Wireless EM7590 0xc080/0xc081 compositions. + +Signed-off-by: Ethan Yang +Link: https://lore.kernel.org/r/20220425055840.5693-1-etyang@sierrawireless.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Oliver Neukum +--- + drivers/usb/serial/qcserial.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c +index c18bf8164bc2..586ef5551e76 100644 +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -166,6 +166,8 @@ static const struct usb_device_id id_table[] = { + {DEVICE_SWI(0x1199, 0x9090)}, /* Sierra Wireless EM7565 QDL */ + {DEVICE_SWI(0x1199, 0x9091)}, /* Sierra Wireless EM7565 */ + {DEVICE_SWI(0x1199, 0x90d2)}, /* Sierra Wireless EM9191 QDL */ ++ {DEVICE_SWI(0x1199, 0xc080)}, /* Sierra Wireless EM7590 QDL */ ++ {DEVICE_SWI(0x1199, 0xc081)}, /* Sierra Wireless EM7590 */ + {DEVICE_SWI(0x413c, 0x81a2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */ + {DEVICE_SWI(0x413c, 0x81a3)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */ + {DEVICE_SWI(0x413c, 0x81a4)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */ +-- +2.35.3 + diff --git a/patches.suse/USB-serial-simple-add-Nokia-phone-driver.patch b/patches.suse/USB-serial-simple-add-Nokia-phone-driver.patch new file mode 100644 index 0000000..ab6a624 --- /dev/null +++ b/patches.suse/USB-serial-simple-add-Nokia-phone-driver.patch @@ -0,0 +1,156 @@ +From c4b9c570965f75d0d55e639747f1e5ccdad2fae0 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 28 Feb 2022 09:49:19 +0100 +Subject: [PATCH] USB: serial: simple: add Nokia phone driver +Git-commit: c4b9c570965f75d0d55e639747f1e5ccdad2fae0 +References: git-fixes +Patch-mainline: v5.18-rc1 + +Add a new "simple" driver for certain Nokia phones, including Nokia 130 +(RM-1035) which exposes two serial ports in "charging only" mode: + +Bus 001 Device 009: ID 0421:069a Nokia Mobile Phones 130 [RM-1035] (Charging only) +Device Descriptor: + bLength 18 + bDescriptorType 1 + bcdUSB 2.00 + bDeviceClass 0 + bDeviceSubClass 0 + bDeviceProtocol 0 + bMaxPacketSize0 8 + idVendor 0x0421 Nokia Mobile Phones + idProduct 0x069a 130 [RM-1035] (Charging only) + bcdDevice 1.00 + iManufacturer 1 Nokia + iProduct 2 Nokia 130 (RM-1035) + iSerial 0 + bNumConfigurations 1 + Configuration Descriptor: + bLength 9 + bDescriptorType 2 + wTotalLength 0x0037 + bNumInterfaces 2 + bConfigurationValue 1 + iConfiguration 0 + bmAttributes 0x80 + (Bus Powered) + MaxPower 500mA + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 0 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 255 Vendor Specific Subclass + bInterfaceProtocol 255 Vendor Specific Protocol + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x81 EP 1 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x01 EP 1 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 1 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 255 Vendor Specific Subclass + bInterfaceProtocol 255 Vendor Specific Protocol + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x82 EP 2 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x02 EP 2 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 0 +Device Status: 0x0000 + (Bus Powered) + +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20220228084919.10656-1-johan@kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Oliver Neukum +--- + drivers/usb/serial/Kconfig | 1 + + drivers/usb/serial/usb-serial-simple.c | 7 +++++++ + 2 files changed, 8 insertions(+) + +diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig +index de5c01257060..ef8d1c73c754 100644 +--- a/drivers/usb/serial/Kconfig ++++ b/drivers/usb/serial/Kconfig +@@ -66,6 +66,7 @@ config USB_SERIAL_SIMPLE + - Libtransistor USB console + - a number of Motorola phones + - Motorola Tetra devices ++ - Nokia mobile phones + - Novatel Wireless GPS receivers + - Siemens USB/MPI adapter. + - ViVOtech ViVOpay USB device. +diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c +index bd23a7cb1be2..4c6747889a19 100644 +--- a/drivers/usb/serial/usb-serial-simple.c ++++ b/drivers/usb/serial/usb-serial-simple.c +@@ -91,6 +91,11 @@ DEVICE(moto_modem, MOTO_IDS); + { USB_DEVICE(0x0cad, 0x9016) } /* TPG2200 */ + DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS); + ++/* Nokia mobile phone driver */ ++#define NOKIA_IDS() \ ++ { USB_DEVICE(0x0421, 0x069a) } /* Nokia 130 (RM-1035) */ ++DEVICE(nokia, NOKIA_IDS); ++ + /* Novatel Wireless GPS driver */ + #define NOVATEL_IDS() \ + { USB_DEVICE(0x09d7, 0x0100) } /* NovAtel FlexPack GPS */ +@@ -123,6 +128,7 @@ static struct usb_serial_driver * const serial_drivers[] = { + &vivopay_device, + &moto_modem_device, + &motorola_tetra_device, ++ &nokia_device, + &novatel_gps_device, + &hp4x_device, + &suunto_device, +@@ -140,6 +146,7 @@ static const struct usb_device_id id_table[] = { + VIVOPAY_IDS(), + MOTO_IDS(), + MOTOROLA_TETRA_IDS(), ++ NOKIA_IDS(), + NOVATEL_IDS(), + HP4X_IDS(), + SUUNTO_IDS(), +-- +2.34.1 + diff --git a/patches.suse/USB-serial-whiteheat-fix-heap-overflow-in-WHITEHEAT_.patch b/patches.suse/USB-serial-whiteheat-fix-heap-overflow-in-WHITEHEAT_.patch new file mode 100644 index 0000000..a2f94d9 --- /dev/null +++ b/patches.suse/USB-serial-whiteheat-fix-heap-overflow-in-WHITEHEAT_.patch @@ -0,0 +1,77 @@ +From e23e50e7acc8d8f16498e9c129db33e6a00e80eb Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Wed, 20 Apr 2022 17:12:34 -0700 +Subject: [PATCH] USB: serial: whiteheat: fix heap overflow in + WHITEHEAT_GET_DTR_RTS +Git-commit: e23e50e7acc8d8f16498e9c129db33e6a00e80eb +References: git-fixes +Patch-mainline: v5.18-rc5 + +The sizeof(struct whitehat_dr_info) can be 4 bytes under CONFIG_AEABI=n +due to "-mabi=apcs-gnu", even though it has a single u8: + +whiteheat_private { + __u8 mcr; /* 0 1 */ + + /* size: 4, cachelines: 1, members: 1 */ + /* padding: 3 */ + /* last cacheline: 4 bytes */ +}; + +The result is technically harmless, as both the source and the +destinations are currently the same allocation size (4 bytes) and don't +use their padding, but if anything were to ever be added after the +"mcr" member in "struct whiteheat_private", it would be overwritten. The +structs both have a single u8 "mcr" member, but are 4 bytes in padded +size. The memcpy() destination was explicitly targeting the u8 member +(size 1) with the length of the whole structure (size 4), triggering +the memcpy buffer overflow warning: + +In file included from include/linux/string.h:253, + from include/linux/bitmap.h:11, + from include/linux/cpumask.h:12, + from include/linux/smp.h:13, + from include/linux/lockdep.h:14, + from include/linux/spinlock.h:62, + from include/linux/mmzone.h:8, + from include/linux/gfp.h:6, + from include/linux/slab.h:15, + from drivers/usb/serial/whiteheat.c:17: +In function 'fortify_memcpy_chk', + inlined from 'firm_send_command' at drivers/usb/serial/whiteheat.c:587:4: +include/linux/fortify-string.h:328:25: warning: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning] + 328 | __write_overflow_field(p_size_field, size); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Instead, just assign the one byte directly. + +Reported-by: kernel test robot +Link: https://lore.kernel.org/lkml/202204142318.vDqjjSFn-lkp@intel.com +Cc: stable@vger.kernel.org +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20220421001234.2421107-1-keescook@chromium.org +Signed-off-by: Johan Hovold +Signed-off-by: Oliver Neukum +--- + drivers/usb/serial/whiteheat.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c +index da65d14c9ed5..06aad0d727dd 100644 +--- a/drivers/usb/serial/whiteheat.c ++++ b/drivers/usb/serial/whiteheat.c +@@ -584,9 +584,8 @@ static int firm_send_command(struct usb_serial_port *port, __u8 command, + switch (command) { + case WHITEHEAT_GET_DTR_RTS: + info = usb_get_serial_port_data(port); +- memcpy(&info->mcr, command_info->result_buffer, +- sizeof(struct whiteheat_dr_info)); +- break; ++ info->mcr = command_info->result_buffer[0]; ++ break; + } + } + exit: +-- +2.35.3 + diff --git a/patches.suse/USB-usb-storage-Fix-use-of-bitfields-for-hardware-da.patch b/patches.suse/USB-usb-storage-Fix-use-of-bitfields-for-hardware-da.patch new file mode 100644 index 0000000..2e9e6a2 --- /dev/null +++ b/patches.suse/USB-usb-storage-Fix-use-of-bitfields-for-hardware-da.patch @@ -0,0 +1,353 @@ +From 1892bf90677abcad7f06e897e308f5c3e3618dd4 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Thu, 17 Mar 2022 16:39:10 -0400 +Subject: [PATCH] USB: usb-storage: Fix use of bitfields for hardware data in + ene_ub6250.c +Git-commit: 1892bf90677abcad7f06e897e308f5c3e3618dd4 +References: git-fixes +Patch-mainline: v5.18-rc1 + +The kernel test robot found a problem with the ene_ub6250 subdriver in +usb-storage: It uses structures containing bitfields to represent +hardware bits in its SD_STATUS, MS_STATUS, and SM_STATUS bytes. This +is not safe; it presumes a particular bit ordering and it assumes the +compiler will not insert padding, neither of which is guaranteed. + +This patch fixes the problem by changing the structures to simple u8 +values, with the bitfields replaced by bitmask constants. + +CC: +Signed-off-by: Alan Stern +Link: https://lore.kernel.org/r/YjOcbuU106UpJ/V8@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Oliver Neukum +--- + drivers/usb/storage/ene_ub6250.c | 153 +++++++++++++++++++-------------------- + 1 file changed, 75 insertions(+), 78 deletions(-) + +--- a/drivers/usb/storage/ene_ub6250.c ++++ b/drivers/usb/storage/ene_ub6250.c +@@ -251,36 +251,33 @@ static struct us_unusual_dev ene_ub6250_ + #define memstick_logaddr(logadr1, logadr0) ((((u16)(logadr1)) << 8) | (logadr0)) + + +-struct SD_STATUS { +- u8 Insert:1; +- u8 Ready:1; +- u8 MediaChange:1; +- u8 IsMMC:1; +- u8 HiCapacity:1; +- u8 HiSpeed:1; +- u8 WtP:1; +- u8 Reserved:1; +-}; +- +-struct MS_STATUS { +- u8 Insert:1; +- u8 Ready:1; +- u8 MediaChange:1; +- u8 IsMSPro:1; +- u8 IsMSPHG:1; +- u8 Reserved1:1; +- u8 WtP:1; +- u8 Reserved2:1; +-}; +- +-struct SM_STATUS { +- u8 Insert:1; +- u8 Ready:1; +- u8 MediaChange:1; +- u8 Reserved:3; +- u8 WtP:1; +- u8 IsMS:1; +-}; ++/* SD_STATUS bits */ ++#define SD_Insert BIT(0) ++#define SD_Ready BIT(1) ++#define SD_MediaChange BIT(2) ++#define SD_IsMMC BIT(3) ++#define SD_HiCapacity BIT(4) ++#define SD_HiSpeed BIT(5) ++#define SD_WtP BIT(6) ++ /* Bit 7 reserved */ ++ ++/* MS_STATUS bits */ ++#define MS_Insert BIT(0) ++#define MS_Ready BIT(1) ++#define MS_MediaChange BIT(2) ++#define MS_IsMSPro BIT(3) ++#define MS_IsMSPHG BIT(4) ++ /* Bit 5 reserved */ ++#define MS_WtP BIT(6) ++ /* Bit 7 reserved */ ++ ++/* SM_STATUS bits */ ++#define SM_Insert BIT(0) ++#define SM_Ready BIT(1) ++#define SM_MediaChange BIT(2) ++ /* Bits 3-5 reserved */ ++#define SM_WtP BIT(6) ++#define SM_IsMS BIT(7) + + struct ms_bootblock_cis { + u8 bCistplDEVICE[6]; /* 0 */ +@@ -451,9 +448,9 @@ struct ene_ub6250_info { + u8 *bbuf; + + /* for 6250 code */ +- struct SD_STATUS SD_Status; +- struct MS_STATUS MS_Status; +- struct SM_STATUS SM_Status; ++ u8 SD_Status; ++ u8 MS_Status; ++ u8 SM_Status; + + /* ----- SD Control Data ---------------- */ + /*SD_REGISTER SD_Regs; */ +@@ -588,7 +585,7 @@ static int sd_scsi_test_unit_ready(struc + { + struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; + +- if (info->SD_Status.Insert && info->SD_Status.Ready) ++ if ((info->SD_Status & SD_Insert) && (info->SD_Status & SD_Ready)) + return USB_STOR_TRANSPORT_GOOD; + else { + ene_sd_init(us); +@@ -620,7 +617,7 @@ static int sd_scsi_mode_sense(struct us_ + 0x0b, 0x00, 0x80, 0x08, 0x00, 0x00, + 0x71, 0xc0, 0x00, 0x00, 0x02, 0x00 }; + +- if (info->SD_Status.WtP) ++ if (info->SD_Status & SD_WtP) + usb_stor_set_xfer_buf(mediaWP, 12, srb); + else + usb_stor_set_xfer_buf(mediaNoWP, 12, srb); +@@ -639,9 +636,9 @@ static int sd_scsi_read_capacity(struct + struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; + + usb_stor_dbg(us, "sd_scsi_read_capacity\n"); +- if (info->SD_Status.HiCapacity) { ++ if (info->SD_Status & SD_HiCapacity) { + bl_len = 0x200; +- if (info->SD_Status.IsMMC) ++ if (info->SD_Status & SD_IsMMC) + bl_num = info->HC_C_SIZE-1; + else + bl_num = (info->HC_C_SIZE + 1) * 1024 - 1; +@@ -691,7 +688,7 @@ static int sd_scsi_read(struct us_data * + return USB_STOR_TRANSPORT_ERROR; + } + +- if (info->SD_Status.HiCapacity) ++ if (info->SD_Status & SD_HiCapacity) + bnByte = bn; + + /* set up the command wrapper */ +@@ -731,7 +728,7 @@ static int sd_scsi_write(struct us_data + return USB_STOR_TRANSPORT_ERROR; + } + +- if (info->SD_Status.HiCapacity) ++ if (info->SD_Status & SD_HiCapacity) + bnByte = bn; + + /* set up the command wrapper */ +@@ -1445,7 +1442,7 @@ static int ms_scsi_test_unit_ready(struc + struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra); + + /* pr_info("MS_SCSI_Test_Unit_Ready\n"); */ +- if (info->MS_Status.Insert && info->MS_Status.Ready) { ++ if ((info->MS_Status & MS_Insert) && (info->MS_Status & MS_Ready)) { + return USB_STOR_TRANSPORT_GOOD; + } else { + ene_ms_init(us); +@@ -1478,7 +1475,7 @@ static int ms_scsi_mode_sense(struct us_ + 0x0b, 0x00, 0x80, 0x08, 0x00, 0x00, + 0x71, 0xc0, 0x00, 0x00, 0x02, 0x00 }; + +- if (info->MS_Status.WtP) ++ if (info->MS_Status & MS_WtP) + usb_stor_set_xfer_buf(mediaWP, 12, srb); + else + usb_stor_set_xfer_buf(mediaNoWP, 12, srb); +@@ -1497,7 +1494,7 @@ static int ms_scsi_read_capacity(struct + + usb_stor_dbg(us, "ms_scsi_read_capacity\n"); + bl_len = 0x200; +- if (info->MS_Status.IsMSPro) ++ if (info->MS_Status & MS_IsMSPro) + bl_num = info->MSP_TotalBlock - 1; + else + bl_num = info->MS_Lib.NumberOfLogBlock * info->MS_Lib.blockSize * 2 - 1; +@@ -1652,7 +1649,7 @@ static int ms_scsi_read(struct us_data * + if (bn > info->bl_num) + return USB_STOR_TRANSPORT_ERROR; + +- if (info->MS_Status.IsMSPro) { ++ if (info->MS_Status & MS_IsMSPro) { + result = ene_load_bincode(us, MSP_RW_PATTERN); + if (result != USB_STOR_XFER_GOOD) { + usb_stor_dbg(us, "Load MPS RW pattern Fail !!\n"); +@@ -1753,7 +1750,7 @@ static int ms_scsi_write(struct us_data + if (bn > info->bl_num) + return USB_STOR_TRANSPORT_ERROR; + +- if (info->MS_Status.IsMSPro) { ++ if (info->MS_Status & MS_IsMSPro) { + result = ene_load_bincode(us, MSP_RW_PATTERN); + if (result != USB_STOR_XFER_GOOD) { + pr_info("Load MSP RW pattern Fail !!\n"); +@@ -1861,12 +1858,12 @@ static int ene_get_card_status(struct us + + tmpreg = (u16) reg4b; + reg4b = *(u32 *)(&buf[0x14]); +- if (info->SD_Status.HiCapacity && !info->SD_Status.IsMMC) ++ if ((info->SD_Status & SD_HiCapacity) && !(info->SD_Status & SD_IsMMC)) + info->HC_C_SIZE = (reg4b >> 8) & 0x3fffff; + + info->SD_C_SIZE = ((tmpreg & 0x03) << 10) | (u16)(reg4b >> 22); + info->SD_C_SIZE_MULT = (u8)(reg4b >> 7) & 0x07; +- if (info->SD_Status.HiCapacity && info->SD_Status.IsMMC) ++ if ((info->SD_Status & SD_HiCapacity) && (info->SD_Status & SD_IsMMC)) + info->HC_C_SIZE = *(u32 *)(&buf[0x100]); + + if (info->SD_READ_BL_LEN > SD_BLOCK_LEN) { +@@ -2076,6 +2073,7 @@ static int ene_ms_init(struct us_data *u + u16 MSP_BlockSize, MSP_UserAreaBlocks; + struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; + u8 *bbuf = info->bbuf; ++ unsigned int s; + + printk(KERN_INFO "transport --- ENE_MSInit\n"); + +@@ -2100,15 +2098,16 @@ static int ene_ms_init(struct us_data *u + return USB_STOR_TRANSPORT_ERROR; + } + /* the same part to test ENE */ +- info->MS_Status = *(struct MS_STATUS *) bbuf; ++ info->MS_Status = bbuf[0]; + +- if (info->MS_Status.Insert && info->MS_Status.Ready) { +- printk(KERN_INFO "Insert = %x\n", info->MS_Status.Insert); +- printk(KERN_INFO "Ready = %x\n", info->MS_Status.Ready); +- printk(KERN_INFO "IsMSPro = %x\n", info->MS_Status.IsMSPro); +- printk(KERN_INFO "IsMSPHG = %x\n", info->MS_Status.IsMSPHG); +- printk(KERN_INFO "WtP= %x\n", info->MS_Status.WtP); +- if (info->MS_Status.IsMSPro) { ++ s = info->MS_Status; ++ if ((s & MS_Insert) && (s & MS_Ready)) { ++ printk(KERN_INFO "Insert = %x\n", !!(s & MS_Insert)); ++ printk(KERN_INFO "Ready = %x\n", !!(s & MS_Ready)); ++ printk(KERN_INFO "IsMSPro = %x\n", !!(s & MS_IsMSPro)); ++ printk(KERN_INFO "IsMSPHG = %x\n", !!(s & MS_IsMSPHG)); ++ printk(KERN_INFO "WtP= %x\n", !!(s & MS_WtP)); ++ if (s & MS_IsMSPro) { + MSP_BlockSize = (bbuf[6] << 8) | bbuf[7]; + MSP_UserAreaBlocks = (bbuf[10] << 8) | bbuf[11]; + info->MSP_TotalBlock = MSP_BlockSize * MSP_UserAreaBlocks; +@@ -2169,17 +2168,17 @@ static int ene_sd_init(struct us_data *u + return USB_STOR_TRANSPORT_ERROR; + } + +- info->SD_Status = *(struct SD_STATUS *) bbuf; +- if (info->SD_Status.Insert && info->SD_Status.Ready) { +- struct SD_STATUS *s = &info->SD_Status; ++ info->SD_Status = bbuf[0]; ++ if ((info->SD_Status & SD_Insert) && (info->SD_Status & SD_Ready)) { ++ unsigned int s = info->SD_Status; + + ene_get_card_status(us, bbuf); +- usb_stor_dbg(us, "Insert = %x\n", s->Insert); +- usb_stor_dbg(us, "Ready = %x\n", s->Ready); +- usb_stor_dbg(us, "IsMMC = %x\n", s->IsMMC); +- usb_stor_dbg(us, "HiCapacity = %x\n", s->HiCapacity); +- usb_stor_dbg(us, "HiSpeed = %x\n", s->HiSpeed); +- usb_stor_dbg(us, "WtP = %x\n", s->WtP); ++ usb_stor_dbg(us, "Insert = %x\n", !!(s & SD_Insert)); ++ usb_stor_dbg(us, "Ready = %x\n", !!(s & SD_Ready)); ++ usb_stor_dbg(us, "IsMMC = %x\n", !!(s & SD_IsMMC)); ++ usb_stor_dbg(us, "HiCapacity = %x\n", !!(s & SD_HiCapacity)); ++ usb_stor_dbg(us, "HiSpeed = %x\n", !!(s & SD_HiSpeed)); ++ usb_stor_dbg(us, "WtP = %x\n", !!(s & SD_WtP)); + } else { + usb_stor_dbg(us, "SD Card Not Ready --- %x\n", bbuf[0]); + return USB_STOR_TRANSPORT_ERROR; +@@ -2201,14 +2200,14 @@ static int ene_init(struct us_data *us) + + misc_reg03 = bbuf[0]; + if (misc_reg03 & 0x01) { +- if (!info->SD_Status.Ready) { ++ if (!(info->SD_Status & SD_Ready)) { + result = ene_sd_init(us); + if (result != USB_STOR_XFER_GOOD) + return USB_STOR_TRANSPORT_ERROR; + } + } + if (misc_reg03 & 0x02) { +- if (!info->MS_Status.Ready) { ++ if (!(info->MS_Status & MS_Ready)) { + result = ene_ms_init(us); + if (result != USB_STOR_XFER_GOOD) + return USB_STOR_TRANSPORT_ERROR; +@@ -2298,13 +2297,13 @@ static int ene_transport(struct scsi_cmn + + /*US_DEBUG(usb_stor_show_command(us, srb)); */ + scsi_set_resid(srb, 0); +- if (unlikely(!(info->SD_Status.Ready || info->MS_Status.Ready))) { ++ if (unlikely(!(info->SD_Status & SD_Ready) || (info->MS_Status & MS_Ready))) { + result = ene_init(us); + } else { +- if (info->SD_Status.Ready) ++ if (info->SD_Status & SD_Ready) + result = sd_scsi_irp(us, srb); + +- if (info->MS_Status.Ready) ++ if (info->MS_Status & MS_Ready) + result = ms_scsi_irp(us, srb); + } + return 0; +@@ -2368,7 +2367,6 @@ static int ene_ub6250_probe(struct usb_i + + static int ene_ub6250_resume(struct usb_interface *iface) + { +- u8 tmp = 0; + struct us_data *us = usb_get_intfdata(iface); + struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra); + +@@ -2380,17 +2378,16 @@ static int ene_ub6250_resume(struct usb_ + mutex_unlock(&us->dev_mutex); + + info->Power_IsResum = true; +- /*info->SD_Status.Ready = 0; */ +- info->SD_Status = *(struct SD_STATUS *)&tmp; +- info->MS_Status = *(struct MS_STATUS *)&tmp; +- info->SM_Status = *(struct SM_STATUS *)&tmp; ++ /* info->SD_Status &= ~SD_Ready; */ ++ info->SD_Status = 0; ++ info->MS_Status = 0; ++ info->SM_Status = 0; + + return 0; + } + + static int ene_ub6250_reset_resume(struct usb_interface *iface) + { +- u8 tmp = 0; + struct us_data *us = usb_get_intfdata(iface); + struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra); + +@@ -2402,10 +2399,10 @@ static int ene_ub6250_reset_resume(struc + * the device + */ + info->Power_IsResum = true; +- /*info->SD_Status.Ready = 0; */ +- info->SD_Status = *(struct SD_STATUS *)&tmp; +- info->MS_Status = *(struct MS_STATUS *)&tmp; +- info->SM_Status = *(struct SM_STATUS *)&tmp; ++ /* info->SD_Status &= ~SD_Ready; */ ++ info->SD_Status = 0; ++ info->MS_Status = 0; ++ info->SM_Status = 0; + + return 0; + } diff --git a/patches.suse/af_key-add-__GFP_ZERO-flag-for-compose_sadb_supporte.patch b/patches.suse/af_key-add-__GFP_ZERO-flag-for-compose_sadb_supporte.patch new file mode 100644 index 0000000..9f5b5c0 --- /dev/null +++ b/patches.suse/af_key-add-__GFP_ZERO-flag-for-compose_sadb_supporte.patch @@ -0,0 +1,42 @@ +From 4f47e6df9d16e20800ca69824c68b3cab663e44f Mon Sep 17 00:00:00 2001 +From: Haimin Zhang +Date: Tue, 8 Mar 2022 11:20:28 +0800 +Subject: [PATCH] af_key: add __GFP_ZERO flag for compose_sadb_supported in + function pfkey_register +Git-commit: 9a564bccb78a76740ea9d75a259942df8143d02c +Patch-mainline: v5.17 +References: CVE-2022-1353 bsc#1198516 + +Add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register +to initialize the buffer of supp_skb to fix a kernel-info-leak issue. +1) Function pfkey_register calls compose_sadb_supported to request +a sk_buff. 2) compose_sadb_supported calls alloc_sbk to allocate +a sk_buff, but it doesn't zero it. 3) If auth_len is greater 0, then +compose_sadb_supported treats the memory as a struct sadb_supported and +begins to initialize. But it just initializes the field sadb_supported_len +and field sadb_supported_exttype without field sadb_supported_reserved. + +Reported-by: TCS Robot +Signed-off-by: Haimin Zhang +Signed-off-by: Steffen Klassert +Signed-off-by: Denis Kirjanov +--- + net/key/af_key.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/key/af_key.c b/net/key/af_key.c +index 72f8e44838d9..06376c06169d 100644 +--- a/net/key/af_key.c ++++ b/net/key/af_key.c +@@ -1709,7 +1709,7 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad + + xfrm_probe_algs(); + +- supp_skb = compose_sadb_supported(hdr, GFP_KERNEL); ++ supp_skb = compose_sadb_supported(hdr, GFP_KERNEL | __GFP_ZERO); + if (!supp_skb) { + if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC) + pfk->registered &= ~(1<sadb_msg_satype); +-- +2.16.4 + diff --git a/patches.suse/arm64-Add-missing-ISB-after-invalidating-TLB-in-__primary_switch.patch b/patches.suse/arm64-Add-missing-ISB-after-invalidating-TLB-in-__primary_switch.patch new file mode 100644 index 0000000..fadbdcb --- /dev/null +++ b/patches.suse/arm64-Add-missing-ISB-after-invalidating-TLB-in-__primary_switch.patch @@ -0,0 +1,42 @@ +From: Marc Zyngier +Date: Wed, 24 Feb 2021 09:37:37 +0000 +Subject: arm64: Add missing ISB after invalidating TLB in __primary_switch +Git-commit: 9d41053e8dc115c92b8002c3db5f545d7602498b +Patch-mainline: v5.12-rc1 +References: git-fixes + +Although there has been a bit of back and forth on the subject, it +appears that invalidating TLBs requires an ISB instruction when FEAT_ETS +is not implemented by the CPU. + +From the bible: + + | In an implementation that does not implement FEAT_ETS, a TLB + | maintenance instruction executed by a PE, PEx, can complete at any + | time after it is issued, but is only guaranteed to be finished for a + | PE, PEx, after the execution of DSB by the PEx followed by a Context + | synchronization event + +Add the missing ISB in __primary_switch, just in case. + +Fixes: 3c5e9f238bc4 ("arm64: head.S: move KASLR processing out of __enable_mmu()") +Suggested-by: Will Deacon +Signed-off-by: Marc Zyngier +Acked-by: Mark Rutland +Link: https://lore.kernel.org/r/20210224093738.3629662-3-maz@kernel.org +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/kernel/head.S | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm64/kernel/head.S ++++ b/arch/arm64/kernel/head.S +@@ -787,6 +787,7 @@ __primary_switch: + + tlbi vmalle1 // Remove any stale TLB entries + dsb nsh ++ isb + + msr sctlr_el1, x19 // re-enable the MMU + isb diff --git a/patches.suse/arm64-Clear-OSDLR_EL1-on-CPU-boot.patch b/patches.suse/arm64-Clear-OSDLR_EL1-on-CPU-boot.patch new file mode 100644 index 0000000..532fa53 --- /dev/null +++ b/patches.suse/arm64-Clear-OSDLR_EL1-on-CPU-boot.patch @@ -0,0 +1,28 @@ +From: Jean-Philippe Brucker +Date: Mon, 8 Apr 2019 18:17:18 +0100 +Subject: arm64: Clear OSDLR_EL1 on CPU boot +Git-commit: 6fda41bf12615ee7c3ddac88155099b1a8cf8d00 +Patch-mainline: v5.2-rc1 +References: git-fixes + +Some firmwares may reboot CPUs with OS Double Lock set. Make sure that +it is unlocked, in order to use debug exceptions. + +Cc: +Signed-off-by: Jean-Philippe Brucker +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/kernel/debug-monitors.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm64/kernel/debug-monitors.c ++++ b/arch/arm64/kernel/debug-monitors.c +@@ -134,6 +134,7 @@ NOKPROBE_SYMBOL(disable_debug_monitors); + */ + static int clear_os_lock(unsigned int cpu) + { ++ write_sysreg(0, osdlr_el1); + write_sysreg(0, oslar_el1); + isb(); + return 0; diff --git a/patches.suse/arm64-Extend-workaround-for-erratum-1024718-to-all-versions-of-Cortex-A55.patch b/patches.suse/arm64-Extend-workaround-for-erratum-1024718-to-all-versions-of-Cortex-A55.patch new file mode 100644 index 0000000..e9626ea --- /dev/null +++ b/patches.suse/arm64-Extend-workaround-for-erratum-1024718-to-all-versions-of-Cortex-A55.patch @@ -0,0 +1,51 @@ +From: Suzuki K Poulose +Date: Wed, 3 Feb 2021 23:00:57 +0000 +Subject: arm64: Extend workaround for erratum 1024718 to all versions of + Cortex-A55 +Git-commit: c0b15c25d25171db4b70cc0b7dbc1130ee94017d +Patch-mainline: v5.12-rc1 +References: git-fixes + +The erratum 1024718 affects Cortex-A55 r0p0 to r2p0. However +we apply the work around for r0p0 - r1p0. Unfortunately this +won't be fixed for the future revisions for the CPU. Thus +extend the work around for all versions of A55, to cover +for r2p0 and any future revisions. + +Cc: stable@vger.kernel.org +Cc: Catalin Marinas +Cc: Will Deacon +Cc: James Morse +Cc: Kunihiko Hayashi +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20210203230057.3961239-1-suzuki.poulose@arm.com +[will: Update Kconfig help text] +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/Kconfig | 2 +- + arch/arm64/kernel/cpufeature.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -454,7 +454,7 @@ config ARM64_ERRATUM_1024718 + help + This option adds work around for Arm Cortex-A55 Erratum 1024718. + +- Affected Cortex-A55 cores (r0p0, r0p1, r1p0) could cause incorrect ++ Affected Cortex-A55 cores (all revisions) could cause incorrect + update of the hardware dirty bit when the DBM/AP bits are updated + without a break-before-make. The work around is to disable the usage + of hardware DBM locally on the affected cores. CPUs not affected by +--- a/arch/arm64/kernel/cpufeature.c ++++ b/arch/arm64/kernel/cpufeature.c +@@ -1067,7 +1067,7 @@ static bool cpu_has_broken_dbm(void) + /* List of CPUs which have broken DBM support. */ + static const struct midr_range cpus[] = { + #ifdef CONFIG_ARM64_ERRATUM_1024718 +- MIDR_RANGE(MIDR_CORTEX_A55, 0, 0, 1, 0), // A55 r0p0 -r1p0 ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A55), + #endif + {}, + }; diff --git a/patches.suse/arm64-Fix-HCR.TGE-status-for-NMI-contexts.patch b/patches.suse/arm64-Fix-HCR.TGE-status-for-NMI-contexts.patch new file mode 100644 index 0000000..bb078f9 --- /dev/null +++ b/patches.suse/arm64-Fix-HCR.TGE-status-for-NMI-contexts.patch @@ -0,0 +1,123 @@ +From: Julien Thierry +Date: Thu, 31 Jan 2019 14:58:39 +0000 +Subject: arm64: Fix HCR.TGE status for NMI contexts +Git-commit: 5870970b9a828d8693aa6d15742573289d7dbcd0 +Patch-mainline: v5.1-rc1 +References: git-fixes + +When using VHE, the host needs to clear HCR_EL2.TGE bit in order +to interact with guest TLBs, switching from EL2&0 translation regime +to EL1&0. + +However, some non-maskable asynchronous event could happen while TGE is +cleared like SDEI. Because of this address translation operations +relying on EL2&0 translation regime could fail (tlb invalidation, +userspace access, ...). + +Fix this by properly setting HCR_EL2.TGE when entering NMI context and +clear it if necessary when returning to the interrupted context. + +Signed-off-by: Julien Thierry +Suggested-by: Marc Zyngier +Reviewed-by: Marc Zyngier +Reviewed-by: James Morse +Cc: Arnd Bergmann +Cc: Will Deacon +Cc: Marc Zyngier +Cc: James Morse +Cc: linux-arch@vger.kernel.org +Cc: stable@vger.kernel.org +Signed-off-by: Catalin Marinas +Acked-by: Ivan T. Ivanov +--- + arch/arm64/include/asm/hardirq.h | 31 +++++++++++++++++++++++++++++++ + arch/arm64/kernel/irq.c | 3 +++ + include/linux/hardirq.h | 7 +++++++ + 3 files changed, 41 insertions(+) + +--- a/arch/arm64/include/asm/hardirq.h ++++ b/arch/arm64/include/asm/hardirq.h +@@ -17,8 +17,12 @@ + #define __ASM_HARDIRQ_H + + #include ++#include + #include ++#include + #include ++#include ++#include + + #define NR_IPI 7 + +@@ -37,6 +41,33 @@ u64 smp_irq_stat_cpu(unsigned int cpu); + + #define __ARCH_IRQ_EXIT_IRQS_DISABLED 1 + ++struct nmi_ctx { ++ u64 hcr; ++}; ++ ++DECLARE_PER_CPU(struct nmi_ctx, nmi_contexts); ++ ++#define arch_nmi_enter() \ ++ do { \ ++ if (is_kernel_in_hyp_mode()) { \ ++ struct nmi_ctx *nmi_ctx = this_cpu_ptr(&nmi_contexts); \ ++ nmi_ctx->hcr = read_sysreg(hcr_el2); \ ++ if (!(nmi_ctx->hcr & HCR_TGE)) { \ ++ write_sysreg(nmi_ctx->hcr | HCR_TGE, hcr_el2); \ ++ isb(); \ ++ } \ ++ } \ ++ } while (0) ++ ++#define arch_nmi_exit() \ ++ do { \ ++ if (is_kernel_in_hyp_mode()) { \ ++ struct nmi_ctx *nmi_ctx = this_cpu_ptr(&nmi_contexts); \ ++ if (!(nmi_ctx->hcr & HCR_TGE)) \ ++ write_sysreg(nmi_ctx->hcr, hcr_el2); \ ++ } \ ++ } while (0) ++ + static inline void ack_bad_irq(unsigned int irq) + { + extern unsigned long irq_err_count; +--- a/arch/arm64/kernel/irq.c ++++ b/arch/arm64/kernel/irq.c +@@ -33,6 +33,9 @@ + + unsigned long irq_err_count; + ++/* Only access this in an NMI enter/exit */ ++DEFINE_PER_CPU(struct nmi_ctx, nmi_contexts); ++ + DEFINE_PER_CPU(unsigned long *, irq_stack_ptr); + + int arch_show_interrupts(struct seq_file *p, int prec) +--- a/include/linux/hardirq.h ++++ b/include/linux/hardirq.h +@@ -59,8 +59,14 @@ extern void irq_enter(void); + */ + extern void irq_exit(void); + ++#ifndef arch_nmi_enter ++#define arch_nmi_enter() do { } while (0) ++#define arch_nmi_exit() do { } while (0) ++#endif ++ + #define nmi_enter() \ + do { \ ++ arch_nmi_enter(); \ + printk_nmi_enter(); \ + lockdep_off(); \ + ftrace_nmi_enter(); \ +@@ -79,6 +85,7 @@ extern void irq_exit(void); + ftrace_nmi_exit(); \ + lockdep_on(); \ + printk_nmi_exit(); \ ++ arch_nmi_exit(); \ + } while (0) + + #endif /* LINUX_HARDIRQ_H */ diff --git a/patches.suse/arm64-Fix-size-of-__early_cpu_boot_status.patch b/patches.suse/arm64-Fix-size-of-__early_cpu_boot_status.patch new file mode 100644 index 0000000..92ce3ea --- /dev/null +++ b/patches.suse/arm64-Fix-size-of-__early_cpu_boot_status.patch @@ -0,0 +1,29 @@ +From: Arun KS +Date: Tue, 30 Apr 2019 16:05:04 +0530 +Subject: arm64: Fix size of __early_cpu_boot_status +Git-commit: 61cf61d81e326163ce1557ceccfca76e11d0e57c +Patch-mainline: v5.2-rc1 +References: git-fixes + +__early_cpu_boot_status is of type long. Use quad +assembler directive to allocate proper size. + +Acked-by: Mark Rutland +Signed-off-by: Arun KS +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/kernel/head.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/kernel/head.S ++++ b/arch/arm64/kernel/head.S +@@ -613,7 +613,7 @@ ENTRY(__boot_cpu_mode) + * with MMU turned off. + */ + ENTRY(__early_cpu_boot_status) +- .long 0 ++ .quad 0 + + .popsection + diff --git a/patches.suse/arm64-Relax-GIC-version-check-during-early-boot.patch b/patches.suse/arm64-Relax-GIC-version-check-during-early-boot.patch new file mode 100644 index 0000000..99ee5ea --- /dev/null +++ b/patches.suse/arm64-Relax-GIC-version-check-during-early-boot.patch @@ -0,0 +1,35 @@ +From: Vladimir Murzin +Date: Wed, 20 Feb 2019 11:43:05 +0000 +Subject: arm64: Relax GIC version check during early boot +Git-commit: 74698f6971f25d045301139413578865fc2bd8f9 +Patch-mainline: v5.0-rc8 +References: git-fixes + +Updates to the GIC architecture allow ID_AA64PFR0_EL1.GIC to have +values other than 0 or 1. At the moment, Linux is quite strict in the +way it handles this field at early boot stage (cpufeature is fine) and +will refuse to use the system register CPU interface if it doesn't +find the value 1. + +Fixes: 021f653791ad17e03f98aaa7fb933816ae16f161 ("irqchip: gic-v3: Initial support for GICv3") +Reported-by: Chase Conklin +Reviewed-by: Marc Zyngier +Signed-off-by: Vladimir Murzin +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/kernel/head.S | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/arch/arm64/kernel/head.S ++++ b/arch/arm64/kernel/head.S +@@ -475,8 +475,7 @@ set_hcr: + /* GICv3 system register access */ + mrs x0, id_aa64pfr0_el1 + ubfx x0, x0, #24, #4 +- cmp x0, #1 +- b.ne 3f ++ cbz x0, 3f + + mrs_s x0, SYS_ICC_SRE_EL2 + orr x0, x0, #ICC_SRE_EL2_SRE // Set ICC_SRE_EL2.SRE==1 diff --git a/patches.suse/arm64-Save-and-restore-OSDLR_EL1-across-suspend-resume.patch b/patches.suse/arm64-Save-and-restore-OSDLR_EL1-across-suspend-resume.patch new file mode 100644 index 0000000..cd392b9 --- /dev/null +++ b/patches.suse/arm64-Save-and-restore-OSDLR_EL1-across-suspend-resume.patch @@ -0,0 +1,80 @@ +From: Jean-Philippe Brucker +Date: Mon, 8 Apr 2019 18:17:19 +0100 +Subject: arm64: Save and restore OSDLR_EL1 across suspend/resume +Git-commit: 827a108e354db633698f0b4a10c1ffd2b1f8d1d0 +Patch-mainline: v5.2-rc1 +References: git-fixes + +When the CPU comes out of suspend, the firmware may have modified the OS +Double Lock Register. Save it in an unused slot of cpu_suspend_ctx, and +restore it on resume. + +Cc: +Signed-off-by: Jean-Philippe Brucker +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/mm/proc.S | 34 ++++++++++++++++++---------------- + 1 file changed, 18 insertions(+), 16 deletions(-) + +--- a/arch/arm64/mm/proc.S ++++ b/arch/arm64/mm/proc.S +@@ -64,24 +64,25 @@ ENTRY(cpu_do_suspend) + mrs x2, tpidr_el0 + mrs x3, tpidrro_el0 + mrs x4, contextidr_el1 +- mrs x5, cpacr_el1 +- mrs x6, tcr_el1 +- mrs x7, vbar_el1 +- mrs x8, mdscr_el1 +- mrs x9, oslsr_el1 +- mrs x10, sctlr_el1 ++ mrs x5, osdlr_el1 ++ mrs x6, cpacr_el1 ++ mrs x7, tcr_el1 ++ mrs x8, vbar_el1 ++ mrs x9, mdscr_el1 ++ mrs x10, oslsr_el1 ++ mrs x11, sctlr_el1 + alternative_if_not ARM64_HAS_VIRT_HOST_EXTN +- mrs x11, tpidr_el1 ++ mrs x12, tpidr_el1 + alternative_else +- mrs x11, tpidr_el2 ++ mrs x12, tpidr_el2 + alternative_endif +- mrs x12, sp_el0 ++ mrs x13, sp_el0 + stp x2, x3, [x0] +- stp x4, xzr, [x0, #16] +- stp x5, x6, [x0, #32] +- stp x7, x8, [x0, #48] +- stp x9, x10, [x0, #64] +- stp x11, x12, [x0, #80] ++ stp x4, x5, [x0, #16] ++ stp x6, x7, [x0, #32] ++ stp x8, x9, [x0, #48] ++ stp x10, x11, [x0, #64] ++ stp x12, x13, [x0, #80] + ret + ENDPROC(cpu_do_suspend) + +@@ -104,8 +105,8 @@ ENTRY(cpu_do_resume) + msr cpacr_el1, x6 + + /* Don't change t0sz here, mask those bits when restoring */ +- mrs x5, tcr_el1 +- bfi x8, x5, TCR_T0SZ_OFFSET, TCR_TxSZ_WIDTH ++ mrs x7, tcr_el1 ++ bfi x8, x7, TCR_T0SZ_OFFSET, TCR_TxSZ_WIDTH + + msr tcr_el1, x8 + msr vbar_el1, x9 +@@ -129,6 +130,7 @@ alternative_endif + /* + * Restore oslsr_el1 by writing oslar_el1 + */ ++ msr osdlr_el1, x5 + ubfx x11, x11, #1, #1 + msr oslar_el1, x11 + reset_pmuserenr_el0 x0 // Disable PMU access from EL0 diff --git a/patches.suse/arm64-armv8_deprecated-Fix-undef_hook-mask-for-thumb-setend.patch b/patches.suse/arm64-armv8_deprecated-Fix-undef_hook-mask-for-thumb-setend.patch new file mode 100644 index 0000000..2019ebd --- /dev/null +++ b/patches.suse/arm64-armv8_deprecated-Fix-undef_hook-mask-for-thumb-setend.patch @@ -0,0 +1,50 @@ +From: Fredrik Strupe +Date: Wed, 8 Apr 2020 13:29:41 +0200 +Subject: arm64: armv8_deprecated: Fix undef_hook mask for thumb setend +Git-commit: fc2266011accd5aeb8ebc335c381991f20e26e33 +Patch-mainline: v5.7-rc1 +References: git-fixes + +For thumb instructions, call_undef_hook() in traps.c first reads a u16, +and if the u16 indicates a T32 instruction (u16 >= 0xe800), a second +u16 is read, which then makes up the the lower half-word of a T32 +instruction. For T16 instructions, the second u16 is not read, +which makes the resulting u32 opcode always have the upper half set to +0. + +However, having the upper half of instr_mask in the undef_hook set to 0 +masks out the upper half of all thumb instructions - both T16 and T32. +This results in trapped T32 instructions with the lower half-word equal +to the T16 encoding of setend (b650) being matched, even though the upper +half-word is not 0000 and thus indicates a T32 opcode. + +An example of such a T32 instruction is eaa0b650, which should raise a +SIGILL since T32 instructions with an eaa prefix are unallocated as per +Arm ARM, but instead works as a SETEND because the second half-word is set +to b650. + +This patch fixes the issue by extending instr_mask to include the +upper u32 half, which will still match T16 instructions where the upper +half is 0, but not T32 instructions. + +Fixes: 2d888f48e056 ("arm64: Emulate SETEND for AArch32 tasks") +Cc: # 4.0.x- +Reviewed-by: Suzuki K Poulose +Signed-off-by: Fredrik Strupe +Signed-off-by: Catalin Marinas +Acked-by: Ivan T. Ivanov +--- + arch/arm64/kernel/armv8_deprecated.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/kernel/armv8_deprecated.c ++++ b/arch/arm64/kernel/armv8_deprecated.c +@@ -598,7 +598,7 @@ static struct undef_hook setend_hooks[] + }, + { + /* Thumb mode */ +- .instr_mask = 0x0000fff7, ++ .instr_mask = 0xfffffff7, + .instr_val = 0x0000b650, + .pstate_mask = (PSR_AA32_T_BIT | PSR_AA32_MODE_MASK), + .pstate_val = (PSR_AA32_T_BIT | PSR_AA32_MODE_USR), diff --git a/patches.suse/arm64-avoid-Woverride-init-warning.patch b/patches.suse/arm64-avoid-Woverride-init-warning.patch new file mode 100644 index 0000000..7e31d24 --- /dev/null +++ b/patches.suse/arm64-avoid-Woverride-init-warning.patch @@ -0,0 +1,73 @@ +From: Arnd Bergmann +Date: Mon, 26 Oct 2020 20:37:46 +0100 +Subject: arm64: avoid -Woverride-init warning +Git-commit: 332576e69a046b9b33f49bd0c3c071cc98215b60 +Patch-mainline: v5.10-rc2 +References: git-fixes + +The icache_policy_str[] definition causes a warning when extra +warning flags are enabled: + +arch/arm64/kernel/cpuinfo.c:38:26: warning: initialized field overwritten [-Woverride-init] + 38 | [ICACHE_POLICY_VIPT] = "VIPT", + | ^~~~~~ +arch/arm64/kernel/cpuinfo.c:38:26: note: (near initialization for 'icache_policy_str[2]') +arch/arm64/kernel/cpuinfo.c:39:26: warning: initialized field overwritten [-Woverride-init] + 39 | [ICACHE_POLICY_PIPT] = "PIPT", + | ^~~~~~ +arch/arm64/kernel/cpuinfo.c:39:26: note: (near initialization for 'icache_policy_str[3]') +arch/arm64/kernel/cpuinfo.c:40:27: warning: initialized field overwritten [-Woverride-init] + 40 | [ICACHE_POLICY_VPIPT] = "VPIPT", + | ^~~~~~~ +arch/arm64/kernel/cpuinfo.c:40:27: note: (near initialization for 'icache_policy_str[0]') + +There is no real need for the default initializer here, as printing a +NULL string is harmless. Rewrite the logic to have an explicit +reserved value for the only one that uses the default value. + +This partially reverts the commit that removed ICACHE_POLICY_AIVIVT. + +Fixes: 155433cb365e ("arm64: cache: Remove support for ASID-tagged VIVT I-caches") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20201026193807.3816388-1-arnd@kernel.org +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/include/asm/cache.h | 1 + + arch/arm64/kernel/cpuinfo.c | 6 +++--- + 2 files changed, 4 insertions(+), 3 deletions(-) + +--- a/arch/arm64/include/asm/cache.h ++++ b/arch/arm64/include/asm/cache.h +@@ -35,6 +35,7 @@ + #define CTR_L1IP(ctr) (((ctr) >> CTR_L1IP_SHIFT) & CTR_L1IP_MASK) + + #define ICACHE_POLICY_VPIPT 0 ++#define ICACHE_POLICY_RESERVED 1 + #define ICACHE_POLICY_VIPT 2 + #define ICACHE_POLICY_PIPT 3 + +--- a/arch/arm64/kernel/cpuinfo.c ++++ b/arch/arm64/kernel/cpuinfo.c +@@ -44,10 +44,10 @@ DEFINE_PER_CPU(struct cpuinfo_arm64, cpu + static struct cpuinfo_arm64 boot_cpu_data; + + static char *icache_policy_str[] = { +- [0 ... ICACHE_POLICY_PIPT] = "RESERVED/UNKNOWN", ++ [ICACHE_POLICY_VPIPT] = "VPIPT", ++ [ICACHE_POLICY_RESERVED] = "RESERVED/UNKNOWN", + [ICACHE_POLICY_VIPT] = "VIPT", + [ICACHE_POLICY_PIPT] = "PIPT", +- [ICACHE_POLICY_VPIPT] = "VPIPT", + }; + + unsigned long __icache_flags; +@@ -312,7 +312,7 @@ static void cpuinfo_detect_icache_policy + case ICACHE_POLICY_VPIPT: + set_bit(ICACHEF_VPIPT, &__icache_flags); + break; +- default: ++ case ICACHE_POLICY_RESERVED: + /* Fallthrough */ + case ICACHE_POLICY_VIPT: + /* Assume aliasing */ diff --git a/patches.suse/arm64-berlin-Select-DW_APB_TIMER_OF.patch b/patches.suse/arm64-berlin-Select-DW_APB_TIMER_OF.patch new file mode 100644 index 0000000..5341700 --- /dev/null +++ b/patches.suse/arm64-berlin-Select-DW_APB_TIMER_OF.patch @@ -0,0 +1,29 @@ +From: Jisheng Zhang +Date: Fri, 9 Oct 2020 15:08:31 +0800 +Subject: arm64: berlin: Select DW_APB_TIMER_OF +Git-commit: b0fc70ce1f028e14a37c186d9f7a55e51439b83a +Patch-mainline: v5.10-rc2 +References: git-fixes + +Berlin SoCs always contain some DW APB timers which can be used as an +always-on broadcast timer. + +Link: https://lore.kernel.org/r/20201009150536.214181fb@xhacker.debian +Cc: # v3.14+ +Signed-off-by: Jisheng Zhang +Signed-off-by: Arnd Bergmann +Acked-by: Ivan T. Ivanov +--- + arch/arm64/Kconfig.platforms | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm64/Kconfig.platforms ++++ b/arch/arm64/Kconfig.platforms +@@ -40,6 +40,7 @@ config ARCH_BCM_IPROC + config ARCH_BERLIN + bool "Marvell Berlin SoC Family" + select DW_APB_ICTL ++ select DW_APB_TIMER_OF + select GPIOLIB + select PINCTRL + help diff --git a/patches.suse/arm64-clear_page-shouldn-t-use-DC-ZVA-when-DCZID_EL0.DZP-1.patch b/patches.suse/arm64-clear_page-shouldn-t-use-DC-ZVA-when-DCZID_EL0.DZP-1.patch new file mode 100644 index 0000000..7db9d3d --- /dev/null +++ b/patches.suse/arm64-clear_page-shouldn-t-use-DC-ZVA-when-DCZID_EL0.DZP-1.patch @@ -0,0 +1,46 @@ +From: Reiji Watanabe +Date: Sun, 5 Dec 2021 16:47:35 -0800 +Subject: arm64: clear_page() shouldn't use DC ZVA when DCZID_EL0.DZP == 1 +Git-commit: f0616abd4e67143b45b04b565839148458857347 +Patch-mainline: v5.17-rc1 +References: git-fixes + +Currently, clear_page() uses DC ZVA instruction unconditionally. But it +should make sure that DCZID_EL0.DZP, which indicates whether or not use +of DC ZVA instruction is prohibited, is zero when using the instruction. +Use STNP instead when DCZID_EL0.DZP == 1. + +Fixes: f27bb139c387 ("arm64: Miscellaneous library functions") +Signed-off-by: Reiji Watanabe +Reviewed-by: Robin Murphy +Link: https://lore.kernel.org/r/20211206004736.1520989-2-reijiw@google.com +Signed-off-by: Catalin Marinas +Acked-by: Ivan T. Ivanov +--- + arch/arm64/lib/clear_page.S | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/arch/arm64/lib/clear_page.S ++++ b/arch/arm64/lib/clear_page.S +@@ -27,6 +27,7 @@ + */ + ENTRY(clear_page) + mrs x1, dczid_el0 ++ tbnz x1, #4, 2f /* Branch if DC ZVA is prohibited */ + and w1, w1, #0xf + mov x2, #4 + lsl x1, x2, x1 +@@ -36,4 +37,13 @@ ENTRY(clear_page) + tst x0, #(PAGE_SIZE - 1) + b.ne 1b + ret ++ ++2: stnp xzr, xzr, [x0] ++ stnp xzr, xzr, [x0, #16] ++ stnp xzr, xzr, [x0, #32] ++ stnp xzr, xzr, [x0, #48] ++ add x0, x0, #64 ++ tst x0, #(PAGE_SIZE - 1) ++ b.ne 2b ++ ret + ENDPROC(clear_page) diff --git a/patches.suse/arm64-compat-Allow-single-byte-watchpoints-on-all-addresses.patch b/patches.suse/arm64-compat-Allow-single-byte-watchpoints-on-all-addresses.patch new file mode 100644 index 0000000..6539e73 --- /dev/null +++ b/patches.suse/arm64-compat-Allow-single-byte-watchpoints-on-all-addresses.patch @@ -0,0 +1,32 @@ +From: Will Deacon +Date: Mon, 29 Jul 2019 11:06:17 +0100 +Subject: arm64: compat: Allow single-byte watchpoints on all addresses +Git-commit: 849adec41203ac5837c40c2d7e08490ffdef3c2c +Patch-mainline: v5.3-rc3 +References: git-fixes + +Commit d968d2b801d8 ("ARM: 7497/1: hw_breakpoint: allow single-byte +watchpoints on all addresses") changed the validation requirements for +hardware watchpoints on arch/arm/. Update our compat layer to implement +the same relaxation. + +Cc: +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/kernel/hw_breakpoint.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/arm64/kernel/hw_breakpoint.c ++++ b/arch/arm64/kernel/hw_breakpoint.c +@@ -555,6 +555,10 @@ int arch_validate_hwbkpt_settings(struct + /* Allow halfword watchpoints and breakpoints. */ + if (info->ctrl.len == ARM_BREAKPOINT_LEN_2) + break; ++ case 3: ++ /* Allow single byte watchpoint. */ ++ if (info->ctrl.len == ARM_BREAKPOINT_LEN_1) ++ break; + default: + return -EINVAL; + } diff --git a/patches.suse/arm64-compat-Reduce-address-limit.patch b/patches.suse/arm64-compat-Reduce-address-limit.patch new file mode 100644 index 0000000..1576253 --- /dev/null +++ b/patches.suse/arm64-compat-Reduce-address-limit.patch @@ -0,0 +1,49 @@ +From: Vincenzo Frascino +Date: Mon, 1 Apr 2019 12:30:14 +0100 +Subject: arm64: compat: Reduce address limit +Git-commit: d263119387de9975d2acba1dfd3392f7c5979c18 +Patch-mainline: v5.2-rc1 +References: git-fixes + +Currently, compat tasks running on arm64 can allocate memory up to +TASK_SIZE_32 (UL(0x100000000)). + +This means that mmap() allocations, if we treat them as returning an +array, are not compliant with the sections 6.5.8 of the C standard +(C99) which states that: "If the expression P points to an element of +an array object and the expression Q points to the last element of the +same array object, the pointer expression Q+1 compares greater than P". + +Redefine TASK_SIZE_32 to address the issue. + +Cc: Catalin Marinas +Cc: Will Deacon +Cc: Jann Horn +Cc: +Reported-by: Jann Horn +Signed-off-by: Vincenzo Frascino +[will: fixed typo in comment] +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/include/asm/processor.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/arch/arm64/include/asm/processor.h ++++ b/arch/arm64/include/asm/processor.h +@@ -51,7 +51,15 @@ + * TASK_UNMAPPED_BASE - the lower boundary of the mmap VM area. + */ + #ifdef CONFIG_COMPAT ++#ifdef CONFIG_ARM64_64K_PAGES ++/* ++ * With CONFIG_ARM64_64K_PAGES enabled, the last page is occupied ++ * by the compat vectors page. ++ */ + #define TASK_SIZE_32 UL(0x100000000) ++#else ++#define TASK_SIZE_32 (UL(0x100000000) - PAGE_SIZE) ++#endif /* CONFIG_ARM64_64K_PAGES */ + #define TASK_SIZE (test_thread_flag(TIF_32BIT) ? \ + TASK_SIZE_32 : TASK_SIZE_64) + #define TASK_SIZE_OF(tsk) (test_tsk_thread_flag(tsk, TIF_32BIT) ? \ diff --git a/patches.suse/arm64-cpufeature-Fix-feature-comparison-for-CTR_EL0.-CWG-ERG.patch b/patches.suse/arm64-cpufeature-Fix-feature-comparison-for-CTR_EL0.-CWG-ERG.patch new file mode 100644 index 0000000..fa5d7b5 --- /dev/null +++ b/patches.suse/arm64-cpufeature-Fix-feature-comparison-for-CTR_EL0.-CWG-ERG.patch @@ -0,0 +1,67 @@ +From: Will Deacon +Date: Tue, 30 Jul 2019 15:40:20 +0100 +Subject: arm64: cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG} +Git-commit: 147b9635e6347104b91f48ca9dca61eb0fbf2a54 +Patch-mainline: v5.3-rc3 +References: git-fixes + +If CTR_EL0.{CWG,ERG} are 0b0000 then they must be interpreted to have +their architecturally maximum values, which defeats the use of +FTR_HIGHER_SAFE when sanitising CPU ID registers on heterogeneous +machines. + +Introduce FTR_HIGHER_OR_ZERO_SAFE so that these fields effectively +saturate at zero. + +Fixes: 3c739b571084 ("arm64: Keep track of CPU feature registers") +Cc: # 4.4.x- +Reviewed-by: Suzuki K Poulose +Acked-by: Mark Rutland +Signed-off-by: Will Deacon +Signed-off-by: Catalin Marinas +Acked-by: Ivan T. Ivanov +--- + arch/arm64/include/asm/cpufeature.h | 7 ++++--- + arch/arm64/kernel/cpufeature.c | 8 ++++++-- + 2 files changed, 10 insertions(+), 5 deletions(-) + +--- a/arch/arm64/include/asm/cpufeature.h ++++ b/arch/arm64/include/asm/cpufeature.h +@@ -47,9 +47,10 @@ + */ + + enum ftr_type { +- FTR_EXACT, /* Use a predefined safe value */ +- FTR_LOWER_SAFE, /* Smaller value is safe */ +- FTR_HIGHER_SAFE,/* Bigger value is safe */ ++ FTR_EXACT, /* Use a predefined safe value */ ++ FTR_LOWER_SAFE, /* Smaller value is safe */ ++ FTR_HIGHER_SAFE, /* Bigger value is safe */ ++ FTR_HIGHER_OR_ZERO_SAFE, /* Bigger value is safe, but 0 is biggest */ + }; + + #define FTR_STRICT true /* SANITY check strict matching required */ +--- a/arch/arm64/kernel/cpufeature.c ++++ b/arch/arm64/kernel/cpufeature.c +@@ -213,8 +213,8 @@ static const struct arm64_ftr_bits ftr_c + ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_EXACT, 31, 1, 1), /* RES1 */ + ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, CTR_DIC_SHIFT, 1, 1), + ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, CTR_IDC_SHIFT, 1, 1), +- ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_HIGHER_SAFE, CTR_CWG_SHIFT, 4, 0), +- ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_HIGHER_SAFE, CTR_ERG_SHIFT, 4, 0), ++ ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_HIGHER_OR_ZERO_SAFE, CTR_CWG_SHIFT, 4, 0), ++ ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_HIGHER_OR_ZERO_SAFE, CTR_ERG_SHIFT, 4, 0), + ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, CTR_DMINLINE_SHIFT, 4, 1), + /* + * Linux can handle differing I-cache policies. Userspace JITs will +@@ -456,6 +456,10 @@ static s64 arm64_ftr_safe_value(const st + case FTR_LOWER_SAFE: + ret = new < cur ? new : cur; + break; ++ case FTR_HIGHER_OR_ZERO_SAFE: ++ if (!cur || !new) ++ break; ++ /* Fallthrough */ + case FTR_HIGHER_SAFE: + ret = new > cur ? new : cur; + break; diff --git a/patches.suse/arm64-cpufeature-Fix-the-type-of-no-FP-SIMD-capability.patch b/patches.suse/arm64-cpufeature-Fix-the-type-of-no-FP-SIMD-capability.patch new file mode 100644 index 0000000..a763fc3 --- /dev/null +++ b/patches.suse/arm64-cpufeature-Fix-the-type-of-no-FP-SIMD-capability.patch @@ -0,0 +1,42 @@ +From: Suzuki K Poulose +Date: Mon, 13 Jan 2020 23:30:19 +0000 +Subject: arm64: cpufeature: Fix the type of no FP/SIMD capability +Git-commit: 449443c03d8cfdacf7313e17779a2594ebf87e6d +Patch-mainline: v5.6-rc1 +References: git-fixes + +The NO_FPSIMD capability is defined with scope SYSTEM, which implies +that the "absence" of FP/SIMD on at least one CPU is detected only +after all the SMP CPUs are brought up. However, we use the status +of this capability for every context switch. So, let us change +the scope to LOCAL_CPU to allow the detection of this capability +as and when the first CPU without FP is brought up. + +Also, the current type allows hotplugged CPU to be brought up without +FP/SIMD when all the current CPUs have FP/SIMD and we have the userspace +up. Fix both of these issues by changing the capability to +BOOT_RESTRICTED_LOCAL_CPU_FEATURE. + +Fixes: 82e0191a1aa11abf ("arm64: Support systems without FP/ASIMD") +Cc: Will Deacon +Cc: Mark Rutland +Reviewed-by: Ard Biesheuvel +Reviewed-by: Catalin Marinas +Signed-off-by: Suzuki K Poulose +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/kernel/cpufeature.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/kernel/cpufeature.c ++++ b/arch/arm64/kernel/cpufeature.c +@@ -1300,7 +1300,7 @@ static const struct arm64_cpu_capabiliti + { + /* FP/SIMD is not implemented */ + .capability = ARM64_HAS_NO_FPSIMD, +- .type = ARM64_CPUCAP_SYSTEM_FEATURE, ++ .type = ARM64_CPUCAP_BOOT_RESTRICTED_CPU_LOCAL_FEATURE, + .min_field_value = 0, + .matches = has_no_fpsimd, + }, diff --git a/patches.suse/arm64-cpufeature-Set-the-FP-SIMD-compat-HWCAP-bits-properly.patch b/patches.suse/arm64-cpufeature-Set-the-FP-SIMD-compat-HWCAP-bits-properly.patch new file mode 100644 index 0000000..1d9ea39 --- /dev/null +++ b/patches.suse/arm64-cpufeature-Set-the-FP-SIMD-compat-HWCAP-bits-properly.patch @@ -0,0 +1,99 @@ +From: Suzuki K Poulose +Date: Mon, 13 Jan 2020 23:30:20 +0000 +Subject: arm64: cpufeature: Set the FP/SIMD compat HWCAP bits properly +Git-commit: 7559950aef1ab8792c50797c6c5c7c5150a02460 +Patch-mainline: v5.6-rc1 +References: git-fixes + +We set the compat_elf_hwcap bits unconditionally on arm64 to +include the VFP and NEON support. However, the FP/SIMD unit +is optional on Arm v8 and thus could be missing. We already +handle this properly in the kernel, but still advertise to +the COMPAT applications that the VFP is available. Fix this +to make sure we only advertise when we really have them. + +Fixes: 82e0191a1aa11abf ("arm64: Support systems without FP/ASIMD") +Cc: Will Deacon +Cc: Mark Rutland +Reviewed-by: Ard Biesheuvel +Reviewed-by: Catalin Marinas +Signed-off-by: Suzuki K Poulose +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/kernel/cpufeature.c | 41 ++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 38 insertions(+), 3 deletions(-) + +--- a/arch/arm64/kernel/cpufeature.c ++++ b/arch/arm64/kernel/cpufeature.c +@@ -43,9 +43,7 @@ EXPORT_SYMBOL_GPL(elf_hwcap); + #define COMPAT_ELF_HWCAP_DEFAULT \ + (COMPAT_HWCAP_HALF|COMPAT_HWCAP_THUMB|\ + COMPAT_HWCAP_FAST_MULT|COMPAT_HWCAP_EDSP|\ +- COMPAT_HWCAP_TLS|COMPAT_HWCAP_VFP|\ +- COMPAT_HWCAP_VFPv3|COMPAT_HWCAP_VFPv4|\ +- COMPAT_HWCAP_NEON|COMPAT_HWCAP_IDIV|\ ++ COMPAT_HWCAP_TLS|COMPAT_HWCAP_IDIV|\ + COMPAT_HWCAP_LPAE) + unsigned int compat_elf_hwcap __read_mostly = COMPAT_ELF_HWCAP_DEFAULT; + unsigned int compat_elf_hwcap2 __read_mostly; +@@ -1392,6 +1390,7 @@ static const struct arm64_cpu_capabiliti + {}, + }; + ++ + #define HWCAP_CAP(reg, field, s, min_value, cap_type, cap) \ + { \ + .desc = #cap, \ +@@ -1405,6 +1404,15 @@ static const struct arm64_cpu_capabiliti + .hwcap = cap, \ + } + ++#define HWCAP_CAP_MATCH(match, cap_type, cap) \ ++ { \ ++ .desc = #cap, \ ++ .type = ARM64_CPUCAP_SYSTEM_FEATURE, \ ++ .hwcap_type = cap_type, \ ++ .hwcap = cap, \ ++ .matches = match, \ ++ } ++ + static const struct arm64_cpu_capabilities arm64_elf_hwcaps[] = { + HWCAP_CAP(SYS_ID_AA64ISAR0_EL1, ID_AA64ISAR0_AES_SHIFT, FTR_UNSIGNED, 2, CAP_HWCAP, HWCAP_PMULL), + HWCAP_CAP(SYS_ID_AA64ISAR0_EL1, ID_AA64ISAR0_AES_SHIFT, FTR_UNSIGNED, 1, CAP_HWCAP, HWCAP_AES), +@@ -1437,8 +1445,35 @@ static const struct arm64_cpu_capabiliti + {}, + }; + ++#ifdef CONFIG_COMPAT ++static bool compat_has_neon(const struct arm64_cpu_capabilities *cap, int scope) ++{ ++ /* ++ * Check that all of MVFR1_EL1.{SIMDSP, SIMDInt, SIMDLS} are available, ++ * in line with that of arm32 as in vfp_init(). We make sure that the ++ * check is future proof, by making sure value is non-zero. ++ */ ++ u32 mvfr1; ++ ++ WARN_ON(scope == SCOPE_LOCAL_CPU && preemptible()); ++ if (scope == SCOPE_SYSTEM) ++ mvfr1 = read_sanitised_ftr_reg(SYS_MVFR1_EL1); ++ else ++ mvfr1 = read_sysreg_s(SYS_MVFR1_EL1); ++ ++ return cpuid_feature_extract_unsigned_field(mvfr1, MVFR1_SIMDSP_SHIFT) && ++ cpuid_feature_extract_unsigned_field(mvfr1, MVFR1_SIMDINT_SHIFT) && ++ cpuid_feature_extract_unsigned_field(mvfr1, MVFR1_SIMDLS_SHIFT); ++} ++#endif ++ + static const struct arm64_cpu_capabilities compat_elf_hwcaps[] = { + #ifdef CONFIG_COMPAT ++ HWCAP_CAP_MATCH(compat_has_neon, CAP_COMPAT_HWCAP, COMPAT_HWCAP_NEON), ++ HWCAP_CAP(SYS_MVFR1_EL1, MVFR1_SIMDFMAC_SHIFT, FTR_UNSIGNED, 1, CAP_COMPAT_HWCAP, COMPAT_HWCAP_VFPv4), ++ /* Arm v8 mandates MVFR0.FPDP == {0, 2}. So, piggy back on this for the presence of VFP support */ ++ HWCAP_CAP(SYS_MVFR0_EL1, MVFR0_FPDP_SHIFT, FTR_UNSIGNED, 2, CAP_COMPAT_HWCAP, COMPAT_HWCAP_VFP), ++ HWCAP_CAP(SYS_MVFR0_EL1, MVFR0_FPDP_SHIFT, FTR_UNSIGNED, 2, CAP_COMPAT_HWCAP, COMPAT_HWCAP_VFPv3), + HWCAP_CAP(SYS_ID_ISAR5_EL1, ID_ISAR5_AES_SHIFT, FTR_UNSIGNED, 2, CAP_COMPAT_HWCAP2, COMPAT_HWCAP2_PMULL), + HWCAP_CAP(SYS_ID_ISAR5_EL1, ID_ISAR5_AES_SHIFT, FTR_UNSIGNED, 1, CAP_COMPAT_HWCAP2, COMPAT_HWCAP2_AES), + HWCAP_CAP(SYS_ID_ISAR5_EL1, ID_ISAR5_SHA1_SHIFT, FTR_UNSIGNED, 1, CAP_COMPAT_HWCAP2, COMPAT_HWCAP2_SHA1), diff --git a/patches.suse/arm64-csum-Fix-handling-of-bad-packets.patch b/patches.suse/arm64-csum-Fix-handling-of-bad-packets.patch new file mode 100644 index 0000000..786cd96 --- /dev/null +++ b/patches.suse/arm64-csum-Fix-handling-of-bad-packets.patch @@ -0,0 +1,43 @@ +From: Robin Murphy +Date: Thu, 30 Jul 2020 10:56:49 +0100 +Subject: arm64: csum: Fix handling of bad packets +Git-commit: 05fb3dbda187bbd9cc1cd0e97e5d6595af570ac6 +Patch-mainline: v5.8 +References: git-fixes + +Although iph is expected to point to at least 20 bytes of valid memory, +ihl may be bogus, for example on reception of a corrupt packet. If it +happens to be less than 5, we really don't want to run away and +dereference 16GB worth of memory until it wraps back to exactly zero... + +Fixes: 0e455d8e80aa ("arm64: Implement optimised IP checksum helpers") +Reported-by: guodeqing +Signed-off-by: Robin Murphy +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/include/asm/checksum.h | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/arch/arm64/include/asm/checksum.h ++++ b/arch/arm64/include/asm/checksum.h +@@ -30,16 +30,17 @@ static inline __sum16 ip_fast_csum(const + { + __uint128_t tmp; + u64 sum; ++ int n = ihl; /* we want it signed */ + + tmp = *(const __uint128_t *)iph; + iph += 16; +- ihl -= 4; ++ n -= 4; + tmp += ((tmp >> 64) | (tmp << 64)); + sum = tmp >> 64; + do { + sum += *(const u32 *)iph; + iph += 4; +- } while (--ihl); ++ } while (--n > 0); + + sum += ((sum >> 32) | (sum << 32)); + return csum_fold(sum >> 32); diff --git a/patches.suse/arm64-debug-Don-t-propagate-UNKNOWN-FAR-into-si_code-for-debug-signals.patch b/patches.suse/arm64-debug-Don-t-propagate-UNKNOWN-FAR-into-si_code-for-debug-signals.patch new file mode 100644 index 0000000..7977df0 --- /dev/null +++ b/patches.suse/arm64-debug-Don-t-propagate-UNKNOWN-FAR-into-si_code-for-debug-signals.patch @@ -0,0 +1,61 @@ +From: Will Deacon +Date: Fri, 1 Mar 2019 13:28:00 +0000 +Subject: arm64: debug: Don't propagate UNKNOWN FAR into si_code for debug + signals +Git-commit: b9a4b9d084d978f80eb9210727c81804588b42ff +Patch-mainline: v5.1-rc1 +References: git-fixes + +FAR_EL1 is UNKNOWN for all debug exceptions other than those caused by +taking a hardware watchpoint. Unfortunately, if a debug handler returns +a non-zero value, then we will propagate the UNKNOWN FAR value to +userspace via the si_addr field of the SIGTRAP siginfo_t. + +Instead, let's set si_addr to take on the PC of the faulting instruction, +which we have available in the current pt_regs. + +Cc: +Reviewed-by: Mark Rutland +Signed-off-by: Will Deacon +Signed-off-by: Catalin Marinas +Acked-by: Ivan T. Ivanov +--- + arch/arm64/mm/fault.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/arch/arm64/mm/fault.c ++++ b/arch/arm64/mm/fault.c +@@ -776,11 +776,12 @@ void __init hook_debug_fault_code(int nr + debug_fault_info[nr].name = name; + } + +-asmlinkage int __exception do_debug_exception(unsigned long addr, ++asmlinkage int __exception do_debug_exception(unsigned long addr_if_watchpoint, + unsigned int esr, + struct pt_regs *regs) + { + const struct fault_info *inf = debug_fault_info + DBG_ESR_EVT(esr); ++ unsigned long pc = instruction_pointer(regs); + struct siginfo info; + int rv; + +@@ -794,16 +795,16 @@ asmlinkage int __exception do_debug_exce + if (user_mode(regs) && instruction_pointer(regs) > TASK_SIZE) + arm64_apply_bp_hardening(); + +- if (!inf->fn(addr, esr, regs)) { ++ if (!inf->fn(addr_if_watchpoint, esr, regs)) { + rv = 1; + } else { + pr_alert("Unhandled debug exception: %s (0x%08x) at 0x%016lx\n", +- inf->name, esr, addr); ++ inf->name, esr, pc); + + info.si_signo = inf->sig; + info.si_errno = 0; + info.si_code = inf->code; +- info.si_addr = (void __user *)addr; ++ info.si_addr = (void __user *)pc; + arm64_notify_die("", regs, &info, 0); + rv = 0; + } diff --git a/patches.suse/arm64-debug-Ensure-debug-handlers-check-triggering-exception-level.patch b/patches.suse/arm64-debug-Ensure-debug-handlers-check-triggering-exception-level.patch new file mode 100644 index 0000000..729e13e --- /dev/null +++ b/patches.suse/arm64-debug-Ensure-debug-handlers-check-triggering-exception-level.patch @@ -0,0 +1,90 @@ +From: Will Deacon +Date: Fri, 1 Mar 2019 13:28:01 +0000 +Subject: arm64: debug: Ensure debug handlers check triggering exception level +Git-commit: 6bd288569b50bc89fa5513031086746968f585cb +Patch-mainline: v5.1-rc1 +References: git-fixes + +Debug exception handlers may be called for exceptions generated both by +user and kernel code. In many cases, this is checked explicitly, but +in other cases things either happen to work by happy accident or they +go slightly wrong. For example, executing 'brk #4' from userspace will +enter the kprobes code and be ignored, but the instruction will be +retried forever in userspace instead of delivering a SIGTRAP. + +Fix this issue in the most stable-friendly fashion by simply adding +explicit checks of the triggering exception level to all of our debug +exception handlers. + +Cc: +Reviewed-by: Mark Rutland +Signed-off-by: Will Deacon +Signed-off-by: Catalin Marinas +Acked-by: Ivan T. Ivanov +--- + arch/arm64/kernel/kgdb.c | 14 ++++++++++---- + arch/arm64/kernel/probes/kprobes.c | 6 ++++++ + 2 files changed, 16 insertions(+), 4 deletions(-) + +--- a/arch/arm64/kernel/kgdb.c ++++ b/arch/arm64/kernel/kgdb.c +@@ -233,27 +233,33 @@ int kgdb_arch_handle_exception(int excep + + static int kgdb_brk_fn(struct pt_regs *regs, unsigned int esr) + { ++ if (user_mode(regs)) ++ return DBG_HOOK_ERROR; ++ + kgdb_handle_exception(1, SIGTRAP, 0, regs); +- return 0; ++ return DBG_HOOK_HANDLED; + } + NOKPROBE_SYMBOL(kgdb_brk_fn) + + static int kgdb_compiled_brk_fn(struct pt_regs *regs, unsigned int esr) + { ++ if (user_mode(regs)) ++ return DBG_HOOK_ERROR; ++ + compiled_break = 1; + kgdb_handle_exception(1, SIGTRAP, 0, regs); + +- return 0; ++ return DBG_HOOK_HANDLED; + } + NOKPROBE_SYMBOL(kgdb_compiled_brk_fn); + + static int kgdb_step_brk_fn(struct pt_regs *regs, unsigned int esr) + { +- if (!kgdb_single_step) ++ if (user_mode(regs) || !kgdb_single_step) + return DBG_HOOK_ERROR; + + kgdb_handle_exception(1, SIGTRAP, 0, regs); +- return 0; ++ return DBG_HOOK_HANDLED; + } + NOKPROBE_SYMBOL(kgdb_step_brk_fn); + +--- a/arch/arm64/kernel/probes/kprobes.c ++++ b/arch/arm64/kernel/probes/kprobes.c +@@ -445,6 +445,9 @@ kprobe_single_step_handler(struct pt_reg + struct kprobe_ctlblk *kcb = get_kprobe_ctlblk(); + int retval; + ++ if (user_mode(regs)) ++ return DBG_HOOK_ERROR; ++ + /* return error if this is not our step */ + retval = kprobe_ss_hit(kcb, instruction_pointer(regs)); + +@@ -461,6 +464,9 @@ kprobe_single_step_handler(struct pt_reg + int __kprobes + kprobe_breakpoint_handler(struct pt_regs *regs, unsigned int esr) + { ++ if (user_mode(regs)) ++ return DBG_HOOK_ERROR; ++ + kprobe_handler(regs); + return DBG_HOOK_HANDLED; + } diff --git a/patches.suse/arm64-dts-marvell-Fix-A37xx-UART0-register-size.patch b/patches.suse/arm64-dts-marvell-Fix-A37xx-UART0-register-size.patch new file mode 100644 index 0000000..b1e82da --- /dev/null +++ b/patches.suse/arm64-dts-marvell-Fix-A37xx-UART0-register-size.patch @@ -0,0 +1,42 @@ +From: allen yan +Date: Thu, 7 Sep 2017 15:04:53 +0200 +Subject: arm64: dts: marvell: Fix A37xx UART0 register size +Git-commit: c737abc193d16e62e23e2fb585b8b7398ab380d8 +Patch-mainline: v4.15-rc1 +References: git-fixes + +Armada-37xx UART0 registers are 0x200 bytes wide. Right next to them are +the UART1 registers that should not be declared in this node. + +Update the example in DT bindings document accordingly. + +Signed-off-by: allen yan +Signed-off-by: Miquel Raynal +Signed-off-by: Gregory CLEMENT +Acked-by: Ivan T. Ivanov +--- + Documentation/devicetree/bindings/serial/mvebu-uart.txt | 2 +- + arch/arm64/boot/dts/marvell/armada-37xx.dtsi | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/Documentation/devicetree/bindings/serial/mvebu-uart.txt ++++ b/Documentation/devicetree/bindings/serial/mvebu-uart.txt +@@ -8,6 +8,6 @@ Required properties: + Example: + serial@12000 { + compatible = "marvell,armada-3700-uart"; +- reg = <0x12000 0x400>; ++ reg = <0x12000 0x200>; + interrupts = <43>; + }; +--- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi ++++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi +@@ -129,7 +129,7 @@ + + uart0: serial@12000 { + compatible = "marvell,armada-3700-uart"; +- reg = <0x12000 0x400>; ++ reg = <0x12000 0x200>; + interrupts = ; + status = "disabled"; + }; diff --git a/patches.suse/arm64-entry-SP-Alignment-Fault-doesn-t-write-to-FAR_EL1.patch b/patches.suse/arm64-entry-SP-Alignment-Fault-doesn-t-write-to-FAR_EL1.patch new file mode 100644 index 0000000..75dc5f2 --- /dev/null +++ b/patches.suse/arm64-entry-SP-Alignment-Fault-doesn-t-write-to-FAR_EL1.patch @@ -0,0 +1,98 @@ +From: James Morse +Date: Mon, 22 Jul 2019 16:11:48 +0100 +Subject: arm64: entry: SP Alignment Fault doesn't write to FAR_EL1 +Git-commit: 40ca0ce56d4bb889dc43b455c55398468115569a +Patch-mainline: v5.3-rc2 +References: git-fixes + +Comparing the arm-arm's pseudocode for AArch64.PCAlignmentFault() with +AArch64.SPAlignmentFault() shows that SP faults don't copy the faulty-SP +to FAR_EL1, but this is where we read from, and the address we provide +to user-space with the BUS_ADRALN signal. + +For user-space this value will be UNKNOWN due to the previous ERET to +user-space. If the last value is preserved, on systems with KASLR or KPTI +this will be the user-space link-register left in FAR_EL1 by tramp_exit(). +Fix this to retrieve the original sp_el0 value, and pass this to +do_sp_pc_fault(). + +SP alignment faults from EL1 will cause us to take the fault again when +trying to store the pt_regs. This eventually takes us to the overflow +stack. Remove the ESR_ELx_EC_SP_ALIGN check as we will never make it +this far. + +Fixes: 60ffc30d5652 ("arm64: Exception handling") +Signed-off-by: James Morse +[will: change label name and fleshed out comment] +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/kernel/entry.S | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +--- a/arch/arm64/kernel/entry.S ++++ b/arch/arm64/kernel/entry.S +@@ -568,10 +568,8 @@ el1_sync: + b.eq el1_ia + cmp x24, #ESR_ELx_EC_SYS64 // configurable trap + b.eq el1_undef +- cmp x24, #ESR_ELx_EC_SP_ALIGN // stack alignment exception +- b.eq el1_sp_pc + cmp x24, #ESR_ELx_EC_PC_ALIGN // pc alignment exception +- b.eq el1_sp_pc ++ b.eq el1_pc + cmp x24, #ESR_ELx_EC_UNKNOWN // unknown exception in EL1 + b.eq el1_undef + cmp x24, #ESR_ELx_EC_BREAKPT_CUR // debug exception in EL1 +@@ -593,9 +591,11 @@ el1_da: + bl do_mem_abort + + kernel_exit 1 +-el1_sp_pc: ++el1_pc: + /* +- * Stack or PC alignment exception handling ++ * PC alignment exception handling. We don't handle SP alignment faults, ++ * since we will have hit a recursive exception when trying to push the ++ * initial pt_regs. + */ + mrs x0, far_el1 + inherit_daif pstate=x23, tmp=x2 +@@ -687,9 +687,9 @@ el0_sync: + cmp x24, #ESR_ELx_EC_SYS64 // configurable trap + b.eq el0_sys + cmp x24, #ESR_ELx_EC_SP_ALIGN // stack alignment exception +- b.eq el0_sp_pc ++ b.eq el0_sp + cmp x24, #ESR_ELx_EC_PC_ALIGN // pc alignment exception +- b.eq el0_sp_pc ++ b.eq el0_pc + cmp x24, #ESR_ELx_EC_UNKNOWN // unknown exception in EL0 + b.eq el0_undef + cmp x24, #ESR_ELx_EC_BREAKPT_LOW // debug exception in EL0 +@@ -713,7 +713,7 @@ el0_sync_compat: + cmp x24, #ESR_ELx_EC_FP_EXC32 // FP/ASIMD exception + b.eq el0_fpsimd_exc + cmp x24, #ESR_ELx_EC_PC_ALIGN // pc alignment exception +- b.eq el0_sp_pc ++ b.eq el0_pc + cmp x24, #ESR_ELx_EC_UNKNOWN // unknown exception in EL0 + b.eq el0_undef + cmp x24, #ESR_ELx_EC_CP15_32 // CP15 MRC/MCR trap +@@ -817,11 +817,15 @@ el0_fpsimd_exc: + mov x1, sp + bl do_fpsimd_exc + b ret_to_user ++el0_sp: ++ ldr x26, [sp, #S_SP] ++ b el0_sp_pc ++el0_pc: ++ mrs x26, far_el1 + el0_sp_pc: + /* + * Stack or PC alignment exception handling + */ +- mrs x26, far_el1 + enable_da_f + #ifdef CONFIG_TRACE_IRQFLAGS + bl trace_hardirqs_off diff --git a/patches.suse/arm64-fix-inline-asm-in-load_unaligned_zeropad.patch b/patches.suse/arm64-fix-inline-asm-in-load_unaligned_zeropad.patch new file mode 100644 index 0000000..e742c9e --- /dev/null +++ b/patches.suse/arm64-fix-inline-asm-in-load_unaligned_zeropad.patch @@ -0,0 +1,55 @@ +From: Peter Collingbourne +Date: Thu, 1 Apr 2021 09:51:10 -0700 +Subject: arm64: fix inline asm in load_unaligned_zeropad() +Git-commit: 185f2e5f51c2029efd9dd26cceb968a44fe053c6 +Patch-mainline: v5.12-rc8 +References: git-fixes + +The inline asm's addr operand is marked as input-only, however in +the case where an exception is taken it may be modified by the BIC +instruction on the exception path. Fix the problem by using a temporary +register as the destination register for the BIC instruction. + +Signed-off-by: Peter Collingbourne +Cc: stable@vger.kernel.org +Link: https://linux-review.googlesource.com/id/I84538c8a2307d567b4f45bb20b715451005f9617 +Link: https://lore.kernel.org/r/20210401165110.3952103-1-pcc@google.com +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/include/asm/word-at-a-time.h | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/arch/arm64/include/asm/word-at-a-time.h ++++ b/arch/arm64/include/asm/word-at-a-time.h +@@ -64,7 +64,7 @@ static inline unsigned long find_zero(un + */ + static inline unsigned long load_unaligned_zeropad(const void *addr) + { +- unsigned long ret, offset; ++ unsigned long ret, tmp; + + /* Load word from unaligned pointer addr */ + asm( +@@ -72,9 +72,9 @@ static inline unsigned long load_unalign + "2:\n" + " .pushsection .fixup,\"ax\"\n" + " .align 2\n" +- "3: and %1, %2, #0x7\n" +- " bic %2, %2, #0x7\n" +- " ldr %0, [%2]\n" ++ "3: bic %1, %2, #0x7\n" ++ " ldr %0, [%1]\n" ++ " and %1, %2, #0x7\n" + " lsl %1, %1, #0x3\n" + #ifndef __AARCH64EB__ + " lsr %0, %0, %1\n" +@@ -84,7 +84,7 @@ static inline unsigned long load_unalign + " b 2b\n" + " .popsection\n" + _ASM_EXTABLE(1b, 3b) +- : "=&r" (ret), "=&r" (offset) ++ : "=&r" (ret), "=&r" (tmp) + : "r" (addr), "Q" (*(unsigned long *)addr)); + + return ret; diff --git a/patches.suse/arm64-fix-the-flush_icache_range-arguments-in-machine_kexec.patch b/patches.suse/arm64-fix-the-flush_icache_range-arguments-in-machine_kexec.patch new file mode 100644 index 0000000..cb8a9de --- /dev/null +++ b/patches.suse/arm64-fix-the-flush_icache_range-arguments-in-machine_kexec.patch @@ -0,0 +1,28 @@ +From: Christoph Hellwig +Date: Sun, 10 May 2020 09:54:41 +0200 +Subject: arm64: fix the flush_icache_range arguments in machine_kexec +Git-commit: d51c214541c5154dda3037289ee895ea3ded5ebd +Patch-mainline: v5.7-rc6 +References: git-fixes + +The second argument is the end "pointer", not the length. + +Fixes: d28f6df1305a ("arm64/kexec: Add core kexec support") +Cc: # 4.8.x- +Signed-off-by: Christoph Hellwig +Signed-off-by: Catalin Marinas +Acked-by: Ivan T. Ivanov +--- + arch/arm64/kernel/machine_kexec.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm64/kernel/machine_kexec.c ++++ b/arch/arm64/kernel/machine_kexec.c +@@ -185,6 +185,7 @@ void machine_kexec(struct kimage *kimage + /* Flush the reboot_code_buffer in preparation for its execution. */ + __flush_dcache_area(reboot_code_buffer, arm64_relocate_new_kernel_size); + flush_icache_range((uintptr_t)reboot_code_buffer, ++ (uintptr_t)reboot_code_buffer + + arm64_relocate_new_kernel_size); + + /* Flush the kimage list and its buffers. */ diff --git a/patches.suse/arm64-futex-Avoid-copying-out-uninitialised-stack-in-failed-cmpxchg.patch b/patches.suse/arm64-futex-Avoid-copying-out-uninitialised-stack-in-failed-cmpxchg.patch new file mode 100644 index 0000000..aa9f16a --- /dev/null +++ b/patches.suse/arm64-futex-Avoid-copying-out-uninitialised-stack-in-failed-cmpxchg.patch @@ -0,0 +1,33 @@ +From: Will Deacon +Date: Wed, 10 Apr 2019 11:49:11 +0100 +Subject: arm64: futex: Avoid copying out uninitialised stack in failed + cmpxchg() +Git-commit: 8e4e0ac02b449297b86498ac24db5786ddd9f647 +Patch-mainline: v5.2-rc1 +References: git-fixes + +Returning an error code from futex_atomic_cmpxchg_inatomic() indicates +that the caller should not make any use of *uval, and should instead act +upon on the value of the error code. Although this is implemented +correctly in our futex code, we needlessly copy uninitialised stack to +*uval in the error case, which can easily be avoided. + +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/include/asm/futex.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/arch/arm64/include/asm/futex.h ++++ b/arch/arm64/include/asm/futex.h +@@ -134,7 +134,9 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, + : "memory"); + uaccess_disable(); + +- *uval = val; ++ if (!ret) ++ *uval = val; ++ + return ret; + } + diff --git a/patches.suse/arm64-futex-Bound-number-of-LDXR-STXR-loops-in-FUTEX_WAKE_OP.patch b/patches.suse/arm64-futex-Bound-number-of-LDXR-STXR-loops-in-FUTEX_WAKE_OP.patch new file mode 100644 index 0000000..b9976f6 --- /dev/null +++ b/patches.suse/arm64-futex-Bound-number-of-LDXR-STXR-loops-in-FUTEX_WAKE_OP.patch @@ -0,0 +1,139 @@ +From: Will Deacon +Date: Mon, 8 Apr 2019 14:23:17 +0100 +Subject: arm64: futex: Bound number of LDXR/STXR loops in FUTEX_WAKE_OP +Git-commit: 03110a5cb2161690ae5ac04994d47ed0cd6cef75 +Patch-mainline: v5.2-rc1 +References: git-fixes + +Our futex implementation makes use of LDXR/STXR loops to perform atomic +updates to user memory from atomic context. This can lead to latency +problems if we end up spinning around the LL/SC sequence at the expense +of doing something useful. + +Rework our futex atomic operations so that we return -EAGAIN if we fail +to update the futex word after 128 attempts. The core futex code will +reschedule if necessary and we'll try again later. + +Cc: +Fixes: 6170a97460db ("arm64: Atomic operations") +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/include/asm/futex.h | 55 +++++++++++++++++++++++++---------------- + 1 file changed, 34 insertions(+), 21 deletions(-) + +--- a/arch/arm64/include/asm/futex.h ++++ b/arch/arm64/include/asm/futex.h +@@ -23,26 +23,34 @@ + + #include + ++#define FUTEX_MAX_LOOPS 128 /* What's the largest number you can think of? */ ++ + #define __futex_atomic_op(insn, ret, oldval, uaddr, tmp, oparg) \ + do { \ ++ unsigned int loops = FUTEX_MAX_LOOPS; \ ++ \ + uaccess_enable(); \ + asm volatile( \ + " prfm pstl1strm, %2\n" \ + "1: ldxr %w1, %2\n" \ + insn "\n" \ + "2: stlxr %w0, %w3, %2\n" \ +-" cbnz %w0, 1b\n" \ +-" dmb ish\n" \ ++" cbz %w0, 3f\n" \ ++" sub %w4, %w4, %w0\n" \ ++" cbnz %w4, 1b\n" \ ++" mov %w0, %w7\n" \ + "3:\n" \ ++" dmb ish\n" \ + " .pushsection .fixup,\"ax\"\n" \ + " .align 2\n" \ +-"4: mov %w0, %w5\n" \ ++"4: mov %w0, %w6\n" \ + " b 3b\n" \ + " .popsection\n" \ + _ASM_EXTABLE(1b, 4b) \ + _ASM_EXTABLE(2b, 4b) \ +- : "=&r" (ret), "=&r" (oldval), "+Q" (*uaddr), "=&r" (tmp) \ +- : "r" (oparg), "Ir" (-EFAULT) \ ++ : "=&r" (ret), "=&r" (oldval), "+Q" (*uaddr), "=&r" (tmp), \ ++ "+r" (loops) \ ++ : "r" (oparg), "Ir" (-EFAULT), "Ir" (-EAGAIN) \ + : "memory"); \ + uaccess_disable(); \ + } while (0) +@@ -57,23 +65,23 @@ arch_futex_atomic_op_inuser(int op, int + + switch (op) { + case FUTEX_OP_SET: +- __futex_atomic_op("mov %w3, %w4", ++ __futex_atomic_op("mov %w3, %w5", + ret, oldval, uaddr, tmp, oparg); + break; + case FUTEX_OP_ADD: +- __futex_atomic_op("add %w3, %w1, %w4", ++ __futex_atomic_op("add %w3, %w1, %w5", + ret, oldval, uaddr, tmp, oparg); + break; + case FUTEX_OP_OR: +- __futex_atomic_op("orr %w3, %w1, %w4", ++ __futex_atomic_op("orr %w3, %w1, %w5", + ret, oldval, uaddr, tmp, oparg); + break; + case FUTEX_OP_ANDN: +- __futex_atomic_op("and %w3, %w1, %w4", ++ __futex_atomic_op("and %w3, %w1, %w5", + ret, oldval, uaddr, tmp, ~oparg); + break; + case FUTEX_OP_XOR: +- __futex_atomic_op("eor %w3, %w1, %w4", ++ __futex_atomic_op("eor %w3, %w1, %w5", + ret, oldval, uaddr, tmp, oparg); + break; + default: +@@ -93,6 +101,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, + u32 oldval, u32 newval) + { + int ret = 0; ++ unsigned int loops = FUTEX_MAX_LOOPS; + u32 val, tmp; + u32 __user *uaddr; + +@@ -104,20 +113,24 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, + asm volatile("// futex_atomic_cmpxchg_inatomic\n" + " prfm pstl1strm, %2\n" + "1: ldxr %w1, %2\n" +-" sub %w3, %w1, %w4\n" +-" cbnz %w3, 3f\n" +-"2: stlxr %w3, %w5, %2\n" +-" cbnz %w3, 1b\n" +-" dmb ish\n" ++" sub %w3, %w1, %w5\n" ++" cbnz %w3, 4f\n" ++"2: stlxr %w3, %w6, %2\n" ++" cbz %w3, 3f\n" ++" sub %w4, %w4, %w3\n" ++" cbnz %w4, 1b\n" ++" mov %w0, %w8\n" + "3:\n" ++" dmb ish\n" ++"4:\n" + " .pushsection .fixup,\"ax\"\n" +-"4: mov %w0, %w6\n" +-" b 3b\n" ++"5: mov %w0, %w7\n" ++" b 4b\n" + " .popsection\n" +- _ASM_EXTABLE(1b, 4b) +- _ASM_EXTABLE(2b, 4b) +- : "+r" (ret), "=&r" (val), "+Q" (*uaddr), "=&r" (tmp) +- : "r" (oldval), "r" (newval), "Ir" (-EFAULT) ++ _ASM_EXTABLE(1b, 5b) ++ _ASM_EXTABLE(2b, 5b) ++ : "+r" (ret), "=&r" (val), "+Q" (*uaddr), "=&r" (tmp), "+r" (loops) ++ : "r" (oldval), "r" (newval), "Ir" (-EFAULT), "Ir" (-EAGAIN) + : "memory"); + uaccess_disable(); + diff --git a/patches.suse/arm64-futex-Fix-FUTEX_WAKE_OP-atomic-ops-with-non-zero-result-value.patch b/patches.suse/arm64-futex-Fix-FUTEX_WAKE_OP-atomic-ops-with-non-zero-result-value.patch new file mode 100644 index 0000000..db12e1b --- /dev/null +++ b/patches.suse/arm64-futex-Fix-FUTEX_WAKE_OP-atomic-ops-with-non-zero-result-value.patch @@ -0,0 +1,89 @@ +From: Will Deacon +Date: Mon, 8 Apr 2019 12:45:09 +0100 +Subject: arm64: futex: Fix FUTEX_WAKE_OP atomic ops with non-zero result value +Git-commit: 045afc24124d80c6998d9c770844c67912083506 +Patch-mainline: v5.1-rc5 +References: git-fixes + +Rather embarrassingly, our futex() FUTEX_WAKE_OP implementation doesn't +explicitly set the return value on the non-faulting path and instead +leaves it holding the result of the underlying atomic operation. This +means that any FUTEX_WAKE_OP atomic operation which computes a non-zero +value will be reported as having failed. Regrettably, I wrote the buggy +code back in 2011 and it was upstreamed as part of the initial arm64 +support in 2012. + +The reasons we appear to get away with this are: + + 1. FUTEX_WAKE_OP is rarely used and therefore doesn't appear to get + exercised by futex() test applications + + 2. If the result of the atomic operation is zero, the system call + behaves correctly + + 3. Prior to version 2.25, the only operation used by GLIBC set the + futex to zero, and therefore worked as expected. From 2.25 onwards, + FUTEX_WAKE_OP is not used by GLIBC at all. + +Fix the implementation by ensuring that the return value is either 0 +to indicate that the atomic operation completed successfully, or -EFAULT +if we encountered a fault when accessing the user mapping. + +Cc: +Fixes: 6170a97460db ("arm64: Atomic operations") +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/include/asm/futex.h | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/arch/arm64/include/asm/futex.h ++++ b/arch/arm64/include/asm/futex.h +@@ -30,8 +30,8 @@ do { \ + " prfm pstl1strm, %2\n" \ + "1: ldxr %w1, %2\n" \ + insn "\n" \ +-"2: stlxr %w3, %w0, %2\n" \ +-" cbnz %w3, 1b\n" \ ++"2: stlxr %w0, %w3, %2\n" \ ++" cbnz %w0, 1b\n" \ + " dmb ish\n" \ + "3:\n" \ + " .pushsection .fixup,\"ax\"\n" \ +@@ -50,30 +50,30 @@ do { \ + static inline int + arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *_uaddr) + { +- int oldval = 0, ret, tmp; ++ int oldval, ret, tmp; + u32 __user *uaddr = __uaccess_mask_ptr(_uaddr); + + pagefault_disable(); + + switch (op) { + case FUTEX_OP_SET: +- __futex_atomic_op("mov %w0, %w4", ++ __futex_atomic_op("mov %w3, %w4", + ret, oldval, uaddr, tmp, oparg); + break; + case FUTEX_OP_ADD: +- __futex_atomic_op("add %w0, %w1, %w4", ++ __futex_atomic_op("add %w3, %w1, %w4", + ret, oldval, uaddr, tmp, oparg); + break; + case FUTEX_OP_OR: +- __futex_atomic_op("orr %w0, %w1, %w4", ++ __futex_atomic_op("orr %w3, %w1, %w4", + ret, oldval, uaddr, tmp, oparg); + break; + case FUTEX_OP_ANDN: +- __futex_atomic_op("and %w0, %w1, %w4", ++ __futex_atomic_op("and %w3, %w1, %w4", + ret, oldval, uaddr, tmp, ~oparg); + break; + case FUTEX_OP_XOR: +- __futex_atomic_op("eor %w0, %w1, %w4", ++ __futex_atomic_op("eor %w3, %w1, %w4", + ret, oldval, uaddr, tmp, oparg); + break; + default: diff --git a/patches.suse/arm64-futex-Restore-oldval-initialization-to-work-around-buggy-compilers.patch b/patches.suse/arm64-futex-Restore-oldval-initialization-to-work-around-buggy-compilers.patch new file mode 100644 index 0000000..1157833 --- /dev/null +++ b/patches.suse/arm64-futex-Restore-oldval-initialization-to-work-around-buggy-compilers.patch @@ -0,0 +1,50 @@ +From: Nathan Chancellor +Date: Wed, 17 Apr 2019 00:21:21 -0700 +Subject: arm64: futex: Restore oldval initialization to work around buggy + compilers +Git-commit: ff8acf929014b7f87315588e0daf8597c8aa9d1c +Patch-mainline: v5.1-rc6 +References: git-fixes + +Commit 045afc24124d ("arm64: futex: Fix FUTEX_WAKE_OP atomic ops with +non-zero result value") removed oldval's zero initialization in +arch_futex_atomic_op_inuser because it is not necessary. Unfortunately, +Android's arm64 GCC 4.9.4 [1] does not agree: + +../kernel/futex.c: In function 'do_futex': +../kernel/futex.c:1658:17: warning: 'oldval' may be used uninitialized +in this function [-Wmaybe-uninitialized] + return oldval == cmparg; + ^ +In file included from ../kernel/futex.c:73:0: +../arch/arm64/include/asm/futex.h:53:6: note: 'oldval' was declared here + int oldval, ret, tmp; + ^ + +GCC fails to follow that when ret is non-zero, futex_atomic_op_inuser +returns right away, avoiding the uninitialized use that it claims. +Restoring the zero initialization works around this issue. + +[1]: https://android.googlesource.com/platform/prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.9/ + +Cc: stable@vger.kernel.org +Fixes: 045afc24124d ("arm64: futex: Fix FUTEX_WAKE_OP atomic ops with non-zero result value") +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Nathan Chancellor +Signed-off-by: Catalin Marinas +Acked-by: Ivan T. Ivanov +--- + arch/arm64/include/asm/futex.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/include/asm/futex.h ++++ b/arch/arm64/include/asm/futex.h +@@ -50,7 +50,7 @@ do { \ + static inline int + arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *_uaddr) + { +- int oldval, ret, tmp; ++ int oldval = 0, ret, tmp; + u32 __user *uaddr = __uaccess_mask_ptr(_uaddr); + + pagefault_disable(); diff --git a/patches.suse/arm64-hibernate-check-pgd-table-allocation.patch b/patches.suse/arm64-hibernate-check-pgd-table-allocation.patch new file mode 100644 index 0000000..af26f4d --- /dev/null +++ b/patches.suse/arm64-hibernate-check-pgd-table-allocation.patch @@ -0,0 +1,47 @@ +From: Pavel Tatashin +Date: Mon, 14 Oct 2019 10:48:24 -0400 +Subject: arm64: hibernate: check pgd table allocation +Git-commit: 8c551f919a73c1dfa690a70a691be1da394145e8 +Patch-mainline: v5.4-rc4 +References: git-fixes + +There is a bug in create_safe_exec_page(), when page table is allocated +it is not checked that table is allocated successfully: + +But it is dereferenced in: pgd_none(READ_ONCE(*pgdp)). Check that +allocation was successful. + +Fixes: 82869ac57b5d ("arm64: kernel: Add support for hibernate/suspend-to-disk") +Reviewed-by: James Morse +Signed-off-by: Pavel Tatashin +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/kernel/hibernate.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/arch/arm64/kernel/hibernate.c ++++ b/arch/arm64/kernel/hibernate.c +@@ -202,6 +202,7 @@ static int create_safe_exec_page(void *s + gfp_t mask) + { + int rc = 0; ++ pgd_t *trans_pgd; + pgd_t *pgd; + pud_t *pud; + pmd_t *pmd; +@@ -216,7 +217,13 @@ static int create_safe_exec_page(void *s + memcpy((void *)dst, src_start, length); + flush_icache_range(dst, dst + length); + +- pgd = pgd_offset_raw(allocator(mask), dst_addr); ++ trans_pgd = allocator(mask); ++ if (!trans_pgd) { ++ rc = -ENOMEM; ++ goto out; ++ } ++ ++ pgd = pgd_offset_raw(trans_pgd, dst_addr); + if (pgd_none(*pgd)) { + pud = allocator(mask); + if (!pud) { diff --git a/patches.suse/arm64-hugetlb-avoid-potential-NULL-dereference.patch b/patches.suse/arm64-hugetlb-avoid-potential-NULL-dereference.patch new file mode 100644 index 0000000..9d36530 --- /dev/null +++ b/patches.suse/arm64-hugetlb-avoid-potential-NULL-dereference.patch @@ -0,0 +1,53 @@ +From: Mark Rutland +Date: Tue, 5 May 2020 13:59:30 +0100 +Subject: arm64: hugetlb: avoid potential NULL dereference +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Git-commit: 027d0c7101f50cf03aeea9eebf484afd4920c8d3 +Patch-mainline: v5.7-rc5 +References: git-fixes + +The static analyzer in GCC 10 spotted that in huge_pte_alloc() we may +pass a NULL pmdp into pte_alloc_map() when pmd_alloc() returns NULL: + +| CC arch/arm64/mm/pageattr.o +| CC arch/arm64/mm/hugetlbpage.o +| from arch/arm64/mm/hugetlbpage.c:10: +| arch/arm64/mm/hugetlbpage.c: In function ‘huge_pte_alloc’: +| ./arch/arm64/include/asm/pgtable-types.h:28:24: warning: dereference of NULL ‘pmdp’ [CWE-690] [-Wanalyzer-null-dereference] +| ./arch/arm64/include/asm/pgtable.h:436:26: note: in expansion of macro ‘pmd_val’ +| arch/arm64/mm/hugetlbpage.c:242:10: note: in expansion of macro ‘pte_alloc_map’ +| |arch/arm64/mm/hugetlbpage.c:232:10: +| |./arch/arm64/include/asm/pgtable-types.h:28:24: +| ./arch/arm64/include/asm/pgtable.h:436:26: note: in expansion of macro ‘pmd_val’ +| arch/arm64/mm/hugetlbpage.c:242:10: note: in expansion of macro ‘pte_alloc_map’ + +This can only occur when the kernel cannot allocate a page, and so is +unlikely to happen in practice before other systems start failing. + +We can avoid this by bailing out if pmd_alloc() fails, as we do earlier +in the function if pud_alloc() fails. + +Fixes: 66b3923a1a0f ("arm64: hugetlb: add support for PTE contiguous bit") +Signed-off-by: Mark Rutland +Reported-by: Kyrill Tkachov +Cc: # 4.5.x- +Cc: Will Deacon +Signed-off-by: Catalin Marinas +Acked-by: Ivan T. Ivanov +--- + arch/arm64/mm/hugetlbpage.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm64/mm/hugetlbpage.c ++++ b/arch/arm64/mm/hugetlbpage.c +@@ -103,6 +103,8 @@ pte_t *huge_pte_alloc(struct mm_struct * + pte = (pte_t *)pud; + } else if (sz == (PAGE_SIZE * CONT_PTES)) { + pmd_t *pmd = pmd_alloc(mm, pud, addr); ++ if (!pmd) ++ return NULL; + + WARN_ON(addr & (sz - 1)); + /* diff --git a/patches.suse/arm64-hw_breakpoint-Don-t-invoke-overflow-handler-on-uaccess-watchpoints.patch b/patches.suse/arm64-hw_breakpoint-Don-t-invoke-overflow-handler-on-uaccess-watchpoints.patch new file mode 100644 index 0000000..8753ac3 --- /dev/null +++ b/patches.suse/arm64-hw_breakpoint-Don-t-invoke-overflow-handler-on-uaccess-watchpoints.patch @@ -0,0 +1,102 @@ +From: Will Deacon +Date: Fri, 29 May 2020 14:12:18 +0100 +Subject: arm64: hw_breakpoint: Don't invoke overflow handler on uaccess + watchpoints +Git-commit: 24ebec25fb270100e252b19c288e21bd7d8cc7f7 +Patch-mainline: v5.8-rc2 +References: git-fixes + +Unprivileged memory accesses generated by the so-called "translated" +instructions (e.g. STTR) at EL1 can cause EL0 watchpoints to fire +unexpectedly if kernel debugging is enabled. In such cases, the +hw_breakpoint logic will invoke the user overflow handler which will +typically raise a SIGTRAP back to the current task. This is futile when +returning back to the kernel because (a) the signal won't have been +delivered and (b) userspace can't handle the thing anyway. + +Avoid invoking the user overflow handler for watchpoints triggered by +kernel uaccess routines, and instead single-step over the faulting +instruction as we would if no overflow handler had been installed. + +(Fixes tag identifies the introduction of unprivileged memory accesses, + which exposed this latent bug in the hw_breakpoint code) + +Cc: Catalin Marinas +Cc: James Morse +Fixes: 57f4959bad0a ("arm64: kernel: Add support for User Access Override") +Reported-by: Luis Machado +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/kernel/hw_breakpoint.c | 44 ++++++++++++++++++++++---------------- + 1 file changed, 26 insertions(+), 18 deletions(-) + +--- a/arch/arm64/kernel/hw_breakpoint.c ++++ b/arch/arm64/kernel/hw_breakpoint.c +@@ -741,6 +741,27 @@ static u64 get_distance_from_watchpoint( + return 0; + } + ++static int watchpoint_report(struct perf_event *wp, unsigned long addr, ++ struct pt_regs *regs) ++{ ++ int step = is_default_overflow_handler(wp); ++ struct arch_hw_breakpoint *info = counter_arch_bp(wp); ++ ++ info->trigger = addr; ++ ++ /* ++ * If we triggered a user watchpoint from a uaccess routine, then ++ * handle the stepping ourselves since userspace really can't help ++ * us with this. ++ */ ++ if (!user_mode(regs) && info->ctrl.privilege == AARCH64_BREAKPOINT_EL0) ++ step = 1; ++ else ++ perf_bp_event(wp, regs); ++ ++ return step; ++} ++ + static int watchpoint_handler(unsigned long addr, unsigned int esr, + struct pt_regs *regs) + { +@@ -750,7 +771,6 @@ static int watchpoint_handler(unsigned l + u64 val; + struct perf_event *wp, **slots; + struct debug_info *debug_info; +- struct arch_hw_breakpoint *info; + struct arch_hw_breakpoint_ctrl ctrl; + + slots = this_cpu_ptr(wp_on_reg); +@@ -788,25 +808,13 @@ static int watchpoint_handler(unsigned l + if (dist != 0) + continue; + +- info = counter_arch_bp(wp); +- info->trigger = addr; +- perf_bp_event(wp, regs); +- +- /* Do we need to handle the stepping? */ +- if (is_default_overflow_handler(wp)) +- step = 1; ++ step = watchpoint_report(wp, addr, regs); + } +- if (min_dist > 0 && min_dist != -1) { +- /* No exact match found. */ +- wp = slots[closest_match]; +- info = counter_arch_bp(wp); +- info->trigger = addr; +- perf_bp_event(wp, regs); + +- /* Do we need to handle the stepping? */ +- if (is_default_overflow_handler(wp)) +- step = 1; +- } ++ /* No exact match found? */ ++ if (min_dist > 0 && min_dist != -1) ++ step = watchpoint_report(slots[closest_match], addr, regs); ++ + rcu_read_unlock(); + + if (!step) diff --git a/patches.suse/arm64-iommu-handle-non-remapped-addresses-in-mmap-and-get_sgtable.patch b/patches.suse/arm64-iommu-handle-non-remapped-addresses-in-mmap-and-get_sgtable.patch new file mode 100644 index 0000000..03476c4 --- /dev/null +++ b/patches.suse/arm64-iommu-handle-non-remapped-addresses-in-mmap-and-get_sgtable.patch @@ -0,0 +1,49 @@ +From: Christoph Hellwig +Date: Tue, 30 Apr 2019 06:51:50 -0400 +Subject: arm64/iommu: handle non-remapped addresses in ->mmap and + ->get_sgtable +Git-commit: a98d9ae937d256ed679a935fc82d9deaa710d98e +Patch-mainline: v5.2-rc2 +References: git-fixes + +DMA allocations that can't sleep may return non-remapped addresses, but +we do not properly handle them in the mmap and get_sgtable methods. +Resolve non-vmalloc addresses using virt_to_page to handle this corner +case. + +Cc: +Acked-by: Catalin Marinas +Reviewed-by: Robin Murphy +Signed-off-by: Christoph Hellwig +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/mm/dma-mapping.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/arch/arm64/mm/dma-mapping.c ++++ b/arch/arm64/mm/dma-mapping.c +@@ -720,6 +720,11 @@ static int __iommu_mmap_attrs(struct dev + if (dma_mmap_from_coherent(dev, vma, cpu_addr, size, &ret)) + return ret; + ++ if (!is_vmalloc_addr(cpu_addr)) { ++ unsigned long pfn = page_to_pfn(virt_to_page(cpu_addr)); ++ return __swiotlb_mmap_pfn(vma, pfn, size); ++ } ++ + if (attrs & DMA_ATTR_FORCE_CONTIGUOUS) { + /* + * DMA_ATTR_FORCE_CONTIGUOUS allocations are always remapped, +@@ -743,6 +748,11 @@ static int __iommu_get_sgtable(struct de + unsigned int count = PAGE_ALIGN(size) >> PAGE_SHIFT; + struct vm_struct *area = find_vm_area(cpu_addr); + ++ if (!is_vmalloc_addr(cpu_addr)) { ++ struct page *page = virt_to_page(cpu_addr); ++ return __swiotlb_get_sgtable_page(sgt, page, size); ++ } ++ + if (attrs & DMA_ATTR_FORCE_CONTIGUOUS) { + /* + * DMA_ATTR_FORCE_CONTIGUOUS allocations are always remapped, diff --git a/patches.suse/arm64-kbuild-remove-compressed-images-on-make-ARCH-arm64-dist-clean.patch b/patches.suse/arm64-kbuild-remove-compressed-images-on-make-ARCH-arm64-dist-clean.patch new file mode 100644 index 0000000..6eea113 --- /dev/null +++ b/patches.suse/arm64-kbuild-remove-compressed-images-on-make-ARCH-arm64-dist-clean.patch @@ -0,0 +1,38 @@ +From: Dirk Behme +Date: Tue, 21 Jan 2020 16:54:39 +0100 +Subject: arm64: kbuild: remove compressed images on 'make ARCH=arm64 + (dist)clean' +Git-commit: d7bbd6c1b01cb5dd13c245d4586a83145c1d5f52 +Patch-mainline: v5.6-rc1 +References: git-fixes + +Since v4.3-rc1 commit 0723c05fb75e44 ("arm64: enable more compressed +Image formats"), it is possible to build Image.{bz2,lz4,lzma,lzo} +AArch64 images. However, the commit missed adding support for removing +those images on 'make ARCH=arm64 (dist)clean'. + +Fix this by adding them to the target list. +Make sure to match the order of the recipes in the makefile. + +Cc: stable@vger.kernel.org # v4.3+ +Fixes: 0723c05fb75e44 ("arm64: enable more compressed Image formats") +Signed-off-by: Dirk Behme +Signed-off-by: Eugeniu Rosca +Reviewed-by: Masahiro Yamada +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/boot/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/boot/Makefile ++++ b/arch/arm64/boot/Makefile +@@ -16,7 +16,7 @@ + + OBJCOPYFLAGS_Image :=-O binary -R .note -R .note.gnu.build-id -R .comment -S + +-targets := Image Image.gz ++targets := Image Image.bz2 Image.gz Image.lz4 Image.lzma Image.lzo + + $(obj)/Image: vmlinux FORCE + $(call if_changed,objcopy) diff --git a/patches.suse/arm64-kdump-update-ppos-when-reading-elfcorehdr.patch b/patches.suse/arm64-kdump-update-ppos-when-reading-elfcorehdr.patch new file mode 100644 index 0000000..b658ec8 --- /dev/null +++ b/patches.suse/arm64-kdump-update-ppos-when-reading-elfcorehdr.patch @@ -0,0 +1,33 @@ +From: Pavel Tatashin +Date: Fri, 19 Mar 2021 16:50:54 -0400 +Subject: arm64: kdump: update ppos when reading elfcorehdr +Git-commit: 141f8202cfa4192c3af79b6cbd68e7760bb01b5a +Patch-mainline: v5.12-rc5 +References: git-fixes + +The ppos points to a position in the old kernel memory (and in case of +arm64 in the crash kernel since elfcorehdr is passed as a segment). The +function should update the ppos by the amount that was read. This bug is +not exposed by accident, but other platforms update this value properly. +So, fix it in ARM64 version of elfcorehdr_read() as well. + +Signed-off-by: Pavel Tatashin +Fixes: e62aaeac426a ("arm64: kdump: provide /proc/vmcore file") +Reviewed-by: Tyler Hicks +Link: https://lore.kernel.org/r/20210319205054.743368-1-pasha.tatashin@soleen.com +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/kernel/crash_dump.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm64/kernel/crash_dump.c ++++ b/arch/arm64/kernel/crash_dump.c +@@ -67,5 +67,7 @@ ssize_t copy_oldmem_page(unsigned long p + ssize_t elfcorehdr_read(char *buf, size_t count, u64 *ppos) + { + memcpy(buf, phys_to_virt((phys_addr_t)*ppos), count); ++ *ppos += count; ++ + return count; + } diff --git a/patches.suse/arm64-kgdb-Fix-single-step-exception-handling-oops.patch b/patches.suse/arm64-kgdb-Fix-single-step-exception-handling-oops.patch new file mode 100644 index 0000000..9e7e73e --- /dev/null +++ b/patches.suse/arm64-kgdb-Fix-single-step-exception-handling-oops.patch @@ -0,0 +1,108 @@ +From: Wei Li +Date: Sun, 10 May 2020 05:41:56 +0800 +Subject: arm64: kgdb: Fix single-step exception handling oops +Git-commit: 8523c006264df65aac7d77284cc69aac46a6f842 +Patch-mainline: v5.8-rc5 +References: git-fixes + +After entering kdb due to breakpoint, when we execute 'ss' or 'go' (will +delay installing breakpoints, do single-step first), it won't work +correctly, and it will enter kdb due to oops. + +It's because the reason gotten in kdb_stub() is not as expected, and it +seems that the ex_vector for single-step should be 0, like what arch +powerpc/sh/parisc has implemented. + +Before the patch: +Entering kdb (current=0xffff8000119e2dc0, pid 0) on processor 0 due to Keyboard Entry +[0]kdb> bp printk +Instruction(i) BP #0 at 0xffff8000101486cc (printk) + is enabled addr at ffff8000101486cc, hardtype=0 installed=0 + +[0]kdb> g + +/ # echo h > /proc/sysrq-trigger + +Entering kdb (current=0xffff0000fa878040, pid 266) on processor 3 due to Breakpoint @ 0xffff8000101486cc +[3]kdb> ss + +Entering kdb (current=0xffff0000fa878040, pid 266) on processor 3 Oops: (null) +due to oops @ 0xffff800010082ab8 +CPU: 3 PID: 266 Comm: sh Not tainted 5.7.0-rc4-13839-gf0e5ad491718 #6 +Hardware name: linux,dummy-virt (DT) +pstate: 00000085 (nzcv daIf -PAN -UAO) +pc : el1_irq+0x78/0x180 +lr : __handle_sysrq+0x80/0x190 +sp : ffff800015003bf0 +x29: ffff800015003d20 x28: ffff0000fa878040 +x27: 0000000000000000 x26: ffff80001126b1f0 +x25: ffff800011b6a0d8 x24: 0000000000000000 +x23: 0000000080200005 x22: ffff8000101486cc +x21: ffff800015003d30 x20: 0000ffffffffffff +x19: ffff8000119f2000 x18: 0000000000000000 +x17: 0000000000000000 x16: 0000000000000000 +x15: 0000000000000000 x14: 0000000000000000 +x13: 0000000000000000 x12: 0000000000000000 +x11: 0000000000000000 x10: 0000000000000000 +x9 : 0000000000000000 x8 : ffff800015003e50 +x7 : 0000000000000002 x6 : 00000000380b9990 +x5 : ffff8000106e99e8 x4 : ffff0000fadd83c0 +x3 : 0000ffffffffffff x2 : ffff800011b6a0d8 +x1 : ffff800011b6a000 x0 : ffff80001130c9d8 +Call trace: + el1_irq+0x78/0x180 + printk+0x0/0x84 + write_sysrq_trigger+0xb0/0x118 + proc_reg_write+0xb4/0xe0 + __vfs_write+0x18/0x40 + vfs_write+0xb0/0x1b8 + ksys_write+0x64/0xf0 + __arm64_sys_write+0x14/0x20 + el0_svc_common.constprop.2+0xb0/0x168 + do_el0_svc+0x20/0x98 + el0_sync_handler+0xec/0x1a8 + el0_sync+0x140/0x180 + +[3]kdb> + +After the patch: +Entering kdb (current=0xffff8000119e2dc0, pid 0) on processor 0 due to Keyboard Entry +[0]kdb> bp printk +Instruction(i) BP #0 at 0xffff8000101486cc (printk) + is enabled addr at ffff8000101486cc, hardtype=0 installed=0 + +[0]kdb> g + +/ # echo h > /proc/sysrq-trigger + +Entering kdb (current=0xffff0000fa852bc0, pid 268) on processor 0 due to Breakpoint @ 0xffff8000101486cc +[0]kdb> g + +Entering kdb (current=0xffff0000fa852bc0, pid 268) on processor 0 due to Breakpoint @ 0xffff8000101486cc +[0]kdb> ss + +Entering kdb (current=0xffff0000fa852bc0, pid 268) on processor 0 due to SS trap @ 0xffff800010082ab8 +[0]kdb> + +Fixes: 44679a4f142b ("arm64: KGDB: Add step debugging support") +Signed-off-by: Wei Li +Tested-by: Douglas Anderson +Reviewed-by: Douglas Anderson +Link: https://lore.kernel.org/r/20200509214159.19680-2-liwei391@huawei.com +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/kernel/kgdb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/kernel/kgdb.c ++++ b/arch/arm64/kernel/kgdb.c +@@ -258,7 +258,7 @@ static int kgdb_step_brk_fn(struct pt_re + if (user_mode(regs) || !kgdb_single_step) + return DBG_HOOK_ERROR; + +- kgdb_handle_exception(1, SIGTRAP, 0, regs); ++ kgdb_handle_exception(0, SIGTRAP, 0, regs); + return DBG_HOOK_HANDLED; + } + NOKPROBE_SYMBOL(kgdb_step_brk_fn); diff --git a/patches.suse/arm64-kprobes-Recover-pstate.D-in-single-step-exception-handler.patch b/patches.suse/arm64-kprobes-Recover-pstate.D-in-single-step-exception-handler.patch new file mode 100644 index 0000000..20d84f4 --- /dev/null +++ b/patches.suse/arm64-kprobes-Recover-pstate.D-in-single-step-exception-handler.patch @@ -0,0 +1,130 @@ +From: Masami Hiramatsu +Date: Thu, 1 Aug 2019 23:25:49 +0900 +Subject: arm64: kprobes: Recover pstate.D in single-step exception handler +Git-commit: b3980e48528c4d2a9e70b145a5bba328b73a0f93 +Patch-mainline: v5.3-rc3 +References: git-fixes + +kprobes manipulates the interrupted PSTATE for single step, and +doesn't restore it. Thus, if we put a kprobe where the pstate.D +(debug) masked, the mask will be cleared after the kprobe hits. + +Moreover, in the most complicated case, this can lead a kernel +crash with below message when a nested kprobe hits. + +[ 152.118921] Unexpected kernel single-step exception at EL1 + +When the 1st kprobe hits, do_debug_exception() will be called. +At this point, debug exception (= pstate.D) must be masked (=1). +But if another kprobes hits before single-step of the first kprobe +(e.g. inside user pre_handler), it unmask the debug exception +(pstate.D = 0) and return. +Then, when the 1st kprobe setting up single-step, it saves current +DAIF, mask DAIF, enable single-step, and restore DAIF. +However, since "D" flag in DAIF is cleared by the 2nd kprobe, the +single-step exception happens soon after restoring DAIF. + +This has been introduced by commit 7419333fa15e ("arm64: kprobe: +Always clear pstate.D in breakpoint exception handler") + +To solve this issue, this stores all DAIF bits and restore it +after single stepping. + +Reported-by: Naresh Kamboju +Fixes: 7419333fa15e ("arm64: kprobe: Always clear pstate.D in breakpoint exception handler") +Reviewed-by: James Morse +Tested-by: James Morse +Signed-off-by: Masami Hiramatsu +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/include/asm/daifflags.h | 1 + arch/arm64/kernel/probes/kprobes.c | 40 +++++-------------------------------- + 2 files changed, 7 insertions(+), 34 deletions(-) + +--- a/arch/arm64/include/asm/daifflags.h ++++ b/arch/arm64/include/asm/daifflags.h +@@ -20,6 +20,7 @@ + + #define DAIF_PROCCTX 0 + #define DAIF_PROCCTX_NOIRQ PSR_I_BIT ++#define DAIF_MASK (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT) + + /* mask/save/unmask/restore all exceptions, including interrupts. */ + static inline void local_daif_mask(void) +--- a/arch/arm64/kernel/probes/kprobes.c ++++ b/arch/arm64/kernel/probes/kprobes.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -167,33 +168,6 @@ static void __kprobes set_current_kprobe + } + + /* +- * When PSTATE.D is set (masked), then software step exceptions can not be +- * generated. +- * SPSR's D bit shows the value of PSTATE.D immediately before the +- * exception was taken. PSTATE.D is set while entering into any exception +- * mode, however software clears it for any normal (none-debug-exception) +- * mode in the exception entry. Therefore, when we are entering into kprobe +- * breakpoint handler from any normal mode then SPSR.D bit is already +- * cleared, however it is set when we are entering from any debug exception +- * mode. +- * Since we always need to generate single step exception after a kprobe +- * breakpoint exception therefore we need to clear it unconditionally, when +- * we become sure that the current breakpoint exception is for kprobe. +- */ +-static void __kprobes +-spsr_set_debug_flag(struct pt_regs *regs, int mask) +-{ +- unsigned long spsr = regs->pstate; +- +- if (mask) +- spsr |= PSR_D_BIT; +- else +- spsr &= ~PSR_D_BIT; +- +- regs->pstate = spsr; +-} +- +-/* + * Interrupts need to be disabled before single-step mode is set, and not + * reenabled until after single-step mode ends. + * Without disabling interrupt on local CPU, there is a chance of +@@ -204,17 +178,17 @@ spsr_set_debug_flag(struct pt_regs *regs + static void __kprobes kprobes_save_local_irqflag(struct kprobe_ctlblk *kcb, + struct pt_regs *regs) + { +- kcb->saved_irqflag = regs->pstate; ++ kcb->saved_irqflag = regs->pstate & DAIF_MASK; + regs->pstate |= PSR_I_BIT; ++ /* Unmask PSTATE.D for enabling software step exceptions. */ ++ regs->pstate &= ~PSR_D_BIT; + } + + static void __kprobes kprobes_restore_local_irqflag(struct kprobe_ctlblk *kcb, + struct pt_regs *regs) + { +- if (kcb->saved_irqflag & PSR_I_BIT) +- regs->pstate |= PSR_I_BIT; +- else +- regs->pstate &= ~PSR_I_BIT; ++ regs->pstate &= ~DAIF_MASK; ++ regs->pstate |= kcb->saved_irqflag; + } + + static void __kprobes +@@ -251,8 +225,6 @@ static void __kprobes setup_singlestep(s + + set_ss_context(kcb, slot); /* mark pending ss */ + +- spsr_set_debug_flag(regs, 0); +- + /* IRQs and single stepping do not mix well. */ + kprobes_save_local_irqflag(kcb, regs); + kernel_enable_single_step(regs); diff --git a/patches.suse/arm64-map-FDT-as-RW-for-early_init_dt_scan.patch b/patches.suse/arm64-map-FDT-as-RW-for-early_init_dt_scan.patch index 0a1ad5d..62ea844 100644 --- a/patches.suse/arm64-map-FDT-as-RW-for-early_init_dt_scan.patch +++ b/patches.suse/arm64-map-FDT-as-RW-for-early_init_dt_scan.patch @@ -25,7 +25,7 @@ Signed-off-by: Mian Yousaf Kaukab --- a/arch/arm64/include/asm/mmu.h +++ b/arch/arm64/include/asm/mmu.h -@@ -85,7 +85,7 @@ extern void init_mem_pgprot(void); +@@ -129,7 +129,7 @@ extern void init_mem_pgprot(void); extern void create_pgd_mapping(struct mm_struct *mm, phys_addr_t phys, unsigned long virt, phys_addr_t size, pgprot_t prot, bool page_mappings_only); @@ -36,7 +36,7 @@ Signed-off-by: Mian Yousaf Kaukab #endif /* !__ASSEMBLY__ */ --- a/arch/arm64/kernel/kaslr.c +++ b/arch/arm64/kernel/kaslr.c -@@ -64,9 +64,6 @@ out: +@@ -65,9 +65,6 @@ out: return default_cmdline; } @@ -46,7 +46,7 @@ Signed-off-by: Mian Yousaf Kaukab /* * This routine will be executed with the kernel mapped at its default virtual * address, and if it returns successfully, the kernel will be remapped, and -@@ -94,7 +91,7 @@ u64 __init kaslr_early_init(u64 dt_phys) +@@ -96,7 +93,7 @@ u64 __init kaslr_early_init(u64 dt_phys) * attempt at mapping the FDT in setup_machine() */ early_fixmap_init(); @@ -112,4 +112,4 @@ Signed-off-by: Mian Yousaf Kaukab - int __init arch_ioremap_pud_supported(void) { - /* only 4k granule supports level 1 block mappings */ + /* diff --git a/patches.suse/arm64-mm-Inhibit-huge-vmap-with-ptdump.patch b/patches.suse/arm64-mm-Inhibit-huge-vmap-with-ptdump.patch new file mode 100644 index 0000000..f31df5b --- /dev/null +++ b/patches.suse/arm64-mm-Inhibit-huge-vmap-with-ptdump.patch @@ -0,0 +1,71 @@ +From: Mark Rutland +Date: Tue, 14 May 2019 14:30:06 +0530 +Subject: arm64/mm: Inhibit huge-vmap with ptdump +Git-commit: 7ba36eccb3f83983a651efd570b4f933ecad1b5c +Patch-mainline: v5.2-rc2 +References: git-fixes + +The arm64 ptdump code can race with concurrent modification of the +kernel page tables. At the time this was added, this was sound as: + +* Modifications to leaf entries could result in stale information being + logged, but would not result in a functional problem. + +* Boot time modifications to non-leaf entries (e.g. freeing of initmem) + were performed when the ptdump code cannot be invoked. + +* At runtime, modifications to non-leaf entries only occurred in the + vmalloc region, and these were strictly additive, as intermediate + entries were never freed. + +However, since commit: + + commit 324420bf91f6 ("arm64: add support for ioremap() block mappings") + +... it has been possible to create huge mappings in the vmalloc area at +runtime, and as part of this existing intermediate levels of table my be +removed and freed. + +It's possible for the ptdump code to race with this, and continue to +walk tables which have been freed (and potentially poisoned or +reallocated). As a result of this, the ptdump code may dereference bogus +addresses, which could be fatal. + +Since huge-vmap is a TLB and memory optimization, we can disable it when +the runtime ptdump code is in use to avoid this problem. + +Cc: Catalin Marinas +Fixes: 324420bf91f60582 ("arm64: add support for ioremap() block mappings") +Acked-by: Ard Biesheuvel +Signed-off-by: Mark Rutland +Signed-off-by: Anshuman Khandual +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/mm/mmu.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/arch/arm64/mm/mmu.c ++++ b/arch/arm64/mm/mmu.c +@@ -900,13 +900,18 @@ void *__init fixmap_remap_fdt(phys_addr_ + + int __init arch_ioremap_pud_supported(void) + { +- /* only 4k granule supports level 1 block mappings */ +- return IS_ENABLED(CONFIG_ARM64_4K_PAGES); ++ /* ++ * Only 4k granule supports level 1 block mappings. ++ * SW table walks can't handle removal of intermediate entries. ++ */ ++ return IS_ENABLED(CONFIG_ARM64_4K_PAGES) && ++ !IS_ENABLED(CONFIG_ARM64_PTDUMP_DEBUGFS); + } + + int __init arch_ioremap_pmd_supported(void) + { +- return 1; ++ /* See arch_ioremap_pud_supported() */ ++ return !IS_ENABLED(CONFIG_ARM64_PTDUMP_DEBUGFS); + } + + int pud_set_huge(pud_t *pud, phys_addr_t phys, pgprot_t prot) diff --git a/patches.suse/arm64-mm-avoid-fixmap-race-condition-when-create-pud-mapping.patch b/patches.suse/arm64-mm-avoid-fixmap-race-condition-when-create-pud-mapping.patch new file mode 100644 index 0000000..9a4dd4b --- /dev/null +++ b/patches.suse/arm64-mm-avoid-fixmap-race-condition-when-create-pud-mapping.patch @@ -0,0 +1,69 @@ +From: Jianyong Wu +Date: Tue, 1 Feb 2022 19:44:00 +0800 +Subject: arm64/mm: avoid fixmap race condition when create pud mapping +Git-commit: ee017ee353506fcec58e481673e4331ff198a80e +Patch-mainline: v5.18-rc1 +References: git-fixes + +The 'fixmap' is a global resource and is used recursively by +create pud mapping(), leading to a potential race condition in the +presence of a concurrent call to alloc_init_pud(): + +kernel_init thread virtio-mem workqueue thread +================== =========================== + + alloc_init_pud(...) alloc_init_pud(...) + pudp = pud_set_fixmap_offset(...) pudp = pud_set_fixmap_offset(...) + READ_ONCE(*pudp) + pud_clear_fixmap(...) + READ_ONCE(*pudp) // CRASH! + +As kernel may sleep during creating pud mapping, introduce a mutex lock to +serialise use of the fixmap entries by alloc_init_pud(). However, there is +no need for locking in early boot stage and it doesn't work well with +KASLR enabled when early boot. So, enable lock when system_state doesn't +equal to "SYSTEM_BOOTING". + +Signed-off-by: Jianyong Wu +Reviewed-by: Catalin Marinas +Fixes: f4710445458c ("arm64: mm: use fixmap when creating page tables") +Link: https://lore.kernel.org/r/20220201114400.56885-1-jianyong.wu@arm.com +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/mm/mmu.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/arch/arm64/mm/mmu.c ++++ b/arch/arm64/mm/mmu.c +@@ -65,6 +65,8 @@ static pte_t bm_pte[PTRS_PER_PTE] __page + static pmd_t bm_pmd[PTRS_PER_PMD] __page_aligned_bss __maybe_unused; + static pud_t bm_pud[PTRS_PER_PUD] __page_aligned_bss __maybe_unused; + ++static DEFINE_MUTEX(fixmap_lock); ++ + pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn, + unsigned long size, pgprot_t vma_prot) + { +@@ -280,6 +282,12 @@ static void alloc_init_pud(pgd_t *pgd, u + } + BUG_ON(pgd_bad(*pgd)); + ++ /* ++ * No need for locking during early boot. And it doesn't work as ++ * expected with KASLR enabled. ++ */ ++ if (system_state != SYSTEM_BOOTING) ++ mutex_lock(&fixmap_lock); + pud = pud_set_fixmap_offset(pgd, addr); + do { + pud_t old_pud = *pud; +@@ -310,6 +318,8 @@ static void alloc_init_pud(pgd_t *pgd, u + } while (pud++, addr = next, addr != end); + + pud_clear_fixmap(); ++ if (system_state != SYSTEM_BOOTING) ++ mutex_unlock(&fixmap_lock); + } + + static void __create_pgd_mapping(pgd_t *pgdir, phys_addr_t phys, diff --git a/patches.suse/arm64-module-remove-NOLOAD-from-linker-script.patch b/patches.suse/arm64-module-remove-NOLOAD-from-linker-script.patch new file mode 100644 index 0000000..cb0b776 --- /dev/null +++ b/patches.suse/arm64-module-remove-NOLOAD-from-linker-script.patch @@ -0,0 +1,43 @@ +From: Fangrui Song +Date: Fri, 18 Feb 2022 00:12:09 -0800 +Subject: arm64: module: remove (NOLOAD) from linker script +Git-commit: 4013e26670c590944abdab56c4fa797527b74325 +Patch-mainline: v5.18-rc1 +References: git-fixes + +On ELF, (NOLOAD) sets the section type to SHT_NOBITS[1]. It is conceptually +inappropriate for .plt and .text.* sections which are always +SHT_PROGBITS. + +In GNU ld, if PLT entries are needed, .plt will be SHT_PROGBITS anyway +and (NOLOAD) will be essentially ignored. In ld.lld, since +https://reviews.llvm.org/D118840 ("[ELF] Support (TYPE=) to +customize the output section type"), ld.lld will report a `section type +mismatch` error. Just remove (NOLOAD) to fix the error. + +[1] https://lld.llvm.org/ELF/linker_script.html As of today, "The +section should be marked as not loadable" on +https://sourceware.org/binutils/docs/ld/Output-Section-Type.html is +outdated for ELF. + +Tested-by: Nathan Chancellor +Reported-by: Nathan Chancellor +Signed-off-by: Fangrui Song +Acked-by: Ard Biesheuvel +Link: https://lore.kernel.org/r/20220218081209.354383-1-maskray@google.com +Signed-off-by: Will Deacon +[iivanov: moved changes from module.lds.h to module.lds] +Acked-by: Ivan T. Ivanov +--- + arch/arm64/kernel/module.lds | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm64/kernel/module.lds ++++ b/arch/arm64/kernel/module.lds +@@ -1,4 +1,4 @@ + SECTIONS { +- .plt 0 (NOLOAD) : { BYTE(0) } +- .init.plt 0 (NOLOAD) : { BYTE(0) } ++ .plt 0 : { BYTE(0) } ++ .init.plt 0 : { BYTE(0) } + } diff --git a/patches.suse/arm64-module-set-plt-section-addresses-to-0x0.patch b/patches.suse/arm64-module-set-plt-section-addresses-to-0x0.patch new file mode 100644 index 0000000..00d3d2f --- /dev/null +++ b/patches.suse/arm64-module-set-plt-section-addresses-to-0x0.patch @@ -0,0 +1,34 @@ +From: Shaoying Xu +Date: Tue, 16 Feb 2021 18:32:34 +0000 +Subject: arm64 module: set plt* section addresses to 0x0 +Git-commit: f5c6d0fcf90ce07ee0d686d465b19b247ebd5ed7 +Patch-mainline: v5.12-rc1 +References: git-fixes + +These plt* and .text.ftrace_trampoline sections specified for arm64 have +non-zero addressses. Non-zero section addresses in a relocatable ELF would +confuse GDB when it tries to compute the section offsets and it ends up +printing wrong symbol addresses. Therefore, set them to zero, which mirrors +the change in commit 5d8591bc0fba ("module: set ksymtab/kcrctab* section +addresses to 0x0"). + +Reported-by: Frank van der Linden +Signed-off-by: Shaoying Xu +Cc: +Link: https://lore.kernel.org/r/20210216183234.GA23876@amazon.com +Signed-off-by: Will Deacon +[iivanov: moved changes from modules.lds.h to modules.lds] +Acked-by: Ivan T. Ivanov +--- + arch/arm64/kernel/module.lds | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm64/kernel/module.lds ++++ b/arch/arm64/kernel/module.lds +@@ -1,4 +1,4 @@ + SECTIONS { +- .plt (NOLOAD) : { BYTE(0) } +- .init.plt (NOLOAD) : { BYTE(0) } ++ .plt 0 (NOLOAD) : { BYTE(0) } ++ .init.plt 0 (NOLOAD) : { BYTE(0) } + } diff --git a/patches.suse/arm64-perf-Report-the-PC-value-in-REGS_ABI_32-mode.patch b/patches.suse/arm64-perf-Report-the-PC-value-in-REGS_ABI_32-mode.patch new file mode 100644 index 0000000..b3608ab --- /dev/null +++ b/patches.suse/arm64-perf-Report-the-PC-value-in-REGS_ABI_32-mode.patch @@ -0,0 +1,64 @@ +From: Jiping Ma +Date: Mon, 11 May 2020 10:52:07 +0800 +Subject: arm64: perf: Report the PC value in REGS_ABI_32 mode +Git-commit: 8dfe804a4031ca6ba3a3efb2048534249b64f3a5 +Patch-mainline: v5.8-rc3 +References: git-fixes + +A 32-bit perf querying the registers of a compat task using REGS_ABI_32 +will receive zeroes from w15, when it expects to find the PC. + +Return the PC value for register dwarf register 15 when returning register +values for a compat task to perf. + +Cc: +Acked-by: Mark Rutland +Signed-off-by: Jiping Ma +Link: https://lore.kernel.org/r/1589165527-188401-1-git-send-email-jiping.ma2@windriver.com +[will: Shuffled code and added a comment] +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/kernel/perf_regs.c | 25 ++++++++++++++++++++++--- + 1 file changed, 22 insertions(+), 3 deletions(-) + +--- a/arch/arm64/kernel/perf_regs.c ++++ b/arch/arm64/kernel/perf_regs.c +@@ -14,15 +14,34 @@ u64 perf_reg_value(struct pt_regs *regs, + return 0; + + /* +- * Compat (i.e. 32 bit) mode: +- * - PC has been set in the pt_regs struct in kernel_entry, +- * - Handle SP and LR here. ++ * Our handling of compat tasks (PERF_SAMPLE_REGS_ABI_32) is weird, but ++ * we're stuck with it for ABI compatability reasons. ++ * ++ * For a 32-bit consumer inspecting a 32-bit task, then it will look at ++ * the first 16 registers (see arch/arm/include/uapi/asm/perf_regs.h). ++ * These correspond directly to a prefix of the registers saved in our ++ * 'struct pt_regs', with the exception of the PC, so we copy that down ++ * (x15 corresponds to SP_hyp in the architecture). ++ * ++ * So far, so good. ++ * ++ * The oddity arises when a 64-bit consumer looks at a 32-bit task and ++ * asks for registers beyond PERF_REG_ARM_MAX. In this case, we return ++ * SP_usr, LR_usr and PC in the positions where the AArch64 SP, LR and ++ * PC registers would normally live. The initial idea was to allow a ++ * 64-bit unwinder to unwind a 32-bit task and, although it's not clear ++ * how well that works in practice, somebody might be relying on it. ++ * ++ * At the time we make a sample, we don't know whether the consumer is ++ * 32-bit or 64-bit, so we have to cater for both possibilities. + */ + if (compat_user_mode(regs)) { + if ((u32)idx == PERF_REG_ARM64_SP) + return regs->compat_sp; + if ((u32)idx == PERF_REG_ARM64_LR) + return regs->compat_lr; ++ if (idx == 15) ++ return regs->pc; + } + + if ((u32)idx == PERF_REG_ARM64_SP) diff --git a/patches.suse/arm64-ptrace-Override-SPSR.SS-when-single-stepping-is-enabled.patch b/patches.suse/arm64-ptrace-Override-SPSR.SS-when-single-stepping-is-enabled.patch new file mode 100644 index 0000000..97a7725 --- /dev/null +++ b/patches.suse/arm64-ptrace-Override-SPSR.SS-when-single-stepping-is-enabled.patch @@ -0,0 +1,107 @@ +From: Will Deacon +Date: Thu, 13 Feb 2020 12:06:26 +0000 +Subject: arm64: ptrace: Override SPSR.SS when single-stepping is enabled +Git-commit: 3a5a4366cecc25daa300b9a9174f7fdd352b9068 +Patch-mainline: v5.8-rc6 +References: git-fixes + +Luis reports that, when reverse debugging with GDB, single-step does not +function as expected on arm64: + + | I've noticed, under very specific conditions, that a PTRACE_SINGLESTEP + | request by GDB won't execute the underlying instruction. As a consequence, + | the PC doesn't move, but we return a SIGTRAP just like we would for a + | regular successful PTRACE_SINGLESTEP request. + +The underlying problem is that when the CPU register state is restored +as part of a reverse step, the SPSR.SS bit is cleared and so the hardware +single-step state can transition to the "active-pending" state, causing +an unexpected step exception to be taken immediately if a step operation +is attempted. + +In hindsight, we probably shouldn't have exposed SPSR.SS in the pstate +accessible by the GPR regset, but it's a bit late for that now. Instead, +simply prevent userspace from configuring the bit to a value which is +inconsistent with the TIF_SINGLESTEP state for the task being traced. + +Cc: +Cc: Mark Rutland +Cc: Keno Fischer +Link: https://lore.kernel.org/r/1eed6d69-d53d-9657-1fc9-c089be07f98c@linaro.org +Reported-by: Luis Machado +Tested-by: Luis Machado +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/include/asm/debug-monitors.h | 2 ++ + arch/arm64/kernel/debug-monitors.c | 20 ++++++++++++++++---- + arch/arm64/kernel/ptrace.c | 4 ++-- + 3 files changed, 20 insertions(+), 6 deletions(-) + +--- a/arch/arm64/include/asm/debug-monitors.h ++++ b/arch/arm64/include/asm/debug-monitors.h +@@ -119,6 +119,8 @@ void disable_debug_monitors(enum dbg_act + + void user_rewind_single_step(struct task_struct *task); + void user_fastforward_single_step(struct task_struct *task); ++void user_regs_reset_single_step(struct user_pt_regs *regs, ++ struct task_struct *task); + + void kernel_enable_single_step(struct pt_regs *regs); + void kernel_disable_single_step(void); +--- a/arch/arm64/kernel/debug-monitors.c ++++ b/arch/arm64/kernel/debug-monitors.c +@@ -151,17 +151,20 @@ postcore_initcall(debug_monitors_init); + /* + * Single step API and exception handling. + */ +-static void set_regs_spsr_ss(struct pt_regs *regs) ++static void set_user_regs_spsr_ss(struct user_pt_regs *regs) + { + regs->pstate |= DBG_SPSR_SS; + } +-NOKPROBE_SYMBOL(set_regs_spsr_ss); ++NOKPROBE_SYMBOL(set_user_regs_spsr_ss); + +-static void clear_regs_spsr_ss(struct pt_regs *regs) ++static void clear_user_regs_spsr_ss(struct user_pt_regs *regs) + { + regs->pstate &= ~DBG_SPSR_SS; + } +-NOKPROBE_SYMBOL(clear_regs_spsr_ss); ++NOKPROBE_SYMBOL(clear_user_regs_spsr_ss); ++ ++#define set_regs_spsr_ss(r) set_user_regs_spsr_ss(&(r)->user_regs) ++#define clear_regs_spsr_ss(r) clear_user_regs_spsr_ss(&(r)->user_regs) + + /* EL1 Single Step Handler hooks */ + static LIST_HEAD(step_hook); +@@ -396,6 +399,15 @@ void user_fastforward_single_step(struct + clear_regs_spsr_ss(task_pt_regs(task)); + } + ++void user_regs_reset_single_step(struct user_pt_regs *regs, ++ struct task_struct *task) ++{ ++ if (test_tsk_thread_flag(task, TIF_SINGLESTEP)) ++ set_user_regs_spsr_ss(regs); ++ else ++ clear_user_regs_spsr_ss(regs); ++} ++ + /* Kernel API */ + void kernel_enable_single_step(struct pt_regs *regs) + { +--- a/arch/arm64/kernel/ptrace.c ++++ b/arch/arm64/kernel/ptrace.c +@@ -1751,8 +1751,8 @@ static int valid_native_regs(struct user + */ + int valid_user_regs(struct user_pt_regs *regs, struct task_struct *task) + { +- if (!test_tsk_thread_flag(task, TIF_SINGLESTEP)) +- regs->pstate &= ~DBG_SPSR_SS; ++ /* https://lore.kernel.org/lkml/20191118131525.GA4180@willie-the-truck */ ++ user_regs_reset_single_step(regs, task); + + if (is_compat_thread(task_thread_info(task))) + return valid_compat_regs(regs); diff --git a/patches.suse/arm64-ptrace-nofpsimd-Fail-FP-SIMD-regset-operations.patch b/patches.suse/arm64-ptrace-nofpsimd-Fail-FP-SIMD-regset-operations.patch new file mode 100644 index 0000000..233e9b0 --- /dev/null +++ b/patches.suse/arm64-ptrace-nofpsimd-Fail-FP-SIMD-regset-operations.patch @@ -0,0 +1,94 @@ +From: Suzuki K Poulose +Date: Mon, 13 Jan 2020 23:30:21 +0000 +Subject: arm64: ptrace: nofpsimd: Fail FP/SIMD regset operations +Git-commit: c9d66999f064947e6b577ceacc1eb2fbca6a8d3c +Patch-mainline: v5.6-rc1 +References: git-fixes + +When fp/simd is not supported on the system, fail the operations +of FP/SIMD regsets. + +Fixes: 82e0191a1aa11abf ("arm64: Support systems without FP/ASIMD") +Cc: Will Deacon +Cc: Mark Rutland +Reviewed-by: Ard Biesheuvel +Reviewed-by: Catalin Marinas +Signed-off-by: Suzuki K Poulose +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/kernel/ptrace.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +--- a/arch/arm64/kernel/ptrace.c ++++ b/arch/arm64/kernel/ptrace.c +@@ -617,6 +617,13 @@ static int gpr_set(struct task_struct *t + return 0; + } + ++static int fpr_active(struct task_struct *target, const struct user_regset *regset) ++{ ++ if (!system_supports_fpsimd()) ++ return -ENODEV; ++ return regset->n; ++} ++ + /* + * TODO: update fp accessors for lazy context switching (sync/flush hwstate) + */ +@@ -639,6 +646,9 @@ static int fpr_get(struct task_struct *t + unsigned int pos, unsigned int count, + void *kbuf, void __user *ubuf) + { ++ if (!system_supports_fpsimd()) ++ return -EINVAL; ++ + if (target == current) + fpsimd_preserve_current_state(); + +@@ -678,6 +688,9 @@ static int fpr_set(struct task_struct *t + { + int ret; + ++ if (!system_supports_fpsimd()) ++ return -EINVAL; ++ + ret = __fpr_set(target, regset, pos, count, kbuf, ubuf, 0); + if (ret) + return ret; +@@ -979,6 +992,7 @@ static const struct user_regset aarch64_ + */ + .size = sizeof(u32), + .align = sizeof(u32), ++ .active = fpr_active, + .get = fpr_get, + .set = fpr_set + }, +@@ -1167,6 +1181,9 @@ static int compat_vfp_get(struct task_st + compat_ulong_t fpscr; + int ret; + ++ if (!system_supports_fpsimd()) ++ return -EINVAL; ++ + uregs = &target->thread.fpsimd_state; + + if (target == current) +@@ -1197,6 +1214,9 @@ static int compat_vfp_set(struct task_st + compat_ulong_t fpscr; + int ret; + ++ if (!system_supports_fpsimd()) ++ return -EINVAL; ++ + if (pos + count > VFP_STATE_SIZE) + return -EIO; + +@@ -1279,6 +1299,7 @@ static const struct user_regset aarch32_ + .n = VFP_STATE_SIZE / sizeof(compat_ulong_t), + .size = sizeof(compat_ulong_t), + .align = sizeof(compat_ulong_t), ++ .active = fpr_active, + .get = compat_vfp_get, + .set = compat_vfp_set + }, diff --git a/patches.suse/arm64-smp-fix-crash_smp_send_stop-behaviour.patch b/patches.suse/arm64-smp-fix-crash_smp_send_stop-behaviour.patch new file mode 100644 index 0000000..1ed3e2c --- /dev/null +++ b/patches.suse/arm64-smp-fix-crash_smp_send_stop-behaviour.patch @@ -0,0 +1,115 @@ +From: Cristian Marussi +Date: Wed, 11 Mar 2020 17:12:45 +0000 +Subject: arm64: smp: fix crash_smp_send_stop() behaviour +Git-commit: f50b7dacccbab2b9e3ef18f52a6dcc18ed2050b9 +Patch-mainline: v5.6-rc7 +References: git-fixes + +On a system configured to trigger a crash_kexec() reboot, when only one CPU +is online and another CPU panics while starting-up, crash_smp_send_stop() +will fail to send any STOP message to the other already online core, +resulting in fail to freeze and registers not properly saved. + +Moreover even if the proper messages are sent (case CPUs > 2) +it will similarly fail to account for the booting CPU when executing +the final stop wait-loop, so potentially resulting in some CPU not +been waited for shutdown before rebooting. + +A tangible effect of this behaviour can be observed when, after a panic +with kexec enabled and loaded, on the following reboot triggered by kexec, +the cpu that could not be successfully stopped fails to come back online: + +[ 362.291022] ------------[ cut here ]------------ +[ 362.291525] kernel BUG at arch/arm64/kernel/cpufeature.c:886! +[ 362.292023] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP +[ 362.292400] Modules linked in: +[ 362.292970] CPU: 3 PID: 0 Comm: swapper/3 Kdump: loaded Not tainted 5.6.0-rc4-00003-gc780b890948a #105 +[ 362.293136] Hardware name: Foundation-v8A (DT) +[ 362.293382] pstate: 200001c5 (nzCv dAIF -PAN -UAO) +[ 362.294063] pc : has_cpuid_feature+0xf0/0x348 +[ 362.294177] lr : verify_local_elf_hwcaps+0x84/0xe8 +[ 362.294280] sp : ffff800011b1bf60 +[ 362.294362] x29: ffff800011b1bf60 x28: 0000000000000000 +[ 362.294534] x27: 0000000000000000 x26: 0000000000000000 +[ 362.294631] x25: 0000000000000000 x24: ffff80001189a25c +[ 362.294718] x23: 0000000000000000 x22: 0000000000000000 +[ 362.294803] x21: ffff8000114aa018 x20: ffff800011156a00 +[ 362.294897] x19: ffff800010c944a0 x18: 0000000000000004 +[ 362.294987] x17: 0000000000000000 x16: 0000000000000000 +[ 362.295073] x15: 00004e53b831ae3c x14: 00004e53b831ae3c +[ 362.295165] x13: 0000000000000384 x12: 0000000000000000 +[ 362.295251] x11: 0000000000000000 x10: 00400032b5503510 +[ 362.295334] x9 : 0000000000000000 x8 : ffff800010c7e204 +[ 362.295426] x7 : 00000000410fd0f0 x6 : 0000000000000001 +[ 362.295508] x5 : 00000000410fd0f0 x4 : 0000000000000000 +[ 362.295592] x3 : 0000000000000000 x2 : ffff8000100939d8 +[ 362.295683] x1 : 0000000000180420 x0 : 0000000000180480 +[ 362.296011] Call trace: +[ 362.296257] has_cpuid_feature+0xf0/0x348 +[ 362.296350] verify_local_elf_hwcaps+0x84/0xe8 +[ 362.296424] check_local_cpu_capabilities+0x44/0x128 +[ 362.296497] secondary_start_kernel+0xf4/0x188 +[ 362.296998] Code: 52805001 72a00301 6b01001f 54000ec0 (d4210000) +[ 362.298652] SMP: stopping secondary CPUs +[ 362.300615] Starting crashdump kernel... +[ 362.301168] Bye! +[ 0.000000] Booting Linux on physical CPU 0x0000000003 [0x410fd0f0] +[ 0.000000] Linux version 5.6.0-rc4-00003-gc780b890948a (crimar01@e120937-lin) (gcc version 8.3.0 (GNU Toolchain for the A-profile Architecture 8.3-2019.03 (arm-rel-8.36))) #105 SMP PREEMPT Fri Mar 6 17:00:42 GMT 2020 +[ 0.000000] Machine model: Foundation-v8A +[ 0.000000] earlycon: pl11 at MMIO 0x000000001c090000 (options '') +[ 0.000000] printk: bootconsole [pl11] enabled +..... +[ 0.138024] rcu: Hierarchical SRCU implementation. +[ 0.153472] its@2f020000: unable to locate ITS domain +[ 0.154078] its@2f020000: Unable to locate ITS domain +[ 0.157541] EFI services will not be available. +[ 0.175395] smp: Bringing up secondary CPUs ... +[ 0.209182] psci: failed to boot CPU1 (-22) +[ 0.209377] CPU1: failed to boot: -22 +[ 0.274598] Detected PIPT I-cache on CPU2 +[ 0.278707] GICv3: CPU2: found redistributor 1 region 0:0x000000002f120000 +[ 0.285212] CPU2: Booted secondary processor 0x0000000001 [0x410fd0f0] +[ 0.369053] Detected PIPT I-cache on CPU3 +[ 0.372947] GICv3: CPU3: found redistributor 2 region 0:0x000000002f140000 +[ 0.378664] CPU3: Booted secondary processor 0x0000000002 [0x410fd0f0] +[ 0.401707] smp: Brought up 1 node, 3 CPUs +[ 0.404057] SMP: Total of 3 processors activated. + +Make crash_smp_send_stop() account also for the online status of the +calling CPU while evaluating how many CPUs are effectively online: this way +the right number of STOPs is sent and all other stopped-cores's registers +are properly saved. + +Fixes: 78fd584cdec05 ("arm64: kdump: implement machine_crash_shutdown()") +Acked-by: Mark Rutland +Signed-off-by: Cristian Marussi +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/kernel/smp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/arch/arm64/kernel/smp.c ++++ b/arch/arm64/kernel/smp.c +@@ -968,7 +968,11 @@ void smp_send_crash_stop(void) + cpumask_t mask; + unsigned long timeout; + +- if (num_online_cpus() == 1) { ++ /* ++ * If this cpu is the only one alive at this point in time, online or ++ * not, there are no stop messages to be sent around, so just back out. ++ */ ++ if (num_other_online_cpus() == 0) { + sdei_mask_local_cpu(); + return; + } +@@ -976,7 +980,7 @@ void smp_send_crash_stop(void) + cpumask_copy(&mask, cpu_online_mask); + cpumask_clear_cpu(smp_processor_id(), &mask); + +- atomic_set(&waiting_for_crash_ipi, num_online_cpus() - 1); ++ atomic_set(&waiting_for_crash_ipi, num_other_online_cpus()); + + pr_crit("SMP: stopping secondary CPUs\n"); + smp_cross_call(&mask, IPI_CPU_CRASH_STOP); diff --git a/patches.suse/arm64-smp-fix-smp_send_stop-behaviour.patch b/patches.suse/arm64-smp-fix-smp_send_stop-behaviour.patch new file mode 100644 index 0000000..a94237d --- /dev/null +++ b/patches.suse/arm64-smp-fix-smp_send_stop-behaviour.patch @@ -0,0 +1,112 @@ +From: Cristian Marussi +Date: Wed, 11 Mar 2020 17:12:44 +0000 +Subject: arm64: smp: fix smp_send_stop() behaviour +Git-commit: d0bab0c39e32d39a8c5cddca72e5b4a3059fe050 +Patch-mainline: v5.6-rc7 +References: git-fixes + +On a system with only one CPU online, when another one CPU panics while +starting-up, smp_send_stop() will fail to send any STOP message to the +other already online core, resulting in a system still responsive and +alive at the end of the panic procedure. + +[ 186.700083] CPU3: shutdown +[ 187.075462] CPU2: shutdown +[ 187.162869] CPU1: shutdown +[ 188.689998] ------------[ cut here ]------------ +[ 188.691645] kernel BUG at arch/arm64/kernel/cpufeature.c:886! +[ 188.692079] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP +[ 188.692444] Modules linked in: +[ 188.693031] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 5.6.0-rc4-00001-g338d25c35a98 #104 +[ 188.693175] Hardware name: Foundation-v8A (DT) +[ 188.693492] pstate: 200001c5 (nzCv dAIF -PAN -UAO) +[ 188.694183] pc : has_cpuid_feature+0xf0/0x348 +[ 188.694311] lr : verify_local_elf_hwcaps+0x84/0xe8 +[ 188.694410] sp : ffff800011b1bf60 +[ 188.694536] x29: ffff800011b1bf60 x28: 0000000000000000 +[ 188.694707] x27: 0000000000000000 x26: 0000000000000000 +[ 188.694801] x25: 0000000000000000 x24: ffff80001189a25c +[ 188.694905] x23: 0000000000000000 x22: 0000000000000000 +[ 188.694996] x21: ffff8000114aa018 x20: ffff800011156a38 +[ 188.695089] x19: ffff800010c944a0 x18: 0000000000000004 +[ 188.695187] x17: 0000000000000000 x16: 0000000000000000 +[ 188.695280] x15: 0000249dbde5431e x14: 0262cbe497efa1fa +[ 188.695371] x13: 0000000000000002 x12: 0000000000002592 +[ 188.695472] x11: 0000000000000080 x10: 00400032b5503510 +[ 188.695572] x9 : 0000000000000000 x8 : ffff800010c80204 +[ 188.695659] x7 : 00000000410fd0f0 x6 : 0000000000000001 +[ 188.695750] x5 : 00000000410fd0f0 x4 : 0000000000000000 +[ 188.695836] x3 : 0000000000000000 x2 : ffff8000100939d8 +[ 188.695919] x1 : 0000000000180420 x0 : 0000000000180480 +[ 188.696253] Call trace: +[ 188.696410] has_cpuid_feature+0xf0/0x348 +[ 188.696504] verify_local_elf_hwcaps+0x84/0xe8 +[ 188.696591] check_local_cpu_capabilities+0x44/0x128 +[ 188.696666] secondary_start_kernel+0xf4/0x188 +[ 188.697150] Code: 52805001 72a00301 6b01001f 54000ec0 (d4210000) +[ 188.698639] ---[ end trace 3f12ca47652f7b72 ]--- +[ 188.699160] Kernel panic - not syncing: Attempted to kill the idle task! +[ 188.699546] Kernel Offset: disabled +[ 188.699828] CPU features: 0x00004,20c02008 +[ 188.700012] Memory Limit: none +[ 188.700538] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]--- + +[root@arch ~]# echo Helo +Helo +[root@arch ~]# cat /proc/cpuinfo | grep proce +processor : 0 + +Make smp_send_stop() account also for the online status of the calling CPU +while evaluating how many CPUs are effectively online: this way, the right +number of STOPs is sent, so enforcing a proper freeze of the system at the +end of panic even under the above conditions. + +Fixes: 08e875c16a16c ("arm64: SMP support") +Reported-by: Dave Martin +Acked-by: Mark Rutland +Signed-off-by: Cristian Marussi +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/kernel/smp.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +--- a/arch/arm64/kernel/smp.c ++++ b/arch/arm64/kernel/smp.c +@@ -923,11 +923,22 @@ void tick_broadcast(const struct cpumask + } + #endif + ++/* ++ * The number of CPUs online, not counting this CPU (which may not be ++ * fully online and so not counted in num_online_cpus()). ++ */ ++static inline unsigned int num_other_online_cpus(void) ++{ ++ unsigned int this_cpu_online = cpu_online(smp_processor_id()); ++ ++ return num_online_cpus() - this_cpu_online; ++} ++ + void smp_send_stop(void) + { + unsigned long timeout; + +- if (num_online_cpus() > 1) { ++ if (num_other_online_cpus()) { + cpumask_t mask; + + cpumask_copy(&mask, cpu_online_mask); +@@ -941,10 +952,10 @@ void smp_send_stop(void) + + /* Wait up to one second for other CPUs to stop */ + timeout = USEC_PER_SEC; +- while (num_online_cpus() > 1 && timeout--) ++ while (num_other_online_cpus() && timeout--) + udelay(1); + +- if (num_online_cpus() > 1) ++ if (num_other_online_cpus()) + pr_warning("SMP: failed to stop secondary CPUs %*pbl\n", + cpumask_pr_args(cpu_online_mask)); + diff --git a/patches.suse/arm64-uaccess-Ensure-PAN-is-re-enabled-after-unhandled-uaccess-fault.patch b/patches.suse/arm64-uaccess-Ensure-PAN-is-re-enabled-after-unhandled-uaccess-fault.patch new file mode 100644 index 0000000..b0d05df --- /dev/null +++ b/patches.suse/arm64-uaccess-Ensure-PAN-is-re-enabled-after-unhandled-uaccess-fault.patch @@ -0,0 +1,114 @@ +From: Pavel Tatashin +Date: Tue, 19 Nov 2019 17:10:06 -0500 +Subject: arm64: uaccess: Ensure PAN is re-enabled after unhandled uaccess + fault +Git-commit: 94bb804e1e6f0a9a77acf20d7c70ea141c6c821e +Patch-mainline: v5.4 +References: git-fixes + +A number of our uaccess routines ('__arch_clear_user()' and +'__arch_copy_{in,from,to}_user()') fail to re-enable PAN if they +encounter an unhandled fault whilst accessing userspace. + +For CPUs implementing both hardware PAN and UAO, this bug has no effect +when both extensions are in use by the kernel. + +For CPUs implementing hardware PAN but not UAO, this means that a kernel +using hardware PAN may execute portions of code with PAN inadvertently +disabled, opening us up to potential security vulnerabilities that rely +on userspace access from within the kernel which would usually be +prevented by this mechanism. In other words, parts of the kernel run the +same way as they would on a CPU without PAN implemented/emulated at all. + +For CPUs not implementing hardware PAN and instead relying on software +emulation via 'CONFIG_ARM64_SW_TTBR0_PAN=y', the impact is unfortunately +much worse. Calling 'schedule()' with software PAN disabled means that +the next task will execute in the kernel using the page-table and ASID +of the previous process even after 'switch_mm()', since the actual +hardware switch is deferred until return to userspace. At this point, or +if there is a intermediate call to 'uaccess_enable()', the page-table +and ASID of the new process are installed. Sadly, due to the changes +introduced by KPTI, this is not an atomic operation and there is a very +small window (two instructions) where the CPU is configured with the +page-table of the old task and the ASID of the new task; a speculative +access in this state is disastrous because it would corrupt the TLB +entries for the new task with mappings from the previous address space. + +As Pavel explains: + + | I was able to reproduce memory corruption problem on Broadcom's SoC + | ARMv8-A like this: + | + | Enable software perf-events with PERF_SAMPLE_CALLCHAIN so userland's + | stack is accessed and copied. + | + | The test program performed the following on every CPU and forking + | many processes: + | + | unsigned long *map = mmap(NULL, PAGE_SIZE, PROT_READ|PROT_WRITE, + | MAP_SHARED | MAP_ANONYMOUS, -1, 0); + | map[0] = getpid(); + | sched_yield(); + | if (map[0] != getpid()) { + | fprintf(stderr, "Corruption detected!"); + | } + | munmap(map, PAGE_SIZE); + | + | From time to time I was getting map[0] to contain pid for a + | different process. + +Ensure that PAN is re-enabled when returning after an unhandled user +fault from our uaccess routines. + +Cc: Catalin Marinas +Reviewed-by: Mark Rutland +Tested-by: Mark Rutland +Cc: +Fixes: 338d4f49d6f7 ("arm64: kernel: Add support for Privileged Access Never") +Signed-off-by: Pavel Tatashin +[will: rewrote commit message] +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/lib/clear_user.S | 1 + + arch/arm64/lib/copy_from_user.S | 1 + + arch/arm64/lib/copy_in_user.S | 1 + + arch/arm64/lib/copy_to_user.S | 1 + + 4 files changed, 4 insertions(+) + +--- a/arch/arm64/lib/clear_user.S ++++ b/arch/arm64/lib/clear_user.S +@@ -57,5 +57,6 @@ ENDPROC(__arch_clear_user) + .section .fixup,"ax" + .align 2 + 9: mov x0, x2 // return the original size ++ uaccess_disable_not_uao x2, x3 + ret + .previous +--- a/arch/arm64/lib/copy_from_user.S ++++ b/arch/arm64/lib/copy_from_user.S +@@ -75,5 +75,6 @@ ENDPROC(__arch_copy_from_user) + .section .fixup,"ax" + .align 2 + 9998: sub x0, end, dst // bytes not copied ++ uaccess_disable_not_uao x3, x4 + ret + .previous +--- a/arch/arm64/lib/copy_in_user.S ++++ b/arch/arm64/lib/copy_in_user.S +@@ -77,5 +77,6 @@ ENDPROC(__arch_copy_in_user) + .section .fixup,"ax" + .align 2 + 9998: sub x0, end, dst // bytes not copied ++ uaccess_disable_not_uao x3, x4 + ret + .previous +--- a/arch/arm64/lib/copy_to_user.S ++++ b/arch/arm64/lib/copy_to_user.S +@@ -74,5 +74,6 @@ ENDPROC(__arch_copy_to_user) + .section .fixup,"ax" + .align 2 + 9998: sub x0, end, dst // bytes not copied ++ uaccess_disable_not_uao x3, x4 + ret + .previous diff --git a/patches.suse/arm64-uprobe-Return-EOPNOTSUPP-for-AARCH32-instruction-probing.patch b/patches.suse/arm64-uprobe-Return-EOPNOTSUPP-for-AARCH32-instruction-probing.patch new file mode 100644 index 0000000..449bd9f --- /dev/null +++ b/patches.suse/arm64-uprobe-Return-EOPNOTSUPP-for-AARCH32-instruction-probing.patch @@ -0,0 +1,36 @@ +From: He Zhe +Date: Tue, 23 Feb 2021 16:25:34 +0800 +Subject: arm64: uprobe: Return EOPNOTSUPP for AARCH32 instruction probing +Git-commit: d47422d953e258ad587b5edf2274eb95d08bdc7d +Patch-mainline: v5.12-rc1 +References: git-fixes + +As stated in linux/errno.h, ENOTSUPP should never be seen by user programs. +When we set up uprobe with 32-bit perf and arm64 kernel, we would see the +following vague error without useful hint. + +The sys_perf_event_open() syscall returned with 524 (INTERNAL ERROR: +strerror_r(524, [buf], 128)=22) + +Use EOPNOTSUPP instead to indicate such cases. + +Signed-off-by: He Zhe +Link: https://lore.kernel.org/r/20210223082535.48730-1-zhe.he@windriver.com +Cc: +Signed-off-by: Will Deacon +Acked-by: Ivan T. Ivanov +--- + arch/arm64/kernel/probes/uprobes.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/kernel/probes/uprobes.c ++++ b/arch/arm64/kernel/probes/uprobes.c +@@ -41,7 +41,7 @@ int arch_uprobe_analyze_insn(struct arch + + /* TODO: Currently we do not support AARCH32 instruction probing */ + if (test_bit(TIF_32BIT, &mm->context.flags)) +- return -ENOTSUPP; ++ return -EOPNOTSUPP; + else if (!IS_ALIGNED(addr, AARCH64_INSN_SIZE)) + return -EINVAL; + diff --git a/patches.suse/ath10k-fix-max-antenna-gain-unit.patch b/patches.suse/ath10k-fix-max-antenna-gain-unit.patch new file mode 100644 index 0000000..6ced2e4 --- /dev/null +++ b/patches.suse/ath10k-fix-max-antenna-gain-unit.patch @@ -0,0 +1,78 @@ +From 0a491167fe0cf9f26062462de2a8688b96125d48 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Tue, 11 Jun 2019 19:21:31 +0200 +Subject: [PATCH] ath10k: fix max antenna gain unit +Git-commit: 0a491167fe0cf9f26062462de2a8688b96125d48 +References: git-fixes +Patch-mainline: v5.16-rc1 + +Most of the txpower for the ath10k firmware is stored as twicepower (0.5 dB +steps). This isn't the case for max_antenna_gain - which is still expected +by the firmware as dB. + +The firmware is converting it from dB to the internal (twicepower) +representation when it calculates the limits of a channel. This can be seen +in tpc_stats when configuring "12" as max_antenna_gain. Instead of the +expected 12 (6 dB), the tpc_stats shows 24 (12 dB). + +Tested on QCA9888 and IPQ4019 with firmware 10.4-3.5.3-00057. + +Fixes: 02256930d9b8 ("ath10k: use proper tx power unit") +Signed-off-by: Sven Eckelmann +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20190611172131.6064-1-sven@narfation.org +Signed-off-by: Oliver Neukum +--- + drivers/net/wireless/ath/ath10k/mac.c | 6 +++--- + drivers/net/wireless/ath/ath10k/wmi.h | 3 +++ + 2 files changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -1003,7 +1003,7 @@ static int ath10k_monitor_vdev_start(str + arg.channel.min_power = 0; + arg.channel.max_power = channel->max_power * 2; + arg.channel.max_reg_power = channel->max_reg_power * 2; +- arg.channel.max_antenna_gain = channel->max_antenna_gain * 2; ++ arg.channel.max_antenna_gain = channel->max_antenna_gain; + + reinit_completion(&ar->vdev_setup_done); + +@@ -1445,7 +1445,7 @@ static int ath10k_vdev_start_restart(str + arg.channel.min_power = 0; + arg.channel.max_power = chandef->chan->max_power * 2; + arg.channel.max_reg_power = chandef->chan->max_reg_power * 2; +- arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain * 2; ++ arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain; + + if (arvif->vdev_type == WMI_VDEV_TYPE_AP) { + arg.ssid = arvif->u.ap.ssid; +@@ -3104,7 +3104,7 @@ static int ath10k_update_channel_list(st + ch->min_power = 0; + ch->max_power = channel->max_power * 2; + ch->max_reg_power = channel->max_reg_power * 2; +- ch->max_antenna_gain = channel->max_antenna_gain * 2; ++ ch->max_antenna_gain = channel->max_antenna_gain; + ch->reg_class_id = 0; /* FIXME */ + + /* FIXME: why use only legacy modes, why not any +--- a/drivers/net/wireless/ath/ath10k/wmi.h ++++ b/drivers/net/wireless/ath/ath10k/wmi.h +@@ -1988,7 +1988,9 @@ struct wmi_channel { + union { + __le32 reginfo1; + struct { ++ /* note: power unit is 1 dBm */ + u8 antenna_max; ++ /* note: power unit is 0.5 dBm */ + u8 max_tx_power; + } __packed; + } __packed; +@@ -2008,6 +2010,7 @@ struct wmi_channel_arg { + u32 min_power; + u32 max_power; + u32 max_reg_power; ++ /* note: power unit is 1 dBm */ + u32 max_antenna_gain; + u32 reg_class_id; + enum wmi_phy_mode mode; diff --git a/patches.suse/ath6kl-fix-control-message-timeout.patch b/patches.suse/ath6kl-fix-control-message-timeout.patch new file mode 100644 index 0000000..988ca02 --- /dev/null +++ b/patches.suse/ath6kl-fix-control-message-timeout.patch @@ -0,0 +1,37 @@ +From a066d28a7e729f808a3e6eff22e70c003091544e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 25 Oct 2021 14:05:20 +0200 +Subject: [PATCH] ath6kl: fix control-message timeout +Git-commit: a066d28a7e729f808a3e6eff22e70c003091544e +References: git-fixes +Patch-mainline: v5.16-rc1 + +USB control-message timeouts are specified in milliseconds and should +specifically not vary with CONFIG_HZ. + +Fixes: 241b128b6b69 ("ath6kl: add back beginnings of USB support") +Cc: stable@vger.kernel.org # 3.4 +Signed-off-by: Johan Hovold +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211025120522.6045-3-johan@kernel.org +Signed-off-by: Oliver Neukum +--- + drivers/net/wireless/ath/ath6kl/usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c +index 5372e948e761..bd367b79a4d3 100644 +--- a/drivers/net/wireless/ath/ath6kl/usb.c ++++ b/drivers/net/wireless/ath/ath6kl/usb.c +@@ -907,7 +907,7 @@ static int ath6kl_usb_submit_ctrl_in(struct ath6kl_usb *ar_usb, + req, + USB_DIR_IN | USB_TYPE_VENDOR | + USB_RECIP_DEVICE, value, index, buf, +- size, 2 * HZ); ++ size, 2000); + + if (ret < 0) { + ath6kl_warn("Failed to read usb control message: %d\n", ret); +-- +2.34.1 + diff --git a/patches.suse/ath6kl-fix-division-by-zero-in-send-path.patch b/patches.suse/ath6kl-fix-division-by-zero-in-send-path.patch new file mode 100644 index 0000000..5573261 --- /dev/null +++ b/patches.suse/ath6kl-fix-division-by-zero-in-send-path.patch @@ -0,0 +1,46 @@ +From c1b9ca365deae667192be9fe24db244919971234 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 27 Oct 2021 10:08:18 +0200 +Subject: [PATCH] ath6kl: fix division by zero in send path +Git-commit: c1b9ca365deae667192be9fe24db244919971234 +References: git-fixes +Patch-mainline: v5.16-rc1 + +Add the missing endpoint max-packet sanity check to probe() to avoid +division by zero in ath10k_usb_hif_tx_sg() in case a malicious device +has broken descriptors (or when doing descriptor fuzz testing). + +Note that USB core will reject URBs submitted for endpoints with zero +wMaxPacketSize but that drivers doing packet-size calculations still +need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip +endpoint descriptors with maxpacket=0")). + +Fixes: 9cbee358687e ("ath6kl: add full USB support") +Cc: stable@vger.kernel.org # 3.5 +Signed-off-by: Johan Hovold +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211027080819.6675-3-johan@kernel.org +Signed-off-by: Oliver Neukum +--- + drivers/net/wireless/ath/ath6kl/usb.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c +index bd367b79a4d3..aba70f35e574 100644 +--- a/drivers/net/wireless/ath/ath6kl/usb.c ++++ b/drivers/net/wireless/ath/ath6kl/usb.c +@@ -340,6 +340,11 @@ static int ath6kl_usb_setup_pipe_resources(struct ath6kl_usb *ar_usb) + le16_to_cpu(endpoint->wMaxPacketSize), + endpoint->bInterval); + } ++ ++ /* Ignore broken descriptors. */ ++ if (usb_endpoint_maxp(endpoint) == 0) ++ continue; ++ + urbcount = 0; + + pipe_num = +-- +2.34.1 + diff --git a/patches.suse/ath9k-Fix-potential-interrupt-storm-on-queue-reset.patch b/patches.suse/ath9k-Fix-potential-interrupt-storm-on-queue-reset.patch new file mode 100644 index 0000000..79bdd92 --- /dev/null +++ b/patches.suse/ath9k-Fix-potential-interrupt-storm-on-queue-reset.patch @@ -0,0 +1,98 @@ +From 4925642d541278575ad1948c5924d71ffd57ef14 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Linus=20L=C3=BCssing?= +Date: Tue, 5 Oct 2021 16:55:53 +0300 +Subject: [PATCH] ath9k: Fix potential interrupt storm on queue reset +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Git-commit: 4925642d541278575ad1948c5924d71ffd57ef14 +References: git-fixes +Patch-mainline: v5.16-rc1 + +In tests with two Lima boards from 8devices (QCA4531 based) on OpenWrt +19.07 we could force a silent restart of a device with no serial +output when we were sending a high amount of UDP traffic (iperf3 at 80 +MBit/s in both directions from external hosts, saturating the wifi and +causing a load of about 4.5 to 6) and were then triggering an +ath9k_queue_reset(). + +Further debugging showed that the restart was caused by the ath79 +watchdog. With disabled watchdog we could observe that the device was +constantly going into ath_isr() interrupt handler and was returning +early after the ATH_OP_HW_RESET flag test, without clearing any +interrupts. Even though ath9k_queue_reset() calls +ath9k_hw_kill_interrupts(). + +With JTAG we could observe the following race condition: + +1) ath9k_queue_reset() + ... + -> ath9k_hw_kill_interrupts() + -> set_bit(ATH_OP_HW_RESET, &common->op_flags); + ... + <- returns + + 2) ath9k_tasklet() + ... + -> ath9k_hw_resume_interrupts() + ... + <- returns + + 3) loops around: + ... + handle_int() + -> ath_isr() + ... + -> if (test_bit(ATH_OP_HW_RESET, + &common->op_flags)) + return IRQ_HANDLED; + + x) ath_reset_internal(): + => never reached <= + +And in ath_isr() we would typically see the following interrupts / +interrupt causes: + +* status: 0x00111030 or 0x00110030 +* async_cause: 2 (AR_INTR_MAC_IPQ) +* sync_cause: 0 + +So the ath9k_tasklet() reenables the ath9k interrupts +through ath9k_hw_resume_interrupts() which ath9k_queue_reset() had just +disabled. And ath_isr() then keeps firing because it returns IRQ_HANDLED +without actually clearing the interrupt. + +To fix this IRQ storm also clear/disable the interrupts again when we +are in reset state. + +Cc: Sven Eckelmann +Cc: Simon Wunderlich +Cc: Linus Lüssing +Fixes: 872b5d814f99 ("ath9k: do not access hardware on IRQs during reset") +Signed-off-by: Linus Lüssing +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210914192515.9273-3-linus.luessing@c0d3.blue +Signed-off-by: Oliver Neukum +--- + drivers/net/wireless/ath/ath9k/main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c +index 139831539da3..98090e40e1cf 100644 +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -533,8 +533,10 @@ irqreturn_t ath_isr(int irq, void *dev) + ath9k_debug_sync_cause(sc, sync_cause); + status &= ah->imask; /* discard unasked-for bits */ + +- if (test_bit(ATH_OP_HW_RESET, &common->op_flags)) ++ if (test_bit(ATH_OP_HW_RESET, &common->op_flags)) { ++ ath9k_hw_kill_interrupts(sc->sc_ah); + return IRQ_HANDLED; ++ } + + /* + * If there are no status bits set, then this interrupt was not +-- +2.34.1 + diff --git a/patches.suse/b43-fix-a-lower-bounds-test.patch b/patches.suse/b43-fix-a-lower-bounds-test.patch new file mode 100644 index 0000000..b85a5fe --- /dev/null +++ b/patches.suse/b43-fix-a-lower-bounds-test.patch @@ -0,0 +1,46 @@ +From 9b793db5fca44d01f72d3564a168171acf7c4076 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 6 Oct 2021 10:36:22 +0300 +Subject: [PATCH] b43: fix a lower bounds test +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Git-commit: 9b793db5fca44d01f72d3564a168171acf7c4076 +References: git-fixes +Patch-mainline: v5.16-rc1 + +The problem is that "channel" is an unsigned int, when it's less 5 the +value of "channel - 5" is not a negative number as one would expect but +is very high positive value instead. + +This means that "start" becomes a very high positive value. The result +of that is that we never enter the "for (i = start; i <= end; i++) {" +loop. Instead of storing the result from b43legacy_radio_aci_detect() +it just uses zero. + +Fixes: ef1a628d83fc ("b43: Implement dynamic PHY API") +Signed-off-by: Dan Carpenter +Acked-by: Michael Büsch +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211006073621.GE8404@kili +Signed-off-by: Oliver Neukum +--- + drivers/net/wireless/broadcom/b43/phy_g.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/b43/phy_g.c b/drivers/net/wireless/broadcom/b43/phy_g.c +index d5a1a5c58236..ac72ca39e409 100644 +--- a/drivers/net/wireless/broadcom/b43/phy_g.c ++++ b/drivers/net/wireless/broadcom/b43/phy_g.c +@@ -2297,7 +2297,7 @@ static u8 b43_gphy_aci_scan(struct b43_wldev *dev) + b43_phy_mask(dev, B43_PHY_G_CRS, 0x7FFF); + b43_set_all_gains(dev, 3, 8, 1); + +- start = (channel - 5 > 0) ? channel - 5 : 1; ++ start = (channel > 5) ? channel - 5 : 1; + end = (channel + 5 < 14) ? channel + 5 : 13; + + for (i = start; i <= end; i++) { +-- +2.34.1 + diff --git a/patches.suse/b43legacy-fix-a-lower-bounds-test.patch b/patches.suse/b43legacy-fix-a-lower-bounds-test.patch new file mode 100644 index 0000000..eeae08a --- /dev/null +++ b/patches.suse/b43legacy-fix-a-lower-bounds-test.patch @@ -0,0 +1,46 @@ +From c1c8380b0320ab757e60ed90efc8b1992a943256 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 6 Oct 2021 10:35:42 +0300 +Subject: [PATCH] b43legacy: fix a lower bounds test +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Git-commit: c1c8380b0320ab757e60ed90efc8b1992a943256 +References: git-fixes +Patch-mainline: v5.16-rc1 + +The problem is that "channel" is an unsigned int, when it's less 5 the +value of "channel - 5" is not a negative number as one would expect but +is very high positive value instead. + +This means that "start" becomes a very high positive value. The result +of that is that we never enter the "for (i = start; i <= end; i++) {" +loop. Instead of storing the result from b43legacy_radio_aci_detect() +it just uses zero. + +Fixes: 75388acd0cd8 ("[B43LEGACY]: add mac80211-based driver for legacy BCM43xx devices") +Signed-off-by: Dan Carpenter +Acked-by: Michael Büsch +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211006073542.GD8404@kili +Signed-off-by: Oliver Neukum +--- + drivers/net/wireless/broadcom/b43legacy/radio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/b43legacy/radio.c b/drivers/net/wireless/broadcom/b43legacy/radio.c +index 06891b4f837b..fdf78c10a05c 100644 +--- a/drivers/net/wireless/broadcom/b43legacy/radio.c ++++ b/drivers/net/wireless/broadcom/b43legacy/radio.c +@@ -283,7 +283,7 @@ u8 b43legacy_radio_aci_scan(struct b43legacy_wldev *dev) + & 0x7FFF); + b43legacy_set_all_gains(dev, 3, 8, 1); + +- start = (channel - 5 > 0) ? channel - 5 : 1; ++ start = (channel > 5) ? channel - 5 : 1; + end = (channel + 5 < 14) ? channel + 5 : 13; + + for (i = start; i <= end; i++) { +-- +2.34.1 + diff --git a/patches.suse/bnx2x-fix-napi-API-usage-sequence.patch b/patches.suse/bnx2x-fix-napi-API-usage-sequence.patch new file mode 100644 index 0000000..5425000 --- /dev/null +++ b/patches.suse/bnx2x-fix-napi-API-usage-sequence.patch @@ -0,0 +1,145 @@ +From: Manish Chopra +Date: Tue, 26 Apr 2022 08:39:13 -0700 +Subject: bnx2x: fix napi API usage sequence +Patch-mainline: v5.18-rc5 +Git-commit: af68656d66eda219b7f55ce8313a1da0312c79e1 +References: bsc#1198217 + +While handling PCI errors (AER flow) driver tries to +disable NAPI [napi_disable()] after NAPI is deleted +[__netif_napi_del()] which causes unexpected system +hang/crash. + +System message log shows the following: +======================================= +[ 3222.537510] EEH: Detected PCI bus error on PHB#384-PE#800000 [ 3222.537511] EEH: This PCI device has failed 2 times in the last hour and will be permanently disabled after 5 failures. +[ 3222.537512] EEH: Notify device drivers to shutdown [ 3222.537513] EEH: Beginning: 'error_detected(IO frozen)' +[ 3222.537514] EEH: PE#800000 (PCI 0384:80:00.0): Invoking +bnx2x->error_detected(IO frozen) +[ 3222.537516] bnx2x: [bnx2x_io_error_detected:14236(eth14)]IO error detected [ 3222.537650] EEH: PE#800000 (PCI 0384:80:00.0): bnx2x driver reports: +'need reset' +[ 3222.537651] EEH: PE#800000 (PCI 0384:80:00.1): Invoking +bnx2x->error_detected(IO frozen) +[ 3222.537651] bnx2x: [bnx2x_io_error_detected:14236(eth13)]IO error detected [ 3222.537729] EEH: PE#800000 (PCI 0384:80:00.1): bnx2x driver reports: +'need reset' +[ 3222.537729] EEH: Finished:'error_detected(IO frozen)' with aggregate recovery state:'need reset' +[ 3222.537890] EEH: Collect temporary log [ 3222.583481] EEH: of node=0384:80:00.0 [ 3222.583519] EEH: PCI device/vendor: 168e14e4 [ 3222.583557] EEH: PCI cmd/status register: 00100140 [ 3222.583557] EEH: PCI-E capabilities and status follow: +[ 3222.583744] EEH: PCI-E 00: 00020010 012c8da2 00095d5e 00455c82 [ 3222.583892] EEH: PCI-E 10: 10820000 00000000 00000000 00000000 [ 3222.583893] EEH: PCI-E 20: 00000000 [ 3222.583893] EEH: PCI-E AER capability register set follows: +[ 3222.584079] EEH: PCI-E AER 00: 13c10001 00000000 00000000 00062030 [ 3222.584230] EEH: PCI-E AER 10: 00002000 000031c0 000001e0 00000000 [ 3222.584378] EEH: PCI-E AER 20: 00000000 00000000 00000000 00000000 [ 3222.584416] EEH: PCI-E AER 30: 00000000 00000000 [ 3222.584416] EEH: of node=0384:80:00.1 [ 3222.584454] EEH: PCI device/vendor: 168e14e4 [ 3222.584491] EEH: PCI cmd/status register: 00100140 [ 3222.584492] EEH: PCI-E capabilities and status follow: +[ 3222.584677] EEH: PCI-E 00: 00020010 012c8da2 00095d5e 00455c82 [ 3222.584825] EEH: PCI-E 10: 10820000 00000000 00000000 00000000 [ 3222.584826] EEH: PCI-E 20: 00000000 [ 3222.584826] EEH: PCI-E AER capability register set follows: +[ 3222.585011] EEH: PCI-E AER 00: 13c10001 00000000 00000000 00062030 [ 3222.585160] EEH: PCI-E AER 10: 00002000 000031c0 000001e0 00000000 [ 3222.585309] EEH: PCI-E AER 20: 00000000 00000000 00000000 00000000 [ 3222.585347] EEH: PCI-E AER 30: 00000000 00000000 [ 3222.586872] RTAS: event: 5, Type: Platform Error (224), Severity: 2 [ 3222.586873] EEH: Reset without hotplug activity [ 3224.762767] EEH: Beginning: 'slot_reset' +[ 3224.762770] EEH: PE#800000 (PCI 0384:80:00.0): Invoking +bnx2x->slot_reset() +[ 3224.762771] bnx2x: [bnx2x_io_slot_reset:14271(eth14)]IO slot reset initializing... +[ 3224.762887] bnx2x 0384:80:00.0: enabling device (0140 -> 0142) [ 3224.768157] bnx2x: [bnx2x_io_slot_reset:14287(eth14)]IO slot reset +--> driver unload + +Uninterruptible tasks +===================== +crash> ps | grep UN + 213 2 11 c000000004c89e00 UN 0.0 0 0 [eehd] + 215 2 0 c000000004c80000 UN 0.0 0 0 +[kworker/0:2] + 2196 1 28 c000000004504f00 UN 0.1 15936 11136 wickedd + 4287 1 9 c00000020d076800 UN 0.0 4032 3008 agetty + 4289 1 20 c00000020d056680 UN 0.0 7232 3840 agetty + 32423 2 26 c00000020038c580 UN 0.0 0 0 +[kworker/26:3] + 32871 4241 27 c0000002609ddd00 UN 0.1 18624 11648 sshd + 32920 10130 16 c00000027284a100 UN 0.1 48512 12608 sendmail + 33092 32987 0 c000000205218b00 UN 0.1 48512 12608 sendmail + 33154 4567 16 c000000260e51780 UN 0.1 48832 12864 pickup + 33209 4241 36 c000000270cb6500 UN 0.1 18624 11712 sshd + 33473 33283 0 c000000205211480 UN 0.1 48512 12672 sendmail + 33531 4241 37 c00000023c902780 UN 0.1 18624 11648 sshd + +EEH handler hung while bnx2x sleeping and holding RTNL lock +=========================================================== +crash> bt 213 +PID: 213 TASK: c000000004c89e00 CPU: 11 COMMAND: "eehd" + #0 [c000000004d477e0] __schedule at c000000000c70808 + #1 [c000000004d478b0] schedule at c000000000c70ee0 + #2 [c000000004d478e0] schedule_timeout at c000000000c76dec + #3 [c000000004d479c0] msleep at c0000000002120cc + #4 [c000000004d479f0] napi_disable at c000000000a06448 + ^^^^^^^^^^^^^^^^ + #5 [c000000004d47a30] bnx2x_netif_stop at c0080000018dba94 [bnx2x] + #6 [c000000004d47a60] bnx2x_io_slot_reset at c0080000018a551c [bnx2x] + #7 [c000000004d47b20] eeh_report_reset at c00000000004c9bc + #8 [c000000004d47b90] eeh_pe_report at c00000000004d1a8 + #9 [c000000004d47c40] eeh_handle_normal_event at c00000000004da64 + +And the sleeping source code +============================ +crash> dis -ls c000000000a06448 +FILE: ../net/core/dev.c +LINE: 6702 + + 6697 { + 6698 might_sleep(); + 6699 set_bit(NAPI_STATE_DISABLE, &n->state); + 6700 + 6701 while (test_and_set_bit(NAPI_STATE_SCHED, &n->state)) +* 6702 msleep(1); + 6703 while (test_and_set_bit(NAPI_STATE_NPSVC, &n->state)) + 6704 msleep(1); + 6705 + 6706 hrtimer_cancel(&n->timer); + 6707 + 6708 clear_bit(NAPI_STATE_DISABLE, &n->state); + 6709 } + +EEH calls into bnx2x twice based on the system log above, first through +bnx2x_io_error_detected() and then bnx2x_io_slot_reset(), and executes +the following call chains: + +bnx2x_io_error_detected() + +-> bnx2x_eeh_nic_unload() + +-> bnx2x_del_all_napi() + +-> __netif_napi_del() + +bnx2x_io_slot_reset() + +-> bnx2x_netif_stop() + +-> bnx2x_napi_disable() + +->napi_disable() + +Fix this by correcting the sequence of NAPI APIs usage, +that is delete the NAPI after disabling it. + +Fixes: 7fa6f34081f1 ("bnx2x: AER revised") +Reported-by: David Christensen +Tested-by: David Christensen +Signed-off-by: Manish Chopra +Signed-off-by: Ariel Elior +Link: https://lore.kernel.org/r/20220426153913.6966-1-manishc@marvell.com +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -14286,10 +14286,6 @@ static int bnx2x_eeh_nic_unload(struct b + + /* Stop Tx */ + bnx2x_tx_disable(bp); +- /* Delete all NAPI objects */ +- bnx2x_del_all_napi(bp); +- if (CNIC_LOADED(bp)) +- bnx2x_del_all_napi_cnic(bp); + netdev_reset_tc(bp->dev); + + del_timer_sync(&bp->timer); +@@ -14394,6 +14390,11 @@ static pci_ers_result_t bnx2x_io_slot_re + bnx2x_drain_tx_queues(bp); + bnx2x_send_unload_req(bp, UNLOAD_RECOVERY); + bnx2x_netif_stop(bp, 1); ++ bnx2x_del_all_napi(bp); ++ ++ if (CNIC_LOADED(bp)) ++ bnx2x_del_all_napi_cnic(bp); ++ + bnx2x_free_irq(bp); + + /* Report UNLOAD_DONE to MCP */ diff --git a/patches.suse/bonding-pair-enable_port-with-slave_arr_updates.patch b/patches.suse/bonding-pair-enable_port-with-slave_arr_updates.patch new file mode 100644 index 0000000..db9ceec --- /dev/null +++ b/patches.suse/bonding-pair-enable_port-with-slave_arr_updates.patch @@ -0,0 +1,54 @@ +From 1c9e6fb6adff458df2916c581526aa4ca3bcbe56 Mon Sep 17 00:00:00 2001 +From: Mahesh Bandewar +Date: Mon, 7 Feb 2022 14:29:01 -0800 +Subject: [PATCH 1/8] bonding: pair enable_port with slave_arr_updates +Git-commit: 23de0d7b6f0e3f9a6283a882594c479949da1120 +Patch-mainline: v5.17-rc4 +References: git-fixes + +When 803.2ad mode enables a participating port, it should update +the slave-array. I have observed that the member links are participating +and are part of the active aggregator while the traffic is egressing via +only one member link (in a case where two links are participating). Via +kprobes I discovered that slave-arr has only one link added while +the other participating link wasn't part of the slave-arr. + +I couldn't see what caused that situation but the simple code-walk +through provided me hints that the enable_port wasn't always associated +with the slave-array update. + +Fixes: ee6377147409 ("bonding: Simplify the xmit function for modes that use xmit_hash") +Signed-off-by: Mahesh Bandewar +Acked-by: Jay Vosburgh +Link: https://lore.kernel.org/r/20220207222901.1795287-1-maheshb@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Denis Kirjanov +--- + drivers/net/bonding/bond_3ad.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c +index 69b4eaca8956..e08d479f4d07 100644 +--- a/drivers/net/bonding/bond_3ad.c ++++ b/drivers/net/bonding/bond_3ad.c +@@ -1007,8 +1007,8 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) + if (port->aggregator && + port->aggregator->is_active && + !__port_is_enabled(port)) { +- + __enable_port(port); ++ *update_slave_arr = true; + } + } + break; +@@ -1755,6 +1755,7 @@ static void ad_agg_selection_logic(struct aggregator *agg, + port = port->next_port_in_aggregator) { + __enable_port(port); + } ++ *update_slave_arr = true; + } + } + +-- +2.16.4 + diff --git a/patches.suse/bpf-fix-panic-due-to-oob-in-bpf_prog_test_run_skb.patch b/patches.suse/bpf-fix-panic-due-to-oob-in-bpf_prog_test_run_skb.patch index 225edc6..f36202f 100644 --- a/patches.suse/bpf-fix-panic-due-to-oob-in-bpf_prog_test_run_skb.patch +++ b/patches.suse/bpf-fix-panic-due-to-oob-in-bpf_prog_test_run_skb.patch @@ -3,7 +3,9 @@ Date: Wed, 11 Jul 2018 15:30:14 +0200 Subject: bpf: fix panic due to oob in bpf_prog_test_run_skb Patch-mainline: v4.18-rc6 Git-commit: 6e6fddc78323533be570873abb728b7e0ba7e024 -References: bsc#1109837 +References: bsc#1109837, bsc#1197219, CVE-2021-39711 +X-Info: adjust for context, no "bpf: rename bpf_compute_data_end into bpf_compute_data_pointers" 6aaae2b6c4330a46204bca042f1d2f41e8e18dea +X-Info: drop second hunk of tools/testing/selftests/bpf/test_verifier.c/do_test_single; no "selftests/bpf: make test_verifier run most programs on 64-byte zero initialized data." 111e6b45315c8d13658f23885b30eb9df3ea2914 sykzaller triggered several panics similar to the below: diff --git a/patches.suse/btrfs-relocation-Only-remove-reloc-rb_trees-if-reloc.patch b/patches.suse/btrfs-relocation-Only-remove-reloc-rb_trees-if-reloc.patch new file mode 100644 index 0000000..0b5fb0b --- /dev/null +++ b/patches.suse/btrfs-relocation-Only-remove-reloc-rb_trees-if-reloc.patch @@ -0,0 +1,67 @@ +From 389305b2aa68723c754f88d9dbd268a400e10664 Mon Sep 17 00:00:00 2001 +Message-Id: <389305b2aa68723c754f88d9dbd268a400e10664.1652398931.git.wqu@suse.com> +From: Qu Wenruo +Date: Tue, 3 Jul 2018 17:10:07 +0800 +Patch-mainline: v4.19 +Git-commit: 389305b2aa68723c754f88d9dbd268a400e10664 +References: bsc#1199399 +Subject: [PATCH] btrfs: relocation: Only remove reloc rb_trees if reloc + control has been initialized + +Invalid reloc tree can cause kernel NULL pointer dereference when btrfs +does some cleanup of the reloc roots. + +It turns out that fs_info::reloc_ctl can be NULL in +btrfs_recover_relocation() as we allocate relocation control after all +reloc roots have been verified. +So when we hit: note, we haven't called set_reloc_control() thus +fs_info::reloc_ctl is still NULL. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=199833 +Reported-by: Xu Wen +Signed-off-by: Qu Wenruo +Tested-by: Gu Jinxiang +Reviewed-by: David Sterba +Signed-off-by: David Sterba +--- + fs/btrfs/relocation.c | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index 229f721cbde9..b98d7a594542 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -1281,18 +1281,19 @@ static void __del_reloc_root(struct btrfs_root *root) + struct mapping_node *node = NULL; + struct reloc_control *rc = fs_info->reloc_ctl; + +- spin_lock(&rc->reloc_root_tree.lock); +- rb_node = tree_search(&rc->reloc_root_tree.rb_root, +- root->node->start); +- if (rb_node) { +- node = rb_entry(rb_node, struct mapping_node, rb_node); +- rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); ++ if (rc) { ++ spin_lock(&rc->reloc_root_tree.lock); ++ rb_node = tree_search(&rc->reloc_root_tree.rb_root, ++ root->node->start); ++ if (rb_node) { ++ node = rb_entry(rb_node, struct mapping_node, rb_node); ++ rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); ++ } ++ spin_unlock(&rc->reloc_root_tree.lock); ++ if (!node) ++ return; ++ BUG_ON((struct btrfs_root *)node->data != root); + } +- spin_unlock(&rc->reloc_root_tree.lock); +- +- if (!node) +- return; +- BUG_ON((struct btrfs_root *)node->data != root); + + spin_lock(&fs_info->trans_lock); + list_del_init(&root->root_list); +-- +2.36.1 + diff --git a/patches.suse/btrfs-tree-checker-fix-incorrect-printk-format.patch b/patches.suse/btrfs-tree-checker-fix-incorrect-printk-format.patch new file mode 100644 index 0000000..32ddaf1 --- /dev/null +++ b/patches.suse/btrfs-tree-checker-fix-incorrect-printk-format.patch @@ -0,0 +1,38 @@ +From cad69d139651423b9cb8917f514740ed3f08b10a Mon Sep 17 00:00:00 2001 +From: Pujin Shi +Date: Wed, 14 Oct 2020 11:24:19 +0800 +References: bsc#1200249 +Git-commit: cad69d139651423b9cb8917f514740ed3f08b10a +Patch-mainline: v5.10 +Subject: [PATCH] btrfs: tree-checker: fix incorrect printk format + +This patch addresses a compile warning: + +fs/btrfs/extent-tree.c: In function '__btrfs_free_extent': +fs/btrfs/extent-tree.c:3187:4: warning: format '%lu' expects argument of type 'long unsigned int', but argument 8 has type 'unsigned int' [-Wformat=] + +Fixes: 1c2a07f598d5 ("btrfs: extent-tree: kill BUG_ON() in __btrfs_free_extent()") +Reviewed-by: Filipe Manana +Signed-off-by: Pujin Shi +Reviewed-by: David Sterba +Signed-off-by: David Sterba +--- + fs/btrfs/extent-tree.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 3b21fee13e77..5fd60b13f4f8 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -3185,7 +3185,7 @@ static int __btrfs_free_extent(struct btrfs_trans_handle *trans, + struct btrfs_tree_block_info *bi; + if (item_size < sizeof(*ei) + sizeof(*bi)) { + btrfs_crit(info, +-"invalid extent item size for key (%llu, %u, %llu) owner %llu, has %u expect >= %lu", ++"invalid extent item size for key (%llu, %u, %llu) owner %llu, has %u expect >= %zu", + key.objectid, key.type, key.offset, + owner_objectid, item_size, + sizeof(*ei) + sizeof(*bi)); +-- +2.36.1 + diff --git a/patches.suse/can-gs_usb-fix-use-of-uninitialized-variable-detach-.patch b/patches.suse/can-gs_usb-fix-use-of-uninitialized-variable-detach-.patch new file mode 100644 index 0000000..9475a58 --- /dev/null +++ b/patches.suse/can-gs_usb-fix-use-of-uninitialized-variable-detach-.patch @@ -0,0 +1,56 @@ +From 87f4d14780b1ac426274050c519bfbc0e74872c7 Mon Sep 17 00:00:00 2001 +From: Marc Kleine-Budde +Date: Fri, 10 Dec 2021 10:03:09 +0100 +Subject: [PATCH 4/6] can: gs_usb: fix use of uninitialized variable, detach + device on reception of invalid USB data +References: git-fixes +Patch-mainline: v5.17-rc1 +Git-commit: 4a8737ff068724f509d583fef404d349adba80d6 + +The received data contains the channel the received data is associated +with. If the channel number is bigger than the actual number of +channels assume broken or malicious USB device and shut it down. + +This fixes the error found by clang: + +| drivers/net/can/usb/gs_usb.c:386:6: error: variable 'dev' is used +| uninitialized whenever 'if' condition is true +| if (hf->channel >= GS_MAX_INTF) +| ^~~~~~~~~~~~~~~~~~~~~~~~~~ +| drivers/net/can/usb/gs_usb.c:474:10: note: uninitialized use occurs here +| hf, dev->gs_hf_size, gs_usb_receive_bulk_callback, +| ^~~ + +Link: https://lore.kernel.org/all/20211210091158.408326-1-mkl@pengutronix.de +Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") +Cc: stable@vger.kernel.org +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Denis Kirjanov +--- + drivers/net/can/usb/gs_usb.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c +index 99c42f297afd..7fbb757af8e9 100644 +--- a/drivers/net/can/usb/gs_usb.c ++++ b/drivers/net/can/usb/gs_usb.c +@@ -328,7 +328,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) + + /* device reports out of range channel id */ + if (hf->channel >= GS_MAX_INTF) +- goto resubmit_urb; ++ goto device_detach; + + dev = usbcan->canch[hf->channel]; + +@@ -413,6 +413,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) + + /* USB failure take down all interfaces */ + if (rc == -ENODEV) { ++ device_detach: + for (rc = 0; rc < GS_MAX_INTF; rc++) { + if (usbcan->canch[rc]) + netif_device_detach(usbcan->canch[rc]->netdev); +-- +2.16.4 + diff --git a/patches.suse/cgroup-cpuset-Remove-cpus_allowed-mems_allowed-setup-in-cpuset_init_smp.patch b/patches.suse/cgroup-cpuset-Remove-cpus_allowed-mems_allowed-setup-in-cpuset_init_smp.patch new file mode 100644 index 0000000..d67312a --- /dev/null +++ b/patches.suse/cgroup-cpuset-Remove-cpus_allowed-mems_allowed-setup-in-cpuset_init_smp.patch @@ -0,0 +1,75 @@ +From: Waiman Long +Date: Wed, 27 Apr 2022 10:54:28 -0400 +Subject: cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in + cpuset_init_smp() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Git-commit: 2685027fca387b602ae565bff17895188b803988 +Patch-mainline: v5.18-rc7 +References: bsc#1199839 + +There are 3 places where the cpu and node masks of the top cpuset can +be initialized in the order they are executed: + 1) start_kernel -> cpuset_init() + 2) start_kernel -> cgroup_init() -> cpuset_bind() + 3) kernel_init_freeable() -> do_basic_setup() -> cpuset_init_smp() + +The first cpuset_init() call just sets all the bits in the masks. +The second cpuset_bind() call sets cpus_allowed and mems_allowed to the +default v2 values. The third cpuset_init_smp() call sets them back to +v1 values. + +For systems with cgroup v2 setup, cpuset_bind() is called once. As a +result, cpu and memory node hot add may fail to update the cpu and node +masks of the top cpuset to include the newly added cpu or node in a +cgroup v2 environment. + +For systems with cgroup v1 setup, cpuset_bind() is called again by +rebind_subsystem() when the v1 cpuset filesystem is mounted as shown +in the dmesg log below with an instrumented kernel. + + [ 2.609781] cpuset_bind() called - v2 = 1 + [ 3.079473] cpuset_init_smp() called + [ 7.103710] cpuset_bind() called - v2 = 0 + +smp_init() is called after the first two init functions. So we don't +have a complete list of active cpus and memory nodes until later in +cpuset_init_smp() which is the right time to set up effective_cpus +and effective_mems. + +To fix this cgroup v2 mask setup problem, the potentially incorrect +cpus_allowed & mems_allowed setting in cpuset_init_smp() are removed. +For cgroup v2 systems, the initial cpuset_bind() call will set the masks +correctly. For cgroup v1 systems, the second call to cpuset_bind() +will do the right setup. + +cc: stable@vger.kernel.org +Signed-off-by: Waiman Long +Tested-by: Feng Tang +Reviewed-by: Michal Koutný +Signed-off-by: Tejun Heo +Acked-by: Michal Koutný +--- + kernel/cgroup/cpuset.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index 9390bfd9f1cd..71a418858a5e 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -3390,8 +3390,11 @@ static struct notifier_block cpuset_track_online_nodes_nb = { + */ + void __init cpuset_init_smp(void) + { +- cpumask_copy(top_cpuset.cpus_allowed, cpu_active_mask); +- top_cpuset.mems_allowed = node_states[N_MEMORY]; ++ /* ++ * cpus_allowd/mems_allowed set to v2 values in the initial ++ * cpuset_bind() call will be reset to v1 values in another ++ * cpuset_bind() call when v1 cpuset is mounted. ++ */ + top_cpuset.old_mems_allowed = top_cpuset.mems_allowed; + + cpumask_copy(top_cpuset.effective_cpus, cpu_active_mask); + diff --git a/patches.suse/char-mwave-Adjust-io-port-register-size.patch b/patches.suse/char-mwave-Adjust-io-port-register-size.patch new file mode 100644 index 0000000..eb9d9fb --- /dev/null +++ b/patches.suse/char-mwave-Adjust-io-port-register-size.patch @@ -0,0 +1,44 @@ +From: Kees Cook +Date: Fri, 3 Dec 2021 00:42:06 -0800 +Subject: char/mwave: Adjust io port register size +Git-commit: f5912cc19acd7c24b2dbf65a6340bf194244f085 +Patch-mainline: 5.17-rc1 +References: git-fixes + +Using MKWORD() on a byte-sized variable results in OOB read. Expand the +size of the reserved area so both MKWORD and MKBYTE continue to work +without overflow. Silences this warning on a -Warray-bounds build: + +drivers/char/mwave/3780i.h:346:22: error: array subscript 'short unsigned int[0]' is partly outside array bounds of 'DSP_ISA_SLAVE_CONTROL[1]' [-Werror=array-bounds] + 346 | #define MKWORD(var) (*((unsigned short *)(&var))) + | ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/char/mwave/3780i.h:356:40: note: in definition of macro 'OutWordDsp' + 356 | #define OutWordDsp(index,value) outw(value,usDspBaseIO+index) + | ^~~~~ +drivers/char/mwave/3780i.c:373:41: note: in expansion of macro 'MKWORD' + 373 | OutWordDsp(DSP_IsaSlaveControl, MKWORD(rSlaveControl)); + | ^~~~~~ +drivers/char/mwave/3780i.c:358:31: note: while referencing 'rSlaveControl' + 358 | DSP_ISA_SLAVE_CONTROL rSlaveControl; + | ^~~~~~~~~~~~~ + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20211203084206.3104326-1-keescook@chromium.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/char/mwave/3780i.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/char/mwave/3780i.h ++++ b/drivers/char/mwave/3780i.h +@@ -68,7 +68,7 @@ typedef struct { + unsigned char ClockControl:1; /* RW: Clock control: 0=normal, 1=stop 3780i clocks */ + unsigned char SoftReset:1; /* RW: Soft reset 0=normal, 1=soft reset active */ + unsigned char ConfigMode:1; /* RW: Configuration mode, 0=normal, 1=config mode */ +- unsigned char Reserved:5; /* 0: Reserved */ ++ unsigned short Reserved:13; /* 0: Reserved */ + } DSP_ISA_SLAVE_CONTROL; + + diff --git a/patches.suse/cputime-cpuacct-Include-guest-time-in-user-time-in-c.patch b/patches.suse/cputime-cpuacct-Include-guest-time-in-user-time-in-c.patch new file mode 100644 index 0000000..5e724f6 --- /dev/null +++ b/patches.suse/cputime-cpuacct-Include-guest-time-in-user-time-in-c.patch @@ -0,0 +1,49 @@ +From 9731698ecb9c851f353ce2496292ff9fcea39dff Mon Sep 17 00:00:00 2001 +From: Andrey Ryabinin +Date: Mon, 15 Nov 2021 19:46:04 +0300 +Subject: [PATCH] cputime, cpuacct: Include guest time in user time in + cpuacct.stat +Git-commit: 9731698ecb9c851f353ce2496292ff9fcea39dff +Patch-mainline: v5.17-rc1 +References: git-fixes + +cpuacct.stat in no-root cgroups shows user time without guest time +included int it. This doesn't match with user time shown in root +cpuacct.stat and /proc//stat. This also affects cgroup2's cpu.stat +in the same way. + +Make account_guest_time() to add user time to cgroup's cpustat to +fix this. + +Fixes: ef12fefabf94 ("cpuacct: add per-cgroup utime/stime statistics") +Signed-off-by: Andrey Ryabinin +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Daniel Jordan +Acked-by: Tejun Heo +Cc: +Link: https://lore.kernel.org/r/20211115164607.23784-1-arbn@yandex-team.com +Signed-off-by: Frederic Weisbecker +--- + kernel/sched/cputime.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c +index 872e481d5098..042a6dbce8f3 100644 +--- a/kernel/sched/cputime.c ++++ b/kernel/sched/cputime.c +@@ -148,10 +148,10 @@ void account_guest_time(struct task_struct *p, u64 cputime) + + /* Add guest time to cpustat. */ + if (task_nice(p) > 0) { +- cpustat[CPUTIME_NICE] += cputime; ++ task_group_account_field(p, CPUTIME_NICE, cputime); + cpustat[CPUTIME_GUEST_NICE] += cputime; + } else { +- cpustat[CPUTIME_USER] += cputime; ++ task_group_account_field(p, CPUTIME_USER, cputime); + cpustat[CPUTIME_GUEST] += cputime; + } + } +-- +2.25.1 + diff --git a/patches.suse/crypto-arm64-aes-neonbs-don-t-access-already-freed-walk.iv.patch b/patches.suse/crypto-arm64-aes-neonbs-don-t-access-already-freed-walk.iv.patch new file mode 100644 index 0000000..36e7579 --- /dev/null +++ b/patches.suse/crypto-arm64-aes-neonbs-don-t-access-already-freed-walk.iv.patch @@ -0,0 +1,38 @@ +From: Eric Biggers +Date: Tue, 9 Apr 2019 23:46:32 -0700 +Subject: crypto: arm64/aes-neonbs - don't access already-freed walk.iv +Git-commit: 4a8108b70508df0b6c4ffa4a3974dab93dcbe851 +Patch-mainline: v5.2-rc1 +References: git-fixes + +If the user-provided IV needs to be aligned to the algorithm's +alignmask, then skcipher_walk_virt() copies the IV into a new aligned +buffer walk.iv. But skcipher_walk_virt() can fail afterwards, and then +if the caller unconditionally accesses walk.iv, it's a use-after-free. + +xts-aes-neonbs doesn't set an alignmask, so currently it isn't affected +by this despite unconditionally accessing walk.iv. However this is more +subtle than desired, and unconditionally accessing walk.iv has caused a +real problem in other algorithms. Thus, update xts-aes-neonbs to start +checking the return value of skcipher_walk_virt(). + +Fixes: 1abee99eafab ("crypto: arm64/aes - reimplement bit-sliced ARM/NEON implementation for arm64") +Cc: # v4.11+ +Signed-off-by: Eric Biggers +Signed-off-by: Herbert Xu +Acked-by: Ivan T. Ivanov +--- + arch/arm64/crypto/aes-neonbs-glue.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm64/crypto/aes-neonbs-glue.c ++++ b/arch/arm64/crypto/aes-neonbs-glue.c +@@ -307,6 +307,8 @@ static int __xts_crypt(struct skcipher_r + int err; + + err = skcipher_walk_virt(&walk, req, true); ++ if (err) ++ return err; + + kernel_neon_begin(); + diff --git a/patches.suse/crypto-ixp4xx-dma_unmap-the-correct-address.patch b/patches.suse/crypto-ixp4xx-dma_unmap-the-correct-address.patch new file mode 100644 index 0000000..e234ebd --- /dev/null +++ b/patches.suse/crypto-ixp4xx-dma_unmap-the-correct-address.patch @@ -0,0 +1,38 @@ +From 9395c58fdddd79cdd3882132cdd04e8ac7ad525f Mon Sep 17 00:00:00 2001 +From: Corentin Labbe +Date: Wed, 5 May 2021 20:26:08 +0000 +Subject: [PATCH] crypto: ixp4xx - dma_unmap the correct address +Git-commit: 9395c58fdddd79cdd3882132cdd04e8ac7ad525f +Patch-mainline: v5.14-rc1 +References: git-fixes + +Testing ixp4xx_crypto with CONFIG_DMA_API_DEBUG lead to the following error: +Dma-api: platform ixp4xx_crypto.0: device driver tries to free DMA memory it has not allocated [device address=0x0000000000000000] [size=24 bytes] + +This is due to dma_unmap using the wrong address. + +Fixes: 0d44dc59b2b4 ("crypto: ixp4xx - Fix handling of chained sg buffers") +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Torsten Duwe + +--- + drivers/crypto/ixp4xx_crypto.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c +index 0616e369522e9..ed3deaa5ed2b8 100644 +--- a/drivers/crypto/ixp4xx_crypto.c ++++ b/drivers/crypto/ixp4xx_crypto.c +@@ -330,7 +330,7 @@ static void free_buf_chain(struct device *dev, struct buffer_desc *buf, + + buf1 = buf->next; + phys1 = buf->phys_next; +- dma_unmap_single(dev, buf->phys_next, buf->buf_len, buf->dir); ++ dma_unmap_single(dev, buf->phys_addr, buf->buf_len, buf->dir); + dma_pool_free(buffer_pool, buf, phys); + buf = buf1; + phys = phys1; +-- +2.35.3 + diff --git a/patches.suse/crypto-qat-don-t-cast-parameter-in-bit-operations.patch b/patches.suse/crypto-qat-don-t-cast-parameter-in-bit-operations.patch new file mode 100644 index 0000000..ed02dda --- /dev/null +++ b/patches.suse/crypto-qat-don-t-cast-parameter-in-bit-operations.patch @@ -0,0 +1,50 @@ +From fffe799b6cc980f967df2f3773dc53639dd68d7e Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Wed, 9 Feb 2022 20:00:47 +0200 +Subject: [PATCH] crypto: qat - don't cast parameter in bit operations +Git-commit: fffe799b6cc980f967df2f3773dc53639dd68d7e +Patch-mainline: v5.18-rc1 +References: git-fixes + +While in this particular case it would not be a (critical) issue, +the pattern itself is bad and error prone in case the location +of the parameter is changed. + +Don't cast parameter to unsigned long pointer in the bit operations. +Instead copy to a local variable on stack of a proper type and use. + +Fixes: b4b7e67c917f ("crypto: qat - Intel(R) QAT ucode part of fw loader") +Signed-off-by: Andy Shevchenko +Reviewed-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Torsten Duwe + +--- + drivers/crypto/qat/qat_common/qat_uclo.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/crypto/qat/qat_common/qat_uclo.c ++++ b/drivers/crypto/qat/qat_common/qat_uclo.c +@@ -429,7 +429,9 @@ static int qat_uclo_init_ustore(struct i + page = image->page; + + for (ae = 0; ae < handle->hal_handle->ae_max_num; ae++) { +- if (!test_bit(ae, (unsigned long *)&uof_image->ae_assigned)) ++ unsigned long ae_assigned = uof_image->ae_assigned; ++ ++ if (!test_bit(ae, &ae_assigned)) + continue; + ustore_size = obj_handle->ae_data[ae].eff_ustore_size; + patt_pos = page->beg_addr_p + page->micro_words_num; +@@ -698,8 +700,9 @@ static int qat_uclo_map_ae(struct icp_qa + (unsigned long *)&handle->hal_handle->ae_mask)) + continue; + for (i = 0; i < obj_handle->uimage_num; i++) { +- if (!test_bit(ae, (unsigned long *) +- &obj_handle->ae_uimage[i].img_ptr->ae_assigned)) ++ unsigned long ae_assigned = obj_handle->ae_uimage[i].img_ptr->ae_assigned; ++ ++ if (!test_bit(ae, &ae_assigned)) + continue; + mflag = 1; + if (qat_uclo_init_ae_data(obj_handle, ae, i)) diff --git a/patches.suse/crypto-rsa-pkcs1pad-fix-buffer-overread-in-pkcs1pad_.patch b/patches.suse/crypto-rsa-pkcs1pad-fix-buffer-overread-in-pkcs1pad_.patch new file mode 100644 index 0000000..d1f9fa6 --- /dev/null +++ b/patches.suse/crypto-rsa-pkcs1pad-fix-buffer-overread-in-pkcs1pad_.patch @@ -0,0 +1,33 @@ +From a24611ea356c7f3f0ec926da11b9482ac1f414fd Mon Sep 17 00:00:00 2001 +From: Eric Biggers +Date: Tue, 18 Jan 2022 16:13:05 -0800 +Subject: [PATCH] crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() +Git-commit: a24611ea356c7f3f0ec926da11b9482ac1f414fd +Patch-mainline: v5.18-rc1 +References: bsc#1197601 + +Before checking whether the expected digest_info is present, we need to +check that there are enough bytes remaining. + +Fixes: a49de377e051 ("crypto: Add hash param to pkcs1pad") +Cc: # v4.6+ +Cc: Tadeusz Struk +Signed-off-by: Eric Biggers +Signed-off-by: Herbert Xu +Acked-by: Takashi Iwai + +--- + crypto/rsa-pkcs1pad.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/crypto/rsa-pkcs1pad.c ++++ b/crypto/rsa-pkcs1pad.c +@@ -481,6 +481,8 @@ static int pkcs1pad_verify_complete(stru + goto done; + pos++; + ++ if (digest_info->size > dst_len - pos) ++ goto done; + if (crypto_memneq(out_buf + pos, digest_info->data, digest_info->size)) + goto done; + diff --git a/patches.suse/crypto-virtio-Fix-dest-length-calculation-in-__virti.patch b/patches.suse/crypto-virtio-Fix-dest-length-calculation-in-__virti.patch new file mode 100644 index 0000000..4ed811d --- /dev/null +++ b/patches.suse/crypto-virtio-Fix-dest-length-calculation-in-__virti.patch @@ -0,0 +1,51 @@ +From d90ca42012db2863a9a30b564a2ace6016594bda Mon Sep 17 00:00:00 2001 +From: "Longpeng(Mike)" +Date: Tue, 2 Jun 2020 15:05:01 +0800 +Subject: [PATCH] crypto: virtio: Fix dest length calculation in + __virtio_crypto_skcipher_do_req() +Git-commit: d90ca42012db2863a9a30b564a2ace6016594bda +Patch-mainline: v5.8-rc1 +References: git-fixes + +The src/dst length is not aligned with AES_BLOCK_SIZE(which is 16) in some +testcases in tcrypto.ko. + +For example, the src/dst length of one of cts(cbc(aes))'s testcase is 17, the +crypto_virtio driver will set @src_data_len=16 but @dst_data_len=17 in this +case and get a wrong at then end. + + SRC: pp pp pp pp pp pp pp pp pp pp pp pp pp pp pp pp pp (17 bytes) + EXP: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc pp (17 bytes) + DST: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 00 (pollute the last bytes) + (pp: plaintext cc:ciphertext) + +Fix this issue by limit the length of dest buffer. + +Fixes: dbaf0624ffa5 ("crypto: add virtio-crypto driver") +Cc: Gonglei +Cc: Herbert Xu +Cc: "Michael S. Tsirkin" +Cc: Jason Wang +Cc: "David S. Miller" +Cc: virtualization@lists.linux-foundation.org +Cc: linux-kernel@vger.kernel.org +Cc: stable@vger.kernel.org +Signed-off-by: Longpeng(Mike) +Link: https://lore.kernel.org/r/20200602070501.2023-4-longpeng2@huawei.com +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Torsten Duwe + +--- + drivers/crypto/virtio/virtio_crypto_algs.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/crypto/virtio/virtio_crypto_algs.c ++++ b/drivers/crypto/virtio/virtio_crypto_algs.c +@@ -366,6 +366,7 @@ __virtio_crypto_ablkcipher_do_req(struct + goto free; + } + ++ dst_len = min_t(unsigned int, req->nbytes, dst_len); + pr_debug("virtio_crypto: src_len: %u, dst_len: %llu\n", + req->nbytes, dst_len); + diff --git a/patches.suse/crypto-virtio-deal-with-unsupported-input-sizes.patch b/patches.suse/crypto-virtio-deal-with-unsupported-input-sizes.patch new file mode 100644 index 0000000..aa07bbe --- /dev/null +++ b/patches.suse/crypto-virtio-deal-with-unsupported-input-sizes.patch @@ -0,0 +1,62 @@ +From 19c5da7d4a2662e85ea67d2d81df57e038fde3ab Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Sat, 9 Nov 2019 18:09:27 +0100 +Subject: [PATCH] crypto: virtio - deal with unsupported input sizes +Git-commit: 19c5da7d4a2662e85ea67d2d81df57e038fde3ab +Patch-mainline: v5.5-rc1 +References: git-fixes + +Return -EINVAL for input sizes that are not a multiple of the AES +block size, since they are not supported by our CBC chaining mode. + +While at it, remove the pr_err() that reports unsupported key sizes +being used: we shouldn't spam the kernel log with that. + +Fixes: dbaf0624ffa5 ("crypto: add virtio-crypto driver") +Cc: "Michael S. Tsirkin" +Cc: Jason Wang +Cc: Gonglei +Cc: virtualization@lists.linux-foundation.org +Signed-off-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Torsten Duwe + +--- + drivers/crypto/virtio/virtio_crypto_algs.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/crypto/virtio/virtio_crypto_algs.c ++++ b/drivers/crypto/virtio/virtio_crypto_algs.c +@@ -60,8 +60,6 @@ virtio_crypto_alg_validate_key(int key_l + *alg = VIRTIO_CRYPTO_CIPHER_AES_CBC; + break; + default: +- pr_err("virtio_crypto: Unsupported key length: %d\n", +- key_len); + return -EINVAL; + } + return 0; +@@ -438,6 +436,11 @@ static int virtio_crypto_ablkcipher_encr + /* Use the first data virtqueue as default */ + struct data_queue *data_vq = &vcrypto->data_vq[0]; + ++ if (!req->nbytes) ++ return 0; ++ if (req->nbytes % AES_BLOCK_SIZE) ++ return -EINVAL; ++ + vc_req->ablkcipher_ctx = ctx; + vc_req->ablkcipher_req = req; + vc_req->encrypt = true; +@@ -455,6 +458,11 @@ static int virtio_crypto_ablkcipher_decr + /* Use the first data virtqueue as default */ + struct data_queue *data_vq = &vcrypto->data_vq[0]; + ++ if (!req->nbytes) ++ return 0; ++ if (req->nbytes % AES_BLOCK_SIZE) ++ return -EINVAL; ++ + vc_req->ablkcipher_ctx = ctx; + vc_req->ablkcipher_req = req; + diff --git a/patches.suse/debug-Lock-down-kgdb.patch b/patches.suse/debug-Lock-down-kgdb.patch new file mode 100644 index 0000000..e7731ab --- /dev/null +++ b/patches.suse/debug-Lock-down-kgdb.patch @@ -0,0 +1,33 @@ +From 2e8fe68c27cd6087603a27b967a78f77c3a7d637 Mon Sep 17 00:00:00 2001 +From: Stephen Brennan +Date: Thu, 14 Apr 2022 13:27:45 -0700 +Subject: [PATCH] debug: Lock down kgdb + +Patch-mainline: Not yet, EMBARGOED +References: bsc#1199426 + +KGDB and KDB allow read and write access to kernel memory, and thus +should not be allowed during lockdown. An attacker with access to a +serial port (for example, via a hypervisor console, which some cloud +vendors provide over the network) could trigger the debugger and use it +to bypass lockdown. Ensure KDB and KGDB cannot be used during lockdown. + +This fixes CVE-2022-21499. + +Signed-off-by: Stephen Brennan +Signed-off-by: Lee, Chun-Yi +--- + kernel/debug/debug_core.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/kernel/debug/debug_core.c ++++ b/kernel/debug/debug_core.c +@@ -621,6 +621,8 @@ return_normal: + + while (1) { + cpu_master_loop: ++ if (kernel_is_locked_down()) ++ break; + if (dbg_kdb_mode) { + kgdb_connected = 1; + error = kdb_stub(ks); diff --git a/patches.suse/drbd-Fix-five-use-after-free-bugs-in-get_initial_state b/patches.suse/drbd-Fix-five-use-after-free-bugs-in-get_initial_state new file mode 100644 index 0000000..3895626 --- /dev/null +++ b/patches.suse/drbd-Fix-five-use-after-free-bugs-in-get_initial_state @@ -0,0 +1,340 @@ +From: Lv Yunlong +Date: Wed, 6 Apr 2022 21:04:43 +0200 +Subject: drbd: Fix five use after free bugs in get_initial_state +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Git-commit: aadb22ba2f656581b2f733deb3a467c48cc618f6 +Patch-mainline: v5.18-rc2 +References: git-fixes + +In get_initial_state, it calls notify_initial_state_done(skb,..) if +cb->args[5]==1. If genlmsg_put() failed in notify_initial_state_done(), +the skb will be freed by nlmsg_free(skb). +Then get_initial_state will goto out and the freed skb will be used by +return value skb->len, which is a uaf bug. + +What's worse, the same problem goes even further: skb can also be +freed in the notify_*_state_change -> notify_*_state calls below. +Thus 4 additional uaf bugs happened. + +My patch lets the problem callee functions: notify_initial_state_done +and notify_*_state_change return an error code if errors happen. +So that the error codes could be propagated and the uaf bugs can be avoid. + +v2 reports a compilation warning. This v3 fixed this warning and built +successfully in my local environment with no additional warnings. +v2: https://lore.kernel.org/patchwork/patch/1435218/ + +Fixes: a29728463b254 ("drbd: Backport the "events2" command") +Signed-off-by: Lv Yunlong +Reviewed-by: Christoph Böhmwalder +Signed-off-by: Jens Axboe +Acked-by: Lee Duncan +--- + drivers/block/drbd/drbd_int.h | 8 +++---- + drivers/block/drbd/drbd_nl.c | 41 +++++++++++++++++++++------------- + drivers/block/drbd/drbd_state.c | 18 +++++++-------- + drivers/block/drbd/drbd_state_change.h | 8 +++---- + 4 files changed, 42 insertions(+), 33 deletions(-) + +diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h +index 4b55e864a0a3..4d3efaa20b7b 100644 +--- a/drivers/block/drbd/drbd_int.h ++++ b/drivers/block/drbd/drbd_int.h +@@ -1638,22 +1638,22 @@ struct sib_info { + }; + void drbd_bcast_event(struct drbd_device *device, const struct sib_info *sib); + +-extern void notify_resource_state(struct sk_buff *, ++extern int notify_resource_state(struct sk_buff *, + unsigned int, + struct drbd_resource *, + struct resource_info *, + enum drbd_notification_type); +-extern void notify_device_state(struct sk_buff *, ++extern int notify_device_state(struct sk_buff *, + unsigned int, + struct drbd_device *, + struct device_info *, + enum drbd_notification_type); +-extern void notify_connection_state(struct sk_buff *, ++extern int notify_connection_state(struct sk_buff *, + unsigned int, + struct drbd_connection *, + struct connection_info *, + enum drbd_notification_type); +-extern void notify_peer_device_state(struct sk_buff *, ++extern int notify_peer_device_state(struct sk_buff *, + unsigned int, + struct drbd_peer_device *, + struct peer_device_info *, +diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c +index 02030c9c4d3b..b7216c186ba4 100644 +--- a/drivers/block/drbd/drbd_nl.c ++++ b/drivers/block/drbd/drbd_nl.c +@@ -4549,7 +4549,7 @@ static int nla_put_notification_header(struct sk_buff *msg, + return drbd_notification_header_to_skb(msg, &nh, true); + } + +-void notify_resource_state(struct sk_buff *skb, ++int notify_resource_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_resource *resource, + struct resource_info *resource_info, +@@ -4591,16 +4591,17 @@ void notify_resource_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(resource, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + +-void notify_device_state(struct sk_buff *skb, ++int notify_device_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_device *device, + struct device_info *device_info, +@@ -4640,16 +4641,17 @@ void notify_device_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(device, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + +-void notify_connection_state(struct sk_buff *skb, ++int notify_connection_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_connection *connection, + struct connection_info *connection_info, +@@ -4689,16 +4691,17 @@ void notify_connection_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(connection, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + +-void notify_peer_device_state(struct sk_buff *skb, ++int notify_peer_device_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_peer_device *peer_device, + struct peer_device_info *peer_device_info, +@@ -4739,13 +4742,14 @@ void notify_peer_device_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(peer_device, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + + void notify_helper(enum drbd_notification_type type, +@@ -4796,7 +4800,7 @@ void notify_helper(enum drbd_notification_type type, + err, seq); + } + +-static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) ++static int notify_initial_state_done(struct sk_buff *skb, unsigned int seq) + { + struct drbd_genlmsghdr *dh; + int err; +@@ -4810,11 +4814,12 @@ static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) + if (nla_put_notification_header(skb, NOTIFY_EXISTS)) + goto nla_put_failure; + genlmsg_end(skb, dh); +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + pr_err("Error %d sending event. Event seq:%u\n", err, seq); ++ return err; + } + + static void free_state_changes(struct list_head *list) +@@ -4841,6 +4846,7 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) + unsigned int seq = cb->args[2]; + unsigned int n; + enum drbd_notification_type flags = 0; ++ int err = 0; + + /* There is no need for taking notification_mutex here: it doesn't + matter if the initial state events mix with later state chage +@@ -4849,32 +4855,32 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) + + cb->args[5]--; + if (cb->args[5] == 1) { +- notify_initial_state_done(skb, seq); ++ err = notify_initial_state_done(skb, seq); + goto out; + } + n = cb->args[4]++; + if (cb->args[4] < cb->args[3]) + flags |= NOTIFY_CONTINUES; + if (n < 1) { +- notify_resource_state_change(skb, seq, state_change->resource, ++ err = notify_resource_state_change(skb, seq, state_change->resource, + NOTIFY_EXISTS | flags); + goto next; + } + n--; + if (n < state_change->n_connections) { +- notify_connection_state_change(skb, seq, &state_change->connections[n], ++ err = notify_connection_state_change(skb, seq, &state_change->connections[n], + NOTIFY_EXISTS | flags); + goto next; + } + n -= state_change->n_connections; + if (n < state_change->n_devices) { +- notify_device_state_change(skb, seq, &state_change->devices[n], ++ err = notify_device_state_change(skb, seq, &state_change->devices[n], + NOTIFY_EXISTS | flags); + goto next; + } + n -= state_change->n_devices; + if (n < state_change->n_devices * state_change->n_connections) { +- notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], ++ err = notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], + NOTIFY_EXISTS | flags); + goto next; + } +@@ -4889,7 +4895,10 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) + cb->args[4] = 0; + } + out: +- return skb->len; ++ if (err) ++ return err; ++ else ++ return skb->len; + } + + int drbd_adm_get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) +diff --git a/drivers/block/drbd/drbd_state.c b/drivers/block/drbd/drbd_state.c +index b8a27818ab3f..4ee11aef6672 100644 +--- a/drivers/block/drbd/drbd_state.c ++++ b/drivers/block/drbd/drbd_state.c +@@ -1537,7 +1537,7 @@ int drbd_bitmap_io_from_worker(struct drbd_device *device, + return rv; + } + +-void notify_resource_state_change(struct sk_buff *skb, ++int notify_resource_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_resource_state_change *resource_state_change, + enum drbd_notification_type type) +@@ -1550,10 +1550,10 @@ void notify_resource_state_change(struct sk_buff *skb, + .res_susp_fen = resource_state_change->susp_fen[NEW], + }; + +- notify_resource_state(skb, seq, resource, &resource_info, type); ++ return notify_resource_state(skb, seq, resource, &resource_info, type); + } + +-void notify_connection_state_change(struct sk_buff *skb, ++int notify_connection_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_connection_state_change *connection_state_change, + enum drbd_notification_type type) +@@ -1564,10 +1564,10 @@ void notify_connection_state_change(struct sk_buff *skb, + .conn_role = connection_state_change->peer_role[NEW], + }; + +- notify_connection_state(skb, seq, connection, &connection_info, type); ++ return notify_connection_state(skb, seq, connection, &connection_info, type); + } + +-void notify_device_state_change(struct sk_buff *skb, ++int notify_device_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_device_state_change *device_state_change, + enum drbd_notification_type type) +@@ -1577,10 +1577,10 @@ void notify_device_state_change(struct sk_buff *skb, + .dev_disk_state = device_state_change->disk_state[NEW], + }; + +- notify_device_state(skb, seq, device, &device_info, type); ++ return notify_device_state(skb, seq, device, &device_info, type); + } + +-void notify_peer_device_state_change(struct sk_buff *skb, ++int notify_peer_device_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_peer_device_state_change *p, + enum drbd_notification_type type) +@@ -1594,7 +1594,7 @@ void notify_peer_device_state_change(struct sk_buff *skb, + .peer_resync_susp_dependency = p->resync_susp_dependency[NEW], + }; + +- notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); ++ return notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); + } + + static void broadcast_state_change(struct drbd_state_change *state_change) +@@ -1602,7 +1602,7 @@ static void broadcast_state_change(struct drbd_state_change *state_change) + struct drbd_resource_state_change *resource_state_change = &state_change->resource[0]; + bool resource_state_has_changed; + unsigned int n_device, n_connection, n_peer_device, n_peer_devices; +- void (*last_func)(struct sk_buff *, unsigned int, void *, ++ int (*last_func)(struct sk_buff *, unsigned int, void *, + enum drbd_notification_type) = NULL; + void *last_arg = NULL; + +diff --git a/drivers/block/drbd/drbd_state_change.h b/drivers/block/drbd/drbd_state_change.h +index ba80f612d6ab..d5b0479bc9a6 100644 +--- a/drivers/block/drbd/drbd_state_change.h ++++ b/drivers/block/drbd/drbd_state_change.h +@@ -44,19 +44,19 @@ extern struct drbd_state_change *remember_old_state(struct drbd_resource *, gfp_ + extern void copy_old_to_new_state_change(struct drbd_state_change *); + extern void forget_state_change(struct drbd_state_change *); + +-extern void notify_resource_state_change(struct sk_buff *, ++extern int notify_resource_state_change(struct sk_buff *, + unsigned int, + struct drbd_resource_state_change *, + enum drbd_notification_type type); +-extern void notify_connection_state_change(struct sk_buff *, ++extern int notify_connection_state_change(struct sk_buff *, + unsigned int, + struct drbd_connection_state_change *, + enum drbd_notification_type type); +-extern void notify_device_state_change(struct sk_buff *, ++extern int notify_device_state_change(struct sk_buff *, + unsigned int, + struct drbd_device_state_change *, + enum drbd_notification_type type); +-extern void notify_peer_device_state_change(struct sk_buff *, ++extern int notify_peer_device_state_change(struct sk_buff *, + unsigned int, + struct drbd_peer_device_state_change *, + enum drbd_notification_type type); + diff --git a/patches.suse/drbd-fix-an-invalid-memory-access-caused-by-incorrect-use-of-list-iterator b/patches.suse/drbd-fix-an-invalid-memory-access-caused-by-incorrect-use-of-list-iterator new file mode 100644 index 0000000..54a5178 --- /dev/null +++ b/patches.suse/drbd-fix-an-invalid-memory-access-caused-by-incorrect-use-of-list-iterator @@ -0,0 +1,58 @@ +From: Xiaomeng Tong +Date: Wed, 6 Apr 2022 21:04:44 +0200 +Subject: drbd: fix an invalid memory access caused by incorrect use of list + iterator +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Git-commit: ae4d37b5df749926891583d42a6801b5da11e3c1 +Patch-mainline: v5.18-rc2 +References: git-fixes + +The bug is here: + idr_remove(&connection->peer_devices, vnr); + +If the previous for_each_connection() don't exit early (no goto hit +inside the loop), the iterator 'connection' after the loop will be a +bogus pointer to an invalid structure object containing the HEAD +(&resource->connections). As a result, the use of 'connection' above +will lead to a invalid memory access (including a possible invalid free +as idr_remove could call free_layer). + +The original intention should have been to remove all peer_devices, +but the following lines have already done the work. So just remove +this line and the unneeded label, to fix this bug. + +[lduncan: hand applied then refreshed.] + +Cc: stable@vger.kernel.org +Fixes: c06ece6ba6f1b ("drbd: Turn connection->volumes into connection->peer_devices") +Signed-off-by: Xiaomeng Tong +Reviewed-by: Christoph Böhmwalder +Reviewed-by: Lars Ellenberg +Signed-off-by: Jens Axboe +Acked-by: Lee Duncan +--- + drivers/block/drbd/drbd_main.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/block/drbd/drbd_main.c ++++ b/drivers/block/drbd/drbd_main.c +@@ -2880,7 +2880,7 @@ enum drbd_ret_code drbd_create_device(st + + if (init_submitter(device)) { + err = ERR_NOMEM; +- goto out_idr_remove_vol; ++ goto out_idr_remove_from_resource; + } + + add_disk(disk); +@@ -2897,8 +2897,6 @@ enum drbd_ret_code drbd_create_device(st + drbd_debugfs_device_add(device); + return NO_ERROR; + +-out_idr_remove_vol: +- idr_remove(&connection->peer_devices, vnr); + out_idr_remove_from_resource: + for_each_connection(connection, resource) { + peer_device = idr_remove(&connection->peer_devices, vnr); diff --git a/patches.suse/drivers-net-xgene-Fix-regression-in-CRC-stripping.patch b/patches.suse/drivers-net-xgene-Fix-regression-in-CRC-stripping.patch new file mode 100644 index 0000000..381ec6c --- /dev/null +++ b/patches.suse/drivers-net-xgene-Fix-regression-in-CRC-stripping.patch @@ -0,0 +1,61 @@ +From e38c4be3b2ef3cc240450b27b6df3f35a4be3d3a Mon Sep 17 00:00:00 2001 +From: Stephane Graber +Date: Tue, 22 Mar 2022 18:42:06 -0400 +Subject: [PATCH 7/8] drivers: net: xgene: Fix regression in CRC stripping +Git-commit: e9e6faeafaa00da1851bcf47912b0f1acae666b4 +Patch-mainline: v5.18-rc1 +References: git-fixes + +All packets on ingress (except for jumbo) are terminated with a 4-bytes +CRC checksum. It's the responsability of the driver to strip those 4 +bytes. Unfortunately a change dating back to March 2017 re-shuffled some +code and made the CRC stripping code effectively dead. + +This change re-orders that part a bit such that the datalen is +immediately altered if needed. + +Fixes: 4902a92270fb ("drivers: net: xgene: Add workaround for errata 10GE_8/ENET_11") +Cc: stable@vger.kernel.org +Signed-off-by: Stephane Graber +Tested-by: Stephane Graber +Link: https://lore.kernel.org/r/20220322224205.752795-1-stgraber@ubuntu.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c +index 2123046fd853..4f7ef1dceba5 100644 +--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c ++++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c +@@ -710,6 +710,12 @@ static int xgene_enet_rx_frame(struct xgene_enet_desc_ring *rx_ring, + buf_pool->rx_skb[skb_index] = NULL; + + datalen = xgene_enet_get_data_len(le64_to_cpu(raw_desc->m1)); ++ ++ /* strip off CRC as HW isn't doing this */ ++ nv = GET_VAL(NV, le64_to_cpu(raw_desc->m0)); ++ if (!nv) ++ datalen -= 4; ++ + skb_put(skb, datalen); + prefetch(skb->data - NET_IP_ALIGN); + skb->protocol = eth_type_trans(skb, ndev); +@@ -731,12 +737,8 @@ static int xgene_enet_rx_frame(struct xgene_enet_desc_ring *rx_ring, + } + } + +- nv = GET_VAL(NV, le64_to_cpu(raw_desc->m0)); +- if (!nv) { +- /* strip off CRC as HW isn't doing this */ +- datalen -= 4; ++ if (!nv) + goto skip_jumbo; +- } + + slots = page_pool->slots - 1; + head = page_pool->head; +-- +2.16.4 + diff --git a/patches.suse/drm-ttm-nouveau-don-t-call-tt-destroy-callback-on-al.patch b/patches.suse/drm-ttm-nouveau-don-t-call-tt-destroy-callback-on-al.patch index 4eb8967..c7fc2c9 100644 --- a/patches.suse/drm-ttm-nouveau-don-t-call-tt-destroy-callback-on-al.patch +++ b/patches.suse/drm-ttm-nouveau-don-t-call-tt-destroy-callback-on-al.patch @@ -7,7 +7,7 @@ Content-type: text/plain; charset=UTF-8 Content-transfer-encoding: 8bit Git-commit: 5de5b6ecf97a021f29403aa272cb4e03318ef586 Patch-mainline: v5.9-rc1 -References: bsc#1175232 +References: bsc#1175232 bsc#1183723 CVE-2021-20292 This is confusing, and from my reading of all the drivers only nouveau got this right. diff --git a/patches.suse/edac-amd64-add-family-ops-for-family-19h-models-00h-0fh.patch b/patches.suse/edac-amd64-add-family-ops-for-family-19h-models-00h-0fh.patch index 6dee3f9..5ee3ac8 100644 --- a/patches.suse/edac-amd64-add-family-ops-for-family-19h-models-00h-0fh.patch +++ b/patches.suse/edac-amd64-add-family-ops-for-family-19h-models-00h-0fh.patch @@ -13,13 +13,13 @@ Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov Link: https://lkml.kernel.org/r/20200110015651.14887-5-Yazen.Ghannam@amd.com --- - drivers/edac/amd64_edac.c | 16 ++++++++++++++++ + drivers/edac/amd64_edac.c | 17 +++++++++++++++++ drivers/edac/amd64_edac.h | 3 +++ - 2 files changed, 19 insertions(+) + 2 files changed, 20 insertions(+) --- a/drivers/edac/amd64_edac.c +++ b/drivers/edac/amd64_edac.c -@@ -2316,6 +2316,15 @@ static struct amd64_family_type family_t +@@ -2325,6 +2325,16 @@ static struct amd64_family_type family_t .dbam_to_cs = f17_addr_mask_to_cs_size, } }, @@ -27,6 +27,7 @@ Link: https://lkml.kernel.org/r/20200110015651.14887-5-Yazen.Ghannam@amd.com + .ctl_name = "F19h", + .f0_id = PCI_DEVICE_ID_AMD_19H_DF_F0, + .f6_id = PCI_DEVICE_ID_AMD_19H_DF_F6, ++ .max_mcs = 8, + .ops = { + .early_channel_count = f17_early_channel_count, + .dbam_to_cs = f17_addr_mask_to_cs_size, @@ -35,7 +36,7 @@ Link: https://lkml.kernel.org/r/20200110015651.14887-5-Yazen.Ghannam@amd.com }; /* -@@ -3365,6 +3374,12 @@ static struct amd64_family_type *per_fam +@@ -3371,6 +3381,12 @@ static struct amd64_family_type *per_fam family_types[F17_CPUS].ctl_name = "F18h"; break; @@ -48,7 +49,7 @@ Link: https://lkml.kernel.org/r/20200110015651.14887-5-Yazen.Ghannam@amd.com default: amd64_err("Unsupported family!\n"); return NULL; -@@ -3624,6 +3639,7 @@ static const struct x86_cpu_id amd64_cpu +@@ -3608,6 +3624,7 @@ static const struct x86_cpu_id amd64_cpu { X86_VENDOR_AMD, 0x16, X86_MODEL_ANY, X86_FEATURE_ANY, 0 }, { X86_VENDOR_AMD, 0x17, X86_MODEL_ANY, X86_FEATURE_ANY, 0 }, { X86_VENDOR_HYGON, 0x18, X86_MODEL_ANY, X86_FEATURE_ANY, 0 }, diff --git a/patches.suse/elfcore-correct-reference-to-CONFIG_UML.patch b/patches.suse/elfcore-correct-reference-to-CONFIG_UML.patch deleted file mode 100644 index eb3dc3e..0000000 --- a/patches.suse/elfcore-correct-reference-to-CONFIG_UML.patch +++ /dev/null @@ -1,54 +0,0 @@ -From: Lukas Bulwahn -Date: Mon, 18 Oct 2021 15:16:09 -0700 -Subject: elfcore: correct reference to CONFIG_UML -Git-commit: b0e901280d9860a0a35055f220e8e457f300f40a -Patch-mainline: v5.15-rc7 -References: git-fixes - -Commit 6e7b64b9dd6d ("elfcore: fix building with clang") introduces -special handling for two architectures, ia64 and User Mode Linux. -However, the wrong name, i.e., CONFIG_UM, for the intended Kconfig -symbol for User-Mode Linux was used. - -Although the directory for User Mode Linux is ./arch/um; the Kconfig -symbol for this architecture is called CONFIG_UML. - -Luckily, ./scripts/checkkconfigsymbols.py warns on non-existing configs: - - UM - Referencing files: include/linux/elfcore.h - Similar symbols: UML, NUMA - -Correct the name of the config to the intended one. - -[akpm@linux-foundation.org: fix um/x86_64, per Catalin] - Link: https://lkml.kernel.org/r/20211006181119.2851441-1-catalin.marinas@arm.com - Link: https://lkml.kernel.org/r/YV6pejGzLy5ppEpt@arm.com - -Link: https://lkml.kernel.org/r/20211006082209.417-1-lukas.bulwahn@gmail.com -Fixes: 6e7b64b9dd6d ("elfcore: fix building with clang") -Signed-off-by: Lukas Bulwahn -Cc: Arnd Bergmann -Cc: Nathan Chancellor -Cc: Nick Desaulniers -Cc: Catalin Marinas -Cc: Barret Rhoden -Cc: -Signed-off-by: Andrew Morton -Signed-off-by: Linus Torvalds -Acked-by: Miroslav Benes ---- - include/linux/elfcore.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/include/linux/elfcore.h -+++ b/include/linux/elfcore.h -@@ -57,7 +57,7 @@ static inline int elf_core_copy_task_xfp - } - #endif - --#if defined(CONFIG_UM) || defined(CONFIG_IA64) -+#if (defined(CONFIG_UML) && defined(CONFIG_X86_32)) || defined(CONFIG_IA64) - /* - * These functions parameterize elf_core_dump in fs/binfmt_elf.c to write out - * extra segments containing the gate DSO contents. Dumping its diff --git a/patches.suse/elfcore-fix-building-with-clang.patch b/patches.suse/elfcore-fix-building-with-clang.patch deleted file mode 100644 index b274120..0000000 --- a/patches.suse/elfcore-fix-building-with-clang.patch +++ /dev/null @@ -1,105 +0,0 @@ -From: Arnd Bergmann -Date: Fri, 11 Dec 2020 13:36:46 -0800 -Subject: elfcore: fix building with clang -Git-commit: 6e7b64b9dd6d96537d816ea07ec26b7dedd397b9 -Patch-mainline: v5.10 -References: bsc#1169514 - -kernel/elfcore.c only contains weak symbols, which triggers a bug with -clang in combination with recordmcount: - - Cannot find symbol for section 2: .text. - kernel/elfcore.o: failed - -Move the empty stubs into linux/elfcore.h as inline functions. As only -two architectures use these, just use the architecture specific Kconfig -symbols to key off the declaration. - -Link: https://lkml.kernel.org/r/20201204165742.3815221-2-arnd@kernel.org -Signed-off-by: Arnd Bergmann -Cc: Nathan Chancellor -Cc: Nick Desaulniers -Cc: Barret Rhoden -Signed-off-by: Andrew Morton -Signed-off-by: Linus Torvalds -Acked-by: Miroslav Benes ---- - include/linux/elfcore.h | 22 ++++++++++++++++++++++ - kernel/Makefile | 1 - - kernel/elfcore.c | 24 ------------------------ - 3 files changed, 22 insertions(+), 25 deletions(-) - ---- a/include/linux/elfcore.h -+++ b/include/linux/elfcore.h -@@ -57,6 +57,7 @@ static inline int elf_core_copy_task_xfp - } - #endif - -+#if defined(CONFIG_UM) || defined(CONFIG_IA64) - /* - * These functions parameterize elf_core_dump in fs/binfmt_elf.c to write out - * extra segments containing the gate DSO contents. Dumping its -@@ -71,5 +72,26 @@ elf_core_write_extra_phdrs(struct coredu - extern int - elf_core_write_extra_data(struct coredump_params *cprm); - extern size_t elf_core_extra_data_size(void); -+#else -+static inline Elf_Half elf_core_extra_phdrs(void) -+{ -+ return 0; -+} -+ -+static inline int elf_core_write_extra_phdrs(struct coredump_params *cprm, loff_t offset) -+{ -+ return 1; -+} -+ -+static inline int elf_core_write_extra_data(struct coredump_params *cprm) -+{ -+ return 1; -+} -+ -+static inline size_t elf_core_extra_data_size(void) -+{ -+ return 0; -+} -+#endif - - #endif /* _LINUX_ELFCORE_H */ ---- a/kernel/Makefile -+++ b/kernel/Makefile -@@ -90,7 +90,6 @@ obj-$(CONFIG_TASK_DELAY_ACCT) += delayac - obj-$(CONFIG_TASKSTATS) += taskstats.o tsacct.o - obj-$(CONFIG_TRACEPOINTS) += tracepoint.o - obj-$(CONFIG_LATENCYTOP) += latencytop.o --obj-$(CONFIG_ELFCORE) += elfcore.o - obj-$(CONFIG_FUNCTION_TRACER) += trace/ - obj-$(CONFIG_TRACING) += trace/ - obj-$(CONFIG_TRACE_CLOCK) += trace/ ---- a/kernel/elfcore.c -+++ /dev/null -@@ -1,24 +0,0 @@ --#include --#include --#include --#include -- --Elf_Half __weak elf_core_extra_phdrs(void) --{ -- return 0; --} -- --int __weak elf_core_write_extra_phdrs(struct coredump_params *cprm, loff_t offset) --{ -- return 1; --} -- --int __weak elf_core_write_extra_data(struct coredump_params *cprm) --{ -- return 1; --} -- --size_t __weak elf_core_extra_data_size(void) --{ -- return 0; --} diff --git a/patches.suse/ext4-avoid-cycles-in-directory-h-tree.patch b/patches.suse/ext4-avoid-cycles-in-directory-h-tree.patch new file mode 100644 index 0000000..e7e7c5c --- /dev/null +++ b/patches.suse/ext4-avoid-cycles-in-directory-h-tree.patch @@ -0,0 +1,81 @@ +From 3ba733f879c2a88910744647e41edeefbc0d92b2 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 18 May 2022 11:33:29 +0200 +Subject: [PATCH] ext4: avoid cycles in directory h-tree +Git-commit: 3ba733f879c2a88910744647e41edeefbc0d92b2 +Patch-mainline: v5.19-rc1 +References: bsc#1198577 CVE-2022-1184 + +A maliciously corrupted filesystem can contain cycles in the h-tree +stored inside a directory. That can easily lead to the kernel corrupting +tree nodes that were already verified under its hands while doing a node +split and consequently accessing unallocated memory. Fix the problem by +verifying traversed block numbers are unique. + +Cc: stable@vger.kernel.org +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20220518093332.13986-2-jack@suse.cz +Signed-off-by: Theodore Ts'o +Acked-by: Jan Kara + +--- + fs/ext4/namei.c | 22 +++++++++++++++++++--- + 1 file changed, 19 insertions(+), 3 deletions(-) + +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -734,12 +734,14 @@ static struct dx_frame * + dx_probe(struct ext4_filename *fname, struct inode *dir, + struct dx_hash_info *hinfo, struct dx_frame *frame_in) + { +- unsigned count, indirect; ++ unsigned count, indirect, level, i; + struct dx_entry *at, *entries, *p, *q, *m; + struct dx_root *root; + struct dx_frame *frame = frame_in; + struct dx_frame *ret_err = ERR_PTR(ERR_BAD_DX_DIR); + u32 hash; ++ ext4_lblk_t block; ++ ext4_lblk_t blocks[2]; + + frame->bh = ext4_read_dirblock(dir, 0, INDEX); + if (IS_ERR(frame->bh)) +@@ -788,6 +790,8 @@ dx_probe(struct ext4_filename *fname, st + } + + dxtrace(printk("Look up %x", hash)); ++ level = 0; ++ blocks[0] = 0; + while (1) { + count = dx_get_count(entries); + if (!count || count > dx_get_limit(entries)) { +@@ -829,15 +833,27 @@ dx_probe(struct ext4_filename *fname, st + dx_get_block(at))); + frame->entries = entries; + frame->at = at; +- if (!indirect--) ++ ++ block = dx_get_block(at); ++ for (i = 0; i <= level; i++) { ++ if (blocks[i] == block) { ++ ext4_warning_inode(dir, ++ "dx entry: tree cycle block %u points back to block %u", ++ blocks[level], block); ++ goto fail; ++ } ++ } ++ if (++level > indirect) + return frame; ++ blocks[level] = block; + frame++; +- frame->bh = ext4_read_dirblock(dir, dx_get_block(at), INDEX); ++ frame->bh = ext4_read_dirblock(dir, block, INDEX); + if (IS_ERR(frame->bh)) { + ret_err = (struct dx_frame *) frame->bh; + frame->bh = NULL; + goto fail; + } ++ + entries = ((struct dx_node *) frame->bh->b_data)->entries; + + if (dx_get_limit(entries) != dx_node_limit(dir)) { diff --git a/patches.suse/ext4-verify-dir-block-before-splitting-it.patch b/patches.suse/ext4-verify-dir-block-before-splitting-it.patch new file mode 100644 index 0000000..854ff40 --- /dev/null +++ b/patches.suse/ext4-verify-dir-block-before-splitting-it.patch @@ -0,0 +1,88 @@ +From 46c116b920ebec58031f0a78c5ea9599b0d2a371 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 18 May 2022 11:33:28 +0200 +Subject: [PATCH] ext4: verify dir block before splitting it +Git-commit: 46c116b920ebec58031f0a78c5ea9599b0d2a371 +Patch-mainline: v5.19-rc1 +References: bsc#1198577 CVE-2022-1184 + +Before splitting a directory block verify its directory entries are sane +so that the splitting code does not access memory it should not. + +Cc: stable@vger.kernel.org +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20220518093332.13986-1-jack@suse.cz +Signed-off-by: Theodore Ts'o +Acked-by: Jan Kara + +--- + fs/ext4/namei.c | 32 +++++++++++++++++++++----------- + 1 file changed, 21 insertions(+), 11 deletions(-) + +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -258,9 +258,9 @@ static struct dx_frame *dx_probe(struct + struct dx_hash_info *hinfo, + struct dx_frame *frame); + static void dx_release(struct dx_frame *frames); +-static int dx_make_map(struct inode *dir, struct ext4_dir_entry_2 *de, +- unsigned blocksize, struct dx_hash_info *hinfo, +- struct dx_map_entry map[]); ++static int dx_make_map(struct inode *dir, struct buffer_head *bh, ++ struct dx_hash_info *hinfo, ++ struct dx_map_entry *map_tail); + static void dx_sort_map(struct dx_map_entry *map, unsigned count); + static struct ext4_dir_entry_2 *dx_move_dirents(char *from, char *to, + struct dx_map_entry *offsets, int count, unsigned blocksize); +@@ -1172,15 +1172,23 @@ static inline int search_dirblock(struct + * Create map of hash values, offsets, and sizes, stored at end of block. + * Returns number of entries mapped. + */ +-static int dx_make_map(struct inode *dir, struct ext4_dir_entry_2 *de, +- unsigned blocksize, struct dx_hash_info *hinfo, ++static int dx_make_map(struct inode *dir, struct buffer_head *bh, ++ struct dx_hash_info *hinfo, + struct dx_map_entry *map_tail) + { + int count = 0; +- char *base = (char *) de; ++ struct ext4_dir_entry_2 *de = (struct ext4_dir_entry_2 *)bh->b_data; ++ unsigned int buflen = bh->b_size; ++ char *base = bh->b_data; + struct dx_hash_info h = *hinfo; + +- while ((char *) de < base + blocksize) { ++ if (ext4_has_metadata_csum(dir->i_sb)) ++ buflen -= sizeof(struct ext4_dir_entry_tail); ++ ++ while ((char *) de < base + buflen) { ++ if (ext4_check_dir_entry(dir, NULL, de, bh, base, buflen, ++ ((char *)de) - base)) ++ return -EFSCORRUPTED; + if (de->name_len && de->inode) { + ext4fs_dirhash(de->name, de->name_len, &h); + map_tail--; +@@ -1190,8 +1198,7 @@ static int dx_make_map(struct inode *dir + count++; + cond_resched(); + } +- /* XXX: do we need to check rec_len == 0 case? -Chris */ +- de = ext4_next_entry(de, blocksize); ++ de = ext4_next_entry(de, dir->i_sb->s_blocksize); + } + return count; + } +@@ -1720,8 +1727,11 @@ static struct ext4_dir_entry_2 *do_split + + /* create map in the end of data2 block */ + map = (struct dx_map_entry *) (data2 + blocksize); +- count = dx_make_map(dir, (struct ext4_dir_entry_2 *) data1, +- blocksize, hinfo, map); ++ count = dx_make_map(dir, *bh, hinfo, map); ++ if (count < 0) { ++ err = count; ++ goto journal_error; ++ } + map -= count; + dx_sort_map(map, count); + /* Ensure that neither split block is over half full */ diff --git a/patches.suse/floppy-Do-not-copy-a-kernel-pointer-to-user-memory-i.patch b/patches.suse/floppy-Do-not-copy-a-kernel-pointer-to-user-memory-i.patch index d855435..eff50f2 100644 --- a/patches.suse/floppy-Do-not-copy-a-kernel-pointer-to-user-memory-i.patch +++ b/patches.suse/floppy-Do-not-copy-a-kernel-pointer-to-user-memory-i.patch @@ -4,7 +4,7 @@ Date: Thu, 20 Sep 2018 09:09:48 -0600 Subject: [PATCH] floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl Git-commit: 65eea8edc315589d6c993cf12dbb5d0e9ef1fe4e Patch-mainline: v4.19-rc5 -References: bsc#1051510 +References: bsc#1051510 bsc#1084513 CVE-2018-7755 The final field of a floppy_struct is the field "name", which is a pointer to a string in kernel memory. The kernel pointer should not be copied to @@ -28,6 +28,7 @@ Broke up long line. Signed-off-by: Jens Axboe Acked-by: Takashi Iwai +Acked-by: Vasant Karasulli --- drivers/block/floppy.c | 3 +++ @@ -47,6 +48,6 @@ index 48f622728ce6..f2b6f4da1034 100644 break; case FDMSGON: UDP->flags |= FTD_MSG; --- +-- 2.18.0 diff --git a/patches.suse/floppy-use-a-statically-allocated-error-counter.patch b/patches.suse/floppy-use-a-statically-allocated-error-counter.patch new file mode 100644 index 0000000..0e515d7 --- /dev/null +++ b/patches.suse/floppy-use-a-statically-allocated-error-counter.patch @@ -0,0 +1,118 @@ +From f71f01394f742fc4558b3f9f4c7ef4c4cf3b07c8 Mon Sep 17 00:00:00 2001 +From: Willy Tarreau +Date: Sun, 8 May 2022 11:37:07 +0200 +Subject: [PATCH] floppy: use a statically allocated error counter +Git-commit: f71f01394f742fc4558b3f9f4c7ef4c4cf3b07c8 +Patch-mainline: v5.18-rc6 +References: bsc#1199063 CVE-2022-1652 + +Interrupt handler bad_flp_intr() may cause a UAF on the recently freed +request just to increment the error count. There's no point keeping +that one in the request anyway, and since the interrupt handler uses a +static pointer to the error which cannot be kept in sync with the +pending request, better make it use a static error counter that's reset +for each new request. This reset now happens when entering +redo_fd_request() for a new request via set_next_request(). + +One initial concern about a single error counter was that errors on one +floppy drive could be reported on another one, but this problem is not +real given that the driver uses a single drive at a time, as that +PC-compatible controllers also have this limitation by using shared +signals. As such the error count is always for the "current" drive. + +Reported-by: Minh Yuan +Suggested-by: Linus Torvalds +Tested-by: Denis Efremov +Signed-off-by: Willy Tarreau +Signed-off-by: Linus Torvalds +Signed-off-by: Denis Efremov +Acked-by: Petr Mladek + +[ pmladek@suse.com: + Backported for 4.19 by Denis Efremov , see + https://lore.kernel.org/all/20220517203516.60030-1-efremov@linux.com/ +] +--- + drivers/block/floppy.c | 17 +++++++---------- + 1 file changed, 7 insertions(+), 10 deletions(-) + +diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c +index 97c8fc4d6e7b..0e66314415c5 100644 +--- a/drivers/block/floppy.c ++++ b/drivers/block/floppy.c +@@ -520,8 +520,8 @@ static unsigned long fdc_busy; + static DECLARE_WAIT_QUEUE_HEAD(fdc_wait); + static DECLARE_WAIT_QUEUE_HEAD(command_done); + +-/* Errors during formatting are counted here. */ +-static int format_errors; ++/* errors encountered on the current (or last) request */ ++static int floppy_errors; + + /* Format request descriptor. */ + static struct format_descr format_req; +@@ -541,7 +541,6 @@ static struct format_descr format_req; + static char *floppy_track_buffer; + static int max_buffer_sectors; + +-static int *errors; + typedef void (*done_f)(int); + static const struct cont_t { + void (*interrupt)(void); +@@ -1434,7 +1433,7 @@ static int interpret_errors(void) + if (DP->flags & FTD_MSG) + DPRINT("Over/Underrun - retrying\n"); + bad = 0; +- } else if (*errors >= DP->max_errors.reporting) { ++ } else if (floppy_errors >= DP->max_errors.reporting) { + print_errors(); + } + if (ST2 & ST2_WC || ST2 & ST2_BC) +@@ -2054,7 +2053,7 @@ static void bad_flp_intr(void) + if (!next_valid_format()) + return; + } +- err_count = ++(*errors); ++ err_count = ++floppy_errors; + INFBOUND(DRWE->badness, err_count); + if (err_count > DP->max_errors.abort) + cont->done(0); +@@ -2199,9 +2198,8 @@ static int do_format(int drive, struct format_descr *tmp_format_req) + return -EINVAL; + } + format_req = *tmp_format_req; +- format_errors = 0; + cont = &format_cont; +- errors = &format_errors; ++ floppy_errors = 0; + ret = wait_til_done(redo_format, true); + if (ret == -EINTR) + return -EINTR; +@@ -2684,7 +2682,7 @@ static int make_raw_rw_request(void) + */ + if (!direct || + (indirect * 2 > direct * 3 && +- *errors < DP->max_errors.read_track && ++ floppy_errors < DP->max_errors.read_track && + ((!probing || + (DP->read_track & (1 << DRS->probed_format)))))) { + max_size = blk_rq_sectors(current_req); +@@ -2818,7 +2816,7 @@ static int set_next_request(void) + if (q) { + current_req = blk_fetch_request(q); + if (current_req) { +- current_req->error_count = 0; ++ floppy_errors = 0; + break; + } + } +@@ -2880,7 +2878,6 @@ static void redo_fd_request(void) + _floppy = floppy_type + DP->autodetect[DRS->probed_format]; + } else + probing = 0; +- errors = &(current_req->error_count); + tmp = make_raw_rw_request(); + if (tmp < 2) { + request_done(tmp); +-- +2.35.3 diff --git a/patches.suse/fs-nfs-Use-fatal_signal_pending-instead-of-signal_pe.patch b/patches.suse/fs-nfs-Use-fatal_signal_pending-instead-of-signal_pe.patch new file mode 100644 index 0000000..38d96f1 --- /dev/null +++ b/patches.suse/fs-nfs-Use-fatal_signal_pending-instead-of-signal_pe.patch @@ -0,0 +1,40 @@ +From: zhouchuangao +Date: Sun, 9 May 2021 19:34:37 -0700 +Subject: [PATCH] fs/nfs: Use fatal_signal_pending instead of signal_pending +Git-commit: bb002388901151fe35b6697ab116f6ed0721a9ed +Patch-mainline: v5.13 +References: git-fixes + +We set the state of the current process to TASK_KILLABLE via +prepare_to_wait(). Should we use fatal_signal_pending() to detect +the signal here? + +Fixes: b4868b44c562 ("NFSv4: Wait for stateid updates after CLOSE/OPEN_DOWNGRADE") +Signed-off-by: zhouchuangao +Signed-off-by: Trond Myklebust +Acked-by: NeilBrown + +--- + fs/nfs/nfs4proc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -1525,7 +1525,7 @@ static void nfs_set_open_stateid_locked( + spin_unlock(&state->owner->so_lock); + rcu_read_unlock(); + +- if (!signal_pending(current)) { ++ if (!fatal_signal_pending(current)) { + if (schedule_timeout(5*HZ) == 0) + status = -EAGAIN; + else +@@ -3182,7 +3182,7 @@ static bool nfs4_refresh_open_old_statei + write_sequnlock(&state->seqlock); + trace_nfs4_close_stateid_update_wait(state->inode, dst, 0); + +- if (signal_pending(current)) ++ if (fatal_signal_pending(current)) + status = -EINTR; + else + if (schedule_timeout(5*HZ) != 0) diff --git a/patches.suse/fsl-fman-Check-for-null-pointer-after-calling-devm_i.patch b/patches.suse/fsl-fman-Check-for-null-pointer-after-calling-devm_i.patch new file mode 100644 index 0000000..f0d653d --- /dev/null +++ b/patches.suse/fsl-fman-Check-for-null-pointer-after-calling-devm_i.patch @@ -0,0 +1,96 @@ +From 930d4e08f3fe403361c3eca2281d45a50073c439 Mon Sep 17 00:00:00 2001 +From: Jiasheng Jiang +Date: Thu, 6 Jan 2022 18:04:10 +0800 +Subject: [PATCH 6/6] fsl/fman: Check for null pointer after calling + devm_ioremap +References: git-fixes +Patch-mainline: v5.17-rc1 +Git-commit: d5a73ec96cc57cf67e51b12820fc2354e7ca46f8 + +As the possible failure of the allocation, the devm_ioremap() may return +NULL pointer. +Take tgec_initialization() as an example. +If allocation fails, the params->base_addr will be NULL pointer and will +be assigned to tgec->regs in tgec_config(). +Then it will cause the dereference of NULL pointer in set_mac_address(), +which is called by tgec_init(). +Therefore, it should be better to add the sanity check after the calling +of the devm_ioremap(). + +Fixes: 3933961682a3 ("fsl/fman: Add FMan MAC driver") +Signed-off-by: Jiasheng Jiang +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/freescale/fman/mac.c | 21 ++++++++++++++++----- + 1 file changed, 16 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/fman/mac.c b/drivers/net/ethernet/freescale/fman/mac.c +index 2f668abae8cc..3198ab317b44 100644 +--- a/drivers/net/ethernet/freescale/fman/mac.c ++++ b/drivers/net/ethernet/freescale/fman/mac.c +@@ -94,14 +94,17 @@ static void mac_exception(void *handle, enum fman_mac_exceptions ex) + __func__, ex); + } + +-static void set_fman_mac_params(struct mac_device *mac_dev, +- struct fman_mac_params *params) ++static int set_fman_mac_params(struct mac_device *mac_dev, ++ struct fman_mac_params *params) + { + struct mac_priv_s *priv = mac_dev->priv; + + params->base_addr = (typeof(params->base_addr)) + devm_ioremap(priv->dev, mac_dev->res->start, + resource_size(mac_dev->res)); ++ if (!params->base_addr) ++ return -ENOMEM; ++ + memcpy(¶ms->addr, mac_dev->addr, sizeof(mac_dev->addr)); + params->max_speed = priv->max_speed; + params->phy_if = mac_dev->phy_if; +@@ -112,6 +115,8 @@ static void set_fman_mac_params(struct mac_device *mac_dev, + params->event_cb = mac_exception; + params->dev_id = mac_dev; + params->internal_phy_node = priv->internal_phy_node; ++ ++ return 0; + } + + static int tgec_initialization(struct mac_device *mac_dev) +@@ -123,7 +128,9 @@ static int tgec_initialization(struct mac_device *mac_dev) + + priv = mac_dev->priv; + +- set_fman_mac_params(mac_dev, ¶ms); ++ err = set_fman_mac_params(mac_dev, ¶ms); ++ if (err) ++ goto _return; + + mac_dev->fman_mac = tgec_config(¶ms); + if (!mac_dev->fman_mac) { +@@ -169,7 +176,9 @@ static int dtsec_initialization(struct mac_device *mac_dev) + + priv = mac_dev->priv; + +- set_fman_mac_params(mac_dev, ¶ms); ++ err = set_fman_mac_params(mac_dev, ¶ms); ++ if (err) ++ goto _return; + + mac_dev->fman_mac = dtsec_config(¶ms); + if (!mac_dev->fman_mac) { +@@ -218,7 +227,9 @@ static int memac_initialization(struct mac_device *mac_dev) + + priv = mac_dev->priv; + +- set_fman_mac_params(mac_dev, ¶ms); ++ err = set_fman_mac_params(mac_dev, ¶ms); ++ if (err) ++ goto _return; + + if (priv->max_speed == SPEED_10000) + params.phy_if = PHY_INTERFACE_MODE_XGMII; +-- +2.16.4 + diff --git a/patches.suse/fuse-fix-pipe-buffer-lifetime-for-direct_io.patch b/patches.suse/fuse-fix-pipe-buffer-lifetime-for-direct_io.patch new file mode 100644 index 0000000..e89b0f5 --- /dev/null +++ b/patches.suse/fuse-fix-pipe-buffer-lifetime-for-direct_io.patch @@ -0,0 +1,88 @@ +From 36c296eb1c781d00f25c05b91375ccdaa367bb9f Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Wed, 30 Mar 2022 08:45:04 -0700 +Subject: [PATCH] fuse: fix pipe buffer lifetime for direct_io +Git-commit: 0c4bcfdecb1ac0967619ee7ff44871d93c08c909 +Patch-mainline: v5.17-rc8 +References: bsc#1197343 CVE-2022-1011 + +commit 0c4bcfdecb1ac0967619ee7ff44871d93c08c909 upstream. + +In FOPEN_DIRECT_IO mode, fuse_file_write_iter() calls +fuse_direct_write_iter(), which normally calls fuse_direct_io(), which then +imports the write buffer with fuse_get_user_pages(), which uses +iov_iter_get_pages() to grab references to userspace pages instead of +actually copying memory. + +On the filesystem device side, these pages can then either be read to +userspace (via fuse_dev_read()), or splice()d over into a pipe using +fuse_dev_splice_read() as pipe buffers with &nosteal_pipe_buf_ops. + +This is wrong because after fuse_dev_do_read() unlocks the FUSE request, +the userspace filesystem can mark the request as completed, causing write() +to return. At that point, the userspace filesystem should no longer have +access to the pipe buffer. + +Fix by copying pages coming from the user address space to new pipe +buffers. + +Reported-by: Jann Horn +Fixes: c3021629a0d8 ("fuse: support splice() reading from fuse device") +Cc: +Signed-off-by: Miklos Szeredi +Signed-off-by: Zach O'Keefe +Acked-by: Luís Henriques +--- + fs/fuse/dev.c | 12 +++++++++++- + fs/fuse/file.c | 1 + + fs/fuse/fuse_i.h | 2 ++ + 3 files changed, 14 insertions(+), 1 deletion(-) + +diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c +index b6f2a10663a0..26d40fecf296 100644 +--- a/fs/fuse/dev.c ++++ b/fs/fuse/dev.c +@@ -985,7 +985,17 @@ static int fuse_copy_page(struct fuse_copy_state *cs, struct page **pagep, + + while (count) { + if (cs->write && cs->pipebufs && page) { +- return fuse_ref_page(cs, page, offset, count); ++ /* ++ * Can't control lifetime of pipe buffers, so always ++ * copy user pages. ++ */ ++ if (cs->req->user_pages) { ++ err = fuse_copy_fill(cs); ++ if (err) ++ return err; ++ } else { ++ return fuse_ref_page(cs, page, offset, count); ++ } + } else if (!cs->len) { + if (cs->move_pages && page && + offset == 0 && count == PAGE_SIZE) { +diff --git a/fs/fuse/file.c b/fs/fuse/file.c +index 4238939af2fe..c01a180b571f 100644 +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -1316,6 +1316,7 @@ static int fuse_get_user_pages(struct fuse_req *req, struct iov_iter *ii, + (PAGE_SIZE - ret) & (PAGE_SIZE - 1); + } + ++ req->user_pages = true; + if (write) + req->in.argpages = 1; + else +diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h +index 338aa5e266d6..cfe57b70bb29 100644 +--- a/fs/fuse/fuse_i.h ++++ b/fs/fuse/fuse_i.h +@@ -310,6 +310,8 @@ struct fuse_req { + /** refcount */ + refcount_t count; + ++ bool user_pages; ++ + /** Unique ID for the interrupt request */ + u64 intr_unique; + diff --git a/patches.suse/hwrng-atmel-disable-trng-on-failure-path.patch b/patches.suse/hwrng-atmel-disable-trng-on-failure-path.patch new file mode 100644 index 0000000..fc89398 --- /dev/null +++ b/patches.suse/hwrng-atmel-disable-trng-on-failure-path.patch @@ -0,0 +1,27 @@ +From: Claudiu Beznea +Date: Mon, 21 Feb 2022 09:59:23 +0200 +Subject: hwrng: atmel - disable trng on failure path +Git-commit: a223ea9f89ab960eb254ba78429efd42eaf845eb +Patch-mainline: 5.18-rc1 +References: git-fixes + +Call atmel_trng_disable() on failure path of probe. + +Fixes: a1fa98d8116f ("hwrng: atmel - disable TRNG during suspend") +Signed-off-by: Claudiu Beznea +Signed-off-by: Herbert Xu +Signed-off-by: Jiri Slaby +--- + drivers/char/hw_random/atmel-rng.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/char/hw_random/atmel-rng.c ++++ b/drivers/char/hw_random/atmel-rng.c +@@ -95,6 +95,7 @@ static int atmel_trng_probe(struct platf + + err_register: + clk_disable_unprepare(trng->clk); ++ atmel_trng_disable(trng); + return ret; + } + diff --git a/patches.suse/hwrng-cavium-HW_RANDOM_CAVIUM-should-depend-on-ARCH_.patch b/patches.suse/hwrng-cavium-HW_RANDOM_CAVIUM-should-depend-on-ARCH_.patch new file mode 100644 index 0000000..0af49b5 --- /dev/null +++ b/patches.suse/hwrng-cavium-HW_RANDOM_CAVIUM-should-depend-on-ARCH_.patch @@ -0,0 +1,31 @@ +From: Geert Uytterhoeven +Date: Wed, 12 Jan 2022 15:05:03 +0100 +Subject: hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER +Git-commit: ab7d88549e2f7ae116afd303f32e1950cb790a1d +Patch-mainline: 5.18-rc1 +References: git-fixes + +The Cavium ThunderX Random Number Generator is only present on Cavium +ThunderX SoCs, and not available as an independent PCIe endpoint. Hence +add a dependency on ARCH_THUNDER, to prevent asking the user about this +driver when configuring a kernel without Cavium Thunder SoC support. + +Fixes: cc2f1908c6b8f625 ("hwrng: cavium - Add Cavium HWRNG driver for ThunderX SoC.") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Herbert Xu +Signed-off-by: Jiri Slaby +--- + drivers/char/hw_random/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/char/hw_random/Kconfig ++++ b/drivers/char/hw_random/Kconfig +@@ -385,7 +385,7 @@ config HW_RANDOM_MESON + + config HW_RANDOM_CAVIUM + tristate "Cavium ThunderX Random Number Generator support" +- depends on HW_RANDOM && PCI && (ARM64 || (COMPILE_TEST && 64BIT)) ++ depends on HW_RANDOM && PCI && (ARCH_THUNDER || (COMPILE_TEST && 64BIT)) + default HW_RANDOM + ---help--- + This driver provides kernel-side support for the Random Number diff --git a/patches.suse/i40e-Fix-MAC-address-setting-for-a-VF-via-Host-VM.patch b/patches.suse/i40e-Fix-MAC-address-setting-for-a-VF-via-Host-VM.patch new file mode 100644 index 0000000..52f933f --- /dev/null +++ b/patches.suse/i40e-Fix-MAC-address-setting-for-a-VF-via-Host-VM.patch @@ -0,0 +1,103 @@ +From 6007fba5d475828063bf8103c1040afdeb0ca673 Mon Sep 17 00:00:00 2001 +From: Slawomir Laba +Date: Wed, 14 Oct 2020 08:54:09 +0000 +Subject: [PATCH 7/7] i40e: Fix MAC address setting for a VF via Host/VM +Git-commit: 3a7001788fed0311d6fb77ed0dabe7bed3567bc0 +References: git-fixes +Patch-mainline: v5.10-rc4 + +Fix MAC setting flow for the PF driver. + +Update the unicast VF's MAC address in VF structure if it is +a new setting in i40e_vc_add_mac_addr_msg. + +When unicast MAC address gets deleted, record that and +set the new unicast MAC address that is already waiting in the filter +list. This logic is based on the order of messages arriving to +the PF driver. + +Without this change the MAC address setting was interpreted +incorrectly in the following use cases: +1) Print incorrect VF MAC or zero MAC +ip link show dev $pf +2) Don't preserve MAC between driver reload +rmmod iavf; modprobe iavf +3) Update VF MAC when macvlan was set +ip link add link $vf address $mac $vf.1 type macvlan +4) Failed to update mac address when VF was trusted +ip link set dev $vf address $mac + +This includes all other configurations including above commands. + +Fixes: f657a6e1313b ("i40e: Fix VF driver MAC address configuration") +Signed-off-by: Slawomir Laba +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 26 ++++++++++++++++++++-- + 1 file changed, 24 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index e0ab04cce265..ec133b017f6b 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -2743,6 +2743,10 @@ static int i40e_vc_add_mac_addr_msg(struct i40e_vf *vf, u8 *msg) + spin_unlock_bh(&vsi->mac_filter_hash_lock); + goto error_param; + } ++ if (is_valid_ether_addr(al->list[i].addr) && ++ is_zero_ether_addr(vf->default_lan_addr.addr)) ++ ether_addr_copy(vf->default_lan_addr.addr, ++ al->list[i].addr); + } + } + spin_unlock_bh(&vsi->mac_filter_hash_lock); +@@ -2770,6 +2774,7 @@ static int i40e_vc_del_mac_addr_msg(struct i40e_vf *vf, u8 *msg) + { + struct virtchnl_ether_addr_list *al = + (struct virtchnl_ether_addr_list *)msg; ++ bool was_unimac_deleted = false; + struct i40e_pf *pf = vf->pf; + struct i40e_vsi *vsi = NULL; + u16 vsi_id = al->vsi_id; +@@ -2790,6 +2795,8 @@ static int i40e_vc_del_mac_addr_msg(struct i40e_vf *vf, u8 *msg) + ret = I40E_ERR_INVALID_MAC_ADDR; + goto error_param; + } ++ if (ether_addr_equal(al->list[i].addr, vf->default_lan_addr.addr)) ++ was_unimac_deleted = true; + } + vsi = pf->vsi[vf->lan_vsi_idx]; + +@@ -2810,10 +2817,25 @@ static int i40e_vc_del_mac_addr_msg(struct i40e_vf *vf, u8 *msg) + dev_err(&pf->pdev->dev, "Unable to program VF %d MAC filters, error %d\n", + vf->vf_id, ret); + ++ if (vf->trusted && was_unimac_deleted) { ++ struct i40e_mac_filter *f; ++ struct hlist_node *h; ++ u8 *macaddr = NULL; ++ int bkt; ++ ++ /* set last unicast mac address as default */ ++ spin_lock_bh(&vsi->mac_filter_hash_lock); ++ hash_for_each_safe(vsi->mac_filter_hash, bkt, h, f, hlist) { ++ if (is_valid_ether_addr(f->macaddr)) ++ macaddr = f->macaddr; ++ } ++ if (macaddr) ++ ether_addr_copy(vf->default_lan_addr.addr, macaddr); ++ spin_unlock_bh(&vsi->mac_filter_hash_lock); ++ } + error_param: + /* send the response to the VF */ +- return i40e_vc_send_resp_to_vf(vf, VIRTCHNL_OP_DEL_ETH_ADDR, +- ret); ++ return i40e_vc_send_resp_to_vf(vf, VIRTCHNL_OP_DEL_ETH_ADDR, ret); + } + + /** +-- +2.16.4 + diff --git a/patches.suse/i40e-Fix-incorrect-netdev-s-real-number-of-RX-TX-que.patch b/patches.suse/i40e-Fix-incorrect-netdev-s-real-number-of-RX-TX-que.patch new file mode 100644 index 0000000..d74f8b1 --- /dev/null +++ b/patches.suse/i40e-Fix-incorrect-netdev-s-real-number-of-RX-TX-que.patch @@ -0,0 +1,90 @@ +From 0d9d241c68a703479815cc561b634be8da5f4aff Mon Sep 17 00:00:00 2001 +From: Jedrzej Jagielski +Date: Fri, 17 Dec 2021 14:29:05 +0000 +Subject: [PATCH 1/6] i40e: Fix incorrect netdev's real number of RX/TX queues +References: git-fixes +Patch-mainline: v5.16 +Git-commit: e738451d78b2f8a9635d66c6a87f304b4d965f7a + +There was a wrong queues representation in sysfs during +driver's reinitialization in case of online cpus number is +less than combined queues. It was caused by stopped +NetworkManager, which is responsible for calling vsi_open +function during driver's initialization. +In specific situation (ex. 12 cpus online) there were 16 queues +in /sys/class/net//queues. In case of modifying queues with +value higher, than number of online cpus, then it caused write +errors and other errors. +Add updating of sysfs's queues representation during driver +initialization. + +Fixes: 41c445ff0f48 ("i40e: main driver core") +Signed-off-by: Lukasz Cieplicki +Signed-off-by: Jedrzej Jagielski +Tested-by: Gurucharan G +Signed-off-by: Tony Nguyen +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 32 ++++++++++++++++++++++------- + 1 file changed, 25 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index df13d37c0e95..6847f3c382a8 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -7869,6 +7869,27 @@ int i40e_open(struct net_device *netdev) + return 0; + } + ++/** ++ * i40e_netif_set_realnum_tx_rx_queues - Update number of tx/rx queues ++ * @vsi: vsi structure ++ * ++ * This updates netdev's number of tx/rx queues ++ * ++ * Returns status of setting tx/rx queues ++ **/ ++static int i40e_netif_set_realnum_tx_rx_queues(struct i40e_vsi *vsi) ++{ ++ int ret; ++ ++ ret = netif_set_real_num_rx_queues(vsi->netdev, ++ vsi->num_queue_pairs); ++ if (ret) ++ return ret; ++ ++ return netif_set_real_num_tx_queues(vsi->netdev, ++ vsi->num_queue_pairs); ++} ++ + /** + * i40e_vsi_open - + * @vsi: the VSI to open +@@ -7905,13 +7926,7 @@ int i40e_vsi_open(struct i40e_vsi *vsi) + goto err_setup_rx; + + /* Notify the stack of the actual queue counts. */ +- err = netif_set_real_num_tx_queues(vsi->netdev, +- vsi->num_queue_pairs); +- if (err) +- goto err_set_queues; +- +- err = netif_set_real_num_rx_queues(vsi->netdev, +- vsi->num_queue_pairs); ++ err = i40e_netif_set_realnum_tx_rx_queues(vsi); + if (err) + goto err_set_queues; + +@@ -13300,6 +13315,9 @@ struct i40e_vsi *i40e_vsi_setup(struct i40e_pf *pf, u8 type, + case I40E_VSI_MAIN: + case I40E_VSI_VMDQ2: + ret = i40e_config_netdev(vsi); ++ if (ret) ++ goto err_netdev; ++ ret = i40e_netif_set_realnum_tx_rx_queues(vsi); + if (ret) + goto err_netdev; + ret = register_netdev(vsi->netdev); +-- +2.16.4 + diff --git a/patches.suse/i40e-Fix-the-conditional-for-i40e_vc_validate_vqs_bi.patch b/patches.suse/i40e-Fix-the-conditional-for-i40e_vc_validate_vqs_bi.patch new file mode 100644 index 0000000..f5828b1 --- /dev/null +++ b/patches.suse/i40e-Fix-the-conditional-for-i40e_vc_validate_vqs_bi.patch @@ -0,0 +1,49 @@ +From a620519a9d8b1a3cf066c16ea46b1d7189262043 Mon Sep 17 00:00:00 2001 +From: Brett Creeley +Date: Mon, 10 Feb 2020 10:59:18 -0800 +Subject: [PATCH 3/7] i40e: Fix the conditional for + i40e_vc_validate_vqs_bitmaps +Git-commit: f27f37a04a69890ac85d9155f03ee2d23b678d8f +References: git-fixes +Patch-mainline: v5.6-rc2 + +Commit d9d6a9aed3f6 ("i40e: Fix virtchnl_queue_select bitmap +validation") introduced a necessary change for verifying how queue +bitmaps from the iavf driver get validated. Unfortunately, the +conditional was reversed. Fix this. + +Fixes: d9d6a9aed3f6 ("i40e: Fix virtchnl_queue_select bitmap validation") +Signed-off-by: Brett Creeley +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index 4cac8a80a98b..136d582b1508 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -2393,7 +2393,7 @@ static int i40e_vc_enable_queues_msg(struct i40e_vf *vf, u8 *msg) + goto error_param; + } + +- if (i40e_vc_validate_vqs_bitmaps(vqs)) { ++ if (!i40e_vc_validate_vqs_bitmaps(vqs)) { + aq_ret = I40E_ERR_PARAM; + goto error_param; + } +@@ -2450,7 +2450,7 @@ static int i40e_vc_disable_queues_msg(struct i40e_vf *vf, u8 *msg) + goto error_param; + } + +- if (i40e_vc_validate_vqs_bitmaps(vqs)) { ++ if (!i40e_vc_validate_vqs_bitmaps(vqs)) { + aq_ret = I40E_ERR_PARAM; + goto error_param; + } +-- +2.16.4 + diff --git a/patches.suse/i40e-Fix-virtchnl_queue_select-bitmap-validation.patch b/patches.suse/i40e-Fix-virtchnl_queue_select-bitmap-validation.patch new file mode 100644 index 0000000..85f31e4 --- /dev/null +++ b/patches.suse/i40e-Fix-virtchnl_queue_select-bitmap-validation.patch @@ -0,0 +1,79 @@ +From d3165c95841ddf1c2d3d916a9a69398dd18140b9 Mon Sep 17 00:00:00 2001 +From: Brett Creeley +Date: Wed, 13 Nov 2019 11:28:17 -0800 +Subject: [PATCH 2/7] i40e: Fix virtchnl_queue_select bitmap validation +Git-commit: d9d6a9aed3f66f8ce5fa3ca6ca26007d75032296 +References: git-fixes +Patch-mainline: v5.5-rc7 + +Currently in i40e_vc_disable_queues_msg() we are incorrectly +validating the virtchnl queue select bitmaps. The +virtchnl_queue_select rx_queues and tx_queue bitmap is being +compared against ICE_MAX_VF_QUEUES, but the problem is that +these bitmaps can have a value greater than I40E_MAX_VF_QUEUES. +Fix this by comparing the bitmaps against BIT(I40E_MAX_VF_QUEUES). + +Also, add the function i40e_vc_validate_vqs_bitmaps() that checks to see +if both virtchnl_queue_select bitmaps are empty along with checking that +the bitmaps only have valid bits set. This function can then be used in +both the queue enable and disable flows. + +Suggested-by: Arkady Gilinksky +Signed-off-by: Brett Creeley +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index 87103d12986c..4cac8a80a98b 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -2351,6 +2351,22 @@ static int i40e_ctrl_vf_rx_rings(struct i40e_vsi *vsi, unsigned long q_map, + return ret; + } + ++/** ++ * i40e_vc_validate_vqs_bitmaps - validate Rx/Tx queue bitmaps from VIRTHCHNL ++ * @vqs: virtchnl_queue_select structure containing bitmaps to validate ++ * ++ * Returns true if validation was successful, else false. ++ */ ++static bool i40e_vc_validate_vqs_bitmaps(struct virtchnl_queue_select *vqs) ++{ ++ if ((!vqs->rx_queues && !vqs->tx_queues) || ++ vqs->rx_queues >= BIT(I40E_MAX_VF_QUEUES) || ++ vqs->tx_queues >= BIT(I40E_MAX_VF_QUEUES)) ++ return false; ++ ++ return true; ++} ++ + /** + * i40e_vc_enable_queues_msg + * @vf: pointer to the VF info +@@ -2377,7 +2393,7 @@ static int i40e_vc_enable_queues_msg(struct i40e_vf *vf, u8 *msg) + goto error_param; + } + +- if ((0 == vqs->rx_queues) && (0 == vqs->tx_queues)) { ++ if (i40e_vc_validate_vqs_bitmaps(vqs)) { + aq_ret = I40E_ERR_PARAM; + goto error_param; + } +@@ -2434,9 +2450,7 @@ static int i40e_vc_disable_queues_msg(struct i40e_vf *vf, u8 *msg) + goto error_param; + } + +- if ((vqs->rx_queues == 0 && vqs->tx_queues == 0) || +- vqs->rx_queues > I40E_MAX_VF_QUEUES || +- vqs->tx_queues > I40E_MAX_VF_QUEUES) { ++ if (i40e_vc_validate_vqs_bitmaps(vqs)) { + aq_ret = I40E_ERR_PARAM; + goto error_param; + } +-- +2.16.4 + diff --git a/patches.suse/i40e-Refactoring-VF-MAC-filters-counting-to-make-mor.patch b/patches.suse/i40e-Refactoring-VF-MAC-filters-counting-to-make-mor.patch new file mode 100644 index 0000000..048f3ee --- /dev/null +++ b/patches.suse/i40e-Refactoring-VF-MAC-filters-counting-to-make-mor.patch @@ -0,0 +1,181 @@ +From 11ef058aaef77550f847f9a7fcb665c4f9799caa Mon Sep 17 00:00:00 2001 +From: Aleksandr Loktionov +Date: Fri, 20 Sep 2019 02:17:24 -0700 +Subject: [PATCH 1/7] i40e: Refactoring VF MAC filters counting to make more + reliable +Git-commit: 621650cabee54886291c4fa59544b9e30b016f92 +References: git-fixes +Patch-mainline: v5.5-rc1 + +This patch prepares ground for the next VF MAC address change fix. +It lets untrusted VF to delete any VF mac filter, but it still +doesn't let untrusted VF to add mac filter not setup by PF. +It removes information duplication in num_mac mac filters counter. +And improves exact h/w mac filters usage checking in the +i40e_check_vf_permission() function by counting mac2add_cnt. +It also improves logging because now all mac addresses will be validated +first and corresponding messages will be logged. + +Signed-off-by: Aleksandr Loktionov +Tested-by: Andrew Bowers +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/intel/i40e/i40e.h | 1 + + drivers/net/ethernet/intel/i40e/i40e_main.c | 19 +++++++++ + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 45 +++++++++------------- + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h | 1 - + 4 files changed, 39 insertions(+), 27 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h +index febd4e721057..bc2c1bfc9fc2 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -1120,6 +1120,7 @@ struct i40e_mac_filter *i40e_add_mac_filter(struct i40e_vsi *vsi, + const u8 *macaddr); + int i40e_del_mac_filter(struct i40e_vsi *vsi, const u8 *macaddr); + bool i40e_is_vsi_in_vlan(struct i40e_vsi *vsi); ++int i40e_count_filters(struct i40e_vsi *vsi); + struct i40e_mac_filter *i40e_find_mac(struct i40e_vsi *vsi, const u8 *macaddr); + void i40e_vlan_stripping_enable(struct i40e_vsi *vsi); + #ifdef CONFIG_I40E_DCB +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 6847f3c382a8..682b9b342c4f 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -1133,6 +1133,25 @@ void i40e_update_stats(struct i40e_vsi *vsi) + i40e_update_vsi_stats(vsi); + } + ++/** ++ * i40e_count_filters - counts VSI mac filters ++ * @vsi: the VSI to be searched ++ * ++ * Returns count of mac filters ++ **/ ++int i40e_count_filters(struct i40e_vsi *vsi) ++{ ++ struct i40e_mac_filter *f; ++ struct hlist_node *h; ++ int bkt; ++ int cnt = 0; ++ ++ hash_for_each_safe(vsi->mac_filter_hash, bkt, h, f, hlist) ++ ++cnt; ++ ++ return cnt; ++} ++ + /** + * i40e_find_filter - Search VSI filter list for specific mac/vlan filter + * @vsi: the VSI to be searched +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index c898b866a2e1..87103d12986c 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -981,7 +981,6 @@ static void i40e_free_vf_res(struct i40e_vf *vf) + i40e_vsi_release(pf->vsi[vf->lan_vsi_idx]); + vf->lan_vsi_idx = 0; + vf->lan_vsi_id = 0; +- vf->num_mac = 0; + } + + /* do the accounting and remove additional ADq VSI's */ +@@ -2578,20 +2577,12 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf, + struct virtchnl_ether_addr_list *al) + { + struct i40e_pf *pf = vf->pf; ++ struct i40e_vsi *vsi = pf->vsi[vf->lan_vsi_idx]; ++ int mac2add_cnt = 0; + int i; + +- /* If this VF is not privileged, then we can't add more than a limited +- * number of addresses. Check to make sure that the additions do not +- * push us over the limit. +- */ +- if (!test_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps) && +- (vf->num_mac + al->num_elements) > I40E_VC_MAX_MAC_ADDR_PER_VF) { +- dev_err(&pf->pdev->dev, +- "Cannot add more MAC addresses, VF is not trusted, switch the VF to trusted to add more functionality\n"); +- return -EPERM; +- } +- + for (i = 0; i < al->num_elements; i++) { ++ struct i40e_mac_filter *f; + u8 *addr = al->list[i].addr; + + if (is_broadcast_ether_addr(addr) || +@@ -2615,8 +2606,24 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf, + "VF attempting to override administratively set MAC address, bring down and up the VF interface to resume normal operation\n"); + return -EPERM; + } ++ ++ /*count filters that really will be added*/ ++ f = i40e_find_mac(vsi, addr); ++ if (!f) ++ ++mac2add_cnt; + } + ++ /* If this VF is not privileged, then we can't add more than a limited ++ * number of addresses. Check to make sure that the additions do not ++ * push us over the limit. ++ */ ++ if (!test_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps) && ++ (i40e_count_filters(vsi) + mac2add_cnt) > ++ I40E_VC_MAX_MAC_ADDR_PER_VF) { ++ dev_err(&pf->pdev->dev, ++ "Cannot add more MAC addresses, VF is not trusted, switch the VF to trusted to add more functionality\n"); ++ return -EPERM; ++ } + return 0; + } + +@@ -2671,8 +2678,6 @@ static int i40e_vc_add_mac_addr_msg(struct i40e_vf *vf, u8 *msg) + ret = I40E_ERR_PARAM; + spin_unlock_bh(&vsi->mac_filter_hash_lock); + goto error_param; +- } else { +- vf->num_mac++; + } + } + } +@@ -2721,16 +2726,6 @@ static int i40e_vc_del_mac_addr_msg(struct i40e_vf *vf, u8 *msg) + ret = I40E_ERR_INVALID_MAC_ADDR; + goto error_param; + } +- +- if (vf->pf_set_mac && +- ether_addr_equal(al->list[i].addr, +- vf->default_lan_addr.addr)) { +- dev_err(&pf->pdev->dev, +- "MAC addr %pM has been set by PF, cannot delete it for VF %d, reset VF to change MAC addr\n", +- vf->default_lan_addr.addr, vf->vf_id); +- ret = I40E_ERR_PARAM; +- goto error_param; +- } + } + vsi = pf->vsi[vf->lan_vsi_idx]; + +@@ -2741,8 +2736,6 @@ static int i40e_vc_del_mac_addr_msg(struct i40e_vf *vf, u8 *msg) + ret = I40E_ERR_INVALID_MAC_ADDR; + spin_unlock_bh(&vsi->mac_filter_hash_lock); + goto error_param; +- } else { +- vf->num_mac--; + } + + spin_unlock_bh(&vsi->mac_filter_hash_lock); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h +index 9ee753bc4efa..308dda5d5d2d 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h +@@ -123,7 +123,6 @@ struct i40e_vf { + bool link_forced; + bool link_up; /* only valid if VF link is forced */ + bool spoofchk; +- u16 num_mac; + u16 num_vlan; + + /* ADq related variables */ +-- +2.16.4 + diff --git a/patches.suse/i40e-Remove-scheduling-while-atomic-possibility.patch b/patches.suse/i40e-Remove-scheduling-while-atomic-possibility.patch new file mode 100644 index 0000000..c08f743 --- /dev/null +++ b/patches.suse/i40e-Remove-scheduling-while-atomic-possibility.patch @@ -0,0 +1,324 @@ +From cf1225021edea83a8e94fa7d3a507d33f9bc7601 Mon Sep 17 00:00:00 2001 +From: Aleksandr Loktionov +Date: Fri, 29 May 2020 14:10:39 -0700 +Subject: [PATCH 4/7] i40e: Remove scheduling while atomic possibility +Git-commit: 37d318d7805f25b672bfd74fc694f19a2ee9665d +References: git-fixes +Patch-mainline: v5.9-rc1 + +In some occasions task held spinlock (mac_filter_hash_lock), +while being rescheduled due to admin queue mutex_lock. The struct +i40e_spinlock asq_spinlock, which later expands to struct mutex +spinlock. Moved i40e_aq_set_vsi_multicast_promiscuous(), +i40e_aq_set_vsi_unicast_promiscuous(), +i40e_aq_set_vsi_mc_promisc_on_vlan(), and +i40e_aq_set_vsi_uc_promisc_on_vlan() outside of atomic context. Without +this patch there is a race condition, which might result in scheduling +while in atomic context. The race condition is between the thread, which +holds mac_filter_hash_lock, while trying to acquire an admin queue mutex +and a thread, which already has said admin queue mutex. The thread, which +holds spinlock, fails to acquire the mutex, which causes this thread to +sleep. + +Signed-off-by: Arkadiusz Kubalewski +Signed-off-by: Aleksandr Loktionov +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 234 ++++++++++++--------- + 1 file changed, 137 insertions(+), 97 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index 136d582b1508..6642abbdccee 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -1132,39 +1132,81 @@ static int i40e_quiesce_vf_pci(struct i40e_vf *vf) + return -EIO; + } + +-static inline int i40e_getnum_vf_vsi_vlan_filters(struct i40e_vsi *vsi); ++/** ++ * i40e_getnum_vf_vsi_vlan_filters ++ * @vsi: pointer to the vsi ++ * ++ * called to get the number of VLANs offloaded on this VF ++ **/ ++static int i40e_getnum_vf_vsi_vlan_filters(struct i40e_vsi *vsi) ++{ ++ struct i40e_mac_filter *f; ++ int num_vlans = 0, bkt; ++ ++ hash_for_each(vsi->mac_filter_hash, bkt, f, hlist) { ++ if (f->vlan >= 0 && f->vlan <= I40E_MAX_VLANID) ++ num_vlans++; ++ } ++ ++ return num_vlans; ++} + + /** +- * i40e_config_vf_promiscuous_mode +- * @vf: pointer to the VF info +- * @vsi_id: VSI id +- * @allmulti: set MAC L2 layer multicast promiscuous enable/disable +- * @alluni: set MAC L2 layer unicast promiscuous enable/disable ++ * i40e_get_vlan_list_sync ++ * @vsi: pointer to the VSI ++ * @num_vlans: number of VLANs in mac_filter_hash, returned to caller ++ * @vlan_list: list of VLANs present in mac_filter_hash, returned to caller. ++ * This array is allocated here, but has to be freed in caller. + * +- * Called from the VF to configure the promiscuous mode of +- * VF vsis and from the VF reset path to reset promiscuous mode. ++ * Called to get number of VLANs and VLAN list present in mac_filter_hash. + **/ +-static i40e_status i40e_config_vf_promiscuous_mode(struct i40e_vf *vf, +- u16 vsi_id, +- bool allmulti, +- bool alluni) ++static void i40e_get_vlan_list_sync(struct i40e_vsi *vsi, int *num_vlans, ++ s16 **vlan_list) + { +- struct i40e_pf *pf = vf->pf; +- struct i40e_hw *hw = &pf->hw; + struct i40e_mac_filter *f; +- i40e_status aq_ret = 0; +- struct i40e_vsi *vsi; ++ int i = 0; + int bkt; + +- vsi = i40e_find_vsi_from_id(pf, vsi_id); +- if (!i40e_vc_isvalid_vsi_id(vf, vsi_id) || !vsi) +- return I40E_ERR_PARAM; ++ spin_lock_bh(&vsi->mac_filter_hash_lock); ++ *num_vlans = i40e_getnum_vf_vsi_vlan_filters(vsi); ++ *vlan_list = kcalloc(*num_vlans, sizeof(**vlan_list), GFP_ATOMIC); ++ if (!(*vlan_list)) ++ goto err; + +- if (vf->port_vlan_id) { +- aq_ret = i40e_aq_set_vsi_mc_promisc_on_vlan(hw, vsi->seid, +- allmulti, +- vf->port_vlan_id, +- NULL); ++ hash_for_each(vsi->mac_filter_hash, bkt, f, hlist) { ++ if (f->vlan < 0 || f->vlan > I40E_MAX_VLANID) ++ continue; ++ (*vlan_list)[i++] = f->vlan; ++ } ++err: ++ spin_unlock_bh(&vsi->mac_filter_hash_lock); ++} ++ ++/** ++ * i40e_set_vsi_promisc ++ * @vf: pointer to the VF struct ++ * @seid: VSI number ++ * @multi_enable: set MAC L2 layer multicast promiscuous enable/disable ++ * for a given VLAN ++ * @unicast_enable: set MAC L2 layer unicast promiscuous enable/disable ++ * for a given VLAN ++ * @vl: List of VLANs - apply filter for given VLANs ++ * @num_vlans: Number of elements in @vl ++ **/ ++static i40e_status ++i40e_set_vsi_promisc(struct i40e_vf *vf, u16 seid, bool multi_enable, ++ bool unicast_enable, s16 *vl, int num_vlans) ++{ ++ struct i40e_pf *pf = vf->pf; ++ struct i40e_hw *hw = &pf->hw; ++ i40e_status aq_ret; ++ int i; ++ ++ /* No VLAN to set promisc on, set on VSI */ ++ if (!num_vlans || !vl) { ++ aq_ret = i40e_aq_set_vsi_multicast_promiscuous(hw, seid, ++ multi_enable, ++ NULL); + if (aq_ret) { + int aq_err = pf->hw.aq.asq_last_status; + +@@ -1173,13 +1215,14 @@ static i40e_status i40e_config_vf_promiscuous_mode(struct i40e_vf *vf, + vf->vf_id, + i40e_stat_str(&pf->hw, aq_ret), + i40e_aq_str(&pf->hw, aq_err)); ++ + return aq_ret; + } + +- aq_ret = i40e_aq_set_vsi_uc_promisc_on_vlan(hw, vsi->seid, +- alluni, +- vf->port_vlan_id, +- NULL); ++ aq_ret = i40e_aq_set_vsi_unicast_promiscuous(hw, seid, ++ unicast_enable, ++ NULL, true); ++ + if (aq_ret) { + int aq_err = pf->hw.aq.asq_last_status; + +@@ -1189,68 +1232,84 @@ static i40e_status i40e_config_vf_promiscuous_mode(struct i40e_vf *vf, + i40e_stat_str(&pf->hw, aq_ret), + i40e_aq_str(&pf->hw, aq_err)); + } ++ + return aq_ret; +- } else if (i40e_getnum_vf_vsi_vlan_filters(vsi)) { +- hash_for_each(vsi->mac_filter_hash, bkt, f, hlist) { +- if (f->vlan < 0 || f->vlan > I40E_MAX_VLANID) +- continue; +- aq_ret = i40e_aq_set_vsi_mc_promisc_on_vlan(hw, +- vsi->seid, +- allmulti, +- f->vlan, +- NULL); +- if (aq_ret) { +- int aq_err = pf->hw.aq.asq_last_status; ++ } + +- dev_err(&pf->pdev->dev, +- "Could not add VLAN %d to multicast promiscuous domain err %s aq_err %s\n", +- f->vlan, +- i40e_stat_str(&pf->hw, aq_ret), +- i40e_aq_str(&pf->hw, aq_err)); +- } ++ for (i = 0; i < num_vlans; i++) { ++ aq_ret = i40e_aq_set_vsi_mc_promisc_on_vlan(hw, seid, ++ multi_enable, ++ vl[i], NULL); ++ if (aq_ret) { ++ int aq_err = pf->hw.aq.asq_last_status; ++ ++ dev_err(&pf->pdev->dev, ++ "VF %d failed to set multicast promiscuous mode err %s aq_err %s\n", ++ vf->vf_id, ++ i40e_stat_str(&pf->hw, aq_ret), ++ i40e_aq_str(&pf->hw, aq_err)); ++ } + +- aq_ret = i40e_aq_set_vsi_uc_promisc_on_vlan(hw, +- vsi->seid, +- alluni, +- f->vlan, +- NULL); +- if (aq_ret) { +- int aq_err = pf->hw.aq.asq_last_status; ++ aq_ret = i40e_aq_set_vsi_uc_promisc_on_vlan(hw, seid, ++ unicast_enable, ++ vl[i], NULL); ++ if (aq_ret) { ++ int aq_err = pf->hw.aq.asq_last_status; + +- dev_err(&pf->pdev->dev, +- "Could not add VLAN %d to Unicast promiscuous domain err %s aq_err %s\n", +- f->vlan, +- i40e_stat_str(&pf->hw, aq_ret), +- i40e_aq_str(&pf->hw, aq_err)); +- } ++ dev_err(&pf->pdev->dev, ++ "VF %d failed to set unicast promiscuous mode err %s aq_err %s\n", ++ vf->vf_id, ++ i40e_stat_str(&pf->hw, aq_ret), ++ i40e_aq_str(&pf->hw, aq_err)); + } +- return aq_ret; + } +- aq_ret = i40e_aq_set_vsi_multicast_promiscuous(hw, vsi->seid, allmulti, +- NULL); +- if (aq_ret) { +- int aq_err = pf->hw.aq.asq_last_status; ++ return aq_ret; ++} + +- dev_err(&pf->pdev->dev, +- "VF %d failed to set multicast promiscuous mode err %s aq_err %s\n", +- vf->vf_id, +- i40e_stat_str(&pf->hw, aq_ret), +- i40e_aq_str(&pf->hw, aq_err)); ++/** ++ * i40e_config_vf_promiscuous_mode ++ * @vf: pointer to the VF info ++ * @vsi_id: VSI id ++ * @allmulti: set MAC L2 layer multicast promiscuous enable/disable ++ * @alluni: set MAC L2 layer unicast promiscuous enable/disable ++ * ++ * Called from the VF to configure the promiscuous mode of ++ * VF vsis and from the VF reset path to reset promiscuous mode. ++ **/ ++static i40e_status i40e_config_vf_promiscuous_mode(struct i40e_vf *vf, ++ u16 vsi_id, ++ bool allmulti, ++ bool alluni) ++{ ++ i40e_status aq_ret = I40E_SUCCESS; ++ struct i40e_pf *pf = vf->pf; ++ struct i40e_vsi *vsi; ++ int num_vlans; ++ s16 *vl; ++ ++ vsi = i40e_find_vsi_from_id(pf, vsi_id); ++ if (!i40e_vc_isvalid_vsi_id(vf, vsi_id) || !vsi) ++ return I40E_ERR_PARAM; ++ ++ if (vf->port_vlan_id) { ++ aq_ret = i40e_set_vsi_promisc(vf, vsi->seid, allmulti, ++ alluni, &vf->port_vlan_id, 1); + return aq_ret; +- } ++ } else if (i40e_getnum_vf_vsi_vlan_filters(vsi)) { ++ i40e_get_vlan_list_sync(vsi, &num_vlans, &vl); + +- aq_ret = i40e_aq_set_vsi_unicast_promiscuous(hw, vsi->seid, alluni, +- NULL, true); +- if (aq_ret) { +- int aq_err = pf->hw.aq.asq_last_status; ++ if (!vl) ++ return I40E_ERR_NO_MEMORY; + +- dev_err(&pf->pdev->dev, +- "VF %d failed to set unicast promiscuous mode err %s aq_err %s\n", +- vf->vf_id, +- i40e_stat_str(&pf->hw, aq_ret), +- i40e_aq_str(&pf->hw, aq_err)); ++ aq_ret = i40e_set_vsi_promisc(vf, vsi->seid, allmulti, alluni, ++ vl, num_vlans); ++ kfree(vl); ++ return aq_ret; + } + ++ /* no VLANs to set on, set on VSI */ ++ aq_ret = i40e_set_vsi_promisc(vf, vsi->seid, allmulti, alluni, ++ NULL, 0); + return aq_ret; + } + +@@ -2007,25 +2066,6 @@ static void i40e_vc_reset_vf_msg(struct i40e_vf *vf) + i40e_reset_vf(vf, false); + } + +-/** +- * i40e_getnum_vf_vsi_vlan_filters +- * @vsi: pointer to the vsi +- * +- * called to get the number of VLANs offloaded on this VF +- **/ +-static inline int i40e_getnum_vf_vsi_vlan_filters(struct i40e_vsi *vsi) +-{ +- struct i40e_mac_filter *f; +- int num_vlans = 0, bkt; +- +- hash_for_each(vsi->mac_filter_hash, bkt, f, hlist) { +- if (f->vlan >= 0 && f->vlan <= I40E_MAX_VLANID) +- num_vlans++; +- } +- +- return num_vlans; +-} +- + /** + * i40e_vc_config_promiscuous_mode_msg + * @vf: pointer to the VF info +-- +2.16.4 + diff --git a/patches.suse/i40e-always-propagate-error-value-in-i40e_set_vsi_pr.patch b/patches.suse/i40e-always-propagate-error-value-in-i40e_set_vsi_pr.patch new file mode 100644 index 0000000..0e8ca49 --- /dev/null +++ b/patches.suse/i40e-always-propagate-error-value-in-i40e_set_vsi_pr.patch @@ -0,0 +1,74 @@ +From b3c708f5b780b65dce69ad92919381ba29de9bd6 Mon Sep 17 00:00:00 2001 +From: Stefan Assmann +Date: Thu, 20 Aug 2020 13:53:12 +0200 +Subject: [PATCH 6/7] i40e: always propagate error value in + i40e_set_vsi_promisc() +Git-commit: b6f23d3817b965bcd6d72aab1f438ff6d16a0691 +References: git-fixes +Patch-mainline: v5.9-rc7 + +The for loop in i40e_set_vsi_promisc() reports errors via dev_err() but +does not propagate the error up the call chain. Instead it continues the +loop and potentially overwrites the reported error value. +This results in the error being recorded in the log buffer, but the +caller might never know anything went the wrong way. + +To avoid this situation i40e_set_vsi_promisc() needs to temporarily store +the error after reporting it. This is still not optimal as multiple +different errors may occur, so store the first error and hope that's +the main issue. + +Fixes: 37d318d7805f (i40e: Remove scheduling while atomic possibility) +Reported-by: Michal Schmidt +Signed-off-by: Stefan Assmann +Tested-by: Aaron Brown +Signed-off-by: Tony Nguyen +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index c8622aa45707..e0ab04cce265 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -1197,9 +1197,9 @@ static i40e_status + i40e_set_vsi_promisc(struct i40e_vf *vf, u16 seid, bool multi_enable, + bool unicast_enable, s16 *vl, u16 num_vlans) + { ++ i40e_status aq_ret, aq_tmp = 0; + struct i40e_pf *pf = vf->pf; + struct i40e_hw *hw = &pf->hw; +- i40e_status aq_ret; + int i; + + /* No VLAN to set promisc on, set on VSI */ +@@ -1248,6 +1248,9 @@ i40e_set_vsi_promisc(struct i40e_vf *vf, u16 seid, bool multi_enable, + vf->vf_id, + i40e_stat_str(&pf->hw, aq_ret), + i40e_aq_str(&pf->hw, aq_err)); ++ ++ if (!aq_tmp) ++ aq_tmp = aq_ret; + } + + aq_ret = i40e_aq_set_vsi_uc_promisc_on_vlan(hw, seid, +@@ -1261,8 +1264,15 @@ i40e_set_vsi_promisc(struct i40e_vf *vf, u16 seid, bool multi_enable, + vf->vf_id, + i40e_stat_str(&pf->hw, aq_ret), + i40e_aq_str(&pf->hw, aq_err)); ++ ++ if (!aq_tmp) ++ aq_tmp = aq_ret; + } + } ++ ++ if (aq_tmp) ++ aq_ret = aq_tmp; ++ + return aq_ret; + } + +-- +2.16.4 + diff --git a/patches.suse/i40e-fix-return-of-uninitialized-aq_ret-in-i40e_set_.patch b/patches.suse/i40e-fix-return-of-uninitialized-aq_ret-in-i40e_set_.patch new file mode 100644 index 0000000..1a42593 --- /dev/null +++ b/patches.suse/i40e-fix-return-of-uninitialized-aq_ret-in-i40e_set_.patch @@ -0,0 +1,76 @@ +From 596e86ecfbf8995d29bf5a8c92561ccbb0a54e95 Mon Sep 17 00:00:00 2001 +From: Stefan Assmann +Date: Thu, 13 Aug 2020 13:26:38 +0200 +Subject: [PATCH 5/7] i40e: fix return of uninitialized aq_ret in + i40e_set_vsi_promisc +Git-commit: e1e1b5356eb48dce4307f5cae10e4d6d5bd3df74 +References: git-fixes +Patch-mainline: v5.9-rc7 + +drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c: In function ‘i40e_set_vsi_promisc’: +drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c:1176:14: error: ‘aq_ret’ may be used uninitialized in this function [-Werror=maybe-uninitialized] + i40e_status aq_ret; + +In case the code inside the if statement and the for loop does not get +executed aq_ret will be uninitialized when the variable gets returned at +the end of the function. + +Avoid this by changing num_vlans from int to u16, so aq_ret always gets +set. Making this change in additional places as num_vlans should never +be negative. + +Fixes: 37d318d7805f ("i40e: Remove scheduling while atomic possibility") +Signed-off-by: Stefan Assmann +Acked-by: Jakub Kicinski +Tested-by: Aaron Brown +Signed-off-by: Tony Nguyen +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index 6642abbdccee..c8622aa45707 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -1141,7 +1141,7 @@ static int i40e_quiesce_vf_pci(struct i40e_vf *vf) + static int i40e_getnum_vf_vsi_vlan_filters(struct i40e_vsi *vsi) + { + struct i40e_mac_filter *f; +- int num_vlans = 0, bkt; ++ u16 num_vlans = 0, bkt; + + hash_for_each(vsi->mac_filter_hash, bkt, f, hlist) { + if (f->vlan >= 0 && f->vlan <= I40E_MAX_VLANID) +@@ -1160,8 +1160,8 @@ static int i40e_getnum_vf_vsi_vlan_filters(struct i40e_vsi *vsi) + * + * Called to get number of VLANs and VLAN list present in mac_filter_hash. + **/ +-static void i40e_get_vlan_list_sync(struct i40e_vsi *vsi, int *num_vlans, +- s16 **vlan_list) ++static void i40e_get_vlan_list_sync(struct i40e_vsi *vsi, u16 *num_vlans, ++ s16 **vlan_list) + { + struct i40e_mac_filter *f; + int i = 0; +@@ -1195,7 +1195,7 @@ static void i40e_get_vlan_list_sync(struct i40e_vsi *vsi, int *num_vlans, + **/ + static i40e_status + i40e_set_vsi_promisc(struct i40e_vf *vf, u16 seid, bool multi_enable, +- bool unicast_enable, s16 *vl, int num_vlans) ++ bool unicast_enable, s16 *vl, u16 num_vlans) + { + struct i40e_pf *pf = vf->pf; + struct i40e_hw *hw = &pf->hw; +@@ -1284,7 +1284,7 @@ static i40e_status i40e_config_vf_promiscuous_mode(struct i40e_vf *vf, + i40e_status aq_ret = I40E_SUCCESS; + struct i40e_pf *pf = vf->pf; + struct i40e_vsi *vsi; +- int num_vlans; ++ u16 num_vlans; + s16 *vl; + + vsi = i40e_find_vsi_from_id(pf, vsi_id); +-- +2.16.4 + diff --git a/patches.suse/iavf-Fix-incorrect-adapter-get-in-iavf_resume.patch b/patches.suse/iavf-Fix-incorrect-adapter-get-in-iavf_resume.patch new file mode 100644 index 0000000..384e4ea --- /dev/null +++ b/patches.suse/iavf-Fix-incorrect-adapter-get-in-iavf_resume.patch @@ -0,0 +1,41 @@ +From 97409904bee7f86151bfc6c5cad85bf68f2356a5 Mon Sep 17 00:00:00 2001 +From: Sylwester Dziedziuch +Date: Wed, 2 Sep 2020 12:54:59 +0000 +Subject: [PATCH] iavf: Fix incorrect adapter get in iavf_resume +Git-commit: 75598a8fc0e0dff2aa5d46c62531b36a595f1d4f +References: git-fixes +Patch-mainline: v5.9 + +When calling iavf_resume there was a crash because wrong +function was used to get iavf_adapter and net_device pointers. +Changed how iavf_resume is getting iavf_adapter and net_device +pointers from pci_dev. + +Fixes: 5eae00c57f5e ("i40evf: main driver core") +Signed-off-by: Sylwester Dziedziuch +Reviewed-by: Aleksandr Loktionov +Tested-by: Aaron Brown +Signed-off-by: Tony Nguyen +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index e161085fa424..822a7a9c17ba 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -3819,8 +3819,8 @@ static int iavf_suspend(struct pci_dev *pdev, pm_message_t state) + **/ + static int iavf_resume(struct pci_dev *pdev) + { +- struct iavf_adapter *adapter = pci_get_drvdata(pdev); +- struct net_device *netdev = adapter->netdev; ++ struct net_device *netdev = pci_get_drvdata(pdev); ++ struct iavf_adapter *adapter = netdev_priv(netdev); + u32 err; + + pci_set_power_state(pdev, PCI_D0); +-- +2.16.4 + diff --git a/patches.suse/ieee802154-atusb-fix-uninit-value-in-atusb_set_exten.patch b/patches.suse/ieee802154-atusb-fix-uninit-value-in-atusb_set_exten.patch new file mode 100644 index 0000000..1418c3c --- /dev/null +++ b/patches.suse/ieee802154-atusb-fix-uninit-value-in-atusb_set_exten.patch @@ -0,0 +1,70 @@ +From 1c9aa0e43dbfdae35b72e84c3374b18a54927e3e Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Tue, 4 Jan 2022 21:28:06 +0300 +Subject: [PATCH 2/6] ieee802154: atusb: fix uninit value in + atusb_set_extended_addr +References: git-fixes +Patch-mainline: v5.16 +Git-commit: 754e4382354f7908923a1949d8dc8d05f82f09cb + +Alexander reported a use of uninitialized value in +atusb_set_extended_addr(), that is caused by reading 0 bytes via +usb_control_msg(). + +Fix it by validating if the number of bytes transferred is actually +correct, since usb_control_msg() may read less bytes, than was requested +by caller. + +Fail log: + +BUG: KASAN: uninit-cmp in ieee802154_is_valid_extended_unicast_addr include/linux/ieee802154.h:310 [inline] +BUG: KASAN: uninit-cmp in atusb_set_extended_addr drivers/net/ieee802154/atusb.c:1000 [inline] +BUG: KASAN: uninit-cmp in atusb_probe.cold+0x29f/0x14db drivers/net/ieee802154/atusb.c:1056 +Uninit value used in comparison: 311daa649a2003bd stack handle: 000000009a2003bd + ieee802154_is_valid_extended_unicast_addr include/linux/ieee802154.h:310 [inline] + atusb_set_extended_addr drivers/net/ieee802154/atusb.c:1000 [inline] + atusb_probe.cold+0x29f/0x14db drivers/net/ieee802154/atusb.c:1056 + usb_probe_interface+0x314/0x7f0 drivers/usb/core/driver.c:396 + +Fixes: 7490b008d123 ("ieee802154: add support for atusb transceiver") +Reported-by: Alexander Potapenko +Acked-by: Alexander Aring +Signed-off-by: Pavel Skripkin +Link: https://lore.kernel.org/r/20220104182806.7188-1-paskripkin@gmail.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Denis Kirjanov +--- + drivers/net/ieee802154/atusb.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ieee802154/atusb.c b/drivers/net/ieee802154/atusb.c +index 2c4274453c15..95510638ebd7 100644 +--- a/drivers/net/ieee802154/atusb.c ++++ b/drivers/net/ieee802154/atusb.c +@@ -84,7 +84,9 @@ static int atusb_control_msg(struct atusb *atusb, unsigned int pipe, + + ret = usb_control_msg(usb_dev, pipe, request, requesttype, + value, index, data, size, timeout); +- if (ret < 0) { ++ if (ret < size) { ++ ret = ret < 0 ? ret : -ENODATA; ++ + atusb->err = ret; + dev_err(&usb_dev->dev, + "atusb_control_msg: req 0x%02x val 0x%x idx 0x%x, error %d\n", +@@ -656,9 +658,9 @@ static int atusb_get_and_show_build(struct atusb *atusb) + if (!build) + return -ENOMEM; + +- ret = atusb_control_msg(atusb, usb_rcvctrlpipe(usb_dev, 0), +- ATUSB_BUILD, ATUSB_REQ_FROM_DEV, 0, 0, +- build, ATUSB_BUILD_SIZE, 1000); ++ /* We cannot call atusb_control_msg() here, since this request may read various length data */ ++ ret = usb_control_msg(atusb->usb_dev, usb_rcvctrlpipe(usb_dev, 0), ATUSB_BUILD, ++ ATUSB_REQ_FROM_DEV, 0, 0, build, ATUSB_BUILD_SIZE, 1000); + if (ret >= 0) { + build[ret] = 0; + dev_info(&usb_dev->dev, "Firmware: build %s\n", build); +-- +2.16.4 + diff --git a/patches.suse/io-64-nonatomic-add-io-read-write-64-be-_lo_hi-_hi_l.patch b/patches.suse/io-64-nonatomic-add-io-read-write-64-be-_lo_hi-_hi_l.patch new file mode 100644 index 0000000..83d1c08 --- /dev/null +++ b/patches.suse/io-64-nonatomic-add-io-read-write-64-be-_lo_hi-_hi_l.patch @@ -0,0 +1,174 @@ +From: Logan Gunthorpe +Date: Wed, 16 Jan 2019 11:25:21 -0700 +Subject: io-64-nonatomic: add io{read|write}64[be]{_lo_hi|_hi_lo} macros +Git-commit: c81d64d3dc1f2decf8f3a9354416b7496b5c389b +Patch-mainline: 5.1-rc1 +References: git-fixes + +This patch adds generic io{read|write}64[be]{_lo_hi|_hi_lo} macros if +they are not already defined by the architecture. (As they are provided +by the generic iomap library). + +The patch also points io{read|write}64[be] to the variant specified by the +header name. + +This is because new drivers are encouraged to use ioreadXX, et al instead +of readX[1], et al -- and mixing ioreadXX with readq is pretty ugly. + +[1] LDD3: section 9.4.2 + +Signed-off-by: Logan Gunthorpe +Reviewed-by: Andy Shevchenko +Cc: Christoph Hellwig +Cc: Arnd Bergmann +Cc: Alan Cox +Cc: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + include/linux/io-64-nonatomic-hi-lo.h | 64 ++++++++++++++++++++++++++++++++++ + include/linux/io-64-nonatomic-lo-hi.h | 64 ++++++++++++++++++++++++++++++++++ + 2 files changed, 128 insertions(+) + +--- a/include/linux/io-64-nonatomic-hi-lo.h ++++ b/include/linux/io-64-nonatomic-hi-lo.h +@@ -54,4 +54,68 @@ static inline void hi_lo_writeq_relaxed( + #define writeq_relaxed hi_lo_writeq_relaxed + #endif + ++#ifndef ioread64_hi_lo ++#define ioread64_hi_lo ioread64_hi_lo ++static inline u64 ioread64_hi_lo(void __iomem *addr) ++{ ++ u32 low, high; ++ ++ high = ioread32(addr + sizeof(u32)); ++ low = ioread32(addr); ++ ++ return low + ((u64)high << 32); ++} ++#endif ++ ++#ifndef iowrite64_hi_lo ++#define iowrite64_hi_lo iowrite64_hi_lo ++static inline void iowrite64_hi_lo(u64 val, void __iomem *addr) ++{ ++ iowrite32(val >> 32, addr + sizeof(u32)); ++ iowrite32(val, addr); ++} ++#endif ++ ++#ifndef ioread64be_hi_lo ++#define ioread64be_hi_lo ioread64be_hi_lo ++static inline u64 ioread64be_hi_lo(void __iomem *addr) ++{ ++ u32 low, high; ++ ++ high = ioread32be(addr); ++ low = ioread32be(addr + sizeof(u32)); ++ ++ return low + ((u64)high << 32); ++} ++#endif ++ ++#ifndef iowrite64be_hi_lo ++#define iowrite64be_hi_lo iowrite64be_hi_lo ++static inline void iowrite64be_hi_lo(u64 val, void __iomem *addr) ++{ ++ iowrite32be(val >> 32, addr); ++ iowrite32be(val, addr + sizeof(u32)); ++} ++#endif ++ ++#ifndef ioread64 ++#define ioread64_is_nonatomic ++#define ioread64 ioread64_hi_lo ++#endif ++ ++#ifndef iowrite64 ++#define iowrite64_is_nonatomic ++#define iowrite64 iowrite64_hi_lo ++#endif ++ ++#ifndef ioread64be ++#define ioread64be_is_nonatomic ++#define ioread64be ioread64be_hi_lo ++#endif ++ ++#ifndef iowrite64be ++#define iowrite64be_is_nonatomic ++#define iowrite64be iowrite64be_hi_lo ++#endif ++ + #endif /* _LINUX_IO_64_NONATOMIC_HI_LO_H_ */ +--- a/include/linux/io-64-nonatomic-lo-hi.h ++++ b/include/linux/io-64-nonatomic-lo-hi.h +@@ -54,4 +54,68 @@ static inline void lo_hi_writeq_relaxed( + #define writeq_relaxed lo_hi_writeq_relaxed + #endif + ++#ifndef ioread64_lo_hi ++#define ioread64_lo_hi ioread64_lo_hi ++static inline u64 ioread64_lo_hi(void __iomem *addr) ++{ ++ u32 low, high; ++ ++ low = ioread32(addr); ++ high = ioread32(addr + sizeof(u32)); ++ ++ return low + ((u64)high << 32); ++} ++#endif ++ ++#ifndef iowrite64_lo_hi ++#define iowrite64_lo_hi iowrite64_lo_hi ++static inline void iowrite64_lo_hi(u64 val, void __iomem *addr) ++{ ++ iowrite32(val, addr); ++ iowrite32(val >> 32, addr + sizeof(u32)); ++} ++#endif ++ ++#ifndef ioread64be_lo_hi ++#define ioread64be_lo_hi ioread64be_lo_hi ++static inline u64 ioread64be_lo_hi(void __iomem *addr) ++{ ++ u32 low, high; ++ ++ low = ioread32be(addr + sizeof(u32)); ++ high = ioread32be(addr); ++ ++ return low + ((u64)high << 32); ++} ++#endif ++ ++#ifndef iowrite64be_lo_hi ++#define iowrite64be_lo_hi iowrite64be_lo_hi ++static inline void iowrite64be_lo_hi(u64 val, void __iomem *addr) ++{ ++ iowrite32be(val, addr + sizeof(u32)); ++ iowrite32be(val >> 32, addr); ++} ++#endif ++ ++#ifndef ioread64 ++#define ioread64_is_nonatomic ++#define ioread64 ioread64_lo_hi ++#endif ++ ++#ifndef iowrite64 ++#define iowrite64_is_nonatomic ++#define iowrite64 iowrite64_lo_hi ++#endif ++ ++#ifndef ioread64be ++#define ioread64be_is_nonatomic ++#define ioread64be ioread64be_lo_hi ++#endif ++ ++#ifndef iowrite64be ++#define iowrite64be_is_nonatomic ++#define iowrite64be iowrite64be_lo_hi ++#endif ++ + #endif /* _LINUX_IO_64_NONATOMIC_LO_HI_H_ */ diff --git a/patches.suse/isdn-cpai-check-ctr-cnr-to-avoid-array-index-out-of-bound.patch b/patches.suse/isdn-cpai-check-ctr-cnr-to-avoid-array-index-out-of-bound.patch new file mode 100644 index 0000000..b86e54e --- /dev/null +++ b/patches.suse/isdn-cpai-check-ctr-cnr-to-avoid-array-index-out-of-bound.patch @@ -0,0 +1,65 @@ +From: Xiaolong Huang +Date: Fri, 8 Oct 2021 14:58:30 +0800 +Subject: isdn: cpai: check ctr->cnr to avoid array index out of bound +Git-commit: 1f3e2e97c003f80c4b087092b225c8787ff91e4d +Patch-mainline: v5.15-rc6 +References: bsc#1191958 CVE-2021-43389 + +The cmtp_add_connection() would add a cmtp session to a controller +and run a kernel thread to process cmtp. + + __module_get(THIS_MODULE); + session->task = kthread_run(cmtp_session, session, "kcmtpd_ctr_%d", + session->num); + +During this process, the kernel thread would call detach_capi_ctr() +to detach a register controller. if the controller +was not attached yet, detach_capi_ctr() would +trigger an array-index-out-bounds bug. + +[ 46.866069][ T6479] UBSAN: array-index-out-of-bounds in +drivers/isdn/capi/kcapi.c:483:21 +[ 46.867196][ T6479] index -1 is out of range for type 'capi_ctr *[32]' +[ 46.867982][ T6479] CPU: 1 PID: 6479 Comm: kcmtpd_ctr_0 Not tainted +5.15.0-rc2+ #8 +[ 46.869002][ T6479] Hardware name: QEMU Standard PC (i440FX + PIIX, +1996), BIOS 1.14.0-2 04/01/2014 +[ 46.870107][ T6479] Call Trace: +[ 46.870473][ T6479] dump_stack_lvl+0x57/0x7d +[ 46.870974][ T6479] ubsan_epilogue+0x5/0x40 +[ 46.871458][ T6479] __ubsan_handle_out_of_bounds.cold+0x43/0x48 +[ 46.872135][ T6479] detach_capi_ctr+0x64/0xc0 +[ 46.872639][ T6479] cmtp_session+0x5c8/0x5d0 +[ 46.873131][ T6479] ? __init_waitqueue_head+0x60/0x60 +[ 46.873712][ T6479] ? cmtp_add_msgpart+0x120/0x120 +[ 46.874256][ T6479] kthread+0x147/0x170 +[ 46.874709][ T6479] ? set_kthread_struct+0x40/0x40 +[ 46.875248][ T6479] ret_from_fork+0x1f/0x30 +[ 46.875773][ T6479] + +Signed-off-by: Xiaolong Huang +Acked-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20211008065830.305057-1-butterflyhuangxx@gmail.com +Signed-off-by: Jakub Kicinski +Acked-by: Borislav Petkov +--- + drivers/isdn/capi/kcapi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c +index cb0afe897162..7313454e403a 100644 +--- a/drivers/isdn/capi/kcapi.c ++++ b/drivers/isdn/capi/kcapi.c +@@ -480,6 +480,11 @@ int detach_capi_ctr(struct capi_ctr *ctr) + + ctr_down(ctr, CAPI_CTR_DETACHED); + ++ if (ctr->cnr < 1 || ctr->cnr - 1 >= CAPI_MAXCONTR) { ++ err = -EINVAL; ++ goto unlock_out; ++ } ++ + if (capi_controller[ctr->cnr - 1] != ctr) { + err = -EINVAL; + goto unlock_out; + diff --git a/patches.suse/ixgbe-add-improvement-for-MDD-response-functionality.patch b/patches.suse/ixgbe-add-improvement-for-MDD-response-functionality.patch new file mode 100644 index 0000000..ca6bdf5 --- /dev/null +++ b/patches.suse/ixgbe-add-improvement-for-MDD-response-functionality.patch @@ -0,0 +1,153 @@ +From: Slawomir Mrozowicz +Date: Tue, 1 Mar 2022 11:40:09 +0000 +Subject: ixgbe: add improvement for MDD response functionality +Patch-mainline: v5.18-rc1 +Git-commit: 008ca35f6e87be1d60b6af3d1ae247c6d5c2531d +References: bsc#1196426 CVE-2021-33061 + +The 82599 PF driver disable VF driver after a special MDD event occurs. +Adds the option for administrators to control whether VFs are +automatically disabled after several MDD events. +The automatically disabling is now the default mode for 82599 PF driver, +as it is more reliable. + +This addresses CVE-2021-33061. + +Signed-off-by: Slawomir Mrozowicz +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/intel/ixgbe/ixgbe.h | 5 ++++ + drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 21 +++++++++++++++++ + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 28 ++++++++++++++++++++++- + 3 files changed, 53 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe.h ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe.h +@@ -208,6 +208,7 @@ struct vf_data_storage { + u8 trusted; + int xcast_mode; + unsigned int vf_api; ++ u8 primary_abort_count; + }; + + enum ixgbevf_xcast_modes { +@@ -571,6 +572,8 @@ struct ixgbe_mac_addr { + #define IXGBE_TRY_LINK_TIMEOUT (4 * HZ) + #define IXGBE_SFP_POLL_JIFFIES (2 * HZ) /* SFP poll every 2 seconds */ + ++#define IXGBE_PRIMARY_ABORT_LIMIT 5 ++ + /* board specific private data structure */ + struct ixgbe_adapter { + unsigned long active_vlans[BITS_TO_LONGS(VLAN_N_VID)]; +@@ -643,6 +643,7 @@ struct ixgbe_adapter { + #define IXGBE_FLAG2_RX_LEGACY BIT(16) + #define IXGBE_FLAG2_IPSEC_ENABLED BIT(17) + #define IXGBE_FLAG2_VF_IPSEC_ENABLED BIT(18) ++#define IXGBE_FLAG2_AUTO_DISABLE_VF BIT(19) + + /* Tx fast path data */ + int num_tx_queues; +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c +@@ -163,6 +163,8 @@ static const char ixgbe_priv_flags_strin + "legacy-rx", + #define IXGBE_PRIV_FLAGS_VF_IPSEC_EN BIT(1) + "vf-ipsec", ++#define IXGBE_PRIV_FLAGS_AUTO_DISABLE_VF BIT(2) ++ "mdd-disable-vf", + }; + + #define IXGBE_PRIV_FLAGS_STR_LEN ARRAY_SIZE(ixgbe_priv_flags_strings) +@@ -3439,6 +3441,9 @@ static u32 ixgbe_get_priv_flags(struct n + if (adapter->flags2 & IXGBE_FLAG2_VF_IPSEC_ENABLED) + priv_flags |= IXGBE_PRIV_FLAGS_VF_IPSEC_EN; + ++ if (adapter->flags2 & IXGBE_FLAG2_AUTO_DISABLE_VF) ++ priv_flags |= IXGBE_PRIV_FLAGS_AUTO_DISABLE_VF; ++ + return priv_flags; + } + +@@ -3446,11 +3451,27 @@ static int ixgbe_set_priv_flags(struct n + { + struct ixgbe_adapter *adapter = netdev_priv(netdev); + unsigned int flags2 = adapter->flags2; ++ unsigned int i; + + flags2 &= ~IXGBE_FLAG2_RX_LEGACY; + if (priv_flags & IXGBE_PRIV_FLAGS_LEGACY_RX) + flags2 |= IXGBE_FLAG2_RX_LEGACY; + ++ flags2 &= ~IXGBE_FLAG2_AUTO_DISABLE_VF; ++ if (priv_flags & IXGBE_PRIV_FLAGS_AUTO_DISABLE_VF) { ++ if (adapter->hw.mac.type == ixgbe_mac_82599EB) { ++ /* Reset primary abort counter */ ++ for (i = 0; i < adapter->num_vfs; i++) ++ adapter->vfinfo[i].primary_abort_count = 0; ++ ++ flags2 |= IXGBE_FLAG2_AUTO_DISABLE_VF; ++ } else { ++ e_info(probe, ++ "Cannot set private flags: Operation not supported\n"); ++ return -EOPNOTSUPP; ++ } ++ } ++ + flags2 &= ~IXGBE_FLAG2_VF_IPSEC_ENABLED; + if (priv_flags & IXGBE_PRIV_FLAGS_VF_IPSEC_EN) + flags2 |= IXGBE_FLAG2_VF_IPSEC_ENABLED; +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -7495,6 +7495,27 @@ static void ixgbe_watchdog_flush_tx(stru + } + + #ifdef CONFIG_PCI_IOV ++static void ixgbe_bad_vf_abort(struct ixgbe_adapter *adapter, u32 vf) ++{ ++ struct ixgbe_hw *hw = &adapter->hw; ++ ++ if (adapter->hw.mac.type == ixgbe_mac_82599EB && ++ adapter->flags2 & IXGBE_FLAG2_AUTO_DISABLE_VF) { ++ adapter->vfinfo[vf].primary_abort_count++; ++ if (adapter->vfinfo[vf].primary_abort_count == ++ IXGBE_PRIMARY_ABORT_LIMIT) { ++ ixgbe_set_vf_link_state(adapter, vf, ++ IFLA_VF_LINK_STATE_DISABLE); ++ adapter->vfinfo[vf].primary_abort_count = 0; ++ ++ e_info(drv, ++ "Malicious Driver Detection event detected on PF %d VF %d MAC: %pM mdd-disable-vf=on", ++ hw->bus.func, vf, ++ adapter->vfinfo[vf].vf_mac_addresses); ++ } ++ } ++} ++ + static void ixgbe_check_for_bad_vf(struct ixgbe_adapter *adapter) + { + struct ixgbe_hw *hw = &adapter->hw; +@@ -7526,8 +7547,10 @@ static void ixgbe_check_for_bad_vf(struc + continue; + pci_read_config_word(vfdev, PCI_STATUS, &status_reg); + if (status_reg != IXGBE_FAILED_READ_CFG_WORD && +- status_reg & PCI_STATUS_REC_MASTER_ABORT) ++ status_reg & PCI_STATUS_REC_MASTER_ABORT) { ++ ixgbe_bad_vf_abort(adapter, vf); + pcie_flr(vfdev); ++ } + } + } + +@@ -10519,6 +10542,9 @@ skip_sriov: + if (err) + goto err_sw_init; + ++ if (adapter->hw.mac.type == ixgbe_mac_82599EB) ++ adapter->flags2 |= IXGBE_FLAG2_AUTO_DISABLE_VF; ++ + for (i = 0; i < adapter->num_rx_queues; i++) + u64_stats_init(&adapter->rx_ring[i]->syncp); + for (i = 0; i < adapter->num_tx_queues; i++) diff --git a/patches.suse/ixgbe-add-the-ability-for-the-PF-to-disable-VF-link-.patch b/patches.suse/ixgbe-add-the-ability-for-the-PF-to-disable-VF-link-.patch new file mode 100644 index 0000000..9e2e3b7 --- /dev/null +++ b/patches.suse/ixgbe-add-the-ability-for-the-PF-to-disable-VF-link-.patch @@ -0,0 +1,375 @@ +From: Slawomir Mrozowicz +Date: Tue, 1 Mar 2022 11:40:08 +0000 +Subject: ixgbe: add the ability for the PF to disable VF link state +Patch-mainline: v5.18-rc1 +Git-commit: 366fd1000995d4cf64e1a61a0d78a051550b9841 +References: bsc#1196426 CVE-2021-33061 + +Add support for ndo_set_vf_link_state the Network Device Option that +allows the PF driver to control the virtual link state of the VF devices. +Without this change a VF cannot be disabled/enabled by the administrator. +In the implementation the auto state takes over PF link state to +VF link setting, the enable state is not supported, the disable state +shut off the VF link regardless of the PF setting. + +Signed-off-by: Slawomir Mrozowicz +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/intel/ixgbe/ixgbe.h | 2 + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 11 - + drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h | 2 + drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 206 ++++++++++++++++++++----- + drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.h | 4 + 5 files changed, 181 insertions(+), 44 deletions(-) + +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe.h ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe.h +@@ -201,6 +201,8 @@ struct vf_data_storage { + u16 pf_vlan; /* When set, guest VLAN config not allowed. */ + u16 pf_qos; + u16 tx_rate; ++ int link_enable; ++ int link_state; + u8 spoofchk_enabled; + bool rss_query_enabled; + u8 trusted; +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -5593,6 +5593,9 @@ static void ixgbe_up_complete(struct ixg + ctrl_ext = IXGBE_READ_REG(hw, IXGBE_CTRL_EXT); + ctrl_ext |= IXGBE_CTRL_EXT_PFRSTD; + IXGBE_WRITE_REG(hw, IXGBE_CTRL_EXT, ctrl_ext); ++ ++ /* update setting rx tx for all active vfs */ ++ ixgbe_set_all_vfs(adapter); + } + + void ixgbe_reinit_locked(struct ixgbe_adapter *adapter) +@@ -6041,11 +6044,8 @@ void ixgbe_down(struct ixgbe_adapter *ad + for (i = 0 ; i < adapter->num_vfs; i++) + adapter->vfinfo[i].clear_to_send = false; + +- /* ping all the active vfs to let them know we are going down */ +- ixgbe_ping_all_vfs(adapter); +- +- /* Disable all VFTE/VFRE TX/RX */ +- ixgbe_disable_tx_rx(adapter); ++ /* update setting rx tx for all active vfs */ ++ ixgbe_set_all_vfs(adapter); + } + + /* disable transmits in the hardware now that interrupts are off */ +@@ -10020,6 +10020,7 @@ static const struct net_device_ops ixgbe + .ndo_set_vf_vlan = ixgbe_ndo_set_vf_vlan, + .ndo_set_vf_rate = ixgbe_ndo_set_vf_bw, + .ndo_set_vf_spoofchk = ixgbe_ndo_set_vf_spoofchk, ++ .ndo_set_vf_link_state = ixgbe_ndo_set_vf_link_state, + .ndo_set_vf_rss_query_en = ixgbe_ndo_set_vf_rss_query_en, + .ndo_set_vf_trust = ixgbe_ndo_set_vf_trust, + .ndo_get_vf_config = ixgbe_ndo_get_vf_config, +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h +@@ -106,6 +106,8 @@ enum ixgbe_pfvf_api_rev { + + #define IXGBE_VF_UPDATE_XCAST_MODE 0x0c + ++#define IXGBE_VF_GET_LINK_STATE 0x10 /* get vf link state */ ++ + /* mailbox API, version 1.4 VF requests */ + #define IXGBE_VF_IPSEC_ADD 0x0d + #define IXGBE_VF_IPSEC_DEL 0x0e +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c +@@ -116,6 +116,7 @@ static int __ixgbe_enable_sriov(struct i + for (i = 0; i < num_vfs; i++) { + /* enable spoof checking for all VFs */ + adapter->vfinfo[i].spoofchk_enabled = true; ++ adapter->vfinfo[i].link_enable = true; + + /* We support VF RSS querying only for 82599 and x540 + * devices at the moment. These devices share RSS +@@ -800,6 +801,57 @@ static inline void ixgbe_write_qde(struc + } + } + ++/** ++ * ixgbe_set_vf_rx_tx - Set VF rx tx ++ * @adapter: Pointer to adapter struct ++ * @vf: VF identifier ++ * ++ * Set or reset correct transmit and receive for vf ++ **/ ++static void ixgbe_set_vf_rx_tx(struct ixgbe_adapter *adapter, int vf) ++{ ++ u32 reg_cur_tx, reg_cur_rx, reg_req_tx, reg_req_rx; ++ struct ixgbe_hw *hw = &adapter->hw; ++ u32 reg_offset, vf_shift; ++ ++ vf_shift = vf % 32; ++ reg_offset = vf / 32; ++ ++ reg_cur_tx = IXGBE_READ_REG(hw, IXGBE_VFTE(reg_offset)); ++ reg_cur_rx = IXGBE_READ_REG(hw, IXGBE_VFRE(reg_offset)); ++ ++ if (adapter->vfinfo[vf].link_enable) { ++ reg_req_tx = reg_cur_tx | 1 << vf_shift; ++ reg_req_rx = reg_cur_rx | 1 << vf_shift; ++ } else { ++ reg_req_tx = reg_cur_tx & ~(1 << vf_shift); ++ reg_req_rx = reg_cur_rx & ~(1 << vf_shift); ++ } ++ ++ /* The 82599 cannot support a mix of jumbo and non-jumbo PF/VFs. ++ * For more info take a look at ixgbe_set_vf_lpe ++ */ ++ if (adapter->hw.mac.type == ixgbe_mac_82599EB) { ++ struct net_device *dev = adapter->netdev; ++ int pf_max_frame = dev->mtu + ETH_HLEN; ++ ++#if IS_ENABLED(CONFIG_FCOE) ++ if (dev->features & NETIF_F_FCOE_MTU) ++ pf_max_frame = max_t(int, pf_max_frame, ++ IXGBE_FCOE_JUMBO_FRAME_SIZE); ++#endif /* CONFIG_FCOE */ ++ ++ if (pf_max_frame > ETH_FRAME_LEN) ++ reg_req_rx = reg_cur_rx & ~(1 << vf_shift); ++ } ++ ++ /* Enable/Disable particular VF */ ++ if (reg_cur_tx != reg_req_tx) ++ IXGBE_WRITE_REG(hw, IXGBE_VFTE(reg_offset), reg_req_tx); ++ if (reg_cur_rx != reg_req_rx) ++ IXGBE_WRITE_REG(hw, IXGBE_VFRE(reg_offset), reg_req_rx); ++} ++ + static int ixgbe_vf_reset_msg(struct ixgbe_adapter *adapter, u32 vf) + { + struct ixgbe_ring_feature *vmdq = &adapter->ring_feature[RING_F_VMDQ]; +@@ -823,11 +875,6 @@ static int ixgbe_vf_reset_msg(struct ixg + vf_shift = vf % 32; + reg_offset = vf / 32; + +- /* enable transmit for vf */ +- reg = IXGBE_READ_REG(hw, IXGBE_VFTE(reg_offset)); +- reg |= BIT(vf_shift); +- IXGBE_WRITE_REG(hw, IXGBE_VFTE(reg_offset), reg); +- + /* force drop enable for all VF Rx queues */ + reg = IXGBE_QDE_ENABLE; + if (adapter->vfinfo[vf].pf_vlan) +@@ -835,27 +882,7 @@ static int ixgbe_vf_reset_msg(struct ixg + + ixgbe_write_qde(adapter, vf, reg); + +- /* enable receive for vf */ +- reg = IXGBE_READ_REG(hw, IXGBE_VFRE(reg_offset)); +- reg |= BIT(vf_shift); +- /* +- * The 82599 cannot support a mix of jumbo and non-jumbo PF/VFs. +- * For more info take a look at ixgbe_set_vf_lpe +- */ +- if (adapter->hw.mac.type == ixgbe_mac_82599EB) { +- struct net_device *dev = adapter->netdev; +- int pf_max_frame = dev->mtu + ETH_HLEN; +- +-#ifdef CONFIG_FCOE +- if (dev->features & NETIF_F_FCOE_MTU) +- pf_max_frame = max_t(int, pf_max_frame, +- IXGBE_FCOE_JUMBO_FRAME_SIZE); +- +-#endif /* CONFIG_FCOE */ +- if (pf_max_frame > ETH_FRAME_LEN) +- reg &= ~BIT(vf_shift); +- } +- IXGBE_WRITE_REG(hw, IXGBE_VFRE(reg_offset), reg); ++ ixgbe_set_vf_rx_tx(adapter, vf); + + /* enable VF mailbox for further messages */ + adapter->vfinfo[vf].clear_to_send = true; +@@ -1175,6 +1202,25 @@ out: + return 0; + } + ++static int ixgbe_get_vf_link_state(struct ixgbe_adapter *adapter, ++ u32 *msgbuf, u32 vf) ++{ ++ u32 *link_state = &msgbuf[1]; ++ ++ /* verify the PF is supporting the correct API */ ++ switch (adapter->vfinfo[vf].vf_api) { ++ case ixgbe_mbox_api_12: ++ case ixgbe_mbox_api_13: ++ break; ++ default: ++ return -EOPNOTSUPP; ++ } ++ ++ *link_state = adapter->vfinfo[vf].link_enable; ++ ++ return 0; ++} ++ + static int ixgbe_rcv_msg_from_vf(struct ixgbe_adapter *adapter, u32 vf) + { + u32 mbx_size = IXGBE_VFMAILBOX_SIZE; +@@ -1298,6 +1298,9 @@ static int ixgbe_rcv_msg_from_vf(struct + case IXGBE_VF_IPSEC_DEL: + retval = ixgbe_ipsec_vf_del_sa(adapter, msgbuf, vf); + break; ++ case IXGBE_VF_GET_LINK_STATE: ++ retval = ixgbe_get_vf_link_state(adapter, msgbuf, vf); ++ break; + default: + e_err(drv, "Unhandled Msg %8.8x\n", msgbuf[0]); + retval = IXGBE_ERR_MBX; +@@ -1289,18 +1338,6 @@ void ixgbe_msg_task(struct ixgbe_adapter + } + } + +-void ixgbe_disable_tx_rx(struct ixgbe_adapter *adapter) +-{ +- struct ixgbe_hw *hw = &adapter->hw; +- +- /* disable transmit and receive for all vfs */ +- IXGBE_WRITE_REG(hw, IXGBE_VFTE(0), 0); +- IXGBE_WRITE_REG(hw, IXGBE_VFTE(1), 0); +- +- IXGBE_WRITE_REG(hw, IXGBE_VFRE(0), 0); +- IXGBE_WRITE_REG(hw, IXGBE_VFRE(1), 0); +-} +- + static inline void ixgbe_ping_vf(struct ixgbe_adapter *adapter, int vf) + { + struct ixgbe_hw *hw = &adapter->hw; +@@ -1326,6 +1363,21 @@ void ixgbe_ping_all_vfs(struct ixgbe_ada + } + } + ++/** ++ * ixgbe_set_all_vfs - update vfs queues ++ * @adapter: Pointer to adapter struct ++ * ++ * Update setting transmit and receive queues for all vfs ++ **/ ++void ixgbe_set_all_vfs(struct ixgbe_adapter *adapter) ++{ ++ int i; ++ ++ for (i = 0 ; i < adapter->num_vfs; i++) ++ ixgbe_set_vf_link_state(adapter, i, ++ adapter->vfinfo[i].link_state); ++} ++ + int ixgbe_ndo_set_vf_mac(struct net_device *netdev, int vf, u8 *mac) + { + struct ixgbe_adapter *adapter = netdev_priv(netdev); +@@ -1623,6 +1675,84 @@ int ixgbe_ndo_set_vf_spoofchk(struct net + return 0; + } + ++/** ++ * ixgbe_set_vf_link_state - Set link state ++ * @adapter: Pointer to adapter struct ++ * @vf: VF identifier ++ * @state: required link state ++ * ++ * Set a link force state on/off a single vf ++ **/ ++void ixgbe_set_vf_link_state(struct ixgbe_adapter *adapter, int vf, int state) ++{ ++ adapter->vfinfo[vf].link_state = state; ++ ++ switch (state) { ++ case IFLA_VF_LINK_STATE_AUTO: ++ if (test_bit(__IXGBE_DOWN, &adapter->state)) ++ adapter->vfinfo[vf].link_enable = false; ++ else ++ adapter->vfinfo[vf].link_enable = true; ++ break; ++ case IFLA_VF_LINK_STATE_ENABLE: ++ adapter->vfinfo[vf].link_enable = true; ++ break; ++ case IFLA_VF_LINK_STATE_DISABLE: ++ adapter->vfinfo[vf].link_enable = false; ++ break; ++ } ++ ++ ixgbe_set_vf_rx_tx(adapter, vf); ++ ++ /* restart the VF */ ++ adapter->vfinfo[vf].clear_to_send = false; ++ ixgbe_ping_vf(adapter, vf); ++} ++ ++/** ++ * ixgbe_ndo_set_vf_link_state - Set link state ++ * @netdev: network interface device structure ++ * @vf: VF identifier ++ * @state: required link state ++ * ++ * Set the link state of a specified VF, regardless of physical link state ++ **/ ++int ixgbe_ndo_set_vf_link_state(struct net_device *netdev, int vf, int state) ++{ ++ struct ixgbe_adapter *adapter = netdev_priv(netdev); ++ int ret = 0; ++ ++ if (vf < 0 || vf >= adapter->num_vfs) { ++ dev_err(&adapter->pdev->dev, ++ "NDO set VF link - invalid VF identifier %d\n", vf); ++ return -EINVAL; ++ } ++ ++ switch (state) { ++ case IFLA_VF_LINK_STATE_ENABLE: ++ dev_info(&adapter->pdev->dev, ++ "NDO set VF %d link state %d - not supported\n", ++ vf, state); ++ break; ++ case IFLA_VF_LINK_STATE_DISABLE: ++ dev_info(&adapter->pdev->dev, ++ "NDO set VF %d link state disable\n", vf); ++ ixgbe_set_vf_link_state(adapter, vf, state); ++ break; ++ case IFLA_VF_LINK_STATE_AUTO: ++ dev_info(&adapter->pdev->dev, ++ "NDO set VF %d link state auto\n", vf); ++ ixgbe_set_vf_link_state(adapter, vf, state); ++ break; ++ default: ++ dev_err(&adapter->pdev->dev, ++ "NDO set VF %d - invalid link state %d\n", vf, state); ++ ret = -EINVAL; ++ } ++ ++ return ret; ++} ++ + int ixgbe_ndo_set_vf_rss_query_en(struct net_device *netdev, int vf, + bool setting) + { +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.h ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.h +@@ -42,8 +42,8 @@ void ixgbe_restore_vf_multicasts(struct + #endif + void ixgbe_msg_task(struct ixgbe_adapter *adapter); + int ixgbe_vf_configuration(struct pci_dev *pdev, unsigned int event_mask); +-void ixgbe_disable_tx_rx(struct ixgbe_adapter *adapter); + void ixgbe_ping_all_vfs(struct ixgbe_adapter *adapter); ++void ixgbe_set_all_vfs(struct ixgbe_adapter *adapter); + int ixgbe_ndo_set_vf_mac(struct net_device *netdev, int queue, u8 *mac); + int ixgbe_ndo_set_vf_vlan(struct net_device *netdev, int queue, u16 vlan, + u8 qos, __be16 vlan_proto); +@@ -56,7 +56,9 @@ int ixgbe_ndo_set_vf_rss_query_en(struct + int ixgbe_ndo_set_vf_trust(struct net_device *netdev, int vf, bool setting); + int ixgbe_ndo_get_vf_config(struct net_device *netdev, + int vf, struct ifla_vf_info *ivi); ++int ixgbe_ndo_set_vf_link_state(struct net_device *netdev, int vf, int state); + void ixgbe_check_vf_rate_limit(struct ixgbe_adapter *adapter); ++void ixgbe_set_vf_link_state(struct ixgbe_adapter *adapter, int vf, int state); + int ixgbe_disable_sriov(struct ixgbe_adapter *adapter); + #ifdef CONFIG_PCI_IOV + void ixgbe_enable_sriov(struct ixgbe_adapter *adapter, unsigned int max_vfs); diff --git a/patches.suse/ixgbevf-add-disable-link-state.patch b/patches.suse/ixgbevf-add-disable-link-state.patch new file mode 100644 index 0000000..b0c2410 --- /dev/null +++ b/patches.suse/ixgbevf-add-disable-link-state.patch @@ -0,0 +1,164 @@ +From: Slawomir Mrozowicz +Date: Tue, 1 Mar 2022 11:40:10 +0000 +Subject: ixgbevf: add disable link state +Patch-mainline: v5.18-rc1 +Git-commit: 443ebdd68b443ea0798c883e8aabf10d75268e92 +References: bsc#1196426 CVE-2021-33061 + +Add possibility to disable link state if it is administratively +disabled in PF. + +It is part of the general functionality that allows the PF driver +to control the state of the virtual link VF devices. + +Signed-off-by: Slawomir Mrozowicz +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/intel/ixgbevf/ixgbevf.h | 2 + + drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 11 +++++ + drivers/net/ethernet/intel/ixgbevf/mbx.h | 2 + + drivers/net/ethernet/intel/ixgbevf/vf.c | 42 ++++++++++++++++++++++ + drivers/net/ethernet/intel/ixgbevf/vf.h | 1 + 5 files changed, 57 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf.h ++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf.h +@@ -410,6 +410,8 @@ struct ixgbevf_adapter { + u32 *rss_key; + u8 rss_indir_tbl[IXGBEVF_X550_VFRETA_SIZE]; + u32 flags; ++ bool link_state; ++ + #define IXGBEVF_FLAGS_LEGACY_RX BIT(1) + + #ifdef CONFIG_XFRM +--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c ++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +@@ -2071,7 +2071,9 @@ static void ixgbevf_negotiate_api(struct + static void ixgbevf_up_complete(struct ixgbevf_adapter *adapter) + { + struct net_device *netdev = adapter->netdev; ++ struct pci_dev *pdev = adapter->pdev; + struct ixgbe_hw *hw = &adapter->hw; ++ bool state; + + ixgbevf_configure_msix(adapter); + +@@ -2084,6 +2086,11 @@ static void ixgbevf_up_complete(struct i + + spin_unlock_bh(&adapter->mbx_lock); + ++ state = adapter->link_state; ++ hw->mac.ops.get_link_state(hw, &adapter->link_state); ++ if (state && state != adapter->link_state) ++ dev_info(&pdev->dev, "VF is administratively disabled\n"); ++ + smp_mb__before_atomic(); + clear_bit(__IXGBEVF_DOWN, &adapter->state); + ixgbevf_napi_enable_all(adapter); +@@ -2789,6 +2796,8 @@ static int ixgbevf_sw_init(struct ixgbev + adapter->tx_ring_count = IXGBEVF_DEFAULT_TXD; + adapter->rx_ring_count = IXGBEVF_DEFAULT_RXD; + ++ adapter->link_state = true; ++ + set_bit(__IXGBEVF_DOWN, &adapter->state); + return 0; + +@@ -3018,7 +3027,7 @@ static void ixgbevf_watchdog_subtask(str + + ixgbevf_watchdog_update_link(adapter); + +- if (adapter->link_up) ++ if (adapter->link_up && adapter->link_state) + ixgbevf_watchdog_link_is_up(adapter); + else + ixgbevf_watchdog_link_is_down(adapter); +--- a/drivers/net/ethernet/intel/ixgbevf/mbx.h ++++ b/drivers/net/ethernet/intel/ixgbevf/mbx.h +@@ -116,6 +116,8 @@ enum ixgbe_pfvf_api_rev { + + #define IXGBE_VF_UPDATE_XCAST_MODE 0x0c + ++#define IXGBE_VF_GET_LINK_STATE 0x10 /* get vf link state */ ++ + /* mailbox API, version 1.4 VF requests */ + #define IXGBE_VF_IPSEC_ADD 0x0d + #define IXGBE_VF_IPSEC_DEL 0x0e +--- a/drivers/net/ethernet/intel/ixgbevf/vf.c ++++ b/drivers/net/ethernet/intel/ixgbevf/vf.c +@@ -595,6 +595,46 @@ static s32 ixgbevf_hv_update_xcast_mode( + } + + /** ++ * ixgbevf_get_link_state_vf - Get VF link state from PF ++ * @hw: pointer to the HW structure ++ * @link_state: link state storage ++ * ++ * Returns state of the operation error or success. ++ */ ++static s32 ixgbevf_get_link_state_vf(struct ixgbe_hw *hw, bool *link_state) ++{ ++ u32 msgbuf[2]; ++ s32 ret_val; ++ s32 err; ++ ++ msgbuf[0] = IXGBE_VF_GET_LINK_STATE; ++ msgbuf[1] = 0x0; ++ ++ err = ixgbevf_write_msg_read_ack(hw, msgbuf, msgbuf, 2); ++ ++ if (err || (msgbuf[0] & IXGBE_VT_MSGTYPE_NACK)) { ++ ret_val = IXGBE_ERR_MBX; ++ } else { ++ ret_val = 0; ++ *link_state = msgbuf[1]; ++ } ++ ++ return ret_val; ++} ++ ++/** ++ * ixgbevf_hv_get_link_state_vf - * Hyper-V variant - just a stub. ++ * @hw: unused ++ * @link_state: unused ++ * ++ * Hyper-V variant; there is no mailbox communication. ++ */ ++static s32 ixgbevf_hv_get_link_state_vf(struct ixgbe_hw *hw, bool *link_state) ++{ ++ return -EOPNOTSUPP; ++} ++ ++/** + * ixgbevf_set_vfta_vf - Set/Unset VLAN filter table address + * @hw: pointer to the HW structure + * @vlan: 12 bit VLAN ID +@@ -970,6 +1010,7 @@ static const struct ixgbe_mac_operations + .set_rar = ixgbevf_set_rar_vf, + .update_mc_addr_list = ixgbevf_update_mc_addr_list_vf, + .update_xcast_mode = ixgbevf_update_xcast_mode, ++ .get_link_state = ixgbevf_get_link_state_vf, + .set_uc_addr = ixgbevf_set_uc_addr_vf, + .set_vfta = ixgbevf_set_vfta_vf, + .set_rlpml = ixgbevf_set_rlpml_vf, +@@ -987,6 +1028,7 @@ static const struct ixgbe_mac_operations + .set_rar = ixgbevf_hv_set_rar_vf, + .update_mc_addr_list = ixgbevf_hv_update_mc_addr_list_vf, + .update_xcast_mode = ixgbevf_hv_update_xcast_mode, ++ .get_link_state = ixgbevf_hv_get_link_state_vf, + .set_uc_addr = ixgbevf_hv_set_uc_addr_vf, + .set_vfta = ixgbevf_hv_set_vfta_vf, + .set_rlpml = ixgbevf_hv_set_rlpml_vf, +--- a/drivers/net/ethernet/intel/ixgbevf/vf.h ++++ b/drivers/net/ethernet/intel/ixgbevf/vf.h +@@ -65,6 +65,7 @@ struct ixgbe_mac_operations { + s32 (*init_rx_addrs)(struct ixgbe_hw *); + s32 (*update_mc_addr_list)(struct ixgbe_hw *, struct net_device *); + s32 (*update_xcast_mode)(struct ixgbe_hw *, int); ++ s32 (*get_link_state)(struct ixgbe_hw *hw, bool *link_state); + s32 (*enable_mc)(struct ixgbe_hw *); + s32 (*disable_mc)(struct ixgbe_hw *); + s32 (*clear_vfta)(struct ixgbe_hw *); diff --git a/patches.suse/libertas-Fix-possible-memory-leak-in-probe-and-disco.patch b/patches.suse/libertas-Fix-possible-memory-leak-in-probe-and-disco.patch new file mode 100644 index 0000000..815a511 --- /dev/null +++ b/patches.suse/libertas-Fix-possible-memory-leak-in-probe-and-disco.patch @@ -0,0 +1,71 @@ +From 9692151e2fe7a326bafe99836fd1f20a2cc3a049 Mon Sep 17 00:00:00 2001 +From: Wang Hai +Date: Wed, 20 Oct 2021 20:03:45 +0800 +Subject: [PATCH] libertas: Fix possible memory leak in probe and disconnect +Git-commit: 9692151e2fe7a326bafe99836fd1f20a2cc3a049 +References: git-fixes +Patch-mainline: v5.16-rc1 + +I got memory leak as follows when doing fault injection test: + +unreferenced object 0xffff88812c7d7400 (size 512): + comm "kworker/6:1", pid 176, jiffies 4295003332 (age 822.830s) + hex dump (first 32 bytes): + 00 68 1e 04 81 88 ff ff 01 00 00 00 00 00 00 00 .h.............. + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [] slab_post_alloc_hook+0x9c/0x490 + [] kmem_cache_alloc_trace+0x1f7/0x470 + [] if_usb_probe+0x63/0x446 [usb8xxx] + [] usb_probe_interface+0x1aa/0x3c0 [usbcore] + [] really_probe+0x190/0x480 + [] __driver_probe_device+0xf9/0x180 + [] driver_probe_device+0x53/0x130 + [] __device_attach_driver+0x105/0x130 + [] bus_for_each_drv+0x129/0x190 + [] __device_attach+0x1c9/0x270 + [] device_initial_probe+0x20/0x30 + [] bus_probe_device+0x142/0x160 + [] device_add+0x829/0x1300 + [] usb_set_configuration+0xb01/0xcc0 [usbcore] + [] usb_generic_driver_probe+0x6e/0x90 [usbcore] + [] usb_probe_device+0x6f/0x130 [usbcore] + +cardp is missing being freed in the error handling path of the probe +and the path of the disconnect, which will cause memory leak. + +This patch adds the missing kfree(). + +Fixes: 876c9d3aeb98 ("[PATCH] Marvell Libertas 8388 802.11b/g USB driver") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211020120345.2016045-3-wanghai38@huawei.com +Signed-off-by: Oliver Neukum +--- + drivers/net/wireless/marvell/libertas/if_usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c +index 20436a289d5c..5d6dc1dd050d 100644 +--- a/drivers/net/wireless/marvell/libertas/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas/if_usb.c +@@ -292,6 +292,7 @@ static int if_usb_probe(struct usb_interface *intf, + if_usb_reset_device(cardp); + dealloc: + if_usb_free(cardp); ++ kfree(cardp); + + error: + return r; +@@ -316,6 +317,7 @@ static void if_usb_disconnect(struct usb_interface *intf) + + /* Unlink and free urb */ + if_usb_free(cardp); ++ kfree(cardp); + + usb_set_intfdata(intf, NULL); + usb_put_dev(interface_to_usbdev(intf)); +-- +2.34.1 + diff --git a/patches.suse/libertas_tf-Fix-possible-memory-leak-in-probe-and-di.patch b/patches.suse/libertas_tf-Fix-possible-memory-leak-in-probe-and-di.patch new file mode 100644 index 0000000..fcc1856 --- /dev/null +++ b/patches.suse/libertas_tf-Fix-possible-memory-leak-in-probe-and-di.patch @@ -0,0 +1,71 @@ +From d549107305b4634c81223a853701c06bcf657bc3 Mon Sep 17 00:00:00 2001 +From: Wang Hai +Date: Wed, 20 Oct 2021 20:03:44 +0800 +Subject: [PATCH] libertas_tf: Fix possible memory leak in probe and disconnect +Git-commit: d549107305b4634c81223a853701c06bcf657bc3 +References: git-fixes +Patch-mainline: v5.16-rc1 + +I got memory leak as follows when doing fault injection test: + +unreferenced object 0xffff88810a2ddc00 (size 512): + comm "kworker/6:1", pid 176, jiffies 4295009893 (age 757.220s) + hex dump (first 32 bytes): + 00 50 05 18 81 88 ff ff 00 00 00 00 00 00 00 00 .P.............. + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [] slab_post_alloc_hook+0x9c/0x490 + [] kmem_cache_alloc_trace+0x1f7/0x470 + [] if_usb_probe+0x60/0x37c [libertas_tf_usb] + [] usb_probe_interface+0x1aa/0x3c0 [usbcore] + [] really_probe+0x190/0x480 + [] __driver_probe_device+0xf9/0x180 + [] driver_probe_device+0x53/0x130 + [] __device_attach_driver+0x105/0x130 + [] bus_for_each_drv+0x129/0x190 + [] __device_attach+0x1c9/0x270 + [] device_initial_probe+0x20/0x30 + [] bus_probe_device+0x142/0x160 + [] device_add+0x829/0x1300 + [] usb_set_configuration+0xb01/0xcc0 [usbcore] + [] usb_generic_driver_probe+0x6e/0x90 [usbcore] + [] usb_probe_device+0x6f/0x130 [usbcore] + +cardp is missing being freed in the error handling path of the probe +and the path of the disconnect, which will cause memory leak. + +This patch adds the missing kfree(). + +Fixes: c305a19a0d0a ("libertas_tf: usb specific functions") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211020120345.2016045-2-wanghai38@huawei.com +Signed-off-by: Oliver Neukum +--- + drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/marvell/libertas_tf/if_usb.c b/drivers/net/wireless/marvell/libertas_tf/if_usb.c +index fe0a69e804d8..75b5319d033f 100644 +--- a/drivers/net/wireless/marvell/libertas_tf/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas_tf/if_usb.c +@@ -230,6 +230,7 @@ static int if_usb_probe(struct usb_interface *intf, + + dealloc: + if_usb_free(cardp); ++ kfree(cardp); + error: + lbtf_deb_leave(LBTF_DEB_MAIN); + return -ENOMEM; +@@ -254,6 +255,7 @@ static void if_usb_disconnect(struct usb_interface *intf) + + /* Unlink and free urb */ + if_usb_free(cardp); ++ kfree(cardp); + + usb_set_intfdata(intf, NULL); + usb_put_dev(interface_to_usbdev(intf)); +-- +2.34.1 + diff --git a/patches.suse/lpfc-set-default-protocol-support-to-fcp-only.patch b/patches.suse/lpfc-set-default-protocol-support-to-fcp-only.patch new file mode 100644 index 0000000..0a7ef7b --- /dev/null +++ b/patches.suse/lpfc-set-default-protocol-support-to-fcp-only.patch @@ -0,0 +1,32 @@ +From: Daniel Wagner +Date: Tue, 31 May 2022 15:12:11 +0200 +Subject: lpfc: Set default protocol support to FCP only +Patch-mainline: Never, restore default settings +References: bsc#1194124 bsc#1198899 + +Several regression have been reported due to enabling NVME support +per default. The default was changed during the driver update +and hence it differs in behavior compared with initial release of +SLE12-SP5. Let's set the default back to FCP only. + +Signed-off-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h +index 669f30cde0e6..c2dbb0787ddf 100644 +--- a/drivers/scsi/lpfc/lpfc.h ++++ b/drivers/scsi/lpfc/lpfc.h +@@ -1075,7 +1075,7 @@ struct lpfc_hba { + #define LPFC_ENABLE_BOTH 3 + #if (IS_ENABLED(CONFIG_NVME_FC)) + #define LPFC_MAX_ENBL_FC4_TYPE LPFC_ENABLE_BOTH +-#define LPFC_DEF_ENBL_FC4_TYPE LPFC_ENABLE_BOTH ++#define LPFC_DEF_ENBL_FC4_TYPE LPFC_ENABLE_FCP + #else + #define LPFC_MAX_ENBL_FC4_TYPE LPFC_ENABLE_FCP + #define LPFC_DEF_ENBL_FC4_TYPE LPFC_ENABLE_FCP +-- +2.29.2 + diff --git a/patches.suse/media-cpia2-fix-control-message-timeouts.patch b/patches.suse/media-cpia2-fix-control-message-timeouts.patch new file mode 100644 index 0000000..11c6369 --- /dev/null +++ b/patches.suse/media-cpia2-fix-control-message-timeouts.patch @@ -0,0 +1,46 @@ +From 10729be03327f53258cb196362015ad5c6eabe02 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 25 Oct 2021 13:16:37 +0100 +Subject: [PATCH] media: cpia2: fix control-message timeouts +Git-commit: 10729be03327f53258cb196362015ad5c6eabe02 +References: git-fixes +Patch-mainline: v5.17-rc1 + +USB control-message timeouts are specified in milliseconds and should +specifically not vary with CONFIG_HZ. + +Fixes: ab33d5071de7 ("V4L/DVB (3376): Add cpia2 camera support") +Cc: stable@vger.kernel.org # 2.6.17 +Signed-off-by: Johan Hovold +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/usb/cpia2/cpia2_usb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/usb/cpia2/cpia2_usb.c b/drivers/media/usb/cpia2/cpia2_usb.c +index 76aac06f9fb8..cba03b286473 100644 +--- a/drivers/media/usb/cpia2/cpia2_usb.c ++++ b/drivers/media/usb/cpia2/cpia2_usb.c +@@ -550,7 +550,7 @@ static int write_packet(struct usb_device *udev, + 0, /* index */ + buf, /* buffer */ + size, +- HZ); ++ 1000); + + kfree(buf); + return ret; +@@ -582,7 +582,7 @@ static int read_packet(struct usb_device *udev, + 0, /* index */ + buf, /* buffer */ + size, +- HZ); ++ 1000); + + if (ret >= 0) + memcpy(registers, buf, size); +-- +2.35.3 + diff --git a/patches.suse/media-cx23885-Fix-snd_card_free-call-on-null-card-po.patch b/patches.suse/media-cx23885-Fix-snd_card_free-call-on-null-card-po.patch new file mode 100644 index 0000000..e939fd3 --- /dev/null +++ b/patches.suse/media-cx23885-Fix-snd_card_free-call-on-null-card-po.patch @@ -0,0 +1,49 @@ +From 7266dda2f1dfe151b12ef0c14eb4d4e622fb211c Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Wed, 4 Aug 2021 10:50:10 +0200 +Subject: [PATCH] media: cx23885: Fix snd_card_free call on null card pointer +Git-commit: 7266dda2f1dfe151b12ef0c14eb4d4e622fb211c +References: git-fixes +Patch-mainline: v5.16-rc1 + +Currently a call to snd_card_new that fails will set card with a NULL +pointer, this causes a null pointer dereference on the error cleanup +path when card it passed to snd_card_free. Fix this by adding a new +error exit path that does not call snd_card_free and exiting via this +new path. + +Addresses-Coverity: ("Explicit null dereference") + +Fixes: 9e44d63246a9 ("[media] cx23885: Add ALSA support") +Signed-off-by: Colin Ian King +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/pci/cx23885/cx23885-alsa.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/pci/cx23885/cx23885-alsa.c b/drivers/media/pci/cx23885/cx23885-alsa.c +index ab14d35214aa..25dc8d4dc5b7 100644 +--- a/drivers/media/pci/cx23885/cx23885-alsa.c ++++ b/drivers/media/pci/cx23885/cx23885-alsa.c +@@ -550,7 +550,7 @@ struct cx23885_audio_dev *cx23885_audio_register(struct cx23885_dev *dev) + SNDRV_DEFAULT_IDX1, SNDRV_DEFAULT_STR1, + THIS_MODULE, sizeof(struct cx23885_audio_dev), &card); + if (err < 0) +- goto error; ++ goto error_msg; + + chip = (struct cx23885_audio_dev *) card->private_data; + chip->dev = dev; +@@ -576,6 +576,7 @@ struct cx23885_audio_dev *cx23885_audio_register(struct cx23885_dev *dev) + + error: + snd_card_free(card); ++error_msg: + pr_err("%s(): Failed to register analog audio adapter\n", + __func__); + +-- +2.35.3 + diff --git a/patches.suse/media-dib0700-fix-undefined-behavior-in-tuner-shutdo.patch b/patches.suse/media-dib0700-fix-undefined-behavior-in-tuner-shutdo.patch new file mode 100644 index 0000000..27aaee3 --- /dev/null +++ b/patches.suse/media-dib0700-fix-undefined-behavior-in-tuner-shutdo.patch @@ -0,0 +1,55 @@ +From f7b77ebe6d2f49c7747b2d619586d1aa33f9ea91 Mon Sep 17 00:00:00 2001 +From: Michael Kuron +Date: Sun, 26 Sep 2021 21:51:26 +0100 +Subject: [PATCH] media: dib0700: fix undefined behavior in tuner shutdown +Git-commit: f7b77ebe6d2f49c7747b2d619586d1aa33f9ea91 +References: git-fixes +Patch-mainline: v5.17-rc1 + +This fixes a problem where closing the tuner would leave it in a state +where it would not tune to any channel when reopened. This problem was +discovered as part of https://github.com/hselasky/webcamd/issues/16. + +Since adap->id is 0 or 1, this bit-shift overflows, which is undefined +behavior. The driver still worked in practice as the overflow would in +most environments result in 0, which rendered the line a no-op. When +running the driver as part of webcamd however, the overflow could lead +to 0xff due to optimizations by the compiler, which would, in the end, +improperly shut down the tuner. + +The bug is a regression introduced in the commit referenced below. The +present patch causes identical behavior to before that commit for +adap->id equal to 0 or 1. The driver does not contain support for +dib0700 devices with more adapters, assuming such even exist. + +Tests have been performed with the Xbox One Digital TV Tuner on amd64. +Not all dib0700 devices are expected to be affected by the regression; +this code path is only taken by those with incorrect endpoint numbers. + +Link: https://lore.kernel.org/linux-media/1d2fc36d94ced6f67c7cc21dcc469d5e5bdd8201.1632689033.git.mchehab+huawei@kernel.org + +Cc: stable@vger.kernel.org +Fixes: 7757ddda6f4f ("[media] DiB0700: add function to change I2C-speed") +Signed-off-by: Michael Kuron +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/usb/dvb-usb/dib0700_core.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c +index 70219b3e8566..7ea8f68b0f45 100644 +--- a/drivers/media/usb/dvb-usb/dib0700_core.c ++++ b/drivers/media/usb/dvb-usb/dib0700_core.c +@@ -618,8 +618,6 @@ int dib0700_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff) + deb_info("the endpoint number (%i) is not correct, use the adapter id instead", adap->fe_adap[0].stream.props.endpoint); + if (onoff) + st->channel_state |= 1 << (adap->id); +- else +- st->channel_state |= 1 << ~(adap->id); + } else { + if (onoff) + st->channel_state |= 1 << (adap->fe_adap[0].stream.props.endpoint-2); +-- +2.35.3 + diff --git a/patches.suse/media-dmxdev-fix-UAF-when-dvb_register_device-fails.patch b/patches.suse/media-dmxdev-fix-UAF-when-dvb_register_device-fails.patch new file mode 100644 index 0000000..460b201 --- /dev/null +++ b/patches.suse/media-dmxdev-fix-UAF-when-dvb_register_device-fails.patch @@ -0,0 +1,103 @@ +From ab599eb11882f834951c436cc080c3455ba32b9b Mon Sep 17 00:00:00 2001 +From: Wang Hai +Date: Fri, 15 Oct 2021 16:57:41 +0800 +Subject: [PATCH] media: dmxdev: fix UAF when dvb_register_device() fails +Git-commit: ab599eb11882f834951c436cc080c3455ba32b9b +References: git-fixes +Patch-mainline: v5.17-rc1 + +I got a use-after-free report: + +dvbdev: dvb_register_device: failed to create device dvb1.dvr0 (-12) +... +================================================================== +BUG: KASAN: use-after-free in dvb_dmxdev_release+0xce/0x2f0 +... +Call Trace: + dump_stack_lvl+0x6c/0x8b + print_address_description.constprop.0+0x48/0x70 + kasan_report.cold+0x82/0xdb + __asan_load4+0x6b/0x90 + dvb_dmxdev_release+0xce/0x2f0 +... +Allocated by task 7666: + kasan_save_stack+0x23/0x50 + __kasan_kmalloc+0x83/0xa0 + kmem_cache_alloc_trace+0x22e/0x470 + dvb_register_device+0x12f/0x980 + dvb_dmxdev_init+0x1f3/0x230 +... +Freed by task 7666: + kasan_save_stack+0x23/0x50 + kasan_set_track+0x20/0x30 + kasan_set_free_info+0x24/0x40 + __kasan_slab_free+0xf2/0x130 + kfree+0xd1/0x5c0 + dvb_register_device.cold+0x1ac/0x1fa + dvb_dmxdev_init+0x1f3/0x230 +... + +When dvb_register_device() in dvb_dmxdev_init() fails, dvb_dmxdev_init() +does not return a failure, and the memory pointed to by dvbdev or +dvr_dvbdev is invalid at this point. If they are used subsequently, it +will result in UFA or null-ptr-deref. + +If dvb_register_device() in dvb_dmxdev_init() fails, fix the bug by making +dvb_dmxdev_init() return an error as well. + +Link: https://lore.kernel.org/linux-media/20211015085741.1203283-1-wanghai38@huawei.com + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/dvb-core/dmxdev.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c +index 5d5a48475a54..01f288fa37e0 100644 +--- a/drivers/media/dvb-core/dmxdev.c ++++ b/drivers/media/dvb-core/dmxdev.c +@@ -1413,7 +1413,7 @@ static const struct dvb_device dvbdev_dvr = { + }; + int dvb_dmxdev_init(struct dmxdev *dmxdev, struct dvb_adapter *dvb_adapter) + { +- int i; ++ int i, ret; + + if (dmxdev->demux->open(dmxdev->demux) < 0) + return -EUSERS; +@@ -1432,14 +1432,26 @@ int dvb_dmxdev_init(struct dmxdev *dmxdev, struct dvb_adapter *dvb_adapter) + DMXDEV_STATE_FREE); + } + +- dvb_register_device(dvb_adapter, &dmxdev->dvbdev, &dvbdev_demux, dmxdev, ++ ret = dvb_register_device(dvb_adapter, &dmxdev->dvbdev, &dvbdev_demux, dmxdev, + DVB_DEVICE_DEMUX, dmxdev->filternum); +- dvb_register_device(dvb_adapter, &dmxdev->dvr_dvbdev, &dvbdev_dvr, ++ if (ret < 0) ++ goto err_register_dvbdev; ++ ++ ret = dvb_register_device(dvb_adapter, &dmxdev->dvr_dvbdev, &dvbdev_dvr, + dmxdev, DVB_DEVICE_DVR, dmxdev->filternum); ++ if (ret < 0) ++ goto err_register_dvr_dvbdev; + + dvb_ringbuffer_init(&dmxdev->dvr_buffer, NULL, 8192); + + return 0; ++ ++err_register_dvr_dvbdev: ++ dvb_unregister_device(dmxdev->dvbdev); ++err_register_dvbdev: ++ vfree(dmxdev->filter); ++ dmxdev->filter = NULL; ++ return ret; + } + + EXPORT_SYMBOL(dvb_dmxdev_init); +-- +2.35.3 + diff --git a/patches.suse/media-dvb-usb-fix-uninit-value-in-dvb_usb_adapter_dv.patch b/patches.suse/media-dvb-usb-fix-uninit-value-in-dvb_usb_adapter_dv.patch new file mode 100644 index 0000000..9be133c --- /dev/null +++ b/patches.suse/media-dvb-usb-fix-uninit-value-in-dvb_usb_adapter_dv.patch @@ -0,0 +1,51 @@ +From c5453769f77ce19a5b03f1f49946fd3f8a374009 Mon Sep 17 00:00:00 2001 +From: Dongliang Mu +Date: Fri, 25 Jun 2021 07:33:27 +0200 +Subject: [PATCH] media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init +Git-commit: c5453769f77ce19a5b03f1f49946fd3f8a374009 +References: git-fixes +Patch-mainline: v5.15-rc1 + +If dibusb_read_eeprom_byte fails, the mac address is not initialized. +And nova_t_read_mac_address does not handle this failure, which leads to +the uninit-value in dvb_usb_adapter_dvb_init. + +Fix this by handling the failure of dibusb_read_eeprom_byte. + +Reported-by: syzbot+e27b4fd589762b0b9329@syzkaller.appspotmail.com +Fixes: 786baecfe78f ("[media] dvb-usb: move it to drivers/media/usb/dvb-usb") +Signed-off-by: Dongliang Mu +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/usb/dvb-usb/nova-t-usb2.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/usb/dvb-usb/nova-t-usb2.c b/drivers/media/usb/dvb-usb/nova-t-usb2.c +index e7b290552b66..9c0eb0d40822 100644 +--- a/drivers/media/usb/dvb-usb/nova-t-usb2.c ++++ b/drivers/media/usb/dvb-usb/nova-t-usb2.c +@@ -130,7 +130,7 @@ static int nova_t_rc_query(struct dvb_usb_device *d, u32 *event, int *state) + + static int nova_t_read_mac_address (struct dvb_usb_device *d, u8 mac[6]) + { +- int i; ++ int i, ret; + u8 b; + + mac[0] = 0x00; +@@ -139,7 +139,9 @@ static int nova_t_read_mac_address (struct dvb_usb_device *d, u8 mac[6]) + + /* this is a complete guess, but works for my box */ + for (i = 136; i < 139; i++) { +- dibusb_read_eeprom_byte(d,i, &b); ++ ret = dibusb_read_eeprom_byte(d, i, &b); ++ if (ret) ++ return ret; + + mac[5 - (i - 136)] = b; + } +-- +2.34.1 + diff --git a/patches.suse/media-dvb-usb-fix-uninit-value-in-vp702x_read_mac_ad.patch b/patches.suse/media-dvb-usb-fix-uninit-value-in-vp702x_read_mac_ad.patch new file mode 100644 index 0000000..d8958e1 --- /dev/null +++ b/patches.suse/media-dvb-usb-fix-uninit-value-in-vp702x_read_mac_ad.patch @@ -0,0 +1,56 @@ +From 797c061ad715a9a1480eb73f44b6939fbe3209ed Mon Sep 17 00:00:00 2001 +From: Dongliang Mu +Date: Fri, 25 Jun 2021 07:59:04 +0200 +Subject: [PATCH] media: dvb-usb: fix uninit-value in vp702x_read_mac_addr +Git-commit: 797c061ad715a9a1480eb73f44b6939fbe3209ed +References: git-fixes +Patch-mainline: v5.15-rc1 + +If vp702x_usb_in_op fails, the mac address is not initialized. +And vp702x_read_mac_addr does not handle this failure, which leads to +the uninit-value in dvb_usb_adapter_dvb_init. + +Fix this by handling the failure of vp702x_usb_in_op. + +Fixes: 786baecfe78f ("[media] dvb-usb: move it to drivers/media/usb/dvb-usb") +Signed-off-by: Dongliang Mu +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/usb/dvb-usb/vp702x.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/usb/dvb-usb/vp702x.c b/drivers/media/usb/dvb-usb/vp702x.c +index bf54747e2e01..a1d9e4801a2b 100644 +--- a/drivers/media/usb/dvb-usb/vp702x.c ++++ b/drivers/media/usb/dvb-usb/vp702x.c +@@ -291,16 +291,22 @@ static int vp702x_rc_query(struct dvb_usb_device *d, u32 *event, int *state) + static int vp702x_read_mac_addr(struct dvb_usb_device *d,u8 mac[6]) + { + u8 i, *buf; ++ int ret; + struct vp702x_device_state *st = d->priv; + + mutex_lock(&st->buf_mutex); + buf = st->buf; +- for (i = 6; i < 12; i++) +- vp702x_usb_in_op(d, READ_EEPROM_REQ, i, 1, &buf[i - 6], 1); ++ for (i = 6; i < 12; i++) { ++ ret = vp702x_usb_in_op(d, READ_EEPROM_REQ, i, 1, ++ &buf[i - 6], 1); ++ if (ret < 0) ++ goto err; ++ } + + memcpy(mac, buf, 6); ++err: + mutex_unlock(&st->buf_mutex); +- return 0; ++ return ret; + } + + static int vp702x_frontend_attach(struct dvb_usb_adapter *adap) +-- +2.34.1 + diff --git a/patches.suse/media-dvb-usb-fix-ununit-value-in-az6027_rc_query.patch b/patches.suse/media-dvb-usb-fix-ununit-value-in-az6027_rc_query.patch new file mode 100644 index 0000000..0f5e93e --- /dev/null +++ b/patches.suse/media-dvb-usb-fix-ununit-value-in-az6027_rc_query.patch @@ -0,0 +1,38 @@ +From afae4ef7d5ad913cab1316137854a36bea6268a5 Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Fri, 13 Aug 2021 16:34:20 +0200 +Subject: [PATCH] media: dvb-usb: fix ununit-value in az6027_rc_query +Git-commit: afae4ef7d5ad913cab1316137854a36bea6268a5 +References: git-fixes +Patch-mainline: v5.16-rc1 + +Syzbot reported ununit-value bug in az6027_rc_query(). The problem was +in missing state pointer initialization. Since this function does nothing +we can simply initialize state to REMOTE_NO_KEY_PRESSED. + +Reported-and-tested-by: syzbot+2cd8c5db4a85f0a04142@syzkaller.appspotmail.com + +Fixes: 76f9a820c867 ("V4L/DVB: AZ6027: Initial import of the driver") +Signed-off-by: Pavel Skripkin +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/usb/dvb-usb/az6027.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/usb/dvb-usb/az6027.c b/drivers/media/usb/dvb-usb/az6027.c +index 1c39b61cde29..86788771175b 100644 +--- a/drivers/media/usb/dvb-usb/az6027.c ++++ b/drivers/media/usb/dvb-usb/az6027.c +@@ -391,6 +391,7 @@ static struct rc_map_table rc_map_az6027_table[] = { + /* remote control stuff (does not work with my box) */ + static int az6027_rc_query(struct dvb_usb_device *d, u32 *event, int *state) + { ++ *state = REMOTE_NO_KEY_PRESSED; + return 0; + } + +-- +2.34.1 + diff --git a/patches.suse/media-em28xx-fix-control-message-timeouts.patch b/patches.suse/media-em28xx-fix-control-message-timeouts.patch new file mode 100644 index 0000000..68ba21b --- /dev/null +++ b/patches.suse/media-em28xx-fix-control-message-timeouts.patch @@ -0,0 +1,41 @@ +From d9b7e8df3aa9b8c10708aab60e72e79ac08237e4 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 25 Oct 2021 13:16:38 +0100 +Subject: [PATCH] media: em28xx: fix control-message timeouts +Git-commit: d9b7e8df3aa9b8c10708aab60e72e79ac08237e4 +REferences: git-fixes +Patch-mainline: v5.17-rc1 + +USB control-message timeouts are specified in milliseconds and should +specifically not vary with CONFIG_HZ. + +Fixes: a6c2ba283565 ("[PATCH] v4l: 716: support for em28xx board family") +Cc: stable@vger.kernel.org # 2.6.16 +Signed-off-by: Johan Hovold +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/usb/em28xx/em28xx-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/media/usb/em28xx/em28xx-core.c ++++ b/drivers/media/usb/em28xx/em28xx-core.c +@@ -100,7 +100,7 @@ int em28xx_read_reg_req_len(struct em28x + mutex_lock(&dev->ctrl_urb_lock); + ret = usb_control_msg(udev, pipe, req, + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- 0x0000, reg, dev->urb_buf, len, HZ); ++ 0x0000, reg, dev->urb_buf, len, 1000); + if (ret < 0) { + em28xx_regdbg("(pipe 0x%08x): IN: %02x %02x %02x %02x %02x %02x %02x %02x failed\n", + pipe, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +@@ -175,7 +175,7 @@ int em28xx_write_regs_req(struct em28xx + memcpy(dev->urb_buf, buf, len); + ret = usb_control_msg(udev, pipe, req, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- 0x0000, reg, dev->urb_buf, len, HZ); ++ 0x0000, reg, dev->urb_buf, len, 1000); + mutex_unlock(&dev->ctrl_urb_lock); + + if (ret < 0) diff --git a/patches.suse/media-em28xx-fix-memory-leak-in-em28xx_init_dev.patch b/patches.suse/media-em28xx-fix-memory-leak-in-em28xx_init_dev.patch new file mode 100644 index 0000000..6f1e402 --- /dev/null +++ b/patches.suse/media-em28xx-fix-memory-leak-in-em28xx_init_dev.patch @@ -0,0 +1,75 @@ +From 22be5a10d0b24eec9e45decd15d7e6112b25f080 Mon Sep 17 00:00:00 2001 +From: Dongliang Mu +Date: Mon, 1 Nov 2021 09:55:39 +0000 +Subject: [PATCH] media: em28xx: fix memory leak in em28xx_init_dev +Git-commit: 22be5a10d0b24eec9e45decd15d7e6112b25f080 +References: git-fixes +Patch-mainline: v5.17-rc1 + +In the em28xx_init_rev, if em28xx_audio_setup fails, this function fails +to deallocate the media_dev allocated in the em28xx_media_device_init. + +Fix this by adding em28xx_unregister_media_device to free media_dev. + +BTW, this patch is tested in my local syzkaller instance, and it can +prevent the memory leak from occurring again. + +CC: Pavel Skripkin +Fixes: 37ecc7b1278f ("[media] em28xx: add media controller support") +Signed-off-by: Dongliang Mu +Reported-by: syzkaller +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/usb/em28xx/em28xx-cards.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +--- a/drivers/media/usb/em28xx/em28xx-cards.c ++++ b/drivers/media/usb/em28xx/em28xx-cards.c +@@ -3399,8 +3399,10 @@ static int em28xx_init_dev(struct em28xx + + if (dev->is_audio_only) { + retval = em28xx_audio_setup(dev); +- if (retval) +- return -ENODEV; ++ if (retval) { ++ retval = -ENODEV; ++ goto err_deinit_media; ++ } + em28xx_init_extension(dev); + + return 0; +@@ -3430,7 +3432,7 @@ static int em28xx_init_dev(struct em28xx + dev_err(&dev->intf->dev, + "%s: em28xx_i2c_register bus 0 - error [%d]!\n", + __func__, retval); +- return retval; ++ goto err_deinit_media; + } + + /* register i2c bus 1 */ +@@ -3446,9 +3448,7 @@ static int em28xx_init_dev(struct em28xx + "%s: em28xx_i2c_register bus 1 - error [%d]!\n", + __func__, retval); + +- em28xx_i2c_unregister(dev, 0); +- +- return retval; ++ goto err_unreg_i2c; + } + } + +@@ -3456,6 +3456,12 @@ static int em28xx_init_dev(struct em28xx + em28xx_card_setup(dev); + + return 0; ++ ++err_unreg_i2c: ++ em28xx_i2c_unregister(dev, 0); ++err_deinit_media: ++ em28xx_unregister_media_device(dev); ++ return retval; + } + + /* high bandwidth multiplier, as encoded in highspeed endpoint descriptors */ diff --git a/patches.suse/media-flexcop-usb-fix-control-message-timeouts.patch b/patches.suse/media-flexcop-usb-fix-control-message-timeouts.patch new file mode 100644 index 0000000..5b063f9 --- /dev/null +++ b/patches.suse/media-flexcop-usb-fix-control-message-timeouts.patch @@ -0,0 +1,101 @@ +From cd1798a387825cc4a51282f5a611ad05bb1ad75f Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 25 Oct 2021 13:16:36 +0100 +Subject: [PATCH] media: flexcop-usb: fix control-message timeouts +Git-commit: cd1798a387825cc4a51282f5a611ad05bb1ad75f +References: git-fixes +Patch-mainline: v5.17-rc1 + +USB control-message timeouts are specified in milliseconds and should +specifically not vary with CONFIG_HZ. + +Note that the driver was multiplying some of the timeout values with HZ +twice resulting in 3000-second timeouts with HZ=1000. + +Also note that two of the timeout defines are currently unused. + +Fixes: 2154be651b90 ("[media] redrat3: new rc-core IR transceiver device driver") +Cc: stable@vger.kernel.org # 3.0 +Signed-off-by: Johan Hovold +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/usb/b2c2/flexcop-usb.c | 10 +++++----- + drivers/media/usb/b2c2/flexcop-usb.h | 12 ++++++------ + 2 files changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c +index 5d38171b7638..bfeb92d93de3 100644 +--- a/drivers/media/usb/b2c2/flexcop-usb.c ++++ b/drivers/media/usb/b2c2/flexcop-usb.c +@@ -87,7 +87,7 @@ static int flexcop_usb_readwrite_dw(struct flexcop_device *fc, u16 wRegOffsPCI, + 0, + fc_usb->data, + sizeof(u32), +- B2C2_WAIT_FOR_OPERATION_RDW * HZ); ++ B2C2_WAIT_FOR_OPERATION_RDW); + + if (ret != sizeof(u32)) { + err("error while %s dword from %d (%d).", read ? "reading" : +@@ -155,7 +155,7 @@ static int flexcop_usb_v8_memory_req(struct flexcop_usb *fc_usb, + wIndex, + fc_usb->data, + buflen, +- nWaitTime * HZ); ++ nWaitTime); + if (ret != buflen) + ret = -EIO; + +@@ -248,13 +248,13 @@ static int flexcop_usb_i2c_req(struct flexcop_i2c_adapter *i2c, + /* DKT 020208 - add this to support special case of DiSEqC */ + case USB_FUNC_I2C_CHECKWRITE: + pipe = B2C2_USB_CTRL_PIPE_OUT; +- nWaitTime = 2; ++ nWaitTime = 2000; + request_type |= USB_DIR_OUT; + break; + case USB_FUNC_I2C_READ: + case USB_FUNC_I2C_REPEATREAD: + pipe = B2C2_USB_CTRL_PIPE_IN; +- nWaitTime = 2; ++ nWaitTime = 2000; + request_type |= USB_DIR_IN; + break; + default: +@@ -281,7 +281,7 @@ static int flexcop_usb_i2c_req(struct flexcop_i2c_adapter *i2c, + wIndex, + fc_usb->data, + buflen, +- nWaitTime * HZ); ++ nWaitTime); + + if (ret != buflen) + ret = -EIO; +diff --git a/drivers/media/usb/b2c2/flexcop-usb.h b/drivers/media/usb/b2c2/flexcop-usb.h +index 2f230bf72252..c7cca1a5ee59 100644 +--- a/drivers/media/usb/b2c2/flexcop-usb.h ++++ b/drivers/media/usb/b2c2/flexcop-usb.h +@@ -91,13 +91,13 @@ typedef enum { + UTILITY_SRAM_TESTVERIFY = 0x16, + } flexcop_usb_utility_function_t; + +-#define B2C2_WAIT_FOR_OPERATION_RW (1*HZ) +-#define B2C2_WAIT_FOR_OPERATION_RDW (3*HZ) +-#define B2C2_WAIT_FOR_OPERATION_WDW (1*HZ) ++#define B2C2_WAIT_FOR_OPERATION_RW 1000 ++#define B2C2_WAIT_FOR_OPERATION_RDW 3000 ++#define B2C2_WAIT_FOR_OPERATION_WDW 1000 + +-#define B2C2_WAIT_FOR_OPERATION_V8READ (3*HZ) +-#define B2C2_WAIT_FOR_OPERATION_V8WRITE (3*HZ) +-#define B2C2_WAIT_FOR_OPERATION_V8FLASH (3*HZ) ++#define B2C2_WAIT_FOR_OPERATION_V8READ 3000 ++#define B2C2_WAIT_FOR_OPERATION_V8WRITE 3000 ++#define B2C2_WAIT_FOR_OPERATION_V8FLASH 3000 + + typedef enum { + V8_MEMORY_PAGE_DVB_CI = 0x20, +-- +2.35.3 + diff --git a/patches.suse/media-lmedm04-Fix-misuse-of-comma.patch b/patches.suse/media-lmedm04-Fix-misuse-of-comma.patch new file mode 100644 index 0000000..a4b20de --- /dev/null +++ b/patches.suse/media-lmedm04-Fix-misuse-of-comma.patch @@ -0,0 +1,34 @@ +From 59a3e78f8cc33901fe39035c1ab681374bba95ad Mon Sep 17 00:00:00 2001 +From: Joe Perches +Date: Sun, 23 Aug 2020 20:13:31 +0200 +Subject: [PATCH] media: lmedm04: Fix misuse of comma +Git-commit: 59a3e78f8cc33901fe39035c1ab681374bba95ad +References: git-fixes +Patch-mainline: v5.12-rc1 + +There's a comma used instead of a semicolon that causes multiple +statements to be executed after an if instead of just the intended +single statement. + +Replace the comma with a semicolon. + +Fixes: 15e1ce33182d ("[media] lmedm04: Fix usb_submit_urb BOGUS urb xfer, pipe 1 != type 3 in interrupt urb") +Signed-off-by: Joe Perches +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/usb/dvb-usb-v2/lmedm04.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c ++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c +@@ -438,7 +438,7 @@ static int lme2510_int_read(struct dvb_u + ep = usb_pipe_endpoint(d->udev, lme_int->lme_urb->pipe); + + if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK) +- lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa), ++ lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa); + + lme_int->lme_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; + diff --git a/patches.suse/media-mceusb-fix-control-message-timeouts.patch b/patches.suse/media-mceusb-fix-control-message-timeouts.patch new file mode 100644 index 0000000..1416215 --- /dev/null +++ b/patches.suse/media-mceusb-fix-control-message-timeouts.patch @@ -0,0 +1,61 @@ +From 16394e998cbb050730536bdf7e89f5a70efbd974 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 25 Oct 2021 13:16:34 +0100 +Subject: [PATCH] media: mceusb: fix control-message timeouts +Git-commit: 16394e998cbb050730536bdf7e89f5a70efbd974 +References: git-fixes +Patch-mainline: v5.17-rc1 + +USB control-message timeouts are specified in milliseconds and should +specifically not vary with CONFIG_HZ. + +Fixes: 66e89522aff7 ("V4L/DVB: IR: add mceusb IR receiver driver") +Cc: stable@vger.kernel.org # 2.6.36 +Signed-off-by: Johan Hovold +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/rc/mceusb.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c +index d09bee82c04c..2dc810f5a73f 100644 +--- a/drivers/media/rc/mceusb.c ++++ b/drivers/media/rc/mceusb.c +@@ -1430,7 +1430,7 @@ static void mceusb_gen1_init(struct mceusb_dev *ir) + */ + ret = usb_control_msg(ir->usbdev, usb_rcvctrlpipe(ir->usbdev, 0), + USB_REQ_SET_ADDRESS, USB_TYPE_VENDOR, 0, 0, +- data, USB_CTRL_MSG_SZ, HZ * 3); ++ data, USB_CTRL_MSG_SZ, 3000); + dev_dbg(dev, "set address - ret = %d", ret); + dev_dbg(dev, "set address - data[0] = %d, data[1] = %d", + data[0], data[1]); +@@ -1438,20 +1438,20 @@ static void mceusb_gen1_init(struct mceusb_dev *ir) + /* set feature: bit rate 38400 bps */ + ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0), + USB_REQ_SET_FEATURE, USB_TYPE_VENDOR, +- 0xc04e, 0x0000, NULL, 0, HZ * 3); ++ 0xc04e, 0x0000, NULL, 0, 3000); + + dev_dbg(dev, "set feature - ret = %d", ret); + + /* bRequest 4: set char length to 8 bits */ + ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0), + 4, USB_TYPE_VENDOR, +- 0x0808, 0x0000, NULL, 0, HZ * 3); ++ 0x0808, 0x0000, NULL, 0, 3000); + dev_dbg(dev, "set char length - retB = %d", ret); + + /* bRequest 2: set handshaking to use DTR/DSR */ + ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0), + 2, USB_TYPE_VENDOR, +- 0x0000, 0x0100, NULL, 0, HZ * 3); ++ 0x0000, 0x0100, NULL, 0, 3000); + dev_dbg(dev, "set handshake - retC = %d", ret); + + /* device resume */ +-- +2.35.3 + diff --git a/patches.suse/media-mtk-vpu-Fix-a-resource-leak-in-the-error-handl.patch b/patches.suse/media-mtk-vpu-Fix-a-resource-leak-in-the-error-handl.patch new file mode 100644 index 0000000..305f38d --- /dev/null +++ b/patches.suse/media-mtk-vpu-Fix-a-resource-leak-in-the-error-handl.patch @@ -0,0 +1,51 @@ +From 2143ad413c05c7be24c3a92760e367b7f6aaac92 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Thu, 19 Aug 2021 22:21:25 +0200 +Subject: [PATCH] media: mtk-vpu: Fix a resource leak in the error handling + path of 'mtk_vpu_probe()' +Git-commit: 2143ad413c05c7be24c3a92760e367b7f6aaac92 +References: git-fixes +Patch-mainline: v5.16-rc1 + +A successful 'clk_prepare()' call should be balanced by a corresponding +'clk_unprepare()' call in the error handling path of the probe, as already +done in the remove function. + +Update the error handling path accordingly. + +Fixes: 3003a180ef6b ("[media] VPU: mediatek: support Mediatek VPU") +Signed-off-by: Christophe JAILLET +Reviewed-by: Houlong Wei +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/platform/mtk-vpu/mtk_vpu.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/mtk-vpu/mtk_vpu.c b/drivers/media/platform/mtk-vpu/mtk_vpu.c +index ec290dde59cf..7f1647da0ade 100644 +--- a/drivers/media/platform/mtk-vpu/mtk_vpu.c ++++ b/drivers/media/platform/mtk-vpu/mtk_vpu.c +@@ -848,7 +848,8 @@ static int mtk_vpu_probe(struct platform_device *pdev) + vpu->wdt.wq = create_singlethread_workqueue("vpu_wdt"); + if (!vpu->wdt.wq) { + dev_err(dev, "initialize wdt workqueue failed\n"); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto clk_unprepare; + } + INIT_WORK(&vpu->wdt.ws, vpu_wdt_reset_func); + mutex_init(&vpu->vpu_mutex); +@@ -942,6 +943,8 @@ static int mtk_vpu_probe(struct platform_device *pdev) + vpu_clock_disable(vpu); + workqueue_destroy: + destroy_workqueue(vpu->wdt.wq); ++clk_unprepare: ++ clk_unprepare(vpu->clk); + + return ret; + } +-- +2.35.3 + diff --git a/patches.suse/media-netup_unidvb-Don-t-leak-SPI-master-in-probe-er.patch b/patches.suse/media-netup_unidvb-Don-t-leak-SPI-master-in-probe-er.patch new file mode 100644 index 0000000..ed9f25f --- /dev/null +++ b/patches.suse/media-netup_unidvb-Don-t-leak-SPI-master-in-probe-er.patch @@ -0,0 +1,73 @@ +From e297ddf296de35037fa97f4302782def196d350a Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Mon, 7 Dec 2020 09:17:12 +0100 +Subject: [PATCH] media: netup_unidvb: Don't leak SPI master in probe error + path +Git-commit: e297ddf296de35037fa97f4302782def196d350a +References: git-fixes +Patch-mainline: v5.11-rc1 + +If the call to spi_register_master() fails on probe of the NetUP +Universal DVB driver, the spi_master struct is erroneously not freed. + +Likewise, if spi_new_device() fails, the spi_controller struct is +not unregistered. Plug the leaks. + +While at it, fix an ordering issue in netup_spi_release() wherein +spi_unregister_master() is called after fiddling with the IRQ control +register. The correct order is to call spi_unregister_master() *before* +this teardown step because bus accesses may still be ongoing until that +function returns. + +Fixes: 52b1eaf4c59a ("[media] netup_unidvb: NetUP Universal DVB-S/S2/T/T2/C PCI-E card driver") +Signed-off-by: Lukas Wunner +Reviewed-by: Mauro Carvalho Chehab +Cc: # v4.3+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation +Cc: # v4.3+ +Cc: Kozlov Sergey +Link: https://lore.kernel.org/r/c4c24f333fc7840f4a3db24789e6e10dd660bede.1607286887.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Oliver Neukum +--- + drivers/media/pci/netup_unidvb/netup_unidvb_spi.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c b/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c +index d4f12c250f91..526042d8afae 100644 +--- a/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c ++++ b/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c +@@ -175,7 +175,7 @@ int netup_spi_init(struct netup_unidvb_dev *ndev) + struct spi_master *master; + struct netup_spi *nspi; + +- master = spi_alloc_master(&ndev->pci_dev->dev, ++ master = devm_spi_alloc_master(&ndev->pci_dev->dev, + sizeof(struct netup_spi)); + if (!master) { + dev_err(&ndev->pci_dev->dev, +@@ -208,6 +208,7 @@ int netup_spi_init(struct netup_unidvb_dev *ndev) + ndev->pci_slot, + ndev->pci_func); + if (!spi_new_device(master, &netup_spi_board)) { ++ spi_unregister_master(master); + ndev->spi = NULL; + dev_err(&ndev->pci_dev->dev, + "%s(): unable to create SPI device\n", __func__); +@@ -226,13 +227,13 @@ void netup_spi_release(struct netup_unidvb_dev *ndev) + if (!spi) + return; + ++ spi_unregister_master(spi->master); + spin_lock_irqsave(&spi->lock, flags); + reg = readw(&spi->regs->control_stat); + writew(reg | NETUP_SPI_CTRL_IRQ, &spi->regs->control_stat); + reg = readw(&spi->regs->control_stat); + writew(reg & ~NETUP_SPI_CTRL_IMASK, &spi->regs->control_stat); + spin_unlock_irqrestore(&spi->lock, flags); +- spi_unregister_master(spi->master); + ndev->spi = NULL; + } + +-- +2.35.3 + diff --git a/patches.suse/media-pvrusb2-fix-control-message-timeouts.patch b/patches.suse/media-pvrusb2-fix-control-message-timeouts.patch new file mode 100644 index 0000000..d77d80a --- /dev/null +++ b/patches.suse/media-pvrusb2-fix-control-message-timeouts.patch @@ -0,0 +1,64 @@ +From b82bf9b9dc305d7d3d93eab106d70dbf2171b43e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 25 Oct 2021 13:16:39 +0100 +Subject: [PATCH] media: pvrusb2: fix control-message timeouts +Git-commit: b82bf9b9dc305d7d3d93eab106d70dbf2171b43e +References: git-fixes +Patch-mainline: v5.17-rc1 + +USB control-message timeouts are specified in milliseconds and should +specifically not vary with CONFIG_HZ. + +Fixes: d855497edbfb ("V4L/DVB (4228a): pvrusb2 to kernel 2.6.18") +Cc: stable@vger.kernel.org # 2.6.18 +Signed-off-by: Johan Hovold +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +index d38dee1792e4..3915d551d59e 100644 +--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c ++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +@@ -1467,7 +1467,7 @@ static int pvr2_upload_firmware1(struct pvr2_hdw *hdw) + for (address = 0; address < fwsize; address += 0x800) { + memcpy(fw_ptr, fw_entry->data + address, 0x800); + ret += usb_control_msg(hdw->usb_dev, pipe, 0xa0, 0x40, address, +- 0, fw_ptr, 0x800, HZ); ++ 0, fw_ptr, 0x800, 1000); + } + + trace_firmware("Upload done, releasing device's CPU"); +@@ -1605,7 +1605,7 @@ int pvr2_upload_firmware2(struct pvr2_hdw *hdw) + ((u32 *)fw_ptr)[icnt] = swab32(((u32 *)fw_ptr)[icnt]); + + ret |= usb_bulk_msg(hdw->usb_dev, pipe, fw_ptr,bcnt, +- &actual_length, HZ); ++ &actual_length, 1000); + ret |= (actual_length != bcnt); + if (ret) break; + fw_done += bcnt; +@@ -3438,7 +3438,7 @@ void pvr2_hdw_cpufw_set_enabled(struct pvr2_hdw *hdw, + 0xa0,0xc0, + address,0, + hdw->fw_buffer+address, +- 0x800,HZ); ++ 0x800,1000); + if (ret < 0) break; + } + +@@ -3977,7 +3977,7 @@ void pvr2_hdw_cpureset_assert(struct pvr2_hdw *hdw,int val) + /* Write the CPUCS register on the 8051. The lsb of the register + is the reset bit; a 1 asserts reset while a 0 clears it. */ + pipe = usb_sndctrlpipe(hdw->usb_dev, 0); +- ret = usb_control_msg(hdw->usb_dev,pipe,0xa0,0x40,0xe600,0,da,1,HZ); ++ ret = usb_control_msg(hdw->usb_dev,pipe,0xa0,0x40,0xe600,0,da,1,1000); + if (ret < 0) { + pvr2_trace(PVR2_TRACE_ERROR_LEGS, + "cpureset_assert(%d) error=%d",val,ret); +-- +2.35.3 + diff --git a/patches.suse/media-rc-loopback-return-number-of-emitters-rather-t.patch b/patches.suse/media-rc-loopback-return-number-of-emitters-rather-t.patch new file mode 100644 index 0000000..06501de --- /dev/null +++ b/patches.suse/media-rc-loopback-return-number-of-emitters-rather-t.patch @@ -0,0 +1,36 @@ +From 6b7f554be8c92319d7e6df92fd247ebb9beb4a45 Mon Sep 17 00:00:00 2001 +From: Sean Young +Date: Sat, 3 Jul 2021 15:37:17 +0200 +Subject: [PATCH] media: rc-loopback: return number of emitters rather than + error +Git-commit: 6b7f554be8c92319d7e6df92fd247ebb9beb4a45 +References: git-fixes +Patch-mainline: v5.15-rc1 + +The LIRC_SET_TRANSMITTER_MASK ioctl should return the number of emitters +if an invalid list was set. + +Cc: stable@vger.kernel.org +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/rc/rc-loopback.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/rc/rc-loopback.c b/drivers/media/rc/rc-loopback.c +index 1ba3f96ffa7d..40ab66c850f2 100644 +--- a/drivers/media/rc/rc-loopback.c ++++ b/drivers/media/rc/rc-loopback.c +@@ -42,7 +42,7 @@ static int loop_set_tx_mask(struct rc_dev *dev, u32 mask) + + if ((mask & (RXMASK_REGULAR | RXMASK_LEARNING)) != mask) { + dprintk("invalid tx mask: %u\n", mask); +- return -EINVAL; ++ return 2; + } + + dprintk("setting tx mask: %u\n", mask); +-- +2.34.1 + diff --git a/patches.suse/media-redrat3-fix-control-message-timeouts.patch b/patches.suse/media-redrat3-fix-control-message-timeouts.patch new file mode 100644 index 0000000..f722e85 --- /dev/null +++ b/patches.suse/media-redrat3-fix-control-message-timeouts.patch @@ -0,0 +1,119 @@ +From 2adc965c8bfa224e11ecccf9c92fd458c4236428 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 25 Oct 2021 13:16:35 +0100 +Subject: [PATCH] media: redrat3: fix control-message timeouts +Git-commit: 2adc965c8bfa224e11ecccf9c92fd458c4236428 +References: git-fixes +Patch-mainline: v5.17-rc1 + +USB control-message timeouts are specified in milliseconds and should +specifically not vary with CONFIG_HZ. + +Fixes: 2154be651b90 ("[media] redrat3: new rc-core IR transceiver device driver") +Cc: stable@vger.kernel.org # 3.0 +Signed-off-by: Johan Hovold +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/rc/redrat3.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c +index ac85464864b9..cb22316b3f00 100644 +--- a/drivers/media/rc/redrat3.c ++++ b/drivers/media/rc/redrat3.c +@@ -404,7 +404,7 @@ static int redrat3_send_cmd(int cmd, struct redrat3_dev *rr3) + udev = rr3->udev; + res = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), cmd, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, +- 0x0000, 0x0000, data, sizeof(u8), HZ * 10); ++ 0x0000, 0x0000, data, sizeof(u8), 10000); + + if (res < 0) { + dev_err(rr3->dev, "%s: Error sending rr3 cmd res %d, data %d", +@@ -480,7 +480,7 @@ static u32 redrat3_get_timeout(struct redrat3_dev *rr3) + pipe = usb_rcvctrlpipe(rr3->udev, 0); + ret = usb_control_msg(rr3->udev, pipe, RR3_GET_IR_PARAM, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, +- RR3_IR_IO_SIG_TIMEOUT, 0, tmp, len, HZ * 5); ++ RR3_IR_IO_SIG_TIMEOUT, 0, tmp, len, 5000); + if (ret != len) + dev_warn(rr3->dev, "Failed to read timeout from hardware\n"); + else { +@@ -510,7 +510,7 @@ static int redrat3_set_timeout(struct rc_dev *rc_dev, unsigned int timeoutus) + ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), RR3_SET_IR_PARAM, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, + RR3_IR_IO_SIG_TIMEOUT, 0, timeout, sizeof(*timeout), +- HZ * 25); ++ 25000); + dev_dbg(dev, "set ir parm timeout %d ret 0x%02x\n", + be32_to_cpu(*timeout), ret); + +@@ -542,32 +542,32 @@ static void redrat3_reset(struct redrat3_dev *rr3) + *val = 0x01; + rc = usb_control_msg(udev, rxpipe, RR3_RESET, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, +- RR3_CPUCS_REG_ADDR, 0, val, len, HZ * 25); ++ RR3_CPUCS_REG_ADDR, 0, val, len, 25000); + dev_dbg(dev, "reset returned 0x%02x\n", rc); + + *val = length_fuzz; + rc = usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, +- RR3_IR_IO_LENGTH_FUZZ, 0, val, len, HZ * 25); ++ RR3_IR_IO_LENGTH_FUZZ, 0, val, len, 25000); + dev_dbg(dev, "set ir parm len fuzz %d rc 0x%02x\n", *val, rc); + + *val = (65536 - (minimum_pause * 2000)) / 256; + rc = usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, +- RR3_IR_IO_MIN_PAUSE, 0, val, len, HZ * 25); ++ RR3_IR_IO_MIN_PAUSE, 0, val, len, 25000); + dev_dbg(dev, "set ir parm min pause %d rc 0x%02x\n", *val, rc); + + *val = periods_measure_carrier; + rc = usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, +- RR3_IR_IO_PERIODS_MF, 0, val, len, HZ * 25); ++ RR3_IR_IO_PERIODS_MF, 0, val, len, 25000); + dev_dbg(dev, "set ir parm periods measure carrier %d rc 0x%02x", *val, + rc); + + *val = RR3_DRIVER_MAXLENS; + rc = usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, +- RR3_IR_IO_MAX_LENGTHS, 0, val, len, HZ * 25); ++ RR3_IR_IO_MAX_LENGTHS, 0, val, len, 25000); + dev_dbg(dev, "set ir parm max lens %d rc 0x%02x\n", *val, rc); + + kfree(val); +@@ -585,7 +585,7 @@ static void redrat3_get_firmware_rev(struct redrat3_dev *rr3) + rc = usb_control_msg(rr3->udev, usb_rcvctrlpipe(rr3->udev, 0), + RR3_FW_VERSION, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, +- 0, 0, buffer, RR3_FW_VERSION_LEN, HZ * 5); ++ 0, 0, buffer, RR3_FW_VERSION_LEN, 5000); + + if (rc >= 0) + dev_info(rr3->dev, "Firmware rev: %s", buffer); +@@ -825,14 +825,14 @@ static int redrat3_transmit_ir(struct rc_dev *rcdev, unsigned *txbuf, + + pipe = usb_sndbulkpipe(rr3->udev, rr3->ep_out->bEndpointAddress); + ret = usb_bulk_msg(rr3->udev, pipe, irdata, +- sendbuf_len, &ret_len, 10 * HZ); ++ sendbuf_len, &ret_len, 10000); + dev_dbg(dev, "sent %d bytes, (ret %d)\n", ret_len, ret); + + /* now tell the hardware to transmit what we sent it */ + pipe = usb_rcvctrlpipe(rr3->udev, 0); + ret = usb_control_msg(rr3->udev, pipe, RR3_TX_SEND_SIGNAL, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, +- 0, 0, irdata, 2, HZ * 10); ++ 0, 0, irdata, 2, 10000); + + if (ret < 0) + dev_err(dev, "Error: control msg send failed, rc %d\n", ret); +-- +2.35.3 + diff --git a/patches.suse/media-s2255-fix-control-message-timeouts.patch b/patches.suse/media-s2255-fix-control-message-timeouts.patch new file mode 100644 index 0000000..5d82581 --- /dev/null +++ b/patches.suse/media-s2255-fix-control-message-timeouts.patch @@ -0,0 +1,49 @@ +From f71d272ad4e354097020a4e6b1dc6e4b59feb50f Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 25 Oct 2021 13:16:40 +0100 +Subject: [PATCH] media: s2255: fix control-message timeouts +Git-commit: f71d272ad4e354097020a4e6b1dc6e4b59feb50f +References: git-fixes +Patch-mainline: v5.17-rc1 + +USB control-message timeouts are specified in milliseconds and should +specifically not vary with CONFIG_HZ. + +Use the common control-message timeout define for the five-second +timeouts. + +Fixes: 38f993ad8b1f ("V4L/DVB (8125): This driver adds support for the Sensoray 2255 devices.") +Cc: stable@vger.kernel.org # 2.6.27 +Signed-off-by: Johan Hovold +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/usb/s2255/s2255drv.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/usb/s2255/s2255drv.c b/drivers/media/usb/s2255/s2255drv.c +index 3b0e4ed75d99..acf18e2251a5 100644 +--- a/drivers/media/usb/s2255/s2255drv.c ++++ b/drivers/media/usb/s2255/s2255drv.c +@@ -1882,7 +1882,7 @@ static long s2255_vendor_req(struct s2255_dev *dev, unsigned char Request, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | + USB_DIR_IN, + Value, Index, buf, +- TransferBufferLength, HZ * 5); ++ TransferBufferLength, USB_CTRL_SET_TIMEOUT); + + if (r >= 0) + memcpy(TransferBuffer, buf, TransferBufferLength); +@@ -1891,7 +1891,7 @@ static long s2255_vendor_req(struct s2255_dev *dev, unsigned char Request, + r = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0), + Request, USB_TYPE_VENDOR | USB_RECIP_DEVICE, + Value, Index, buf, +- TransferBufferLength, HZ * 5); ++ TransferBufferLength, USB_CTRL_SET_TIMEOUT); + } + kfree(buf); + return r; +-- +2.35.3 + diff --git a/patches.suse/media-stk1160-fix-control-message-timeouts.patch b/patches.suse/media-stk1160-fix-control-message-timeouts.patch new file mode 100644 index 0000000..e5b10c2 --- /dev/null +++ b/patches.suse/media-stk1160-fix-control-message-timeouts.patch @@ -0,0 +1,46 @@ +From 6aa6e70cdb5b863a57bad61310bf89b6617a5d2d Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 25 Oct 2021 13:16:41 +0100 +Subject: [PATCH] media: stk1160: fix control-message timeouts +Git-commit: 6aa6e70cdb5b863a57bad61310bf89b6617a5d2d +References: git-fixes +Patch-mainline: v5.17-rc1 + +USB control-message timeouts are specified in milliseconds and should +specifically not vary with CONFIG_HZ. + +Fixes: 9cb2173e6ea8 ("[media] media: Add stk1160 new driver (easycap replacement)") +Cc: stable@vger.kernel.org # 3.7 +Signed-off-by: Johan Hovold +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/usb/stk1160/stk1160-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/usb/stk1160/stk1160-core.c b/drivers/media/usb/stk1160/stk1160-core.c +index b4f8bc5db138..4e1698f78818 100644 +--- a/drivers/media/usb/stk1160/stk1160-core.c ++++ b/drivers/media/usb/stk1160/stk1160-core.c +@@ -65,7 +65,7 @@ int stk1160_read_reg(struct stk1160 *dev, u16 reg, u8 *value) + return -ENOMEM; + ret = usb_control_msg(dev->udev, pipe, 0x00, + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- 0x00, reg, buf, sizeof(u8), HZ); ++ 0x00, reg, buf, sizeof(u8), 1000); + if (ret < 0) { + stk1160_err("read failed on reg 0x%x (%d)\n", + reg, ret); +@@ -85,7 +85,7 @@ int stk1160_write_reg(struct stk1160 *dev, u16 reg, u16 value) + + ret = usb_control_msg(dev->udev, pipe, 0x01, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- value, reg, NULL, 0, HZ); ++ value, reg, NULL, 0, 1000); + if (ret < 0) { + stk1160_err("write failed on reg 0x%x (%d)\n", + reg, ret); +-- +2.35.3 + diff --git a/patches.suse/media-stkwebcam-fix-memory-leak-in-stk_camera_probe.patch b/patches.suse/media-stkwebcam-fix-memory-leak-in-stk_camera_probe.patch new file mode 100644 index 0000000..f4d4488 --- /dev/null +++ b/patches.suse/media-stkwebcam-fix-memory-leak-in-stk_camera_probe.patch @@ -0,0 +1,48 @@ +From 514e97674400462cc09c459a1ddfb9bf39017223 Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Wed, 7 Jul 2021 19:54:30 +0200 +Subject: [PATCH] media: stkwebcam: fix memory leak in stk_camera_probe +Git-commit: 514e97674400462cc09c459a1ddfb9bf39017223 +References: git-fixes +Patch-mainline: v5.15-rc1 + +My local syzbot instance hit memory leak in usb_set_configuration(). +The problem was in unputted usb interface. In case of errors after +usb_get_intf() the reference should be putted to correclty free memory +allocated for this interface. + +Fixes: ec16dae5453e ("V4L/DVB (7019): V4L: add support for Syntek DC1125 webcams") +Cc: stable@vger.kernel.org +Signed-off-by: Pavel Skripkin +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/usb/stkwebcam/stk-webcam.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/media/usb/stkwebcam/stk-webcam.c ++++ b/drivers/media/usb/stkwebcam/stk-webcam.c +@@ -1357,7 +1357,7 @@ static int stk_camera_probe(struct usb_i + if (!dev->isoc_ep) { + STK_ERROR("Could not find isoc-in endpoint"); + err = -ENODEV; +- goto error; ++ goto error_put; + } + dev->vsettings.palette = V4L2_PIX_FMT_RGB565; + dev->vsettings.mode = MODE_VGA; +@@ -1370,10 +1370,12 @@ static int stk_camera_probe(struct usb_i + + err = stk_register_video_device(dev); + if (err) +- goto error; ++ goto error_put; + + return 0; + ++error_put: ++ usb_put_intf(interface); + error: + v4l2_ctrl_handler_free(hdl); + v4l2_device_unregister(&dev->v4l2_dev); diff --git a/patches.suse/media-uvc-don-t-do-DMA-on-stack.patch b/patches.suse/media-uvc-don-t-do-DMA-on-stack.patch new file mode 100644 index 0000000..2cc76c5 --- /dev/null +++ b/patches.suse/media-uvc-don-t-do-DMA-on-stack.patch @@ -0,0 +1,100 @@ +From 1a10d7fdb6d0e235e9d230916244cc2769d3f170 Mon Sep 17 00:00:00 2001 +From: Mauro Carvalho Chehab +Date: Thu, 17 Jun 2021 14:33:29 +0200 +Subject: [PATCH] media: uvc: don't do DMA on stack +Git-commit: 1a10d7fdb6d0e235e9d230916244cc2769d3f170 +References: git-fixes +Patch-mainline: v5.15-rc1 + +As warned by smatch: + drivers/media/usb/uvc/uvc_v4l2.c:911 uvc_ioctl_g_input() error: doing dma on the stack (&i) + drivers/media/usb/uvc/uvc_v4l2.c:943 uvc_ioctl_s_input() error: doing dma on the stack (&i) + +those two functions call uvc_query_ctrl passing a pointer to +a data at the DMA stack. those are used to send URBs via +usb_control_msg(). Using DMA stack is not supported and should +not work anymore on modern Linux versions. + +So, use a kmalloc'ed buffer. + +Cc: stable@vger.kernel.org # Kernel 4.9 and upper +Reviewed-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/usb/uvc/uvc_v4l2.c | 34 +++++++++++++++++++++----------- + 1 file changed, 23 insertions(+), 11 deletions(-) + +diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c +index 252136cc885c..6acb8013de08 100644 +--- a/drivers/media/usb/uvc/uvc_v4l2.c ++++ b/drivers/media/usb/uvc/uvc_v4l2.c +@@ -899,8 +899,8 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input) + { + struct uvc_fh *handle = fh; + struct uvc_video_chain *chain = handle->chain; ++ u8 *buf; + int ret; +- u8 i; + + if (chain->selector == NULL || + (chain->dev->quirks & UVC_QUIRK_IGNORE_SELECTOR_UNIT)) { +@@ -908,22 +908,27 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input) + return 0; + } + ++ buf = kmalloc(1, GFP_KERNEL); ++ if (!buf) ++ return -ENOMEM; ++ + ret = uvc_query_ctrl(chain->dev, UVC_GET_CUR, chain->selector->id, + chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL, +- &i, 1); +- if (ret < 0) +- return ret; ++ buf, 1); ++ if (!ret) ++ *input = *buf - 1; + +- *input = i - 1; +- return 0; ++ kfree(buf); ++ ++ return ret; + } + + static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input) + { + struct uvc_fh *handle = fh; + struct uvc_video_chain *chain = handle->chain; ++ u8 *buf; + int ret; +- u32 i; + + ret = uvc_acquire_privileges(handle); + if (ret < 0) +@@ -939,10 +944,17 @@ static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input) + if (input >= chain->selector->bNrInPins) + return -EINVAL; + +- i = input + 1; +- return uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id, +- chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL, +- &i, 1); ++ buf = kmalloc(1, GFP_KERNEL); ++ if (!buf) ++ return -ENOMEM; ++ ++ *buf = input + 1; ++ ret = uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id, ++ chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL, ++ buf, 1); ++ kfree(buf); ++ ++ return ret; + } + + static int uvc_ioctl_queryctrl(struct file *file, void *fh, +-- +2.34.1 + diff --git a/patches.suse/media-v4l2-ioctl-S_CTRL-output-the-right-value.patch b/patches.suse/media-v4l2-ioctl-S_CTRL-output-the-right-value.patch new file mode 100644 index 0000000..ac7accb --- /dev/null +++ b/patches.suse/media-v4l2-ioctl-S_CTRL-output-the-right-value.patch @@ -0,0 +1,55 @@ +From c87ed93574e3cd8346c05bd934c617596c12541b Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Fri, 18 Jun 2021 14:29:06 +0200 +Subject: [PATCH] media: v4l2-ioctl: S_CTRL output the right value +Git-commit: c87ed93574e3cd8346c05bd934c617596c12541b +References: git-fixes +Patch-mainline: v5.16-rc1 + +If the driver does not implement s_ctrl, but it does implement +s_ext_ctrls, we convert the call. + +When that happens we have also to convert back the response from +s_ext_ctrls. + +Fixes v4l2_compliance: +Control ioctls (Input 0): + fail: v4l2-test-controls.cpp(411): returned control value out of range + fail: v4l2-test-controls.cpp(507): invalid control 00980900 + test VIDIOC_G/S_CTRL: FAIL + +Fixes: 35ea11ff8471 ("V4L/DVB (8430): videodev: move some functions from v4l2-dev.h to v4l2-common.h or v4l2-ioctl.h") +Reviewed-by: Hans Verkuil +Signed-off-by: Ricardo Ribalda +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/v4l2-core/v4l2-ioctl.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/media/v4l2-core/v4l2-ioctl.c ++++ b/drivers/media/v4l2-core/v4l2-ioctl.c +@@ -2052,6 +2052,7 @@ static int v4l_s_ctrl(const struct v4l2_ + test_bit(V4L2_FL_USES_V4L2_FH, &vfd->flags) ? fh : NULL; + struct v4l2_ext_controls ctrls; + struct v4l2_ext_control ctrl; ++ int ret; + + if (vfh && vfh->ctrl_handler) + return v4l2_s_ctrl(vfh, vfh->ctrl_handler, p); +@@ -2067,9 +2068,11 @@ static int v4l_s_ctrl(const struct v4l2_ + ctrls.controls = &ctrl; + ctrl.id = p->id; + ctrl.value = p->value; +- if (check_ext_ctrls(&ctrls, 1)) +- return ops->vidioc_s_ext_ctrls(file, fh, &ctrls); +- return -EINVAL; ++ if (!check_ext_ctrls(&ctrls, VIDIOC_S_CTRL)) ++ return -EINVAL; ++ ret = ops->vidioc_s_ext_ctrls(file, fh, &ctrls); ++ p->value = ctrl.value; ++ return ret; + } + + static int v4l_g_ext_ctrls(const struct v4l2_ioctl_ops *ops, diff --git a/patches.suse/media-videobuf2-core-dequeue-if-start_streaming-fail.patch b/patches.suse/media-videobuf2-core-dequeue-if-start_streaming-fail.patch new file mode 100644 index 0000000..7370834 --- /dev/null +++ b/patches.suse/media-videobuf2-core-dequeue-if-start_streaming-fail.patch @@ -0,0 +1,65 @@ +From c592b46907adbeb81243f7eb7a468c36692658b8 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Wed, 30 Jun 2021 09:58:23 +0200 +Subject: [PATCH] media: videobuf2-core: dequeue if start_streaming fails +Git-commit: c592b46907adbeb81243f7eb7a468c36692658b8 +References: git-fixes +Patch-mainline: v5.14-rc5 + +If a vb2_queue sets q->min_buffers_needed then when the number of +queued buffers reaches q->min_buffers_needed, vb2_core_qbuf() will call +the start_streaming() callback. If start_streaming() returns an error, +then that error was just returned by vb2_core_qbuf(), but the buffer +was still queued. However, userspace expects that if VIDIOC_QBUF fails, +the buffer is returned dequeued. + +So if start_streaming() fails, then remove the buffer from the queue, +thus avoiding this unwanted side-effect. + +Signed-off-by: Hans Verkuil +Reviewed-by: Laurent Pinchart +Tested-by: Kieran Bingham +Fixes: b3379c6201bb ("[media] vb2: only call start_streaming if sufficient buffers are queued") +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/v4l2-core/videobuf2-core.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/media/v4l2-core/videobuf2-core.c ++++ b/drivers/media/v4l2-core/videobuf2-core.c +@@ -1373,6 +1373,7 @@ static int vb2_start_streaming(struct vb + int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb) + { + struct vb2_buffer *vb; ++ enum vb2_buffer_state orig_state; + int ret; + + if (q->error) { +@@ -1402,6 +1403,7 @@ int vb2_core_qbuf(struct vb2_queue *q, u + * Add to the queued buffers list, a buffer will stay on it until + * dequeued in dqbuf. + */ ++ orig_state = vb->state; + list_add_tail(&vb->queued_entry, &q->queued_list); + q->queued_count++; + q->waiting_for_buffers = false; +@@ -1432,8 +1434,17 @@ int vb2_core_qbuf(struct vb2_queue *q, u + if (q->streaming && !q->start_streaming_called && + q->queued_count >= q->min_buffers_needed) { + ret = vb2_start_streaming(q); +- if (ret) ++ if (ret) { ++ /* ++ * Since vb2_core_qbuf will return with an error, ++ * we should return it to state DEQUEUED since ++ * the error indicates that the buffer wasn't queued. ++ */ ++ list_del(&vb->queued_entry); ++ q->queued_count--; ++ vb->state = orig_state; + return ret; ++ } + } + + dprintk(1, "qbuf of buffer %d succeeded\n", vb->index); diff --git a/patches.suse/media-vim2m-Remove-surplus-name-initialization.patch b/patches.suse/media-vim2m-Remove-surplus-name-initialization.patch new file mode 100644 index 0000000..b159619 --- /dev/null +++ b/patches.suse/media-vim2m-Remove-surplus-name-initialization.patch @@ -0,0 +1,33 @@ +From a9c24b8977c216cd7a8bf5a9f9d0621668e49746 Mon Sep 17 00:00:00 2001 +From: Anton Leontiev +Date: Tue, 12 Jun 2018 06:11:01 -0400 +Subject: [PATCH] media: vim2m: Remove surplus name initialization +Git-commit: a9c24b8977c216cd7a8bf5a9f9d0621668e49746 +References: git-fixes +Patch-mainline: v4.19-rc1 + +Name is already initialized by assignment from vim2m_videodev. + +Signed-off-by: Anton Leontiev +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/platform/vim2m.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c +index 065483e62db4..1393aa806462 100644 +--- a/drivers/media/platform/vim2m.c ++++ b/drivers/media/platform/vim2m.c +@@ -1020,7 +1020,6 @@ static int vim2m_probe(struct platform_device *pdev) + } + + video_set_drvdata(vfd, dev); +- snprintf(vfd->name, sizeof(vfd->name), "%s", vim2m_videodev.name); + v4l2_info(&dev->v4l2_dev, + "Device registered as /dev/video%d\n", vfd->num); + +-- +2.35.3 + diff --git a/patches.suse/mm-page_alloc-fix-build_zonerefs_node.patch b/patches.suse/mm-page_alloc-fix-build_zonerefs_node.patch new file mode 100644 index 0000000..e9dde57 --- /dev/null +++ b/patches.suse/mm-page_alloc-fix-build_zonerefs_node.patch @@ -0,0 +1,71 @@ +Patch-mainline: v5.18-rc3 +Git-commit: e553f62f10d93551eb883eca227ac54d1a4fad84 +References: git-fixes +From: Juergen Gross +Date: Thu, 14 Apr 2022 19:13:43 -0700 +Subject: [PATCH] mm, page_alloc: fix build_zonerefs_node() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Since commit 6aa303defb74 ("mm, vmscan: only allocate and reclaim from +zones with pages managed by the buddy allocator") only zones with free +memory are included in a built zonelist. This is problematic when e.g. +all memory of a zone has been ballooned out when zonelists are being +rebuilt. + +The decision whether to rebuild the zonelists when onlining new memory +is done based on populated_zone() returning 0 for the zone the memory +will be added to. The new zone is added to the zonelists only, if it +has free memory pages (managed_zone() returns a non-zero value) after +the memory has been onlined. This implies, that onlining memory will +always free the added pages to the allocator immediately, but this is +not true in all cases: when e.g. running as a Xen guest the onlined new +memory will be added only to the ballooned memory list, it will be freed +only when the guest is being ballooned up afterwards. + +Another problem with using managed_zone() for the decision whether a +zone is being added to the zonelists is, that a zone with all memory +used will in fact be removed from all zonelists in case the zonelists +happen to be rebuilt. + +Use populated_zone() when building a zonelist as it has been done before +that commit. + +There was a report that QubesOS (based on Xen) is hitting this problem. +Xen has switched to use the zone device functionality in kernel 5.9 and +QubesOS wants to use memory hotplugging for guests in order to be able +to start a guest with minimal memory and expand it as needed. This was +the report leading to the patch. + +Link: https://lkml.kernel.org/r/20220407120637.9035-1-jgross@suse.com +Fixes: 6aa303defb74 ("mm, vmscan: only allocate and reclaim from zones with pages managed by the buddy allocator") +Signed-off-by: Juergen Gross +Reported-by: Marek Marczykowski-Górecki +Acked-by: Michal Hocko +Acked-by: David Hildenbrand +Cc: Marek Marczykowski-Górecki +Reviewed-by: Wei Yang +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +--- + mm/page_alloc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 6e5b4488a0c5..33ca8cab21e6 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -5014,7 +5014,7 @@ static int build_zonelists_node(pg_data_t *pgdat, struct zonelist *zonelist, + do { + zone_type--; + zone = pgdat->node_zones + zone_type; +- if (managed_zone(zone)) { ++ if (populated_zone(zone)) { + zoneref_set_zone(zone, + &zonelist->_zonerefs[nr_zones++]); + check_highest_zone(zone_type); +-- +2.35.3 + diff --git a/patches.suse/msft-hv-2514-net-mana-Use-struct_size-helper-in-mana_gd_create_dm.patch b/patches.suse/msft-hv-2514-net-mana-Use-struct_size-helper-in-mana_gd_create_dm.patch new file mode 100644 index 0000000..9f23eed --- /dev/null +++ b/patches.suse/msft-hv-2514-net-mana-Use-struct_size-helper-in-mana_gd_create_dm.patch @@ -0,0 +1,44 @@ +From: "Gustavo A. R. Silva" +Date: Mon, 24 Jan 2022 15:43:47 -0600 +Patch-mainline: v5.18-rc1 +Subject: net: mana: Use struct_size() helper in mana_gd_create_dma_region() +Git-commit: 10cdc794dae890fb3149e90854e8440cf5bf615e +References: bsc#1195651 + +Make use of the struct_size() helper instead of an open-coded version, +in order to avoid any potential type mistakes or integer overflows that, +in the worst scenario, could lead to heap overflows. + +Also, address the following sparse warnings: +drivers/net/ethernet/microsoft/mana/gdma_main.c:677:24: warning: using sizeof on a flexible structure + +Link: https://github.com/KSPP/linux/issues/174 +Signed-off-by: Gustavo A. R. Silva +Reviewed-by: Dexuan Cui +Signed-off-by: David S. Miller +Acked-by: Olaf Hering +--- + drivers/net/ethernet/microsoft/mana/gdma_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c b/drivers/net/ethernet/microsoft/mana/gdma_main.c +--- a/drivers/net/ethernet/microsoft/mana/gdma_main.c ++++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c +@@ -663,7 +663,7 @@ static int mana_gd_create_dma_region(struct gdma_dev *gd, + struct gdma_context *gc = gd->gdma_context; + struct hw_channel_context *hwc; + u32 length = gmi->length; +- u32 req_msg_size; ++ size_t req_msg_size; + int err; + int i; + +@@ -674,7 +674,7 @@ static int mana_gd_create_dma_region(struct gdma_dev *gd, + return -EINVAL; + + hwc = gc->hwc.driver_data; +- req_msg_size = sizeof(*req) + num_page * sizeof(u64); ++ req_msg_size = struct_size(req, page_addr_list, num_page); + if (req_msg_size > hwc->max_req_msg_size) + return -EINVAL; + diff --git a/patches.suse/msft-hv-2516-net-mana-Add-counter-for-packet-dropped-by-XDP.patch b/patches.suse/msft-hv-2516-net-mana-Add-counter-for-packet-dropped-by-XDP.patch new file mode 100644 index 0000000..4f10422 --- /dev/null +++ b/patches.suse/msft-hv-2516-net-mana-Add-counter-for-packet-dropped-by-XDP.patch @@ -0,0 +1,221 @@ +From: Haiyang Zhang +Date: Fri, 28 Jan 2022 18:03:36 -0800 +Patch-mainline: v5.18-rc1 +Subject: net: mana: Add counter for packet dropped by XDP +Git-commit: f90f84201edde2bca25a73226ff0ebe765273890 +References: bsc#1195651 + +This counter will show up in ethtool stat data. + +Signed-off-by: Haiyang Zhang +Signed-off-by: David S. Miller +Acked-by: Olaf Hering +--- + drivers/net/ethernet/microsoft/mana/mana.h | 13 ++++++-- + drivers/net/ethernet/microsoft/mana/mana_en.c | 35 +++++++++++++--------- + drivers/net/ethernet/microsoft/mana/mana_ethtool.c | 30 +++++++++++-------- + 3 files changed, 49 insertions(+), 29 deletions(-) + +diff --git a/drivers/net/ethernet/microsoft/mana/mana.h b/drivers/net/ethernet/microsoft/mana/mana.h +--- a/drivers/net/ethernet/microsoft/mana/mana.h ++++ b/drivers/net/ethernet/microsoft/mana/mana.h +@@ -48,7 +48,14 @@ enum TRI_STATE { + + #define MAX_PORTS_IN_MANA_DEV 256 + +-struct mana_stats { ++struct mana_stats_rx { ++ u64 packets; ++ u64 bytes; ++ u64 xdp_drop; ++ struct u64_stats_sync syncp; ++}; ++ ++struct mana_stats_tx { + u64 packets; + u64 bytes; + struct u64_stats_sync syncp; +@@ -76,7 +83,7 @@ struct mana_txq { + + atomic_t pending_sends; + +- struct mana_stats stats; ++ struct mana_stats_tx stats; + }; + + /* skb data and frags dma mappings */ +@@ -298,7 +305,7 @@ struct mana_rxq { + + u32 buf_index; + +- struct mana_stats stats; ++ struct mana_stats_rx stats; + + struct bpf_prog __rcu *bpf_prog; + struct xdp_rxq_info xdp_rxq; +diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c +--- a/drivers/net/ethernet/microsoft/mana/mana_en.c ++++ b/drivers/net/ethernet/microsoft/mana/mana_en.c +@@ -136,7 +136,7 @@ int mana_start_xmit(struct sk_buff *skb, struct net_device *ndev) + bool ipv4 = false, ipv6 = false; + struct mana_tx_package pkg = {}; + struct netdev_queue *net_txq; +- struct mana_stats *tx_stats; ++ struct mana_stats_tx *tx_stats; + struct gdma_queue *gdma_sq; + unsigned int csum_type; + struct mana_txq *txq; +@@ -299,7 +299,8 @@ static void mana_get_stats64(struct net_device *ndev, + { + struct mana_port_context *apc = netdev_priv(ndev); + unsigned int num_queues = apc->num_queues; +- struct mana_stats *stats; ++ struct mana_stats_rx *rx_stats; ++ struct mana_stats_tx *tx_stats; + unsigned int start; + u64 packets, bytes; + int q; +@@ -310,26 +311,26 @@ static void mana_get_stats64(struct net_device *ndev, + netdev_stats_to_stats64(st, &ndev->stats); + + for (q = 0; q < num_queues; q++) { +- stats = &apc->rxqs[q]->stats; ++ rx_stats = &apc->rxqs[q]->stats; + + do { +- start = u64_stats_fetch_begin_irq(&stats->syncp); +- packets = stats->packets; +- bytes = stats->bytes; +- } while (u64_stats_fetch_retry_irq(&stats->syncp, start)); ++ start = u64_stats_fetch_begin_irq(&rx_stats->syncp); ++ packets = rx_stats->packets; ++ bytes = rx_stats->bytes; ++ } while (u64_stats_fetch_retry_irq(&rx_stats->syncp, start)); + + st->rx_packets += packets; + st->rx_bytes += bytes; + } + + for (q = 0; q < num_queues; q++) { +- stats = &apc->tx_qp[q].txq.stats; ++ tx_stats = &apc->tx_qp[q].txq.stats; + + do { +- start = u64_stats_fetch_begin_irq(&stats->syncp); +- packets = stats->packets; +- bytes = stats->bytes; +- } while (u64_stats_fetch_retry_irq(&stats->syncp, start)); ++ start = u64_stats_fetch_begin_irq(&tx_stats->syncp); ++ packets = tx_stats->packets; ++ bytes = tx_stats->bytes; ++ } while (u64_stats_fetch_retry_irq(&tx_stats->syncp, start)); + + st->tx_packets += packets; + st->tx_bytes += bytes; +@@ -986,7 +987,7 @@ static struct sk_buff *mana_build_skb(void *buf_va, uint pkt_len, + static void mana_rx_skb(void *buf_va, struct mana_rxcomp_oob *cqe, + struct mana_rxq *rxq) + { +- struct mana_stats *rx_stats = &rxq->stats; ++ struct mana_stats_rx *rx_stats = &rxq->stats; + struct net_device *ndev = rxq->ndev; + uint pkt_len = cqe->ppi[0].pkt_len; + u16 rxq_idx = rxq->rxq_idx; +@@ -1007,7 +1008,7 @@ static void mana_rx_skb(void *buf_va, struct mana_rxcomp_oob *cqe, + act = mana_run_xdp(ndev, rxq, &xdp, buf_va, pkt_len); + + if (act != XDP_PASS && act != XDP_TX) +- goto drop; ++ goto drop_xdp; + + skb = mana_build_skb(buf_va, pkt_len, &xdp); + +@@ -1048,9 +1049,15 @@ static void mana_rx_skb(void *buf_va, struct mana_rxcomp_oob *cqe, + u64_stats_update_end(&rx_stats->syncp); + return; + ++drop_xdp: ++ u64_stats_update_begin(&rx_stats->syncp); ++ rx_stats->xdp_drop++; ++ u64_stats_update_end(&rx_stats->syncp); ++ + drop: + free_page((unsigned long)buf_va); + ++ndev->stats.rx_dropped; ++ + return; + } + +diff --git a/drivers/net/ethernet/microsoft/mana/mana_ethtool.c b/drivers/net/ethernet/microsoft/mana/mana_ethtool.c +--- a/drivers/net/ethernet/microsoft/mana/mana_ethtool.c ++++ b/drivers/net/ethernet/microsoft/mana/mana_ethtool.c +@@ -23,7 +23,7 @@ static int mana_get_sset_count(struct net_device *ndev, int stringset) + if (stringset != ETH_SS_STATS) + return -EINVAL; + +- return ARRAY_SIZE(mana_eth_stats) + num_queues * 4; ++ return ARRAY_SIZE(mana_eth_stats) + num_queues * 5; + } + + static void mana_get_strings(struct net_device *ndev, u32 stringset, u8 *data) +@@ -46,6 +46,8 @@ static void mana_get_strings(struct net_device *ndev, u32 stringset, u8 *data) + p += ETH_GSTRING_LEN; + sprintf(p, "rx_%d_bytes", i); + p += ETH_GSTRING_LEN; ++ sprintf(p, "rx_%d_xdp_drop", i); ++ p += ETH_GSTRING_LEN; + } + + for (i = 0; i < num_queues; i++) { +@@ -62,9 +64,11 @@ static void mana_get_ethtool_stats(struct net_device *ndev, + struct mana_port_context *apc = netdev_priv(ndev); + unsigned int num_queues = apc->num_queues; + void *eth_stats = &apc->eth_stats; +- struct mana_stats *stats; ++ struct mana_stats_rx *rx_stats; ++ struct mana_stats_tx *tx_stats; + unsigned int start; + u64 packets, bytes; ++ u64 xdp_drop; + int q, i = 0; + + if (!apc->port_is_up) +@@ -74,26 +78,28 @@ static void mana_get_ethtool_stats(struct net_device *ndev, + data[i++] = *(u64 *)(eth_stats + mana_eth_stats[q].offset); + + for (q = 0; q < num_queues; q++) { +- stats = &apc->rxqs[q]->stats; ++ rx_stats = &apc->rxqs[q]->stats; + + do { +- start = u64_stats_fetch_begin_irq(&stats->syncp); +- packets = stats->packets; +- bytes = stats->bytes; +- } while (u64_stats_fetch_retry_irq(&stats->syncp, start)); ++ start = u64_stats_fetch_begin_irq(&rx_stats->syncp); ++ packets = rx_stats->packets; ++ bytes = rx_stats->bytes; ++ xdp_drop = rx_stats->xdp_drop; ++ } while (u64_stats_fetch_retry_irq(&rx_stats->syncp, start)); + + data[i++] = packets; + data[i++] = bytes; ++ data[i++] = xdp_drop; + } + + for (q = 0; q < num_queues; q++) { +- stats = &apc->tx_qp[q].txq.stats; ++ tx_stats = &apc->tx_qp[q].txq.stats; + + do { +- start = u64_stats_fetch_begin_irq(&stats->syncp); +- packets = stats->packets; +- bytes = stats->bytes; +- } while (u64_stats_fetch_retry_irq(&stats->syncp, start)); ++ start = u64_stats_fetch_begin_irq(&tx_stats->syncp); ++ packets = tx_stats->packets; ++ bytes = tx_stats->bytes; ++ } while (u64_stats_fetch_retry_irq(&tx_stats->syncp, start)); + + data[i++] = packets; + data[i++] = bytes; diff --git a/patches.suse/msft-hv-2517-net-mana-Add-counter-for-XDP_TX.patch b/patches.suse/msft-hv-2517-net-mana-Add-counter-for-XDP_TX.patch new file mode 100644 index 0000000..aab3335 --- /dev/null +++ b/patches.suse/msft-hv-2517-net-mana-Add-counter-for-XDP_TX.patch @@ -0,0 +1,102 @@ +From: Haiyang Zhang +Date: Fri, 28 Jan 2022 18:03:37 -0800 +Patch-mainline: v5.18-rc1 +Subject: net: mana: Add counter for XDP_TX +Git-commit: d356abb95b9883198b1ba0db678659369701e17d +References: bsc#1195651 + +This counter will show up in ethtool stat. It is the +number of packets received and forwarded by XDP program. + +Signed-off-by: Haiyang Zhang +Signed-off-by: David S. Miller +Acked-by: Olaf Hering +--- + drivers/net/ethernet/microsoft/mana/mana.h | 1 + + drivers/net/ethernet/microsoft/mana/mana_en.c | 12 ++++++++---- + drivers/net/ethernet/microsoft/mana/mana_ethtool.c | 7 ++++++- + 3 files changed, 15 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/microsoft/mana/mana.h b/drivers/net/ethernet/microsoft/mana/mana.h +--- a/drivers/net/ethernet/microsoft/mana/mana.h ++++ b/drivers/net/ethernet/microsoft/mana/mana.h +@@ -52,6 +52,7 @@ struct mana_stats_rx { + u64 packets; + u64 bytes; + u64 xdp_drop; ++ u64 xdp_tx; + struct u64_stats_sync syncp; + }; + +diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c +--- a/drivers/net/ethernet/microsoft/mana/mana_en.c ++++ b/drivers/net/ethernet/microsoft/mana/mana_en.c +@@ -1035,6 +1035,14 @@ static void mana_rx_skb(void *buf_va, struct mana_rxcomp_oob *cqe, + skb_set_hash(skb, hash_value, PKT_HASH_TYPE_L3); + } + ++ u64_stats_update_begin(&rx_stats->syncp); ++ rx_stats->packets++; ++ rx_stats->bytes += pkt_len; ++ ++ if (act == XDP_TX) ++ rx_stats->xdp_tx++; ++ u64_stats_update_end(&rx_stats->syncp); ++ + if (act == XDP_TX) { + skb_set_queue_mapping(skb, rxq_idx); + mana_xdp_tx(skb, ndev); +@@ -1043,10 +1051,6 @@ static void mana_rx_skb(void *buf_va, struct mana_rxcomp_oob *cqe, + + napi_gro_receive(napi, skb); + +- u64_stats_update_begin(&rx_stats->syncp); +- rx_stats->packets++; +- rx_stats->bytes += pkt_len; +- u64_stats_update_end(&rx_stats->syncp); + return; + + drop_xdp: +diff --git a/drivers/net/ethernet/microsoft/mana/mana_ethtool.c b/drivers/net/ethernet/microsoft/mana/mana_ethtool.c +--- a/drivers/net/ethernet/microsoft/mana/mana_ethtool.c ++++ b/drivers/net/ethernet/microsoft/mana/mana_ethtool.c +@@ -23,7 +23,7 @@ static int mana_get_sset_count(struct net_device *ndev, int stringset) + if (stringset != ETH_SS_STATS) + return -EINVAL; + +- return ARRAY_SIZE(mana_eth_stats) + num_queues * 5; ++ return ARRAY_SIZE(mana_eth_stats) + num_queues * 6; + } + + static void mana_get_strings(struct net_device *ndev, u32 stringset, u8 *data) +@@ -48,6 +48,8 @@ static void mana_get_strings(struct net_device *ndev, u32 stringset, u8 *data) + p += ETH_GSTRING_LEN; + sprintf(p, "rx_%d_xdp_drop", i); + p += ETH_GSTRING_LEN; ++ sprintf(p, "rx_%d_xdp_tx", i); ++ p += ETH_GSTRING_LEN; + } + + for (i = 0; i < num_queues; i++) { +@@ -69,6 +71,7 @@ static void mana_get_ethtool_stats(struct net_device *ndev, + unsigned int start; + u64 packets, bytes; + u64 xdp_drop; ++ u64 xdp_tx; + int q, i = 0; + + if (!apc->port_is_up) +@@ -85,11 +88,13 @@ static void mana_get_ethtool_stats(struct net_device *ndev, + packets = rx_stats->packets; + bytes = rx_stats->bytes; + xdp_drop = rx_stats->xdp_drop; ++ xdp_tx = rx_stats->xdp_tx; + } while (u64_stats_fetch_retry_irq(&rx_stats->syncp, start)); + + data[i++] = packets; + data[i++] = bytes; + data[i++] = xdp_drop; ++ data[i++] = xdp_tx; + } + + for (q = 0; q < num_queues; q++) { diff --git a/patches.suse/msft-hv-2518-net-mana-Reuse-XDP-dropped-page.patch b/patches.suse/msft-hv-2518-net-mana-Reuse-XDP-dropped-page.patch new file mode 100644 index 0000000..46a3993 --- /dev/null +++ b/patches.suse/msft-hv-2518-net-mana-Reuse-XDP-dropped-page.patch @@ -0,0 +1,68 @@ +From: Haiyang Zhang +Date: Fri, 28 Jan 2022 18:03:38 -0800 +Patch-mainline: v5.18-rc1 +Subject: net: mana: Reuse XDP dropped page +Git-commit: a6bf5703f17bdbd775c0e6837dd2d5b1c344e28c +References: bsc#1195651 + +Reuse the dropped page in RX path to save page allocation +overhead. + +Signed-off-by: Haiyang Zhang +Signed-off-by: David S. Miller +Acked-by: Olaf Hering +--- + drivers/net/ethernet/microsoft/mana/mana.h | 1 + + drivers/net/ethernet/microsoft/mana/mana_en.c | 15 +++++++++++++-- + 2 files changed, 14 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/microsoft/mana/mana.h b/drivers/net/ethernet/microsoft/mana/mana.h +--- a/drivers/net/ethernet/microsoft/mana/mana.h ++++ b/drivers/net/ethernet/microsoft/mana/mana.h +@@ -310,6 +310,7 @@ struct mana_rxq { + + struct bpf_prog __rcu *bpf_prog; + struct xdp_rxq_info xdp_rxq; ++ struct page *xdp_save_page; + + /* MUST BE THE LAST MEMBER: + * Each receive buffer has an associated mana_recv_buf_oob. +diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c +--- a/drivers/net/ethernet/microsoft/mana/mana_en.c ++++ b/drivers/net/ethernet/microsoft/mana/mana_en.c +@@ -1059,7 +1059,9 @@ drop_xdp: + u64_stats_update_end(&rx_stats->syncp); + + drop: +- free_page((unsigned long)buf_va); ++ WARN_ON_ONCE(rxq->xdp_save_page); ++ rxq->xdp_save_page = virt_to_page(buf_va); ++ + ++ndev->stats.rx_dropped; + + return; +@@ -1116,7 +1118,13 @@ static void mana_process_rx_cqe(struct mana_rxq *rxq, struct mana_cq *cq, + rxbuf_oob = &rxq->rx_oobs[curr]; + WARN_ON_ONCE(rxbuf_oob->wqe_inf.wqe_size_in_bu != 1); + +- new_page = alloc_page(GFP_ATOMIC); ++ /* Reuse XDP dropped page if available */ ++ if (rxq->xdp_save_page) { ++ new_page = rxq->xdp_save_page; ++ rxq->xdp_save_page = NULL; ++ } else { ++ new_page = alloc_page(GFP_ATOMIC); ++ } + + if (new_page) { + da = dma_map_page(dev, new_page, XDP_PACKET_HEADROOM, rxq->datasize, +@@ -1403,6 +1411,9 @@ static void mana_destroy_rxq(struct mana_port_context *apc, + + mana_deinit_cq(apc, &rxq->rx_cq); + ++ if (rxq->xdp_save_page) ++ __free_page(rxq->xdp_save_page); ++ + for (i = 0; i < rxq->num_rx_buf; i++) { + rx_oob = &rxq->rx_oobs[i]; + diff --git a/patches.suse/msft-hv-2523-net-mana-Add-handling-of-CQE_RX_TRUNCATED.patch b/patches.suse/msft-hv-2523-net-mana-Add-handling-of-CQE_RX_TRUNCATED.patch new file mode 100644 index 0000000..3ab9552 --- /dev/null +++ b/patches.suse/msft-hv-2523-net-mana-Add-handling-of-CQE_RX_TRUNCATED.patch @@ -0,0 +1,42 @@ +From: Haiyang Zhang +Date: Fri, 4 Feb 2022 14:45:44 -0800 +Patch-mainline: v5.18-rc1 +Subject: net: mana: Add handling of CQE_RX_TRUNCATED +Git-commit: e4b7621982d29f26ff4d39af389e5e675a4ffed4 +References: bsc#1195651 + +The proper way to drop this kind of CQE is advancing rxq tail +without indicating the packet to the upper network layer. + +Signed-off-by: Haiyang Zhang +Reviewed-by: Dexuan Cui +Signed-off-by: David S. Miller +Acked-by: Olaf Hering +--- + drivers/net/ethernet/microsoft/mana/mana_en.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c +--- a/drivers/net/ethernet/microsoft/mana/mana_en.c ++++ b/drivers/net/ethernet/microsoft/mana/mana_en.c +@@ -1085,8 +1085,10 @@ static void mana_process_rx_cqe(struct mana_rxq *rxq, struct mana_cq *cq, + break; + + case CQE_RX_TRUNCATED: +- netdev_err(ndev, "Dropped a truncated packet\n"); +- return; ++ ++ndev->stats.rx_dropped; ++ rxbuf_oob = &rxq->rx_oobs[rxq->buf_index]; ++ netdev_warn_once(ndev, "Dropped a truncated packet\n"); ++ goto drop; + + case CQE_RX_COALESCED_4: + netdev_err(ndev, "RX coalescing is unsupported\n"); +@@ -1154,6 +1156,7 @@ static void mana_process_rx_cqe(struct mana_rxq *rxq, struct mana_cq *cq, + + mana_rx_skb(old_buf, oob, rxq); + ++drop: + mana_move_wq_tail(rxq->gdma_rq, rxbuf_oob->wqe_inf.wqe_size_in_bu); + + mana_post_pkt_rxq(rxq); diff --git a/patches.suse/msft-hv-2524-net-mana-Remove-unnecessary-check-of-cqe_type-in-man.patch b/patches.suse/msft-hv-2524-net-mana-Remove-unnecessary-check-of-cqe_type-in-man.patch new file mode 100644 index 0000000..0f544f7 --- /dev/null +++ b/patches.suse/msft-hv-2524-net-mana-Remove-unnecessary-check-of-cqe_type-in-man.patch @@ -0,0 +1,31 @@ +From: Haiyang Zhang +Date: Fri, 4 Feb 2022 14:45:45 -0800 +Patch-mainline: v5.18-rc1 +Subject: net: mana: Remove unnecessary check of cqe_type in mana_process_rx_cqe() +Git-commit: 68f831355052706e1f8498653f6c4d36643c0db8 +References: bsc#1195651 + +The switch statement already ensures cqe_type == CQE_RX_OKAY at that +point. + +Signed-off-by: Haiyang Zhang +Reviewed-by: Dexuan Cui +Signed-off-by: David S. Miller +Acked-by: Olaf Hering +--- + drivers/net/ethernet/microsoft/mana/mana_en.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c +--- a/drivers/net/ethernet/microsoft/mana/mana_en.c ++++ b/drivers/net/ethernet/microsoft/mana/mana_en.c +@@ -1104,9 +1104,6 @@ static void mana_process_rx_cqe(struct mana_rxq *rxq, struct mana_cq *cq, + return; + } + +- if (oob->cqe_hdr.cqe_type != CQE_RX_OKAY) +- return; +- + pktlen = oob->ppi[0].pkt_len; + + if (pktlen == 0) { diff --git a/patches.suse/mwifiex-Read-a-PCI-register-after-writing-the-TX-rin.patch b/patches.suse/mwifiex-Read-a-PCI-register-after-writing-the-TX-rin.patch new file mode 100644 index 0000000..005b41e --- /dev/null +++ b/patches.suse/mwifiex-Read-a-PCI-register-after-writing-the-TX-rin.patch @@ -0,0 +1,59 @@ +From e5f4eb8223aa740237cd463246a7debcddf4eda1 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jonas=20Dre=C3=9Fler?= +Date: Mon, 11 Oct 2021 15:32:23 +0200 +Subject: [PATCH] mwifiex: Read a PCI register after writing the TX ring write + pointer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Git-commit: e5f4eb8223aa740237cd463246a7debcddf4eda1 +References: git-fixes +Patch-mainline: v5.16-rc1 + +On the 88W8897 PCIe+USB card the firmware randomly crashes after setting +the TX ring write pointer. The issue is present in the latest firmware +version 15.68.19.p21 of the PCIe+USB card. + +Those firmware crashes can be worked around by reading any PCI register +of the card after setting that register, so read the PCI_VENDOR_ID +register here. The reason this works is probably because we keep the bus +from entering an ASPM state for a bit longer, because that's what causes +the cards firmware to crash. + +This fixes a bug where during RX/TX traffic and with ASPM L1 substates +enabled (the specific substates where the issue happens appear to be +platform dependent), the firmware crashes and eventually a command +timeout appears in the logs. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=109681 +Cc: stable@vger.kernel.org +Signed-off-by: Jonas Dreßler +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211011133224.15561-2-verdre@v0yd.nl +Signed-off-by: Oliver Neukum +--- + drivers/net/wireless/marvell/mwifiex/pcie.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c +index c6ccce426b49..641fa539de1f 100644 +--- a/drivers/net/wireless/marvell/mwifiex/pcie.c ++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c +@@ -1490,6 +1490,14 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb, + ret = -1; + goto done_unmap; + } ++ ++ /* The firmware (latest version 15.68.19.p21) of the 88W8897 PCIe+USB card ++ * seems to crash randomly after setting the TX ring write pointer when ++ * ASPM powersaving is enabled. A workaround seems to be keeping the bus ++ * busy by reading a random register afterwards. ++ */ ++ mwifiex_read_reg(adapter, PCI_VENDOR_ID, &rx_val); ++ + if ((mwifiex_pcie_txbd_not_full(card)) && + tx_param->next_pkt_len) { + /* have more packets and TxBD still can hold more */ +-- +2.34.1 + diff --git a/patches.suse/mwifiex-Send-DELBA-requests-according-to-spec.patch b/patches.suse/mwifiex-Send-DELBA-requests-according-to-spec.patch new file mode 100644 index 0000000..697b184 --- /dev/null +++ b/patches.suse/mwifiex-Send-DELBA-requests-according-to-spec.patch @@ -0,0 +1,55 @@ +From cc8a8bc37466f79b24d972555237f3d591150602 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jonas=20Dre=C3=9Fler?= +Date: Sat, 16 Oct 2021 17:32:43 +0200 +Subject: [PATCH] mwifiex: Send DELBA requests according to spec +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Git-commit: cc8a8bc37466f79b24d972555237f3d591150602 +References: git-fixes +Patch-mainline: v5.16-rc1 + +While looking at on-air packets using Wireshark, I noticed we're never +setting the initiator bit when sending DELBA requests to the AP: While +we set the bit on our del_ba_param_set bitmask, we forget to actually +copy that bitmask over to the command struct, which means we never +actually set the initiator bit. + +Fix that and copy the bitmask over to the host_cmd_ds_11n_delba command +struct. + +Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver") +Signed-off-by: Jonas Dreßler +Acked-by: Pali Rohár +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211016153244.24353-5-verdre@v0yd.nl +Signed-off-by: Oliver Neukum +--- + drivers/net/wireless/marvell/mwifiex/11n.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/11n.c b/drivers/net/wireless/marvell/mwifiex/11n.c +index b0695432b26a..9ff2058bcd7e 100644 +--- a/drivers/net/wireless/marvell/mwifiex/11n.c ++++ b/drivers/net/wireless/marvell/mwifiex/11n.c +@@ -657,14 +657,15 @@ int mwifiex_send_delba(struct mwifiex_private *priv, int tid, u8 *peer_mac, + uint16_t del_ba_param_set; + + memset(&delba, 0, sizeof(delba)); +- delba.del_ba_param_set = cpu_to_le16(tid << DELBA_TID_POS); + +- del_ba_param_set = le16_to_cpu(delba.del_ba_param_set); ++ del_ba_param_set = tid << DELBA_TID_POS; ++ + if (initiator) + del_ba_param_set |= IEEE80211_DELBA_PARAM_INITIATOR_MASK; + else + del_ba_param_set &= ~IEEE80211_DELBA_PARAM_INITIATOR_MASK; + ++ delba.del_ba_param_set = cpu_to_le16(del_ba_param_set); + memcpy(&delba.peer_mac_addr, peer_mac, ETH_ALEN); + + /* We don't wait for the response of this command */ +-- +2.34.1 + diff --git a/patches.suse/mxser-fix-xmit_buf-leak-in-activate-when-LSR-0xff.patch b/patches.suse/mxser-fix-xmit_buf-leak-in-activate-when-LSR-0xff.patch new file mode 100644 index 0000000..703b259 --- /dev/null +++ b/patches.suse/mxser-fix-xmit_buf-leak-in-activate-when-LSR-0xff.patch @@ -0,0 +1,68 @@ +From: Jiri Slaby +Date: Mon, 24 Jan 2022 08:14:24 +0100 +Subject: mxser: fix xmit_buf leak in activate when LSR == 0xff +Git-commit: cd3a4907ee334b40d7aa880c7ab310b154fd5cd4 +Patch-mainline: 5.18-rc1 +References: git-fixes + +When LSR is 0xff in ->activate() (rather unlike), we return an error. +Provided ->shutdown() is not called when ->activate() fails, nothing +actually frees the buffer in this case. + +Fix this by properly freeing the buffer in a designated label. We jump +there also from the "!info->type" if now too. + +Fixes: 6769140d3047 ("tty: mxser: use the tty_port_open method") +Signed-off-by: Jiri Slaby +Link: https://lore.kernel.org/r/20220124071430.14907-6-jslaby@suse.cz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/mxser.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +--- a/drivers/tty/mxser.c ++++ b/drivers/tty/mxser.c +@@ -860,6 +860,7 @@ static int mxser_activate(struct tty_por + struct mxser_port *info = container_of(port, struct mxser_port, port); + unsigned long page; + unsigned long flags; ++ int ret; + + page = __get_free_page(GFP_KERNEL); + if (!page) +@@ -869,9 +870,9 @@ static int mxser_activate(struct tty_por + + if (!info->ioaddr || !info->type) { + set_bit(TTY_IO_ERROR, &tty->flags); +- free_page(page); + spin_unlock_irqrestore(&info->slock, flags); +- return 0; ++ ret = 0; ++ goto err_free_xmit; + } + info->port.xmit_buf = (unsigned char *) page; + +@@ -897,8 +898,10 @@ static int mxser_activate(struct tty_por + if (capable(CAP_SYS_ADMIN)) { + set_bit(TTY_IO_ERROR, &tty->flags); + return 0; +- } else +- return -ENODEV; ++ } ++ ++ ret = -ENODEV; ++ goto err_free_xmit; + } + + /* +@@ -943,6 +946,10 @@ static int mxser_activate(struct tty_por + spin_unlock_irqrestore(&info->slock, flags); + + return 0; ++err_free_xmit: ++ free_page(page); ++ info->port.xmit_buf = NULL; ++ return ret; + } + + /* diff --git a/patches.suse/net-bcmgenet-Don-t-claim-WOL-when-its-not-available.patch b/patches.suse/net-bcmgenet-Don-t-claim-WOL-when-its-not-available.patch new file mode 100644 index 0000000..0062d3c --- /dev/null +++ b/patches.suse/net-bcmgenet-Don-t-claim-WOL-when-its-not-available.patch @@ -0,0 +1,57 @@ +From 82d66836b8ce8749ff0610b1bd4313f876aa4f47 Mon Sep 17 00:00:00 2001 +From: Jeremy Linton +Date: Wed, 9 Mar 2022 22:55:35 -0600 +Subject: [PATCH 4/8] net: bcmgenet: Don't claim WOL when its not available +Git-commit: 00b022f8f876a3a036b0df7f971001bef6398605 +Patch-mainline: v5.17-rc8 +References: git-fixes + +Some of the bcmgenet platforms don't correctly support WOL, yet +ethtool returns: + +"Supports Wake-on: gsf" + +which is false. + +Ideally if there isn't a wol_irq, or there is something else that +keeps the device from being able to wakeup it should display: + +"Supports Wake-on: d" + +This patch checks whether the device can wakup, before using the +hard-coded supported flags. This corrects the ethtool reporting, as +well as the WOL configuration because ethtool verifies that the mode +is supported before attempting it. + +Fixes: c51de7f3976b ("net: bcmgenet: add Wake-on-LAN support code") +Signed-off-by: Jeremy Linton +Tested-by: Peter Robinson +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/20220310045535.224450-1-jeremy.linton@arm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c +index a5caaf44b61a..a9a83d48b18f 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c +@@ -44,6 +44,13 @@ + void bcmgenet_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol) + { + struct bcmgenet_priv *priv = netdev_priv(dev); ++ struct device *kdev = &priv->pdev->dev; ++ ++ if (!device_can_wakeup(kdev)) { ++ wol->supported = 0; ++ wol->wolopts = 0; ++ return; ++ } + + wol->supported = WAKE_MAGIC | WAKE_MAGICSECURE; + wol->wolopts = priv->wolopts; +-- +2.16.4 + diff --git a/patches.suse/net-ethernet-mtk_eth_soc-fix-return-values-and-refac.patch b/patches.suse/net-ethernet-mtk_eth_soc-fix-return-values-and-refac.patch new file mode 100644 index 0000000..0a86c1b --- /dev/null +++ b/patches.suse/net-ethernet-mtk_eth_soc-fix-return-values-and-refac.patch @@ -0,0 +1,137 @@ +From b048aa8154b180f3da08f58813c59d65f83f1d3e Mon Sep 17 00:00:00 2001 +From: Daniel Golle +Date: Tue, 4 Jan 2022 12:06:22 +0000 +Subject: [PATCH 3/6] net: ethernet: mtk_eth_soc: fix return values and + refactor MDIO ops +References: git-fixes +Patch-mainline: v5.17-rc1 +Git-commit: eda80b249df7bbc7b3dd13907343a3e59bfc57fd + +Instead of returning -1 (-EPERM) when MDIO bus is stuck busy +while writing or 0xffff if it happens while reading, return the +appropriate -ETIMEDOUT. Also fix return type to int instead of u32. +Refactor functions to use bitfield helpers instead of having various +masking and shifting constants in the code, which also results in the +register definitions in the header file being more obviously related +to what is stated in the MediaTek's Reference Manual. + +Fixes: 656e705243fd0 ("net-next: mediatek: add support for MT7623 ethernet") +Signed-off-by: Daniel Golle +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 53 ++++++++++++++++------------- + drivers/net/ethernet/mediatek/mtk_eth_soc.h | 16 ++++++--- + 2 files changed, 41 insertions(+), 28 deletions(-) + +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index 962975d192d1..5f15eb86ff00 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -78,46 +78,53 @@ static int mtk_mdio_busy_wait(struct mtk_eth *eth) + } + + dev_err(eth->dev, "mdio: MDIO timeout\n"); +- return -1; ++ return -ETIMEDOUT; + } + +-static u32 _mtk_mdio_write(struct mtk_eth *eth, u32 phy_addr, +- u32 phy_register, u32 write_data) ++static int _mtk_mdio_write(struct mtk_eth *eth, u32 phy_addr, u32 phy_reg, ++ u32 write_data) + { +- if (mtk_mdio_busy_wait(eth)) +- return -1; ++ int ret; + +- write_data &= 0xffff; ++ ret = mtk_mdio_busy_wait(eth); ++ if (ret < 0) ++ return ret; + +- mtk_w32(eth, PHY_IAC_ACCESS | PHY_IAC_START | PHY_IAC_WRITE | +- (phy_register << PHY_IAC_REG_SHIFT) | +- (phy_addr << PHY_IAC_ADDR_SHIFT) | write_data, ++ mtk_w32(eth, PHY_IAC_ACCESS | ++ PHY_IAC_START_C22 | ++ PHY_IAC_CMD_WRITE | ++ PHY_IAC_REG(phy_reg) | ++ PHY_IAC_ADDR(phy_addr) | ++ PHY_IAC_DATA(write_data), + MTK_PHY_IAC); + +- if (mtk_mdio_busy_wait(eth)) +- return -1; ++ ret = mtk_mdio_busy_wait(eth); ++ if (ret < 0) ++ return ret; + + return 0; + } + +-static u32 _mtk_mdio_read(struct mtk_eth *eth, int phy_addr, int phy_reg) ++static int _mtk_mdio_read(struct mtk_eth *eth, u32 phy_addr, u32 phy_reg) + { +- u32 d; ++ int ret; + +- if (mtk_mdio_busy_wait(eth)) +- return 0xffff; ++ ret = mtk_mdio_busy_wait(eth); ++ if (ret < 0) ++ return ret; + +- mtk_w32(eth, PHY_IAC_ACCESS | PHY_IAC_START | PHY_IAC_READ | +- (phy_reg << PHY_IAC_REG_SHIFT) | +- (phy_addr << PHY_IAC_ADDR_SHIFT), ++ mtk_w32(eth, PHY_IAC_ACCESS | ++ PHY_IAC_START_C22 | ++ PHY_IAC_CMD_C22_READ | ++ PHY_IAC_REG(phy_reg) | ++ PHY_IAC_ADDR(phy_addr), + MTK_PHY_IAC); + +- if (mtk_mdio_busy_wait(eth)) +- return 0xffff; +- +- d = mtk_r32(eth, MTK_PHY_IAC) & 0xffff; ++ ret = mtk_mdio_busy_wait(eth); ++ if (ret < 0) ++ return ret; + +- return d; ++ return mtk_r32(eth, MTK_PHY_IAC) & PHY_IAC_DATA_MASK; + } + + static int mtk_mdio_write(struct mii_bus *bus, int phy_addr, +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.h b/drivers/net/ethernet/mediatek/mtk_eth_soc.h +index 3c46a3b613b9..d656a459e77b 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h +@@ -288,11 +288,17 @@ + /* PHY Indirect Access Control registers */ + #define MTK_PHY_IAC 0x10004 + #define PHY_IAC_ACCESS BIT(31) +-#define PHY_IAC_READ BIT(19) +-#define PHY_IAC_WRITE BIT(18) +-#define PHY_IAC_START BIT(16) +-#define PHY_IAC_ADDR_SHIFT 20 +-#define PHY_IAC_REG_SHIFT 25 ++#define PHY_IAC_REG_MASK GENMASK(29, 25) ++#define PHY_IAC_REG(x) FIELD_PREP(PHY_IAC_REG_MASK, (x)) ++#define PHY_IAC_ADDR_MASK GENMASK(24, 20) ++#define PHY_IAC_ADDR(x) FIELD_PREP(PHY_IAC_ADDR_MASK, (x)) ++#define PHY_IAC_CMD_MASK GENMASK(19, 18) ++#define PHY_IAC_CMD_WRITE FIELD_PREP(PHY_IAC_CMD_MASK, 1) ++#define PHY_IAC_CMD_C22_READ FIELD_PREP(PHY_IAC_CMD_MASK, 2) ++#define PHY_IAC_START_MASK GENMASK(17, 16) ++#define PHY_IAC_START_C22 FIELD_PREP(PHY_IAC_START_MASK, 1) ++#define PHY_IAC_DATA_MASK GENMASK(15, 0) ++#define PHY_IAC_DATA(x) FIELD_PREP(PHY_IAC_DATA_MASK, (x)) + #define PHY_IAC_TIMEOUT HZ + + /* Mac control registers */ +-- +2.16.4 + diff --git a/patches.suse/net-qlogic-check-the-return-value-of-dma_alloc_coher.patch b/patches.suse/net-qlogic-check-the-return-value-of-dma_alloc_coher.patch new file mode 100644 index 0000000..e8a1c37 --- /dev/null +++ b/patches.suse/net-qlogic-check-the-return-value-of-dma_alloc_coher.patch @@ -0,0 +1,49 @@ +From cb0d2dc083a1c0c176d52858ca7318bc462cfbee Mon Sep 17 00:00:00 2001 +From: Jia-Ju Bai +Date: Sat, 5 Mar 2022 01:14:11 -0800 +Subject: [PATCH 2/8] net: qlogic: check the return value of + dma_alloc_coherent() in qed_vf_hw_prepare() +Git-commit: e0058f0fa80f6e09c4d363779c241c45a3c56b94 +Patch-mainline: v5.17-rc8 +References: git-fixes + +The function dma_alloc_coherent() in qed_vf_hw_prepare() can fail, so +its return value should be checked. + +Fixes: 1408cc1fa48c ("qed: Introduce VFs") +Reported-by: TOTE Robot +Signed-off-by: Jia-Ju Bai +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/qlogic/qed/qed_vf.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_vf.c b/drivers/net/ethernet/qlogic/qed/qed_vf.c +index 93a0fbf6a132..e12338abaf0a 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_vf.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_vf.c +@@ -539,6 +539,9 @@ int qed_vf_hw_prepare(struct qed_hwfn *p_hwfn) + p_iov->bulletin.size, + &p_iov->bulletin.phys, + GFP_KERNEL); ++ if (!p_iov->bulletin.p_virt) ++ goto free_pf2vf_reply; ++ + DP_VERBOSE(p_hwfn, QED_MSG_IOV, + "VF's bulletin Board [%p virt 0x%llx phys 0x%08x bytes]\n", + p_iov->bulletin.p_virt, +@@ -578,6 +581,10 @@ int qed_vf_hw_prepare(struct qed_hwfn *p_hwfn) + + return rc; + ++free_pf2vf_reply: ++ dma_free_coherent(&p_hwfn->cdev->pdev->dev, ++ sizeof(union pfvf_tlvs), ++ p_iov->pf2vf_reply, p_iov->pf2vf_reply_phys); + free_vf2pf_request: + dma_free_coherent(&p_hwfn->cdev->pdev->dev, + sizeof(union vfpf_tlvs), +-- +2.16.4 + diff --git a/patches.suse/net-sched-fixed-barrier-to-prevent-skbuff-sticking-i.patch b/patches.suse/net-sched-fixed-barrier-to-prevent-skbuff-sticking-i.patch new file mode 100644 index 0000000..74c9b45 --- /dev/null +++ b/patches.suse/net-sched-fixed-barrier-to-prevent-skbuff-sticking-i.patch @@ -0,0 +1,134 @@ +From: Vincent Ray +Date: Wed, 25 May 2022 17:17:46 -0700 +Subject: net: sched: fixed barrier to prevent skbuff sticking in qdisc backlog +Patch-mainline: v5.19-rc1 +Git-commit: a54ce3703613e41fe1d98060b62ec09a3984dc28 +References: bsc#1183405 + +In qdisc_run_begin(), smp_mb__before_atomic() used before test_bit() +does not provide any ordering guarantee as test_bit() is not an atomic +operation. This, added to the fact that the spin_trylock() call at +the beginning of qdisc_run_begin() does not guarantee acquire +semantics if it does not grab the lock, makes it possible for the +following statement : + +if (test_bit(__QDISC_STATE_MISSED, &qdisc->state)) + +to be executed before an enqueue operation called before +qdisc_run_begin(). + +As a result the following race can happen : + + CPU 1 CPU 2 + + qdisc_run_begin() qdisc_run_begin() /* true */ + set(MISSED) . + /* returns false */ . + . /* sees MISSED = 1 */ + . /* so qdisc not empty */ + . __qdisc_run() + . . + . pfifo_fast_dequeue() + ----> /* may be done here */ . +| . clear(MISSED) +| . . +| . smp_mb __after_atomic(); +| . . +| . /* recheck the queue */ +| . /* nothing => exit */ +| enqueue(skb1) +| . +| qdisc_run_begin() +| . +| spin_trylock() /* fail */ +| . +| smp_mb__before_atomic() /* not enough */ +| . + ---- if (test_bit(MISSED)) + return false; /* exit */ + +In the above scenario, CPU 1 and CPU 2 both try to grab the +qdisc->seqlock at the same time. Only CPU 2 succeeds and enters the +bypass code path, where it emits its skb then calls __qdisc_run(). + +CPU1 fails, sets MISSED and goes down the traditionnal enqueue() + +dequeue() code path. But when executing qdisc_run_begin() for the +second time, after enqueuing its skbuff, it sees the MISSED bit still +set (by itself) and consequently chooses to exit early without setting +it again nor trying to grab the spinlock again. + +Meanwhile CPU2 has seen MISSED = 1, cleared it, checked the queue +and found it empty, so it returned. + +At the end of the sequence, we end up with skb1 enqueued in the +backlog, both CPUs out of __dev_xmit_skb(), the MISSED bit not set, +and no __netif_schedule() called made. skb1 will now linger in the +qdisc until somebody later performs a full __qdisc_run(). Associated +to the bypass capacity of the qdisc, and the ability of the TCP layer +to avoid resending packets which it knows are still in the qdisc, this +can lead to serious traffic "holes" in a TCP connection. + +We fix this by replacing the smp_mb__before_atomic() / test_bit() / +set_bit() / smp_mb__after_atomic() sequence inside qdisc_run_begin() +by a single test_and_set_bit() call, which is more concise and +enforces the needed memory barriers. + +Fixes: 89837eb4b246 ("net: sched: add barrier to ensure correct ordering for lockless qdisc") +Signed-off-by: Vincent Ray +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20220526001746.2437669-1-eric.dumazet@gmail.com +Signed-off-by: Jakub Kicinski +Acked-by: Michal Kubecek + +--- + include/net/sch_generic.h | 36 ++++++++---------------------------- + 1 file changed, 8 insertions(+), 28 deletions(-) + +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -165,37 +165,17 @@ static inline bool qdisc_run_begin(struct Qdisc *qdisc) + if (spin_trylock(&qdisc->seqlock)) + goto nolock_empty; + +- /* Paired with smp_mb__after_atomic() to make sure +- * STATE_MISSED checking is synchronized with clearing +- * in pfifo_fast_dequeue(). ++ /* No need to insist if the MISSED flag was already set. ++ * Note that test_and_set_bit() also gives us memory ordering ++ * guarantees wrt potential earlier enqueue() and below ++ * spin_trylock(), both of which are necessary to prevent races + */ +- smp_mb__before_atomic(); +- +- /* If the MISSED flag is set, it means other thread has +- * set the MISSED flag before second spin_trylock(), so +- * we can return false here to avoid multi cpus doing +- * the set_bit() and second spin_trylock() concurrently. +- */ +- if (test_bit(__QDISC_STATE_MISSED, &qdisc->state)) ++ if (test_and_set_bit(__QDISC_STATE_MISSED, &qdisc->state)) + return false; + +- /* Set the MISSED flag before the second spin_trylock(), +- * if the second spin_trylock() return false, it means +- * other cpu holding the lock will do dequeuing for us +- * or it will see the MISSED flag set after releasing +- * lock and reschedule the net_tx_action() to do the +- * dequeuing. +- */ +- set_bit(__QDISC_STATE_MISSED, &qdisc->state); +- +- /* spin_trylock() only has load-acquire semantic, so use +- * smp_mb__after_atomic() to ensure STATE_MISSED is set +- * before doing the second spin_trylock(). +- */ +- smp_mb__after_atomic(); +- +- /* Retry again in case other CPU may not see the new flag +- * after it releases the lock at the end of qdisc_run_end(). ++ /* Try to take the lock again to make sure that we will either ++ * grab it or the CPU that still has it will see MISSED set ++ * when testing it in qdisc_run_end() + */ + if (!spin_trylock(&qdisc->seqlock)) + return false; diff --git a/patches.suse/net-sysfs-call-dev_hold-if-kobject_init_and_add-succ.patch b/patches.suse/net-sysfs-call-dev_hold-if-kobject_init_and_add-succ.patch new file mode 100644 index 0000000..68d1f84 --- /dev/null +++ b/patches.suse/net-sysfs-call-dev_hold-if-kobject_init_and_add-succ.patch @@ -0,0 +1,61 @@ +From: YueHaibing +Date: Tue, 19 Mar 2019 10:16:53 +0800 +Subject: net-sysfs: call dev_hold if kobject_init_and_add success +Patch-mainline: v5.1-rc3 +Git-commit: a3e23f719f5c4a38ffb3d30c8d7632a4ed8ccd9e +References: CVE-2019-20811 bsc#1172456 + +In netdev_queue_add_kobject and rx_queue_add_kobject, +if sysfs_create_group failed, kobject_put will call +netdev_queue_release to decrease dev refcont, however +dev_hold has not be called. So we will see this while +unregistering dev: + +unregister_netdevice: waiting for bcsh0 to become free. Usage count = -1 + +Reported-by: Hulk Robot +Fixes: d0d668371679 ("net: don't decrement kobj reference count on init failure") +Signed-off-by: YueHaibing +Signed-off-by: David S. Miller +Acked-by: Michal Kubecek + +--- + net/core/net-sysfs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/net/core/net-sysfs.c ++++ b/net/core/net-sysfs.c +@@ -919,6 +919,8 @@ static int rx_queue_add_kobject(struct net_device *dev, int index) + if (error) + return error; + ++ dev_hold(queue->dev); ++ + if (dev->sysfs_rx_queue_group) { + error = sysfs_create_group(kobj, dev->sysfs_rx_queue_group); + if (error) { +@@ -928,7 +930,6 @@ static int rx_queue_add_kobject(struct net_device *dev, int index) + } + + kobject_uevent(kobj, KOBJ_ADD); +- dev_hold(queue->dev); + + return error; + } +@@ -1340,6 +1341,8 @@ static int netdev_queue_add_kobject(struct net_device *dev, int index) + if (error) + return error; + ++ dev_hold(queue->dev); ++ + #ifdef CONFIG_BQL + error = sysfs_create_group(kobj, &dql_group); + if (error) { +@@ -1349,7 +1352,6 @@ static int netdev_queue_add_kobject(struct net_device *dev, int index) + #endif + + kobject_uevent(kobj, KOBJ_ADD); +- dev_hold(queue->dev); + + return 0; + } diff --git a/patches.suse/net-usb-ax88179_178a-Fix-out-of-bounds-accesses-in-R.patch b/patches.suse/net-usb-ax88179_178a-Fix-out-of-bounds-accesses-in-R.patch index 70322c5..07c5992 100644 --- a/patches.suse/net-usb-ax88179_178a-Fix-out-of-bounds-accesses-in-R.patch +++ b/patches.suse/net-usb-ax88179_178a-Fix-out-of-bounds-accesses-in-R.patch @@ -4,7 +4,7 @@ Date: Wed, 26 Jan 2022 14:14:52 +0100 Subject: [PATCH] net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup Git-commit: 57bc3d3ae8c14df3ceb4e17d26ddf9eeab304581 -References: bsc#1196018 +References: bsc#1196018 CVE-2022-28748 Patch-mainline: v5.17-rc4 ax88179_rx_fixup() contains several out-of-bounds accesses that can be diff --git a/patches.suse/net-x25-Fix-null-ptr-deref-caused-by-x25_disconnect.patch b/patches.suse/net-x25-Fix-null-ptr-deref-caused-by-x25_disconnect.patch new file mode 100644 index 0000000..b86e806 --- /dev/null +++ b/patches.suse/net-x25-Fix-null-ptr-deref-caused-by-x25_disconnect.patch @@ -0,0 +1,64 @@ +From d6f4bdc3bca4ddcdc60c0544d85ecf7670ee1c53 Mon Sep 17 00:00:00 2001 +From: Duoming Zhou +Date: Sat, 26 Mar 2022 18:43:46 +0800 +Subject: [PATCH] net/x25: Fix null-ptr-deref caused by x25_disconnect +Git-commit: 7781607938c8371d4c2b243527430241c62e39c2 +Patch-mainline: v5.18-rc1 +References: CVE-2022-1516 bsc#1199012 + +When the link layer is terminating, x25->neighbour will be set to NULL +in x25_disconnect(). As a result, it could cause null-ptr-deref bugs in +x25_sendmsg(),x25_recvmsg() and x25_connect(). One of the bugs is +shown below. + + (Thread 1) | (Thread 2) +x25_link_terminated() | x25_recvmsg() + x25_kill_by_neigh() | ... + x25_disconnect() | lock_sock(sk) + ... | ... + x25->neighbour = NULL //(1) | + ... | x25->neighbour->extended //(2) + +The code sets NULL to x25->neighbour in position (1) and dereferences +x25->neighbour in position (2), which could cause null-ptr-deref bug. + +This patch adds lock_sock() in x25_kill_by_neigh() in order to synchronize +with x25_sendmsg(), x25_recvmsg() and x25_connect(). What`s more, the +sock held by lock_sock() is not NULL, because it is extracted from x25_list +and uses x25_list_lock to synchronize. + +Fixes: 4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect") +Signed-off-by: Duoming Zhou +Reviewed-by: Lin Ma +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + net/x25/af_x25.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c +index b7e91af375a9..bdf6e80c8597 100644 +--- a/net/x25/af_x25.c ++++ b/net/x25/af_x25.c +@@ -1789,10 +1789,15 @@ void x25_kill_by_neigh(struct x25_neigh *nb) + + write_lock_bh(&x25_list_lock); + +- sk_for_each(s, &x25_list) +- if (x25_sk(s)->neighbour == nb) ++ sk_for_each(s, &x25_list) { ++ if (x25_sk(s)->neighbour == nb) { ++ write_unlock_bh(&x25_list_lock); ++ lock_sock(s); + x25_disconnect(s, ENETUNREACH, 0, 0); +- ++ release_sock(s); ++ write_lock_bh(&x25_list_lock); ++ } ++ } + write_unlock_bh(&x25_list_lock); + + /* Remove any related forwards */ +-- +2.16.4 + diff --git a/patches.suse/netfilter-conntrack-connection-timeout-after-re-regi.patch b/patches.suse/netfilter-conntrack-connection-timeout-after-re-regi.patch new file mode 100644 index 0000000..0fcdb8b --- /dev/null +++ b/patches.suse/netfilter-conntrack-connection-timeout-after-re-regi.patch @@ -0,0 +1,58 @@ +From 4f25434bccc28cf8a07876ef5142a2869a674353 Mon Sep 17 00:00:00 2001 +From: Francesco Ruggeri +Date: Wed, 7 Oct 2020 12:32:52 -0700 +Subject: [PATCH] netfilter: conntrack: connection timeout after re-register +Git-commit: 4f25434bccc28cf8a07876ef5142a2869a674353 +Patch-mainline: v5.10-rc1 +References: bsc#1199035 + +If the first packet conntrack sees after a re-register is an outgoing +keepalive packet with no data (SEG.SEQ = SND.NXT-1), td_end is set to +SND.NXT-1. +When the peer correctly acknowledges SND.NXT, tcp_in_window fails +check III (Upper bound for valid (s)ack: sack <= receiver.td_end) and +returns false, which cascades into nf_conntrack_in setting +skb->_nfct = 0 and in later conntrack iptables rules not matching. +In cases where iptables are dropping packets that do not match +conntrack rules this can result in idle tcp connections to time out. + +v2: adjust td_end when getting the reply rather than when sending out + the keepalive packet. + +Fixes: f94e63801ab2 ("netfilter: conntrack: reset tcp maxwin on re-register") +Signed-off-by: Francesco Ruggeri +Signed-off-by: Pablo Neira Ayuso +Acked-by: Ali Abdallah +--- + net/netfilter/nf_conntrack_proto_tcp.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +--- a/net/netfilter/nf_conntrack_proto_tcp.c ++++ b/net/netfilter/nf_conntrack_proto_tcp.c +@@ -576,13 +576,20 @@ static bool tcp_in_window(const struct n + swin = win << sender->td_scale; + sender->td_maxwin = (swin == 0 ? 1 : swin); + sender->td_maxend = end + sender->td_maxwin; +- /* +- * We haven't seen traffic in the other direction yet +- * but we have to tweak window tracking to pass III +- * and IV until that happens. +- */ +- if (receiver->td_maxwin == 0) ++ if (receiver->td_maxwin == 0) { ++ /* We haven't seen traffic in the other ++ * direction yet but we have to tweak window ++ * tracking to pass III and IV until that ++ * happens. ++ */ + receiver->td_end = receiver->td_maxend = sack; ++ } else if (sack == receiver->td_end + 1) { ++ /* Likely a reply to a keepalive. ++ * Needed for III. ++ */ ++ receiver->td_end++; ++ } ++ + } + } else if (((state->state == TCP_CONNTRACK_SYN_SENT + && dir == IP_CT_DIR_ORIGINAL) diff --git a/patches.suse/netfilter-conntrack-move-synack-init-code-to-helper.patch b/patches.suse/netfilter-conntrack-move-synack-init-code-to-helper.patch new file mode 100644 index 0000000..4b04bce --- /dev/null +++ b/patches.suse/netfilter-conntrack-move-synack-init-code-to-helper.patch @@ -0,0 +1,85 @@ +From cc4f9d62037ebcb811f4908bba2986c01df1bd50 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Sat, 29 Jan 2022 17:47:00 +0100 +Subject: [PATCH] netfilter: conntrack: move synack init code to helper +Git-commit: cc4f9d62037ebcb811f4908bba2986c01df1bd50 +Patch-mainline: v5.17-rc4 +References: bsc#1199035 + +It seems more readable to use a common helper in the followup fix rather +than copypaste or goto. + +No functional change intended. The function is only called for syn-ack +or syn in repy direction in case of simultaneous open. + +Signed-off-by: Florian Westphal +Acked-by: Jozsef Kadlecsik +Signed-off-by: Pablo Neira Ayuso +Acked-by: Ali Abdallah +--- + net/netfilter/nf_conntrack_proto_tcp.c | 47 ++++++++++++++++++++------------- + 1 file changed, 29 insertions(+), 18 deletions(-) + +--- a/net/netfilter/nf_conntrack_proto_tcp.c ++++ b/net/netfilter/nf_conntrack_proto_tcp.c +@@ -497,6 +497,32 @@ static void tcp_sack(const struct sk_buf + } + } + ++static void tcp_init_sender(struct ip_ct_tcp_state *sender, ++ struct ip_ct_tcp_state *receiver, ++ const struct sk_buff *skb, ++ unsigned int dataoff, ++ const struct tcphdr *tcph, ++ u32 end, u32 win) ++{ ++ /* SYN-ACK in reply to a SYN ++ * or SYN from reply direction in simultaneous open. ++ */ ++ sender->td_end = ++ sender->td_maxend = end; ++ sender->td_maxwin = (win == 0 ? 1 : win); ++ ++ tcp_options(skb, dataoff, tcph, sender); ++ /* RFC 1323: ++ * Both sides must send the Window Scale option ++ * to enable window scaling in either direction. ++ */ ++ if (!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE && ++ receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE)) { ++ sender->td_scale = 0; ++ receiver->td_scale = 0; ++ } ++} ++ + static bool tcp_in_window(const struct nf_conn *ct, + struct ip_ct_tcp *state, + enum ip_conntrack_dir dir, +@@ -548,24 +574,9 @@ static bool tcp_in_window(const struct n + * Initialize sender data. + */ + if (tcph->syn) { +- /* +- * SYN-ACK in reply to a SYN +- * or SYN from reply direction in simultaneous open. +- */ +- sender->td_end = +- sender->td_maxend = end; +- sender->td_maxwin = (win == 0 ? 1 : win); +- +- tcp_options(skb, dataoff, tcph, sender); +- /* +- * RFC 1323: +- * Both sides must send the Window Scale option +- * to enable window scaling in either direction. +- */ +- if (!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE +- && receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE)) +- sender->td_scale = +- receiver->td_scale = 0; ++ tcp_init_sender(sender, receiver, ++ skb, dataoff, tcph, ++ end, win); + if (!tcph->ack) + /* Simultaneous open */ + return true; diff --git a/patches.suse/netfilter-conntrack-re-init-state-for-retransmitted-.patch b/patches.suse/netfilter-conntrack-re-init-state-for-retransmitted-.patch new file mode 100644 index 0000000..09a9712 --- /dev/null +++ b/patches.suse/netfilter-conntrack-re-init-state-for-retransmitted-.patch @@ -0,0 +1,77 @@ +From 82b72cb94666b3dbd7152bb9f441b068af7a921b Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Sat, 29 Jan 2022 17:47:01 +0100 +Subject: [PATCH] netfilter: conntrack: re-init state for retransmitted syn-ack +Git-commit: 82b72cb94666b3dbd7152bb9f441b068af7a921b +Patch-mainline: v5.17-rc4 +References: bsc#1199035 + +TCP conntrack assumes that a syn-ack retransmit is identical to the +previous syn-ack. This isn't correct and causes stuck 3whs in some more +esoteric scenarios. tcpdump to illustrate the problem: + + client > server: Flags [S] seq 1365731894, win 29200, [mss 1460,sackOK,TS val 2083035583 ecr 0,wscale 7] + server > client: Flags [S.] seq 145824453, ack 643160523, win 65535, [mss 8952,wscale 5,TS val 3215367629 ecr 2082921663] + +Note the invalid/outdated synack ack number. +Conntrack marks this syn-ack as out-of-window/invalid, but it did +initialize the reply direction parameters based on this packets content. + + client > server: Flags [S] seq 1365731894, win 29200, [mss 1460,sackOK,TS val 2083036623 ecr 0,wscale 7] + +... retransmit... + + server > client: Flags [S.], seq 145824453, ack 643160523, win 65535, [mss 8952,wscale 5,TS val 3215368644 ecr 2082921663] + +and another bogus synack. This repeats, then client re-uses for a new +attempt: + +client > server: Flags [S], seq 2375731741, win 29200, [mss 1460,sackOK,TS val 2083100223 ecr 0,wscale 7] +server > client: Flags [S.], seq 145824453, ack 643160523, win 65535, [mss 8952,wscale 5,TS val 3215430754 ecr 2082921663] + +... but still gets a invalid syn-ack. + +This repeats until: + + server > client: Flags [S.], seq 145824453, ack 643160523, win 65535, [mss 8952,wscale 5,TS val 3215437785 ecr 2082921663] + server > client: Flags [R.], seq 145824454, ack 643160523, win 65535, [mss 8952,wscale 5,TS val 3215443451 ecr 2082921663] + client > server: Flags [S], seq 2375731741, win 29200, [mss 1460,sackOK,TS val 2083115583 ecr 0,wscale 7] + server > client: Flags [S.], seq 162602410, ack 2375731742, win 65535, [mss 8952,wscale 5,TS val 3215445754 ecr 2083115583] + +This syn-ack has the correct ack number, but conntrack flags it as +invalid: The internal state was created from the first syn-ack seen +so the sequence number of the syn-ack is treated as being outside of +the announced window. + +Don't assume that retransmitted syn-ack is identical to previous one. +Treat it like the first syn-ack and reinit state. + +Signed-off-by: Florian Westphal +Acked-by: Jozsef Kadlecsik +Signed-off-by: Pablo Neira Ayuso +Acked-by: Ali Abdallah +--- + net/netfilter/nf_conntrack_proto_tcp.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/net/netfilter/nf_conntrack_proto_tcp.c ++++ b/net/netfilter/nf_conntrack_proto_tcp.c +@@ -620,6 +620,18 @@ static bool tcp_in_window(const struct n + sender->td_maxwin = (win == 0 ? 1 : win); + + tcp_options(skb, dataoff, tcph, sender); ++ } else if (tcph->syn && dir == IP_CT_DIR_REPLY && ++ state->state == TCP_CONNTRACK_SYN_SENT) { ++ /* Retransmitted syn-ack, or syn (simultaneous open). ++ * ++ * Re-init state for this direction, just like for the first ++ * syn(-ack) reply, it might differ in seq, ack or tcp options. ++ */ ++ tcp_init_sender(sender, receiver, ++ skb, dataoff, tcph, ++ end, win); ++ if (!tcph->ack) ++ return true; + } + + if (!(tcph->ack)) { diff --git a/patches.suse/netfilter-nf_conntrack_tcp-preserve-liberal-flag-in-.patch b/patches.suse/netfilter-nf_conntrack_tcp-preserve-liberal-flag-in-.patch new file mode 100644 index 0000000..bac1e5d --- /dev/null +++ b/patches.suse/netfilter-nf_conntrack_tcp-preserve-liberal-flag-in-.patch @@ -0,0 +1,66 @@ +From f2dd495a8d589371289981d5ed33e6873df94ecc Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Mon, 21 Mar 2022 11:38:32 +0100 +Subject: [PATCH] netfilter: nf_conntrack_tcp: preserve liberal flag in tcp + options +Git-commit: f2dd495a8d589371289981d5ed33e6873df94ecc +Patch-mainline: v5.18-rc1 +References: bsc#1199035 + +Do not reset IP_CT_TCP_FLAG_BE_LIBERAL flag in out-of-sync scenarios +coming before the TCP window tracking, otherwise such connections will +fail in the window check. + +Update tcp_options() to leave this flag in place and add a new helper +function to reset the tcp window state. + +Based on patch from Sven Auhagen. + +Fixes: c4832c7bbc3f ("netfilter: nf_ct_tcp: improve out-of-sync situation in TCP tracking") +Tested-by: Sven Auhagen +Signed-off-by: Pablo Neira Ayuso +Acked-by: Ali Abdallah +--- + net/netfilter/nf_conntrack_proto_tcp.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- a/net/netfilter/nf_conntrack_proto_tcp.c ++++ b/net/netfilter/nf_conntrack_proto_tcp.c +@@ -393,8 +393,8 @@ static void tcp_options(const struct sk_ + length, buff); + BUG_ON(ptr == NULL); + +- state->td_scale = +- state->flags = 0; ++ state->td_scale = 0; ++ state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL; + + while (length > 0) { + int opcode=*ptr++; +@@ -859,6 +859,16 @@ static bool tcp_can_early_drop(const str + return false; + } + ++static void nf_ct_tcp_state_reset(struct ip_ct_tcp_state *state) ++{ ++ state->td_end = 0; ++ state->td_maxend = 0; ++ state->td_maxwin = 0; ++ state->td_maxack = 0; ++ state->td_scale = 0; ++ state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL; ++} ++ + /* Returns verdict for packet, or -1 for invalid. */ + static int tcp_packet(struct nf_conn *ct, + const struct sk_buff *skb, +@@ -960,8 +970,7 @@ static int tcp_packet(struct nf_conn *ct + ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK; + ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags = + ct->proto.tcp.last_flags; +- memset(&ct->proto.tcp.seen[dir], 0, +- sizeof(struct ip_ct_tcp_state)); ++ nf_ct_tcp_state_reset(&ct->proto.tcp.seen[dir]); + break; + } + ct->proto.tcp.last_index = index; diff --git a/patches.suse/netfilter-nf_conntrack_tcp-re-init-for-syn-packets-o.patch b/patches.suse/netfilter-nf_conntrack_tcp-re-init-for-syn-packets-o.patch new file mode 100644 index 0000000..309a431 --- /dev/null +++ b/patches.suse/netfilter-nf_conntrack_tcp-re-init-for-syn-packets-o.patch @@ -0,0 +1,94 @@ +From c7aab4f17021b636a0ee75bcf28e06fb7c94ab48 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Mon, 25 Apr 2022 11:47:11 +0200 +Subject: [PATCH] netfilter: nf_conntrack_tcp: re-init for syn packets only +Git-commit: c7aab4f17021b636a0ee75bcf28e06fb7c94ab48 +Patch-mainline: v5.18-rc5 +References: bsc#1199035 + +Jaco Kroon reported tcp problems that Eric Dumazet and Neal Cardwell +pinpointed to nf_conntrack tcp_in_window() bug. + +tcp trace shows following sequence: + +I > R Flags [S], seq 3451342529, win 62580, options [.. tfo [|tcp]> +R > I Flags [S.], seq 2699962254, ack 3451342530, win 65535, options [..] +R > I Flags [P.], seq 1:89, ack 1, [..] + +Note 3rd ACK is from responder to initiator so following branch is taken: + } else if (((state->state == TCP_CONNTRACK_SYN_SENT + && dir == IP_CT_DIR_ORIGINAL) + || (state->state == TCP_CONNTRACK_SYN_RECV + && dir == IP_CT_DIR_REPLY)) + && after(end, sender->td_end)) { + +... because state == TCP_CONNTRACK_SYN_RECV and dir is REPLY. +This causes the scaling factor to be reset to 0: window scale option +is only present in syn(ack) packets. This in turn makes nf_conntrack +mark valid packets as out-of-window. + +This was always broken, it exists even in original commit where +window tracking was added to ip_conntrack (nf_conntrack predecessor) +in 2.6.9-rc1 kernel. + +Restrict to 'tcph->syn', just like the 3rd condtional added in +commit 82b72cb94666 ("netfilter: conntrack: re-init state for retransmitted syn-ack"). + +Upon closer look, those conditionals/branches can be merged: + +Because earlier checks prevent syn-ack from showing up in +original direction, the 'dir' checks in the conditional quoted above are +redundant, remove them. Return early for pure syn retransmitted in reply +direction (simultaneous open). + +Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.") +Reported-by: Jaco Kroon +Signed-off-by: Florian Westphal +Acked-by: Jozsef Kadlecsik +Signed-off-by: Pablo Neira Ayuso +Acked-by: Ali Abdallah +--- + net/netfilter/nf_conntrack_proto_tcp.c | 21 ++++++--------------- + 1 file changed, 6 insertions(+), 15 deletions(-) + +--- a/net/netfilter/nf_conntrack_proto_tcp.c ++++ b/net/netfilter/nf_conntrack_proto_tcp.c +@@ -605,24 +605,14 @@ static bool tcp_in_window(const struct n + } + + } +- } else if (((state->state == TCP_CONNTRACK_SYN_SENT +- && dir == IP_CT_DIR_ORIGINAL) +- || (state->state == TCP_CONNTRACK_SYN_RECV +- && dir == IP_CT_DIR_REPLY)) +- && after(end, sender->td_end)) { ++ } else if (tcph->syn && ++ after(end, sender->td_end) && ++ (state->state == TCP_CONNTRACK_SYN_SENT || ++ state->state == TCP_CONNTRACK_SYN_RECV)) { + /* + * RFC 793: "if a TCP is reinitialized ... then it need + * not wait at all; it must only be sure to use sequence + * numbers larger than those recently used." +- */ +- sender->td_end = +- sender->td_maxend = end; +- sender->td_maxwin = (win == 0 ? 1 : win); +- +- tcp_options(skb, dataoff, tcph, sender); +- } else if (tcph->syn && dir == IP_CT_DIR_REPLY && +- state->state == TCP_CONNTRACK_SYN_SENT) { +- /* Retransmitted syn-ack, or syn (simultaneous open). + * + * Re-init state for this direction, just like for the first + * syn(-ack) reply, it might differ in seq, ack or tcp options. +@@ -630,7 +620,8 @@ static bool tcp_in_window(const struct n + tcp_init_sender(sender, receiver, + skb, dataoff, tcph, + end, win); +- if (!tcph->ack) ++ ++ if (dir == IP_CT_DIR_REPLY && !tcph->ack) + return true; + } + diff --git a/patches.suse/netfilter-nf_tables-disallow-non-stateful-expression.patch b/patches.suse/netfilter-nf_tables-disallow-non-stateful-expression.patch new file mode 100644 index 0000000..a7ceb77 --- /dev/null +++ b/patches.suse/netfilter-nf_tables-disallow-non-stateful-expression.patch @@ -0,0 +1,83 @@ +From: Pablo Neira Ayuso +Date: Wed, 25 May 2022 10:36:38 +0200 +Subject: netfilter: nf_tables: disallow non-stateful expression in sets earlier +Patch-mainline: v5.19-rc1 +Git-commit: 520778042ccca019f3ffa136dd0ca565c486cedd +References: bsc#1200015 + +Since 3e135cd499bf ("netfilter: nft_dynset: dynamic stateful expression +instantiation"), it is possible to attach stateful expressions to set +elements. + +cd5125d8f518 ("netfilter: nf_tables: split set destruction in deactivate +and destroy phase") introduces conditional destruction on the object to +accomodate transaction semantics. + +nft_expr_init() calls expr->ops->init() first, then check for +NFT_STATEFUL_EXPR, this stills allows to initialize a non-stateful +lookup expressions which points to a set, which might lead to UAF since +the set is not properly detached from the set->binding for this case. +Anyway, this combination is non-sense from nf_tables perspective. + +This patch fixes this problem by checking for NFT_STATEFUL_EXPR before +expr->ops->init() is called. + +The reporter provides a KASAN splat and a poc reproducer (similar to +those autogenerated by syzbot to report use-after-free errors). It is +unknown to me if they are using syzbot or if they use similar automated +tool to locate the bug that they are reporting. + +For the record, this is the KASAN splat. + +[ 85.431824] ================================================================== +[ 85.432901] BUG: KASAN: use-after-free in nf_tables_bind_set+0x81b/0xa20 +[ 85.433825] Write of size 8 at addr ffff8880286f0e98 by task poc/776 +[ 85.434756] +[ 85.434999] CPU: 1 PID: 776 Comm: poc Tainted: G W 5.18.0+ #2 +[ 85.436023] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 + +Fixes: 0b2d8a7b638b ("netfilter: nf_tables: add helper functions for expression handling") +Reported-and-tested-by: Aaron Adams +Signed-off-by: Pablo Neira Ayuso +Acked-by: Michal Kubecek + +--- + net/netfilter/nf_tables_api.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -1808,23 +1808,27 @@ struct nft_expr *nft_expr_init(const struct nft_ctx *ctx, + + err = nf_tables_expr_parse(ctx, nla, &info); + if (err < 0) +- goto err1; ++ goto err_expr_parse; ++ ++ err = -EOPNOTSUPP; ++ if (!(info.ops->type->flags & NFT_EXPR_STATEFUL)) ++ goto err_expr_stateful; + + err = -ENOMEM; + expr = kzalloc(info.ops->size, GFP_KERNEL); + if (expr == NULL) +- goto err2; ++ goto err_expr_stateful; + + err = nf_tables_newexpr(ctx, &info, expr); + if (err < 0) +- goto err3; ++ goto err_expr_new; + + return expr; +-err3: ++err_expr_new: + kfree(expr); +-err2: ++err_expr_stateful: + module_put(info.ops->type->owner); +-err1: ++err_expr_parse: + return ERR_PTR(err); + } + diff --git a/patches.suse/nfc-nfcmrvl-main-reorder-destructive-operations-in-n.patch b/patches.suse/nfc-nfcmrvl-main-reorder-destructive-operations-in-n.patch new file mode 100644 index 0000000..fe381f3 --- /dev/null +++ b/patches.suse/nfc-nfcmrvl-main-reorder-destructive-operations-in-n.patch @@ -0,0 +1,113 @@ +From d270453a0d9ec10bb8a802a142fb1b3601a83098 Mon Sep 17 00:00:00 2001 +From: Duoming Zhou +Date: Fri, 29 Apr 2022 20:45:51 +0800 +Subject: [PATCH] nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs +Git-commit: d270453a0d9ec10bb8a802a142fb1b3601a83098 +Patch-mainline: v5.18-rc6 +References: CVE-2022-1734 bsc#1199605 + +There are destructive operations such as nfcmrvl_fw_dnld_abort and +gpio_free in nfcmrvl_nci_unregister_dev. The resources such as firmware, +gpio and so on could be destructed while the upper layer functions such as +nfcmrvl_fw_dnld_start and nfcmrvl_nci_recv_frame is executing, which leads +to double-free, use-after-free and null-ptr-deref bugs. + +There are three situations that could lead to double-free bugs. + +The first situation is shown below: + + (Thread 1) | (Thread 2) +nfcmrvl_fw_dnld_start | + ... | nfcmrvl_nci_unregister_dev + release_firmware() | nfcmrvl_fw_dnld_abort + kfree(fw) //(1) | fw_dnld_over + | release_firmware + ... | kfree(fw) //(2) + | ... + +The second situation is shown below: + + (Thread 1) | (Thread 2) +nfcmrvl_fw_dnld_start | + ... | + mod_timer | + (wait a time) | + fw_dnld_timeout | nfcmrvl_nci_unregister_dev + fw_dnld_over | nfcmrvl_fw_dnld_abort + release_firmware | fw_dnld_over + kfree(fw) //(1) | release_firmware + ... | kfree(fw) //(2) + +The third situation is shown below: + + (Thread 1) | (Thread 2) +nfcmrvl_nci_recv_frame | + if(..->fw_download_in_progress)| + nfcmrvl_fw_dnld_recv_frame | + queue_work | + | +fw_dnld_rx_work | nfcmrvl_nci_unregister_dev + fw_dnld_over | nfcmrvl_fw_dnld_abort + release_firmware | fw_dnld_over + kfree(fw) //(1) | release_firmware + | kfree(fw) //(2) + +The firmware struct is deallocated in position (1) and deallocated +in position (2) again. + +The crash trace triggered by POC is like below: + +Bug: KASAN: double-free or invalid-free in fw_dnld_over +Call Trace: + kfree + fw_dnld_over + nfcmrvl_nci_unregister_dev + nci_uart_tty_close + tty_ldisc_kill + tty_ldisc_hangup + __tty_hangup.part.0 + tty_release + ... + +What's more, there are also use-after-free and null-ptr-deref bugs +in nfcmrvl_fw_dnld_start. If we deallocate firmware struct, gpio or +set null to the members of priv->fw_dnld in nfcmrvl_nci_unregister_dev, +then, we dereference firmware, gpio or the members of priv->fw_dnld in +nfcmrvl_fw_dnld_start, the UAF or NPD bugs will happen. + +This patch reorders destructive operations after nci_unregister_device +in order to synchronize between cleanup routine and firmware download +routine. + +The nci_unregister_device is well synchronized. If the device is +detaching, the firmware download routine will goto error. If firmware +download routine is executing, nci_unregister_device will wait until +firmware download routine is finished. + +Fixes: 3194c6870158 ("NFC: nfcmrvl: add firmware download support") +Signed-off-by: Duoming Zhou +Signed-off-by: David S. Miller +Acked-by: Takashi Iwai + +--- + drivers/nfc/nfcmrvl/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/nfc/nfcmrvl/main.c ++++ b/drivers/nfc/nfcmrvl/main.c +@@ -194,6 +194,7 @@ void nfcmrvl_nci_unregister_dev(struct n + { + struct nci_dev *ndev = priv->ndev; + ++ nci_unregister_device(ndev); + if (priv->ndev->nfc_dev->fw_download_in_progress) + nfcmrvl_fw_dnld_abort(priv); + +@@ -202,7 +203,6 @@ void nfcmrvl_nci_unregister_dev(struct n + if (priv->config.reset_n_io) + gpio_free(priv->config.reset_n_io); + +- nci_unregister_device(ndev); + nci_free_device(ndev); + kfree(priv); + } diff --git a/patches.suse/nfc-replace-improper-check-device_is_registered-in-n.patch b/patches.suse/nfc-replace-improper-check-device_is_registered-in-n.patch new file mode 100644 index 0000000..eea40e3 --- /dev/null +++ b/patches.suse/nfc-replace-improper-check-device_is_registered-in-n.patch @@ -0,0 +1,172 @@ +From da5c0f119203ad9728920456a0f52a6d850c01cd Mon Sep 17 00:00:00 2001 +From: Duoming Zhou +Date: Fri, 29 Apr 2022 20:45:50 +0800 +Subject: [PATCH] nfc: replace improper check device_is_registered() in netlink related functions +Git-commit: da5c0f119203ad9728920456a0f52a6d850c01cd +Patch-mainline: v5.18-rc6 +References: CVE-2022-1974 bsc#1200144 + +The device_is_registered() in nfc core is used to check whether +nfc device is registered in netlink related functions such as +nfc_fw_download(), nfc_dev_up() and so on. Although device_is_registered() +is protected by device_lock, there is still a race condition between +device_del() and device_is_registered(). The root cause is that +kobject_del() in device_del() is not protected by device_lock. + + (cleanup task) | (netlink task) + | +nfc_unregister_device | nfc_fw_download + device_del | device_lock + ... | if (!device_is_registered)//(1) + kobject_del//(2) | ... + ... | device_unlock + +The device_is_registered() returns the value of state_in_sysfs and +the state_in_sysfs is set to zero in kobject_del(). If we pass check in +position (1), then set zero in position (2). As a result, the check +in position (1) is useless. + +This patch uses bool variable instead of device_is_registered() to judge +whether the nfc device is registered, which is well synchronized. + +Fixes: 3e256b8f8dfa ("NFC: add nfc subsystem core") +Signed-off-by: Duoming Zhou +Signed-off-by: David S. Miller +Acked-by: Takashi Iwai + +--- + net/nfc/core.c | 29 ++++++++++++++--------------- + 1 file changed, 14 insertions(+), 15 deletions(-) + +--- a/net/nfc/core.c ++++ b/net/nfc/core.c +@@ -38,7 +38,7 @@ int nfc_fw_download(struct nfc_dev *dev, + + device_lock(&dev->dev); + +- if (!device_is_registered(&dev->dev)) { ++ if (dev->shutting_down) { + rc = -ENODEV; + goto error; + } +@@ -94,7 +94,7 @@ int nfc_dev_up(struct nfc_dev *dev) + + device_lock(&dev->dev); + +- if (!device_is_registered(&dev->dev)) { ++ if (dev->shutting_down) { + rc = -ENODEV; + goto error; + } +@@ -142,7 +142,7 @@ int nfc_dev_down(struct nfc_dev *dev) + + device_lock(&dev->dev); + +- if (!device_is_registered(&dev->dev)) { ++ if (dev->shutting_down) { + rc = -ENODEV; + goto error; + } +@@ -206,7 +206,7 @@ int nfc_start_poll(struct nfc_dev *dev, + + device_lock(&dev->dev); + +- if (!device_is_registered(&dev->dev)) { ++ if (dev->shutting_down) { + rc = -ENODEV; + goto error; + } +@@ -245,7 +245,7 @@ int nfc_stop_poll(struct nfc_dev *dev) + + device_lock(&dev->dev); + +- if (!device_is_registered(&dev->dev)) { ++ if (dev->shutting_down) { + rc = -ENODEV; + goto error; + } +@@ -290,7 +290,7 @@ int nfc_dep_link_up(struct nfc_dev *dev, + + device_lock(&dev->dev); + +- if (!device_is_registered(&dev->dev)) { ++ if (dev->shutting_down) { + rc = -ENODEV; + goto error; + } +@@ -334,7 +334,7 @@ int nfc_dep_link_down(struct nfc_dev *de + + device_lock(&dev->dev); + +- if (!device_is_registered(&dev->dev)) { ++ if (dev->shutting_down) { + rc = -ENODEV; + goto error; + } +@@ -400,7 +400,7 @@ int nfc_activate_target(struct nfc_dev * + + device_lock(&dev->dev); + +- if (!device_is_registered(&dev->dev)) { ++ if (dev->shutting_down) { + rc = -ENODEV; + goto error; + } +@@ -446,7 +446,7 @@ int nfc_deactivate_target(struct nfc_dev + + device_lock(&dev->dev); + +- if (!device_is_registered(&dev->dev)) { ++ if (dev->shutting_down) { + rc = -ENODEV; + goto error; + } +@@ -493,7 +493,7 @@ int nfc_data_exchange(struct nfc_dev *de + + device_lock(&dev->dev); + +- if (!device_is_registered(&dev->dev)) { ++ if (dev->shutting_down) { + rc = -ENODEV; + kfree_skb(skb); + goto error; +@@ -550,7 +550,7 @@ int nfc_enable_se(struct nfc_dev *dev, u + + device_lock(&dev->dev); + +- if (!device_is_registered(&dev->dev)) { ++ if (dev->shutting_down) { + rc = -ENODEV; + goto error; + } +@@ -599,7 +599,7 @@ int nfc_disable_se(struct nfc_dev *dev, + + device_lock(&dev->dev); + +- if (!device_is_registered(&dev->dev)) { ++ if (dev->shutting_down) { + rc = -ENODEV; + goto error; + } +@@ -1127,6 +1127,7 @@ int nfc_register_device(struct nfc_dev * + dev->rfkill = NULL; + } + } ++ dev->shutting_down = false; + device_unlock(&dev->dev); + + rc = nfc_genl_device_added(dev); +@@ -1159,12 +1160,10 @@ void nfc_unregister_device(struct nfc_de + rfkill_unregister(dev->rfkill); + rfkill_destroy(dev->rfkill); + } ++ dev->shutting_down = true; + device_unlock(&dev->dev); + + if (dev->ops->check_presence) { +- device_lock(&dev->dev); +- dev->shutting_down = true; +- device_unlock(&dev->dev); + del_timer_sync(&dev->check_pres_timer); + cancel_work_sync(&dev->check_pres_work); + } diff --git a/patches.suse/nfs-access-cache-no-negative.patch b/patches.suse/nfs-access-cache-no-negative.patch new file mode 100644 index 0000000..3ae8989 --- /dev/null +++ b/patches.suse/nfs-access-cache-no-negative.patch @@ -0,0 +1,87 @@ +From: NeilBrown +Subject: NFS: limit use of ACCESS cache for negative responses +Patch-mainline: Submitted - linux-nfs 28 apr 2022 +References: bsc#1196570 + +[[ + 165110909570.7595.8578730126480600782.stgit@noble.brown + Upstream maintainer doesn't like this +]] + +NFS currently caches the results of ACCESS lookups indefinitely while the +inode doesn't change (i.e. while ctime, changeid, owner/group/mode etc +don't change). This is a problem is the result from the server might +change. + +When the result from the server depends purely on the credentials +provided by the client and the information in the inode, it is not +expected that the result from the server will change, and the current +behaviour is safe. + +However in some configurations the server can include another lookup +step. This happens with the Linux NFS server when the "--manage-gids" +option is given to rpc.mountd. NetApp servers have similar functionality +with "AUTH_SYS Extended Groups" functionality in ONTAP9. With these, +the user reported by the client is mapped on the server to a list of +group ids. If this mapping changes, the result of ACCESS can change. + +This is particularly a problem when a new group is added to a user. If +they had already tried and failed to access the file (or more commonly a +directory) then adding them to the group will not successfully give them +access as the failure is cached. Even if the user logs out and back in +again to get the new credential on the client, they might try to access +the file before the server is aware of the change. By default the Linux +server caches group information for 30 minutes. This can be reduce but +there will always be a window after the group has been added when the +server can still report ACCESS based on old group information. + +The inverse is less of a problem. Removing someone from a group has +never been a guaranteed way to remove any access - at the very least a +user normally needs to log off before they lose access to any groups that +they were a member of. + +The value of the ACCESS cache is realised primarily for successful +tests. These happen often, for example the test for X permissions +during filename lookups. Having a quick (even lock-free) result helps +this common operation. When the ACCESS cache denies the access there is +less cost in taking longer to confirm the access, and this is the case +were a stale cache is more problematic. + +So, this patch changes the way that the access cache is used. +- If the requested access is found in the cache, and is granted, then the + call uses the cached information no matter how old it is. +- If the requested access is found in the cache and is denied, then the + cached result is only used if is it newer than the MINATTRTIMEO + for the file. +- If the requested access is found in the cache, is denied, and is more + than MINATTRTIMEO old, then a new ACCESS request is made to the server +- If the requested access is NOT found in the cache, obviously a new + ACCESS request is made to the server, and this will be cached. + +Signed-off-by: NeilBrown +Acked-by: NeilBrown + +--- + fs/nfs/dir.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -2470,8 +2470,15 @@ static int nfs_do_access(struct inode *i + status = nfs_access_get_cached_rcu(inode, cred, &cache); + if (status != 0) + status = nfs_access_get_cached(inode, cred, &cache, may_block); +- if (status == 0) +- goto out_cached; ++ if (status == 0) { ++ if ((mask & ~cache.mask & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0) ++ /* if access is granted, trust the cache */ ++ goto out_cached; ++ if (time_in_range_open(jiffies, cache.jiffies, ++ cache.jiffies + NFS_MINATTRTIMEO(inode))) ++ /* If cache entry very new, trust even for negative */ ++ goto out_cached; ++ } + + status = -ECHILD; + if (!may_block) diff --git a/patches.suse/ovl-fix-missing-negative-dentry-check-in-ovl_rename.patch b/patches.suse/ovl-fix-missing-negative-dentry-check-in-ovl_rename.patch new file mode 100644 index 0000000..96b9cd1 --- /dev/null +++ b/patches.suse/ovl-fix-missing-negative-dentry-check-in-ovl_rename.patch @@ -0,0 +1,66 @@ +From 7c34058c01ed674e6d80f654153d80c01eaa6be9 Mon Sep 17 00:00:00 2001 +From: Zheng Liang +Date: Fri, 24 Sep 2021 09:16:27 +0800 +Subject: [PATCH] ovl: fix missing negative dentry check in ovl_rename() +Git-commit: a295aef603e109a47af355477326bd41151765b6 +Patch-mainline: v5.15-rc5 +References: CVE-2021-20321 bsc#1191647 + +The following reproducer + + mkdir lower upper work merge + touch lower/old + touch lower/new + mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merge + rm merge/new + mv merge/old merge/new & unlink upper/new + +may result in this race: + +PROCESS A: + rename("merge/old", "merge/new"); + overwrite=true,ovl_lower_positive(old)=true, + ovl_dentry_is_whiteout(new)=true -> flags |= RENAME_EXCHANGE + +PROCESS B: + unlink("upper/new"); + +PROCESS A: + lookup newdentry in new_upperdir + call vfs_rename() with negative newdentry and RENAME_EXCHANGE + +Fix by adding the missing check for negative newdentry. + +Signed-off-by: Zheng Liang +Fixes: e9be9d5e76e3 ("overlay filesystem") +Cc: # v3.18 +Signed-off-by: Miklos Szeredi +Acked-by: David Disseldorp +--- + fs/overlayfs/dir.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c +index 3bd1462cea4e..7886426a0389 100644 +--- a/fs/overlayfs/dir.c ++++ b/fs/overlayfs/dir.c +@@ -1025,9 +1025,13 @@ static int ovl_rename(struct inode *olddir, struct dentry *old, + goto out_dput; + } + } else { +- if (!d_is_negative(newdentry) && +- (!new_opaque || !ovl_is_whiteout(newdentry))) +- goto out_dput; ++ if (!d_is_negative(newdentry)) { ++ if (!new_opaque || !ovl_is_whiteout(newdentry)) ++ goto out_dput; ++ } else { ++ if (flags & RENAME_EXCHANGE) ++ goto out_dput; ++ } + } + + if (olddentry == trap) +-- +2.34.1 + diff --git a/patches.suse/perf-fix-sys_perf_event_open-race-against-self.patch b/patches.suse/perf-fix-sys_perf_event_open-race-against-self.patch new file mode 100644 index 0000000..542741c --- /dev/null +++ b/patches.suse/perf-fix-sys_perf_event_open-race-against-self.patch @@ -0,0 +1,70 @@ +From: Peter Zijlstra +Subject: perf: Fix sys_perf_event_open() race against self +Date: Fri May 13 10:06:01 CEST 2022 +References: CVE-2022-1729, bsc#1199507 +Git-commit: 3ac6487e584a1eb54071dbe1212e05b884136704 +Patch-mainline: v5.18-rc7 +Signed-off-by: Tony Jones + +Norbert reported that it's possible to race sys_perf_event_open() such +that the looser ends up in another context from the group leader, +triggering many WARNs. + +The move_group case checks for races against itself, but the +!move_group case doesn't, seemingly relying on the previous +group_leader->ctx == ctx check. However, that check is racy due to not +holding any locks at that time. + +Therefore, re-check the result after acquiring locks and bailing +if they no longer match. + +Additionally, clarify the not_move_group case from the +move_group-vs-move_group race. + +Fixes: f63a8daa5812 ("perf: Fix event->ctx locking") +Reported-by: Norbert Slusarek +Signed-off-by: Peter Zijlstra (Intel) +--- + +--- + kernel/events/core.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -10014,6 +10014,9 @@ SYSCALL_DEFINE5(perf_event_open, + * Do not allow to attach to a group in a different task + * or CPU context. If we're moving SW events, we'll fix + * this up later, so allow that. ++ * ++ * Racy, not holding group_leader->ctx->mutex, see comment with ++ * perf_event_ctx_lock(). + */ + if (!move_group && group_leader->ctx != ctx) + goto err_context; +@@ -10625,6 +10625,7 @@ SYSCALL_DEFINE5(perf_event_open, + } else { + perf_event_ctx_unlock(group_leader, gctx); + move_group = 0; ++ goto not_move_group; + } + } + +@@ -10641,7 +10642,17 @@ SYSCALL_DEFINE5(perf_event_open, + } + } else { + mutex_lock(&ctx->mutex); ++ ++ /* ++ * Now that we hold ctx->lock, (re)validate group_leader->ctx == ctx, ++ * see the group_leader && !move_group test earlier. ++ */ ++ if (group_leader && group_leader->ctx != ctx) { ++ err = -EINVAL; ++ goto err_locked; ++ } + } ++not_move_group: + + if (ctx->task == TASK_TOMBSTONE) { + err = -ESRCH; diff --git a/patches.suse/powerpc-64s-Add-CPU_FTRS_POWER9_DD2_2-to-CPU_FTRS_AL.patch b/patches.suse/powerpc-64s-Add-CPU_FTRS_POWER9_DD2_2-to-CPU_FTRS_AL.patch new file mode 100644 index 0000000..a2f76a2 --- /dev/null +++ b/patches.suse/powerpc-64s-Add-CPU_FTRS_POWER9_DD2_2-to-CPU_FTRS_AL.patch @@ -0,0 +1,52 @@ +From 3e36960a27fec30f16bace1521dc852105522f5e Mon Sep 17 00:00:00 2001 +From: Michael Ellerman +Date: Thu, 19 May 2022 14:30:56 +1000 +Subject: [PATCH] powerpc/64s: Add CPU_FTRS_POWER9_DD2_2 to CPU_FTRS_ALWAYS + mask + +References: bsc#1061840 git-fixes +Patch-mainline: v5.19-rc1 +Git-commit: 3e36960a27fec30f16bace1521dc852105522f5e + +CPU_FTRS_POWER9_DD2_2 is missing from CPU_FTRS_ALWAYS. + +That doesn't cause any bug, because CPU_FTRS_POWER9_DD2_2 adds new bits +that don't appear in other values, so when anded with the other masks +the result is the same. + +But for consistency we should have all values in the CPU_FTRS_ALWAYS +mask, so that the logic is robust against the values being changed in +future. + +Fixes: b5af4f279323 ("powerpc: Add CPU feature bits for TM bug workarounds on POWER9 v2.2") +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220519122205.746276-1-mpe@ellerman.id.au +Acked-by: Michal Suchanek +--- + arch/powerpc/include/asm/cputable.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h +index e85c849214a2..4457052d7450 100644 +--- a/arch/powerpc/include/asm/cputable.h ++++ b/arch/powerpc/include/asm/cputable.h +@@ -541,14 +541,14 @@ enum { + #define CPU_FTRS_ALWAYS \ + (CPU_FTRS_POSSIBLE & ~CPU_FTR_HVMODE & CPU_FTRS_POWER7 & \ + CPU_FTRS_POWER8E & CPU_FTRS_POWER8 & CPU_FTRS_POWER9 & \ +- CPU_FTRS_POWER9_DD2_1 & CPU_FTRS_DT_CPU_BASE) ++ CPU_FTRS_POWER9_DD2_1 & CPU_FTRS_POWER9_DD2_2 & CPU_FTRS_DT_CPU_BASE) + #else + #define CPU_FTRS_ALWAYS \ + (CPU_FTRS_PPC970 & CPU_FTRS_POWER5 & \ + CPU_FTRS_POWER6 & CPU_FTRS_POWER7 & CPU_FTRS_CELL & \ + CPU_FTRS_PA6T & CPU_FTRS_POWER8 & CPU_FTRS_POWER8E & \ + ~CPU_FTR_HVMODE & CPU_FTRS_POSSIBLE & CPU_FTRS_POWER9 & \ +- CPU_FTRS_POWER9_DD2_1 & CPU_FTRS_DT_CPU_BASE) ++ CPU_FTRS_POWER9_DD2_1 & CPU_FTRS_POWER9_DD2_2 & CPU_FTRS_DT_CPU_BASE) + #endif /* CONFIG_CPU_LITTLE_ENDIAN */ + #endif + #else +-- +2.35.3 + diff --git a/patches.suse/powerpc-64s-Remove-POWER9-DD1-support.patch b/patches.suse/powerpc-64s-Remove-POWER9-DD1-support.patch index f6ac54c..f9d219a 100644 --- a/patches.suse/powerpc-64s-Remove-POWER9-DD1-support.patch +++ b/patches.suse/powerpc-64s-Remove-POWER9-DD1-support.patch @@ -51,9 +51,11 @@ Acked-by: Michal Suchanek drivers/misc/cxl/pci.c | 41 +++++-------- 32 files changed, 66 insertions(+), 533 deletions(-) +diff --git a/arch/powerpc/include/asm/book3s/64/hugetlb.h b/arch/powerpc/include/asm/book3s/64/hugetlb.h +index c459f937d484..50888388a359 100644 --- a/arch/powerpc/include/asm/book3s/64/hugetlb.h +++ b/arch/powerpc/include/asm/book3s/64/hugetlb.h -@@ -31,26 +31,6 @@ static inline int hstate_get_psize(struc +@@ -32,26 +32,6 @@ static inline int hstate_get_psize(struct hstate *hstate) } } @@ -80,9 +82,11 @@ Acked-by: Michal Suchanek #ifdef CONFIG_ARCH_HAS_GIGANTIC_PAGE static inline bool gigantic_page_supported(void) { +diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h +index 63cee159022b..d334e6b9a46d 100644 --- a/arch/powerpc/include/asm/book3s/64/pgtable.h +++ b/arch/powerpc/include/asm/book3s/64/pgtable.h -@@ -454,9 +454,8 @@ static inline pte_t ptep_get_and_clear_f +@@ -474,9 +474,8 @@ static inline pte_t ptep_get_and_clear_full(struct mm_struct *mm, { if (full && radix_enabled()) { /* @@ -94,9 +98,10 @@ Acked-by: Michal Suchanek */ return radix__ptep_get_and_clear_full(mm, addr, ptep, full); } +diff --git a/arch/powerpc/include/asm/book3s/64/radix.h b/arch/powerpc/include/asm/book3s/64/radix.h --- a/arch/powerpc/include/asm/book3s/64/radix.h +++ b/arch/powerpc/include/asm/book3s/64/radix.h -@@ -11,12 +11,6 @@ +@@ -12,12 +12,6 @@ #include #endif @@ -109,7 +114,7 @@ Acked-by: Michal Suchanek #ifndef __ASSEMBLY__ #include #include -@@ -151,20 +145,7 @@ static inline unsigned long radix__pte_u +@@ -154,20 +148,7 @@ static inline unsigned long radix__pte_update(struct mm_struct *mm, { unsigned long old_pte; @@ -131,7 +136,7 @@ Acked-by: Michal Suchanek if (!huge) assert_pte_locked(mm, addr); -@@ -239,8 +220,6 @@ static inline int radix__pmd_trans_huge( +@@ -253,8 +234,6 @@ static inline int radix__pmd_trans_huge(pmd_t pmd) static inline pmd_t radix__pmd_mkhuge(pmd_t pmd) { @@ -140,7 +145,7 @@ Acked-by: Michal Suchanek return __pmd(pmd_val(pmd) | _PAGE_PTE); } static inline void radix__pmdp_huge_split_prepare(struct vm_area_struct *vma, -@@ -277,18 +256,14 @@ static inline unsigned long radix__get_t +@@ -285,18 +264,14 @@ static inline unsigned long radix__get_tree_size(void) unsigned long rts_field; /* * We support 52 bits, hence: @@ -163,9 +168,11 @@ Acked-by: Michal Suchanek return rts_field; } +diff --git a/arch/powerpc/include/asm/book3s/64/tlbflush-radix.h b/arch/powerpc/include/asm/book3s/64/tlbflush-radix.h +index ef5c3f2994c9..1154a6dc6d26 100644 --- a/arch/powerpc/include/asm/book3s/64/tlbflush-radix.h +++ b/arch/powerpc/include/asm/book3s/64/tlbflush-radix.h -@@ -43,8 +43,6 @@ extern void radix__flush_tlb_page_psize( +@@ -48,8 +48,6 @@ extern void radix__flush_tlb_page_psize(struct mm_struct *mm, unsigned long vmad extern void radix__flush_tlb_pwc(struct mmu_gather *tlb, unsigned long addr); extern void radix__flush_tlb_collapsed_pmd(struct mm_struct *mm, unsigned long addr); extern void radix__flush_tlb_all(void); @@ -174,9 +181,10 @@ Acked-by: Michal Suchanek extern void radix__flush_tlb_lpid_page(unsigned int lpid, unsigned long addr, +diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h --- a/arch/powerpc/include/asm/cputable.h +++ b/arch/powerpc/include/asm/cputable.h -@@ -209,7 +209,6 @@ static inline void cpu_feature_keys_init +@@ -210,7 +210,6 @@ static inline void cpu_feature_keys_init(void) { } #define CPU_FTR_DAWR LONG_ASM_CONST(0x0000008000000000) #define CPU_FTR_DABRX LONG_ASM_CONST(0x0000010000000000) #define CPU_FTR_PMAO_BUG LONG_ASM_CONST(0x0000020000000000) @@ -184,7 +192,7 @@ Acked-by: Michal Suchanek #define CPU_FTR_POWER9_DD2_1 LONG_ASM_CONST(0x0000080000000000) #define CPU_FTR_P9_TM_HV_ASSIST LONG_ASM_CONST(0x0000100000000000) #define CPU_FTR_P9_TM_XER_SO_BUG LONG_ASM_CONST(0x0000200000000000) -@@ -462,8 +461,6 @@ static inline void cpu_feature_keys_init +@@ -464,8 +463,6 @@ static inline void cpu_feature_keys_init(void) { } CPU_FTR_DBELL | CPU_FTR_HAS_PPR | CPU_FTR_ARCH_207S | \ CPU_FTR_TM_COMP | CPU_FTR_ARCH_300 | CPU_FTR_PKEY | \ CPU_FTR_P9_TLBIE_BUG) @@ -193,46 +201,50 @@ Acked-by: Michal Suchanek #define CPU_FTRS_POWER9_DD2_0 CPU_FTRS_POWER9 #define CPU_FTRS_POWER9_DD2_1 (CPU_FTRS_POWER9 | CPU_FTR_POWER9_DD2_1) #define CPU_FTRS_POWER9_DD2_2 (CPU_FTRS_POWER9 | CPU_FTR_POWER9_DD2_1 | \ -@@ -487,16 +484,14 @@ static inline void cpu_feature_keys_init +@@ -489,16 +486,14 @@ static inline void cpu_feature_keys_init(void) { } #define CPU_FTRS_POSSIBLE \ (CPU_FTRS_POWER7 | CPU_FTRS_POWER8E | CPU_FTRS_POWER8 | \ - CPU_FTRS_POWER8_DD1 | CPU_FTR_ALTIVEC_COMP | CPU_FTR_VSX_COMP | \ -- CPU_FTRS_POWER9 | CPU_FTRS_POWER9_DD1 | CPU_FTRS_POWER9_DD2_1 | \ + CPU_FTR_ALTIVEC_COMP | CPU_FTR_VSX_COMP | CPU_FTRS_POWER9 | \ +- CPU_FTRS_POWER9_DD1 | CPU_FTRS_POWER9_DD2_1 | \ - CPU_FTRS_POWER9_DD2_2) -+ CPU_FTRS_POWER9 | CPU_FTRS_POWER9_DD2_1 | CPU_FTRS_POWER9_DD2_2) ++ CPU_FTRS_POWER9_DD2_1 | CPU_FTRS_POWER9_DD2_2) #else #define CPU_FTRS_POSSIBLE \ (CPU_FTRS_PPC970 | CPU_FTRS_POWER5 | \ CPU_FTRS_POWER6 | CPU_FTRS_POWER7 | CPU_FTRS_POWER8E | \ - CPU_FTRS_POWER8 | CPU_FTRS_POWER8_DD1 | CPU_FTRS_CELL | \ - CPU_FTRS_PA6T | CPU_FTR_VSX_COMP | CPU_FTR_ALTIVEC_COMP | \ -- CPU_FTRS_POWER9 | CPU_FTRS_POWER9_DD1 | CPU_FTRS_POWER9_DD2_1 | \ + CPU_FTRS_POWER8 | CPU_FTRS_CELL | CPU_FTRS_PA6T | \ + CPU_FTR_VSX_COMP | CPU_FTR_ALTIVEC_COMP | CPU_FTRS_POWER9 | \ +- CPU_FTRS_POWER9_DD1 | CPU_FTRS_POWER9_DD2_1 | \ - CPU_FTRS_POWER9_DD2_2) -+ CPU_FTRS_POWER9 | CPU_FTRS_POWER9_DD2_1 | CPU_FTRS_POWER9_DD2_2) ++ CPU_FTRS_POWER9_DD2_1 | CPU_FTRS_POWER9_DD2_2) #endif /* CONFIG_CPU_LITTLE_ENDIAN */ #endif #else -@@ -565,7 +560,7 @@ enum { +@@ -567,8 +562,7 @@ enum { #define CPU_FTRS_ALWAYS \ (CPU_FTRS_POSSIBLE & ~CPU_FTR_HVMODE & CPU_FTRS_POWER7 & \ - CPU_FTRS_POWER8E & CPU_FTRS_POWER8 & CPU_FTRS_POWER8_DD1 & \ -- CPU_FTRS_POWER9 & CPU_FTRS_POWER9_DD1 & CPU_FTRS_POWER9_DD2_1 & \ -+ CPU_FTRS_POWER9 & CPU_FTRS_POWER9_DD2_1 & \ - CPU_FTRS_DT_CPU_BASE) + CPU_FTRS_POWER8E & CPU_FTRS_POWER8 & CPU_FTRS_POWER9 & \ +- CPU_FTRS_POWER9_DD1 & CPU_FTRS_POWER9_DD2_1 & \ ++ CPU_FTRS_POWER9_DD2_1 & CPU_FTRS_DT_CPU_BASE) +- CPU_FTRS_DT_CPU_BASE) #else #define CPU_FTRS_ALWAYS \ -@@ -573,7 +568,7 @@ enum { + (CPU_FTRS_PPC970 & CPU_FTRS_POWER5 & \ +@@ -575,8 +570,7 @@ enum { CPU_FTRS_POWER6 & CPU_FTRS_POWER7 & CPU_FTRS_CELL & \ CPU_FTRS_PA6T & CPU_FTRS_POWER8 & CPU_FTRS_POWER8E & \ - CPU_FTRS_POWER8_DD1 & ~CPU_FTR_HVMODE & CPU_FTRS_POSSIBLE & \ -- CPU_FTRS_POWER9 & CPU_FTRS_POWER9_DD1 & CPU_FTRS_POWER9_DD2_1 & \ -+ CPU_FTRS_POWER9 & CPU_FTRS_POWER9_DD2_1 & \ - CPU_FTRS_DT_CPU_BASE) + ~CPU_FTR_HVMODE & CPU_FTRS_POSSIBLE & CPU_FTRS_POWER9 & \ +- CPU_FTRS_POWER9_DD1 & CPU_FTRS_POWER9_DD2_1 & \ ++ CPU_FTRS_POWER9_DD2_1 & CPU_FTRS_DT_CPU_BASE) +- CPU_FTRS_DT_CPU_BASE) #endif /* CONFIG_CPU_LITTLE_ENDIAN */ #endif + #else +diff --git a/arch/powerpc/include/asm/paca.h b/arch/powerpc/include/asm/paca.h +index 6d34bd71139d..4e9cede5a7e7 100644 --- a/arch/powerpc/include/asm/paca.h +++ b/arch/powerpc/include/asm/paca.h -@@ -180,11 +180,6 @@ struct paca_struct { +@@ -187,11 +187,6 @@ struct paca_struct { u8 subcore_sibling_mask; /* Flag to request this thread not to stop */ atomic_t dont_stop; @@ -244,9 +256,11 @@ Acked-by: Michal Suchanek /* The PSSCR value that the kernel requested before going to stop */ u64 requested_psscr; +diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c +index 0a0544335950..89cf15566c4e 100644 --- a/arch/powerpc/kernel/asm-offsets.c +++ b/arch/powerpc/kernel/asm-offsets.c -@@ -759,7 +759,6 @@ int main(void) +@@ -766,7 +766,6 @@ int main(void) OFFSET(PACA_THREAD_IDLE_STATE, paca_struct, thread_idle_state); OFFSET(PACA_THREAD_MASK, paca_struct, thread_mask); OFFSET(PACA_SUBCORE_SIBLING_MASK, paca_struct, subcore_sibling_mask); @@ -254,9 +268,11 @@ Acked-by: Michal Suchanek OFFSET(PACA_REQ_PSSCR, paca_struct, requested_psscr); OFFSET(PACA_DONT_STOP, paca_struct, dont_stop); #define STOP_SPR(x, f) OFFSET(x, paca_struct, stop_sprs.f) +diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c +index c8fc9691f8c7..bc75a2908a7e 100644 --- a/arch/powerpc/kernel/cputable.c +++ b/arch/powerpc/kernel/cputable.c -@@ -485,25 +485,6 @@ static struct cpu_spec __initdata cpu_sp +@@ -485,25 +485,6 @@ static struct cpu_spec __initdata cpu_specs[] = { .machine_check_early = __machine_check_early_realmode_p8, .platform = "power8", }, @@ -282,9 +298,11 @@ Acked-by: Michal Suchanek { /* Power9 DD2.0 */ .pvr_mask = 0xffffefff, .pvr_value = 0x004e0200, +diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c +index 4be1c0de9406..98c373a4c1cf 100644 --- a/arch/powerpc/kernel/dt_cpu_ftrs.c +++ b/arch/powerpc/kernel/dt_cpu_ftrs.c -@@ -700,9 +700,7 @@ static __init void cpufeatures_cpu_quirk +@@ -701,9 +701,7 @@ static __init void cpufeatures_cpu_quirks(void) /* * Not all quirks can be derived from the cpufeatures device tree. */ @@ -295,9 +313,11 @@ Acked-by: Michal Suchanek ; /* DD2.0 has no feature flag */ else if ((version & 0xffffefff) == 0x004e0201) cur_cpu_spec->cpu_features |= CPU_FTR_POWER9_DD2_1; +diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S +index 285c6465324a..76a14702cb9c 100644 --- a/arch/powerpc/kernel/exceptions-64s.S +++ b/arch/powerpc/kernel/exceptions-64s.S -@@ -220,9 +220,7 @@ BEGIN_FTR_SECTION +@@ -276,9 +276,7 @@ BEGIN_FTR_SECTION * * This interrupt can wake directly from idle. If that is the case, * the machine check is handled then the idle wakeup code is called @@ -308,12 +328,15 @@ Acked-by: Michal Suchanek */ mr r11,r1 /* Save r1 */ lhz r10,PACA_IN_MCE(r13) +diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S +index e734f6e45abc..d85d5515a091 100644 --- a/arch/powerpc/kernel/idle_book3s.S +++ b/arch/powerpc/kernel/idle_book3s.S -@@ -458,43 +458,6 @@ END_FTR_SECTION_IFSET(CPU_FTR_P9_TM_XER_ +@@ -466,43 +466,6 @@ END_FTR_SECTION_IFSET(CPU_FTR_P9_TM_XER_SO_BUG) + blr /* return 0 for wakeup cause / SRR1 value */ #endif - /* +-/* - * On waking up from stop 0,1,2 with ESL=1 on POWER9 DD1, - * HSPRG0 will be set to the HSPRG0 value of one of the - * threads in this core. Thus the value we have in r13 @@ -350,11 +373,10 @@ Acked-by: Michal Suchanek - stb r3,PACA_NAPSTATELOST(r13) - blr - --/* + /* * Called from machine check handler for powersave wakeups. * Low level machine check processing has already been done. Now just - * go through the wake up path to get everything in order. -@@ -528,9 +491,6 @@ pnv_powersave_wakeup: +@@ -537,9 +500,6 @@ pnv_powersave_wakeup: ld r2, PACATOC(r13) BEGIN_FTR_SECTION @@ -364,7 +386,7 @@ Acked-by: Michal Suchanek bl pnv_restore_hyp_resource_arch300 FTR_SECTION_ELSE bl pnv_restore_hyp_resource_arch207 -@@ -593,22 +553,12 @@ END_FTR_SECTION_IFCLR(CPU_FTR_POWER9_DD2 +@@ -602,22 +562,12 @@ END_FTR_SECTION_IFCLR(CPU_FTR_POWER9_DD2_1) LOAD_REG_ADDRBASE(r5,pnv_first_deep_stop_state) ld r4,ADDROFF(pnv_first_deep_stop_state)(r5) @@ -387,6 +409,7 @@ Acked-by: Michal Suchanek li r0, 0 /* clear requested_psscr to say we're awake */ std r0, PACA_REQ_PSSCR(r13) cmpd cr4,r5,r4 +diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c --- a/arch/powerpc/kernel/process.c +++ b/arch/powerpc/kernel/process.c @@ -1275,17 +1275,6 @@ struct task_struct *__switch_to(struct t @@ -407,9 +430,11 @@ Acked-by: Michal Suchanek } #endif /* CONFIG_PPC_BOOK3S_64 */ +diff --git a/arch/powerpc/kvm/book3s_64_mmu_radix.c b/arch/powerpc/kvm/book3s_64_mmu_radix.c +index 176f911ee983..0af1c0aea1fe 100644 --- a/arch/powerpc/kvm/book3s_64_mmu_radix.c +++ b/arch/powerpc/kvm/book3s_64_mmu_radix.c -@@ -66,10 +66,7 @@ int kvmppc_mmu_radix_xlate(struct kvm_vc +@@ -66,10 +66,7 @@ int kvmppc_mmu_radix_xlate(struct kvm_vcpu *vcpu, gva_t eaddr, bits = root & RPDS_MASK; root = root & RPDB_MASK; @@ -420,7 +445,7 @@ Acked-by: Michal Suchanek /* current implementations only support 52-bit space */ if (offset != 52) -@@ -180,17 +177,7 @@ static unsigned long kvmppc_radix_update +@@ -160,17 +157,7 @@ static unsigned long kvmppc_radix_update_pte(struct kvm *kvm, pte_t *ptep, unsigned long clr, unsigned long set, unsigned long addr, unsigned int shift) { @@ -439,9 +464,11 @@ Acked-by: Michal Suchanek } void kvmppc_radix_set_pte_at(struct kvm *kvm, unsigned long addr, +diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c +index de686b340f4a..b568582120a3 100644 --- a/arch/powerpc/kvm/book3s_hv.c +++ b/arch/powerpc/kvm/book3s_hv.c -@@ -1694,14 +1694,6 @@ static int kvmppc_set_one_reg_hv(struct +@@ -1693,14 +1693,6 @@ static int kvmppc_set_one_reg_hv(struct kvm_vcpu *vcpu, u64 id, r = set_vpa(vcpu, &vcpu->arch.dtl, addr, len); break; case KVM_REG_PPC_TB_OFFSET: @@ -456,7 +483,7 @@ Acked-by: Michal Suchanek /* round up to multiple of 2^24 */ vcpu->arch.vcore->tb_offset = ALIGN(set_reg_val(id, *val), 1UL << 24); -@@ -2027,8 +2019,6 @@ static struct kvm_vcpu *kvmppc_core_vcpu +@@ -2026,8 +2018,6 @@ static struct kvm_vcpu *kvmppc_core_vcpu_create_hv(struct kvm *kvm, /* * Set the default HFSCR for the guest from the host value. * This value is only used on POWER9. @@ -465,19 +492,21 @@ Acked-by: Michal Suchanek * On POWER9, we want to virtualize the doorbell facility, so we * turn off the HFSCR bit, which causes those instructions to trap. */ +diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S +index 153988d878e8..6e4554b273f1 100644 --- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S +++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S -@@ -919,9 +919,6 @@ END_FTR_SECTION_IFSET(CPU_FTR_DAWR) +@@ -916,9 +916,6 @@ END_FTR_SECTION_IFSET(CPU_FTR_DAWR) + mtspr SPRN_BESCR, r6 mtspr SPRN_PID, r7 mtspr SPRN_WORT, r8 - BEGIN_FTR_SECTION +-BEGIN_FTR_SECTION - PPC_INVALIDATE_ERAT -END_FTR_SECTION_IFSET(CPU_FTR_POWER9_DD1) --BEGIN_FTR_SECTION + BEGIN_FTR_SECTION /* POWER8-only registers */ ld r5, VCPU_TCSCR(r4) - ld r6, VCPU_ACOP(r4) -@@ -1914,7 +1911,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300) +@@ -1912,7 +1909,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300) ld r5, VCPU_KVM(r9) lbz r0, KVM_RADIX(r5) cmpwi cr2, r0, 0 @@ -486,7 +515,7 @@ Acked-by: Michal Suchanek /* * Radix: do eieio; tlbsync; ptesync sequence in case we -@@ -1954,11 +1951,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300) +@@ -1952,11 +1949,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300) bdnz 1b ptesync @@ -499,7 +528,7 @@ Acked-by: Michal Suchanek #endif /* CONFIG_PPC_RADIX_MMU */ /* -@@ -3369,11 +3362,6 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_300) +@@ -3367,11 +3360,6 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_300) mtspr SPRN_CIABR, r0 mtspr SPRN_DAWRX, r0 @@ -511,9 +540,11 @@ Acked-by: Michal Suchanek BEGIN_MMU_FTR_SECTION b 4f END_MMU_FTR_SECTION_IFSET(MMU_FTR_TYPE_RADIX) +diff --git a/arch/powerpc/kvm/book3s_xive_template.c b/arch/powerpc/kvm/book3s_xive_template.c +index 6e41ba7ec8f4..4171ede8722b 100644 --- a/arch/powerpc/kvm/book3s_xive_template.c +++ b/arch/powerpc/kvm/book3s_xive_template.c -@@ -25,18 +25,6 @@ static void GLUE(X_PFX,ack_pending)(stru +@@ -25,18 +25,6 @@ static void GLUE(X_PFX,ack_pending)(struct kvmppc_xive_vcpu *xc) */ eieio(); @@ -532,7 +563,7 @@ Acked-by: Michal Suchanek /* Perform the acknowledge OS to register cycle. */ ack = be16_to_cpu(__x_readw(__x_tima + TM_SPC_ACK_OS_REG)); -@@ -89,8 +77,15 @@ static void GLUE(X_PFX,source_eoi)(u32 h +@@ -89,8 +77,15 @@ static void GLUE(X_PFX,source_eoi)(u32 hw_irq, struct xive_irq_data *xd) /* If the XIVE supports the new "store EOI facility, use it */ if (xd->flags & XIVE_IRQ_FLAG_STORE_EOI) __x_writeq(0, __x_eoi_page(xd) + XIVE_ESB_STORE_EOI); @@ -549,7 +580,7 @@ Acked-by: Michal Suchanek } else { uint64_t eoi_val; -@@ -102,20 +97,12 @@ static void GLUE(X_PFX,source_eoi)(u32 h +@@ -102,20 +97,12 @@ static void GLUE(X_PFX,source_eoi)(u32 hw_irq, struct xive_irq_data *xd) * * This allows us to then do a re-trigger if Q was set * rather than synthetizing an interrupt in software @@ -575,9 +606,11 @@ Acked-by: Michal Suchanek } } +diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c +index 8318716e5075..5a72e980e25a 100644 --- a/arch/powerpc/mm/hash_utils_64.c +++ b/arch/powerpc/mm/hash_utils_64.c -@@ -806,31 +806,6 @@ int hash__remove_section_mapping(unsigne +@@ -808,31 +808,6 @@ int hash__remove_section_mapping(unsigned long start, unsigned long end) } #endif /* CONFIG_MEMORY_HOTPLUG */ @@ -609,7 +642,7 @@ Acked-by: Michal Suchanek static void __init hash_init_partition_table(phys_addr_t hash_table, unsigned long htab_size) { -@@ -843,8 +818,6 @@ static void __init hash_init_partition_t +@@ -845,8 +820,6 @@ static void __init hash_init_partition_table(phys_addr_t hash_table, htab_size = __ilog2(htab_size) - 18; mmu_partition_table_set_entry(0, hash_table | htab_size, 0); pr_info("Partition table %p\n", partition_tb); @@ -618,7 +651,7 @@ Acked-by: Michal Suchanek } static void __init htab_initialize(void) -@@ -1074,9 +1047,6 @@ void hash__early_init_mmu_secondary(void +@@ -1077,9 +1050,6 @@ void hash__early_init_mmu_secondary(void) /* Initialize hash table for that CPU */ if (!firmware_has_feature(FW_FEATURE_LPAR)) { @@ -628,9 +661,11 @@ Acked-by: Michal Suchanek if (!cpu_has_feature(CPU_FTR_ARCH_300)) mtspr(SPRN_SDR1, _SDR1); else +diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c +index 7c5f479c5c00..ec7538a802f9 100644 --- a/arch/powerpc/mm/hugetlbpage.c +++ b/arch/powerpc/mm/hugetlbpage.c -@@ -763,15 +763,12 @@ static int __init add_huge_page_size(uns +@@ -620,15 +620,12 @@ static int __init add_huge_page_size(unsigned long long size) * firmware we only add hugetlb support for page sizes that can be * supported by linux page table layout. * For now we have @@ -649,9 +684,11 @@ Acked-by: Michal Suchanek } else { if (mmu_psize != MMU_PAGE_16M && mmu_psize != MMU_PAGE_16G) return -EINVAL; +diff --git a/arch/powerpc/mm/mmu_context_book3s64.c b/arch/powerpc/mm/mmu_context_book3s64.c +index f3d4b4a0e561..39e9ef0eb78b 100644 --- a/arch/powerpc/mm/mmu_context_book3s64.c +++ b/arch/powerpc/mm/mmu_context_book3s64.c -@@ -252,15 +252,7 @@ void arch_exit_mmap(struct mm_struct *mm +@@ -273,15 +273,7 @@ void arch_exit_mmap(struct mm_struct *mm) #ifdef CONFIG_PPC_RADIX_MMU void radix__switch_mmu_context(struct mm_struct *prev, struct mm_struct *next) { @@ -669,9 +706,11 @@ Acked-by: Michal Suchanek + isync(); } #endif +diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c +index 96f68c5aa1f5..bba168d02235 100644 --- a/arch/powerpc/mm/pgtable-radix.c +++ b/arch/powerpc/mm/pgtable-radix.c -@@ -163,16 +163,6 @@ void radix__mark_rodata_ro(void) +@@ -226,16 +226,6 @@ void radix__mark_rodata_ro(void) { unsigned long start, end; @@ -688,7 +727,7 @@ Acked-by: Michal Suchanek start = (unsigned long)_stext; end = (unsigned long)__init_begin; -@@ -454,35 +444,6 @@ found: +@@ -533,35 +523,6 @@ void __init radix__early_init_devtree(void) return; } @@ -724,7 +763,7 @@ Acked-by: Michal Suchanek static void radix_init_amor(void) { /* -@@ -497,22 +458,12 @@ static void radix_init_amor(void) +@@ -576,22 +537,12 @@ static void radix_init_amor(void) static void radix_init_iamr(void) { @@ -748,7 +787,7 @@ Acked-by: Michal Suchanek } void __init radix__early_init_mmu(void) -@@ -564,8 +515,6 @@ void __init radix__early_init_mmu(void) +@@ -644,8 +595,6 @@ void __init radix__early_init_mmu(void) if (!firmware_has_feature(FW_FEATURE_LPAR)) { radix_init_native(); @@ -757,7 +796,7 @@ Acked-by: Michal Suchanek lpcr = mfspr(SPRN_LPCR); mtspr(SPRN_LPCR, lpcr | LPCR_UPRT | LPCR_HR); radix_init_partition_table(); -@@ -591,10 +540,6 @@ void radix__early_init_mmu_secondary(voi +@@ -671,10 +620,6 @@ void radix__early_init_mmu_secondary(void) * update partition table control register and UPRT */ if (!firmware_has_feature(FW_FEATURE_LPAR)) { @@ -768,7 +807,7 @@ Acked-by: Michal Suchanek lpcr = mfspr(SPRN_LPCR); mtspr(SPRN_LPCR, lpcr | LPCR_UPRT | LPCR_HR); -@@ -1015,8 +960,7 @@ void radix__ptep_set_access_flags(struct +@@ -1095,8 +1040,7 @@ void radix__ptep_set_access_flags(struct vm_area_struct *vma, pte_t *ptep, * To avoid NMMU hang while relaxing access, we need mark * the pte invalid in between. */ @@ -778,9 +817,11 @@ Acked-by: Michal Suchanek unsigned long old_pte, new_pte; old_pte = __radix_pte_update(ptep, ~0, 0); +diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c +index 67a6e86d3e7e..902767b8a9c1 100644 --- a/arch/powerpc/mm/tlb-radix.c +++ b/arch/powerpc/mm/tlb-radix.c -@@ -930,24 +930,6 @@ void radix__flush_tlb_all(void) +@@ -994,24 +994,6 @@ void radix__flush_tlb_all(void) asm volatile("eieio; tlbsync; ptesync": : :"memory"); } @@ -805,9 +846,11 @@ Acked-by: Michal Suchanek #ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE extern void radix_kvm_prefetch_workaround(struct mm_struct *mm) { +diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c +index 3f66fcf8ad99..01f92c4a9f02 100644 --- a/arch/powerpc/perf/core-book3s.c +++ b/arch/powerpc/perf/core-book3s.c -@@ -128,10 +128,6 @@ static inline void power_pmu_bhrb_disabl +@@ -128,10 +128,6 @@ static inline void power_pmu_bhrb_disable(struct perf_event *event) {} static void power_pmu_sched_task(struct perf_event_context *ctx, bool sched_in) {} static inline void power_pmu_bhrb_read(struct cpu_hw_events *cpuhw) {} static void pmao_restore_workaround(bool ebb) { } @@ -818,7 +861,7 @@ Acked-by: Michal Suchanek #endif /* CONFIG_PPC32 */ static bool regs_use_siar(struct pt_regs *regs) -@@ -714,14 +710,6 @@ static void pmao_restore_workaround(bool +@@ -714,14 +710,6 @@ static void pmao_restore_workaround(bool ebb) mtspr(SPRN_PMC6, pmcs[5]); } @@ -833,7 +876,7 @@ Acked-by: Michal Suchanek #endif /* CONFIG_PPC64 */ static void perf_event_interrupt(struct pt_regs *regs); -@@ -1046,7 +1034,6 @@ static u64 check_and_compute_delta(u64 p +@@ -1046,7 +1034,6 @@ static u64 check_and_compute_delta(u64 prev, u64 val) static void power_pmu_read(struct perf_event *event) { s64 val, delta, prev; @@ -841,7 +884,7 @@ Acked-by: Michal Suchanek if (event->hw.state & PERF_HES_STOPPED) return; -@@ -1056,13 +1043,6 @@ static void power_pmu_read(struct perf_e +@@ -1056,13 +1043,6 @@ static void power_pmu_read(struct perf_event *event) if (is_ebb_event(event)) { val = read_pmc(event->hw.idx); @@ -855,7 +898,7 @@ Acked-by: Michal Suchanek local64_set(&event->hw.prev_count, val); return; } -@@ -1076,13 +1056,6 @@ static void power_pmu_read(struct perf_e +@@ -1076,13 +1056,6 @@ static void power_pmu_read(struct perf_event *event) prev = local64_read(&event->hw.prev_count); barrier(); val = read_pmc(event->hw.idx); @@ -869,7 +912,7 @@ Acked-by: Michal Suchanek delta = check_and_compute_delta(prev, val); if (!delta) return; -@@ -1535,13 +1508,6 @@ nocheck: +@@ -1535,13 +1508,6 @@ static int power_pmu_add(struct perf_event *event, int ef_flags) event->attr.branch_sample_type); } @@ -883,6 +926,8 @@ Acked-by: Michal Suchanek perf_pmu_enable(event->pmu); local_irq_restore(flags); return ret; +diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c +index 2efee3f196f5..177de814286f 100644 --- a/arch/powerpc/perf/isa207-common.c +++ b/arch/powerpc/perf/isa207-common.c @@ -59,7 +59,7 @@ static bool is_event_valid(u64 event) @@ -894,7 +939,7 @@ Acked-by: Michal Suchanek valid_mask = p9_EVENT_VALID_MASK; return !(event & ~valid_mask); -@@ -86,8 +86,6 @@ static void mmcra_sdar_mode(u64 event, u +@@ -86,8 +86,6 @@ static void mmcra_sdar_mode(u64 event, unsigned long *mmcra) * Incase of Power9: * Marked event: MMCRA[SDAR_MODE] will be set to 0b00 ('No Updates'), * or if group already have any marked events. @@ -903,7 +948,7 @@ Acked-by: Michal Suchanek * For rest * MMCRA[SDAR_MODE] will be set from event code. * If sdar_mode from event is zero, default to 0b01. Hardware -@@ -96,7 +94,7 @@ static void mmcra_sdar_mode(u64 event, u +@@ -96,7 +94,7 @@ static void mmcra_sdar_mode(u64 event, unsigned long *mmcra) if (cpu_has_feature(CPU_FTR_ARCH_300)) { if (is_event_marked(event) || (*mmcra & MMCRA_SAMPLE_ENABLE)) *mmcra &= MMCRA_SDAR_MODE_NO_UPDATES; @@ -912,7 +957,7 @@ Acked-by: Michal Suchanek *mmcra |= p9_SDAR_MODE(event) << MMCRA_SDAR_MODE_SHIFT; else *mmcra |= MMCRA_SDAR_MODE_DCACHE; -@@ -106,7 +104,7 @@ static void mmcra_sdar_mode(u64 event, u +@@ -106,7 +104,7 @@ static void mmcra_sdar_mode(u64 event, unsigned long *mmcra) static u64 thresh_cmp_val(u64 value) { @@ -930,7 +975,7 @@ Acked-by: Michal Suchanek return p9_EVENT_COMBINE(event); return EVENT_COMBINE(event); -@@ -122,7 +120,7 @@ static unsigned long combine_from_event( +@@ -122,7 +120,7 @@ static unsigned long combine_from_event(u64 event) static unsigned long combine_shift(unsigned long pmc) { @@ -939,6 +984,8 @@ Acked-by: Michal Suchanek return p9_MMCR1_COMBINE_SHIFT(pmc); return MMCR1_COMBINE_SHIFT(pmc); +diff --git a/arch/powerpc/perf/isa207-common.h b/arch/powerpc/perf/isa207-common.h +index 6a0b586c935a..0028f4b9490d 100644 --- a/arch/powerpc/perf/isa207-common.h +++ b/arch/powerpc/perf/isa207-common.h @@ -158,11 +158,6 @@ @@ -953,9 +1000,11 @@ Acked-by: Michal Suchanek /* Bits in MMCR1 for PowerISA v2.07 */ #define MMCR1_UNIT_SHIFT(pmc) (60 - (4 * ((pmc) - 1))) #define MMCR1_COMBINE_SHIFT(pmc) (35 - ((pmc) - 1)) +diff --git a/arch/powerpc/perf/power9-pmu.c b/arch/powerpc/perf/power9-pmu.c +index 2ca0b33b4efb..e012b1030a5b 100644 --- a/arch/powerpc/perf/power9-pmu.c +++ b/arch/powerpc/perf/power9-pmu.c -@@ -219,12 +219,6 @@ static struct attribute_group power9_pmu +@@ -219,12 +219,6 @@ static struct attribute_group power9_pmu_events_group = { .attrs = power9_events_attr, }; @@ -968,7 +1017,7 @@ Acked-by: Michal Suchanek PMU_FORMAT_ATTR(event, "config:0-51"); PMU_FORMAT_ATTR(pmcxsel, "config:0-7"); PMU_FORMAT_ATTR(mark, "config:8"); -@@ -267,17 +261,6 @@ static const struct attribute_group *pow +@@ -267,17 +261,6 @@ static const struct attribute_group *power9_pmu_attr_groups[] = { NULL, }; @@ -986,7 +1035,7 @@ Acked-by: Michal Suchanek static int power9_generic_events[] = { [PERF_COUNT_HW_CPU_CYCLES] = PM_CYC, [PERF_COUNT_HW_STALLED_CYCLES_FRONTEND] = PM_ICT_NOSLOT_CYC, -@@ -439,25 +422,6 @@ static int power9_cache_events[C(MAX)][C +@@ -439,25 +422,6 @@ static int power9_cache_events[C(MAX)][C(OP_MAX)][C(RESULT_MAX)] = { #undef C @@ -1037,9 +1086,10 @@ Acked-by: Michal Suchanek if (rc) return rc; +diff --git a/arch/powerpc/platforms/powernv/idle.c b/arch/powerpc/platforms/powernv/idle.c --- a/arch/powerpc/platforms/powernv/idle.c +++ b/arch/powerpc/platforms/powernv/idle.c -@@ -177,11 +177,6 @@ static void pnv_alloc_idle_core_states(v +@@ -177,11 +177,6 @@ static void pnv_alloc_idle_core_states(void) paca[cpu].core_idle_state_ptr = core_idle_state; paca[cpu].thread_idle_state = PNV_THREAD_RUNNING; paca[cpu].thread_mask = 1 << j; @@ -1080,9 +1130,11 @@ Acked-by: Michal Suchanek if (supported_cpuidle_states & OPAL_PM_NAP_ENABLED) ppc_md.power_save = power7_idle; +diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c +index b80909957792..0d354e19ef92 100644 --- a/arch/powerpc/platforms/powernv/smp.c +++ b/arch/powerpc/platforms/powernv/smp.c -@@ -256,23 +256,6 @@ static void pnv_cause_ipi(int cpu) +@@ -283,23 +283,6 @@ static void pnv_cause_ipi(int cpu) ic_cause_ipi(cpu); } @@ -1106,7 +1158,7 @@ Acked-by: Michal Suchanek static void __init pnv_smp_probe(void) { if (xive_enabled()) -@@ -284,14 +267,10 @@ static void __init pnv_smp_probe(void) +@@ -311,14 +294,10 @@ static void __init pnv_smp_probe(void) ic_cause_ipi = smp_ops->cause_ipi; WARN_ON(!ic_cause_ipi); @@ -1124,9 +1176,11 @@ Acked-by: Michal Suchanek } } +diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c +index 3459015092fa..4758173df426 100644 --- a/arch/powerpc/sysdev/xive/common.c +++ b/arch/powerpc/sysdev/xive/common.c -@@ -319,7 +319,7 @@ void xive_do_source_eoi(u32 hw_irq, stru +@@ -319,7 +319,7 @@ void xive_do_source_eoi(u32 hw_irq, struct xive_irq_data *xd) * The FW told us to call it. This happens for some * interrupt sources that need additional HW whacking * beyond the ESB manipulation. For example LPC interrupts @@ -1135,7 +1189,7 @@ Acked-by: Michal Suchanek * itself. The Firmware will take care of it. */ if (WARN_ON_ONCE(!xive_ops->eoi)) -@@ -337,9 +337,9 @@ void xive_do_source_eoi(u32 hw_irq, stru +@@ -337,9 +337,9 @@ void xive_do_source_eoi(u32 hw_irq, struct xive_irq_data *xd) * This allows us to then do a re-trigger if Q was set * rather than synthesizing an interrupt in software * @@ -1148,9 +1202,11 @@ Acked-by: Michal Suchanek */ if (xd->flags & XIVE_IRQ_FLAG_LSI) xive_esb_read(xd, XIVE_ESB_LOAD_EOI); +diff --git a/drivers/misc/cxl/cxl.h b/drivers/misc/cxl/cxl.h +index 918d4fb742d1..505f973e13f3 100644 --- a/drivers/misc/cxl/cxl.h +++ b/drivers/misc/cxl/cxl.h -@@ -856,14 +856,6 @@ static inline bool cxl_is_power9(void) +@@ -865,14 +865,6 @@ static inline bool cxl_is_power9(void) return false; } @@ -1165,9 +1221,11 @@ Acked-by: Michal Suchanek ssize_t cxl_pci_afu_read_err_buffer(struct cxl_afu *afu, char *buf, loff_t off, size_t count); +diff --git a/drivers/misc/cxl/cxllib.c b/drivers/misc/cxl/cxllib.c +index 0bc7c31cf739..5a3f91255258 100644 --- a/drivers/misc/cxl/cxllib.c +++ b/drivers/misc/cxl/cxllib.c -@@ -102,10 +102,6 @@ int cxllib_get_xsl_config(struct pci_dev +@@ -102,10 +102,6 @@ int cxllib_get_xsl_config(struct pci_dev *dev, struct cxllib_xsl_config *cfg) rc = cxl_get_xsl9_dsnctl(dev, capp_unit_id, &cfg->dsnctl); if (rc) return rc; @@ -1178,9 +1236,11 @@ Acked-by: Michal Suchanek cfg->version = CXL_XSL_CONFIG_CURRENT_VERSION; cfg->log_bar_size = CXL_CAPI_WINDOW_LOG_SIZE; +diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c +index 429d6de1dde7..2af0d4c47b76 100644 --- a/drivers/misc/cxl/pci.c +++ b/drivers/misc/cxl/pci.c -@@ -467,23 +467,21 @@ int cxl_get_xsl9_dsnctl(struct pci_dev * +@@ -465,23 +465,21 @@ int cxl_get_xsl9_dsnctl(struct pci_dev *dev, u64 capp_unit_id, u64 *reg) /* nMMU_ID Defaults to: b’000001001’*/ xsl_dsnctl |= ((u64)0x09 << (63-28)); @@ -1193,14 +1253,6 @@ Acked-by: Michal Suchanek - * Not supported on P9 DD1. - */ - xsl_dsnctl |= (nbwind << (63-55)); -- -- /* -- * Upper 16b address bits of ASB_Notify messages sent to the -- * system. Need to match the PHB’s ASN Compare/Mask Register. -- * Not supported on P9 DD1. -- */ -- xsl_dsnctl |= asnind; -- } + /* + * Used to identify CAPI packets which should be sorted into + * the Non-Blocking queues by the PHB. This field should match @@ -1209,7 +1261,14 @@ Acked-by: Michal Suchanek + * Not supported on P9 DD1. + */ + xsl_dsnctl |= (nbwind << (63-55)); -+ + +- /* +- * Upper 16b address bits of ASB_Notify messages sent to the +- * system. Need to match the PHB’s ASN Compare/Mask Register. +- * Not supported on P9 DD1. +- */ +- xsl_dsnctl |= asnind; +- } + /* + * Upper 16b address bits of ASB_Notify messages sent to the + * system. Need to match the PHB’s ASN Compare/Mask Register. @@ -1219,7 +1278,7 @@ Acked-by: Michal Suchanek *reg = xsl_dsnctl; return 0; -@@ -541,15 +539,8 @@ static int init_implementation_adapter_r +@@ -539,15 +537,8 @@ static int init_implementation_adapter_regs_psl9(struct cxl *adapter, /* Snoop machines */ cxl_p1_write(adapter, CXL_PSL9_APCDEDALLOC, 0x800F000200000000ULL); @@ -1237,3 +1296,6 @@ Acked-by: Michal Suchanek /* * Check if PSL has data-cache. We need to flush adapter datacache +-- +2.35.3 + diff --git a/patches.suse/powerpc-Enable-the-DAWR-on-POWER9-DD2.3-and-above.patch b/patches.suse/powerpc-Enable-the-DAWR-on-POWER9-DD2.3-and-above.patch new file mode 100644 index 0000000..9dc761d --- /dev/null +++ b/patches.suse/powerpc-Enable-the-DAWR-on-POWER9-DD2.3-and-above.patch @@ -0,0 +1,134 @@ +From 26b78c81e84c5133b299fb11bf17ec1a3d2ad217 Mon Sep 17 00:00:00 2001 +From: Reza Arbab +Date: Tue, 3 May 2022 12:01:52 -0500 +Subject: [PATCH] powerpc: Enable the DAWR on POWER9 DD2.3 and above + +References: bsc#1055117 ltc#159753 +Patch-mainline: v5.19-rc1 +Git-commit: 26b78c81e84c5133b299fb11bf17ec1a3d2ad217 + +The hardware bug in POWER9 preventing use of the DAWR was fixed in +DD2.3. Set the CPU_FTR_DAWR feature bit on these newer systems to start +using it again, and update the documentation accordingly. + +The CPU features for DD2.3 are currently determined by "DD2.2 or later" +logic. In adding DD2.3 as a discrete case for the first time here, I'm +carrying the quirks of DD2.2 forward to keep all behavior outside of +this DAWR change the same. This leaves the assessment and potential +removal of those quirks on DD2.3 for later. + +Signed-off-by: Reza Arbab +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220503170152.23412-1-arbab@linux.ibm.com +Acked-by: Michal Suchanek +--- + Documentation/powerpc/dawr-power9.rst | 26 +++++++++++++++++--------- + arch/powerpc/include/asm/cputable.h | 10 ++++++++-- + arch/powerpc/kernel/cputable.c | 22 ++++++++++++++++++++-- + arch/powerpc/kernel/dt_cpu_ftrs.c | 8 +++++++- + 4 files changed, 52 insertions(+), 14 deletions(-) + +diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h +--- a/arch/powerpc/include/asm/cputable.h ++++ b/arch/powerpc/include/asm/cputable.h +@@ -440,6 +440,10 @@ static inline void cpu_feature_keys_init(void) { } + #define CPU_FTRS_POWER9_DD2_2 (CPU_FTRS_POWER9 | CPU_FTR_POWER9_DD2_1 | \ + CPU_FTR_P9_TM_HV_ASSIST | \ + CPU_FTR_P9_TM_XER_SO_BUG) ++#define CPU_FTRS_POWER9_DD2_3 (CPU_FTRS_POWER9 | CPU_FTR_POWER9_DD2_1 | \ ++ CPU_FTR_P9_TM_HV_ASSIST | \ ++ CPU_FTR_P9_TM_XER_SO_BUG | \ ++ CPU_FTR_DAWR) + #define CPU_FTRS_CELL (CPU_FTR_LWSYNC | \ + CPU_FTR_PPCAS_ARCH_V2 | CPU_FTR_CTRL | \ + CPU_FTR_ALTIVEC_COMP | CPU_FTR_MMCRA | CPU_FTR_SMT | \ +@@ -469,14 +473,16 @@ static inline void cpu_feature_keys_init(void) { } + #define CPU_FTRS_POSSIBLE \ + (CPU_FTRS_POWER7 | CPU_FTRS_POWER8E | CPU_FTRS_POWER8 | \ + CPU_FTR_ALTIVEC_COMP | CPU_FTR_VSX_COMP | CPU_FTRS_POWER9 | \ +- CPU_FTRS_POWER9_DD2_1 | CPU_FTRS_POWER9_DD2_2) ++ CPU_FTRS_POWER9_DD2_1 | CPU_FTRS_POWER9_DD2_2 | \ ++ CPU_FTRS_POWER9_DD2_3) + #else + #define CPU_FTRS_POSSIBLE \ + (CPU_FTRS_PPC970 | CPU_FTRS_POWER5 | \ + CPU_FTRS_POWER6 | CPU_FTRS_POWER7 | CPU_FTRS_POWER8E | \ + CPU_FTRS_POWER8 | CPU_FTRS_CELL | CPU_FTRS_PA6T | \ + CPU_FTR_VSX_COMP | CPU_FTR_ALTIVEC_COMP | CPU_FTRS_POWER9 | \ +- CPU_FTRS_POWER9_DD2_1 | CPU_FTRS_POWER9_DD2_2) ++ CPU_FTRS_POWER9_DD2_1 | CPU_FTRS_POWER9_DD2_2 | \ ++ CPU_FTRS_POWER9_DD2_3) + #endif /* CONFIG_CPU_LITTLE_ENDIAN */ + #endif + #else +diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c +index f9b3def5b254..a5dbfccd2047 100644 +--- a/arch/powerpc/kernel/cputable.c ++++ b/arch/powerpc/kernel/cputable.c +@@ -487,11 +487,29 @@ static struct cpu_spec __initdata cpu_specs[] = { + .machine_check_early = __machine_check_early_realmode_p9, + .platform = "power9", + }, +- { /* Power9 DD2.2 or later */ ++ { /* Power9 DD2.2 */ ++ .pvr_mask = 0xffffefff, ++ .pvr_value = 0x004e0202, ++ .cpu_name = "POWER9 (raw)", ++ .cpu_features = CPU_FTRS_POWER9_DD2_2, ++ .cpu_user_features = COMMON_USER_POWER9, ++ .cpu_user_features2 = COMMON_USER2_POWER9, ++ .mmu_features = MMU_FTRS_POWER9, ++ .icache_bsize = 128, ++ .dcache_bsize = 128, ++ .num_pmcs = 6, ++ .pmc_type = PPC_PMC_IBM, ++ .oprofile_cpu_type = "ppc64/power9", ++ .cpu_setup = __setup_cpu_power9, ++ .cpu_restore = __restore_cpu_power9, ++ .machine_check_early = __machine_check_early_realmode_p9, ++ .platform = "power9", ++ }, ++ { /* Power9 DD2.3 or later */ + .pvr_mask = 0xffff0000, + .pvr_value = 0x004e0000, + .cpu_name = "POWER9 (raw)", +- .cpu_features = CPU_FTRS_POWER9_DD2_2, ++ .cpu_features = CPU_FTRS_POWER9_DD2_3, + .cpu_user_features = COMMON_USER_POWER9, + .cpu_user_features2 = COMMON_USER2_POWER9, + .mmu_features = MMU_FTRS_POWER9, +diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c +--- a/arch/powerpc/kernel/dt_cpu_ftrs.c ++++ b/arch/powerpc/kernel/dt_cpu_ftrs.c +@@ -774,21 +774,24 @@ static __init void cpufeatures_cpu_quirks(void) + if ((version & 0xffffefff) == 0x004e0200) { + /* DD2.0 has no feature flag */ + cur_cpu_spec->cpu_features |= CPU_FTR_P9_RADIX_PREFETCH_BUG; ++ cur_cpu_spec->cpu_features &= ~(CPU_FTR_DAWR); + } else if ((version & 0xffffefff) == 0x004e0201) { + cur_cpu_spec->cpu_features |= CPU_FTR_POWER9_DD2_1; + cur_cpu_spec->cpu_features |= CPU_FTR_P9_RADIX_PREFETCH_BUG; ++ cur_cpu_spec->cpu_features &= ~(CPU_FTR_DAWR); + } else if ((version & 0xffffefff) == 0x004e0202) { + cur_cpu_spec->cpu_features |= CPU_FTR_P9_TM_HV_ASSIST; + cur_cpu_spec->cpu_features |= CPU_FTR_P9_TM_XER_SO_BUG; + cur_cpu_spec->cpu_features |= CPU_FTR_POWER9_DD2_1; ++ cur_cpu_spec->cpu_features &= ~(CPU_FTR_DAWR); ++ } else if ((version & 0xffffefff) == 0x004e0203) { ++ cur_cpu_spec->cpu_features |= CPU_FTR_P9_TM_HV_ASSIST; ++ cur_cpu_spec->cpu_features |= CPU_FTR_P9_TM_XER_SO_BUG; ++ cur_cpu_spec->cpu_features |= CPU_FTR_POWER9_DD2_1; + } else if ((version & 0xffff0000) == 0x004e0000) { + /* DD2.1 and up have DD2_1 */ + cur_cpu_spec->cpu_features |= CPU_FTR_POWER9_DD2_1; + } +- +- if ((version & 0xffff0000) == 0x004e0000) { +- cur_cpu_spec->cpu_features &= ~(CPU_FTR_DAWR); +- } + + update_tlbie_feature_flag(version); + /* +-- +2.35.3 + diff --git a/patches.suse/powerpc-Remove-Power8-DD1-from-cputable.patch b/patches.suse/powerpc-Remove-Power8-DD1-from-cputable.patch new file mode 100644 index 0000000..3ee0ebe --- /dev/null +++ b/patches.suse/powerpc-Remove-Power8-DD1-from-cputable.patch @@ -0,0 +1,109 @@ +From e11b64b1ef336f8976e5bf194b0eede48954f419 Mon Sep 17 00:00:00 2001 +From: Joel Stanley +Date: Wed, 11 Jul 2018 16:02:58 +1000 +Subject: [PATCH] powerpc: Remove Power8 DD1 from cputable + +References: bsc#1055117 ltc#159753 +Patch-mainline: v4.19-rc1 +Git-commit: e11b64b1ef336f8976e5bf194b0eede48954f419 + +This was added to support an early version of Power8 that did not have +working doorbells. These machines were not publicly available, and all of +the internal users have long since upgraded. + +Signed-off-by: Joel Stanley +Signed-off-by: Michael Ellerman +Acked-by: Michal Suchanek +--- + arch/powerpc/include/asm/cputable.h | 15 +++++++-------- + arch/powerpc/kernel/cputable.c | 19 ------------------- + 2 files changed, 7 insertions(+), 27 deletions(-) + +diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h +--- a/arch/powerpc/include/asm/cputable.h ++++ b/arch/powerpc/include/asm/cputable.h +@@ -452,7 +452,6 @@ static inline void cpu_feature_keys_init(void) { } + CPU_FTR_DBELL | CPU_FTR_HAS_PPR | CPU_FTR_DAWR | \ + CPU_FTR_ARCH_207S | CPU_FTR_TM_COMP | CPU_FTR_PKEY) + #define CPU_FTRS_POWER8E (CPU_FTRS_POWER8 | CPU_FTR_PMAO_BUG) +-#define CPU_FTRS_POWER8_DD1 (CPU_FTRS_POWER8 & ~CPU_FTR_DBELL) + #define CPU_FTRS_POWER9 (CPU_FTR_LWSYNC | \ + CPU_FTR_PPCAS_ARCH_V2 | CPU_FTR_CTRL | CPU_FTR_ARCH_206 |\ + CPU_FTR_MMCRA | CPU_FTR_SMT | \ +@@ -488,16 +487,16 @@ static inline void cpu_feature_keys_init(void) { } + #ifdef CONFIG_CPU_LITTLE_ENDIAN + #define CPU_FTRS_POSSIBLE \ + (CPU_FTRS_POWER7 | CPU_FTRS_POWER8E | CPU_FTRS_POWER8 | \ +- CPU_FTRS_POWER8_DD1 | CPU_FTR_ALTIVEC_COMP | CPU_FTR_VSX_COMP | \ +- CPU_FTRS_POWER9 | CPU_FTRS_POWER9_DD1 | CPU_FTRS_POWER9_DD2_1 | \ ++ CPU_FTR_ALTIVEC_COMP | CPU_FTR_VSX_COMP | CPU_FTRS_POWER9 | \ ++ CPU_FTRS_POWER9_DD1 | CPU_FTRS_POWER9_DD2_1 | \ + CPU_FTRS_POWER9_DD2_2) + #else + #define CPU_FTRS_POSSIBLE \ + (CPU_FTRS_PPC970 | CPU_FTRS_POWER5 | \ + CPU_FTRS_POWER6 | CPU_FTRS_POWER7 | CPU_FTRS_POWER8E | \ +- CPU_FTRS_POWER8 | CPU_FTRS_POWER8_DD1 | CPU_FTRS_CELL | \ +- CPU_FTRS_PA6T | CPU_FTR_VSX_COMP | CPU_FTR_ALTIVEC_COMP | \ +- CPU_FTRS_POWER9 | CPU_FTRS_POWER9_DD1 | CPU_FTRS_POWER9_DD2_1 | \ ++ CPU_FTRS_POWER8 | CPU_FTRS_CELL | CPU_FTRS_PA6T | \ ++ CPU_FTR_VSX_COMP | CPU_FTR_ALTIVEC_COMP | CPU_FTRS_POWER9 | \ ++ CPU_FTRS_POWER9_DD1 | CPU_FTRS_POWER9_DD2_1 | \ + CPU_FTRS_POWER9_DD2_2) + #endif /* CONFIG_CPU_LITTLE_ENDIAN */ + #endif +@@ -566,8 +565,8 @@ enum { + #ifdef CONFIG_CPU_LITTLE_ENDIAN + #define CPU_FTRS_ALWAYS \ + (CPU_FTRS_POSSIBLE & ~CPU_FTR_HVMODE & CPU_FTRS_POWER7 & \ +- CPU_FTRS_POWER8E & CPU_FTRS_POWER8 & CPU_FTRS_POWER8_DD1 & \ ++ CPU_FTRS_POWER8E & CPU_FTRS_POWER8 & CPU_FTRS_POWER9 & \ +- CPU_FTRS_POWER9 & CPU_FTRS_POWER9_DD1 & CPU_FTRS_POWER9_DD2_1 & \ ++ CPU_FTRS_POWER9_DD1 & CPU_FTRS_POWER9_DD2_1 & \ + CPU_FTRS_DT_CPU_BASE) + #else + #define CPU_FTRS_ALWAYS \ +@@ -574,8 +573,8 @@ enum { + (CPU_FTRS_PPC970 & CPU_FTRS_POWER5 & \ + CPU_FTRS_POWER6 & CPU_FTRS_POWER7 & CPU_FTRS_CELL & \ + CPU_FTRS_PA6T & CPU_FTRS_POWER8 & CPU_FTRS_POWER8E & \ +- CPU_FTRS_POWER8_DD1 & ~CPU_FTR_HVMODE & CPU_FTRS_POSSIBLE & \ ++ ~CPU_FTR_HVMODE & CPU_FTRS_POSSIBLE & CPU_FTRS_POWER9 & \ +- CPU_FTRS_POWER9 & CPU_FTRS_POWER9_DD1 & CPU_FTRS_POWER9_DD2_1 & \ ++ CPU_FTRS_POWER9_DD1 & CPU_FTRS_POWER9_DD2_1 & \ + CPU_FTRS_DT_CPU_BASE) + #endif /* CONFIG_CPU_LITTLE_ENDIAN */ + #endif +diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c +index c8fc9691f8c7..9169ffdbab08 100644 +--- a/arch/powerpc/kernel/cputable.c ++++ b/arch/powerpc/kernel/cputable.c +@@ -447,25 +447,6 @@ static struct cpu_spec __initdata cpu_specs[] = { + .machine_check_early = __machine_check_early_realmode_p8, + .platform = "power8", + }, +- { /* Power8 DD1: Does not support doorbell IPIs */ +- .pvr_mask = 0xffffff00, +- .pvr_value = 0x004d0100, +- .cpu_name = "POWER8 (raw)", +- .cpu_features = CPU_FTRS_POWER8_DD1, +- .cpu_user_features = COMMON_USER_POWER8, +- .cpu_user_features2 = COMMON_USER2_POWER8, +- .mmu_features = MMU_FTRS_POWER8, +- .icache_bsize = 128, +- .dcache_bsize = 128, +- .num_pmcs = 6, +- .pmc_type = PPC_PMC_IBM, +- .oprofile_cpu_type = "ppc64/power8", +- .oprofile_type = PPC_OPROFILE_INVALID, +- .cpu_setup = __setup_cpu_power8, +- .cpu_restore = __restore_cpu_power8, +- .machine_check_early = __machine_check_early_realmode_p8, +- .platform = "power8", +- }, + { /* Power8 */ + .pvr_mask = 0xffff0000, + .pvr_value = 0x004d0000, +-- +2.35.3 + diff --git a/patches.suse/powerpc-numa-Prefer-node-id-queried-from-vphn.patch b/patches.suse/powerpc-numa-Prefer-node-id-queried-from-vphn.patch new file mode 100644 index 0000000..8276c91 --- /dev/null +++ b/patches.suse/powerpc-numa-Prefer-node-id-queried-from-vphn.patch @@ -0,0 +1,61 @@ +From 6398eaa268168b528dd1d3d0e70e61e9c13bea23 Mon Sep 17 00:00:00 2001 +From: Srikar Dronamraju +Date: Tue, 18 Aug 2020 13:41:03 +0530 +Subject: [PATCH] powerpc/numa: Prefer node id queried from vphn + +References: bsc#1199237 bsc#1200173 ltc#198329 +Patch-mainline: v5.10-rc1 +Git-commit: 6398eaa268168b528dd1d3d0e70e61e9c13bea23 + +Node id queried from the static device tree may not +be correct. For example: it may always show 0 on a shared processor. +Hence prefer the node id queried from vphn and fallback on the device tree +based node id if vphn query fails. + +Signed-off-by: Srikar Dronamraju +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200818081104.57888-3-srikar@linux.vnet.ibm.com +Acked-by: Michal Suchanek +--- + arch/powerpc/mm/numa.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c +index f63e1a41402f..9f0127cfb978 100644 +--- a/arch/powerpc/mm/numa.c ++++ b/arch/powerpc/mm/numa.c +@@ -728,21 +728,22 @@ static int __init parse_numa_properties(void) + */ + for_each_present_cpu(i) { + struct device_node *cpu; +- int nid; +- +- cpu = of_get_cpu_node(i, NULL); +- BUG_ON(!cpu); +- nid = of_node_to_nid_single(cpu); +- of_node_put(cpu); ++ int nid = vphn_get_nid(i); + + /* + * Don't fall back to default_nid yet -- we will plug + * cpus into nodes once the memory scan has discovered + * the topology. + */ +- if (nid < 0) +- continue; +- node_set_online(nid); ++ if (nid == NUMA_NO_NODE) { ++ cpu = of_get_cpu_node(i, NULL); ++ BUG_ON(!cpu); ++ nid = of_node_to_nid_single(cpu); ++ of_node_put(cpu); ++ } ++ ++ if (likely(nid > 0)) ++ node_set_online(nid); + } + + get_n_mem_cells(&n_mem_addr_cells, &n_mem_size_cells); +-- +2.35.3 + diff --git a/patches.suse/powerpc-perf-Fix-power9-event-alternatives.patch b/patches.suse/powerpc-perf-Fix-power9-event-alternatives.patch new file mode 100644 index 0000000..a14b684 --- /dev/null +++ b/patches.suse/powerpc-perf-Fix-power9-event-alternatives.patch @@ -0,0 +1,90 @@ +From 0dcad700bb2776e3886fe0a645a4bf13b1e747cd Mon Sep 17 00:00:00 2001 +From: Athira Rajeev +Date: Tue, 19 Apr 2022 17:18:27 +0530 +Subject: [PATCH] powerpc/perf: Fix power9 event alternatives + +References: bsc#1137728, LTC#178106, git-fixes +Patch-mainline: v5.18-rc4 +Git-commit: 0dcad700bb2776e3886fe0a645a4bf13b1e747cd + +When scheduling a group of events, there are constraint checks done to +make sure all events can go in a group. Example, one of the criteria is +that events in a group cannot use the same PMC. But platform specific +PMU supports alternative event for some of the event codes. During +perf_event_open(), if any event group doesn't match constraint check +criteria, further lookup is done to find alternative event. + +By current design, the array of alternatives events in PMU code is +expected to be sorted by column 0. This is because in +find_alternative() the return criteria is based on event code +comparison. ie. "event < ev_alt[i][0])". This optimisation is there +since find_alternative() can be called multiple times. In power9 PMU +code, the alternative event array is not sorted properly and hence there +is breakage in finding alternative events. + +To work with existing logic, fix the alternative event array to be +sorted by column 0 for power9-pmu.c + +Results: + +With alternative events, multiplexing can be avoided. That is, for +example, in power9 PM_LD_MISS_L1 (0x3e054) has alternative event, +PM_LD_MISS_L1_ALT (0x400f0). This is an identical event which can be +programmed in a different PMC. + +Before: + + # perf stat -e r3e054,r300fc + + Performance counter stats for 'system wide': + + 1057860 r3e054 (50.21%) + 379 r300fc (49.79%) + + 0.944329741 seconds time elapsed + +Since both the events are using PMC3 in this case, they are +multiplexed here. + +After: + + # perf stat -e r3e054,r300fc + + Performance counter stats for 'system wide': + + 1006948 r3e054 + 182 r300fc + +Fixes: 91e0bd1e6251 ("powerpc/perf: Add PM_LD_MISS_L1 and PM_BR_2PATH to power9 event list") +Signed-off-by: Athira Rajeev +Reviewed-by: Madhavan Srinivasan +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220419114828.89843-1-atrajeev@linux.vnet.ibm.com +Acked-by: Michal Suchanek +--- + arch/powerpc/perf/power9-pmu.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/powerpc/perf/power9-pmu.c b/arch/powerpc/perf/power9-pmu.c +index c9eb5232e68b..c393e837648e 100644 +--- a/arch/powerpc/perf/power9-pmu.c ++++ b/arch/powerpc/perf/power9-pmu.c +@@ -133,11 +133,11 @@ int p9_dd22_bl_ev[] = { + + /* Table of alternatives, sorted by column 0 */ + static const unsigned int power9_event_alternatives[][MAX_ALT] = { +- { PM_INST_DISP, PM_INST_DISP_ALT }, +- { PM_RUN_CYC_ALT, PM_RUN_CYC }, +- { PM_RUN_INST_CMPL_ALT, PM_RUN_INST_CMPL }, +- { PM_LD_MISS_L1, PM_LD_MISS_L1_ALT }, + { PM_BR_2PATH, PM_BR_2PATH_ALT }, ++ { PM_INST_DISP, PM_INST_DISP_ALT }, ++ { PM_RUN_CYC_ALT, PM_RUN_CYC }, ++ { PM_LD_MISS_L1, PM_LD_MISS_L1_ALT }, ++ { PM_RUN_INST_CMPL_ALT, PM_RUN_INST_CMPL }, + }; + + static int power9_get_alternatives(u64 event, unsigned int flags, u64 alt[]) +-- +2.34.1 + diff --git a/patches.suse/powerpc-powernv-Get-L1D-flush-requirements-from-devi.patch b/patches.suse/powerpc-powernv-Get-L1D-flush-requirements-from-devi.patch new file mode 100644 index 0000000..7302121 --- /dev/null +++ b/patches.suse/powerpc-powernv-Get-L1D-flush-requirements-from-devi.patch @@ -0,0 +1,50 @@ +From 2efee6adb56159288bce9d1ab51fc9056d7007d4 Mon Sep 17 00:00:00 2001 +From: Russell Currey +Date: Mon, 4 Apr 2022 20:15:35 +1000 +Subject: [PATCH] powerpc/powernv: Get L1D flush requirements from device-tree + +References: bsc#1188885 ltc#193722 git-fixes +Patch-mainline: v5.19-rc1 +Git-commit: 2efee6adb56159288bce9d1ab51fc9056d7007d4 + +The device-tree properties no-need-l1d-flush-msr-pr-1-to-0 and +no-need-l1d-flush-kernel-on-user-access are the equivalents of +H_CPU_BEHAV_NO_L1D_FLUSH_ENTRY and H_CPU_BEHAV_NO_L1D_FLUSH_UACCESS +from the H_GET_CPU_CHARACTERISTICS hcall on pseries respectively. + +In commit d02fa40d759f ("powerpc/powernv: Remove POWER9 PVR version +check for entry and uaccess flushes") the condition for disabling the +L1D flush on kernel entry and user access was changed from any non-P9 +CPU to only checking P7 and P8. Without the appropriate device-tree +checks for newer processors on powernv, these flushes are unnecessarily +enabled on those systems. This patch corrects this. + +Fixes: d02fa40d759f ("powerpc/powernv: Remove POWER9 PVR version check for entry and uaccess flushes") +Reported-by: Joel Stanley +Signed-off-by: Russell Currey +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220404101536.104794-1-ruscur@russell.cc +Acked-by: Michal Suchanek +--- + arch/powerpc/platforms/powernv/setup.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c +--- a/arch/powerpc/platforms/powernv/setup.c ++++ b/arch/powerpc/platforms/powernv/setup.c +@@ -96,6 +96,12 @@ static void __init init_fw_feat_flags(struct device_node *np) + + if (fw_feature_is("disabled", "needs-spec-barrier-for-bound-checks", np)) + security_ftr_clear(SEC_FTR_BNDS_CHK_SPEC_BAR); ++ ++ if (fw_feature_is("enabled", "no-need-l1d-flush-msr-pr-1-to-0", np)) ++ security_ftr_clear(SEC_FTR_L1D_FLUSH_ENTRY); ++ ++ if (fw_feature_is("enabled", "no-need-l1d-flush-kernel-on-user-access", np)) ++ security_ftr_clear(SEC_FTR_L1D_FLUSH_UACCESS); + } + + static void pnv_setup_security_mitigations(void) +-- +2.35.3 + diff --git a/patches.suse/powerpc-powernv-Get-STF-barrier-requirements-from-de.patch b/patches.suse/powerpc-powernv-Get-STF-barrier-requirements-from-de.patch new file mode 100644 index 0000000..1d9f17b --- /dev/null +++ b/patches.suse/powerpc-powernv-Get-STF-barrier-requirements-from-de.patch @@ -0,0 +1,45 @@ +From d2a3c131981d4498571908df95c3c9393a00adf5 Mon Sep 17 00:00:00 2001 +From: Russell Currey +Date: Mon, 4 Apr 2022 20:15:36 +1000 +Subject: [PATCH] powerpc/powernv: Get STF barrier requirements from + device-tree + +References: bsc#1188885 ltc#193722 git-fixes +Patch-mainline: v5.19-rc1 +Git-commit: d2a3c131981d4498571908df95c3c9393a00adf5 + +The device-tree property no-need-store-drain-on-priv-state-switch is +equivalent to H_CPU_BEHAV_NO_STF_BARRIER from the +H_CPU_GET_CHARACTERISTICS hcall on pseries. + +Since commit 84ed26fd00c5 ("powerpc/security: Add a security feature for +STF barrier") powernv systems with this device-tree property have been +enabling the STF barrier when they have no need for it. This patch +fixes this by clearing the STF barrier feature on those systems. + +Fixes: 84ed26fd00c5 ("powerpc/security: Add a security feature for STF barrier") +Reported-by: Joel Stanley +Signed-off-by: Russell Currey +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220404101536.104794-2-ruscur@russell.cc +Acked-by: Michal Suchanek +--- + arch/powerpc/platforms/powernv/setup.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c +--- a/arch/powerpc/platforms/powernv/setup.c ++++ b/arch/powerpc/platforms/powernv/setup.c +@@ -102,6 +102,9 @@ static void __init init_fw_feat_flags(struct device_node *np) + + if (fw_feature_is("enabled", "no-need-l1d-flush-kernel-on-user-access", np)) + security_ftr_clear(SEC_FTR_L1D_FLUSH_UACCESS); ++ ++ if (fw_feature_is("enabled", "no-need-store-drain-on-priv-state-switch", np)) ++ security_ftr_clear(SEC_FTR_STF_BARRIER); + } + + static void pnv_setup_security_mitigations(void) +-- +2.35.3 + diff --git a/patches.suse/powerpc-powernv-Remove-POWER9-PVR-version-check-for-.patch b/patches.suse/powerpc-powernv-Remove-POWER9-PVR-version-check-for-.patch new file mode 100644 index 0000000..8bea767 --- /dev/null +++ b/patches.suse/powerpc-powernv-Remove-POWER9-PVR-version-check-for-.patch @@ -0,0 +1,56 @@ +From d02fa40d759ff9a53c93b10d8a4b591688982b26 Mon Sep 17 00:00:00 2001 +From: Nicholas Piggin +Date: Mon, 3 May 2021 23:02:43 +1000 +Subject: [PATCH] powerpc/powernv: Remove POWER9 PVR version check for entry + and uaccess flushes + +References: bsc#1188885 ltc#193722 git-fixes +Patch-mainline: v5.17-rc1 +Git-commit: d02fa40d759ff9a53c93b10d8a4b591688982b26 + +These aren't necessarily POWER9 only, and it's not to say some new +vulnerability may not get discovered on other processors for which +we would like the flexibility of having the workaround enabled by +firmware. + +Remove the restriction that the workarounds only apply to POWER9. + +However POWER7 and POWER8 are not affected, and they may not have +older firmware that does not advertise this, so clear these workarounds +manually. + +Signed-off-by: Nicholas Piggin +Reviewed-by: Joel Stanley +[mpe: Incorporate changes from Nick, reword comment slightly.] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210503130243.891868-5-npiggin@gmail.com +Acked-by: Michal Suchanek +--- + arch/powerpc/platforms/powernv/setup.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c +index ad56a54ac9c5..5ef6b8afb3d0 100644 +--- a/arch/powerpc/platforms/powernv/setup.c ++++ b/arch/powerpc/platforms/powernv/setup.c +@@ -123,10 +123,14 @@ static void pnv_setup_security_mitigations(void) + } + + /* +- * If we are non-Power9 bare metal, we don't need to flush on kernel +- * entry or after user access: they fix a P9 specific vulnerability. ++ * The issues addressed by the entry and uaccess flush don't affect P7 ++ * or P8, so on bare metal disable them explicitly in case firmware does ++ * not include the features to disable them. POWER9 and newer processors ++ * should have the appropriate firmware flags. + */ +- if (!pvr_version_is(PVR_POWER9)) { ++ if (pvr_version_is(PVR_POWER7) || pvr_version_is(PVR_POWER7p) || ++ pvr_version_is(PVR_POWER8E) || pvr_version_is(PVR_POWER8NVL) || ++ pvr_version_is(PVR_POWER8)) { + security_ftr_clear(SEC_FTR_L1D_FLUSH_ENTRY); + security_ftr_clear(SEC_FTR_L1D_FLUSH_UACCESS); + } +-- +2.35.3 + diff --git a/patches.suse/powerpc-xive-Add-some-error-handling-code-to-xive_sp.patch b/patches.suse/powerpc-xive-Add-some-error-handling-code-to-xive_sp.patch new file mode 100644 index 0000000..e0db177 --- /dev/null +++ b/patches.suse/powerpc-xive-Add-some-error-handling-code-to-xive_sp.patch @@ -0,0 +1,107 @@ +From e414e2938ee26e734f19e92a60cd090ebaff37e6 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Tue, 1 Feb 2022 13:31:16 +0100 +Subject: [PATCH] powerpc/xive: Add some error handling code to + 'xive_spapr_init()' +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +References: fate#322438 git-fixes +Patch-mainline: v5.18-rc1 +Git-commit: e414e2938ee26e734f19e92a60cd090ebaff37e6 + +'xive_irq_bitmap_add()' can return -ENOMEM. +In this case, we should free the memory already allocated and return +'false' to the caller. + +Also add an error path which undoes the 'tima = ioremap(...)' + +Signed-off-by: Christophe JAILLET +Reviewed-by: Cédric Le Goater +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/564998101804886b151235c8a9f93020923bfd2c.1643718324.git.christophe.jaillet@wanadoo.fr +Acked-by: Michal Suchanek +--- + arch/powerpc/sysdev/xive/spapr.c | 36 +++++++++++++++++++++++++------- + 1 file changed, 28 insertions(+), 8 deletions(-) + +diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c +--- a/arch/powerpc/sysdev/xive/spapr.c ++++ b/arch/powerpc/sysdev/xive/spapr.c +@@ -67,6 +67,17 @@ static int __init xive_irq_bitmap_add(int base, int count) + return 0; + } + ++static void xive_irq_bitmap_remove_all(void) ++{ ++ struct xive_irq_bitmap *xibm, *tmp; ++ ++ list_for_each_entry_safe(xibm, tmp, &xive_irq_bitmaps, list) { ++ list_del(&xibm->list); ++ kfree(xibm->bitmap); ++ kfree(xibm); ++ } ++} ++ + static int __xive_irq_bitmap_alloc(struct xive_irq_bitmap *xibm) + { + int irq; +@@ -803,7 +814,7 @@ bool __init xive_spapr_init(void) + u32 val; + u32 len; + const __be32 *reg; +- int i; ++ int i, err; + + if (xive_spapr_disabled()) + return false; +@@ -828,23 +839,26 @@ bool __init xive_spapr_init(void) + } + + if (!xive_get_max_prio(&max_prio)) +- return false; ++ goto err_unmap; + + /* Feed the IRQ number allocator with the ranges given in the DT */ + reg = of_get_property(np, "ibm,xive-lisn-ranges", &len); + if (!reg) { + pr_err("Failed to read 'ibm,xive-lisn-ranges' property\n"); +- return false; ++ goto err_unmap; + } + + if (len % (2 * sizeof(u32)) != 0) { + pr_err("invalid 'ibm,xive-lisn-ranges' property\n"); +- return false; ++ goto err_unmap; + } + +- for (i = 0; i < len / (2 * sizeof(u32)); i++, reg += 2) +- xive_irq_bitmap_add(be32_to_cpu(reg[0]), +- be32_to_cpu(reg[1])); ++ for (i = 0; i < len / (2 * sizeof(u32)); i++, reg += 2) { ++ err = xive_irq_bitmap_add(be32_to_cpu(reg[0]), ++ be32_to_cpu(reg[1])); ++ if (err < 0) ++ goto err_mem_free; ++ } + + /* Iterate the EQ sizes and pick one */ + of_property_for_each_u32(np, "ibm,xive-eq-sizes", prop, reg, val) { +@@ -855,8 +869,14 @@ bool __init xive_spapr_init(void) + + /* Initialize XIVE core with our backend */ + if (!xive_core_init(&xive_spapr_ops, tima, TM_QW1_OS, max_prio)) +- return false; ++ goto err_mem_free; + + pr_info("Using %dkB queues\n", 1 << (xive_queue_shift - 10)); + return true; ++ ++err_mem_free: ++ xive_irq_bitmap_remove_all(); ++err_unmap: ++ iounmap(tima); ++ return false; + } diff --git a/patches.suse/powerpc-xive-Fix-refcount-leak-in-xive_spapr_init.patch b/patches.suse/powerpc-xive-Fix-refcount-leak-in-xive_spapr_init.patch new file mode 100644 index 0000000..3523d63 --- /dev/null +++ b/patches.suse/powerpc-xive-Fix-refcount-leak-in-xive_spapr_init.patch @@ -0,0 +1,60 @@ +From 1d1fb9618bdd5a5fbf9a9eb75133da301d33721c Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Thu, 12 May 2022 13:05:33 +0400 +Subject: [PATCH] powerpc/xive: Fix refcount leak in xive_spapr_init +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +References: fate#322438 git-fixes +Patch-mainline: v5.19-rc1 +Git-commit: 1d1fb9618bdd5a5fbf9a9eb75133da301d33721c + +of_find_compatible_node() returns a node pointer with refcount +incremented, we should use of_node_put() on it when done. +Add missing of_node_put() to avoid refcount leak. + +Fixes: eac1e731b59e ("powerpc/xive: guest exploitation of the XIVE interrupt controller") +Signed-off-by: Miaoqian Lin +Reviewed-by: Cédric Le Goater +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220512090535.33397-1-linmq006@gmail.com +Acked-by: Michal Suchanek +--- + arch/powerpc/sysdev/xive/spapr.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c +--- a/arch/powerpc/sysdev/xive/spapr.c ++++ b/arch/powerpc/sysdev/xive/spapr.c +@@ -832,12 +832,12 @@ bool __init xive_spapr_init(void) + /* Resource 1 is the OS ring TIMA */ + if (of_address_to_resource(np, 1, &r)) { + pr_err("Failed to get thread mgmnt area resource\n"); +- return false; ++ goto err_put; + } + tima = ioremap(r.start, resource_size(&r)); + if (!tima) { + pr_err("Failed to map thread mgmnt area\n"); +- return false; ++ goto err_put; + } + + if (!xive_get_max_prio(&max_prio)) +@@ -873,6 +873,7 @@ bool __init xive_spapr_init(void) + if (!xive_core_init(&xive_spapr_ops, tima, TM_QW1_OS, max_prio)) + goto err_mem_free; + ++ of_node_put(np); + pr_info("Using %dkB queues\n", 1 << (xive_queue_shift - 10)); + return true; + +@@ -880,5 +881,7 @@ bool __init xive_spapr_init(void) + xive_irq_bitmap_remove_all(); + err_unmap: + iounmap(tima); ++err_put: ++ of_node_put(np); + return false; + } diff --git a/patches.suse/ppp-ensure-minimum-packet-size-in-ppp_write.patch b/patches.suse/ppp-ensure-minimum-packet-size-in-ppp_write.patch new file mode 100644 index 0000000..114ffd7 --- /dev/null +++ b/patches.suse/ppp-ensure-minimum-packet-size-in-ppp_write.patch @@ -0,0 +1,103 @@ +From c43dcac4c08208102d1309c0db8cc34a9c2605b9 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Wed, 5 Jan 2022 03:48:42 -0800 +Subject: [PATCH 5/6] ppp: ensure minimum packet size in ppp_write() +References: git-fixes +Patch-mainline: v5.17-rc1 +Git-commit: 44073187990d5629804ce0627525f6ea5cfef171 + +It seems pretty clear ppp layer assumed user space +would always be kind to provide enough data +in their write() to a ppp device. + +This patch makes sure user provides at least +2 bytes. + +It adds PPP_PROTO_LEN macro that could replace +in net-next many occurrences of hard-coded 2 value. + +I replaced only one occurrence to ease backports +to stable kernels. + +The bug manifests in the following report: + +BUG: KMSAN: uninit-value in ppp_send_frame+0x28d/0x27c0 drivers/net/ppp/ppp_generic.c:1740 + ppp_send_frame+0x28d/0x27c0 drivers/net/ppp/ppp_generic.c:1740 + __ppp_xmit_process+0x23e/0x4b0 drivers/net/ppp/ppp_generic.c:1640 + ppp_xmit_process+0x1fe/0x480 drivers/net/ppp/ppp_generic.c:1661 + ppp_write+0x5cb/0x5e0 drivers/net/ppp/ppp_generic.c:513 + do_iter_write+0xb0c/0x1500 fs/read_write.c:853 + vfs_writev fs/read_write.c:924 [inline] + do_writev+0x645/0xe00 fs/read_write.c:967 + __do_sys_writev fs/read_write.c:1040 [inline] + __se_sys_writev fs/read_write.c:1037 [inline] + __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037 + do_syscall_x64 arch/x86/entry/common.c:51 [inline] + do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Uninit was created at: + slab_post_alloc_hook mm/slab.h:524 [inline] + slab_alloc_node mm/slub.c:3251 [inline] + __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 + kmalloc_reserve net/core/skbuff.c:354 [inline] + __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 + alloc_skb include/linux/skbuff.h:1126 [inline] + ppp_write+0x11d/0x5e0 drivers/net/ppp/ppp_generic.c:501 + do_iter_write+0xb0c/0x1500 fs/read_write.c:853 + vfs_writev fs/read_write.c:924 [inline] + do_writev+0x645/0xe00 fs/read_write.c:967 + __do_sys_writev fs/read_write.c:1040 [inline] + __se_sys_writev fs/read_write.c:1037 [inline] + __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037 + do_syscall_x64 arch/x86/entry/common.c:51 [inline] + do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Cc: Paul Mackerras +Cc: linux-ppp@vger.kernel.org +Reported-by: syzbot +Acked-by: Guillaume Nault +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ppp/ppp_generic.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c +index d4dd44d0f002..352e751125fb 100644 +--- a/drivers/net/ppp/ppp_generic.c ++++ b/drivers/net/ppp/ppp_generic.c +@@ -72,6 +72,8 @@ + #define MPHDRLEN 6 /* multilink protocol header length */ + #define MPHDRLEN_SSN 4 /* ditto with short sequence numbers */ + ++#define PPP_PROTO_LEN 2 ++ + /* + * An instance of /dev/ppp can be associated with either a ppp + * interface unit or a ppp channel. In both cases, file->private_data +@@ -501,6 +503,9 @@ static ssize_t ppp_write(struct file *file, const char __user *buf, + + if (!pf) + return -ENXIO; ++ /* All PPP packets should start with the 2-byte protocol */ ++ if (count < PPP_PROTO_LEN) ++ return -EINVAL; + ret = -ENOMEM; + skb = alloc_skb(count + pf->hdrlen, GFP_KERNEL); + if (!skb) +@@ -1536,7 +1541,7 @@ ppp_send_frame(struct ppp *ppp, struct sk_buff *skb) + } + + ++ppp->stats64.tx_packets; +- ppp->stats64.tx_bytes += skb->len - 2; ++ ppp->stats64.tx_bytes += skb->len - PPP_PROTO_LEN; + + switch (proto) { + case PPP_IP: +-- +2.16.4 + diff --git a/patches.suse/ptrace-Check-PTRACE_O_SUSPEND_SECCOMP-permission-on-.patch b/patches.suse/ptrace-Check-PTRACE_O_SUSPEND_SECCOMP-permission-on-.patch new file mode 100644 index 0000000..2e09293 --- /dev/null +++ b/patches.suse/ptrace-Check-PTRACE_O_SUSPEND_SECCOMP-permission-on-.patch @@ -0,0 +1,111 @@ +From ee1fee900537b5d9560e9f937402de5ddc8412f3 Mon Sep 17 00:00:00 2001 +From: Jann Horn +Date: Sat, 19 Mar 2022 02:08:37 +0100 +Subject: [PATCH] ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE +Git-commit: ee1fee900537b5d9560e9f937402de5ddc8412f3 +Patch-mainline: v5.18-rc1 +References: CVE-2022-30594 bsc#1199505 bsc#1198413 + +Setting PTRACE_O_SUSPEND_SECCOMP is supposed to be a highly privileged +operation because it allows the tracee to completely bypass all seccomp +filters on kernels with CONFIG_CHECKPOINT_RESTORE=y. It is only supposed to +be settable by a process with global CAP_SYS_ADMIN, and only if that +process is not subject to any seccomp filters at all. + +However, while these permission checks were done on the PTRACE_SETOPTIONS +path, they were missing on the PTRACE_SEIZE path, which also sets +user-specified ptrace flags. + +Move the permissions checks out into a helper function and let both +ptrace_attach() and ptrace_setoptions() call it. + +Cc: stable@kernel.org +Fixes: 13c4a90119d2 ("seccomp: add ptrace options for suspend/resume") +Signed-off-by: Jann Horn +Link: https://lkml.kernel.org/r/20220319010838.1386861-1-jannh@google.com +Signed-off-by: Eric W. Biederman +Acked-by: Michal Koutný +Acked-by: Takashi Iwai + +--- + kernel/ptrace.c | 47 ++++++++++++++++++++++++++++++++--------------- + 1 file changed, 32 insertions(+), 15 deletions(-) + +diff --git a/kernel/ptrace.c b/kernel/ptrace.c +index eea265082e97..ccc4b465775b 100644 +--- a/kernel/ptrace.c ++++ b/kernel/ptrace.c +@@ -371,6 +371,26 @@ bool ptrace_may_access(struct task_struct *task, unsigned int mode) + return !err; + } + ++static int check_ptrace_options(unsigned long data) ++{ ++ if (data & ~(unsigned long)PTRACE_O_MASK) ++ return -EINVAL; ++ ++ if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) { ++ if (!IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) || ++ !IS_ENABLED(CONFIG_SECCOMP)) ++ return -EINVAL; ++ ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EPERM; ++ ++ if (seccomp_mode(¤t->seccomp) != SECCOMP_MODE_DISABLED || ++ current->ptrace & PT_SUSPEND_SECCOMP) ++ return -EPERM; ++ } ++ return 0; ++} ++ + static int ptrace_attach(struct task_struct *task, long request, + unsigned long addr, + unsigned long flags) +@@ -382,8 +402,16 @@ static int ptrace_attach(struct task_struct *task, long request, + if (seize) { + if (addr != 0) + goto out; ++ /* ++ * This duplicates the check in check_ptrace_options() because ++ * ptrace_attach() and ptrace_setoptions() have historically ++ * used different error codes for unknown ptrace options. ++ */ + if (flags & ~(unsigned long)PTRACE_O_MASK) + goto out; ++ retval = check_ptrace_options(flags); ++ if (retval) ++ return retval; + flags = PT_PTRACED | PT_SEIZED | (flags << PT_OPT_FLAG_SHIFT); + } else { + flags = PT_PTRACED; +@@ -654,22 +682,11 @@ int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long ds + static int ptrace_setoptions(struct task_struct *child, unsigned long data) + { + unsigned flags; ++ int ret; + +- if (data & ~(unsigned long)PTRACE_O_MASK) +- return -EINVAL; +- +- if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) { +- if (!IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) || +- !IS_ENABLED(CONFIG_SECCOMP)) +- return -EINVAL; +- +- if (!capable(CAP_SYS_ADMIN)) +- return -EPERM; +- +- if (seccomp_mode(¤t->seccomp) != SECCOMP_MODE_DISABLED || +- current->ptrace & PT_SUSPEND_SECCOMP) +- return -EPERM; +- } ++ ret = check_ptrace_options(data); ++ if (ret) ++ return ret; + + /* Avoid intermediate state when all opts are cleared */ + flags = child->ptrace; +-- +2.31.1 + diff --git a/patches.suse/ptrace-Check-PTRACE_O_SUSPEND_SECCOMP-permission-on-PTRACE_SEIZE.patch b/patches.suse/ptrace-Check-PTRACE_O_SUSPEND_SECCOMP-permission-on-PTRACE_SEIZE.patch deleted file mode 100644 index ad8f139..0000000 --- a/patches.suse/ptrace-Check-PTRACE_O_SUSPEND_SECCOMP-permission-on-PTRACE_SEIZE.patch +++ /dev/null @@ -1,106 +0,0 @@ -From: Jann Horn -Date: Sat, 19 Mar 2022 02:08:37 +0100 -Subject: ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE -Git-commit: ee1fee900537b5d9560e9f937402de5ddc8412f3 -Patch-mainline: v5.18-rc1 -References: bsc#1198413 - -Setting PTRACE_O_SUSPEND_SECCOMP is supposed to be a highly privileged -operation because it allows the tracee to completely bypass all seccomp -filters on kernels with CONFIG_CHECKPOINT_RESTORE=y. It is only supposed to -be settable by a process with global CAP_SYS_ADMIN, and only if that -process is not subject to any seccomp filters at all. - -However, while these permission checks were done on the PTRACE_SETOPTIONS -path, they were missing on the PTRACE_SEIZE path, which also sets -user-specified ptrace flags. - -Move the permissions checks out into a helper function and let both -ptrace_attach() and ptrace_setoptions() call it. - -Cc: stable@kernel.org -Fixes: 13c4a90119d2 ("seccomp: add ptrace options for suspend/resume") -Signed-off-by: Jann Horn -Link: https://lkml.kernel.org/r/20220319010838.1386861-1-jannh@google.com -Signed-off-by: Eric W. Biederman -Acked-by: Michal Koutný ---- - kernel/ptrace.c | 47 ++++++++++++++++++++++++++++++++--------------- - 1 file changed, 32 insertions(+), 15 deletions(-) - -diff --git a/kernel/ptrace.c b/kernel/ptrace.c -index eea265082e97..ccc4b465775b 100644 ---- a/kernel/ptrace.c -+++ b/kernel/ptrace.c -@@ -371,6 +371,26 @@ bool ptrace_may_access(struct task_struct *task, unsigned int mode) - return !err; - } - -+static int check_ptrace_options(unsigned long data) -+{ -+ if (data & ~(unsigned long)PTRACE_O_MASK) -+ return -EINVAL; -+ -+ if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) { -+ if (!IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) || -+ !IS_ENABLED(CONFIG_SECCOMP)) -+ return -EINVAL; -+ -+ if (!capable(CAP_SYS_ADMIN)) -+ return -EPERM; -+ -+ if (seccomp_mode(¤t->seccomp) != SECCOMP_MODE_DISABLED || -+ current->ptrace & PT_SUSPEND_SECCOMP) -+ return -EPERM; -+ } -+ return 0; -+} -+ - static int ptrace_attach(struct task_struct *task, long request, - unsigned long addr, - unsigned long flags) -@@ -382,8 +402,16 @@ static int ptrace_attach(struct task_struct *task, long request, - if (seize) { - if (addr != 0) - goto out; -+ /* -+ * This duplicates the check in check_ptrace_options() because -+ * ptrace_attach() and ptrace_setoptions() have historically -+ * used different error codes for unknown ptrace options. -+ */ - if (flags & ~(unsigned long)PTRACE_O_MASK) - goto out; -+ retval = check_ptrace_options(flags); -+ if (retval) -+ return retval; - flags = PT_PTRACED | PT_SEIZED | (flags << PT_OPT_FLAG_SHIFT); - } else { - flags = PT_PTRACED; -@@ -654,22 +682,11 @@ int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long ds - static int ptrace_setoptions(struct task_struct *child, unsigned long data) - { - unsigned flags; -+ int ret; - -- if (data & ~(unsigned long)PTRACE_O_MASK) -- return -EINVAL; -- -- if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) { -- if (!IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) || -- !IS_ENABLED(CONFIG_SECCOMP)) -- return -EINVAL; -- -- if (!capable(CAP_SYS_ADMIN)) -- return -EPERM; -- -- if (seccomp_mode(¤t->seccomp) != SECCOMP_MODE_DISABLED || -- current->ptrace & PT_SUSPEND_SECCOMP) -- return -EPERM; -- } -+ ret = check_ptrace_options(data); -+ if (ret) -+ return ret; - - /* Avoid intermediate state when all opts are cleared */ - flags = child->ptrace; - diff --git a/patches.suse/qed-display-VF-trust-config.patch b/patches.suse/qed-display-VF-trust-config.patch new file mode 100644 index 0000000..e47ba40 --- /dev/null +++ b/patches.suse/qed-display-VF-trust-config.patch @@ -0,0 +1,36 @@ +From 632111b307cee51528cba551a2a38a5965a489e9 Mon Sep 17 00:00:00 2001 +From: Manish Chopra +Date: Wed, 2 Mar 2022 02:52:21 -0800 +Subject: [PATCH 5/8] qed: display VF trust config +Git-commit: 4e6e6bec7440b9b76f312f28b1f4e944eebb3abc +Patch-mainline: v5.18-rc1 +References: git-fixes + +Driver does support SR-IOV VFs trust configuration but +it does not display it when queried via ip link utility. + +Cc: stable@vger.kernel.org +Fixes: f990c82c385b ("qed*: Add support for ndo_set_vf_trust") +Signed-off-by: Manish Chopra +Signed-off-by: Ariel Elior +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/qlogic/qed/qed_sriov.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +index 4cc319a1e1e3..bbc8611c4067 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +@@ -4717,6 +4717,7 @@ static int qed_get_vf_config(struct qed_dev *cdev, + tx_rate = vf_info->tx_rate; + ivi->max_tx_rate = tx_rate ? tx_rate : link.speed; + ivi->min_tx_rate = qed_iov_get_vf_min_rate(hwfn, vf_id); ++ ivi->trusted = vf_info->is_trusted_request; + + return 0; + } +-- +2.16.4 + diff --git a/patches.suse/qed-return-status-of-qed_iov_get_link.patch b/patches.suse/qed-return-status-of-qed_iov_get_link.patch new file mode 100644 index 0000000..4424d01 --- /dev/null +++ b/patches.suse/qed-return-status-of-qed_iov_get_link.patch @@ -0,0 +1,86 @@ +From c4075aa54eecb42b16cc9a799b7effdd1b1ad383 Mon Sep 17 00:00:00 2001 +From: Tom Rix +Date: Sat, 5 Mar 2022 07:06:42 -0800 +Subject: [PATCH 3/8] qed: return status of qed_iov_get_link +Git-commit: d9dc0c84ad2d4cc911ba252c973d1bf18d5eb9cf +Patch-mainline: v5.17-rc8 +References: git-fixes + +Clang static analysis reports this issue +qed_sriov.c:4727:19: warning: Assigned value is + garbage or undefined + ivi->max_tx_rate = tx_rate ? tx_rate : link.speed; + ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +link is only sometimes set by the call to qed_iov_get_link() +qed_iov_get_link fails without setting link or returning +status. So change the decl to return status. + +Fixes: 73390ac9d82b ("qed*: support ndo_get_vf_config") +Signed-off-by: Tom Rix +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/qlogic/qed/qed_sriov.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +index 7411e23481f2..4cc319a1e1e3 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +@@ -3801,11 +3801,11 @@ bool qed_iov_mark_vf_flr(struct qed_hwfn *p_hwfn, u32 *p_disabled_vfs) + return found; + } + +-static void qed_iov_get_link(struct qed_hwfn *p_hwfn, +- u16 vfid, +- struct qed_mcp_link_params *p_params, +- struct qed_mcp_link_state *p_link, +- struct qed_mcp_link_capabilities *p_caps) ++static int qed_iov_get_link(struct qed_hwfn *p_hwfn, ++ u16 vfid, ++ struct qed_mcp_link_params *p_params, ++ struct qed_mcp_link_state *p_link, ++ struct qed_mcp_link_capabilities *p_caps) + { + struct qed_vf_info *p_vf = qed_iov_get_vf_info(p_hwfn, + vfid, +@@ -3813,7 +3813,7 @@ static void qed_iov_get_link(struct qed_hwfn *p_hwfn, + struct qed_bulletin_content *p_bulletin; + + if (!p_vf) +- return; ++ return -EINVAL; + + p_bulletin = p_vf->bulletin.p_virt; + +@@ -3823,6 +3823,7 @@ static void qed_iov_get_link(struct qed_hwfn *p_hwfn, + __qed_vf_get_link_state(p_hwfn, p_link, p_bulletin); + if (p_caps) + __qed_vf_get_link_caps(p_hwfn, p_caps, p_bulletin); ++ return 0; + } + + static int +@@ -4684,6 +4685,7 @@ static int qed_get_vf_config(struct qed_dev *cdev, + struct qed_public_vf_info *vf_info; + struct qed_mcp_link_state link; + u32 tx_rate; ++ int ret; + + /* Sanitize request */ + if (IS_VF(cdev)) +@@ -4697,7 +4699,9 @@ static int qed_get_vf_config(struct qed_dev *cdev, + + vf_info = qed_iov_get_public_vf_info(hwfn, vf_id, true); + +- qed_iov_get_link(hwfn, vf_id, NULL, &link, NULL); ++ ret = qed_iov_get_link(hwfn, vf_id, NULL, &link, NULL); ++ if (ret) ++ return ret; + + /* Fill information about VF */ + ivi->vf = vf_id; +-- +2.16.4 + diff --git a/patches.suse/qed-validate-and-restrict-untrusted-VFs-vlan-promisc.patch b/patches.suse/qed-validate-and-restrict-untrusted-VFs-vlan-promisc.patch new file mode 100644 index 0000000..ad8ec03 --- /dev/null +++ b/patches.suse/qed-validate-and-restrict-untrusted-VFs-vlan-promisc.patch @@ -0,0 +1,115 @@ +From 9209700b1f818bdbcfd9452fc944e6622b22e22e Mon Sep 17 00:00:00 2001 +From: Manish Chopra +Date: Wed, 2 Mar 2022 02:52:22 -0800 +Subject: [PATCH 6/8] qed: validate and restrict untrusted VFs vlan promisc + mode +Git-commit: cbcc44db2cf7b836896733acc0e5ea966136ed22 +Patch-mainline: v5.18-rc1 +References: git-fixes + +Today when VFs are put in promiscuous mode, they can request PF +to configure device for them to receive all VLANs traffic regardless +of what vlan is configured by the PF (via ip link) and PF allows this +config request regardless of whether VF is trusted or not. + +From security POV, when VLAN is configured for VF through PF (via ip link), +honour such config requests from VF only when they are configured to be +trusted, otherwise restrict such VFs vlan promisc mode config. + +Cc: stable@vger.kernel.org +Fixes: f990c82c385b ("qed*: Add support for ndo_set_vf_trust") +Signed-off-by: Manish Chopra +Signed-off-by: Ariel Elior +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/qlogic/qed/qed_sriov.c | 28 ++++++++++++++++++++++++++-- + drivers/net/ethernet/qlogic/qed/qed_sriov.h | 1 + + 2 files changed, 27 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +index bbc8611c4067..40d9939f4997 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +@@ -3003,12 +3003,16 @@ static int qed_iov_pre_update_vport(struct qed_hwfn *hwfn, + u8 mask = QED_ACCEPT_UCAST_UNMATCHED | QED_ACCEPT_MCAST_UNMATCHED; + struct qed_filter_accept_flags *flags = ¶ms->accept_flags; + struct qed_public_vf_info *vf_info; ++ u16 tlv_mask; ++ ++ tlv_mask = BIT(QED_IOV_VP_UPDATE_ACCEPT_PARAM) | ++ BIT(QED_IOV_VP_UPDATE_ACCEPT_ANY_VLAN); + + /* Untrusted VFs can't even be trusted to know that fact. + * Simply indicate everything is configured fine, and trace + * configuration 'behind their back'. + */ +- if (!(*tlvs & BIT(QED_IOV_VP_UPDATE_ACCEPT_PARAM))) ++ if (!(*tlvs & tlv_mask)) + return 0; + + vf_info = qed_iov_get_public_vf_info(hwfn, vfid, true); +@@ -3025,6 +3029,13 @@ static int qed_iov_pre_update_vport(struct qed_hwfn *hwfn, + flags->tx_accept_filter &= ~mask; + } + ++ if (params->update_accept_any_vlan_flg) { ++ vf_info->accept_any_vlan = params->accept_any_vlan; ++ ++ if (vf_info->forced_vlan && !vf_info->is_trusted_configured) ++ params->accept_any_vlan = false; ++ } ++ + return 0; + } + +@@ -5148,6 +5159,12 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn) + + params.update_ctl_frame_check = 1; + params.mac_chk_en = !vf_info->is_trusted_configured; ++ params.update_accept_any_vlan_flg = 0; ++ ++ if (vf_info->accept_any_vlan && vf_info->forced_vlan) { ++ params.update_accept_any_vlan_flg = 1; ++ params.accept_any_vlan = vf_info->accept_any_vlan; ++ } + + if (vf_info->rx_accept_mode & mask) { + flags->update_rx_mode_config = 1; +@@ -5163,13 +5180,20 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn) + if (!vf_info->is_trusted_configured) { + flags->rx_accept_filter &= ~mask; + flags->tx_accept_filter &= ~mask; ++ params.accept_any_vlan = false; + } + + if (flags->update_rx_mode_config || + flags->update_tx_mode_config || +- params.update_ctl_frame_check) ++ params.update_ctl_frame_check || ++ params.update_accept_any_vlan_flg) { ++ DP_VERBOSE(hwfn, QED_MSG_IOV, ++ "vport update config for %s VF[abs 0x%x rel 0x%x]\n", ++ vf_info->is_trusted_configured ? "trusted" : "untrusted", ++ vf->abs_vf_id, vf->relative_vf_id); + qed_sp_vport_update(hwfn, ¶ms, + QED_SPQ_MODE_EBLOCK, NULL); ++ } + } + } + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.h b/drivers/net/ethernet/qlogic/qed/qed_sriov.h +index 9a8fd79611f2..853be06bccdf 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.h ++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.h +@@ -88,6 +88,7 @@ struct qed_public_vf_info { + bool is_trusted_request; + u8 rx_accept_mode; + u8 tx_accept_mode; ++ bool accept_any_vlan; + }; + + struct qed_iov_vf_init_params { +-- +2.16.4 + diff --git a/patches.suse/random-check-for-signal_pending-outside-of-need_resc.patch b/patches.suse/random-check-for-signal_pending-outside-of-need_resc.patch new file mode 100644 index 0000000..67a5fc7 --- /dev/null +++ b/patches.suse/random-check-for-signal_pending-outside-of-need_resc.patch @@ -0,0 +1,44 @@ +From: Jann Horn +Date: Tue, 5 Apr 2022 18:39:31 +0200 +Subject: random: check for signal_pending() outside of need_resched() check +Git-commit: 1448769c9cdb69ad65287f4f7ab58bc5f2f5d7ba +Patch-mainline: 5.18-rc2 +References: git-fixes + +signal_pending() checks TIF_NOTIFY_SIGNAL and TIF_SIGPENDING, which +signal that the task should bail out of the syscall when possible. This +is a separate concept from need_resched(), which checks +TIF_NEED_RESCHED, signaling that the task should preempt. + +In particular, with the current code, the signal_pending() bailout +probably won't work reliably. + +Change this to look like other functions that read lots of data, such as +read_zero(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Jann Horn +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Jiri Slaby +--- + drivers/char/random.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -1035,13 +1035,13 @@ static ssize_t extract_crng_user(void __ + int large_request = (nbytes > 256); + + while (nbytes) { +- if (large_request && need_resched()) { ++ if (large_request) { + if (signal_pending(current)) { + if (ret == 0) + ret = -ERESTARTSYS; + break; + } +- schedule(); ++ cond_resched(); + } + + extract_crng(tmp); diff --git a/patches.suse/random-fix-data-race-on-crng_node_pool.patch b/patches.suse/random-fix-data-race-on-crng_node_pool.patch new file mode 100644 index 0000000..ef23052 --- /dev/null +++ b/patches.suse/random-fix-data-race-on-crng_node_pool.patch @@ -0,0 +1,104 @@ +From: Eric Biggers +Date: Mon, 20 Dec 2021 16:41:56 -0600 +Subject: random: fix data race on crng_node_pool +Git-commit: 5d73d1e320c3fd94ea15ba5f79301da9a8bcc7de +Patch-mainline: 5.17-rc1 +References: git-fixes + +extract_crng() and crng_backtrack_protect() load crng_node_pool with a +plain load, which causes undefined behavior if do_numa_crng_init() +modifies it concurrently. + +Fix this by using READ_ONCE(). Note: as per the previous discussion +https://lore.kernel.org/lkml/20211219025139.31085-1-ebiggers@kernel.org/T/#u, +READ_ONCE() is believed to be sufficient here, and it was requested that +it be used here instead of smp_load_acquire(). + +Also change do_numa_crng_init() to set crng_node_pool using +cmpxchg_release() instead of mb() + cmpxchg(), as the former is +sufficient here but is more lightweight. + +Fixes: 1e7f583af67b ("random: make /dev/urandom scalable for silly userspace programs") +Cc: stable@vger.kernel.org +Signed-off-by: Eric Biggers +Acked-by: Paul E. McKenney +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Jiri Slaby +--- + drivers/char/random.c | 42 ++++++++++++++++++++++-------------------- + 1 file changed, 22 insertions(+), 20 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -814,8 +814,8 @@ static void do_numa_crng_init(struct wor + crng_initialize(crng); + pool[i] = crng; + } +- mb(); +- if (cmpxchg(&crng_node_pool, NULL, pool)) { ++ /* pairs with READ_ONCE() in select_crng() */ ++ if (cmpxchg_release(&crng_node_pool, NULL, pool) != NULL) { + for_each_node(i) + kfree(pool[i]); + kfree(pool); +@@ -828,8 +828,26 @@ static void numa_crng_init(void) + { + schedule_work(&numa_crng_init_work); + } ++ ++static struct crng_state *select_crng(void) ++{ ++ struct crng_state **pool; ++ int nid = numa_node_id(); ++ ++ /* pairs with cmpxchg_release() in do_numa_crng_init() */ ++ pool = READ_ONCE(crng_node_pool); ++ if (pool && pool[nid]) ++ return pool[nid]; ++ ++ return &primary_crng; ++} + #else + static void numa_crng_init(void) {} ++ ++static struct crng_state *select_crng(void) ++{ ++ return &primary_crng; ++} + #endif + + /* +@@ -978,15 +996,7 @@ static void _extract_crng(struct crng_st + + static void extract_crng(__u8 out[CHACHA20_BLOCK_SIZE]) + { +- struct crng_state *crng = NULL; +- +-#ifdef CONFIG_NUMA +- if (crng_node_pool) +- crng = crng_node_pool[numa_node_id()]; +- if (crng == NULL) +-#endif +- crng = &primary_crng; +- _extract_crng(crng, out); ++ _extract_crng(select_crng(), out); + } + + /* +@@ -1015,15 +1025,7 @@ static void _crng_backtrack_protect(stru + + static void crng_backtrack_protect(__u8 tmp[CHACHA20_BLOCK_SIZE], int used) + { +- struct crng_state *crng = NULL; +- +-#ifdef CONFIG_NUMA +- if (crng_node_pool) +- crng = crng_node_pool[numa_node_id()]; +- if (crng == NULL) +-#endif +- crng = &primary_crng; +- _crng_backtrack_protect(crng, tmp, used); ++ _crng_backtrack_protect(select_crng(), tmp, used); + } + + static ssize_t extract_crng_user(void __user *buf, size_t nbytes) diff --git a/patches.suse/revert-scsi-qla2xxx-Changes-to-support-FCP2-Target.patch b/patches.suse/revert-scsi-qla2xxx-Changes-to-support-FCP2-Target.patch new file mode 100644 index 0000000..5690d92 --- /dev/null +++ b/patches.suse/revert-scsi-qla2xxx-Changes-to-support-FCP2-Target.patch @@ -0,0 +1,48 @@ +From: David Bond +Date: Tue, 31 May 2022 08:53:10 -0600 +Subject: revert scsi: qla2xxx: Changes to support FCP2 Target +Patch-mainline: Never, revert of mainline commit causing customer issue for test package +References: bsc#1198438 + +Revert Adding changes to support FCP2 Target. +--- + +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 88c5a8ec0e7c..4b27eebbc1b3 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -1821,13 +1821,6 @@ void qla2x00_handle_rscn(scsi_qla_host_t *vha, struct event_arg *ea) + case RSCN_PORT_ADDR: + fcport = qla2x00_find_fcport_by_nportid(vha, &ea->id, 1); + if (fcport) { +- if (fcport->flags & FCF_FCP2_DEVICE) { +- ql_dbg(ql_dbg_disc, vha, 0x2115, +- "Delaying session delete for FCP2 portid=%06x %8phC ", +- fcport->d_id.b24, fcport->port_name); +- return; +- } +- + if (vha->hw->flags.edif_enabled && DBELL_ACTIVE(vha)) { + /* + * On ipsec start by remote port, Target port +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 850fc95f7033..9285db77b95d 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -4062,16 +4062,6 @@ qla2x00_mark_all_devices_lost(scsi_qla_host_t *vha) + "Mark all dev lost\n"); + + list_for_each_entry(fcport, &vha->vp_fcports, list) { +- if (fcport->loop_id != FC_NO_LOOP_ID && +- (fcport->flags & FCF_FCP2_DEVICE) && +- fcport->port_type == FCT_TARGET && +- !qla2x00_reset_active(vha)) { +- ql_dbg(ql_dbg_disc, vha, 0x211a, +- "Delaying session delete for FCP2 flags 0x%x port_type = 0x%x port_id=%06x %phC", +- fcport->flags, fcport->port_type, +- fcport->d_id.b24, fcport->port_name); +- continue; +- } + fcport->scan_state = 0; + qlt_schedule_sess_for_deletion(fcport); + } diff --git a/patches.suse/rtl8187-fix-control-message-timeouts.patch b/patches.suse/rtl8187-fix-control-message-timeouts.patch new file mode 100644 index 0000000..519d89b --- /dev/null +++ b/patches.suse/rtl8187-fix-control-message-timeouts.patch @@ -0,0 +1,91 @@ +From 2e9be536a213e838daed6ba42024dd68954ac061 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 25 Oct 2021 14:05:21 +0200 +Subject: [PATCH] rtl8187: fix control-message timeouts +Git-commit: 2e9be536a213e838daed6ba42024dd68954ac061 +References: git-fixes +Patch-mainline: v5.16-rc1 + +USB control-message timeouts are specified in milliseconds and should +specifically not vary with CONFIG_HZ. + +Fixes: 605bebe23bf6 ("[PATCH] Add rtl8187 wireless driver") +Cc: stable@vger.kernel.org # 2.6.23 +Signed-off-by: Johan Hovold +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211025120522.6045-4-johan@kernel.org +Signed-off-by: Oliver Neukum +--- + .../net/wireless/realtek/rtl818x/rtl8187/rtl8225.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c +index 585784258c66..4efab907a3ac 100644 +--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c ++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c +@@ -28,7 +28,7 @@ u8 rtl818x_ioread8_idx(struct rtl8187_priv *priv, + usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0), + RTL8187_REQ_GET_REG, RTL8187_REQT_READ, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits8, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits8, sizeof(val), 500); + + val = priv->io_dmabuf->bits8; + mutex_unlock(&priv->io_mutex); +@@ -45,7 +45,7 @@ u16 rtl818x_ioread16_idx(struct rtl8187_priv *priv, + usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0), + RTL8187_REQ_GET_REG, RTL8187_REQT_READ, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits16, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits16, sizeof(val), 500); + + val = priv->io_dmabuf->bits16; + mutex_unlock(&priv->io_mutex); +@@ -62,7 +62,7 @@ u32 rtl818x_ioread32_idx(struct rtl8187_priv *priv, + usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0), + RTL8187_REQ_GET_REG, RTL8187_REQT_READ, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits32, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits32, sizeof(val), 500); + + val = priv->io_dmabuf->bits32; + mutex_unlock(&priv->io_mutex); +@@ -79,7 +79,7 @@ void rtl818x_iowrite8_idx(struct rtl8187_priv *priv, + usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), + RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits8, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits8, sizeof(val), 500); + + mutex_unlock(&priv->io_mutex); + } +@@ -93,7 +93,7 @@ void rtl818x_iowrite16_idx(struct rtl8187_priv *priv, + usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), + RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits16, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits16, sizeof(val), 500); + + mutex_unlock(&priv->io_mutex); + } +@@ -107,7 +107,7 @@ void rtl818x_iowrite32_idx(struct rtl8187_priv *priv, + usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), + RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits32, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits32, sizeof(val), 500); + + mutex_unlock(&priv->io_mutex); + } +@@ -183,7 +183,7 @@ static void rtl8225_write_8051(struct ieee80211_hw *dev, u8 addr, __le16 data) + usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), + RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, + addr, 0x8225, &priv->io_dmabuf->bits16, sizeof(data), +- HZ / 2); ++ 500); + + mutex_unlock(&priv->io_mutex); + +-- +2.34.1 + diff --git a/patches.suse/sched-core-Add-__sched-tag-for-io_schedule.patch b/patches.suse/sched-core-Add-__sched-tag-for-io_schedule.patch new file mode 100644 index 0000000..0cecc78 --- /dev/null +++ b/patches.suse/sched-core-Add-__sched-tag-for-io_schedule.patch @@ -0,0 +1,48 @@ +From e3b929b0a184edb35531153c5afcaebb09014f9d Mon Sep 17 00:00:00 2001 +From: Gao Xiang +Date: Mon, 3 Jun 2019 17:13:38 +0800 +Subject: [PATCH] sched/core: Add __sched tag for io_schedule() +Git-commit: e3b929b0a184edb35531153c5afcaebb09014f9d +Patch-mainline: v5.3-rc1 +References: git-fixes + +Non-inline io_schedule() was introduced in: + + commit 10ab56434f2f ("sched/core: Separate out io_schedule_prepare() and io_schedule_finish()") + +Keep in line with io_schedule_timeout(), otherwise "/proc//wchan" will +report io_schedule() rather than its callers when waiting for IO. + +Reported-by: Jilong Kou +Signed-off-by: Gao Xiang +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Tejun Heo +Cc: Andrew Morton +Cc: Linus Torvalds +Cc: Miao Xie +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Fixes: 10ab56434f2f ("sched/core: Separate out io_schedule_prepare() and io_schedule_finish()") +Link: https://lkml.kernel.org/r/20190603091338.2695-1-gaoxiang25@huawei.com +Signed-off-by: Ingo Molnar +Signed-off-by: Frederic Weisbecker +--- + kernel/sched/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 29984d8c41f0..cd047927f707 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -5122,7 +5122,7 @@ long __sched io_schedule_timeout(long timeout) + } + EXPORT_SYMBOL(io_schedule_timeout); + +-void io_schedule(void) ++void __sched io_schedule(void) + { + int token; + +-- +2.25.1 + diff --git a/patches.suse/sched-core-Fix-comment-regarding-nr_iowait_cpu-and-g.patch b/patches.suse/sched-core-Fix-comment-regarding-nr_iowait_cpu-and-g.patch new file mode 100644 index 0000000..999ab32 --- /dev/null +++ b/patches.suse/sched-core-Fix-comment-regarding-nr_iowait_cpu-and-g.patch @@ -0,0 +1,48 @@ +From 9c2298aad355d8c1957df3015448fef333526934 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Thu, 4 Oct 2018 11:05:14 +0200 +Subject: [PATCH] sched/core: Fix comment regarding nr_iowait_cpu() and + get_iowait_load() +Git-commit: 9c2298aad355d8c1957df3015448fef333526934 +Patch-mainline: v4.20-rc1 +References: git-fixes + +The comment related to nr_iowait_cpu() and get_iowait_load() confuses +cpufreq with cpuidle and is not very useful for this reason, so fix it. + +Signed-off-by: Rafael J. Wysocki +Acked-by: Peter Zijlstra +Cc: Linus Torvalds +Cc: Linux PM +Cc: Tejun Heo +Cc: Thomas Gleixner +Fixes: e33a9bba85a8 "sched/core: move IO scheduling accounting from io_schedule_timeout() into scheduler" +Link: http://lkml.kernel.org/r/3803514.xkx7zY50tF@aspire.rjw.lan +Signed-off-by: Ingo Molnar +Signed-off-by: Frederic Weisbecker +--- + kernel/sched/core.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 56b3c1781276..fe0223121883 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -2916,10 +2916,10 @@ unsigned long nr_iowait(void) + } + + /* +- * Consumers of these two interfaces, like for example the cpufreq menu +- * governor are using nonsensical data. Boosting frequency for a CPU that has +- * IO-wait which might not even end up running the task when it does become +- * runnable. ++ * Consumers of these two interfaces, like for example the cpuidle menu ++ * governor, are using nonsensical data. Preferring shallow idle state selection ++ * for a CPU that has IO-wait which might not even end up running the task when ++ * it does become runnable. + */ + + unsigned long nr_iowait_cpu(int cpu) +-- +2.25.1 + diff --git a/patches.suse/sched-debug-Remove-mpol_get-put-and-task_lock-unlock.patch b/patches.suse/sched-debug-Remove-mpol_get-put-and-task_lock-unlock.patch new file mode 100644 index 0000000..bbbdeb0 --- /dev/null +++ b/patches.suse/sched-debug-Remove-mpol_get-put-and-task_lock-unlock.patch @@ -0,0 +1,59 @@ +From 28c988c3ec29db74a1dda631b18785958d57df4f Mon Sep 17 00:00:00 2001 +From: Bharata B Rao +Date: Tue, 18 Jan 2022 10:35:15 +0530 +Subject: [PATCH] sched/debug: Remove mpol_get/put and task_lock/unlock from + sched_show_numa +Git-commit: 28c988c3ec29db74a1dda631b18785958d57df4f +Patch-mainline: v5.18-rc1 +References: git-fixes + +The older format of /proc/pid/sched printed home node info which +required the mempolicy and task lock around mpol_get(). However +the format has changed since then and there is no need for +sched_show_numa() any more to have mempolicy argument, +asssociated mpol_get/put and task_lock/unlock. Remove them. + +Fixes: 397f2378f1361 ("sched/numa: Fix numa balancing stats in /proc/pid/sched") +Signed-off-by: Bharata B Rao +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Srikar Dronamraju +Acked-by: Mel Gorman +Link: https://lore.kernel.org/r/20220118050515.2973-1-bharata@amd.com +Signed-off-by: Frederic Weisbecker +--- + kernel/sched/debug.c | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c +index aa29211de1bf..102d6f70e84d 100644 +--- a/kernel/sched/debug.c ++++ b/kernel/sched/debug.c +@@ -931,25 +931,15 @@ void print_numa_stats(struct seq_file *m, int node, unsigned long tsf, + static void sched_show_numa(struct task_struct *p, struct seq_file *m) + { + #ifdef CONFIG_NUMA_BALANCING +- struct mempolicy *pol; +- + if (p->mm) + P(mm->numa_scan_seq); + +- task_lock(p); +- pol = p->mempolicy; +- if (pol && !(pol->flags & MPOL_F_MORON)) +- pol = NULL; +- mpol_get(pol); +- task_unlock(p); +- + P(numa_pages_migrated); + P(numa_preferred_nid); + P(total_numa_faults); + SEQ_printf(m, "current_node=%d, numa_group_id=%d\n", + task_node(p), task_numa_group_id(p)); + show_numa_stats(p, m); +- mpol_put(pol); + #endif + } + +-- +2.25.1 + diff --git a/patches.suse/scsi-bnx2fc-Make-bnx2fc_recv_frame-mp-safe b/patches.suse/scsi-bnx2fc-Make-bnx2fc_recv_frame-mp-safe new file mode 100644 index 0000000..f111cbd --- /dev/null +++ b/patches.suse/scsi-bnx2fc-Make-bnx2fc_recv_frame-mp-safe @@ -0,0 +1,93 @@ +From: John Meneghini +Date: Mon, 24 Jan 2022 09:51:10 -0500 +Subject: scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe +Git-commit: 936bd03405fc83ba039d42bc93ffd4b88418f1d3 +Patch-mainline: v5.17-rc3 +References: git-fixes + +Running tests with a debug kernel shows that bnx2fc_recv_frame() is +modifying the per_cpu lport stats counters in a non-mpsafe way. Just boot +a debug kernel and run the bnx2fc driver with the hardware enabled. + +[ 1391.699147] BUG: using smp_processor_id() in preemptible [00000000] code: bnx2fc_ +[ 1391.699160] caller is bnx2fc_recv_frame+0xbf9/0x1760 [bnx2fc] +[ 1391.699174] CPU: 2 PID: 4355 Comm: bnx2fc_l2_threa Kdump: loaded Tainted: G B +[ 1391.699180] Hardware name: HP ProLiant DL120 G7, BIOS J01 07/01/2013 +[ 1391.699183] Call Trace: +[ 1391.699188] dump_stack_lvl+0x57/0x7d +[ 1391.699198] check_preemption_disabled+0xc8/0xd0 +[ 1391.699205] bnx2fc_recv_frame+0xbf9/0x1760 [bnx2fc] +[ 1391.699215] ? do_raw_spin_trylock+0xb5/0x180 +[ 1391.699221] ? bnx2fc_npiv_create_vports.isra.0+0x4e0/0x4e0 [bnx2fc] +[ 1391.699229] ? bnx2fc_l2_rcv_thread+0xb7/0x3a0 [bnx2fc] +[ 1391.699240] bnx2fc_l2_rcv_thread+0x1af/0x3a0 [bnx2fc] +[ 1391.699250] ? bnx2fc_ulp_init+0xc0/0xc0 [bnx2fc] +[ 1391.699258] kthread+0x364/0x420 +[ 1391.699263] ? _raw_spin_unlock_irq+0x24/0x50 +[ 1391.699268] ? set_kthread_struct+0x100/0x100 +[ 1391.699273] ret_from_fork+0x22/0x30 + +Restore the old get_cpu/put_cpu code with some modifications to reduce the +size of the critical section. + +Link: https://lore.kernel.org/r/20220124145110.442335-1-jmeneghi@redhat.com +Fixes: d576a5e80cd0 ("bnx2fc: Improve stats update mechanism") +Tested-by: Guangwu Zhang +Acked-by: Saurav Kashyap +Signed-off-by: John Meneghini +Signed-off-by: Martin K. Petersen +Acked-by: Lee Duncan +--- + drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 21 +++++++++++++-------- + 1 file changed, 13 insertions(+), 8 deletions(-) + +diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +index 9be273c320e2..a826456c6075 100644 +--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c ++++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +@@ -508,7 +508,8 @@ static int bnx2fc_l2_rcv_thread(void *arg) + + static void bnx2fc_recv_frame(struct sk_buff *skb) + { +- u32 fr_len; ++ u64 crc_err; ++ u32 fr_len, fr_crc; + struct fc_lport *lport; + struct fcoe_rcv_info *fr; + struct fc_stats *stats; +@@ -542,6 +543,11 @@ static void bnx2fc_recv_frame(struct sk_buff *skb) + skb_pull(skb, sizeof(struct fcoe_hdr)); + fr_len = skb->len - sizeof(struct fcoe_crc_eof); + ++ stats = per_cpu_ptr(lport->stats, get_cpu()); ++ stats->RxFrames++; ++ stats->RxWords += fr_len / FCOE_WORD_TO_BYTE; ++ put_cpu(); ++ + fp = (struct fc_frame *)skb; + fc_frame_init(fp); + fr_dev(fp) = lport; +@@ -624,16 +630,15 @@ static void bnx2fc_recv_frame(struct sk_buff *skb) + return; + } + +- stats = per_cpu_ptr(lport->stats, smp_processor_id()); +- stats->RxFrames++; +- stats->RxWords += fr_len / FCOE_WORD_TO_BYTE; ++ fr_crc = le32_to_cpu(fr_crc(fp)); + +- if (le32_to_cpu(fr_crc(fp)) != +- ~crc32(~0, skb->data, fr_len)) { +- if (stats->InvalidCRCCount < 5) ++ if (unlikely(fr_crc != ~crc32(~0, skb->data, fr_len))) { ++ stats = per_cpu_ptr(lport->stats, get_cpu()); ++ crc_err = (stats->InvalidCRCCount++); ++ put_cpu(); ++ if (crc_err < 5) + printk(KERN_WARNING PFX "dropping frame with " + "CRC error\n"); +- stats->InvalidCRCCount++; + kfree_skb(skb); + return; + } + diff --git a/patches.suse/scsi-fnic-Fix-a-tracing-statement b/patches.suse/scsi-fnic-Fix-a-tracing-statement new file mode 100644 index 0000000..0f11cf8 --- /dev/null +++ b/patches.suse/scsi-fnic-Fix-a-tracing-statement @@ -0,0 +1,35 @@ +From: Bart Van Assche +Date: Fri, 18 Feb 2022 11:50:49 -0800 +Subject: scsi: fnic: Fix a tracing statement +Git-commit: 3032ed77a28913203a4fe0ab8f05752331af79b3 +Patch-mainline: v5.18-rc1 +References: git-fixes + +Report both the command flags and command state instead of only the +command state. + +[lduncan: hand applied then refreshed.] + +Link: https://lore.kernel.org/r/20220218195117.25689-22-bvanassche@acm.org +Fixes: 4d7007b49d52 ("[SCSI] fnic: Fnic Trace Utility") +Cc: Hiral Patel +Reviewed-by: Hannes Reinecke +Reviewed-by: Himanshu Madhani +Signed-off-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Acked-by: Lee Duncan +--- + drivers/scsi/fnic/fnic_scsi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/fnic/fnic_scsi.c ++++ b/drivers/scsi/fnic/fnic_scsi.c +@@ -611,7 +611,7 @@ out: + FNIC_TRACE(fnic_queuecommand, sc->device->host->host_no, + sc->request->tag, sc, io_req, + sg_count, cmd_trace, +- (((u64)CMD_FLAGS(sc) >> 32) | CMD_STATE(sc))); ++ (((u64)CMD_FLAGS(sc) << 32) | CMD_STATE(sc))); + + /* if only we issued IO, will we have the io lock */ + if (io_lock_acquired) diff --git a/patches.suse/scsi-fnic-Replace-DMA-mask-of-64-bits-with-47-bits b/patches.suse/scsi-fnic-Replace-DMA-mask-of-64-bits-with-47-bits new file mode 100644 index 0000000..7adbd9f --- /dev/null +++ b/patches.suse/scsi-fnic-Replace-DMA-mask-of-64-bits-with-47-bits @@ -0,0 +1,42 @@ +From: Karan Tilak Kumar +Date: Fri, 13 May 2022 13:56:05 -0700 +Subject: scsi: fnic: Replace DMA mask of 64 bits with 47 bits +Git-commit: b559b99a5c08194c14dc271e69ca786771b353dc +Patch-mainline: v5.19-rc1 +References: bsc#1199631 + +Cisco VIC supports only 47 bits. If the host sends DMA addresses that are +greater than 47 bits, it causes work queue (WQ) errors in the VIC. + +[lduncan: modified/refreshed by hand to apply correctly to an older driver.] + +Link: https://lore.kernel.org/r/20220513205605.81788-1-kartilak@cisco.com +Tested-by: Karan Tilak Kumar +Co-developed-by: Dhanraj Jhawar +Signed-off-by: Dhanraj Jhawar +Co-developed-by: Sesidhar Baddela +Signed-off-by: Sesidhar Baddela +Signed-off-by: Arulprabhu Ponnusamy +Signed-off-by: Karan Tilak Kumar +Signed-off-by: Martin K. Petersen +Acked-by: Lee Duncan +--- + drivers/scsi/fnic/fnic_main.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/scsi/fnic/fnic_main.c ++++ b/drivers/scsi/fnic/fnic_main.c +@@ -608,10 +608,10 @@ static int fnic_probe(struct pci_dev *pd + pci_set_master(pdev); + + /* Query PCI controller on system for DMA addressing +- * limitation for the device. Try 64-bit first, and +- * fail to 32-bit. ++ * limitation for the device. Try 47-bit first, and ++ * fail to 32-bit. Cisco VIC supports 47 bits only. + */ +- err = pci_set_dma_mask(pdev, DMA_BIT_MASK(64)); ++ err = pci_set_dma_mask(pdev, DMA_BIT_MASK(47)); + if (err) { + err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32)); + if (err) { diff --git a/patches.suse/scsi-hisi_sas-Change-permission-of-parameter-prot_mask b/patches.suse/scsi-hisi_sas-Change-permission-of-parameter-prot_mask new file mode 100644 index 0000000..ba409c1 --- /dev/null +++ b/patches.suse/scsi-hisi_sas-Change-permission-of-parameter-prot_mask @@ -0,0 +1,36 @@ +From: Xiang Chen +Date: Thu, 24 Feb 2022 19:51:24 +0800 +Subject: scsi: hisi_sas: Change permission of parameter prot_mask +Git-commit: c4e070457a93705e56ed06b3910d9e5fe56d3be3 +Patch-mainline: v5.18-rc1 +References: git-fixes + +Currently the permission of parameter prot_mask is 0x0, which means that +the member does not appear in sysfs. Change it as other module parameters +to 0444 for world-readable. + +[mkp: s/v3/v2/] +[lduncan: refreshed to avoid fuzz] + +Link: https://lore.kernel.org/r/1645703489-87194-2-git-send-email-john.garry@huawei.com +Fixes: d6a9000b81be ("scsi: hisi_sas: Add support for DIF feature for v2 hw") +Reported-by: Yihang Li +Signed-off-by: Xiang Chen +Signed-off-by: John Garry +Signed-off-by: Martin K. Petersen +Acked-by: Lee Duncan +--- + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -489,7 +489,7 @@ MODULE_PARM_DESC(intr_conv, "interrupt c + + /* permit overriding the host protection capabilities mask (EEDP/T10 PI) */ + static int prot_mask; +-module_param(prot_mask, int, 0); ++module_param(prot_mask, int, 0444); + MODULE_PARM_DESC(prot_mask, " host protection capabilities mask, def=0x0 "); + + static bool auto_affine_msi_experimental; diff --git a/patches.suse/scsi-lpfc-Copyright-updates-for-14.2.0.0-patches.patch b/patches.suse/scsi-lpfc-Copyright-updates-for-14.2.0.0-patches.patch deleted file mode 100644 index d269e8f..0000000 --- a/patches.suse/scsi-lpfc-Copyright-updates-for-14.2.0.0-patches.patch +++ /dev/null @@ -1,242 +0,0 @@ -From: James Smart -Date: Thu, 24 Feb 2022 18:23:08 -0800 -Subject: scsi: lpfc: Copyright updates for 14.2.0.0 patches -Patch-mainline: v5.18-rc1 -Git-commit: f45775bf562a5523602541482106b2e9871955cf -References: bsc#1197675 - -Update copyrights to 2022 for files modified in the 14.2.0.0 patch set. - -Link: https://lore.kernel.org/r/20220225022308.16486-18-jsmart2021@gmail.com -Co-developed-by: Justin Tee -Signed-off-by: Justin Tee -Signed-off-by: James Smart -Signed-off-by: Martin K. Petersen -Acked-by: Daniel Wagner ---- - drivers/scsi/lpfc/lpfc.h | 2 +- - drivers/scsi/lpfc/lpfc_bsg.c | 2 +- - drivers/scsi/lpfc/lpfc_crtn.h | 2 +- - drivers/scsi/lpfc/lpfc_ct.c | 2 +- - drivers/scsi/lpfc/lpfc_els.c | 2 +- - drivers/scsi/lpfc/lpfc_hbadisc.c | 2 +- - drivers/scsi/lpfc/lpfc_hw.h | 2 +- - drivers/scsi/lpfc/lpfc_hw4.h | 2 +- - drivers/scsi/lpfc/lpfc_init.c | 2 +- - drivers/scsi/lpfc/lpfc_nportdisc.c | 2 +- - drivers/scsi/lpfc/lpfc_nvme.c | 2 +- - drivers/scsi/lpfc/lpfc_nvme.h | 2 +- - drivers/scsi/lpfc/lpfc_nvmet.c | 2 +- - drivers/scsi/lpfc/lpfc_scsi.c | 2 +- - drivers/scsi/lpfc/lpfc_sli.c | 2 +- - drivers/scsi/lpfc/lpfc_sli.h | 2 +- - drivers/scsi/lpfc/lpfc_sli4.h | 2 +- - drivers/scsi/lpfc/lpfc_version.h | 4 ++-- - 18 files changed, 19 insertions(+), 19 deletions(-) - ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2021 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2022 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * ---- a/drivers/scsi/lpfc/lpfc_bsg.c -+++ b/drivers/scsi/lpfc/lpfc_bsg.c -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2021 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2022 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2009-2015 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * ---- a/drivers/scsi/lpfc/lpfc_crtn.h -+++ b/drivers/scsi/lpfc/lpfc_crtn.h -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2021 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2022 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * ---- a/drivers/scsi/lpfc/lpfc_ct.c -+++ b/drivers/scsi/lpfc/lpfc_ct.c -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2021 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2022 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2021 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2022 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * ---- a/drivers/scsi/lpfc/lpfc_hbadisc.c -+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2021 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2022 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * ---- a/drivers/scsi/lpfc/lpfc_hw.h -+++ b/drivers/scsi/lpfc/lpfc_hw.h -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2021 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2022 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * ---- a/drivers/scsi/lpfc/lpfc_hw4.h -+++ b/drivers/scsi/lpfc/lpfc_hw4.h -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2021 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2022 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2009-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2021 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2022 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * ---- a/drivers/scsi/lpfc/lpfc_nportdisc.c -+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2021 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2022 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * ---- a/drivers/scsi/lpfc/lpfc_nvme.c -+++ b/drivers/scsi/lpfc/lpfc_nvme.c -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2021 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2022 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * ---- a/drivers/scsi/lpfc/lpfc_nvme.h -+++ b/drivers/scsi/lpfc/lpfc_nvme.h -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2021 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2022 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * ---- a/drivers/scsi/lpfc/lpfc_nvmet.c -+++ b/drivers/scsi/lpfc/lpfc_nvmet.c -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2021 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2022 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * ---- a/drivers/scsi/lpfc/lpfc_scsi.c -+++ b/drivers/scsi/lpfc/lpfc_scsi.c -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2021 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2022 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2021 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2022 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * ---- a/drivers/scsi/lpfc/lpfc_sli.h -+++ b/drivers/scsi/lpfc/lpfc_sli.h -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2021 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2022 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * ---- a/drivers/scsi/lpfc/lpfc_sli4.h -+++ b/drivers/scsi/lpfc/lpfc_sli4.h -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2021 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2022 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2009-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * ---- a/drivers/scsi/lpfc/lpfc_version.h -+++ b/drivers/scsi/lpfc/lpfc_version.h -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2021 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2022 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * -@@ -32,6 +32,6 @@ - - #define LPFC_MODULE_DESC "Emulex LightPulse Fibre Channel SCSI driver " \ - LPFC_DRIVER_VERSION --#define LPFC_COPYRIGHT "Copyright (C) 2017-2021 Broadcom. All Rights " \ -+#define LPFC_COPYRIGHT "Copyright (C) 2017-2022 Broadcom. All Rights " \ - "Reserved. The term \"Broadcom\" refers to Broadcom Inc. " \ - "and/or its subsidiaries." diff --git a/patches.suse/scsi-lpfc-SLI-path-split-Introduce-lpfc_prep_wqe.patch b/patches.suse/scsi-lpfc-SLI-path-split-Introduce-lpfc_prep_wqe.patch deleted file mode 100644 index 64992e7..0000000 --- a/patches.suse/scsi-lpfc-SLI-path-split-Introduce-lpfc_prep_wqe.patch +++ /dev/null @@ -1,292 +0,0 @@ -From: James Smart -Date: Thu, 24 Feb 2022 18:22:54 -0800 -Subject: scsi: lpfc: SLI path split: Introduce lpfc_prep_wqe -Patch-mainline: v5.18-rc1 -Git-commit: 561341425bcc70e97edf978b3041eec5cf23acef -References: bsc#1197675 - -Introduce lpfc_prep_wqe routine. - -The lpfc_prep_wqe() routine is used with lpfc_sli_issue_iocb() and -lpfc_sli_issue_iocb_wait(). The routine performs additional SLI-4 wqe field -setting that the generic routines did not perform as they kept their -actions compatible with both SLI3 and SLI4. - -Link: https://lore.kernel.org/r/20220225022308.16486-4-jsmart2021@gmail.com -Co-developed-by: Justin Tee -Signed-off-by: Justin Tee -Signed-off-by: James Smart -Signed-off-by: Martin K. Petersen -Acked-by: Daniel Wagner ---- - drivers/scsi/lpfc/lpfc_bsg.c | 1 - drivers/scsi/lpfc/lpfc_crtn.h | 1 - drivers/scsi/lpfc/lpfc_ct.c | 1 - drivers/scsi/lpfc/lpfc_els.c | 2 - drivers/scsi/lpfc/lpfc_sli.c | 195 +++++++++++++++++++++++++++++++++++++++++- - 5 files changed, 198 insertions(+), 2 deletions(-) - ---- a/drivers/scsi/lpfc/lpfc_bsg.c -+++ b/drivers/scsi/lpfc/lpfc_bsg.c -@@ -3294,6 +3294,7 @@ lpfc_bsg_diag_loopback_run(struct bsg_jo - cmdiocbq->cmd_flag |= LPFC_IO_LOOPBACK; - cmdiocbq->vport = phba->pport; - cmdiocbq->cmd_cmpl = NULL; -+ - iocb_stat = lpfc_sli_issue_iocb_wait(phba, LPFC_ELS_RING, cmdiocbq, - rspiocbq, (phba->fc_ratov * 2) + - LPFC_DRVR_TIMEOUT); ---- a/drivers/scsi/lpfc/lpfc_crtn.h -+++ b/drivers/scsi/lpfc/lpfc_crtn.h -@@ -192,6 +192,7 @@ void lpfc_els_timeout_handler(struct lpf - struct lpfc_iocbq *lpfc_prep_els_iocb(struct lpfc_vport *, uint8_t, uint16_t, - uint8_t, struct lpfc_nodelist *, - uint32_t, uint32_t); -+void lpfc_sli_prep_wqe(struct lpfc_hba *phba, struct lpfc_iocbq *job); - void lpfc_hb_timeout_handler(struct lpfc_hba *); - - void lpfc_ct_unsol_event(struct lpfc_hba *, struct lpfc_sli_ring *, ---- a/drivers/scsi/lpfc/lpfc_ct.c -+++ b/drivers/scsi/lpfc/lpfc_ct.c -@@ -657,6 +657,7 @@ lpfc_gen_req(struct lpfc_vport *vport, s - geniocb->context_un.ndlp = lpfc_nlp_get(ndlp); - if (!geniocb->context_un.ndlp) - goto out; -+ - rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, geniocb, 0); - - if (rc == IOCB_ERROR) { ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -2814,6 +2814,7 @@ lpfc_issue_els_adisc(struct lpfc_vport * - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, - "Issue ADISC: did:x%x refcnt %d", - ndlp->nlp_DID, kref_read(&ndlp->kref), 0); -+ - rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, elsiocb, 0); - if (rc == IOCB_ERROR) { - lpfc_els_free_iocb(phba, elsiocb); -@@ -3038,6 +3039,7 @@ lpfc_issue_els_logo(struct lpfc_vport *v - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, - "Issue LOGO: did:x%x refcnt %d", - ndlp->nlp_DID, kref_read(&ndlp->kref), 0); -+ - rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, elsiocb, 0); - if (rc == IOCB_ERROR) { - lpfc_els_free_iocb(phba, elsiocb); ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -11089,6 +11089,8 @@ lpfc_sli_issue_iocb(struct lpfc_hba *phb - int rc; - - if (phba->sli_rev == LPFC_SLI_REV4) { -+ lpfc_sli_prep_wqe(phba, piocb); -+ - eq = phba->sli4_hba.hdwq[piocb->hba_wqidx].hba_eq; - - pring = lpfc_sli4_calc_ring(phba, piocb); -@@ -12912,9 +12914,11 @@ lpfc_sli_issue_iocb_wait(struct lpfc_hba - unsigned long iflags; - bool iocb_completed = true; - -- if (phba->sli_rev >= LPFC_SLI_REV4) -+ if (phba->sli_rev >= LPFC_SLI_REV4) { -+ lpfc_sli_prep_wqe(phba, piocb); -+ - pring = lpfc_sli4_calc_ring(phba, piocb); -- else -+ } else - pring = &phba->sli.sli3_ring[ring_number]; - /* - * If the caller has provided a response iocbq buffer, then context2 -@@ -22287,3 +22291,190 @@ lpfc_free_cmd_rsp_buf_per_hdwq(struct lp - - spin_unlock_irqrestore(&hdwq->hdwq_lock, iflags); - } -+ -+/** -+ * lpfc_sli_prep_wqe - Prepare WQE for the command to be posted -+ * @phba: phba object -+ * @job: job entry of the command to be posted. -+ * -+ * Fill the common fields of the wqe for each of the command. -+ * -+ * Return codes: -+ * None -+ **/ -+void -+lpfc_sli_prep_wqe(struct lpfc_hba *phba, struct lpfc_iocbq *job) -+{ -+ u8 cmnd; -+ u32 *pcmd; -+ u32 if_type = 0; -+ u32 fip, abort_tag; -+ struct lpfc_nodelist *ndlp = NULL; -+ union lpfc_wqe128 *wqe = &job->wqe; -+ struct lpfc_dmabuf *context2; -+ u32 els_id = LPFC_ELS_ID_DEFAULT; -+ u8 command_type = ELS_COMMAND_NON_FIP; -+ -+ fip = phba->hba_flag & HBA_FIP_SUPPORT; -+ /* The fcp commands will set command type */ -+ if (job->cmd_flag & LPFC_IO_FCP) -+ command_type = FCP_COMMAND; -+ else if (fip && (job->cmd_flag & LPFC_FIP_ELS_ID_MASK)) -+ command_type = ELS_COMMAND_FIP; -+ else -+ command_type = ELS_COMMAND_NON_FIP; -+ -+ abort_tag = job->iotag; -+ cmnd = bf_get(wqe_cmnd, &wqe->els_req.wqe_com); -+ -+ switch (cmnd) { -+ case CMD_ELS_REQUEST64_WQE: -+ if (job->cmd_flag & LPFC_IO_LIBDFC) -+ ndlp = job->context_un.ndlp; -+ else -+ ndlp = (struct lpfc_nodelist *)job->context1; -+ -+ /* CCP CCPE PV PRI in word10 were set in the memcpy */ -+ if (command_type == ELS_COMMAND_FIP) -+ els_id = ((job->cmd_flag & LPFC_FIP_ELS_ID_MASK) -+ >> LPFC_FIP_ELS_ID_SHIFT); -+ -+ if_type = bf_get(lpfc_sli_intf_if_type, -+ &phba->sli4_hba.sli_intf); -+ if (if_type >= LPFC_SLI_INTF_IF_TYPE_2) { -+ context2 = (struct lpfc_dmabuf *)job->context2; -+ pcmd = (u32 *)context2->virt; -+ if (pcmd && (*pcmd == ELS_CMD_FLOGI || -+ *pcmd == ELS_CMD_SCR || -+ *pcmd == ELS_CMD_RDF || -+ *pcmd == ELS_CMD_EDC || -+ *pcmd == ELS_CMD_RSCN_XMT || -+ *pcmd == ELS_CMD_FDISC || -+ *pcmd == ELS_CMD_LOGO || -+ *pcmd == ELS_CMD_PLOGI)) { -+ bf_set(els_req64_sp, &wqe->els_req, 1); -+ bf_set(els_req64_sid, &wqe->els_req, -+ job->vport->fc_myDID); -+ -+ if ((*pcmd == ELS_CMD_FLOGI) && -+ !(phba->fc_topology == -+ LPFC_TOPOLOGY_LOOP)) -+ bf_set(els_req64_sid, &wqe->els_req, 0); -+ -+ bf_set(wqe_ct, &wqe->els_req.wqe_com, 1); -+ bf_set(wqe_ctxt_tag, &wqe->els_req.wqe_com, -+ phba->vpi_ids[job->vport->vpi]); -+ } else if (pcmd) { -+ bf_set(wqe_ct, &wqe->els_req.wqe_com, 0); -+ bf_set(wqe_ctxt_tag, &wqe->els_req.wqe_com, -+ phba->sli4_hba.rpi_ids[ndlp->nlp_rpi]); -+ } -+ } -+ -+ bf_set(wqe_temp_rpi, &wqe->els_req.wqe_com, -+ phba->sli4_hba.rpi_ids[ndlp->nlp_rpi]); -+ -+ bf_set(wqe_els_id, &wqe->els_req.wqe_com, els_id); -+ bf_set(wqe_dbde, &wqe->els_req.wqe_com, 1); -+ bf_set(wqe_iod, &wqe->els_req.wqe_com, LPFC_WQE_IOD_READ); -+ bf_set(wqe_qosd, &wqe->els_req.wqe_com, 1); -+ bf_set(wqe_lenloc, &wqe->els_req.wqe_com, LPFC_WQE_LENLOC_NONE); -+ bf_set(wqe_ebde_cnt, &wqe->els_req.wqe_com, 0); -+ break; -+ case CMD_XMIT_ELS_RSP64_WQE: -+ ndlp = (struct lpfc_nodelist *)job->context1; -+ -+ /* word4 */ -+ wqe->xmit_els_rsp.word4 = 0; -+ -+ if_type = bf_get(lpfc_sli_intf_if_type, -+ &phba->sli4_hba.sli_intf); -+ if (if_type >= LPFC_SLI_INTF_IF_TYPE_2) { -+ if (job->vport->fc_flag & FC_PT2PT) { -+ bf_set(els_rsp64_sp, &wqe->xmit_els_rsp, 1); -+ bf_set(els_rsp64_sid, &wqe->xmit_els_rsp, -+ job->vport->fc_myDID); -+ if (job->vport->fc_myDID == Fabric_DID) { -+ bf_set(wqe_els_did, -+ &wqe->xmit_els_rsp.wqe_dest, 0); -+ } -+ } -+ } -+ -+ bf_set(wqe_dbde, &wqe->xmit_els_rsp.wqe_com, 1); -+ bf_set(wqe_iod, &wqe->xmit_els_rsp.wqe_com, LPFC_WQE_IOD_WRITE); -+ bf_set(wqe_qosd, &wqe->xmit_els_rsp.wqe_com, 1); -+ bf_set(wqe_lenloc, &wqe->xmit_els_rsp.wqe_com, -+ LPFC_WQE_LENLOC_WORD3); -+ bf_set(wqe_ebde_cnt, &wqe->xmit_els_rsp.wqe_com, 0); -+ -+ if (phba->fc_topology == LPFC_TOPOLOGY_LOOP) { -+ bf_set(els_rsp64_sp, &wqe->xmit_els_rsp, 1); -+ bf_set(els_rsp64_sid, &wqe->xmit_els_rsp, -+ job->vport->fc_myDID); -+ bf_set(wqe_ct, &wqe->xmit_els_rsp.wqe_com, 1); -+ } -+ -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ bf_set(wqe_rsp_temp_rpi, &wqe->xmit_els_rsp, -+ phba->sli4_hba.rpi_ids[ndlp->nlp_rpi]); -+ -+ if (bf_get(wqe_ct, &wqe->xmit_els_rsp.wqe_com)) -+ bf_set(wqe_ctxt_tag, &wqe->xmit_els_rsp.wqe_com, -+ phba->vpi_ids[job->vport->vpi]); -+ } -+ command_type = OTHER_COMMAND; -+ break; -+ case CMD_GEN_REQUEST64_WQE: -+ /* Word 10 */ -+ bf_set(wqe_dbde, &wqe->gen_req.wqe_com, 1); -+ bf_set(wqe_iod, &wqe->gen_req.wqe_com, LPFC_WQE_IOD_READ); -+ bf_set(wqe_qosd, &wqe->gen_req.wqe_com, 1); -+ bf_set(wqe_lenloc, &wqe->gen_req.wqe_com, LPFC_WQE_LENLOC_NONE); -+ bf_set(wqe_ebde_cnt, &wqe->gen_req.wqe_com, 0); -+ command_type = OTHER_COMMAND; -+ break; -+ case CMD_XMIT_SEQUENCE64_WQE: -+ if (phba->link_flag & LS_LOOPBACK_MODE) -+ bf_set(wqe_xo, &wqe->xmit_sequence.wge_ctl, 1); -+ -+ wqe->xmit_sequence.rsvd3 = 0; -+ bf_set(wqe_pu, &wqe->xmit_sequence.wqe_com, 0); -+ bf_set(wqe_dbde, &wqe->xmit_sequence.wqe_com, 1); -+ bf_set(wqe_iod, &wqe->xmit_sequence.wqe_com, -+ LPFC_WQE_IOD_WRITE); -+ bf_set(wqe_lenloc, &wqe->xmit_sequence.wqe_com, -+ LPFC_WQE_LENLOC_WORD12); -+ bf_set(wqe_ebde_cnt, &wqe->xmit_sequence.wqe_com, 0); -+ command_type = OTHER_COMMAND; -+ break; -+ case CMD_XMIT_BLS_RSP64_WQE: -+ bf_set(xmit_bls_rsp64_seqcnthi, &wqe->xmit_bls_rsp, 0xffff); -+ bf_set(wqe_xmit_bls_pt, &wqe->xmit_bls_rsp.wqe_dest, 0x1); -+ bf_set(wqe_ct, &wqe->xmit_bls_rsp.wqe_com, 1); -+ bf_set(wqe_ctxt_tag, &wqe->xmit_bls_rsp.wqe_com, -+ phba->vpi_ids[phba->pport->vpi]); -+ bf_set(wqe_qosd, &wqe->xmit_bls_rsp.wqe_com, 1); -+ bf_set(wqe_lenloc, &wqe->xmit_bls_rsp.wqe_com, -+ LPFC_WQE_LENLOC_NONE); -+ /* Overwrite the pre-set comnd type with OTHER_COMMAND */ -+ command_type = OTHER_COMMAND; -+ break; -+ case CMD_FCP_ICMND64_WQE: /* task mgmt commands */ -+ case CMD_ABORT_XRI_WQE: /* abort iotag */ -+ case CMD_SEND_FRAME: /* mds loopback */ -+ /* cases already formatted for sli4 wqe - no chgs necessary */ -+ return; -+ default: -+ dump_stack(); -+ lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, -+ "6207 Invalid command 0x%x\n", -+ cmnd); -+ break; -+ } -+ -+ wqe->generic.wqe_com.abort_tag = abort_tag; -+ bf_set(wqe_reqtag, &wqe->generic.wqe_com, job->iotag); -+ bf_set(wqe_cmd_type, &wqe->generic.wqe_com, command_type); -+ bf_set(wqe_cqid, &wqe->generic.wqe_com, LPFC_WQE_CQ_ID_DEFAULT); -+} diff --git a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-Abort-paths.patch b/patches.suse/scsi-lpfc-SLI-path-split-Refactor-Abort-paths.patch deleted file mode 100644 index ff8419c..0000000 --- a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-Abort-paths.patch +++ /dev/null @@ -1,816 +0,0 @@ -From: James Smart -Date: Thu, 24 Feb 2022 18:23:05 -0800 -Subject: scsi: lpfc: SLI path split: Refactor Abort paths -Patch-mainline: v5.18-rc1 -Git-commit: 31a59f75702fe9a9d3772ece821a0d07a0805572 -References: bsc#1197675 - -This patch refactors the Abort paths to use SLI-4 as the primary interface. - - - Introduce generic lpfc_sli_prep_abort_xri jump table routine - - - Consolidate lpfc_sli4_issue_abort_iotag and lpfc_sli_issue_abort_iotag - into a single generic lpfc_sli_issue_abort_iotag routine - - - Consolidate lpfc_sli4_abort_fcp_cmpl and lpfc_sli_abort_fcp_cmpl into a - single generic lpfc_sli_abort_fcp_cmpl routine - - - Remove unused routine lpfc_get_iocb_from_iocbq - - - Conversion away from using SLI-3 iocb structures to set/access fields in - common routines. Use the new generic get/set routines that were added. - This move changes code from indirect structure references to using local - variables with the generic routines. - - - Refactor routines when setting non-generic fields, to have both SLI3 and - SLI4 specific sections. This replaces the set-as-SLI3 then translate to - SLI4 behavior of the past. - -Link: https://lore.kernel.org/r/20220225022308.16486-15-jsmart2021@gmail.com -Co-developed-by: Justin Tee -Signed-off-by: Justin Tee -Signed-off-by: James Smart -Signed-off-by: Martin K. Petersen -Acked-by: Daniel Wagner ---- - drivers/scsi/lpfc/lpfc.h | 14 + - drivers/scsi/lpfc/lpfc_crtn.h | 3 - drivers/scsi/lpfc/lpfc_nvme.c | 5 - drivers/scsi/lpfc/lpfc_scsi.c | 12 - - drivers/scsi/lpfc/lpfc_sli.c | 382 +++++++++++++++++++++++------------------- - drivers/scsi/lpfc/lpfc_sli.h | 4 - 6 files changed, 236 insertions(+), 184 deletions(-) - ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -843,8 +843,6 @@ struct lpfc_hba { - void (*__lpfc_sli_release_iocbq)(struct lpfc_hba *, - struct lpfc_iocbq *); - int (*lpfc_hba_down_post)(struct lpfc_hba *phba); -- IOCB_t * (*lpfc_get_iocb_from_iocbq) -- (struct lpfc_iocbq *); - void (*lpfc_scsi_cmd_iocb_cmpl) - (struct lpfc_hba *, struct lpfc_iocbq *, struct lpfc_iocbq *); - -@@ -891,6 +889,9 @@ struct lpfc_hba { - struct lpfc_dmabuf *bmp, u16 rpi, - u16 ox_id, u32 num_entry, u8 rctl, - u8 last_seq, u8 cr_cx_cmd); -+ void (*__lpfc_sli_prep_abort_xri)(struct lpfc_iocbq *cmdiocbq, -+ u16 ulp_context, u16 iotag, -+ u8 ulp_class, u16 cqid, bool ia); - - /* expedite pool */ - struct lpfc_epd_pool epd_pool; -@@ -1749,6 +1750,15 @@ u32 get_job_data_placed(struct lpfc_hba - } - - static inline -+u32 get_job_abtsiotag(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq) -+{ -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ return iocbq->wqe.abort_cmd.wqe_com.abort_tag; -+ else -+ return iocbq->iocb.un.acxri.abortIoTag; -+} -+ -+static inline - u32 get_job_els_rsp64_did(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq) - { - if (phba->sli_rev == LPFC_SLI_REV4) ---- a/drivers/scsi/lpfc/lpfc_crtn.h -+++ b/drivers/scsi/lpfc/lpfc_crtn.h -@@ -367,6 +367,9 @@ void lpfc_sli_prep_xmit_seq64(struct lpf - struct lpfc_dmabuf *bmp, u16 rpi, u16 ox_id, - u32 num_entry, u8 rctl, u8 last_seq, - u8 cr_cx_cmd); -+void lpfc_sli_prep_abort_xri(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocbq, -+ u16 ulp_context, u16 iotag, u8 ulp_class, u16 cqid, -+ bool ia); - struct lpfc_sglq *__lpfc_clear_active_sglq(struct lpfc_hba *phba, uint16_t xri); - struct lpfc_sglq *__lpfc_sli_get_nvmet_sglq(struct lpfc_hba *phba, - struct lpfc_iocbq *piocbq); ---- a/drivers/scsi/lpfc/lpfc_nvme.c -+++ b/drivers/scsi/lpfc/lpfc_nvme.c -@@ -1600,9 +1600,8 @@ lpfc_nvme_abort_fcreq_cmpl(struct lpfc_h - "6145 ABORT_XRI_CN completing on rpi x%x " - "original iotag x%x, abort cmd iotag x%x " - "req_tag x%x, status x%x, hwstatus x%x\n", -- cmdiocb->iocb.un.acxri.abortContextTag, -- cmdiocb->iocb.un.acxri.abortIoTag, -- cmdiocb->iotag, -+ bf_get(wqe_ctxt_tag, &cmdiocb->wqe.generic.wqe_com), -+ get_job_abtsiotag(phba, cmdiocb), cmdiocb->iotag, - bf_get(lpfc_wcqe_c_request_tag, abts_cmpl), - bf_get(lpfc_wcqe_c_status, abts_cmpl), - bf_get(lpfc_wcqe_c_hw_status, abts_cmpl)); ---- a/drivers/scsi/lpfc/lpfc_scsi.c -+++ b/drivers/scsi/lpfc/lpfc_scsi.c -@@ -5628,15 +5628,13 @@ lpfc_abort_handler(struct scsi_cmnd *cmn - } - - lpfc_cmd->waitq = &waitq; -- if (phba->sli_rev == LPFC_SLI_REV4) { -+ if (phba->sli_rev == LPFC_SLI_REV4) - spin_unlock(&pring_s4->ring_lock); -- ret_val = lpfc_sli4_issue_abort_iotag(phba, iocb, -- lpfc_sli4_abort_fcp_cmpl); -- } else { -+ else - pring = &phba->sli.sli3_ring[LPFC_FCP_RING]; -- ret_val = lpfc_sli_issue_abort_iotag(phba, pring, iocb, -- lpfc_sli_abort_fcp_cmpl); -- } -+ -+ ret_val = lpfc_sli_issue_abort_iotag(phba, pring, iocb, -+ lpfc_sli_abort_fcp_cmpl); - - /* Make sure HBA is alive */ - lpfc_issue_hb_tmo(phba); ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -101,12 +101,6 @@ union lpfc_wqe128 lpfc_iread_cmd_templat - union lpfc_wqe128 lpfc_iwrite_cmd_template; - union lpfc_wqe128 lpfc_icmnd_cmd_template; - --static IOCB_t * --lpfc_get_iocb_from_iocbq(struct lpfc_iocbq *iocbq) --{ -- return &iocbq->iocb; --} -- - /* Setup WQE templates for IOs */ - void lpfc_wqe_cmd_template(void) - { -@@ -1730,20 +1724,18 @@ static int - lpfc_sli_ringtxcmpl_put(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, - struct lpfc_iocbq *piocb) - { -- if (phba->sli_rev == LPFC_SLI_REV4) -- lockdep_assert_held(&pring->ring_lock); -- else -- lockdep_assert_held(&phba->hbalock); -+ u32 ulp_command = 0; - - BUG_ON(!piocb); -+ ulp_command = get_job_cmnd(phba, piocb); - - list_add_tail(&piocb->list, &pring->txcmplq); - piocb->cmd_flag |= LPFC_IO_ON_TXCMPLQ; - pring->txcmplq_cnt++; -- - if ((unlikely(pring->ringno == LPFC_ELS_RING)) && -- (piocb->iocb.ulpCommand != CMD_ABORT_XRI_CN) && -- (piocb->iocb.ulpCommand != CMD_CLOSE_XRI_CN)) { -+ (ulp_command != CMD_ABORT_XRI_WQE) && -+ (ulp_command != CMD_ABORT_XRI_CN) && -+ (ulp_command != CMD_CLOSE_XRI_CN)) { - BUG_ON(!piocb->vport); - if (!(piocb->vport->load_flag & FC_UNLOADING)) - mod_timer(&piocb->vport->els_tmofunc, -@@ -10676,6 +10668,77 @@ lpfc_sli_prep_xmit_seq64(struct lpfc_hba - rctl, last_seq, cr_cx_cmd); - } - -+static void -+__lpfc_sli_prep_abort_xri_s3(struct lpfc_iocbq *cmdiocbq, u16 ulp_context, -+ u16 iotag, u8 ulp_class, u16 cqid, bool ia) -+{ -+ IOCB_t *icmd = NULL; -+ -+ icmd = &cmdiocbq->iocb; -+ memset(icmd, 0, sizeof(*icmd)); -+ -+ /* Word 5 */ -+ icmd->un.acxri.abortContextTag = ulp_context; -+ icmd->un.acxri.abortIoTag = iotag; -+ -+ if (ia) { -+ /* Word 7 */ -+ icmd->ulpCommand = CMD_CLOSE_XRI_CN; -+ } else { -+ /* Word 3 */ -+ icmd->un.acxri.abortType = ABORT_TYPE_ABTS; -+ -+ /* Word 7 */ -+ icmd->ulpClass = ulp_class; -+ icmd->ulpCommand = CMD_ABORT_XRI_CN; -+ } -+ -+ /* Word 7 */ -+ icmd->ulpLe = 1; -+} -+ -+static void -+__lpfc_sli_prep_abort_xri_s4(struct lpfc_iocbq *cmdiocbq, u16 ulp_context, -+ u16 iotag, u8 ulp_class, u16 cqid, bool ia) -+{ -+ union lpfc_wqe128 *wqe; -+ -+ wqe = &cmdiocbq->wqe; -+ memset(wqe, 0, sizeof(*wqe)); -+ -+ /* Word 3 */ -+ bf_set(abort_cmd_criteria, &wqe->abort_cmd, T_XRI_TAG); -+ if (ia) -+ bf_set(abort_cmd_ia, &wqe->abort_cmd, 1); -+ else -+ bf_set(abort_cmd_ia, &wqe->abort_cmd, 0); -+ -+ /* Word 7 */ -+ bf_set(wqe_cmnd, &wqe->abort_cmd.wqe_com, CMD_ABORT_XRI_WQE); -+ -+ /* Word 8 */ -+ wqe->abort_cmd.wqe_com.abort_tag = ulp_context; -+ -+ /* Word 9 */ -+ bf_set(wqe_reqtag, &wqe->abort_cmd.wqe_com, iotag); -+ -+ /* Word 10 */ -+ bf_set(wqe_qosd, &wqe->abort_cmd.wqe_com, 1); -+ -+ /* Word 11 */ -+ bf_set(wqe_cqid, &wqe->abort_cmd.wqe_com, cqid); -+ bf_set(wqe_cmd_type, &wqe->abort_cmd.wqe_com, OTHER_COMMAND); -+} -+ -+void -+lpfc_sli_prep_abort_xri(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocbq, -+ u16 ulp_context, u16 iotag, u8 ulp_class, u16 cqid, -+ bool ia) -+{ -+ phba->__lpfc_sli_prep_abort_xri(cmdiocbq, ulp_context, iotag, ulp_class, -+ cqid, ia); -+} -+ - /** - * lpfc_sli_api_table_setup - Set up sli api function jump table - * @phba: The hba struct for which this call is being executed. -@@ -10697,6 +10760,7 @@ lpfc_sli_api_table_setup(struct lpfc_hba - phba->__lpfc_sli_prep_els_req_rsp = __lpfc_sli_prep_els_req_rsp_s3; - phba->__lpfc_sli_prep_gen_req = __lpfc_sli_prep_gen_req_s3; - phba->__lpfc_sli_prep_xmit_seq64 = __lpfc_sli_prep_xmit_seq64_s3; -+ phba->__lpfc_sli_prep_abort_xri = __lpfc_sli_prep_abort_xri_s3; - break; - case LPFC_PCI_DEV_OC: - phba->__lpfc_sli_issue_iocb = __lpfc_sli_issue_iocb_s4; -@@ -10705,6 +10769,7 @@ lpfc_sli_api_table_setup(struct lpfc_hba - phba->__lpfc_sli_prep_els_req_rsp = __lpfc_sli_prep_els_req_rsp_s4; - phba->__lpfc_sli_prep_gen_req = __lpfc_sli_prep_gen_req_s4; - phba->__lpfc_sli_prep_xmit_seq64 = __lpfc_sli_prep_xmit_seq64_s4; -+ phba->__lpfc_sli_prep_abort_xri = __lpfc_sli_prep_abort_xri_s4; - break; - default: - lpfc_printf_log(phba, KERN_ERR, LOG_INIT, -@@ -10712,7 +10777,6 @@ lpfc_sli_api_table_setup(struct lpfc_hba - dev_grp); - return -ENODEV; - } -- phba->lpfc_get_iocb_from_iocbq = lpfc_get_iocb_from_iocbq; - return 0; - } - -@@ -10912,8 +10976,8 @@ lpfc_sli_abts_err_handler(struct lpfc_hb - lpfc_printf_log(phba, KERN_INFO, LOG_SLI, - "3095 Event Context not found, no " - "action on vpi %d rpi %d status 0x%x, reason 0x%x\n", -- iocbq->iocb.ulpContext, iocbq->iocb.ulpStatus, -- vpi, rpi); -+ vpi, rpi, iocbq->iocb.ulpStatus, -+ iocbq->iocb.ulpContext); - } - - /* lpfc_sli4_abts_err_handler - handle a failed ABTS request from an SLI4 port. -@@ -11761,47 +11825,33 @@ static void - lpfc_sli_abort_els_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - struct lpfc_iocbq *rspiocb) - { -- IOCB_t *irsp = &rspiocb->iocb; -- uint16_t abort_iotag, abort_context; -- struct lpfc_iocbq *abort_iocb = NULL; -- -- if (irsp->ulpStatus) { -+ u32 ulp_status = get_job_ulpstatus(phba, rspiocb); -+ u32 ulp_word4 = get_job_word4(phba, rspiocb); -+ u8 cmnd = get_job_cmnd(phba, cmdiocb); - -+ if (ulp_status) { - /* - * Assume that the port already completed and returned, or - * will return the iocb. Just Log the message. - */ -- abort_context = cmdiocb->iocb.un.acxri.abortContextTag; -- abort_iotag = cmdiocb->iocb.un.acxri.abortIoTag; -- -- spin_lock_irq(&phba->hbalock); - if (phba->sli_rev < LPFC_SLI_REV4) { -- if (irsp->ulpCommand == CMD_ABORT_XRI_CX && -- irsp->ulpStatus == IOSTAT_LOCAL_REJECT && -- irsp->un.ulpWord[4] == IOERR_ABORT_REQUESTED) { -- spin_unlock_irq(&phba->hbalock); -+ if (cmnd == CMD_ABORT_XRI_CX && -+ ulp_status == IOSTAT_LOCAL_REJECT && -+ ulp_word4 == IOERR_ABORT_REQUESTED) { - goto release_iocb; - } -- if (abort_iotag != 0 && -- abort_iotag <= phba->sli.last_iotag) -- abort_iocb = -- phba->sli.iocbq_lookup[abort_iotag]; -- } else -- /* For sli4 the abort_tag is the XRI, -- * so the abort routine puts the iotag of the iocb -- * being aborted in the context field of the abort -- * IOCB. -- */ -- abort_iocb = phba->sli.iocbq_lookup[abort_context]; -+ } - - lpfc_printf_log(phba, KERN_WARNING, LOG_ELS | LOG_SLI, - "0327 Cannot abort els iocb x%px " -- "with tag %x context %x, abort status %x, " -- "abort code %x\n", -- abort_iocb, abort_iotag, abort_context, -- irsp->ulpStatus, irsp->un.ulpWord[4]); -+ "with io cmd xri %x abort tag : x%x, " -+ "abort status %x abort code %x\n", -+ cmdiocb, get_job_abtsiotag(phba, cmdiocb), -+ (phba->sli_rev == LPFC_SLI_REV4) ? -+ get_wqe_reqtag(cmdiocb) : -+ cmdiocb->iocb.un.acxri.abortContextTag, -+ ulp_status, ulp_word4); - -- spin_unlock_irq(&phba->hbalock); - } - release_iocb: - lpfc_sli_release_iocbq(phba, cmdiocb); -@@ -11880,20 +11930,21 @@ lpfc_sli_issue_abort_iotag(struct lpfc_h - { - struct lpfc_vport *vport = cmdiocb->vport; - struct lpfc_iocbq *abtsiocbp; -- IOCB_t *icmd = NULL; -- IOCB_t *iabt = NULL; - int retval = IOCB_ERROR; - unsigned long iflags; -- struct lpfc_nodelist *ndlp; -+ struct lpfc_nodelist *ndlp = NULL; -+ u32 ulp_command = get_job_cmnd(phba, cmdiocb); -+ u16 ulp_context, iotag; -+ bool ia; - - /* - * There are certain command types we don't want to abort. And we - * don't want to abort commands that are already in the process of - * being aborted. - */ -- icmd = &cmdiocb->iocb; -- if (icmd->ulpCommand == CMD_ABORT_XRI_CN || -- icmd->ulpCommand == CMD_CLOSE_XRI_CN || -+ if (ulp_command == CMD_ABORT_XRI_WQE || -+ ulp_command == CMD_ABORT_XRI_CN || -+ ulp_command == CMD_CLOSE_XRI_CN || - cmdiocb->cmd_flag & LPFC_DRIVER_ABORTED) - return IOCB_ABORTING; - -@@ -11928,37 +11979,40 @@ lpfc_sli_issue_abort_iotag(struct lpfc_h - */ - cmdiocb->cmd_flag |= LPFC_DRIVER_ABORTED; - -- iabt = &abtsiocbp->iocb; -- iabt->un.acxri.abortType = ABORT_TYPE_ABTS; -- iabt->un.acxri.abortContextTag = icmd->ulpContext; - if (phba->sli_rev == LPFC_SLI_REV4) { -- iabt->un.acxri.abortIoTag = cmdiocb->sli4_xritag; -- if (pring->ringno == LPFC_ELS_RING) -- iabt->un.acxri.abortContextTag = cmdiocb->iotag; -+ ulp_context = cmdiocb->sli4_xritag; -+ iotag = abtsiocbp->iotag; - } else { -- iabt->un.acxri.abortIoTag = icmd->ulpIoTag; -+ iotag = cmdiocb->iocb.ulpIoTag; - if (pring->ringno == LPFC_ELS_RING) { - ndlp = (struct lpfc_nodelist *)(cmdiocb->context1); -- iabt->un.acxri.abortContextTag = ndlp->nlp_rpi; -+ ulp_context = ndlp->nlp_rpi; -+ } else { -+ ulp_context = cmdiocb->iocb.ulpContext; - } - } -- iabt->ulpLe = 1; -- iabt->ulpClass = icmd->ulpClass; -+ -+ if (phba->link_state < LPFC_LINK_UP || -+ (phba->sli_rev == LPFC_SLI_REV4 && -+ phba->sli4_hba.link_state.status == LPFC_FC_LA_TYPE_LINK_DOWN)) -+ ia = true; -+ else -+ ia = false; -+ -+ lpfc_sli_prep_abort_xri(phba, abtsiocbp, ulp_context, iotag, -+ cmdiocb->iocb.ulpClass, -+ LPFC_WQE_CQ_ID_DEFAULT, ia); -+ -+ abtsiocbp->vport = vport; - - /* ABTS WQE must go to the same WQ as the WQE to be aborted */ - abtsiocbp->hba_wqidx = cmdiocb->hba_wqidx; - if (cmdiocb->cmd_flag & LPFC_IO_FCP) - abtsiocbp->cmd_flag |= (LPFC_IO_FCP | LPFC_USE_FCPWQIDX); -+ - if (cmdiocb->cmd_flag & LPFC_IO_FOF) - abtsiocbp->cmd_flag |= LPFC_IO_FOF; - -- if (phba->link_state < LPFC_LINK_UP || -- (phba->sli_rev == LPFC_SLI_REV4 && -- phba->sli4_hba.link_state.status == LPFC_FC_LA_TYPE_LINK_DOWN)) -- iabt->ulpCommand = CMD_CLOSE_XRI_CN; -- else -- iabt->ulpCommand = CMD_ABORT_XRI_CN; -- - if (cmpl) - abtsiocbp->cmd_cmpl = cmpl; - else -@@ -11982,12 +12036,12 @@ lpfc_sli_issue_abort_iotag(struct lpfc_h - abort_iotag_exit: - - lpfc_printf_vlog(vport, KERN_INFO, LOG_SLI, -- "0339 Abort xri x%x, original iotag x%x, " -- "abort cmd iotag x%x retval x%x\n", -- iabt->un.acxri.abortIoTag, -- iabt->un.acxri.abortContextTag, -- abtsiocbp->iotag, retval); -- -+ "0339 Abort IO XRI x%x, Original iotag x%x, " -+ "abort tag x%x Cmdjob : x%px Abortjob : x%px " -+ "retval x%x\n", -+ ulp_context, (phba->sli_rev == LPFC_SLI_REV4) ? -+ cmdiocb->iotag : iotag, iotag, cmdiocb, abtsiocbp, -+ retval); - if (retval) { - cmdiocb->cmd_flag &= ~LPFC_DRIVER_ABORTED; - __lpfc_sli_release_iocbq(phba, abtsiocbp); -@@ -12047,7 +12101,7 @@ static int - lpfc_sli_validate_fcp_iocb_for_abort(struct lpfc_iocbq *iocbq, - struct lpfc_vport *vport) - { -- IOCB_t *icmd = NULL; -+ u8 ulp_command; - - /* No null ptr vports */ - if (!iocbq || iocbq->vport != vport) -@@ -12056,12 +12110,13 @@ lpfc_sli_validate_fcp_iocb_for_abort(str - /* iocb must be for FCP IO, already exists on the TX cmpl queue, - * can't be premarked as driver aborted, nor be an ABORT iocb itself - */ -- icmd = &iocbq->iocb; -+ ulp_command = get_job_cmnd(vport->phba, iocbq); - if (!(iocbq->cmd_flag & LPFC_IO_FCP) || - !(iocbq->cmd_flag & LPFC_IO_ON_TXCMPLQ) || - (iocbq->cmd_flag & LPFC_DRIVER_ABORTED) || -- (icmd->ulpCommand == CMD_ABORT_XRI_CN || -- icmd->ulpCommand == CMD_CLOSE_XRI_CN)) -+ (ulp_command == CMD_ABORT_XRI_CN || -+ ulp_command == CMD_CLOSE_XRI_CN || -+ ulp_command == CMD_ABORT_XRI_WQE)) - return -EINVAL; - - return 0; -@@ -12153,9 +12208,9 @@ lpfc_sli_sum_iocb(struct lpfc_vport *vpo - { - struct lpfc_hba *phba = vport->phba; - struct lpfc_iocbq *iocbq; -- IOCB_t *icmd = NULL; - int sum, i; - unsigned long iflags; -+ u8 ulp_command; - - spin_lock_irqsave(&phba->hbalock, iflags); - for (i = 1, sum = 0; i <= phba->sli.last_iotag; i++) { -@@ -12168,9 +12223,10 @@ lpfc_sli_sum_iocb(struct lpfc_vport *vpo - continue; - - /* Include counting outstanding aborts */ -- icmd = &iocbq->iocb; -- if (icmd->ulpCommand == CMD_ABORT_XRI_CN || -- icmd->ulpCommand == CMD_CLOSE_XRI_CN) { -+ ulp_command = get_job_cmnd(phba, iocbq); -+ if (ulp_command == CMD_ABORT_XRI_CN || -+ ulp_command == CMD_CLOSE_XRI_CN || -+ ulp_command == CMD_ABORT_XRI_WQE) { - sum++; - continue; - } -@@ -12185,33 +12241,6 @@ lpfc_sli_sum_iocb(struct lpfc_vport *vpo - } - - /** -- * lpfc_sli4_abort_fcp_cmpl - Completion handler function for aborted FCP IOCBs -- * @phba: Pointer to HBA context object -- * @cmdiocb: Pointer to command iocb object. -- * @wcqe: pointer to the complete wcqe -- * -- * This function is called when an aborted FCP iocb completes. This -- * function is called by the ring event handler with no lock held. -- * This function frees the iocb. It is called for sli-4 adapters. -- **/ --void --lpfc_sli4_abort_fcp_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, -- struct lpfc_wcqe_complete *wcqe) --{ -- lpfc_printf_log(phba, KERN_INFO, LOG_SLI, -- "3017 ABORT_XRI_CN completing on rpi x%x " -- "original iotag x%x, abort cmd iotag x%x " -- "status 0x%x, reason 0x%x\n", -- cmdiocb->iocb.un.acxri.abortContextTag, -- cmdiocb->iocb.un.acxri.abortIoTag, -- cmdiocb->iotag, -- (bf_get(lpfc_wcqe_c_status, wcqe) -- & LPFC_IOCB_STATUS_MASK), -- wcqe->parameter); -- lpfc_sli_release_iocbq(phba, cmdiocb); --} -- --/** - * lpfc_sli_abort_fcp_cmpl - Completion handler function for aborted FCP IOCBs - * @phba: Pointer to HBA context object - * @cmdiocb: Pointer to command iocb object. -@@ -12226,13 +12255,15 @@ lpfc_sli_abort_fcp_cmpl(struct lpfc_hba - struct lpfc_iocbq *rspiocb) - { - lpfc_printf_log(phba, KERN_INFO, LOG_SLI, -- "3096 ABORT_XRI_CN completing on rpi x%x " -+ "3096 ABORT_XRI_CX completing on rpi x%x " - "original iotag x%x, abort cmd iotag x%x " - "status 0x%x, reason 0x%x\n", -+ (phba->sli_rev == LPFC_SLI_REV4) ? -+ cmdiocb->sli4_xritag : - cmdiocb->iocb.un.acxri.abortContextTag, -- cmdiocb->iocb.un.acxri.abortIoTag, -- cmdiocb->iotag, rspiocb->iocb.ulpStatus, -- rspiocb->iocb.un.ulpWord[4]); -+ get_job_abtsiotag(phba, cmdiocb), -+ cmdiocb->iotag, get_job_ulpstatus(phba, rspiocb), -+ get_job_word4(phba, rspiocb)); - lpfc_sli_release_iocbq(phba, cmdiocb); - return; - } -@@ -12273,7 +12304,6 @@ lpfc_sli_abort_iocb(struct lpfc_vport *v - int errcnt = 0, ret_val = 0; - unsigned long iflags; - int i; -- void *fcp_cmpl = NULL; - - /* all I/Os are in process of being flushed */ - if (phba->hba_flag & HBA_IOQ_FLUSH) -@@ -12292,13 +12322,11 @@ lpfc_sli_abort_iocb(struct lpfc_vport *v - spin_lock_irqsave(&phba->hbalock, iflags); - if (phba->sli_rev == LPFC_SLI_REV3) { - pring = &phba->sli.sli3_ring[LPFC_FCP_RING]; -- fcp_cmpl = lpfc_sli_abort_fcp_cmpl; - } else if (phba->sli_rev == LPFC_SLI_REV4) { - pring = lpfc_sli4_calc_ring(phba, iocbq); -- fcp_cmpl = lpfc_sli4_abort_fcp_cmpl; - } - ret_val = lpfc_sli_issue_abort_iotag(phba, pring, iocbq, -- fcp_cmpl); -+ lpfc_sli_abort_fcp_cmpl); - spin_unlock_irqrestore(&phba->hbalock, iflags); - if (ret_val != IOCB_SUCCESS) - errcnt++; -@@ -12340,12 +12368,13 @@ lpfc_sli_abort_taskmgmt(struct lpfc_vpor - struct lpfc_hba *phba = vport->phba; - struct lpfc_io_buf *lpfc_cmd; - struct lpfc_iocbq *abtsiocbq; -- struct lpfc_nodelist *ndlp; -+ struct lpfc_nodelist *ndlp = NULL; - struct lpfc_iocbq *iocbq; -- IOCB_t *icmd; - int sum, i, ret_val; - unsigned long iflags; - struct lpfc_sli_ring *pring_s4 = NULL; -+ u16 ulp_context, iotag, cqid = LPFC_WQE_CQ_ID_DEFAULT; -+ bool ia; - - spin_lock_irqsave(&phba->hbalock, iflags); - -@@ -12407,16 +12436,32 @@ lpfc_sli_abort_taskmgmt(struct lpfc_vpor - continue; - } - -- icmd = &iocbq->iocb; -- abtsiocbq->iocb.un.acxri.abortType = ABORT_TYPE_ABTS; -- abtsiocbq->iocb.un.acxri.abortContextTag = icmd->ulpContext; -- if (phba->sli_rev == LPFC_SLI_REV4) -- abtsiocbq->iocb.un.acxri.abortIoTag = -- iocbq->sli4_xritag; -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ iotag = abtsiocbq->iotag; -+ ulp_context = iocbq->sli4_xritag; -+ cqid = lpfc_cmd->hdwq->io_cq_map; -+ } else { -+ iotag = iocbq->iocb.ulpIoTag; -+ if (pring->ringno == LPFC_ELS_RING) { -+ ndlp = (struct lpfc_nodelist *)(iocbq->context1); -+ ulp_context = ndlp->nlp_rpi; -+ } else { -+ ulp_context = iocbq->iocb.ulpContext; -+ } -+ } -+ -+ ndlp = lpfc_cmd->rdata->pnode; -+ -+ if (lpfc_is_link_up(phba) && -+ (ndlp && ndlp->nlp_state == NLP_STE_MAPPED_NODE)) -+ ia = false; - else -- abtsiocbq->iocb.un.acxri.abortIoTag = icmd->ulpIoTag; -- abtsiocbq->iocb.ulpLe = 1; -- abtsiocbq->iocb.ulpClass = icmd->ulpClass; -+ ia = true; -+ -+ lpfc_sli_prep_abort_xri(phba, abtsiocbq, ulp_context, iotag, -+ iocbq->iocb.ulpClass, cqid, -+ ia); -+ - abtsiocbq->vport = vport; - - /* ABTS WQE must go to the same WQ as the WQE to be aborted */ -@@ -12426,14 +12471,6 @@ lpfc_sli_abort_taskmgmt(struct lpfc_vpor - if (iocbq->cmd_flag & LPFC_IO_FOF) - abtsiocbq->cmd_flag |= LPFC_IO_FOF; - -- ndlp = lpfc_cmd->rdata->pnode; -- -- if (lpfc_is_link_up(phba) && -- (ndlp && ndlp->nlp_state == NLP_STE_MAPPED_NODE)) -- abtsiocbq->iocb.ulpCommand = CMD_ABORT_XRI_CN; -- else -- abtsiocbq->iocb.ulpCommand = CMD_CLOSE_XRI_CN; -- - /* Setup callback routine and issue the command. */ - abtsiocbq->cmd_cmpl = lpfc_sli_abort_fcp_cmpl; - -@@ -18297,8 +18334,8 @@ lpfc_sli4_seq_abort_rsp_cmpl(struct lpfc - if (rsp_iocbq && rsp_iocbq->iocb.ulpStatus) - lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, - "3154 BLS ABORT RSP failed, data: x%x/x%x\n", -- rsp_iocbq->iocb.ulpStatus, -- rsp_iocbq->iocb.un.ulpWord[4]); -+ get_job_ulpstatus(phba, rsp_iocbq), -+ get_job_word4(phba, rsp_iocbq)); - } - - /** -@@ -18340,7 +18377,7 @@ lpfc_sli4_seq_abort_rsp(struct lpfc_vpor - struct lpfc_nodelist *ndlp; - uint16_t oxid, rxid, xri, lxri; - uint32_t sid, fctl; -- IOCB_t *icmd; -+ union lpfc_wqe128 *icmd; - int rc; - - if (!lpfc_is_link_up(phba)) -@@ -18368,22 +18405,11 @@ lpfc_sli4_seq_abort_rsp(struct lpfc_vpor - if (!ctiocb) - return; - -+ icmd = &ctiocb->wqe; -+ - /* Extract the F_CTL field from FC_HDR */ - fctl = sli4_fctl_from_fc_hdr(fc_hdr); - -- icmd = &ctiocb->iocb; -- icmd->un.xseq64.bdl.bdeSize = 0; -- icmd->un.xseq64.bdl.ulpIoTag32 = 0; -- icmd->un.xseq64.w5.hcsw.Dfctl = 0; -- icmd->un.xseq64.w5.hcsw.Rctl = FC_RCTL_BA_ACC; -- icmd->un.xseq64.w5.hcsw.Type = FC_TYPE_BLS; -- -- /* Fill in the rest of iocb fields */ -- icmd->ulpCommand = CMD_XMIT_BLS_RSP64_CX; -- icmd->ulpBdeCount = 0; -- icmd->ulpLe = 1; -- icmd->ulpClass = CLASS3; -- icmd->ulpContext = phba->sli4_hba.rpi_ids[ndlp->nlp_rpi]; - ctiocb->context1 = lpfc_nlp_get(ndlp); - if (!ctiocb->context1) { - lpfc_sli_release_iocbq(phba, ctiocb); -@@ -18394,17 +18420,15 @@ lpfc_sli4_seq_abort_rsp(struct lpfc_vpor - ctiocb->cmd_cmpl = lpfc_sli4_seq_abort_rsp_cmpl; - ctiocb->sli4_lxritag = NO_XRI; - ctiocb->sli4_xritag = NO_XRI; -+ ctiocb->abort_rctl = FC_RCTL_BA_ACC; - -- if (fctl & FC_FC_EX_CTX) { -+ if (fctl & FC_FC_EX_CTX) - /* Exchange responder sent the abort so we - * own the oxid. - */ -- ctiocb->abort_bls = LPFC_ABTS_UNSOL_RSP; - xri = oxid; -- } else { -- ctiocb->abort_bls = LPFC_ABTS_UNSOL_INT; -+ else - xri = rxid; -- } - lxri = lpfc_sli4_xri_inrange(phba, xri); - if (lxri != NO_XRI) - lpfc_set_rrq_active(phba, ndlp, lxri, -@@ -18416,10 +18440,12 @@ lpfc_sli4_seq_abort_rsp(struct lpfc_vpor - */ - if ((fctl & FC_FC_EX_CTX) && - (lxri > lpfc_sli4_get_iocb_cnt(phba))) { -- icmd->un.xseq64.w5.hcsw.Rctl = FC_RCTL_BA_RJT; -- bf_set(lpfc_vndr_code, &icmd->un.bls_rsp, 0); -- bf_set(lpfc_rsn_expln, &icmd->un.bls_rsp, FC_BA_RJT_INV_XID); -- bf_set(lpfc_rsn_code, &icmd->un.bls_rsp, FC_BA_RJT_UNABLE); -+ ctiocb->abort_rctl = FC_RCTL_BA_RJT; -+ bf_set(xmit_bls_rsp64_rjt_vspec, &icmd->xmit_bls_rsp, 0); -+ bf_set(xmit_bls_rsp64_rjt_expc, &icmd->xmit_bls_rsp, -+ FC_BA_RJT_INV_XID); -+ bf_set(xmit_bls_rsp64_rjt_rsnc, &icmd->xmit_bls_rsp, -+ FC_BA_RJT_UNABLE); - } - - /* If BA_ABTS failed to abort a partially assembled receive sequence, -@@ -18427,10 +18453,12 @@ lpfc_sli4_seq_abort_rsp(struct lpfc_vpor - * the IOCB for a BA_RJT. - */ - if (aborted == false) { -- icmd->un.xseq64.w5.hcsw.Rctl = FC_RCTL_BA_RJT; -- bf_set(lpfc_vndr_code, &icmd->un.bls_rsp, 0); -- bf_set(lpfc_rsn_expln, &icmd->un.bls_rsp, FC_BA_RJT_INV_XID); -- bf_set(lpfc_rsn_code, &icmd->un.bls_rsp, FC_BA_RJT_UNABLE); -+ ctiocb->abort_rctl = FC_RCTL_BA_RJT; -+ bf_set(xmit_bls_rsp64_rjt_vspec, &icmd->xmit_bls_rsp, 0); -+ bf_set(xmit_bls_rsp64_rjt_expc, &icmd->xmit_bls_rsp, -+ FC_BA_RJT_INV_XID); -+ bf_set(xmit_bls_rsp64_rjt_rsnc, &icmd->xmit_bls_rsp, -+ FC_BA_RJT_UNABLE); - } - - if (fctl & FC_FC_EX_CTX) { -@@ -18438,28 +18466,40 @@ lpfc_sli4_seq_abort_rsp(struct lpfc_vpor - * of BA_ACC will use OX_ID from ABTS for the XRI_TAG - * field and RX_ID from ABTS for RX_ID field. - */ -- bf_set(lpfc_abts_orig, &icmd->un.bls_rsp, LPFC_ABTS_UNSOL_RSP); -+ ctiocb->abort_bls = LPFC_ABTS_UNSOL_RSP; -+ bf_set(xmit_bls_rsp64_rxid, &icmd->xmit_bls_rsp, rxid); - } else { - /* ABTS sent by initiator to CT exchange, construction - * of BA_ACC will need to allocate a new XRI as for the - * XRI_TAG field. - */ -- bf_set(lpfc_abts_orig, &icmd->un.bls_rsp, LPFC_ABTS_UNSOL_INT); -+ ctiocb->abort_bls = LPFC_ABTS_UNSOL_INT; - } -- bf_set(lpfc_abts_rxid, &icmd->un.bls_rsp, rxid); -- bf_set(lpfc_abts_oxid, &icmd->un.bls_rsp, oxid); -+ -+ /* OX_ID is invariable to who sent ABTS to CT exchange */ -+ bf_set(xmit_bls_rsp64_oxid, &icmd->xmit_bls_rsp, oxid); -+ bf_set(xmit_bls_rsp64_oxid, &icmd->xmit_bls_rsp, rxid); -+ -+ /* Use CT=VPI */ -+ bf_set(wqe_els_did, &icmd->xmit_bls_rsp.wqe_dest, -+ ndlp->nlp_DID); -+ bf_set(xmit_bls_rsp64_temprpi, &icmd->xmit_bls_rsp, -+ phba->sli4_hba.rpi_ids[ndlp->nlp_rpi]); -+ bf_set(wqe_cmnd, &icmd->generic.wqe_com, CMD_XMIT_BLS_RSP64_CX); -+ - - /* Xmit CT abts response on exchange */ - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "1200 Send BLS cmd x%x on oxid x%x Data: x%x\n", -- icmd->un.xseq64.w5.hcsw.Rctl, oxid, phba->link_state); -+ ctiocb->abort_rctl, oxid, phba->link_state); - -+ lpfc_sli_prep_wqe(phba, ctiocb); - rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, ctiocb, 0); - if (rc == IOCB_ERROR) { - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, - "2925 Failed to issue CT ABTS RSP x%x on " - "xri x%x, Data x%x\n", -- icmd->un.xseq64.w5.hcsw.Rctl, oxid, -+ ctiocb->abort_rctl, oxid, - phba->link_state); - lpfc_nlp_put(ndlp); - ctiocb->context1 = NULL; ---- a/drivers/scsi/lpfc/lpfc_sli.h -+++ b/drivers/scsi/lpfc/lpfc_sli.h -@@ -70,11 +70,13 @@ struct lpfc_iocbq { - struct lpfc_wcqe_complete wcqe_cmpl; /* WQE cmpl */ - - u32 unsol_rcv_len; /* Receive len in usol path */ -+ - uint8_t num_bdes; - uint8_t abort_bls; /* ABTS by initiator or responder */ -- -+ u8 abort_rctl; /* ACC or RJT flag */ - uint8_t priority; /* OAS priority */ - uint8_t retry; /* retry counter for IOCB cmd - if needed */ -+ - u32 cmd_flag; - #define LPFC_IO_LIBDFC 1 /* libdfc iocb */ - #define LPFC_IO_WAKE 2 /* Synchronous I/O completed */ diff --git a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-BSG-paths.patch b/patches.suse/scsi-lpfc-SLI-path-split-Refactor-BSG-paths.patch deleted file mode 100644 index a7fa209..0000000 --- a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-BSG-paths.patch +++ /dev/null @@ -1,149 +0,0 @@ -From: James Smart -Date: Thu, 24 Feb 2022 18:23:06 -0800 -Subject: scsi: lpfc: SLI path split: Refactor BSG paths -Patch-mainline: v5.18-rc1 -Git-commit: 0e082d926f59dbad311e4cc15317631b935a2efe -References: bsc#1197675 - -This patch refactors the BSG paths to use SLI-4 as the primary interface. - - - Conversion away from using SLI-3 iocb structures to set/access fields in - common routines. Use the new generic get/set routines that were added. - This move changes code from indirect structure references to using local - variables with the generic routines. - - - Refactor routines when setting non-generic fields, to have both SLI3 and - SLI4 specific sections. This replaces the set-as-SLI3 then translate to - SLI4 behavior of the past. - -Link: https://lore.kernel.org/r/20220225022308.16486-16-jsmart2021@gmail.com -Co-developed-by: Justin Tee -Signed-off-by: Justin Tee -Signed-off-by: James Smart -Signed-off-by: Martin K. Petersen -Acked-by: Daniel Wagner ---- - drivers/scsi/lpfc/lpfc_bsg.c | 36 ++++++++++++++++++++++-------------- - 1 file changed, 22 insertions(+), 14 deletions(-) - ---- a/drivers/scsi/lpfc/lpfc_bsg.c -+++ b/drivers/scsi/lpfc/lpfc_bsg.c -@@ -564,7 +564,6 @@ lpfc_bsg_rport_els_cmp(struct lpfc_hba * - struct bsg_job_data *dd_data; - struct bsg_job *job; - struct fc_bsg_reply *bsg_reply; -- IOCB_t *rsp; - struct lpfc_nodelist *ndlp; - struct lpfc_dmabuf *pcmd = NULL, *prsp = NULL; - struct fc_bsg_ctels_reply *els_reply; -@@ -572,6 +571,7 @@ lpfc_bsg_rport_els_cmp(struct lpfc_hba * - unsigned long flags; - unsigned int rsp_size; - int rc = 0; -+ u32 ulp_status, ulp_word4, total_data_placed; - - dd_data = cmdiocbq->context1; - ndlp = dd_data->context_un.iocb.ndlp; -@@ -592,7 +592,9 @@ lpfc_bsg_rport_els_cmp(struct lpfc_hba * - cmdiocbq->cmd_flag &= ~LPFC_IO_CMD_OUTSTANDING; - spin_unlock_irqrestore(&phba->hbalock, flags); - -- rsp = &rspiocbq->iocb; -+ ulp_status = get_job_ulpstatus(phba, rspiocbq); -+ ulp_word4 = get_job_word4(phba, rspiocbq); -+ total_data_placed = get_job_data_placed(phba, rspiocbq); - pcmd = (struct lpfc_dmabuf *)cmdiocbq->context2; - prsp = (struct lpfc_dmabuf *)pcmd->list.next; - -@@ -601,24 +603,28 @@ lpfc_bsg_rport_els_cmp(struct lpfc_hba * - */ - - if (job) { -- if (rsp->ulpStatus == IOSTAT_SUCCESS) { -- rsp_size = rsp->un.elsreq64.bdl.bdeSize; -+ if (ulp_status == IOSTAT_SUCCESS) { -+ rsp_size = total_data_placed; - bsg_reply->reply_payload_rcv_len = - sg_copy_from_buffer(job->reply_payload.sg_list, - job->reply_payload.sg_cnt, - prsp->virt, - rsp_size); -- } else if (rsp->ulpStatus == IOSTAT_LS_RJT) { -+ } else if (ulp_status == IOSTAT_LS_RJT) { - bsg_reply->reply_payload_rcv_len = - sizeof(struct fc_bsg_ctels_reply); - /* LS_RJT data returned in word 4 */ -- rjt_data = (uint8_t *)&rsp->un.ulpWord[4]; -+ rjt_data = (uint8_t *)&ulp_word4; - els_reply = &bsg_reply->reply_data.ctels_reply; - els_reply->status = FC_CTELS_STATUS_REJECT; - els_reply->rjt_data.action = rjt_data[3]; - els_reply->rjt_data.reason_code = rjt_data[2]; - els_reply->rjt_data.reason_explanation = rjt_data[1]; - els_reply->rjt_data.vendor_unique = rjt_data[0]; -+ } else if (ulp_status == IOSTAT_LOCAL_REJECT && -+ (ulp_word4 & IOERR_PARAM_MASK) == -+ IOERR_SEQUENCE_TIMEOUT) { -+ rc = -ETIMEDOUT; - } else { - rc = -EIO; - } -@@ -695,7 +701,6 @@ lpfc_bsg_rport_els(struct bsg_job *job) - * we won't be dma into memory that is no longer allocated to for the - * request. - */ -- - cmdiocbq = lpfc_prep_els_iocb(vport, 1, cmdsize, 0, ndlp, - ndlp->nlp_DID, elscmd); - if (!cmdiocbq) { -@@ -707,12 +712,13 @@ lpfc_bsg_rport_els(struct bsg_job *job) - sg_copy_to_buffer(job->request_payload.sg_list, - job->request_payload.sg_cnt, - ((struct lpfc_dmabuf *)cmdiocbq->context2)->virt, -- cmdsize); -+ job->request_payload.payload_len); - - rpi = ndlp->nlp_rpi; - - if (phba->sli_rev == LPFC_SLI_REV4) -- cmdiocbq->iocb.ulpContext = phba->sli4_hba.rpi_ids[rpi]; -+ bf_set(wqe_ctxt_tag, &cmdiocbq->wqe.generic.wqe_com, -+ phba->sli4_hba.rpi_ids[rpi]); - else - cmdiocbq->iocb.ulpContext = rpi; - cmdiocbq->cmd_flag |= LPFC_IO_LIBDFC; -@@ -1377,11 +1383,11 @@ lpfc_issue_ct_rsp_cmp(struct lpfc_hba *p - struct bsg_job_data *dd_data; - struct bsg_job *job; - struct fc_bsg_reply *bsg_reply; -- IOCB_t *rsp; - struct lpfc_dmabuf *bmp, *cmp; - struct lpfc_nodelist *ndlp; - unsigned long flags; - int rc = 0; -+ u32 ulp_status, ulp_word4; - - dd_data = cmdiocbq->context1; - -@@ -1402,15 +1408,17 @@ lpfc_issue_ct_rsp_cmp(struct lpfc_hba *p - ndlp = dd_data->context_un.iocb.ndlp; - cmp = cmdiocbq->context2; - bmp = cmdiocbq->context3; -- rsp = &rspiocbq->iocb; -+ -+ ulp_status = get_job_ulpstatus(phba, rspiocbq); -+ ulp_word4 = get_job_word4(phba, rspiocbq); - - /* Copy the completed job data or set the error status */ - - if (job) { - bsg_reply = job->reply; -- if (rsp->ulpStatus) { -- if (rsp->ulpStatus == IOSTAT_LOCAL_REJECT) { -- switch (rsp->un.ulpWord[4] & IOERR_PARAM_MASK) { -+ if (ulp_status) { -+ if (ulp_status == IOSTAT_LOCAL_REJECT) { -+ switch (ulp_word4 & IOERR_PARAM_MASK) { - case IOERR_SEQUENCE_TIMEOUT: - rc = -ETIMEDOUT; - break; diff --git a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-CT-paths.patch b/patches.suse/scsi-lpfc-SLI-path-split-Refactor-CT-paths.patch deleted file mode 100644 index 67bd678..0000000 --- a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-CT-paths.patch +++ /dev/null @@ -1,1981 +0,0 @@ -From: James Smart -Date: Thu, 24 Feb 2022 18:23:03 -0800 -Subject: scsi: lpfc: SLI path split: Refactor CT paths -Patch-mainline: v5.18-rc1 -Git-commit: 61910d6a524308357c17f7e41acff83ec9510cee -References: bsc#1197675 - -This patch refactors the CT paths to use SLI-4 as the primary interface. - - - Introduce generic lpfc_sli_prep_gen_req jump table routine - - - Introduce generic lpfc_sli_prep_xmit_seq64 jump table routine - - - Rename lpfcdiag_loop_post_rxbufs to lpfcdiag_sli3_loop_post_rxbufs to - indicate that it is an SLI3 only path - - - Create new prep_wqe routine for unsolicited ELS rsp WQEs. - - - Conversion away from using SLI-3 iocb structures to set/access fields in - common routines. Use the new generic get/set routines that were added. - This move changes code from indirect structure references to using local - variables with the generic routines. - - - Refactor routines when setting non-generic fields, to have both SLI3 and - SLI4 specific sections. This replaces the set-as-SLI3 then translate to - SLI4 behavior of the past. - -Link: https://lore.kernel.org/r/20220225022308.16486-13-jsmart2021@gmail.com -Co-developed-by: Justin Tee -Signed-off-by: Justin Tee -Signed-off-by: James Smart -Signed-off-by: Martin K. Petersen -Acked-by: Daniel Wagner ---- - drivers/scsi/lpfc/lpfc.h | 16 + - drivers/scsi/lpfc/lpfc_bsg.c | 266 +++++++++++----------------- - drivers/scsi/lpfc/lpfc_crtn.h | 8 - drivers/scsi/lpfc/lpfc_ct.c | 331 ++++++++++++++++------------------- - drivers/scsi/lpfc/lpfc_sli.c | 390 +++++++++++++++++++++++++++++++++++------- - drivers/scsi/lpfc/lpfc_sli.h | 1 - 6 files changed, 615 insertions(+), 397 deletions(-) - ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -880,6 +880,13 @@ struct lpfc_hba { - struct lpfc_dmabuf *bmp, - u16 cmd_size, u32 did, u32 elscmd, - u8 tmo, u8 expect_rsp); -+ void (*__lpfc_sli_prep_gen_req)(struct lpfc_iocbq *cmdiocbq, -+ struct lpfc_dmabuf *bmp, u16 rpi, -+ u32 num_entry, u8 tmo); -+ void (*__lpfc_sli_prep_xmit_seq64)(struct lpfc_iocbq *cmdiocbq, -+ struct lpfc_dmabuf *bmp, u16 rpi, -+ u16 ox_id, u32 num_entry, u8 rctl, -+ u8 last_seq, u8 cr_cx_cmd); - - /* expedite pool */ - struct lpfc_epd_pool epd_pool; -@@ -1729,6 +1736,15 @@ u16 get_job_rcvoxid(struct lpfc_hba *phb - } - - static inline -+u32 get_job_data_placed(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq) -+{ -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ return iocbq->wcqe_cmpl.total_data_placed; -+ else -+ return iocbq->iocb.un.genreq64.bdl.bdeSize; -+} -+ -+static inline - u32 get_job_els_rsp64_did(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq) - { - if (phba->sli_rev == LPFC_SLI_REV4) ---- a/drivers/scsi/lpfc/lpfc_bsg.c -+++ b/drivers/scsi/lpfc/lpfc_bsg.c -@@ -303,13 +303,12 @@ lpfc_bsg_send_mgmt_cmd_cmp(struct lpfc_h - struct bsg_job_data *dd_data; - struct bsg_job *job; - struct fc_bsg_reply *bsg_reply; -- IOCB_t *rsp; - struct lpfc_dmabuf *bmp, *cmp, *rmp; - struct lpfc_nodelist *ndlp; - struct lpfc_bsg_iocb *iocb; - unsigned long flags; -- unsigned int rsp_size; - int rc = 0; -+ u32 ulp_status, ulp_word4, total_data_placed; - - dd_data = cmdiocbq->context1; - -@@ -333,14 +332,16 @@ lpfc_bsg_send_mgmt_cmd_cmp(struct lpfc_h - rmp = iocb->rmp; - cmp = cmdiocbq->context2; - bmp = cmdiocbq->context3; -- rsp = &rspiocbq->iocb; -+ ulp_status = get_job_ulpstatus(phba, rspiocbq); -+ ulp_word4 = get_job_word4(phba, rspiocbq); -+ total_data_placed = get_job_data_placed(phba, rspiocbq); - - /* Copy the completed data or set the error status */ - - if (job) { -- if (rsp->ulpStatus) { -- if (rsp->ulpStatus == IOSTAT_LOCAL_REJECT) { -- switch (rsp->un.ulpWord[4] & IOERR_PARAM_MASK) { -+ if (ulp_status) { -+ if (ulp_status == IOSTAT_LOCAL_REJECT) { -+ switch (ulp_word4 & IOERR_PARAM_MASK) { - case IOERR_SEQUENCE_TIMEOUT: - rc = -ETIMEDOUT; - break; -@@ -355,10 +356,9 @@ lpfc_bsg_send_mgmt_cmd_cmp(struct lpfc_h - rc = -EACCES; - } - } else { -- rsp_size = rsp->un.genreq64.bdl.bdeSize; - bsg_reply->reply_payload_rcv_len = - lpfc_bsg_copy_data(rmp, &job->reply_payload, -- rsp_size, 0); -+ total_data_placed, 0); - } - } - -@@ -388,22 +388,21 @@ static int - lpfc_bsg_send_mgmt_cmd(struct bsg_job *job) - { - struct lpfc_vport *vport = shost_priv(fc_bsg_to_shost(job)); -- struct lpfc_hba *phba = vport->phba; - struct lpfc_rport_data *rdata = fc_bsg_to_rport(job)->dd_data; -+ struct lpfc_hba *phba = vport->phba; - struct lpfc_nodelist *ndlp = rdata->pnode; - struct fc_bsg_reply *bsg_reply = job->reply; - struct ulp_bde64 *bpl = NULL; -- uint32_t timeout; - struct lpfc_iocbq *cmdiocbq = NULL; -- IOCB_t *cmd; - struct lpfc_dmabuf *bmp = NULL, *cmp = NULL, *rmp = NULL; -- int request_nseg; -- int reply_nseg; -+ int request_nseg, reply_nseg; -+ u32 num_entry; - struct bsg_job_data *dd_data; - unsigned long flags; - uint32_t creg_val; - int rc = 0; - int iocb_stat; -+ u16 ulp_context; - - /* in case no data is transferred */ - bsg_reply->reply_payload_rcv_len = 0; -@@ -426,8 +425,6 @@ lpfc_bsg_send_mgmt_cmd(struct bsg_job *j - goto free_dd; - } - -- cmd = &cmdiocbq->iocb; -- - bmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL); - if (!bmp) { - rc = -ENOMEM; -@@ -461,29 +458,21 @@ lpfc_bsg_send_mgmt_cmd(struct bsg_job *j - goto free_cmp; - } - -- cmd->un.genreq64.bdl.ulpIoTag32 = 0; -- cmd->un.genreq64.bdl.addrHigh = putPaddrHigh(bmp->phys); -- cmd->un.genreq64.bdl.addrLow = putPaddrLow(bmp->phys); -- cmd->un.genreq64.bdl.bdeFlags = BUFF_TYPE_BLP_64; -- cmd->un.genreq64.bdl.bdeSize = -- (request_nseg + reply_nseg) * sizeof(struct ulp_bde64); -- cmd->ulpCommand = CMD_GEN_REQUEST64_CR; -- cmd->un.genreq64.w5.hcsw.Fctl = (SI | LA); -- cmd->un.genreq64.w5.hcsw.Dfctl = 0; -- cmd->un.genreq64.w5.hcsw.Rctl = FC_RCTL_DD_UNSOL_CTL; -- cmd->un.genreq64.w5.hcsw.Type = FC_TYPE_CT; -- cmd->ulpBdeCount = 1; -- cmd->ulpLe = 1; -- cmd->ulpClass = CLASS3; -- cmd->ulpContext = ndlp->nlp_rpi; -+ num_entry = request_nseg + reply_nseg; -+ - if (phba->sli_rev == LPFC_SLI_REV4) -- cmd->ulpContext = phba->sli4_hba.rpi_ids[ndlp->nlp_rpi]; -- cmd->ulpOwner = OWN_CHIP; -+ ulp_context = phba->sli4_hba.rpi_ids[ndlp->nlp_rpi]; -+ else -+ ulp_context = ndlp->nlp_rpi; -+ -+ lpfc_sli_prep_gen_req(phba, cmdiocbq, bmp, ulp_context, num_entry, -+ phba->fc_ratov * 2); -+ -+ cmdiocbq->num_bdes = num_entry; - cmdiocbq->vport = phba->pport; -+ cmdiocbq->context2 = cmp; - cmdiocbq->context3 = bmp; - cmdiocbq->cmd_flag |= LPFC_IO_LIBDFC; -- timeout = phba->fc_ratov * 2; -- cmd->ulpTimeout = timeout; - - cmdiocbq->cmd_cmpl = lpfc_bsg_send_mgmt_cmd_cmp; - cmdiocbq->context1 = dd_data; -@@ -919,6 +908,7 @@ lpfc_bsg_ct_unsol_event(struct lpfc_hba - struct lpfc_bsg_event *evt; - struct event_data *evt_dat = NULL; - struct lpfc_iocbq *iocbq; -+ IOCB_t *iocb = NULL; - size_t offset = 0; - struct list_head head; - struct ulp_bde64 *bde; -@@ -926,13 +916,13 @@ lpfc_bsg_ct_unsol_event(struct lpfc_hba - int i; - struct lpfc_dmabuf *bdeBuf1 = piocbq->context2; - struct lpfc_dmabuf *bdeBuf2 = piocbq->context3; -- struct lpfc_hbq_entry *hbqe; - struct lpfc_sli_ct_request *ct_req; - struct bsg_job *job = NULL; - struct fc_bsg_reply *bsg_reply; - struct bsg_job_data *dd_data = NULL; - unsigned long flags; - int size = 0; -+ u32 bde_count = 0; - - INIT_LIST_HEAD(&head); - list_add_tail(&head, &piocbq->list); -@@ -962,12 +952,17 @@ lpfc_bsg_ct_unsol_event(struct lpfc_hba - if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) { - /* take accumulated byte count from the last iocbq */ - iocbq = list_entry(head.prev, typeof(*iocbq), list); -- evt_dat->len = iocbq->iocb.unsli3.rcvsli3.acc_len; -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ evt_dat->len = iocbq->wcqe_cmpl.total_data_placed; -+ else -+ evt_dat->len = iocbq->iocb.unsli3.rcvsli3.acc_len; - } else { - list_for_each_entry(iocbq, &head, list) { -- for (i = 0; i < iocbq->iocb.ulpBdeCount; i++) -+ iocb = &iocbq->iocb; -+ for (i = 0; i < iocb->ulpBdeCount; -+ i++) - evt_dat->len += -- iocbq->iocb.un.cont64[i].tus.f.bdeSize; -+ iocb->un.cont64[i].tus.f.bdeSize; - } - } - -@@ -989,20 +984,20 @@ lpfc_bsg_ct_unsol_event(struct lpfc_hba - if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) { - bdeBuf1 = iocbq->context2; - bdeBuf2 = iocbq->context3; -+ - } -- for (i = 0; i < iocbq->iocb.ulpBdeCount; i++) { -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ bde_count = iocbq->wcqe_cmpl.word3; -+ else -+ bde_count = iocbq->iocb.ulpBdeCount; -+ for (i = 0; i < bde_count; i++) { - if (phba->sli3_options & - LPFC_SLI3_HBQ_ENABLED) { - if (i == 0) { -- hbqe = (struct lpfc_hbq_entry *) -- &iocbq->iocb.un.ulpWord[0]; -- size = hbqe->bde.tus.f.bdeSize; -+ size = iocbq->wqe.gen_req.bde.tus.f.bdeSize; - dmabuf = bdeBuf1; - } else if (i == 1) { -- hbqe = (struct lpfc_hbq_entry *) -- &iocbq->iocb.unsli3. -- sli3Words[4]; -- size = hbqe->bde.tus.f.bdeSize; -+ size = iocbq->unsol_rcv_len; - dmabuf = bdeBuf2; - } - if ((offset + size) > evt_dat->len) -@@ -1057,16 +1052,16 @@ lpfc_bsg_ct_unsol_event(struct lpfc_hba - dmabuf); - } else { - lpfc_sli3_post_buffer(phba, -- pring, -- 1); -+ pring, -+ 1); - } - break; - default: - if (!(phba->sli3_options & - LPFC_SLI3_HBQ_ENABLED)) - lpfc_sli3_post_buffer(phba, -- pring, -- 1); -+ pring, -+ 1); - break; - } - } -@@ -1089,14 +1084,15 @@ lpfc_bsg_ct_unsol_event(struct lpfc_hba - phba->ct_ctx[ - evt_dat->immed_dat].SID); - phba->ct_ctx[evt_dat->immed_dat].rxid = -- piocbq->iocb.ulpContext; -+ get_job_ulpcontext(phba, piocbq); - phba->ct_ctx[evt_dat->immed_dat].oxid = -- piocbq->iocb.unsli3.rcvsli3.ox_id; -+ get_job_rcvoxid(phba, piocbq); - phba->ct_ctx[evt_dat->immed_dat].SID = -- piocbq->iocb.un.rcvels.remoteID; -+ bf_get(wqe_els_did, -+ &piocbq->wqe.xmit_els_rsp.wqe_dest); - phba->ct_ctx[evt_dat->immed_dat].valid = UNSOL_VALID; - } else -- evt_dat->immed_dat = piocbq->iocb.ulpContext; -+ evt_dat->immed_dat = get_job_ulpcontext(phba, piocbq); - - evt_dat->type = FC_REG_CT_EVENT; - list_add(&evt_dat->node, &evt->events_to_see); -@@ -1463,13 +1459,13 @@ lpfc_issue_ct_rsp(struct lpfc_hba *phba, - struct lpfc_dmabuf *cmp, struct lpfc_dmabuf *bmp, - int num_entry) - { -- IOCB_t *icmd; - struct lpfc_iocbq *ctiocb = NULL; - int rc = 0; - struct lpfc_nodelist *ndlp = NULL; - struct bsg_job_data *dd_data; - unsigned long flags; - uint32_t creg_val; -+ u16 ulp_context, iotag; - - ndlp = lpfc_findnode_did(phba->pport, phba->ct_ctx[tag].SID); - if (!ndlp) { -@@ -1496,62 +1492,36 @@ lpfc_issue_ct_rsp(struct lpfc_hba *phba, - goto no_ctiocb; - } - -- icmd = &ctiocb->iocb; -- icmd->un.xseq64.bdl.ulpIoTag32 = 0; -- icmd->un.xseq64.bdl.addrHigh = putPaddrHigh(bmp->phys); -- icmd->un.xseq64.bdl.addrLow = putPaddrLow(bmp->phys); -- icmd->un.xseq64.bdl.bdeFlags = BUFF_TYPE_BLP_64; -- icmd->un.xseq64.bdl.bdeSize = (num_entry * sizeof(struct ulp_bde64)); -- icmd->un.xseq64.w5.hcsw.Fctl = (LS | LA); -- icmd->un.xseq64.w5.hcsw.Dfctl = 0; -- icmd->un.xseq64.w5.hcsw.Rctl = FC_RCTL_DD_SOL_CTL; -- icmd->un.xseq64.w5.hcsw.Type = FC_TYPE_CT; -- -- /* Fill in rest of iocb */ -- icmd->ulpCommand = CMD_XMIT_SEQUENCE64_CX; -- icmd->ulpBdeCount = 1; -- icmd->ulpLe = 1; -- icmd->ulpClass = CLASS3; - if (phba->sli_rev == LPFC_SLI_REV4) { - /* Do not issue unsol response if oxid not marked as valid */ - if (phba->ct_ctx[tag].valid != UNSOL_VALID) { - rc = IOCB_ERROR; - goto issue_ct_rsp_exit; - } -- icmd->ulpContext = phba->ct_ctx[tag].rxid; -- icmd->unsli3.rcvsli3.ox_id = phba->ct_ctx[tag].oxid; -- ndlp = lpfc_findnode_did(phba->pport, phba->ct_ctx[tag].SID); -- if (!ndlp) { -- lpfc_printf_log(phba, KERN_WARNING, LOG_ELS, -- "2721 ndlp null for oxid %x SID %x\n", -- icmd->ulpContext, -- phba->ct_ctx[tag].SID); -- rc = IOCB_ERROR; -- goto issue_ct_rsp_exit; -- } - -- /* get a refernece count so the ndlp doesn't go away while -- * we respond -- */ -- if (!lpfc_nlp_get(ndlp)) { -- rc = IOCB_ERROR; -- goto issue_ct_rsp_exit; -- } -- -- icmd->un.ulpWord[3] = -- phba->sli4_hba.rpi_ids[ndlp->nlp_rpi]; -+ lpfc_sli_prep_xmit_seq64(phba, ctiocb, bmp, -+ phba->sli4_hba.rpi_ids[ndlp->nlp_rpi], -+ phba->ct_ctx[tag].oxid, num_entry, -+ FC_RCTL_DD_SOL_CTL, 1, -+ CMD_XMIT_SEQUENCE64_WQE); - - /* The exchange is done, mark the entry as invalid */ - phba->ct_ctx[tag].valid = UNSOL_INVALID; -- } else -- icmd->ulpContext = (ushort) tag; -+ iotag = get_wqe_reqtag(ctiocb); -+ } else { -+ lpfc_sli_prep_xmit_seq64(phba, ctiocb, bmp, 0, tag, num_entry, -+ FC_RCTL_DD_SOL_CTL, 1, -+ CMD_XMIT_SEQUENCE64_CX); -+ ctiocb->num_bdes = num_entry; -+ iotag = ctiocb->iocb.ulpIoTag; -+ } - -- icmd->ulpTimeout = phba->fc_ratov * 2; -+ ulp_context = get_job_ulpcontext(phba, ctiocb); - - /* Xmit CT response on exchange */ - lpfc_printf_log(phba, KERN_INFO, LOG_ELS, -- "2722 Xmit CT response on exchange x%x Data: x%x x%x x%x\n", -- icmd->ulpContext, icmd->ulpIoTag, tag, phba->link_state); -+ "2722 Xmit CT response on exchange x%x Data: x%x x%x x%x\n", -+ ulp_context, iotag, tag, phba->link_state); - - ctiocb->cmd_flag |= LPFC_IO_LIBDFC; - ctiocb->vport = phba->pport; -@@ -2637,7 +2607,6 @@ static int lpfcdiag_loop_get_xri(struct - { - struct lpfc_bsg_event *evt; - struct lpfc_iocbq *cmdiocbq, *rspiocbq; -- IOCB_t *cmd, *rsp; - struct lpfc_dmabuf *dmabuf; - struct ulp_bde64 *bpl = NULL; - struct lpfc_sli_ct_request *ctreq = NULL; -@@ -2645,6 +2614,7 @@ static int lpfcdiag_loop_get_xri(struct - int time_left; - int iocb_stat = IOCB_SUCCESS; - unsigned long flags; -+ u32 status; - - *txxri = 0; - *rxxri = 0; -@@ -2688,9 +2658,6 @@ static int lpfcdiag_loop_get_xri(struct - goto err_get_xri_exit; - } - -- cmd = &cmdiocbq->iocb; -- rsp = &rspiocbq->iocb; -- - memset(ctreq, 0, ELX_LOOPBACK_HEADER_SZ); - - ctreq->RevisionId.bits.Revision = SLI_CT_REVISION; -@@ -2700,36 +2667,24 @@ static int lpfcdiag_loop_get_xri(struct - ctreq->CommandResponse.bits.CmdRsp = ELX_LOOPBACK_XRI_SETUP; - ctreq->CommandResponse.bits.Size = 0; - -- -- cmd->un.xseq64.bdl.addrHigh = putPaddrHigh(dmabuf->phys); -- cmd->un.xseq64.bdl.addrLow = putPaddrLow(dmabuf->phys); -- cmd->un.xseq64.bdl.bdeFlags = BUFF_TYPE_BLP_64; -- cmd->un.xseq64.bdl.bdeSize = sizeof(*bpl); -- -- cmd->un.xseq64.w5.hcsw.Fctl = LA; -- cmd->un.xseq64.w5.hcsw.Dfctl = 0; -- cmd->un.xseq64.w5.hcsw.Rctl = FC_RCTL_DD_UNSOL_CTL; -- cmd->un.xseq64.w5.hcsw.Type = FC_TYPE_CT; -- -- cmd->ulpCommand = CMD_XMIT_SEQUENCE64_CR; -- cmd->ulpBdeCount = 1; -- cmd->ulpLe = 1; -- cmd->ulpClass = CLASS3; -- cmd->ulpContext = rpi; -- -+ cmdiocbq->context3 = dmabuf; - cmdiocbq->cmd_flag |= LPFC_IO_LIBDFC; - cmdiocbq->vport = phba->pport; - cmdiocbq->cmd_cmpl = NULL; - -+ lpfc_sli_prep_xmit_seq64(phba, cmdiocbq, dmabuf, rpi, 0, 1, -+ FC_RCTL_DD_SOL_CTL, 0, CMD_XMIT_SEQUENCE64_CR); -+ - iocb_stat = lpfc_sli_issue_iocb_wait(phba, LPFC_ELS_RING, cmdiocbq, -- rspiocbq, -- (phba->fc_ratov * 2) -- + LPFC_DRVR_TIMEOUT); -- if ((iocb_stat != IOCB_SUCCESS) || (rsp->ulpStatus != IOSTAT_SUCCESS)) { -+ rspiocbq, (phba->fc_ratov * 2) -+ + LPFC_DRVR_TIMEOUT); -+ -+ status = get_job_ulpstatus(phba, rspiocbq); -+ if (iocb_stat != IOCB_SUCCESS || status != IOCB_SUCCESS) { - ret_val = -EIO; - goto err_get_xri_exit; - } -- *txxri = rsp->ulpContext; -+ *txxri = get_job_ulpcontext(phba, rspiocbq); - - evt->waiting = 1; - evt->wait_time_stamp = jiffies; -@@ -2930,7 +2885,7 @@ diag_cmd_data_alloc(struct lpfc_hba *phb - } - - /** -- * lpfcdiag_loop_post_rxbufs - post the receive buffers for an unsol CT cmd -+ * lpfcdiag_sli3_loop_post_rxbufs - post the receive buffers for an unsol CT cmd - * @phba: Pointer to HBA context object - * @rxxri: Receive exchange id - * @len: Number of data bytes -@@ -2938,8 +2893,8 @@ diag_cmd_data_alloc(struct lpfc_hba *phb - * This function allocates and posts a data buffer of sufficient size to receive - * an unsolicted CT command. - **/ --static int lpfcdiag_loop_post_rxbufs(struct lpfc_hba *phba, uint16_t rxxri, -- size_t len) -+static int lpfcdiag_sli3_loop_post_rxbufs(struct lpfc_hba *phba, uint16_t rxxri, -+ size_t len) - { - struct lpfc_sli_ring *pring; - struct lpfc_iocbq *cmdiocbq; -@@ -2976,7 +2931,6 @@ static int lpfcdiag_loop_post_rxbufs(str - /* Queue buffers for the receive exchange */ - num_bde = (uint32_t)rxbuffer->flag; - dmp = &rxbuffer->dma; -- - cmd = &cmdiocbq->iocb; - i = 0; - -@@ -3044,7 +2998,6 @@ static int lpfcdiag_loop_post_rxbufs(str - ret_val = -EIO; - goto err_post_rxbufs_exit; - } -- - cmd = &cmdiocbq->iocb; - i = 0; - } -@@ -3096,7 +3049,7 @@ lpfc_bsg_diag_loopback_run(struct bsg_jo - size_t segment_len = 0, segment_offset = 0, current_offset = 0; - uint16_t rpi = 0; - struct lpfc_iocbq *cmdiocbq, *rspiocbq = NULL; -- IOCB_t *cmd, *rsp = NULL; -+ union lpfc_wqe128 *cmdwqe, *rspwqe; - struct lpfc_sli_ct_request *ctreq; - struct lpfc_dmabuf *txbmp; - struct ulp_bde64 *txbpl = NULL; -@@ -3189,7 +3142,7 @@ lpfc_bsg_diag_loopback_run(struct bsg_jo - goto loopback_test_exit; - } - -- rc = lpfcdiag_loop_post_rxbufs(phba, rxxri, full_size); -+ rc = lpfcdiag_sli3_loop_post_rxbufs(phba, rxxri, full_size); - if (rc) { - lpfcdiag_loop_self_unreg(phba, rpi); - goto loopback_test_exit; -@@ -3232,9 +3185,12 @@ lpfc_bsg_diag_loopback_run(struct bsg_jo - goto err_loopback_test_exit; - } - -- cmd = &cmdiocbq->iocb; -- if (phba->sli_rev < LPFC_SLI_REV4) -- rsp = &rspiocbq->iocb; -+ cmdwqe = &cmdiocbq->wqe; -+ memset(cmdwqe, 0, sizeof(union lpfc_wqe)); -+ if (phba->sli_rev < LPFC_SLI_REV4) { -+ rspwqe = &rspiocbq->wqe; -+ memset(rspwqe, 0, sizeof(union lpfc_wqe)); -+ } - - INIT_LIST_HEAD(&head); - list_add_tail(&head, &txbuffer->dma.list); -@@ -3266,42 +3222,32 @@ lpfc_bsg_diag_loopback_run(struct bsg_jo - /* Build the XMIT_SEQUENCE iocb */ - num_bde = (uint32_t)txbuffer->flag; - -- cmd->un.xseq64.bdl.addrHigh = putPaddrHigh(txbmp->phys); -- cmd->un.xseq64.bdl.addrLow = putPaddrLow(txbmp->phys); -- cmd->un.xseq64.bdl.bdeFlags = BUFF_TYPE_BLP_64; -- cmd->un.xseq64.bdl.bdeSize = (num_bde * sizeof(struct ulp_bde64)); -- -- cmd->un.xseq64.w5.hcsw.Fctl = (LS | LA); -- cmd->un.xseq64.w5.hcsw.Dfctl = 0; -- cmd->un.xseq64.w5.hcsw.Rctl = FC_RCTL_DD_UNSOL_CTL; -- cmd->un.xseq64.w5.hcsw.Type = FC_TYPE_CT; -- -- cmd->ulpCommand = CMD_XMIT_SEQUENCE64_CX; -- cmd->ulpBdeCount = 1; -- cmd->ulpLe = 1; -- cmd->ulpClass = CLASS3; -+ cmdiocbq->num_bdes = num_bde; -+ cmdiocbq->cmd_flag |= LPFC_IO_LIBDFC; -+ cmdiocbq->cmd_flag |= LPFC_IO_LOOPBACK; -+ cmdiocbq->vport = phba->pport; -+ cmdiocbq->cmd_cmpl = NULL; -+ cmdiocbq->context3 = txbmp; - - if (phba->sli_rev < LPFC_SLI_REV4) { -- cmd->ulpContext = txxri; -+ lpfc_sli_prep_xmit_seq64(phba, cmdiocbq, txbmp, 0, txxri, -+ num_bde, FC_RCTL_DD_UNSOL_CTL, 1, -+ CMD_XMIT_SEQUENCE64_CX); -+ - } else { -- cmd->un.xseq64.bdl.ulpIoTag32 = 0; -- cmd->un.ulpWord[3] = phba->sli4_hba.rpi_ids[rpi]; -- cmdiocbq->context3 = txbmp; -+ lpfc_sli_prep_xmit_seq64(phba, cmdiocbq, txbmp, -+ phba->sli4_hba.rpi_ids[rpi], 0xffff, -+ full_size, FC_RCTL_DD_UNSOL_CTL, 1, -+ CMD_XMIT_SEQUENCE64_WQE); - cmdiocbq->sli4_xritag = NO_XRI; -- cmd->unsli3.rcvsli3.ox_id = 0xffff; - } -- cmdiocbq->cmd_flag |= LPFC_IO_LIBDFC; -- cmdiocbq->cmd_flag |= LPFC_IO_LOOPBACK; -- cmdiocbq->vport = phba->pport; -- cmdiocbq->cmd_cmpl = NULL; - - iocb_stat = lpfc_sli_issue_iocb_wait(phba, LPFC_ELS_RING, cmdiocbq, - rspiocbq, (phba->fc_ratov * 2) + - LPFC_DRVR_TIMEOUT); -- -- if ((iocb_stat != IOCB_SUCCESS) || -- ((phba->sli_rev < LPFC_SLI_REV4) && -- (rsp->ulpStatus != IOSTAT_SUCCESS))) { -+ if (iocb_stat != IOCB_SUCCESS || -+ (phba->sli_rev < LPFC_SLI_REV4 && -+ (get_job_ulpstatus(phba, rspiocbq) != IOSTAT_SUCCESS))) { - lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC, - "3126 Failed loopback test issue iocb: " - "iocb_stat:x%x\n", iocb_stat); ---- a/drivers/scsi/lpfc/lpfc_crtn.h -+++ b/drivers/scsi/lpfc/lpfc_crtn.h -@@ -359,6 +359,14 @@ void lpfc_sli_prep_els_req_rsp(struct lp - struct lpfc_vport *vport, - struct lpfc_dmabuf *bmp, u16 cmd_size, u32 did, - u32 elscmd, u8 tmo, u8 expect_rsp); -+void lpfc_sli_prep_gen_req(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocbq, -+ struct lpfc_dmabuf *bmp, u16 rpi, u32 num_entry, -+ u8 tmo); -+void lpfc_sli_prep_xmit_seq64(struct lpfc_hba *phba, -+ struct lpfc_iocbq *cmdiocbq, -+ struct lpfc_dmabuf *bmp, u16 rpi, u16 ox_id, -+ u32 num_entry, u8 rctl, u8 last_seq, -+ u8 cr_cx_cmd); - struct lpfc_sglq *__lpfc_clear_active_sglq(struct lpfc_hba *phba, uint16_t xri); - struct lpfc_sglq *__lpfc_sli_get_nvmet_sglq(struct lpfc_hba *phba, - struct lpfc_iocbq *piocbq); ---- a/drivers/scsi/lpfc/lpfc_ct.c -+++ b/drivers/scsi/lpfc/lpfc_ct.c -@@ -85,12 +85,12 @@ lpfc_ct_ignore_hbq_buffer(struct lpfc_hb - lpfc_printf_log(phba, KERN_INFO, LOG_ELS, - "0146 Ignoring unsolicited CT No HBQ " - "status = x%x\n", -- piocbq->iocb.ulpStatus); -+ get_job_ulpstatus(phba, piocbq)); - } - lpfc_printf_log(phba, KERN_INFO, LOG_ELS, - "0145 Ignoring unsolicted CT HBQ Size:%d " - "status = x%x\n", -- size, piocbq->iocb.ulpStatus); -+ size, get_job_ulpstatus(phba, piocbq)); - } - - static void -@@ -141,7 +141,7 @@ lpfc_ct_unsol_cmpl(struct lpfc_hba *phba - * lpfc_ct_reject_event - Issue reject for unhandled CT MIB commands - * @ndlp: pointer to a node-list data structure. - * @ct_req: pointer to the CT request data structure. -- * @rx_id: rx_id of the received UNSOL CT command -+ * @ulp_context: context of received UNSOL CT command - * @ox_id: ox_id of the UNSOL CT command - * - * This routine is invoked by the lpfc_ct_handle_mibreq routine for sending -@@ -150,7 +150,7 @@ lpfc_ct_unsol_cmpl(struct lpfc_hba *phba - static void - lpfc_ct_reject_event(struct lpfc_nodelist *ndlp, - struct lpfc_sli_ct_request *ct_req, -- u16 rx_id, u16 ox_id) -+ u16 ulp_context, u16 ox_id) - { - struct lpfc_vport *vport = ndlp->vport; - struct lpfc_hba *phba = vport->phba; -@@ -159,8 +159,8 @@ lpfc_ct_reject_event(struct lpfc_nodelis - struct lpfc_dmabuf *bmp = NULL; - struct lpfc_dmabuf *mp = NULL; - struct ulp_bde64 *bpl; -- IOCB_t *icmd; - u8 rc = 0; -+ u32 tmo; - - /* fill in BDEs for command */ - mp = kmalloc(sizeof(*mp), GFP_KERNEL); -@@ -218,43 +218,41 @@ lpfc_ct_reject_event(struct lpfc_nodelis - goto ct_free_bmpvirt; - } - -- icmd = &cmdiocbq->iocb; -- icmd->un.genreq64.bdl.ulpIoTag32 = 0; -- icmd->un.genreq64.bdl.addrHigh = putPaddrHigh(bmp->phys); -- icmd->un.genreq64.bdl.addrLow = putPaddrLow(bmp->phys); -- icmd->un.genreq64.bdl.bdeFlags = BUFF_TYPE_BLP_64; -- icmd->un.genreq64.bdl.bdeSize = sizeof(struct ulp_bde64); -- icmd->un.genreq64.w5.hcsw.Fctl = (LS | LA); -- icmd->un.genreq64.w5.hcsw.Dfctl = 0; -- icmd->un.genreq64.w5.hcsw.Rctl = FC_RCTL_DD_SOL_CTL; -- icmd->un.genreq64.w5.hcsw.Type = FC_TYPE_CT; -- icmd->ulpCommand = CMD_XMIT_SEQUENCE64_CX; -- icmd->ulpBdeCount = 1; -- icmd->ulpLe = 1; -- icmd->ulpClass = CLASS3; -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ lpfc_sli_prep_xmit_seq64(phba, cmdiocbq, bmp, -+ phba->sli4_hba.rpi_ids[ndlp->nlp_rpi], -+ ox_id, 1, FC_RCTL_DD_SOL_CTL, 1, -+ CMD_XMIT_SEQUENCE64_WQE); -+ } else { -+ lpfc_sli_prep_xmit_seq64(phba, cmdiocbq, bmp, 0, ulp_context, 1, -+ FC_RCTL_DD_SOL_CTL, 1, -+ CMD_XMIT_SEQUENCE64_CX); -+ } - - /* Save for completion so we can release these resources */ -- cmdiocbq->context1 = lpfc_nlp_get(ndlp); - cmdiocbq->context2 = (uint8_t *)mp; - cmdiocbq->context3 = (uint8_t *)bmp; - cmdiocbq->cmd_cmpl = lpfc_ct_unsol_cmpl; -- icmd->ulpContext = rx_id; /* Xri / rx_id */ -- icmd->unsli3.rcvsli3.ox_id = ox_id; -- icmd->un.ulpWord[3] = -- phba->sli4_hba.rpi_ids[ndlp->nlp_rpi]; -- icmd->ulpTimeout = (3 * phba->fc_ratov); -+ tmo = (3 * phba->fc_ratov); - - cmdiocbq->retry = 0; - cmdiocbq->vport = vport; - cmdiocbq->context_un.ndlp = NULL; -- cmdiocbq->drvrTimeout = icmd->ulpTimeout + LPFC_DRVR_TIMEOUT; -+ cmdiocbq->drvrTimeout = tmo + LPFC_DRVR_TIMEOUT; -+ -+ cmdiocbq->context1 = lpfc_nlp_get(ndlp); -+ if (!cmdiocbq->context1) -+ goto ct_no_ndlp; - - rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, cmdiocbq, 0); -- if (!rc) -- return; -+ if (rc) { -+ lpfc_nlp_put(ndlp); -+ goto ct_no_ndlp; -+ } -+ return; - -+ct_no_ndlp: - rc = 6; -- lpfc_nlp_put(ndlp); - lpfc_sli_release_iocbq(phba, cmdiocbq); - ct_free_bmpvirt: - lpfc_mbuf_free(phba, bmp->virt, bmp->phys); -@@ -284,25 +282,17 @@ lpfc_ct_handle_mibreq(struct lpfc_hba *p - { - struct lpfc_sli_ct_request *ct_req; - struct lpfc_nodelist *ndlp = NULL; -- struct lpfc_vport *vport = NULL; -- IOCB_t *icmd = &ctiocbq->iocb; -- u32 mi_cmd, vpi; -- u32 did = 0; -- -- vpi = ctiocbq->iocb.unsli3.rcvsli3.vpi; -- vport = lpfc_find_vport_by_vpid(phba, vpi); -- if (!vport) { -- lpfc_printf_log(phba, KERN_INFO, LOG_ELS, -- "6437 Unsol CT: VPORT NULL vpi : x%x\n", -- vpi); -- return; -- } -+ struct lpfc_vport *vport = ctiocbq->vport; -+ u32 ulp_status = get_job_ulpstatus(phba, ctiocbq); -+ u32 ulp_word4 = get_job_word4(phba, ctiocbq); -+ u32 did; -+ u32 mi_cmd; - -- did = ctiocbq->iocb.un.rcvels.remoteID; -- if (icmd->ulpStatus) { -+ did = bf_get(els_rsp64_sid, &ctiocbq->wqe.xmit_els_rsp); -+ if (ulp_status) { - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "6438 Unsol CT: status:x%x/x%x did : x%x\n", -- icmd->ulpStatus, icmd->un.ulpWord[4], did); -+ ulp_status, ulp_word4, did); - return; - } - -@@ -320,13 +310,14 @@ lpfc_ct_handle_mibreq(struct lpfc_hba *p - - ct_req = ((struct lpfc_sli_ct_request *) - (((struct lpfc_dmabuf *)ctiocbq->context2)->virt)); -- - mi_cmd = ct_req->CommandResponse.bits.CmdRsp; - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "6442 : MI Cmd : x%x Not Supported\n", mi_cmd); - lpfc_ct_reject_event(ndlp, ct_req, -- ctiocbq->iocb.ulpContext, -- ctiocbq->iocb.unsli3.rcvsli3.ox_id); -+ bf_get(wqe_ctxt_tag, -+ &ctiocbq->wqe.xmit_els_rsp.wqe_com), -+ bf_get(wqe_rcvoxid, -+ &ctiocbq->wqe.xmit_els_rsp.wqe_com)); - } - - /** -@@ -349,21 +340,32 @@ lpfc_ct_unsol_event(struct lpfc_hba *phb - IOCB_t *icmd = &ctiocbq->iocb; - int i; - struct lpfc_iocbq *iocbq; -+ struct lpfc_iocbq *iocb; - dma_addr_t dma_addr; - uint32_t size; - struct list_head head; - struct lpfc_sli_ct_request *ct_req; - struct lpfc_dmabuf *bdeBuf1 = ctiocbq->context2; - struct lpfc_dmabuf *bdeBuf2 = ctiocbq->context3; -+ u32 status, parameter, bde_count = 0; -+ struct lpfc_wcqe_complete *wcqe_cmpl = NULL; - - ctiocbq->context1 = NULL; - ctiocbq->context2 = NULL; - ctiocbq->context3 = NULL; - -- if (unlikely(icmd->ulpStatus == IOSTAT_NEED_BUFFER)) { -+ wcqe_cmpl = &ctiocbq->wcqe_cmpl; -+ status = get_job_ulpstatus(phba, ctiocbq); -+ parameter = get_job_word4(phba, ctiocbq); -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ bde_count = wcqe_cmpl->word3; -+ else -+ bde_count = icmd->ulpBdeCount; -+ -+ if (unlikely(status == IOSTAT_NEED_BUFFER)) { - lpfc_sli_hbqbuf_add_hbqs(phba, LPFC_ELS_HBQ); -- } else if ((icmd->ulpStatus == IOSTAT_LOCAL_REJECT) && -- ((icmd->un.ulpWord[4] & IOERR_PARAM_MASK) == -+ } else if ((status == IOSTAT_LOCAL_REJECT) && -+ ((parameter & IOERR_PARAM_MASK) == - IOERR_RCV_BUFFER_WAITING)) { - /* Not enough posted buffers; Try posting more buffers */ - phba->fc_stat.NoRcvBuf++; -@@ -375,26 +377,12 @@ lpfc_ct_unsol_event(struct lpfc_hba *phb - /* If there are no BDEs associated - * with this IOCB, there is nothing to do. - */ -- if (icmd->ulpBdeCount == 0) -+ if (bde_count == 0) - return; - -- if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) { -- ctiocbq->context2 = bdeBuf1; -- if (icmd->ulpBdeCount == 2) -- ctiocbq->context3 = bdeBuf2; -- } else { -- dma_addr = getPaddr(icmd->un.cont64[0].addrHigh, -- icmd->un.cont64[0].addrLow); -- ctiocbq->context2 = lpfc_sli_ringpostbuf_get(phba, pring, -- dma_addr); -- if (icmd->ulpBdeCount == 2) { -- dma_addr = getPaddr(icmd->un.cont64[1].addrHigh, -- icmd->un.cont64[1].addrLow); -- ctiocbq->context3 = lpfc_sli_ringpostbuf_get(phba, -- pring, -- dma_addr); -- } -- } -+ ctiocbq->context2 = bdeBuf1; -+ if (bde_count == 2) -+ ctiocbq->context3 = bdeBuf2; - - ct_req = ((struct lpfc_sli_ct_request *) - (((struct lpfc_dmabuf *)ctiocbq->context2)->virt)); -@@ -410,19 +398,29 @@ lpfc_ct_unsol_event(struct lpfc_hba *phb - if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) { - INIT_LIST_HEAD(&head); - list_add_tail(&head, &ctiocbq->list); -- list_for_each_entry(iocbq, &head, list) { -- icmd = &iocbq->iocb; -- if (icmd->ulpBdeCount == 0) -+ list_for_each_entry(iocb, &head, list) { -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ bde_count = iocb->wcqe_cmpl.word3; -+ else -+ bde_count = iocb->iocb.ulpBdeCount; -+ -+ if (!bde_count) - continue; -- bdeBuf1 = iocbq->context2; -- iocbq->context2 = NULL; -- size = icmd->un.cont64[0].tus.f.bdeSize; -+ bdeBuf1 = iocb->context2; -+ iocb->context2 = NULL; -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ size = iocb->wqe.gen_req.bde.tus.f.bdeSize; -+ else -+ size = iocb->iocb.un.cont64[0].tus.f.bdeSize; - lpfc_ct_unsol_buffer(phba, ctiocbq, bdeBuf1, size); - lpfc_in_buf_free(phba, bdeBuf1); -- if (icmd->ulpBdeCount == 2) { -- bdeBuf2 = iocbq->context3; -- iocbq->context3 = NULL; -- size = icmd->unsli3.rcvsli3.bde2.tus.f.bdeSize; -+ if (bde_count == 2) { -+ bdeBuf2 = iocb->context3; -+ iocb->context3 = NULL; -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ size = iocb->unsol_rcv_len; -+ else -+ size = iocb->iocb.unsli3.rcvsli3.bde2.tus.f.bdeSize; - lpfc_ct_unsol_buffer(phba, ctiocbq, bdeBuf2, - size); - lpfc_in_buf_free(phba, bdeBuf2); -@@ -586,15 +584,15 @@ lpfc_ct_free_iocb(struct lpfc_hba *phba, - static int - lpfc_gen_req(struct lpfc_vport *vport, struct lpfc_dmabuf *bmp, - struct lpfc_dmabuf *inp, struct lpfc_dmabuf *outp, -- void (*cmpl) (struct lpfc_hba *, struct lpfc_iocbq *, -- struct lpfc_iocbq *), -+ void (*cmpl)(struct lpfc_hba *, struct lpfc_iocbq *, -+ struct lpfc_iocbq *), - struct lpfc_nodelist *ndlp, uint32_t event_tag, uint32_t num_entry, - uint32_t tmo, uint8_t retry) - { - struct lpfc_hba *phba = vport->phba; -- IOCB_t *icmd; - struct lpfc_iocbq *geniocb; - int rc; -+ u16 ulp_context; - - /* Allocate buffer for command iocb */ - geniocb = lpfc_sli_get_iocbq(phba); -@@ -602,12 +600,8 @@ lpfc_gen_req(struct lpfc_vport *vport, s - if (geniocb == NULL) - return 1; - -- icmd = &geniocb->iocb; -- icmd->un.genreq64.bdl.ulpIoTag32 = 0; -- icmd->un.genreq64.bdl.addrHigh = putPaddrHigh(bmp->phys); -- icmd->un.genreq64.bdl.addrLow = putPaddrLow(bmp->phys); -- icmd->un.genreq64.bdl.bdeFlags = BUFF_TYPE_BLP_64; -- icmd->un.genreq64.bdl.bdeSize = (num_entry * sizeof(struct ulp_bde64)); -+ /* Update the num_entry bde count */ -+ geniocb->num_bdes = num_entry; - - geniocb->context3 = (uint8_t *) bmp; - -@@ -617,41 +611,26 @@ lpfc_gen_req(struct lpfc_vport *vport, s - - geniocb->event_tag = event_tag; - -- /* Fill in payload, bp points to frame payload */ -- icmd->ulpCommand = CMD_GEN_REQUEST64_CR; -- -- /* Fill in rest of iocb */ -- icmd->un.genreq64.w5.hcsw.Fctl = (SI | LA); -- icmd->un.genreq64.w5.hcsw.Dfctl = 0; -- icmd->un.genreq64.w5.hcsw.Rctl = FC_RCTL_DD_UNSOL_CTL; -- icmd->un.genreq64.w5.hcsw.Type = FC_TYPE_CT; -- - if (!tmo) { - /* FC spec states we need 3 * ratov for CT requests */ - tmo = (3 * phba->fc_ratov); - } -- icmd->ulpTimeout = tmo; -- icmd->ulpBdeCount = 1; -- icmd->ulpLe = 1; -- icmd->ulpClass = CLASS3; -- icmd->ulpContext = ndlp->nlp_rpi; -+ - if (phba->sli_rev == LPFC_SLI_REV4) -- icmd->ulpContext = phba->sli4_hba.rpi_ids[ndlp->nlp_rpi]; -+ ulp_context = phba->sli4_hba.rpi_ids[ndlp->nlp_rpi]; -+ else -+ ulp_context = ndlp->nlp_rpi; - -- if (phba->sli3_options & LPFC_SLI3_NPIV_ENABLED) { -- /* For GEN_REQUEST64_CR, use the RPI */ -- icmd->ulpCt_h = 0; -- icmd->ulpCt_l = 0; -- } -+ lpfc_sli_prep_gen_req(phba, geniocb, bmp, ulp_context, num_entry, tmo); - - /* Issue GEN REQ IOCB for NPORT */ - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "0119 Issue GEN REQ IOCB to NPORT x%x " - "Data: x%x x%x\n", -- ndlp->nlp_DID, icmd->ulpIoTag, -+ ndlp->nlp_DID, geniocb->iotag, - vport->port_state); - geniocb->cmd_cmpl = cmpl; -- geniocb->drvrTimeout = icmd->ulpTimeout + LPFC_DRVR_TIMEOUT; -+ geniocb->drvrTimeout = tmo + LPFC_DRVR_TIMEOUT; - geniocb->vport = vport; - geniocb->retry = retry; - geniocb->context_un.ndlp = lpfc_nlp_get(ndlp); -@@ -659,9 +638,7 @@ lpfc_gen_req(struct lpfc_vport *vport, s - goto out; - - rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, geniocb, 0); -- - if (rc == IOCB_ERROR) { -- geniocb->context_un.ndlp = NULL; - lpfc_nlp_put(ndlp); - goto out; - } -@@ -937,12 +914,13 @@ lpfc_cmpl_ct_cmd_gid_ft(struct lpfc_hba - { - struct lpfc_vport *vport = cmdiocb->vport; - struct Scsi_Host *shost = lpfc_shost_from_vport(vport); -- IOCB_t *irsp; - struct lpfc_dmabuf *outp; - struct lpfc_dmabuf *inp; - struct lpfc_sli_ct_request *CTrsp; - struct lpfc_sli_ct_request *CTreq; - struct lpfc_nodelist *ndlp; -+ u32 ulp_status = get_job_ulpstatus(phba, rspiocb); -+ u32 ulp_word4 = get_job_word4(phba, rspiocb); - int rc, type; - - /* First save ndlp, before we overwrite it */ -@@ -950,13 +928,13 @@ lpfc_cmpl_ct_cmd_gid_ft(struct lpfc_hba - - /* we pass cmdiocb to state machine which needs rspiocb as well */ - cmdiocb->context_un.rsp_iocb = rspiocb; -+ - inp = (struct lpfc_dmabuf *) cmdiocb->context1; - outp = (struct lpfc_dmabuf *) cmdiocb->context2; -- irsp = &rspiocb->iocb; - - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_CT, - "GID_FT cmpl: status:x%x/x%x rtry:%d", -- irsp->ulpStatus, irsp->un.ulpWord[4], vport->fc_ns_retry); -+ ulp_status, ulp_word4, vport->fc_ns_retry); - - /* Ignore response if link flipped after this request was made */ - if (cmdiocb->event_tag != phba->fc_eventTag) { -@@ -980,7 +958,7 @@ lpfc_cmpl_ct_cmd_gid_ft(struct lpfc_hba - lpfc_vport_set_state(vport, FC_VPORT_FAILED); - goto out; - } -- if (lpfc_error_lost_link(irsp->ulpStatus, irsp->un.ulpWord[4])) { -+ if (lpfc_error_lost_link(ulp_status, ulp_word4)) { - lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY, - "0226 NS query failed due to link event\n"); - if (vport->fc_flag & FC_RSCN_MODE) -@@ -1012,11 +990,11 @@ lpfc_cmpl_ct_cmd_gid_ft(struct lpfc_hba - } - spin_unlock_irq(shost->host_lock); - -- if (irsp->ulpStatus) { -+ if (ulp_status) { - /* Check for retry */ - if (vport->fc_ns_retry < LPFC_MAX_NS_RETRY) { -- if (irsp->ulpStatus != IOSTAT_LOCAL_REJECT || -- (irsp->un.ulpWord[4] & IOERR_PARAM_MASK) != -+ if (ulp_status != IOSTAT_LOCAL_REJECT || -+ (ulp_word4 & IOERR_PARAM_MASK) != - IOERR_NO_RESOURCES) - vport->fc_ns_retry++; - -@@ -1039,7 +1017,7 @@ lpfc_cmpl_ct_cmd_gid_ft(struct lpfc_hba - lpfc_vport_set_state(vport, FC_VPORT_FAILED); - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, - "0257 GID_FT Query error: 0x%x 0x%x\n", -- irsp->ulpStatus, vport->fc_ns_retry); -+ ulp_status, vport->fc_ns_retry); - } else { - /* Good status, continue checking */ - CTreq = (struct lpfc_sli_ct_request *) inp->virt; -@@ -1053,12 +1031,12 @@ lpfc_cmpl_ct_cmd_gid_ft(struct lpfc_hba - CTreq->un.gid.Fc4Type, - vport->num_disc_nodes, - vport->gidft_inp, -- irsp->un.genreq64.bdl.bdeSize); -+ get_job_data_placed(phba, rspiocb)); - - lpfc_ns_rsp(vport, - outp, - CTreq->un.gid.Fc4Type, -- (uint32_t) (irsp->un.genreq64.bdl.bdeSize)); -+ get_job_data_placed(phba, rspiocb)); - } else if (CTrsp->CommandResponse.bits.CmdRsp == - be16_to_cpu(SLI_CT_RESPONSE_FS_RJT)) { - /* NameServer Rsp Error */ -@@ -1153,12 +1131,13 @@ lpfc_cmpl_ct_cmd_gid_pt(struct lpfc_hba - { - struct lpfc_vport *vport = cmdiocb->vport; - struct Scsi_Host *shost = lpfc_shost_from_vport(vport); -- IOCB_t *irsp; - struct lpfc_dmabuf *outp; - struct lpfc_dmabuf *inp; - struct lpfc_sli_ct_request *CTrsp; - struct lpfc_sli_ct_request *CTreq; - struct lpfc_nodelist *ndlp; -+ u32 ulp_status = get_job_ulpstatus(phba, rspiocb); -+ u32 ulp_word4 = get_job_word4(phba, rspiocb); - int rc; - - /* First save ndlp, before we overwrite it */ -@@ -1168,11 +1147,10 @@ lpfc_cmpl_ct_cmd_gid_pt(struct lpfc_hba - cmdiocb->context_un.rsp_iocb = rspiocb; - inp = (struct lpfc_dmabuf *)cmdiocb->context1; - outp = (struct lpfc_dmabuf *)cmdiocb->context2; -- irsp = &rspiocb->iocb; - - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_CT, - "GID_PT cmpl: status:x%x/x%x rtry:%d", -- irsp->ulpStatus, irsp->un.ulpWord[4], -+ ulp_status, ulp_word4, - vport->fc_ns_retry); - - /* Ignore response if link flipped after this request was made */ -@@ -1197,7 +1175,7 @@ lpfc_cmpl_ct_cmd_gid_pt(struct lpfc_hba - lpfc_vport_set_state(vport, FC_VPORT_FAILED); - goto out; - } -- if (lpfc_error_lost_link(irsp->ulpStatus, irsp->un.ulpWord[4])) { -+ if (lpfc_error_lost_link(ulp_status, ulp_word4)) { - lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY, - "4166 NS query failed due to link event\n"); - if (vport->fc_flag & FC_RSCN_MODE) -@@ -1229,11 +1207,11 @@ lpfc_cmpl_ct_cmd_gid_pt(struct lpfc_hba - } - spin_unlock_irq(shost->host_lock); - -- if (irsp->ulpStatus) { -+ if (ulp_status) { - /* Check for retry */ - if (vport->fc_ns_retry < LPFC_MAX_NS_RETRY) { -- if (irsp->ulpStatus != IOSTAT_LOCAL_REJECT || -- (irsp->un.ulpWord[4] & IOERR_PARAM_MASK) != -+ if (ulp_status != IOSTAT_LOCAL_REJECT || -+ (ulp_word4 & IOERR_PARAM_MASK) != - IOERR_NO_RESOURCES) - vport->fc_ns_retry++; - -@@ -1252,7 +1230,7 @@ lpfc_cmpl_ct_cmd_gid_pt(struct lpfc_hba - lpfc_vport_set_state(vport, FC_VPORT_FAILED); - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, - "4103 GID_FT Query error: 0x%x 0x%x\n", -- irsp->ulpStatus, vport->fc_ns_retry); -+ ulp_status, vport->fc_ns_retry); - } else { - /* Good status, continue checking */ - CTreq = (struct lpfc_sli_ct_request *)inp->virt; -@@ -1266,12 +1244,12 @@ lpfc_cmpl_ct_cmd_gid_pt(struct lpfc_hba - CTreq->un.gid.Fc4Type, - vport->num_disc_nodes, - vport->gidft_inp, -- irsp->un.genreq64.bdl.bdeSize); -+ get_job_data_placed(phba, rspiocb)); - - lpfc_ns_rsp(vport, - outp, - CTreq->un.gid.Fc4Type, -- (uint32_t)(irsp->un.genreq64.bdl.bdeSize)); -+ get_job_data_placed(phba, rspiocb)); - } else if (CTrsp->CommandResponse.bits.CmdRsp == - be16_to_cpu(SLI_CT_RESPONSE_FS_RJT)) { - /* NameServer Rsp Error */ -@@ -1366,20 +1344,21 @@ lpfc_cmpl_ct_cmd_gff_id(struct lpfc_hba - { - struct lpfc_vport *vport = cmdiocb->vport; - struct Scsi_Host *shost = lpfc_shost_from_vport(vport); -- IOCB_t *irsp = &rspiocb->iocb; - struct lpfc_dmabuf *inp = (struct lpfc_dmabuf *) cmdiocb->context1; - struct lpfc_dmabuf *outp = (struct lpfc_dmabuf *) cmdiocb->context2; - struct lpfc_sli_ct_request *CTrsp; - int did, rc, retry; - uint8_t fbits; - struct lpfc_nodelist *ndlp = NULL, *free_ndlp = NULL; -+ u32 ulp_status = get_job_ulpstatus(phba, rspiocb); -+ u32 ulp_word4 = get_job_word4(phba, rspiocb); - - did = ((struct lpfc_sli_ct_request *) inp->virt)->un.gff.PortId; - did = be32_to_cpu(did); - - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_CT, - "GFF_ID cmpl: status:x%x/x%x did:x%x", -- irsp->ulpStatus, irsp->un.ulpWord[4], did); -+ ulp_status, ulp_word4, did); - - /* Ignore response if link flipped after this request was made */ - if (cmdiocb->event_tag != phba->fc_eventTag) { -@@ -1388,7 +1367,7 @@ lpfc_cmpl_ct_cmd_gff_id(struct lpfc_hba - goto iocb_free; - } - -- if (irsp->ulpStatus == IOSTAT_SUCCESS) { -+ if (ulp_status == IOSTAT_SUCCESS) { - /* Good status, continue checking */ - CTrsp = (struct lpfc_sli_ct_request *) outp->virt; - fbits = CTrsp->un.gff_acc.fbits[FCP_TYPE_FEATURE_OFFSET]; -@@ -1418,8 +1397,8 @@ lpfc_cmpl_ct_cmd_gff_id(struct lpfc_hba - /* Check for retry */ - if (cmdiocb->retry < LPFC_MAX_NS_RETRY) { - retry = 1; -- if (irsp->ulpStatus == IOSTAT_LOCAL_REJECT) { -- switch ((irsp->un.ulpWord[4] & -+ if (ulp_status == IOSTAT_LOCAL_REJECT) { -+ switch ((ulp_word4 & - IOERR_PARAM_MASK)) { - - case IOERR_NO_RESOURCES: -@@ -1455,7 +1434,7 @@ lpfc_cmpl_ct_cmd_gff_id(struct lpfc_hba - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, - "0267 NameServer GFF Rsp " - "x%x Error (%d %d) Data: x%x x%x\n", -- did, irsp->ulpStatus, irsp->un.ulpWord[4], -+ did, ulp_status, ulp_word4, - vport->fc_flag, vport->fc_rscn_id_cnt); - } - -@@ -1510,10 +1489,9 @@ lpfc_cmpl_ct_cmd_gff_id(struct lpfc_hba - - static void - lpfc_cmpl_ct_cmd_gft_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, -- struct lpfc_iocbq *rspiocb) -+ struct lpfc_iocbq *rspiocb) - { - struct lpfc_vport *vport = cmdiocb->vport; -- IOCB_t *irsp = &rspiocb->iocb; - struct lpfc_dmabuf *inp = (struct lpfc_dmabuf *)cmdiocb->context1; - struct lpfc_dmabuf *outp = (struct lpfc_dmabuf *)cmdiocb->context2; - struct lpfc_sli_ct_request *CTrsp; -@@ -1521,13 +1499,15 @@ lpfc_cmpl_ct_cmd_gft_id(struct lpfc_hba - struct lpfc_nodelist *ndlp = NULL; - struct lpfc_nodelist *ns_ndlp = NULL; - uint32_t fc4_data_0, fc4_data_1; -+ u32 ulp_status = get_job_ulpstatus(phba, rspiocb); -+ u32 ulp_word4 = get_job_word4(phba, rspiocb); - - did = ((struct lpfc_sli_ct_request *)inp->virt)->un.gft.PortId; - did = be32_to_cpu(did); - - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_CT, - "GFT_ID cmpl: status:x%x/x%x did:x%x", -- irsp->ulpStatus, irsp->un.ulpWord[4], did); -+ ulp_status, ulp_word4, did); - - /* Ignore response if link flipped after this request was made */ - if ((uint32_t) cmdiocb->event_tag != phba->fc_eventTag) { -@@ -1539,7 +1519,7 @@ lpfc_cmpl_ct_cmd_gft_id(struct lpfc_hba - /* Preserve the nameserver node to release the reference. */ - ns_ndlp = cmdiocb->context_un.ndlp; - -- if (irsp->ulpStatus == IOSTAT_SUCCESS) { -+ if (ulp_status == IOSTAT_SUCCESS) { - /* Good status, continue checking */ - CTrsp = (struct lpfc_sli_ct_request *)outp->virt; - fc4_data_0 = be32_to_cpu(CTrsp->un.gft_acc.fc4_types[0]); -@@ -1600,7 +1580,7 @@ lpfc_cmpl_ct_cmd_gft_id(struct lpfc_hba - } - } else - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, -- "3065 GFT_ID failed x%08x\n", irsp->ulpStatus); -+ "3065 GFT_ID failed x%08x\n", ulp_status); - - out: - lpfc_ct_free_iocb(phba, cmdiocb); -@@ -1614,12 +1594,13 @@ lpfc_cmpl_ct(struct lpfc_hba *phba, stru - struct lpfc_vport *vport = cmdiocb->vport; - struct lpfc_dmabuf *inp; - struct lpfc_dmabuf *outp; -- IOCB_t *irsp; - struct lpfc_sli_ct_request *CTrsp; - struct lpfc_nodelist *ndlp; - int cmdcode, rc; - uint8_t retry; - uint32_t latt; -+ u32 ulp_status = get_job_ulpstatus(phba, rspiocb); -+ u32 ulp_word4 = get_job_word4(phba, rspiocb); - - /* First save ndlp, before we overwrite it */ - ndlp = cmdiocb->context_un.ndlp; -@@ -1629,7 +1610,6 @@ lpfc_cmpl_ct(struct lpfc_hba *phba, stru - - inp = (struct lpfc_dmabuf *) cmdiocb->context1; - outp = (struct lpfc_dmabuf *) cmdiocb->context2; -- irsp = &rspiocb->iocb; - - cmdcode = be16_to_cpu(((struct lpfc_sli_ct_request *) inp->virt)-> - CommandResponse.bits.CmdRsp); -@@ -1637,28 +1617,28 @@ lpfc_cmpl_ct(struct lpfc_hba *phba, stru - - latt = lpfc_els_chk_latt(vport); - -- /* RFT request completes status CmdRsp */ -+ /* RFT request completes status CmdRsp */ - lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY, - "0209 CT Request completes, latt %d, " -- "ulpStatus x%x CmdRsp x%x, Context x%x, Tag x%x\n", -- latt, irsp->ulpStatus, -+ "ulp_status x%x CmdRsp x%x, Context x%x, Tag x%x\n", -+ latt, ulp_status, - CTrsp->CommandResponse.bits.CmdRsp, -- cmdiocb->iocb.ulpContext, cmdiocb->iocb.ulpIoTag); -+ get_job_ulpcontext(phba, cmdiocb), cmdiocb->iotag); - - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_CT, - "CT cmd cmpl: status:x%x/x%x cmd:x%x", -- irsp->ulpStatus, irsp->un.ulpWord[4], cmdcode); -+ ulp_status, ulp_word4, cmdcode); - -- if (irsp->ulpStatus) { -+ if (ulp_status) { - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, - "0268 NS cmd x%x Error (x%x x%x)\n", -- cmdcode, irsp->ulpStatus, irsp->un.ulpWord[4]); -+ cmdcode, ulp_status, ulp_word4); - -- if ((irsp->ulpStatus == IOSTAT_LOCAL_REJECT) && -- (((irsp->un.ulpWord[4] & IOERR_PARAM_MASK) == -- IOERR_SLI_DOWN) || -- ((irsp->un.ulpWord[4] & IOERR_PARAM_MASK) == -- IOERR_SLI_ABORTED))) -+ if (ulp_status == IOSTAT_LOCAL_REJECT && -+ (((ulp_word4 & IOERR_PARAM_MASK) == -+ IOERR_SLI_DOWN) || -+ ((ulp_word4 & IOERR_PARAM_MASK) == -+ IOERR_SLI_ABORTED))) - goto out; - - retry = cmdiocb->retry; -@@ -1683,10 +1663,10 @@ static void - lpfc_cmpl_ct_cmd_rft_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - struct lpfc_iocbq *rspiocb) - { -- IOCB_t *irsp = &rspiocb->iocb; - struct lpfc_vport *vport = cmdiocb->vport; -+ u32 ulp_status = get_job_ulpstatus(phba, rspiocb); - -- if (irsp->ulpStatus == IOSTAT_SUCCESS) { -+ if (ulp_status == IOSTAT_SUCCESS) { - struct lpfc_dmabuf *outp; - struct lpfc_sli_ct_request *CTrsp; - -@@ -1704,10 +1684,10 @@ static void - lpfc_cmpl_ct_cmd_rnn_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - struct lpfc_iocbq *rspiocb) - { -- IOCB_t *irsp = &rspiocb->iocb; - struct lpfc_vport *vport = cmdiocb->vport; -+ u32 ulp_status = get_job_ulpstatus(phba, rspiocb); - -- if (irsp->ulpStatus == IOSTAT_SUCCESS) { -+ if (ulp_status == IOSTAT_SUCCESS) { - struct lpfc_dmabuf *outp; - struct lpfc_sli_ct_request *CTrsp; - -@@ -1725,10 +1705,10 @@ static void - lpfc_cmpl_ct_cmd_rspn_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - struct lpfc_iocbq *rspiocb) - { -- IOCB_t *irsp = &rspiocb->iocb; - struct lpfc_vport *vport = cmdiocb->vport; -+ u32 ulp_status = get_job_ulpstatus(phba, rspiocb); - -- if (irsp->ulpStatus == IOSTAT_SUCCESS) { -+ if (ulp_status == IOSTAT_SUCCESS) { - struct lpfc_dmabuf *outp; - struct lpfc_sli_ct_request *CTrsp; - -@@ -1746,10 +1726,10 @@ static void - lpfc_cmpl_ct_cmd_rsnn_nn(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - struct lpfc_iocbq *rspiocb) - { -- IOCB_t *irsp = &rspiocb->iocb; - struct lpfc_vport *vport = cmdiocb->vport; -+ u32 ulp_status = get_job_ulpstatus(phba, rspiocb); - -- if (irsp->ulpStatus == IOSTAT_SUCCESS) { -+ if (ulp_status == IOSTAT_SUCCESS) { - struct lpfc_dmabuf *outp; - struct lpfc_sli_ct_request *CTrsp; - -@@ -1779,10 +1759,10 @@ static void - lpfc_cmpl_ct_cmd_rff_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - struct lpfc_iocbq *rspiocb) - { -- IOCB_t *irsp = &rspiocb->iocb; - struct lpfc_vport *vport = cmdiocb->vport; -+ u32 ulp_status = get_job_ulpstatus(phba, rspiocb); - -- if (irsp->ulpStatus == IOSTAT_SUCCESS) { -+ if (ulp_status == IOSTAT_SUCCESS) { - struct lpfc_dmabuf *outp; - struct lpfc_sli_ct_request *CTrsp; - -@@ -2193,20 +2173,21 @@ lpfc_cmpl_ct_disc_fdmi(struct lpfc_hba * - struct lpfc_sli_ct_request *CTrsp = outp->virt; - uint16_t fdmi_cmd = CTcmd->CommandResponse.bits.CmdRsp; - uint16_t fdmi_rsp = CTrsp->CommandResponse.bits.CmdRsp; -- IOCB_t *irsp = &rspiocb->iocb; - struct lpfc_nodelist *ndlp, *free_ndlp = NULL; - uint32_t latt, cmd, err; -+ u32 ulp_status = get_job_ulpstatus(phba, rspiocb); -+ u32 ulp_word4 = get_job_word4(phba, rspiocb); - - latt = lpfc_els_chk_latt(vport); - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_CT, - "FDMI cmpl: status:x%x/x%x latt:%d", -- irsp->ulpStatus, irsp->un.ulpWord[4], latt); -+ ulp_status, ulp_word4, latt); - -- if (latt || irsp->ulpStatus) { -+ if (latt || ulp_status) { - - /* Look for a retryable error */ -- if (irsp->ulpStatus == IOSTAT_LOCAL_REJECT) { -- switch ((irsp->un.ulpWord[4] & IOERR_PARAM_MASK)) { -+ if (ulp_status == IOSTAT_LOCAL_REJECT) { -+ switch ((ulp_word4 & IOERR_PARAM_MASK)) { - case IOERR_SLI_ABORTED: - case IOERR_SLI_DOWN: - /* Driver aborted this IO. No retry as error -@@ -2236,9 +2217,9 @@ lpfc_cmpl_ct_disc_fdmi(struct lpfc_hba * - - lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY, - "0229 FDMI cmd %04x failed, latt = %d " -- "ulpStatus: x%x, rid x%x\n", -- be16_to_cpu(fdmi_cmd), latt, irsp->ulpStatus, -- irsp->un.ulpWord[4]); -+ "ulp_status: x%x, rid x%x\n", -+ be16_to_cpu(fdmi_cmd), latt, ulp_status, -+ ulp_word4); - } - - free_ndlp = cmdiocb->context_un.ndlp; ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -1258,20 +1258,15 @@ static struct lpfc_sglq * - struct lpfc_sglq *start_sglq = NULL; - struct lpfc_io_buf *lpfc_cmd; - struct lpfc_nodelist *ndlp; -- struct lpfc_sli_ring *pring = NULL; - int found = 0; -+ u8 cmnd; - -- if (piocbq->cmd_flag & LPFC_IO_NVME_LS) -- pring = phba->sli4_hba.nvmels_wq->pring; -- else -- pring = lpfc_phba_elsring(phba); -- -- lockdep_assert_held(&pring->ring_lock); -+ cmnd = get_job_cmnd(phba, piocbq); - - if (piocbq->cmd_flag & LPFC_IO_FCP) { - lpfc_cmd = (struct lpfc_io_buf *) piocbq->context1; - ndlp = lpfc_cmd->rdata->pnode; -- } else if ((piocbq->iocb.ulpCommand == CMD_GEN_REQUEST64_CR) && -+ } else if ((cmnd == CMD_GEN_REQUEST64_CR) && - !(piocbq->cmd_flag & LPFC_IO_LIBDFC)) { - ndlp = piocbq->context_un.ndlp; - } else if (piocbq->cmd_flag & LPFC_IO_LIBDFC) { -@@ -3232,6 +3227,56 @@ lpfc_complete_unsol_iocb(struct lpfc_hba - return 0; - } - -+static void -+lpfc_sli_prep_unsol_wqe(struct lpfc_hba *phba, -+ struct lpfc_iocbq *saveq) -+{ -+ IOCB_t *irsp; -+ union lpfc_wqe128 *wqe; -+ u16 i = 0; -+ -+ irsp = &saveq->iocb; -+ wqe = &saveq->wqe; -+ -+ /* Fill wcqe with the IOCB status fields */ -+ bf_set(lpfc_wcqe_c_status, &saveq->wcqe_cmpl, irsp->ulpStatus); -+ saveq->wcqe_cmpl.word3 = irsp->ulpBdeCount; -+ saveq->wcqe_cmpl.parameter = irsp->un.ulpWord[4]; -+ saveq->wcqe_cmpl.total_data_placed = irsp->unsli3.rcvsli3.acc_len; -+ -+ /* Source ID */ -+ bf_set(els_rsp64_sid, &wqe->xmit_els_rsp, irsp->un.rcvels.parmRo); -+ -+ /* rx-id of the response frame */ -+ bf_set(wqe_ctxt_tag, &wqe->xmit_els_rsp.wqe_com, irsp->ulpContext); -+ -+ /* ox-id of the frame */ -+ bf_set(wqe_rcvoxid, &wqe->xmit_els_rsp.wqe_com, -+ irsp->unsli3.rcvsli3.ox_id); -+ -+ /* DID */ -+ bf_set(wqe_els_did, &wqe->xmit_els_rsp.wqe_dest, -+ irsp->un.rcvels.remoteID); -+ -+ /* unsol data len */ -+ for (i = 0; i < irsp->ulpBdeCount; i++) { -+ struct lpfc_hbq_entry *hbqe = NULL; -+ -+ if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) { -+ if (i == 0) { -+ hbqe = (struct lpfc_hbq_entry *) -+ &irsp->un.ulpWord[0]; -+ saveq->wqe.gen_req.bde.tus.f.bdeSize = -+ hbqe->bde.tus.f.bdeSize; -+ } else if (i == 1) { -+ hbqe = (struct lpfc_hbq_entry *) -+ &irsp->unsli3.sli3Words[4]; -+ saveq->unsol_rcv_len = hbqe->bde.tus.f.bdeSize; -+ } -+ } -+ } -+} -+ - /** - * lpfc_sli_process_unsol_iocb - Unsolicited iocb handler - * @phba: Pointer to HBA context object. -@@ -3252,11 +3297,13 @@ lpfc_sli_process_unsol_iocb(struct lpfc_ - { - IOCB_t * irsp; - WORD5 * w5p; -+ dma_addr_t paddr; - uint32_t Rctl, Type; - struct lpfc_iocbq *iocbq; - struct lpfc_dmabuf *dmzbuf; - -- irsp = &(saveq->iocb); -+ irsp = &saveq->iocb; -+ saveq->vport = phba->pport; - - if (irsp->ulpCommand == CMD_ASYNC_STATUS) { - if (pring->lpfc_sli_rcv_async_status) -@@ -3274,22 +3321,22 @@ lpfc_sli_process_unsol_iocb(struct lpfc_ - } - - if ((irsp->ulpCommand == CMD_IOCB_RET_XRI64_CX) && -- (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED)) { -+ (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED)) { - if (irsp->ulpBdeCount > 0) { - dmzbuf = lpfc_sli_get_buff(phba, pring, -- irsp->un.ulpWord[3]); -+ irsp->un.ulpWord[3]); - lpfc_in_buf_free(phba, dmzbuf); - } - - if (irsp->ulpBdeCount > 1) { - dmzbuf = lpfc_sli_get_buff(phba, pring, -- irsp->unsli3.sli3Words[3]); -+ irsp->unsli3.sli3Words[3]); - lpfc_in_buf_free(phba, dmzbuf); - } - - if (irsp->ulpBdeCount > 2) { - dmzbuf = lpfc_sli_get_buff(phba, pring, -- irsp->unsli3.sli3Words[7]); -+ irsp->unsli3.sli3Words[7]); - lpfc_in_buf_free(phba, dmzbuf); - } - -@@ -3322,9 +3369,10 @@ lpfc_sli_process_unsol_iocb(struct lpfc_ - irsp->unsli3.sli3Words[7]); - } - list_for_each_entry(iocbq, &saveq->list, list) { -- irsp = &(iocbq->iocb); -+ irsp = &iocbq->iocb; - if (irsp->ulpBdeCount != 0) { -- iocbq->context2 = lpfc_sli_get_buff(phba, pring, -+ iocbq->context2 = lpfc_sli_get_buff(phba, -+ pring, - irsp->un.ulpWord[3]); - if (!iocbq->context2) - lpfc_printf_log(phba, -@@ -3336,7 +3384,8 @@ lpfc_sli_process_unsol_iocb(struct lpfc_ - irsp->un.ulpWord[3]); - } - if (irsp->ulpBdeCount == 2) { -- iocbq->context3 = lpfc_sli_get_buff(phba, pring, -+ iocbq->context3 = lpfc_sli_get_buff(phba, -+ pring, - irsp->unsli3.sli3Words[7]); - if (!iocbq->context3) - lpfc_printf_log(phba, -@@ -3349,7 +3398,20 @@ lpfc_sli_process_unsol_iocb(struct lpfc_ - irsp->unsli3.sli3Words[7]); - } - } -+ } else { -+ paddr = getPaddr(irsp->un.cont64[0].addrHigh, -+ irsp->un.cont64[0].addrLow); -+ saveq->context2 = lpfc_sli_ringpostbuf_get(phba, pring, -+ paddr); -+ if (irsp->ulpBdeCount == 2) { -+ paddr = getPaddr(irsp->un.cont64[1].addrHigh, -+ irsp->un.cont64[1].addrLow); -+ saveq->context3 = lpfc_sli_ringpostbuf_get(phba, -+ pring, -+ paddr); -+ } - } -+ - if (irsp->ulpBdeCount != 0 && - (irsp->ulpCommand == CMD_IOCB_RCV_CONT64_CX || - irsp->ulpStatus == IOSTAT_INTERMED_RSP)) { -@@ -3367,12 +3429,14 @@ lpfc_sli_process_unsol_iocb(struct lpfc_ - if (!found) - list_add_tail(&saveq->clist, - &pring->iocb_continue_saveq); -+ - if (saveq->iocb.ulpStatus != IOSTAT_INTERMED_RSP) { - list_del_init(&iocbq->clist); - saveq = iocbq; -- irsp = &(saveq->iocb); -- } else -+ irsp = &saveq->iocb; -+ } else { - return 0; -+ } - } - if ((irsp->ulpCommand == CMD_RCV_ELS_REQ64_CX) || - (irsp->ulpCommand == CMD_RCV_ELS_REQ_CX) || -@@ -3395,6 +3459,19 @@ lpfc_sli_process_unsol_iocb(struct lpfc_ - } - } - -+ if ((phba->sli3_options & LPFC_SLI3_NPIV_ENABLED) && -+ (irsp->ulpCommand == CMD_IOCB_RCV_ELS64_CX || -+ irsp->ulpCommand == CMD_IOCB_RCV_SEQ64_CX)) { -+ if (irsp->unsli3.rcvsli3.vpi == 0xffff) -+ saveq->vport = phba->pport; -+ else -+ saveq->vport = lpfc_find_vport_by_vpid(phba, -+ irsp->unsli3.rcvsli3.vpi); -+ } -+ -+ /* Prepare WQE with Unsol frame */ -+ lpfc_sli_prep_unsol_wqe(phba, saveq); -+ - if (!lpfc_complete_unsol_iocb(phba, pring, saveq, Rctl, Type)) - lpfc_printf_log(phba, KERN_WARNING, LOG_SLI, - "0313 Ring %d handler: unexpected Rctl x%x " -@@ -10410,6 +10487,195 @@ lpfc_sli_prep_els_req_rsp(struct lpfc_hb - elscmd, tmo, expect_rsp); - } - -+static void -+__lpfc_sli_prep_gen_req_s3(struct lpfc_iocbq *cmdiocbq, struct lpfc_dmabuf *bmp, -+ u16 rpi, u32 num_entry, u8 tmo) -+{ -+ IOCB_t *cmd; -+ -+ cmd = &cmdiocbq->iocb; -+ memset(cmd, 0, sizeof(*cmd)); -+ -+ cmd->un.genreq64.bdl.addrHigh = putPaddrHigh(bmp->phys); -+ cmd->un.genreq64.bdl.addrLow = putPaddrLow(bmp->phys); -+ cmd->un.genreq64.bdl.bdeFlags = BUFF_TYPE_BLP_64; -+ cmd->un.genreq64.bdl.bdeSize = num_entry * sizeof(struct ulp_bde64); -+ -+ cmd->un.genreq64.w5.hcsw.Rctl = FC_RCTL_DD_UNSOL_CTL; -+ cmd->un.genreq64.w5.hcsw.Type = FC_TYPE_CT; -+ cmd->un.genreq64.w5.hcsw.Fctl = (SI | LA); -+ -+ cmd->ulpContext = rpi; -+ cmd->ulpClass = CLASS3; -+ cmd->ulpCommand = CMD_GEN_REQUEST64_CR; -+ cmd->ulpBdeCount = 1; -+ cmd->ulpLe = 1; -+ cmd->ulpOwner = OWN_CHIP; -+ cmd->ulpTimeout = tmo; -+} -+ -+static void -+__lpfc_sli_prep_gen_req_s4(struct lpfc_iocbq *cmdiocbq, struct lpfc_dmabuf *bmp, -+ u16 rpi, u32 num_entry, u8 tmo) -+{ -+ union lpfc_wqe128 *cmdwqe; -+ struct ulp_bde64_le *bde, *bpl; -+ u32 xmit_len = 0, total_len = 0, size, type, i; -+ -+ cmdwqe = &cmdiocbq->wqe; -+ memset(cmdwqe, 0, sizeof(*cmdwqe)); -+ -+ /* Calculate total_len and xmit_len */ -+ bpl = (struct ulp_bde64_le *)bmp->virt; -+ for (i = 0; i < num_entry; i++) { -+ size = le32_to_cpu(bpl[i].type_size) & ULP_BDE64_SIZE_MASK; -+ total_len += size; -+ } -+ for (i = 0; i < num_entry; i++) { -+ size = le32_to_cpu(bpl[i].type_size) & ULP_BDE64_SIZE_MASK; -+ type = le32_to_cpu(bpl[i].type_size) & ULP_BDE64_TYPE_MASK; -+ if (type != ULP_BDE64_TYPE_BDE_64) -+ break; -+ xmit_len += size; -+ } -+ -+ /* Words 0 - 2 */ -+ bde = (struct ulp_bde64_le *)&cmdwqe->generic.bde; -+ bde->addr_low = cpu_to_le32(putPaddrLow(bmp->phys)); -+ bde->addr_high = cpu_to_le32(putPaddrHigh(bmp->phys)); -+ bde->type_size = cpu_to_le32(xmit_len); -+ bde->type_size |= cpu_to_le32(ULP_BDE64_TYPE_BLP_64); -+ -+ /* Word 3 */ -+ cmdwqe->gen_req.request_payload_len = xmit_len; -+ -+ /* Word 5 */ -+ bf_set(wqe_type, &cmdwqe->gen_req.wge_ctl, FC_TYPE_CT); -+ bf_set(wqe_rctl, &cmdwqe->gen_req.wge_ctl, FC_RCTL_DD_UNSOL_CTL); -+ bf_set(wqe_si, &cmdwqe->gen_req.wge_ctl, 1); -+ bf_set(wqe_la, &cmdwqe->gen_req.wge_ctl, 1); -+ -+ /* Word 6 */ -+ bf_set(wqe_ctxt_tag, &cmdwqe->gen_req.wqe_com, rpi); -+ -+ /* Word 7 */ -+ bf_set(wqe_tmo, &cmdwqe->gen_req.wqe_com, tmo); -+ bf_set(wqe_class, &cmdwqe->gen_req.wqe_com, CLASS3); -+ bf_set(wqe_cmnd, &cmdwqe->gen_req.wqe_com, CMD_GEN_REQUEST64_CR); -+ bf_set(wqe_ct, &cmdwqe->gen_req.wqe_com, SLI4_CT_RPI); -+ -+ /* Word 12 */ -+ cmdwqe->gen_req.max_response_payload_len = total_len - xmit_len; -+} -+ -+void -+lpfc_sli_prep_gen_req(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocbq, -+ struct lpfc_dmabuf *bmp, u16 rpi, u32 num_entry, u8 tmo) -+{ -+ phba->__lpfc_sli_prep_gen_req(cmdiocbq, bmp, rpi, num_entry, tmo); -+} -+ -+static void -+__lpfc_sli_prep_xmit_seq64_s3(struct lpfc_iocbq *cmdiocbq, -+ struct lpfc_dmabuf *bmp, u16 rpi, u16 ox_id, -+ u32 num_entry, u8 rctl, u8 last_seq, u8 cr_cx_cmd) -+{ -+ IOCB_t *icmd; -+ -+ icmd = &cmdiocbq->iocb; -+ memset(icmd, 0, sizeof(*icmd)); -+ -+ icmd->un.xseq64.bdl.addrHigh = putPaddrHigh(bmp->phys); -+ icmd->un.xseq64.bdl.addrLow = putPaddrLow(bmp->phys); -+ icmd->un.xseq64.bdl.bdeFlags = BUFF_TYPE_BLP_64; -+ icmd->un.xseq64.bdl.bdeSize = (num_entry * sizeof(struct ulp_bde64)); -+ icmd->un.xseq64.w5.hcsw.Fctl = LA; -+ if (last_seq) -+ icmd->un.xseq64.w5.hcsw.Fctl |= LS; -+ icmd->un.xseq64.w5.hcsw.Dfctl = 0; -+ icmd->un.xseq64.w5.hcsw.Rctl = rctl; -+ icmd->un.xseq64.w5.hcsw.Type = FC_TYPE_CT; -+ -+ icmd->ulpBdeCount = 1; -+ icmd->ulpLe = 1; -+ icmd->ulpClass = CLASS3; -+ -+ switch (cr_cx_cmd) { -+ case CMD_XMIT_SEQUENCE64_CR: -+ icmd->ulpContext = rpi; -+ icmd->ulpCommand = CMD_XMIT_SEQUENCE64_CR; -+ break; -+ case CMD_XMIT_SEQUENCE64_CX: -+ icmd->ulpContext = ox_id; -+ icmd->ulpCommand = CMD_XMIT_SEQUENCE64_CX; -+ break; -+ default: -+ break; -+ } -+} -+ -+static void -+__lpfc_sli_prep_xmit_seq64_s4(struct lpfc_iocbq *cmdiocbq, -+ struct lpfc_dmabuf *bmp, u16 rpi, u16 ox_id, -+ u32 full_size, u8 rctl, u8 last_seq, u8 cr_cx_cmd) -+{ -+ union lpfc_wqe128 *wqe; -+ struct ulp_bde64 *bpl; -+ struct ulp_bde64_le *bde; -+ -+ wqe = &cmdiocbq->wqe; -+ memset(wqe, 0, sizeof(*wqe)); -+ -+ /* Words 0 - 2 */ -+ bpl = (struct ulp_bde64 *)bmp->virt; -+ if (cmdiocbq->cmd_flag & (LPFC_IO_LIBDFC | LPFC_IO_LOOPBACK)) { -+ wqe->xmit_sequence.bde.addrHigh = bpl->addrHigh; -+ wqe->xmit_sequence.bde.addrLow = bpl->addrLow; -+ wqe->xmit_sequence.bde.tus.w = bpl->tus.w; -+ } else { -+ bde = (struct ulp_bde64_le *)&wqe->xmit_sequence.bde; -+ bde->addr_low = cpu_to_le32(putPaddrLow(bmp->phys)); -+ bde->addr_high = cpu_to_le32(putPaddrHigh(bmp->phys)); -+ bde->type_size = cpu_to_le32(bpl->tus.f.bdeSize); -+ bde->type_size |= cpu_to_le32(ULP_BDE64_TYPE_BDE_64); -+ } -+ -+ /* Word 5 */ -+ bf_set(wqe_ls, &wqe->xmit_sequence.wge_ctl, last_seq); -+ bf_set(wqe_la, &wqe->xmit_sequence.wge_ctl, 1); -+ bf_set(wqe_dfctl, &wqe->xmit_sequence.wge_ctl, 0); -+ bf_set(wqe_rctl, &wqe->xmit_sequence.wge_ctl, rctl); -+ bf_set(wqe_type, &wqe->xmit_sequence.wge_ctl, FC_TYPE_CT); -+ -+ /* Word 6 */ -+ bf_set(wqe_ctxt_tag, &wqe->xmit_sequence.wqe_com, rpi); -+ -+ bf_set(wqe_cmnd, &wqe->xmit_sequence.wqe_com, -+ CMD_XMIT_SEQUENCE64_WQE); -+ -+ /* Word 7 */ -+ bf_set(wqe_class, &wqe->xmit_sequence.wqe_com, CLASS3); -+ -+ /* Word 9 */ -+ bf_set(wqe_rcvoxid, &wqe->xmit_sequence.wqe_com, ox_id); -+ -+ /* Word 12 */ -+ if (cmdiocbq->cmd_flag & (LPFC_IO_LIBDFC | LPFC_IO_LOOPBACK)) -+ wqe->xmit_sequence.xmit_len = full_size; -+ else -+ wqe->xmit_sequence.xmit_len = -+ wqe->xmit_sequence.bde.tus.f.bdeSize; -+} -+ -+void -+lpfc_sli_prep_xmit_seq64(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocbq, -+ struct lpfc_dmabuf *bmp, u16 rpi, u16 ox_id, -+ u32 num_entry, u8 rctl, u8 last_seq, u8 cr_cx_cmd) -+{ -+ phba->__lpfc_sli_prep_xmit_seq64(cmdiocbq, bmp, rpi, ox_id, num_entry, -+ rctl, last_seq, cr_cx_cmd); -+} -+ - /** - * lpfc_sli_api_table_setup - Set up sli api function jump table - * @phba: The hba struct for which this call is being executed. -@@ -10429,12 +10695,16 @@ lpfc_sli_api_table_setup(struct lpfc_hba - phba->__lpfc_sli_release_iocbq = __lpfc_sli_release_iocbq_s3; - phba->__lpfc_sli_issue_fcp_io = __lpfc_sli_issue_fcp_io_s3; - phba->__lpfc_sli_prep_els_req_rsp = __lpfc_sli_prep_els_req_rsp_s3; -+ phba->__lpfc_sli_prep_gen_req = __lpfc_sli_prep_gen_req_s3; -+ phba->__lpfc_sli_prep_xmit_seq64 = __lpfc_sli_prep_xmit_seq64_s3; - break; - case LPFC_PCI_DEV_OC: - phba->__lpfc_sli_issue_iocb = __lpfc_sli_issue_iocb_s4; - phba->__lpfc_sli_release_iocbq = __lpfc_sli_release_iocbq_s4; - phba->__lpfc_sli_issue_fcp_io = __lpfc_sli_issue_fcp_io_s4; - phba->__lpfc_sli_prep_els_req_rsp = __lpfc_sli_prep_els_req_rsp_s4; -+ phba->__lpfc_sli_prep_gen_req = __lpfc_sli_prep_gen_req_s4; -+ phba->__lpfc_sli_prep_xmit_seq64 = __lpfc_sli_prep_xmit_seq64_s4; - break; - default: - lpfc_printf_log(phba, KERN_ERR, LOG_INIT, -@@ -18310,7 +18580,6 @@ lpfc_prep_seq(struct lpfc_vport *vport, - struct fc_frame_header *fc_hdr; - uint32_t sid; - uint32_t len, tot_len; -- struct ulp_bde64 *pbde; - - fc_hdr = (struct fc_frame_header *)seq_dmabuf->hbuf.virt; - /* remove from receive buffer list */ -@@ -18323,40 +18592,40 @@ lpfc_prep_seq(struct lpfc_vport *vport, - first_iocbq = lpfc_sli_get_iocbq(vport->phba); - if (first_iocbq) { - /* Initialize the first IOCB. */ -- first_iocbq->iocb.unsli3.rcvsli3.acc_len = 0; -- first_iocbq->iocb.ulpStatus = IOSTAT_SUCCESS; -+ first_iocbq->wcqe_cmpl.total_data_placed = 0; -+ bf_set(lpfc_wcqe_c_status, &first_iocbq->wcqe_cmpl, -+ IOSTAT_SUCCESS); - first_iocbq->vport = vport; - - /* Check FC Header to see what TYPE of frame we are rcv'ing */ - if (sli4_type_from_fc_hdr(fc_hdr) == FC_TYPE_ELS) { -- first_iocbq->iocb.ulpCommand = CMD_IOCB_RCV_ELS64_CX; -- first_iocbq->iocb.un.rcvels.parmRo = -- sli4_did_from_fc_hdr(fc_hdr); -- first_iocbq->iocb.ulpPU = PARM_NPIV_DID; -- } else -- first_iocbq->iocb.ulpCommand = CMD_IOCB_RCV_SEQ64_CX; -- first_iocbq->iocb.ulpContext = NO_XRI; -- first_iocbq->iocb.unsli3.rcvsli3.ox_id = -- be16_to_cpu(fc_hdr->fh_ox_id); -- /* iocbq is prepped for internal consumption. Physical vpi. */ -- first_iocbq->iocb.unsli3.rcvsli3.vpi = -- vport->phba->vpi_ids[vport->vpi]; -- /* put the first buffer into the first IOCBq */ -+ bf_set(els_rsp64_sid, &first_iocbq->wqe.xmit_els_rsp, -+ sli4_did_from_fc_hdr(fc_hdr)); -+ } -+ -+ bf_set(wqe_ctxt_tag, &first_iocbq->wqe.xmit_els_rsp.wqe_com, -+ NO_XRI); -+ bf_set(wqe_rcvoxid, &first_iocbq->wqe.xmit_els_rsp.wqe_com, -+ be16_to_cpu(fc_hdr->fh_ox_id)); -+ -+ /* put the first buffer into the first iocb */ - tot_len = bf_get(lpfc_rcqe_length, -- &seq_dmabuf->cq_event.cqe.rcqe_cmpl); -+ &seq_dmabuf->cq_event.cqe.rcqe_cmpl); - - first_iocbq->context2 = &seq_dmabuf->dbuf; - first_iocbq->context3 = NULL; -- first_iocbq->iocb.ulpBdeCount = 1; -+ /* Keep track of the BDE count */ -+ first_iocbq->wcqe_cmpl.word3 = 1; -+ - if (tot_len > LPFC_DATA_BUF_SIZE) -- first_iocbq->iocb.un.cont64[0].tus.f.bdeSize = -- LPFC_DATA_BUF_SIZE; -+ first_iocbq->wqe.gen_req.bde.tus.f.bdeSize = -+ LPFC_DATA_BUF_SIZE; - else -- first_iocbq->iocb.un.cont64[0].tus.f.bdeSize = tot_len; -- -- first_iocbq->iocb.un.rcvels.remoteID = sid; -+ first_iocbq->wqe.gen_req.bde.tus.f.bdeSize = tot_len; - -- first_iocbq->iocb.unsli3.rcvsli3.acc_len = tot_len; -+ first_iocbq->wcqe_cmpl.total_data_placed = tot_len; -+ bf_set(wqe_els_did, &first_iocbq->wqe.xmit_els_rsp.wqe_dest, -+ sid); - } - iocbq = first_iocbq; - /* -@@ -18370,28 +18639,23 @@ lpfc_prep_seq(struct lpfc_vport *vport, - } - if (!iocbq->context3) { - iocbq->context3 = d_buf; -- iocbq->iocb.ulpBdeCount++; -+ iocbq->wcqe_cmpl.word3++; - /* We need to get the size out of the right CQE */ - hbq_buf = container_of(d_buf, struct hbq_dmabuf, dbuf); - len = bf_get(lpfc_rcqe_length, - &hbq_buf->cq_event.cqe.rcqe_cmpl); -- pbde = (struct ulp_bde64 *) -- &iocbq->iocb.unsli3.sli3Words[4]; -- if (len > LPFC_DATA_BUF_SIZE) -- pbde->tus.f.bdeSize = LPFC_DATA_BUF_SIZE; -- else -- pbde->tus.f.bdeSize = len; -- -- iocbq->iocb.unsli3.rcvsli3.acc_len += len; -+ iocbq->unsol_rcv_len = len; -+ iocbq->wcqe_cmpl.total_data_placed += len; - tot_len += len; - } else { - iocbq = lpfc_sli_get_iocbq(vport->phba); - if (!iocbq) { - if (first_iocbq) { -- first_iocbq->iocb.ulpStatus = -- IOSTAT_FCP_RSP_ERROR; -- first_iocbq->iocb.un.ulpWord[4] = -- IOERR_NO_RESOURCES; -+ bf_set(lpfc_wcqe_c_status, -+ &first_iocbq->wcqe_cmpl, -+ IOSTAT_SUCCESS); -+ first_iocbq->wcqe_cmpl.parameter = -+ IOERR_NO_RESOURCES; - } - lpfc_in_buf_free(vport->phba, d_buf); - continue; -@@ -18402,17 +18666,19 @@ lpfc_prep_seq(struct lpfc_vport *vport, - &hbq_buf->cq_event.cqe.rcqe_cmpl); - iocbq->context2 = d_buf; - iocbq->context3 = NULL; -- iocbq->iocb.ulpBdeCount = 1; -+ iocbq->wcqe_cmpl.word3 = 1; -+ - if (len > LPFC_DATA_BUF_SIZE) -- iocbq->iocb.un.cont64[0].tus.f.bdeSize = -- LPFC_DATA_BUF_SIZE; -+ iocbq->wqe.xmit_els_rsp.bde.tus.f.bdeSize = -+ LPFC_DATA_BUF_SIZE; - else -- iocbq->iocb.un.cont64[0].tus.f.bdeSize = len; -+ iocbq->wqe.xmit_els_rsp.bde.tus.f.bdeSize = -+ len; - - tot_len += len; -- iocbq->iocb.unsli3.rcvsli3.acc_len = tot_len; -- -- iocbq->iocb.un.rcvels.remoteID = sid; -+ iocbq->wcqe_cmpl.total_data_placed = tot_len; -+ bf_set(wqe_els_did, &iocbq->wqe.xmit_els_rsp.wqe_dest, -+ sid); - list_add_tail(&iocbq->list, &first_iocbq->list); - } - } ---- a/drivers/scsi/lpfc/lpfc_sli.h -+++ b/drivers/scsi/lpfc/lpfc_sli.h -@@ -69,6 +69,7 @@ struct lpfc_iocbq { - IOCB_t iocb; /* SLI-3 */ - struct lpfc_wcqe_complete wcqe_cmpl; /* WQE cmpl */ - -+ u32 unsol_rcv_len; /* Receive len in usol path */ - uint8_t num_bdes; - uint8_t abort_bls; /* ABTS by initiator or responder */ - diff --git a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-FDISC-paths.patch b/patches.suse/scsi-lpfc-SLI-path-split-Refactor-FDISC-paths.patch deleted file mode 100644 index c0e8356..0000000 --- a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-FDISC-paths.patch +++ /dev/null @@ -1,128 +0,0 @@ -From: James Smart -Date: Thu, 24 Feb 2022 18:23:00 -0800 -Subject: scsi: lpfc: SLI path split: Refactor FDISC paths -Patch-mainline: v5.18-rc1 -Git-commit: 9d41f08aa2eba4048357f7bd5efc11e97c213708 -References: bsc#1197675 - -This patch refactors the FDISC paths to use SLI-4 as the primary interface: - - - Conversion away from using SLI-3 iocb structures to set/access fields in - common routines. Use the new generic get/set routines that were added. - This move changes code from indirect structure references to using local - variables with the generic routines. - - - Refactor routines when setting non-generic fields, to have both SLI3 and - SLI4 specific sections. This replaces the set-as-SLI3 then translate to - SLI4 behavior of the past. - -Link: https://lore.kernel.org/r/20220225022308.16486-10-jsmart2021@gmail.com -Co-developed-by: Justin Tee -Signed-off-by: Justin Tee -Signed-off-by: James Smart -Signed-off-by: Martin K. Petersen -Acked-by: Daniel Wagner ---- - drivers/scsi/lpfc/lpfc_els.c | 47 ++++++++++++++++++++++++++----------------- - 1 file changed, 29 insertions(+), 18 deletions(-) - ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -11124,6 +11124,7 @@ lpfc_issue_els_fdisc(struct lpfc_vport * - { - struct lpfc_hba *phba = vport->phba; - IOCB_t *icmd; -+ union lpfc_wqe128 *wqe = NULL; - struct lpfc_iocbq *elsiocb; - struct serv_parm *sp; - uint8_t *pcmd; -@@ -11143,15 +11144,14 @@ lpfc_issue_els_fdisc(struct lpfc_vport * - return 1; - } - -- icmd = &elsiocb->iocb; -- icmd->un.elsreq64.myID = 0; -- icmd->un.elsreq64.fl = 1; -- -- /* -- * SLI3 ports require a different context type value than SLI4. -- * Catch SLI3 ports here and override the prep. -- */ -- if (phba->sli_rev == LPFC_SLI_REV3) { -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ wqe = &elsiocb->wqe; -+ bf_set(els_req64_sid, &wqe->els_req, 0); -+ bf_set(els_req64_sp, &wqe->els_req, 1); -+ } else { -+ icmd = &elsiocb->iocb; -+ icmd->un.elsreq64.myID = 0; -+ icmd->un.elsreq64.fl = 1; - icmd->ulpCt_h = 1; - icmd->ulpCt_l = 0; - } -@@ -11189,14 +11189,11 @@ lpfc_issue_els_fdisc(struct lpfc_vport * - did, 0, 0); - - elsiocb->context1 = lpfc_nlp_get(ndlp); -- if (!elsiocb->context1) { -- lpfc_els_free_iocb(phba, elsiocb); -+ if (!elsiocb->context1) - goto err_out; -- } - - rc = lpfc_issue_fabric_iocb(phba, elsiocb); - if (rc == IOCB_ERROR) { -- lpfc_els_free_iocb(phba, elsiocb); - lpfc_nlp_put(ndlp); - goto err_out; - } -@@ -11205,6 +11202,7 @@ lpfc_issue_els_fdisc(struct lpfc_vport * - return 0; - - err_out: -+ lpfc_els_free_iocb(phba, elsiocb); - lpfc_vport_set_state(vport, FC_VPORT_FAILED); - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, - "0256 Issue FDISC: Cannot send IOCB\n"); -@@ -11233,23 +11231,36 @@ lpfc_cmpl_els_npiv_logo(struct lpfc_hba - IOCB_t *irsp; - struct lpfc_nodelist *ndlp; - struct Scsi_Host *shost = lpfc_shost_from_vport(vport); -+ u32 ulp_status, ulp_word4, did, tmo; - - ndlp = (struct lpfc_nodelist *)cmdiocb->context1; -- irsp = &rspiocb->iocb; -+ -+ ulp_status = get_job_ulpstatus(phba, rspiocb); -+ ulp_word4 = get_job_word4(phba, rspiocb); -+ -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ did = get_job_els_rsp64_did(phba, cmdiocb); -+ tmo = get_wqe_tmo(cmdiocb); -+ } else { -+ irsp = &rspiocb->iocb; -+ did = get_job_els_rsp64_did(phba, rspiocb); -+ tmo = irsp->ulpTimeout; -+ } -+ - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, - "LOGO npiv cmpl: status:x%x/x%x did:x%x", -- irsp->ulpStatus, irsp->un.ulpWord[4], irsp->un.rcvels.remoteID); -+ ulp_status, ulp_word4, did); - - /* NPIV LOGO completes to NPort */ - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "2928 NPIV LOGO completes to NPort x%x " - "Data: x%x x%x x%x x%x x%x x%x x%x\n", -- ndlp->nlp_DID, irsp->ulpStatus, irsp->un.ulpWord[4], -- irsp->ulpTimeout, vport->num_disc_nodes, -+ ndlp->nlp_DID, ulp_status, ulp_word4, -+ tmo, vport->num_disc_nodes, - kref_read(&ndlp->kref), ndlp->nlp_flag, - ndlp->fc4_xpt_flags); - -- if (irsp->ulpStatus == IOSTAT_SUCCESS) { -+ if (ulp_status == IOSTAT_SUCCESS) { - spin_lock_irq(shost->host_lock); - vport->fc_flag &= ~FC_NDISC_ACTIVE; - vport->fc_flag &= ~FC_FABRIC; diff --git a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-LS_ACC-paths.patch b/patches.suse/scsi-lpfc-SLI-path-split-Refactor-LS_ACC-paths.patch deleted file mode 100644 index 7674f99..0000000 --- a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-LS_ACC-paths.patch +++ /dev/null @@ -1,559 +0,0 @@ -From: James Smart -Date: Thu, 24 Feb 2022 18:22:58 -0800 -Subject: scsi: lpfc: SLI path split: Refactor LS_ACC paths -Patch-mainline: v5.18-rc1 -Git-commit: 3f607dcb43f1cbc0536a5096e058dd2050ab3de8 -References: bsc#1197675 - -This patch refactors the LS_ACC paths to use SLI-4 as the primary -interface: - - - Conversion away from using SLI-3 iocb structures to set/access fields in - common routines. Use the new generic get/set routines that were added. - This move changes code from indirect structure references to using local - variables with the generic routines. - - - Refactor routines when setting non-generic fields, to have both SLI3 and - SLI4 specific sections. This replaces the set-as-SLI3 then translate to - SLI4 behavior of the past. - -Link: https://lore.kernel.org/r/20220225022308.16486-8-jsmart2021@gmail.com -Co-developed-by: Justin Tee -Signed-off-by: Justin Tee -Signed-off-by: James Smart -Signed-off-by: Martin K. Petersen -Acked-by: Daniel Wagner ---- - drivers/scsi/lpfc/lpfc_els.c | 244 +++++++++++++++++++++++++++++++------------ - 1 file changed, 177 insertions(+), 67 deletions(-) - ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -5111,12 +5111,14 @@ lpfc_cmpl_els_logo_acc(struct lpfc_hba * - { - struct lpfc_nodelist *ndlp = (struct lpfc_nodelist *) cmdiocb->context1; - struct lpfc_vport *vport = cmdiocb->vport; -- IOCB_t *irsp; -+ u32 ulp_status, ulp_word4; -+ -+ ulp_status = get_job_ulpstatus(phba, rspiocb); -+ ulp_word4 = get_job_word4(phba, rspiocb); - -- irsp = &rspiocb->iocb; - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_RSP, - "ACC LOGO cmpl: status:x%x/x%x did:x%x", -- irsp->ulpStatus, irsp->un.ulpWord[4], ndlp->nlp_DID); -+ ulp_status, ulp_word4, ndlp->nlp_DID); - /* ACC to LOGO completes to NPort */ - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "0109 ACC to LOGO completes to NPort x%x refcnt %d " -@@ -5134,7 +5136,6 @@ lpfc_cmpl_els_logo_acc(struct lpfc_hba * - goto out; - - if (ndlp->nlp_state == NLP_STE_NPR_NODE) { -- - /* If PLOGI is being retried, PLOGI completion will cleanup the - * node. The NLP_NPR_2B_DISC flag needs to be retained to make - * progress on nodes discovered from last RSCN. -@@ -5241,8 +5242,7 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, - IOCB_t *irsp; - LPFC_MBOXQ_t *mbox = NULL; - struct lpfc_dmabuf *mp = NULL; -- -- irsp = &rspiocb->iocb; -+ u32 ulp_status, ulp_word4, tmo, did, iotag; - - if (!vport) { - lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, -@@ -5252,6 +5252,19 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, - if (cmdiocb->context_un.mbox) - mbox = cmdiocb->context_un.mbox; - -+ ulp_status = get_job_ulpstatus(phba, rspiocb); -+ ulp_word4 = get_job_word4(phba, rspiocb); -+ did = get_job_els_rsp64_did(phba, cmdiocb); -+ -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ tmo = get_wqe_tmo(cmdiocb); -+ iotag = get_wqe_reqtag(cmdiocb); -+ } else { -+ irsp = &rspiocb->iocb; -+ tmo = irsp->ulpTimeout; -+ iotag = irsp->ulpIoTag; -+ } -+ - /* Check to see if link went down during discovery */ - if (!ndlp || lpfc_els_chk_latt(vport)) { - if (mbox) { -@@ -5267,19 +5280,17 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, - - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_RSP, - "ELS rsp cmpl: status:x%x/x%x did:x%x", -- irsp->ulpStatus, irsp->un.ulpWord[4], -- cmdiocb->iocb.un.elsreq64.remoteID); -+ ulp_status, ulp_word4, did); - /* ELS response tag completes */ - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "0110 ELS response tag x%x completes " -- "Data: x%x x%x x%x x%x x%x x%x x%x x%x x%px\n", -- cmdiocb->iocb.ulpIoTag, rspiocb->iocb.ulpStatus, -- rspiocb->iocb.un.ulpWord[4], rspiocb->iocb.ulpTimeout, -+ "Data: x%x x%x x%x x%x x%x x%x x%x x%x %p %p\n", -+ iotag, ulp_status, ulp_word4, tmo, - ndlp->nlp_DID, ndlp->nlp_flag, ndlp->nlp_state, -- ndlp->nlp_rpi, kref_read(&ndlp->kref), mbox); -+ ndlp->nlp_rpi, kref_read(&ndlp->kref), mbox, ndlp); - if (mbox) { -- if ((rspiocb->iocb.ulpStatus == 0) && -- (ndlp->nlp_flag & NLP_ACC_REGLOGIN)) { -+ if (ulp_status == 0 -+ && (ndlp->nlp_flag & NLP_ACC_REGLOGIN)) { - if (!lpfc_unreg_rpi(vport, ndlp) && - (!(vport->fc_flag & FC_PT2PT))) { - if (ndlp->nlp_state == NLP_STE_REG_LOGIN_ISSUE) { -@@ -5772,6 +5783,7 @@ lpfc_issue_els_edc_rsp(struct lpfc_vport - struct lpfc_els_edc_rsp *edc_rsp; - struct lpfc_iocbq *elsiocb; - IOCB_t *icmd, *cmd; -+ union lpfc_wqe128 *wqe; - uint8_t *pcmd; - int cmdsize, rc; - -@@ -5781,11 +5793,21 @@ lpfc_issue_els_edc_rsp(struct lpfc_vport - if (!elsiocb) - return 1; - -- icmd = &elsiocb->iocb; -- cmd = &cmdiocb->iocb; -- icmd->ulpContext = cmd->ulpContext; /* Xri / rx_id */ -- icmd->unsli3.rcvsli3.ox_id = cmd->unsli3.rcvsli3.ox_id; -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ wqe = &elsiocb->wqe; -+ bf_set(wqe_ctxt_tag, &wqe->generic.wqe_com, -+ get_job_ulpcontext(phba, cmdiocb)); /* Xri / rx_id */ -+ bf_set(wqe_rcvoxid, &wqe->xmit_els_rsp.wqe_com, -+ get_job_rcvoxid(phba, cmdiocb)); -+ } else { -+ icmd = &elsiocb->iocb; -+ cmd = &cmdiocb->iocb; -+ icmd->ulpContext = cmd->ulpContext; /* Xri / rx_id */ -+ icmd->unsli3.rcvsli3.ox_id = cmd->unsli3.rcvsli3.ox_id; -+ } -+ - pcmd = (((struct lpfc_dmabuf *)elsiocb->context2)->virt); -+ - memset(pcmd, 0, cmdsize); - - edc_rsp = (struct lpfc_els_edc_rsp *)pcmd; -@@ -6132,10 +6154,12 @@ lpfc_els_rsp_rnid_acc(struct lpfc_vport - struct lpfc_hba *phba = vport->phba; - RNID *rn; - IOCB_t *icmd, *oldcmd; -+ union lpfc_wqe128 *wqe; - struct lpfc_iocbq *elsiocb; - uint8_t *pcmd; - uint16_t cmdsize; - int rc; -+ u32 ulp_context; - - cmdsize = sizeof(uint32_t) + sizeof(uint32_t) - + (2 * sizeof(struct lpfc_name)); -@@ -6147,15 +6171,26 @@ lpfc_els_rsp_rnid_acc(struct lpfc_vport - if (!elsiocb) - return 1; - -- icmd = &elsiocb->iocb; -- oldcmd = &oldiocb->iocb; -- icmd->ulpContext = oldcmd->ulpContext; /* Xri / rx_id */ -- icmd->unsli3.rcvsli3.ox_id = oldcmd->unsli3.rcvsli3.ox_id; -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ wqe = &elsiocb->wqe; -+ bf_set(wqe_ctxt_tag, &wqe->generic.wqe_com, -+ get_job_ulpcontext(phba, oldiocb)); /* Xri / rx_id */ -+ ulp_context = get_job_ulpcontext(phba, elsiocb); -+ bf_set(wqe_rcvoxid, &wqe->xmit_els_rsp.wqe_com, -+ get_job_rcvoxid(phba, oldiocb)); -+ } else { -+ icmd = &elsiocb->iocb; -+ oldcmd = &oldiocb->iocb; -+ icmd->ulpContext = oldcmd->ulpContext; /* Xri / rx_id */ -+ ulp_context = elsiocb->iocb.ulpContext; -+ icmd->unsli3.rcvsli3.ox_id = -+ oldcmd->unsli3.rcvsli3.ox_id; -+ } - - /* Xmit RNID ACC response tag */ - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "0132 Xmit RNID ACC response tag x%x xri x%x\n", -- elsiocb->iotag, elsiocb->iocb.ulpContext); -+ elsiocb->iotag, ulp_context); - pcmd = (uint8_t *) (((struct lpfc_dmabuf *) elsiocb->context2)->virt); - *((uint32_t *) (pcmd)) = ELS_CMD_ACC; - pcmd += sizeof(uint32_t); -@@ -6238,7 +6273,8 @@ lpfc_els_clear_rrq(struct lpfc_vport *vp - be32_to_cpu(bf_get(rrq_did, rrq)), - bf_get(rrq_oxid, rrq), - rxid, -- iocb->iotag, iocb->iocb.ulpContext); -+ get_wqe_reqtag(iocb), -+ get_job_ulpcontext(phba, iocb)); - - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_RSP, - "Clear RRQ: did:x%x flg:x%x exchg:x%.08x", -@@ -6907,12 +6943,14 @@ lpfc_els_rdp_cmpl(struct lpfc_hba *phba, - struct lpfc_iocbq *elsiocb; - struct ulp_bde64 *bpl; - IOCB_t *icmd; -+ union lpfc_wqe128 *wqe; - uint8_t *pcmd; - struct ls_rjt *stat; - struct fc_rdp_res_frame *rdp_res; - uint32_t cmdsize, len; - uint16_t *flag_ptr; - int rc; -+ u32 ulp_context; - - if (status != SUCCESS) - goto error; -@@ -6921,19 +6959,29 @@ lpfc_els_rdp_cmpl(struct lpfc_hba *phba, - cmdsize = sizeof(struct fc_rdp_res_frame); - - elsiocb = lpfc_prep_els_iocb(vport, 0, cmdsize, -- lpfc_max_els_tries, rdp_context->ndlp, -- rdp_context->ndlp->nlp_DID, ELS_CMD_ACC); -+ lpfc_max_els_tries, rdp_context->ndlp, -+ rdp_context->ndlp->nlp_DID, ELS_CMD_ACC); - if (!elsiocb) - goto free_rdp_context; - -- icmd = &elsiocb->iocb; -- icmd->ulpContext = rdp_context->rx_id; -- icmd->unsli3.rcvsli3.ox_id = rdp_context->ox_id; -+ ulp_context = get_job_ulpcontext(phba, elsiocb); -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ wqe = &elsiocb->wqe; -+ /* ox-id of the frame */ -+ bf_set(wqe_rcvoxid, &wqe->xmit_els_rsp.wqe_com, -+ rdp_context->ox_id); -+ bf_set(wqe_ctxt_tag, &wqe->xmit_els_rsp.wqe_com, -+ rdp_context->rx_id); -+ } else { -+ icmd = &elsiocb->iocb; -+ icmd->ulpContext = rdp_context->rx_id; -+ icmd->unsli3.rcvsli3.ox_id = rdp_context->ox_id; -+ } - - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "2171 Xmit RDP response tag x%x xri x%x, " - "did x%x, nlp_flag x%x, nlp_state x%x, rpi x%x", -- elsiocb->iotag, elsiocb->iocb.ulpContext, -+ elsiocb->iotag, ulp_context, - ndlp->nlp_DID, ndlp->nlp_flag, ndlp->nlp_state, - ndlp->nlp_rpi); - rdp_res = (struct fc_rdp_res_frame *) -@@ -7017,9 +7065,20 @@ lpfc_els_rdp_cmpl(struct lpfc_hba *phba, - if (!elsiocb) - goto free_rdp_context; - -- icmd = &elsiocb->iocb; -- icmd->ulpContext = rdp_context->rx_id; -- icmd->unsli3.rcvsli3.ox_id = rdp_context->ox_id; -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ wqe = &elsiocb->wqe; -+ /* ox-id of the frame */ -+ bf_set(wqe_rcvoxid, &wqe->xmit_els_rsp.wqe_com, -+ rdp_context->ox_id); -+ bf_set(wqe_ctxt_tag, -+ &wqe->xmit_els_rsp.wqe_com, -+ rdp_context->rx_id); -+ } else { -+ icmd = &elsiocb->iocb; -+ icmd->ulpContext = rdp_context->rx_id; -+ icmd->unsli3.rcvsli3.ox_id = rdp_context->ox_id; -+ } -+ - pcmd = (uint8_t *) (((struct lpfc_dmabuf *) elsiocb->context2)->virt); - - *((uint32_t *) (pcmd)) = ELS_CMD_LS_RJT; -@@ -7042,7 +7101,7 @@ lpfc_els_rdp_cmpl(struct lpfc_hba *phba, - - free_rdp_context: - /* This reference put is for the original unsolicited RDP. If the -- * iocb prep failed, there is no reference to remove. -+ * prep failed, there is no reference to remove. - */ - lpfc_nlp_put(ndlp); - kfree(rdp_context); -@@ -7108,7 +7167,7 @@ lpfc_els_rcv_rdp(struct lpfc_vport *vpor - uint8_t rjt_err, rjt_expl = LSEXP_NOTHING_MORE; - struct fc_rdp_req_frame *rdp_req; - struct lpfc_rdp_context *rdp_context; -- IOCB_t *cmd = NULL; -+ union lpfc_wqe128 *cmd = NULL; - struct ls_rjt stat; - - if (phba->sli_rev < LPFC_SLI_REV4 || -@@ -7150,15 +7209,17 @@ lpfc_els_rcv_rdp(struct lpfc_vport *vpor - goto error; - } - -- cmd = &cmdiocb->iocb; -+ cmd = &cmdiocb->wqe; - rdp_context->ndlp = lpfc_nlp_get(ndlp); - if (!rdp_context->ndlp) { - kfree(rdp_context); - rjt_err = LSRJT_UNABLE_TPC; - goto error; - } -- rdp_context->ox_id = cmd->unsli3.rcvsli3.ox_id; -- rdp_context->rx_id = cmd->ulpContext; -+ rdp_context->ox_id = bf_get(wqe_rcvoxid, -+ &cmd->xmit_els_rsp.wqe_com); -+ rdp_context->rx_id = bf_get(wqe_ctxt_tag, -+ &cmd->xmit_els_rsp.wqe_com); - rdp_context->cmpl = lpfc_els_rdp_cmpl; - if (lpfc_get_rdp_info(phba, rdp_context)) { - lpfc_printf_vlog(ndlp->vport, KERN_WARNING, LOG_ELS, -@@ -7188,6 +7249,7 @@ lpfc_els_lcb_rsp(struct lpfc_hba *phba, - { - MAILBOX_t *mb; - IOCB_t *icmd; -+ union lpfc_wqe128 *wqe; - uint8_t *pcmd; - struct lpfc_iocbq *elsiocb; - struct lpfc_nodelist *ndlp; -@@ -7238,9 +7300,17 @@ lpfc_els_lcb_rsp(struct lpfc_hba *phba, - (((struct lpfc_dmabuf *)elsiocb->context2)->virt); - - memset(lcb_res, 0, sizeof(struct fc_lcb_res_frame)); -- icmd = &elsiocb->iocb; -- icmd->ulpContext = lcb_context->rx_id; -- icmd->unsli3.rcvsli3.ox_id = lcb_context->ox_id; -+ -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ wqe = &elsiocb->wqe; -+ bf_set(wqe_ctxt_tag, &wqe->generic.wqe_com, lcb_context->rx_id); -+ bf_set(wqe_rcvoxid, &wqe->xmit_els_rsp.wqe_com, -+ lcb_context->ox_id); -+ } else { -+ icmd = &elsiocb->iocb; -+ icmd->ulpContext = lcb_context->rx_id; -+ icmd->unsli3.rcvsli3.ox_id = lcb_context->ox_id; -+ } - - pcmd = (uint8_t *)(((struct lpfc_dmabuf *)elsiocb->context2)->virt); - *((uint32_t *)(pcmd)) = ELS_CMD_ACC; -@@ -7270,15 +7340,23 @@ lpfc_els_lcb_rsp(struct lpfc_hba *phba, - error: - cmdsize = sizeof(struct fc_lcb_res_frame); - elsiocb = lpfc_prep_els_iocb(phba->pport, 0, cmdsize, -- lpfc_max_els_tries, ndlp, -- ndlp->nlp_DID, ELS_CMD_LS_RJT); -+ lpfc_max_els_tries, ndlp, -+ ndlp->nlp_DID, ELS_CMD_LS_RJT); - lpfc_nlp_put(ndlp); - if (!elsiocb) - goto free_lcb_context; - -- icmd = &elsiocb->iocb; -- icmd->ulpContext = lcb_context->rx_id; -- icmd->unsli3.rcvsli3.ox_id = lcb_context->ox_id; -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ wqe = &elsiocb->wqe; -+ bf_set(wqe_ctxt_tag, &wqe->generic.wqe_com, lcb_context->rx_id); -+ bf_set(wqe_rcvoxid, &wqe->xmit_els_rsp.wqe_com, -+ lcb_context->ox_id); -+ } else { -+ icmd = &elsiocb->iocb; -+ icmd->ulpContext = lcb_context->rx_id; -+ icmd->unsli3.rcvsli3.ox_id = lcb_context->ox_id; -+ } -+ - pcmd = (uint8_t *)(((struct lpfc_dmabuf *)elsiocb->context2)->virt); - - *((uint32_t *)(pcmd)) = ELS_CMD_LS_RJT; -@@ -7443,8 +7521,8 @@ lpfc_els_rcv_lcb(struct lpfc_vport *vpor - lcb_context->type = beacon->lcb_type; - lcb_context->frequency = beacon->lcb_frequency; - lcb_context->duration = beacon->lcb_duration; -- lcb_context->ox_id = cmdiocb->iocb.unsli3.rcvsli3.ox_id; -- lcb_context->rx_id = cmdiocb->iocb.ulpContext; -+ lcb_context->ox_id = get_job_rcvoxid(phba, cmdiocb); -+ lcb_context->rx_id = get_job_ulpcontext(phba, cmdiocb); - lcb_context->ndlp = lpfc_nlp_get(ndlp); - if (!lcb_context->ndlp) { - rjt_err = LSRJT_UNABLE_TPC; -@@ -8299,6 +8377,7 @@ lpfc_els_rsp_rls_acc(struct lpfc_hba *ph - int rc = 0; - MAILBOX_t *mb; - IOCB_t *icmd; -+ union lpfc_wqe128 *wqe; - struct RLS_RSP *rls_rsp; - uint8_t *pcmd; - struct lpfc_iocbq *elsiocb; -@@ -8306,6 +8385,7 @@ lpfc_els_rsp_rls_acc(struct lpfc_hba *ph - uint16_t oxid; - uint16_t rxid; - uint32_t cmdsize; -+ u32 ulp_context; - - mb = &pmb->u.mb; - -@@ -8333,9 +8413,17 @@ lpfc_els_rsp_rls_acc(struct lpfc_hba *ph - return; - } - -- icmd = &elsiocb->iocb; -- icmd->ulpContext = rxid; -- icmd->unsli3.rcvsli3.ox_id = oxid; -+ ulp_context = get_job_ulpcontext(phba, elsiocb); -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ wqe = &elsiocb->wqe; -+ /* Xri / rx_id */ -+ bf_set(wqe_ctxt_tag, &wqe->generic.wqe_com, rxid); -+ bf_set(wqe_rcvoxid, &wqe->xmit_els_rsp.wqe_com, oxid); -+ } else { -+ icmd = &elsiocb->iocb; -+ icmd->ulpContext = rxid; -+ icmd->unsli3.rcvsli3.ox_id = oxid; -+ } - - pcmd = (uint8_t *) (((struct lpfc_dmabuf *) elsiocb->context2)->virt); - *((uint32_t *) (pcmd)) = ELS_CMD_ACC; -@@ -8353,7 +8441,7 @@ lpfc_els_rsp_rls_acc(struct lpfc_hba *ph - lpfc_printf_vlog(ndlp->vport, KERN_INFO, LOG_ELS, - "2874 Xmit ELS RLS ACC response tag x%x xri x%x, " - "did x%x, nlp_flag x%x, nlp_state x%x, rpi x%x\n", -- elsiocb->iotag, elsiocb->iocb.ulpContext, -+ elsiocb->iotag, ulp_context, - ndlp->nlp_DID, ndlp->nlp_flag, ndlp->nlp_state, - ndlp->nlp_rpi); - elsiocb->cmd_cmpl = lpfc_cmpl_els_rsp; -@@ -8397,6 +8485,8 @@ lpfc_els_rcv_rls(struct lpfc_vport *vpor - struct lpfc_hba *phba = vport->phba; - LPFC_MBOXQ_t *mbox; - struct ls_rjt stat; -+ u32 ctx = get_job_ulpcontext(phba, cmdiocb); -+ u32 ox_id = get_job_rcvoxid(phba, cmdiocb); - - if ((ndlp->nlp_state != NLP_STE_UNMAPPED_NODE) && - (ndlp->nlp_state != NLP_STE_MAPPED_NODE)) -@@ -8407,8 +8497,7 @@ lpfc_els_rcv_rls(struct lpfc_vport *vpor - if (mbox) { - lpfc_read_lnk_stat(phba, mbox); - mbox->ctx_buf = (void *)((unsigned long) -- ((cmdiocb->iocb.unsli3.rcvsli3.ox_id << 16) | -- cmdiocb->iocb.ulpContext)); /* rx_id */ -+ (ox_id << 16 | ctx)); - mbox->ctx_ndlp = lpfc_nlp_get(ndlp); - if (!mbox->ctx_ndlp) - goto node_err; -@@ -8461,13 +8550,15 @@ lpfc_els_rcv_rtv(struct lpfc_vport *vpor - struct lpfc_nodelist *ndlp) - { - int rc = 0; -+ IOCB_t *icmd; -+ union lpfc_wqe128 *wqe; - struct lpfc_hba *phba = vport->phba; - struct ls_rjt stat; - struct RTV_RSP *rtv_rsp; - uint8_t *pcmd; - struct lpfc_iocbq *elsiocb; - uint32_t cmdsize; -- -+ u32 ulp_context; - - if ((ndlp->nlp_state != NLP_STE_UNMAPPED_NODE) && - (ndlp->nlp_state != NLP_STE_MAPPED_NODE)) -@@ -8486,9 +8577,19 @@ lpfc_els_rcv_rtv(struct lpfc_vport *vpor - *((uint32_t *) (pcmd)) = ELS_CMD_ACC; - pcmd += sizeof(uint32_t); /* Skip past command */ - -+ ulp_context = get_job_ulpcontext(phba, elsiocb); - /* use the command's xri in the response */ -- elsiocb->iocb.ulpContext = cmdiocb->iocb.ulpContext; /* Xri / rx_id */ -- elsiocb->iocb.unsli3.rcvsli3.ox_id = cmdiocb->iocb.unsli3.rcvsli3.ox_id; -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ wqe = &elsiocb->wqe; -+ bf_set(wqe_ctxt_tag, &wqe->generic.wqe_com, -+ get_job_ulpcontext(phba, cmdiocb)); -+ bf_set(wqe_rcvoxid, &wqe->xmit_els_rsp.wqe_com, -+ get_job_rcvoxid(phba, cmdiocb)); -+ } else { -+ icmd = &elsiocb->iocb; -+ icmd->ulpContext = get_job_ulpcontext(phba, cmdiocb); -+ icmd->unsli3.rcvsli3.ox_id = get_job_rcvoxid(phba, cmdiocb); -+ } - - rtv_rsp = (struct RTV_RSP *)pcmd; - -@@ -8504,7 +8605,7 @@ lpfc_els_rcv_rtv(struct lpfc_vport *vpor - "2875 Xmit ELS RTV ACC response tag x%x xri x%x, " - "did x%x, nlp_flag x%x, nlp_state x%x, rpi x%x, " - "Data: x%x x%x x%x\n", -- elsiocb->iotag, elsiocb->iocb.ulpContext, -+ elsiocb->iotag, ulp_context, - ndlp->nlp_DID, ndlp->nlp_flag, ndlp->nlp_state, - ndlp->nlp_rpi, - rtv_rsp->ratov, rtv_rsp->edtov, rtv_rsp->qtov); -@@ -8653,10 +8754,12 @@ lpfc_els_rsp_rpl_acc(struct lpfc_vport * - { - int rc = 0; - struct lpfc_hba *phba = vport->phba; -- IOCB_t *icmd, *oldcmd; -+ IOCB_t *icmd; -+ union lpfc_wqe128 *wqe; - RPL_RSP rpl_rsp; - struct lpfc_iocbq *elsiocb; - uint8_t *pcmd; -+ u32 ulp_context; - - elsiocb = lpfc_prep_els_iocb(vport, 0, cmdsize, oldiocb->retry, ndlp, - ndlp->nlp_DID, ELS_CMD_ACC); -@@ -8664,10 +8767,19 @@ lpfc_els_rsp_rpl_acc(struct lpfc_vport * - if (!elsiocb) - return 1; - -- icmd = &elsiocb->iocb; -- oldcmd = &oldiocb->iocb; -- icmd->ulpContext = oldcmd->ulpContext; /* Xri / rx_id */ -- icmd->unsli3.rcvsli3.ox_id = oldcmd->unsli3.rcvsli3.ox_id; -+ ulp_context = get_job_ulpcontext(phba, elsiocb); -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ wqe = &elsiocb->wqe; -+ /* Xri / rx_id */ -+ bf_set(wqe_ctxt_tag, &wqe->generic.wqe_com, -+ get_job_ulpcontext(phba, oldiocb)); -+ bf_set(wqe_rcvoxid, &wqe->xmit_els_rsp.wqe_com, -+ get_job_rcvoxid(phba, oldiocb)); -+ } else { -+ icmd = &elsiocb->iocb; -+ icmd->ulpContext = get_job_ulpcontext(phba, oldiocb); -+ icmd->unsli3.rcvsli3.ox_id = get_job_rcvoxid(phba, oldiocb); -+ } - - pcmd = (((struct lpfc_dmabuf *) elsiocb->context2)->virt); - *((uint32_t *) (pcmd)) = ELS_CMD_ACC; -@@ -8688,7 +8800,7 @@ lpfc_els_rsp_rpl_acc(struct lpfc_vport * - "0120 Xmit ELS RPL ACC response tag x%x " - "xri x%x, did x%x, nlp_flag x%x, nlp_state x%x, " - "rpi x%x\n", -- elsiocb->iotag, elsiocb->iocb.ulpContext, -+ elsiocb->iotag, ulp_context, - ndlp->nlp_DID, ndlp->nlp_flag, ndlp->nlp_state, - ndlp->nlp_rpi); - elsiocb->cmd_cmpl = lpfc_cmpl_els_rsp; -@@ -8797,12 +8909,10 @@ lpfc_els_rcv_farp(struct lpfc_vport *vpo - { - struct lpfc_dmabuf *pcmd; - uint32_t *lp; -- IOCB_t *icmd; - FARP *fp; - uint32_t cnt, did; - -- icmd = &cmdiocb->iocb; -- did = icmd->un.elsreq64.remoteID; -+ did = get_job_els_rsp64_did(vport->phba, cmdiocb); - pcmd = (struct lpfc_dmabuf *) cmdiocb->context2; - lp = (uint32_t *) pcmd->virt; - diff --git a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-LS_RJT-paths.patch b/patches.suse/scsi-lpfc-SLI-path-split-Refactor-LS_RJT-paths.patch deleted file mode 100644 index 983370a..0000000 --- a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-LS_RJT-paths.patch +++ /dev/null @@ -1,72 +0,0 @@ -From: James Smart -Date: Thu, 24 Feb 2022 18:22:59 -0800 -Subject: scsi: lpfc: SLI path split: Refactor LS_RJT paths -Patch-mainline: v5.18-rc1 -Git-commit: e0367dfe90d6d5b2143311b0027c9c5d8878a30c -References: bsc#1197675 - -This patch refactors the LS_RJT paths to use SLI-4 as the primary -interface: - - - Conversion away from using SLI-3 iocb structures to set/access fields in - common routines. Use the new generic get/set routines that were added. - This move changes code from indirect structure references to using local - variables with the generic routines. - - - Refactor routines when setting non-generic fields, to have both SLI3 and - SLI4 specific sections. This replaces the set-as-SLI3 then translate to - SLI4 behavior of the past. - -Link: https://lore.kernel.org/r/20220225022308.16486-9-jsmart2021@gmail.com -Co-developed-by: Justin Tee -Signed-off-by: Justin Tee -Signed-off-by: James Smart -Signed-off-by: Martin K. Petersen -Acked-by: Daniel Wagner ---- - drivers/scsi/lpfc/lpfc_els.c | 20 +++++++++++++++----- - 1 file changed, 15 insertions(+), 5 deletions(-) - ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -5696,6 +5696,7 @@ lpfc_els_rsp_reject(struct lpfc_vport *v - struct lpfc_hba *phba = vport->phba; - IOCB_t *icmd; - IOCB_t *oldcmd; -+ union lpfc_wqe128 *wqe; - struct lpfc_iocbq *elsiocb; - uint8_t *pcmd; - uint16_t cmdsize; -@@ -5706,10 +5707,19 @@ lpfc_els_rsp_reject(struct lpfc_vport *v - if (!elsiocb) - return 1; - -- icmd = &elsiocb->iocb; -- oldcmd = &oldiocb->iocb; -- icmd->ulpContext = oldcmd->ulpContext; /* Xri / rx_id */ -- icmd->unsli3.rcvsli3.ox_id = oldcmd->unsli3.rcvsli3.ox_id; -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ wqe = &elsiocb->wqe; -+ bf_set(wqe_ctxt_tag, &wqe->generic.wqe_com, -+ get_job_ulpcontext(phba, oldiocb)); /* Xri / rx_id */ -+ bf_set(wqe_rcvoxid, &wqe->xmit_els_rsp.wqe_com, -+ get_job_rcvoxid(phba, oldiocb)); -+ } else { -+ icmd = &elsiocb->iocb; -+ oldcmd = &oldiocb->iocb; -+ icmd->ulpContext = oldcmd->ulpContext; /* Xri / rx_id */ -+ icmd->unsli3.rcvsli3.ox_id = oldcmd->unsli3.rcvsli3.ox_id; -+ } -+ - pcmd = (uint8_t *) (((struct lpfc_dmabuf *) elsiocb->context2)->virt); - - *((uint32_t *) (pcmd)) = ELS_CMD_LS_RJT; -@@ -5725,7 +5735,7 @@ lpfc_els_rsp_reject(struct lpfc_vport *v - "xri x%x, did x%x, nlp_flag x%x, nlp_state x%x, " - "rpi x%x\n", - rejectError, elsiocb->iotag, -- elsiocb->iocb.ulpContext, ndlp->nlp_DID, -+ get_job_ulpcontext(phba, elsiocb), ndlp->nlp_DID, - ndlp->nlp_flag, ndlp->nlp_state, ndlp->nlp_rpi); - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_RSP, - "Issue LS_RJT: did:x%x flg:x%x err:x%x", diff --git a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-PLOGI-PRLI-ADISC-L.patch b/patches.suse/scsi-lpfc-SLI-path-split-Refactor-PLOGI-PRLI-ADISC-L.patch deleted file mode 100644 index e5388a4..0000000 --- a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-PLOGI-PRLI-ADISC-L.patch +++ /dev/null @@ -1,781 +0,0 @@ -From: James Smart -Date: Thu, 24 Feb 2022 18:22:56 -0800 -Subject: scsi: lpfc: SLI path split: Refactor PLOGI/PRLI/ADISC/LOGO paths -Patch-mainline: v5.18-rc1 -Git-commit: cad93a0890319500ce069b8e8e279353e0ea2f9a -References: bsc#1197675 - -This patch refactors the PLOGI/PRLI/ADISC/LOGO paths to use SLI-4 as -the primary interface: - - - Conversion away from using SLI-3 iocb structures to set/access fields in - common routines. Use the new generic get/set routines that were added. - This move changes code from indirect structure references to using local - variables with the generic routines. - - - Refactor routines when setting non-generic fields, to have both SLI3 and - SLI4 specific sections. This replaces the set-as-SLI3 then translate to - SLI4 behavior of the past. - -Link: https://lore.kernel.org/r/20220225022308.16486-6-jsmart2021@gmail.com -Co-developed-by: Justin Tee -Signed-off-by: Justin Tee -Signed-off-by: James Smart -Signed-off-by: Martin K. Petersen -Acked-by: Daniel Wagner ---- - drivers/scsi/lpfc/lpfc.h | 9 + - drivers/scsi/lpfc/lpfc_els.c | 278 ++++++++++++++++++++++++++----------- - drivers/scsi/lpfc/lpfc_nportdisc.c | 60 ++++--- - 3 files changed, 242 insertions(+), 105 deletions(-) - ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -1720,6 +1720,15 @@ u16 get_job_ulpcontext(struct lpfc_hba * - } - - static inline -+u16 get_job_rcvoxid(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq) -+{ -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ return bf_get(wqe_rcvoxid, &iocbq->wqe.generic.wqe_com); -+ else -+ return iocbq->iocb.unsli3.rcvsli3.ox_id; -+} -+ -+static inline - u32 get_job_els_rsp64_did(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq) - { - if (phba->sli_rev == LPFC_SLI_REV4) ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -1958,24 +1958,32 @@ lpfc_cmpl_els_plogi(struct lpfc_hba *phb - struct lpfc_nodelist *ndlp, *free_ndlp; - struct lpfc_dmabuf *prsp; - int disc; -+ u32 ulp_status, ulp_word4, did, iotag; - - /* we pass cmdiocb to state machine which needs rspiocb as well */ - cmdiocb->context_un.rsp_iocb = rspiocb; - -- irsp = &rspiocb->iocb; -+ ulp_status = get_job_ulpstatus(phba, rspiocb); -+ ulp_word4 = get_job_word4(phba, rspiocb); -+ did = get_job_els_rsp64_did(phba, cmdiocb); -+ -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ iotag = get_wqe_reqtag(cmdiocb); -+ } else { -+ irsp = &rspiocb->iocb; -+ iotag = irsp->ulpIoTag; -+ } -+ - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, - "PLOGI cmpl: status:x%x/x%x did:x%x", -- irsp->ulpStatus, irsp->un.ulpWord[4], -- irsp->un.elsreq64.remoteID); -+ ulp_status, ulp_word4, did); - -- ndlp = lpfc_findnode_did(vport, irsp->un.elsreq64.remoteID); -+ ndlp = lpfc_findnode_did(vport, did); - if (!ndlp) { - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, - "0136 PLOGI completes to NPort x%x " - "with no ndlp. Data: x%x x%x x%x\n", -- irsp->un.elsreq64.remoteID, -- irsp->ulpStatus, irsp->un.ulpWord[4], -- irsp->ulpIoTag); -+ did, ulp_status, ulp_word4, iotag); - goto out_freeiocb; - } - -@@ -1992,7 +2000,7 @@ lpfc_cmpl_els_plogi(struct lpfc_hba *phb - "0102 PLOGI completes to NPort x%06x " - "Data: x%x x%x x%x x%x x%x\n", - ndlp->nlp_DID, ndlp->nlp_fc4_type, -- irsp->ulpStatus, irsp->un.ulpWord[4], -+ ulp_status, ulp_word4, - disc, vport->num_disc_nodes); - - /* Check to see if link went down during discovery */ -@@ -2003,7 +2011,7 @@ lpfc_cmpl_els_plogi(struct lpfc_hba *phb - goto out; - } - -- if (irsp->ulpStatus) { -+ if (ulp_status) { - /* Check for retry */ - if (lpfc_els_retry(phba, cmdiocb, rspiocb)) { - /* ELS command is being retried */ -@@ -2015,17 +2023,18 @@ lpfc_cmpl_els_plogi(struct lpfc_hba *phb - goto out; - } - /* PLOGI failed Don't print the vport to vport rjts */ -- if (irsp->ulpStatus != IOSTAT_LS_RJT || -- (((irsp->un.ulpWord[4]) >> 16 != LSRJT_INVALID_CMD) && -- ((irsp->un.ulpWord[4]) >> 16 != LSRJT_UNABLE_TPC)) || -- (phba)->pport->cfg_log_verbose & LOG_ELS) -+ if (ulp_status != IOSTAT_LS_RJT || -+ (((ulp_word4) >> 16 != LSRJT_INVALID_CMD) && -+ ((ulp_word4) >> 16 != LSRJT_UNABLE_TPC)) || -+ (phba)->pport->cfg_log_verbose & LOG_ELS) - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, -- "2753 PLOGI failure DID:%06X Status:x%x/x%x\n", -- ndlp->nlp_DID, irsp->ulpStatus, -- irsp->un.ulpWord[4]); -+ "2753 PLOGI failure DID:%06X " -+ "Status:x%x/x%x\n", -+ ndlp->nlp_DID, ulp_status, -+ ulp_word4); - - /* Do not call DSM for lpfc_els_abort'ed ELS cmds */ -- if (!lpfc_error_lost_link(irsp->ulpStatus, irsp->un.ulpWord[4])) -+ if (!lpfc_error_lost_link(ulp_status, ulp_word4)) - lpfc_disc_state_machine(vport, ndlp, cmdiocb, - NLP_EVT_CMPL_PLOGI); - -@@ -2231,16 +2240,20 @@ lpfc_cmpl_els_prli(struct lpfc_hba *phba - struct lpfc_iocbq *rspiocb) - { - struct lpfc_vport *vport = cmdiocb->vport; -- IOCB_t *irsp; - struct lpfc_nodelist *ndlp; - char *mode; - u32 loglevel; -+ u32 ulp_status; -+ u32 ulp_word4; - - /* we pass cmdiocb to state machine which needs rspiocb as well */ - cmdiocb->context_un.rsp_iocb = rspiocb; - -- irsp = &(rspiocb->iocb); - ndlp = (struct lpfc_nodelist *) cmdiocb->context1; -+ -+ ulp_status = get_job_ulpstatus(phba, rspiocb); -+ ulp_word4 = get_job_word4(phba, rspiocb); -+ - spin_lock_irq(&ndlp->lock); - ndlp->nlp_flag &= ~NLP_PRLI_SND; - -@@ -2251,21 +2264,21 @@ lpfc_cmpl_els_prli(struct lpfc_hba *phba - - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, - "PRLI cmpl: status:x%x/x%x did:x%x", -- irsp->ulpStatus, irsp->un.ulpWord[4], -+ ulp_status, ulp_word4, - ndlp->nlp_DID); - - /* PRLI completes to NPort */ - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "0103 PRLI completes to NPort x%06x " - "Data: x%x x%x x%x x%x\n", -- ndlp->nlp_DID, irsp->ulpStatus, irsp->un.ulpWord[4], -+ ndlp->nlp_DID, ulp_status, ulp_word4, - vport->num_disc_nodes, ndlp->fc4_prli_sent); - - /* Check to see if link went down during discovery */ - if (lpfc_els_chk_latt(vport)) - goto out; - -- if (irsp->ulpStatus) { -+ if (ulp_status) { - /* Check for retry */ - if (lpfc_els_retry(phba, cmdiocb, rspiocb)) { - /* ELS command is being retried */ -@@ -2288,11 +2301,11 @@ lpfc_cmpl_els_prli(struct lpfc_hba *phba - lpfc_printf_vlog(vport, mode, loglevel, - "2754 PRLI failure DID:%06X Status:x%x/x%x, " - "data: x%x\n", -- ndlp->nlp_DID, irsp->ulpStatus, -- irsp->un.ulpWord[4], ndlp->fc4_prli_sent); -+ ndlp->nlp_DID, ulp_status, -+ ulp_word4, ndlp->fc4_prli_sent); - - /* Do not call DSM for lpfc_els_abort'ed ELS cmds */ -- if (!lpfc_error_lost_link(irsp->ulpStatus, irsp->un.ulpWord[4])) -+ if (!lpfc_error_lost_link(ulp_status, ulp_word4)) - lpfc_disc_state_machine(vport, ndlp, cmdiocb, - NLP_EVT_CMPL_PRLI); - -@@ -2686,16 +2699,26 @@ lpfc_cmpl_els_adisc(struct lpfc_hba *phb - IOCB_t *irsp; - struct lpfc_nodelist *ndlp; - int disc; -+ u32 ulp_status, ulp_word4, tmo; - - /* we pass cmdiocb to state machine which needs rspiocb as well */ - cmdiocb->context_un.rsp_iocb = rspiocb; - -- irsp = &(rspiocb->iocb); - ndlp = (struct lpfc_nodelist *) cmdiocb->context1; - -+ ulp_status = get_job_ulpstatus(phba, rspiocb); -+ ulp_word4 = get_job_word4(phba, rspiocb); -+ -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ tmo = get_wqe_tmo(cmdiocb); -+ } else { -+ irsp = &rspiocb->iocb; -+ tmo = irsp->ulpTimeout; -+ } -+ - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, - "ADISC cmpl: status:x%x/x%x did:x%x", -- irsp->ulpStatus, irsp->un.ulpWord[4], -+ ulp_status, ulp_word4, - ndlp->nlp_DID); - - /* Since ndlp can be freed in the disc state machine, note if this node -@@ -2709,8 +2732,8 @@ lpfc_cmpl_els_adisc(struct lpfc_hba *phb - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "0104 ADISC completes to NPort x%x " - "Data: x%x x%x x%x x%x x%x\n", -- ndlp->nlp_DID, irsp->ulpStatus, irsp->un.ulpWord[4], -- irsp->ulpTimeout, disc, vport->num_disc_nodes); -+ ndlp->nlp_DID, ulp_status, ulp_word4, -+ tmo, disc, vport->num_disc_nodes); - /* Check to see if link went down during discovery */ - if (lpfc_els_chk_latt(vport)) { - spin_lock_irq(&ndlp->lock); -@@ -2719,7 +2742,7 @@ lpfc_cmpl_els_adisc(struct lpfc_hba *phb - goto out; - } - -- if (irsp->ulpStatus) { -+ if (ulp_status) { - /* Check for retry */ - if (lpfc_els_retry(phba, cmdiocb, rspiocb)) { - /* ELS command is being retried */ -@@ -2734,11 +2757,10 @@ lpfc_cmpl_els_adisc(struct lpfc_hba *phb - /* ADISC failed */ - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, - "2755 ADISC failure DID:%06X Status:x%x/x%x\n", -- ndlp->nlp_DID, irsp->ulpStatus, -- irsp->un.ulpWord[4]); -- -+ ndlp->nlp_DID, ulp_status, -+ ulp_word4); - lpfc_disc_state_machine(vport, ndlp, cmdiocb, -- NLP_EVT_CMPL_ADISC); -+ NLP_EVT_CMPL_ADISC); - - /* As long as this node is not registered with the SCSI or NVMe - * transport, it is no longer an active node. Otherwise -@@ -2866,11 +2888,23 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba - unsigned long flags; - uint32_t skip_recovery = 0; - int wake_up_waiter = 0; -+ u32 ulp_status; -+ u32 ulp_word4; -+ u32 tmo; - - /* we pass cmdiocb to state machine which needs rspiocb as well */ - cmdiocb->context_un.rsp_iocb = rspiocb; - -- irsp = &(rspiocb->iocb); -+ ulp_status = get_job_ulpstatus(phba, rspiocb); -+ ulp_word4 = get_job_word4(phba, rspiocb); -+ -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ tmo = get_wqe_tmo(cmdiocb); -+ } else { -+ irsp = &rspiocb->iocb; -+ tmo = irsp->ulpTimeout; -+ } -+ - spin_lock_irq(&ndlp->lock); - ndlp->nlp_flag &= ~NLP_LOGO_SND; - if (ndlp->save_flags & NLP_WAIT_FOR_LOGO) { -@@ -2881,7 +2915,7 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba - - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, - "LOGO cmpl: status:x%x/x%x did:x%x", -- irsp->ulpStatus, irsp->un.ulpWord[4], -+ ulp_status, ulp_word4, - ndlp->nlp_DID); - - /* LOGO completes to NPort */ -@@ -2889,8 +2923,8 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba - "0105 LOGO completes to NPort x%x " - "refcnt %d nflags x%x Data: x%x x%x x%x x%x\n", - ndlp->nlp_DID, kref_read(&ndlp->kref), ndlp->nlp_flag, -- irsp->ulpStatus, irsp->un.ulpWord[4], -- irsp->ulpTimeout, vport->num_disc_nodes); -+ ulp_status, ulp_word4, -+ tmo, vport->num_disc_nodes); - - if (lpfc_els_chk_latt(vport)) { - skip_recovery = 1; -@@ -2902,14 +2936,15 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba - * all acceptable. Note the failure and move forward with - * discovery. The PLOGI will retry. - */ -- if (irsp->ulpStatus) { -+ if (ulp_status) { - /* LOGO failed */ - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, -- "2756 LOGO failure, No Retry DID:%06X Status:x%x/x%x\n", -- ndlp->nlp_DID, irsp->ulpStatus, -- irsp->un.ulpWord[4]); -- /* Do not call DSM for lpfc_els_abort'ed ELS cmds */ -- if (lpfc_error_lost_link(irsp->ulpStatus, irsp->un.ulpWord[4])) { -+ "2756 LOGO failure, No Retry DID:%06X " -+ "Status:x%x/x%x\n", -+ ndlp->nlp_DID, ulp_status, -+ ulp_word4); -+ -+ if (lpfc_error_lost_link(ulp_status, ulp_word4)) { - skip_recovery = 1; - goto out; - } -@@ -2964,8 +2999,8 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "3187 LOGO completes to NPort x%x: Start " - "Recovery Data: x%x x%x x%x x%x\n", -- ndlp->nlp_DID, irsp->ulpStatus, -- irsp->un.ulpWord[4], irsp->ulpTimeout, -+ ndlp->nlp_DID, ulp_status, -+ ulp_word4, tmo, - vport->num_disc_nodes); - lpfc_disc_start(vport); - return; -@@ -5345,6 +5380,8 @@ lpfc_els_rsp_acc(struct lpfc_vport *vpor - struct lpfc_hba *phba = vport->phba; - IOCB_t *icmd; - IOCB_t *oldcmd; -+ union lpfc_wqe128 *wqe; -+ union lpfc_wqe128 *oldwqe = &oldiocb->wqe; - struct lpfc_iocbq *elsiocb; - uint8_t *pcmd; - struct serv_parm *sp; -@@ -5353,8 +5390,6 @@ lpfc_els_rsp_acc(struct lpfc_vport *vpor - ELS_PKT *els_pkt_ptr; - struct fc_els_rdf_resp *rdf_resp; - -- oldcmd = &oldiocb->iocb; -- - switch (flag) { - case ELS_CMD_ACC: - cmdsize = sizeof(uint32_t); -@@ -5367,9 +5402,25 @@ lpfc_els_rsp_acc(struct lpfc_vport *vpor - return 1; - } - -- icmd = &elsiocb->iocb; -- icmd->ulpContext = oldcmd->ulpContext; /* Xri / rx_id */ -- icmd->unsli3.rcvsli3.ox_id = oldcmd->unsli3.rcvsli3.ox_id; -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ wqe = &elsiocb->wqe; -+ /* XRI / rx_id */ -+ bf_set(wqe_ctxt_tag, &wqe->xmit_els_rsp.wqe_com, -+ bf_get(wqe_ctxt_tag, -+ &oldwqe->xmit_els_rsp.wqe_com)); -+ -+ /* oxid */ -+ bf_set(wqe_rcvoxid, &wqe->xmit_els_rsp.wqe_com, -+ bf_get(wqe_rcvoxid, -+ &oldwqe->xmit_els_rsp.wqe_com)); -+ } else { -+ icmd = &elsiocb->iocb; -+ oldcmd = &oldiocb->iocb; -+ icmd->ulpContext = oldcmd->ulpContext; /* Xri / rx_id */ -+ icmd->unsli3.rcvsli3.ox_id = -+ oldcmd->unsli3.rcvsli3.ox_id; -+ } -+ - pcmd = (((struct lpfc_dmabuf *) elsiocb->context2)->virt); - *((uint32_t *) (pcmd)) = ELS_CMD_ACC; - pcmd += sizeof(uint32_t); -@@ -5386,9 +5437,25 @@ lpfc_els_rsp_acc(struct lpfc_vport *vpor - if (!elsiocb) - return 1; - -- icmd = &elsiocb->iocb; -- icmd->ulpContext = oldcmd->ulpContext; /* Xri / rx_id */ -- icmd->unsli3.rcvsli3.ox_id = oldcmd->unsli3.rcvsli3.ox_id; -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ wqe = &elsiocb->wqe; -+ /* XRI / rx_id */ -+ bf_set(wqe_ctxt_tag, &wqe->xmit_els_rsp.wqe_com, -+ bf_get(wqe_ctxt_tag, -+ &oldwqe->xmit_els_rsp.wqe_com)); -+ -+ /* oxid */ -+ bf_set(wqe_rcvoxid, &wqe->xmit_els_rsp.wqe_com, -+ bf_get(wqe_rcvoxid, -+ &oldwqe->xmit_els_rsp.wqe_com)); -+ } else { -+ icmd = &elsiocb->iocb; -+ oldcmd = &oldiocb->iocb; -+ icmd->ulpContext = oldcmd->ulpContext; /* Xri / rx_id */ -+ icmd->unsli3.rcvsli3.ox_id = -+ oldcmd->unsli3.rcvsli3.ox_id; -+ } -+ - pcmd = (((struct lpfc_dmabuf *) elsiocb->context2)->virt); - - if (mbox) -@@ -5448,9 +5515,25 @@ lpfc_els_rsp_acc(struct lpfc_vport *vpor - if (!elsiocb) - return 1; - -- icmd = &elsiocb->iocb; -- icmd->ulpContext = oldcmd->ulpContext; /* Xri / rx_id */ -- icmd->unsli3.rcvsli3.ox_id = oldcmd->unsli3.rcvsli3.ox_id; -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ wqe = &elsiocb->wqe; -+ /* XRI / rx_id */ -+ bf_set(wqe_ctxt_tag, &wqe->xmit_els_rsp.wqe_com, -+ bf_get(wqe_ctxt_tag, -+ &oldwqe->xmit_els_rsp.wqe_com)); -+ -+ /* oxid */ -+ bf_set(wqe_rcvoxid, &wqe->xmit_els_rsp.wqe_com, -+ bf_get(wqe_rcvoxid, -+ &oldwqe->xmit_els_rsp.wqe_com)); -+ } else { -+ icmd = &elsiocb->iocb; -+ oldcmd = &oldiocb->iocb; -+ icmd->ulpContext = oldcmd->ulpContext; /* Xri / rx_id */ -+ icmd->unsli3.rcvsli3.ox_id = -+ oldcmd->unsli3.rcvsli3.ox_id; -+ } -+ - pcmd = (((struct lpfc_dmabuf *) elsiocb->context2)->virt); - - memcpy(pcmd, ((struct lpfc_dmabuf *) oldiocb->context2)->virt, -@@ -5470,9 +5553,25 @@ lpfc_els_rsp_acc(struct lpfc_vport *vpor - if (!elsiocb) - return 1; - -- icmd = &elsiocb->iocb; -- icmd->ulpContext = oldcmd->ulpContext; /* Xri / rx_id */ -- icmd->unsli3.rcvsli3.ox_id = oldcmd->unsli3.rcvsli3.ox_id; -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ wqe = &elsiocb->wqe; -+ /* XRI / rx_id */ -+ bf_set(wqe_ctxt_tag, &wqe->xmit_els_rsp.wqe_com, -+ bf_get(wqe_ctxt_tag, -+ &oldwqe->xmit_els_rsp.wqe_com)); -+ -+ /* oxid */ -+ bf_set(wqe_rcvoxid, &wqe->xmit_els_rsp.wqe_com, -+ bf_get(wqe_rcvoxid, -+ &oldwqe->xmit_els_rsp.wqe_com)); -+ } else { -+ icmd = &elsiocb->iocb; -+ oldcmd = &oldiocb->iocb; -+ icmd->ulpContext = oldcmd->ulpContext; /* Xri / rx_id */ -+ icmd->unsli3.rcvsli3.ox_id = -+ oldcmd->unsli3.rcvsli3.ox_id; -+ } -+ - pcmd = (((struct lpfc_dmabuf *)elsiocb->context2)->virt); - rdf_resp = (struct fc_els_rdf_resp *)pcmd; - memset(rdf_resp, 0, sizeof(*rdf_resp)); -@@ -5727,10 +5826,12 @@ lpfc_els_rsp_adisc_acc(struct lpfc_vport - struct lpfc_hba *phba = vport->phba; - ADISC *ap; - IOCB_t *icmd, *oldcmd; -+ union lpfc_wqe128 *wqe; - struct lpfc_iocbq *elsiocb; - uint8_t *pcmd; - uint16_t cmdsize; - int rc; -+ u32 ulp_context; - - cmdsize = sizeof(uint32_t) + sizeof(ADISC); - elsiocb = lpfc_prep_els_iocb(vport, 0, cmdsize, oldiocb->retry, ndlp, -@@ -5738,16 +5839,29 @@ lpfc_els_rsp_adisc_acc(struct lpfc_vport - if (!elsiocb) - return 1; - -- icmd = &elsiocb->iocb; -- oldcmd = &oldiocb->iocb; -- icmd->ulpContext = oldcmd->ulpContext; /* Xri / rx_id */ -- icmd->unsli3.rcvsli3.ox_id = oldcmd->unsli3.rcvsli3.ox_id; -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ wqe = &elsiocb->wqe; -+ /* XRI / rx_id */ -+ bf_set(wqe_ctxt_tag, &wqe->generic.wqe_com, -+ get_job_ulpcontext(phba, oldiocb)); -+ ulp_context = get_job_ulpcontext(phba, elsiocb); -+ /* oxid */ -+ bf_set(wqe_rcvoxid, &wqe->xmit_els_rsp.wqe_com, -+ get_job_rcvoxid(phba, oldiocb)); -+ } else { -+ icmd = &elsiocb->iocb; -+ oldcmd = &oldiocb->iocb; -+ icmd->ulpContext = oldcmd->ulpContext; /* Xri / rx_id */ -+ ulp_context = elsiocb->iocb.ulpContext; -+ icmd->unsli3.rcvsli3.ox_id = -+ oldcmd->unsli3.rcvsli3.ox_id; -+ } - - /* Xmit ADISC ACC response tag */ - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "0130 Xmit ADISC ACC response iotag x%x xri: " - "x%x, did x%x, nlp_flag x%x, nlp_state x%x rpi x%x\n", -- elsiocb->iotag, elsiocb->iocb.ulpContext, -+ elsiocb->iotag, ulp_context, - ndlp->nlp_DID, ndlp->nlp_flag, ndlp->nlp_state, - ndlp->nlp_rpi); - pcmd = (uint8_t *) (((struct lpfc_dmabuf *) elsiocb->context2)->virt); -@@ -5780,14 +5894,6 @@ lpfc_els_rsp_adisc_acc(struct lpfc_vport - return 1; - } - -- /* Xmit ELS ACC response tag */ -- lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, -- "0128 Xmit ELS ACC response Status: x%x, IoTag: x%x, " -- "XRI: x%x, DID: x%x, nlp_flag: x%x nlp_state: x%x " -- "RPI: x%x, fc_flag x%x\n", -- rc, elsiocb->iotag, elsiocb->sli4_xritag, -- ndlp->nlp_DID, ndlp->nlp_flag, ndlp->nlp_state, -- ndlp->nlp_rpi, vport->fc_flag); - return 0; - } - -@@ -5820,13 +5926,14 @@ lpfc_els_rsp_prli_acc(struct lpfc_vport - lpfc_vpd_t *vpd; - IOCB_t *icmd; - IOCB_t *oldcmd; -+ union lpfc_wqe128 *wqe; - struct lpfc_iocbq *elsiocb; - uint8_t *pcmd; - uint16_t cmdsize; - uint32_t prli_fc4_req, *req_payload; - struct lpfc_dmabuf *req_buf; - int rc; -- u32 elsrspcmd; -+ u32 elsrspcmd, ulp_context; - - /* Need the incoming PRLI payload to determine if the ACC is for an - * FC4 or NVME PRLI type. The PRLI type is at word 1. -@@ -5852,20 +5959,31 @@ lpfc_els_rsp_prli_acc(struct lpfc_vport - } - - elsiocb = lpfc_prep_els_iocb(vport, 0, cmdsize, oldiocb->retry, ndlp, -- ndlp->nlp_DID, elsrspcmd); -+ ndlp->nlp_DID, elsrspcmd); - if (!elsiocb) - return 1; - -- icmd = &elsiocb->iocb; -- oldcmd = &oldiocb->iocb; -- icmd->ulpContext = oldcmd->ulpContext; /* Xri / rx_id */ -- icmd->unsli3.rcvsli3.ox_id = oldcmd->unsli3.rcvsli3.ox_id; -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ wqe = &elsiocb->wqe; -+ bf_set(wqe_ctxt_tag, &wqe->generic.wqe_com, -+ get_job_ulpcontext(phba, oldiocb)); /* Xri / rx_id */ -+ ulp_context = get_job_ulpcontext(phba, elsiocb); -+ bf_set(wqe_rcvoxid, &wqe->xmit_els_rsp.wqe_com, -+ get_job_rcvoxid(phba, oldiocb)); -+ } else { -+ icmd = &elsiocb->iocb; -+ oldcmd = &oldiocb->iocb; -+ icmd->ulpContext = oldcmd->ulpContext; /* Xri / rx_id */ -+ ulp_context = elsiocb->iocb.ulpContext; -+ icmd->unsli3.rcvsli3.ox_id = -+ oldcmd->unsli3.rcvsli3.ox_id; -+ } - - /* Xmit PRLI ACC response tag */ - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "0131 Xmit PRLI ACC response tag x%x xri x%x, " - "did x%x, nlp_flag x%x, nlp_state x%x, rpi x%x\n", -- elsiocb->iotag, elsiocb->iocb.ulpContext, -+ elsiocb->iotag, ulp_context, - ndlp->nlp_DID, ndlp->nlp_flag, ndlp->nlp_state, - ndlp->nlp_rpi); - pcmd = (uint8_t *) (((struct lpfc_dmabuf *) elsiocb->context2)->virt); ---- a/drivers/scsi/lpfc/lpfc_nportdisc.c -+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c -@@ -677,13 +677,13 @@ static int - lpfc_rcv_padisc(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, - struct lpfc_iocbq *cmdiocb) - { -+ struct lpfc_hba *phba = vport->phba; - struct lpfc_iocbq *elsiocb; - struct lpfc_dmabuf *pcmd; - struct serv_parm *sp; - struct lpfc_name *pnn, *ppn; - struct ls_rjt stat; - ADISC *ap; -- IOCB_t *icmd; - uint32_t *lp; - uint32_t cmd; - -@@ -701,8 +701,8 @@ lpfc_rcv_padisc(struct lpfc_vport *vport - ppn = (struct lpfc_name *) & sp->portName; - } - -- icmd = &cmdiocb->iocb; -- if (icmd->ulpStatus == 0 && lpfc_check_adisc(vport, ndlp, pnn, ppn)) { -+ if (get_job_ulpstatus(phba, cmdiocb) == 0 && -+ lpfc_check_adisc(vport, ndlp, pnn, ppn)) { - - /* - * As soon as we send ACC, the remote NPort can -@@ -713,7 +713,6 @@ lpfc_rcv_padisc(struct lpfc_vport *vport - elsiocb = kmalloc(sizeof(struct lpfc_iocbq), - GFP_KERNEL); - if (elsiocb) { -- - /* Save info from cmd IOCB used in rsp */ - memcpy((uint8_t *)elsiocb, (uint8_t *)cmdiocb, - sizeof(struct lpfc_iocbq)); -@@ -1304,23 +1303,24 @@ lpfc_cmpl_plogi_plogi_issue(struct lpfc_ - struct lpfc_dmabuf *pcmd, *prsp, *mp; - uint32_t *lp; - uint32_t vid, flag; -- IOCB_t *irsp; - struct serv_parm *sp; - uint32_t ed_tov; - LPFC_MBOXQ_t *mbox; - int rc; -+ u32 ulp_status; -+ u32 did; - - cmdiocb = (struct lpfc_iocbq *) arg; - rspiocb = cmdiocb->context_un.rsp_iocb; - -+ ulp_status = get_job_ulpstatus(phba, rspiocb); -+ - if (ndlp->nlp_flag & NLP_ACC_REGLOGIN) { - /* Recovery from PLOGI collision logic */ - return ndlp->nlp_state; - } - -- irsp = &rspiocb->iocb; -- -- if (irsp->ulpStatus) -+ if (ulp_status) - goto out; - - pcmd = (struct lpfc_dmabuf *) cmdiocb->context2; -@@ -1432,7 +1432,9 @@ lpfc_cmpl_plogi_plogi_issue(struct lpfc_ - goto out; - } - -- if (lpfc_reg_rpi(phba, vport->vpi, irsp->un.elsreq64.remoteID, -+ did = get_job_els_rsp64_did(phba, cmdiocb); -+ -+ if (lpfc_reg_rpi(phba, vport->vpi, did, - (uint8_t *) sp, mbox, ndlp->nlp_rpi) == 0) { - switch (ndlp->nlp_DID) { - case NameServer_DID: -@@ -1662,17 +1664,18 @@ lpfc_cmpl_adisc_adisc_issue(struct lpfc_ - { - struct lpfc_hba *phba = vport->phba; - struct lpfc_iocbq *cmdiocb, *rspiocb; -- IOCB_t *irsp; - ADISC *ap; - int rc; -+ u32 ulp_status; - - cmdiocb = (struct lpfc_iocbq *) arg; - rspiocb = cmdiocb->context_un.rsp_iocb; - -+ ulp_status = get_job_ulpstatus(phba, rspiocb); -+ - ap = (ADISC *)lpfc_check_elscmpl_iocb(phba, cmdiocb, rspiocb); -- irsp = &rspiocb->iocb; - -- if ((irsp->ulpStatus) || -+ if ((ulp_status) || - (!lpfc_check_adisc(vport, ndlp, &ap->nodeName, &ap->portName))) { - /* 1 sec timeout */ - mod_timer(&ndlp->nlp_delayfunc, -@@ -2115,14 +2118,16 @@ lpfc_cmpl_prli_prli_issue(struct lpfc_vp - { - struct lpfc_iocbq *cmdiocb, *rspiocb; - struct lpfc_hba *phba = vport->phba; -- IOCB_t *irsp; - PRLI *npr; - struct lpfc_nvme_prli *nvpr; - void *temp_ptr; -+ u32 ulp_status; - - cmdiocb = (struct lpfc_iocbq *) arg; - rspiocb = cmdiocb->context_un.rsp_iocb; - -+ ulp_status = get_job_ulpstatus(phba, rspiocb); -+ - /* A solicited PRLI is either FCP or NVME. The PRLI cmd/rsp - * format is different so NULL the two PRLI types so that the - * driver correctly gets the correct context. -@@ -2135,8 +2140,7 @@ lpfc_cmpl_prli_prli_issue(struct lpfc_vp - else if (cmdiocb->cmd_flag & LPFC_PRLI_NVME_REQ) - nvpr = (struct lpfc_nvme_prli *) temp_ptr; - -- irsp = &rspiocb->iocb; -- if (irsp->ulpStatus) { -+ if (ulp_status) { - if ((vport->port_type == LPFC_NPIV_PORT) && - vport->cfg_restrict_login) { - goto out; -@@ -2735,16 +2739,18 @@ static uint32_t - lpfc_cmpl_plogi_npr_node(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, - void *arg, uint32_t evt) - { -+ struct lpfc_hba *phba = vport->phba; - struct lpfc_iocbq *cmdiocb, *rspiocb; -- IOCB_t *irsp; -+ u32 ulp_status; - - cmdiocb = (struct lpfc_iocbq *) arg; - rspiocb = cmdiocb->context_un.rsp_iocb; - -- irsp = &rspiocb->iocb; -- if (irsp->ulpStatus) { -+ ulp_status = get_job_ulpstatus(phba, rspiocb); -+ -+ if (ulp_status) - return NLP_STE_FREED_NODE; -- } -+ - return ndlp->nlp_state; - } - -@@ -2752,14 +2758,16 @@ static uint32_t - lpfc_cmpl_prli_npr_node(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, - void *arg, uint32_t evt) - { -+ struct lpfc_hba *phba = vport->phba; - struct lpfc_iocbq *cmdiocb, *rspiocb; -- IOCB_t *irsp; -+ u32 ulp_status; - - cmdiocb = (struct lpfc_iocbq *) arg; - rspiocb = cmdiocb->context_un.rsp_iocb; - -- irsp = &rspiocb->iocb; -- if (irsp->ulpStatus && (ndlp->nlp_flag & NLP_NODEV_REMOVE)) { -+ ulp_status = get_job_ulpstatus(phba, rspiocb); -+ -+ if (ulp_status && (ndlp->nlp_flag & NLP_NODEV_REMOVE)) { - lpfc_drop_node(vport, ndlp); - return NLP_STE_FREED_NODE; - } -@@ -2786,14 +2794,16 @@ static uint32_t - lpfc_cmpl_adisc_npr_node(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, - void *arg, uint32_t evt) - { -+ struct lpfc_hba *phba = vport->phba; - struct lpfc_iocbq *cmdiocb, *rspiocb; -- IOCB_t *irsp; -+ u32 ulp_status; - - cmdiocb = (struct lpfc_iocbq *) arg; - rspiocb = cmdiocb->context_un.rsp_iocb; - -- irsp = &rspiocb->iocb; -- if (irsp->ulpStatus && (ndlp->nlp_flag & NLP_NODEV_REMOVE)) { -+ ulp_status = get_job_ulpstatus(phba, rspiocb); -+ -+ if (ulp_status && (ndlp->nlp_flag & NLP_NODEV_REMOVE)) { - lpfc_drop_node(vport, ndlp); - return NLP_STE_FREED_NODE; - } diff --git a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-SCSI-paths.patch b/patches.suse/scsi-lpfc-SLI-path-split-Refactor-SCSI-paths.patch deleted file mode 100644 index c8f319d..0000000 --- a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-SCSI-paths.patch +++ /dev/null @@ -1,661 +0,0 @@ -From: James Smart -Date: Thu, 24 Feb 2022 18:23:04 -0800 -Subject: scsi: lpfc: SLI path split: Refactor SCSI paths -Patch-mainline: v5.18-rc1 -Git-commit: 3512ac0942938d6977e7999ee69765d948d2faf1 -References: bsc#1197675 - -This patch refactors the SCSI paths to use SLI-4 as the primary interface. - - - Conversion away from using SLI-3 iocb structures to set/access fields in - common routines. Use the new generic get/set routines that were added. - This move changes code from indirect structure references to using local - variables with the generic routines. - - - Refactor routines when setting non-generic fields, to have both SLI3 and - SLI4 specific sections. This replaces the set-as-SLI3 then translate to - SLI4 behavior of the past. - -Link: https://lore.kernel.org/r/20220225022308.16486-14-jsmart2021@gmail.com -Co-developed-by: Justin Tee -Signed-off-by: Justin Tee -Signed-off-by: James Smart -Signed-off-by: Martin K. Petersen -Acked-by: Daniel Wagner ---- - drivers/scsi/lpfc/lpfc.h | 4 - drivers/scsi/lpfc/lpfc_scsi.c | 378 ++++++++++++++++++------------------------ - drivers/scsi/lpfc/lpfc_sli.c | 6 - 3 files changed, 173 insertions(+), 215 deletions(-) - ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -828,6 +828,10 @@ struct lpfc_hba { - (struct lpfc_vport *vport, - struct lpfc_io_buf *lpfc_cmd, - uint8_t tmo); -+ int (*lpfc_scsi_prep_task_mgmt_cmd) -+ (struct lpfc_vport *vport, -+ struct lpfc_io_buf *lpfc_cmd, -+ u64 lun, u8 task_mgmt_cmd); - - /* IOCB interface function jump table entries */ - int (*__lpfc_sli_issue_iocb) ---- a/drivers/scsi/lpfc/lpfc_scsi.c -+++ b/drivers/scsi/lpfc/lpfc_scsi.c -@@ -2939,160 +2939,58 @@ lpfc_calc_bg_err(struct lpfc_hba *phba, - * -1 - Internal error (bad profile, ...etc) - */ - static int --lpfc_sli4_parse_bg_err(struct lpfc_hba *phba, struct lpfc_io_buf *lpfc_cmd, -- struct lpfc_wcqe_complete *wcqe) -+lpfc_parse_bg_err(struct lpfc_hba *phba, struct lpfc_io_buf *lpfc_cmd, -+ struct lpfc_iocbq *pIocbOut) - { - struct scsi_cmnd *cmd = lpfc_cmd->pCmd; -+ struct sli3_bg_fields *bgf; - int ret = 0; -- u32 status = bf_get(lpfc_wcqe_c_status, wcqe); -+ struct lpfc_wcqe_complete *wcqe; -+ u32 status; - u32 bghm = 0; - u32 bgstat = 0; - u64 failing_sector = 0; - -- if (status == CQE_STATUS_DI_ERROR) { -- if (bf_get(lpfc_wcqe_c_bg_ge, wcqe)) /* Guard Check failed */ -- bgstat |= BGS_GUARD_ERR_MASK; -- if (bf_get(lpfc_wcqe_c_bg_ae, wcqe)) /* AppTag Check failed */ -- bgstat |= BGS_APPTAG_ERR_MASK; -- if (bf_get(lpfc_wcqe_c_bg_re, wcqe)) /* RefTag Check failed */ -- bgstat |= BGS_REFTAG_ERR_MASK; -- -- /* Check to see if there was any good data before the error */ -- if (bf_get(lpfc_wcqe_c_bg_tdpv, wcqe)) { -- bgstat |= BGS_HI_WATER_MARK_PRESENT_MASK; -- bghm = wcqe->total_data_placed; -- } -- -- /* -- * Set ALL the error bits to indicate we don't know what -- * type of error it is. -- */ -- if (!bgstat) -- bgstat |= (BGS_REFTAG_ERR_MASK | BGS_APPTAG_ERR_MASK | -- BGS_GUARD_ERR_MASK); -- } -- -- if (lpfc_bgs_get_guard_err(bgstat)) { -- ret = 1; -- -- scsi_build_sense_buffer(1, cmd->sense_buffer, ILLEGAL_REQUEST, -- 0x10, 0x1); -- cmd->result = DRIVER_SENSE << 24 | DID_ABORT << 16 | -- SAM_STAT_CHECK_CONDITION; -- phba->bg_guard_err_cnt++; -- lpfc_printf_log(phba, KERN_WARNING, LOG_FCP | LOG_BG, -- "9059 BLKGRD: Guard Tag error in cmd" -- " 0x%x lba 0x%llx blk cnt 0x%x " -- "bgstat=x%x bghm=x%x\n", cmd->cmnd[0], -- (unsigned long long)scsi_get_lba(cmd), -- scsi_logical_block_count(cmd), bgstat, bghm); -- } -- -- if (lpfc_bgs_get_reftag_err(bgstat)) { -- ret = 1; -- -- scsi_build_sense_buffer(1, cmd->sense_buffer, ILLEGAL_REQUEST, -- 0x10, 0x3); -- cmd->result = DRIVER_SENSE << 24 | DID_ABORT << 16 | -- SAM_STAT_CHECK_CONDITION; -- -- phba->bg_reftag_err_cnt++; -- lpfc_printf_log(phba, KERN_WARNING, LOG_FCP | LOG_BG, -- "9060 BLKGRD: Ref Tag error in cmd" -- " 0x%x lba 0x%llx blk cnt 0x%x " -- "bgstat=x%x bghm=x%x\n", cmd->cmnd[0], -- (unsigned long long)scsi_get_lba(cmd), -- scsi_logical_block_count(cmd), bgstat, bghm); -- } -- -- if (lpfc_bgs_get_apptag_err(bgstat)) { -- ret = 1; - -- scsi_build_sense_buffer(1, cmd->sense_buffer, ILLEGAL_REQUEST, -- 0x10, 0x2); -- cmd->result = DRIVER_SENSE << 24 | DID_ABORT << 16 | -- SAM_STAT_CHECK_CONDITION; -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ wcqe = &pIocbOut->wcqe_cmpl; -+ status = bf_get(lpfc_wcqe_c_status, wcqe); - -- phba->bg_apptag_err_cnt++; -- lpfc_printf_log(phba, KERN_WARNING, LOG_FCP | LOG_BG, -- "9062 BLKGRD: App Tag error in cmd" -- " 0x%x lba 0x%llx blk cnt 0x%x " -- "bgstat=x%x bghm=x%x\n", cmd->cmnd[0], -- (unsigned long long)scsi_get_lba(cmd), -- scsi_logical_block_count(cmd), bgstat, bghm); -- } -+ if (status == CQE_STATUS_DI_ERROR) { -+ /* Guard Check failed */ -+ if (bf_get(lpfc_wcqe_c_bg_ge, wcqe)) -+ bgstat |= BGS_GUARD_ERR_MASK; -+ -+ /* AppTag Check failed */ -+ if (bf_get(lpfc_wcqe_c_bg_ae, wcqe)) -+ bgstat |= BGS_APPTAG_ERR_MASK; -+ -+ /* RefTag Check failed */ -+ if (bf_get(lpfc_wcqe_c_bg_re, wcqe)) -+ bgstat |= BGS_REFTAG_ERR_MASK; - -- if (lpfc_bgs_get_hi_water_mark_present(bgstat)) { -- /* -- * setup sense data descriptor 0 per SPC-4 as an information -- * field, and put the failing LBA in it. -- * This code assumes there was also a guard/app/ref tag error -- * indication. -- */ -- cmd->sense_buffer[7] = 0xc; /* Additional sense length */ -- cmd->sense_buffer[8] = 0; /* Information descriptor type */ -- cmd->sense_buffer[9] = 0xa; /* Additional descriptor length */ -- cmd->sense_buffer[10] = 0x80; /* Validity bit */ -+ /* Check to see if there was any good data before the -+ * error -+ */ -+ if (bf_get(lpfc_wcqe_c_bg_tdpv, wcqe)) { -+ bgstat |= BGS_HI_WATER_MARK_PRESENT_MASK; -+ bghm = wcqe->total_data_placed; -+ } - -- /* bghm is a "on the wire" FC frame based count */ -- switch (scsi_get_prot_op(cmd)) { -- case SCSI_PROT_READ_INSERT: -- case SCSI_PROT_WRITE_STRIP: -- bghm /= cmd->device->sector_size; -- break; -- case SCSI_PROT_READ_STRIP: -- case SCSI_PROT_WRITE_INSERT: -- case SCSI_PROT_READ_PASS: -- case SCSI_PROT_WRITE_PASS: -- bghm /= (cmd->device->sector_size + -- sizeof(struct scsi_dif_tuple)); -- break; -+ /* -+ * Set ALL the error bits to indicate we don't know what -+ * type of error it is. -+ */ -+ if (!bgstat) -+ bgstat |= (BGS_REFTAG_ERR_MASK | -+ BGS_APPTAG_ERR_MASK | -+ BGS_GUARD_ERR_MASK); - } -- -- failing_sector = scsi_get_lba(cmd); -- failing_sector += bghm; -- -- /* Descriptor Information */ -- put_unaligned_be64(failing_sector, &cmd->sense_buffer[12]); -- } -- -- if (!ret) { -- /* No error was reported - problem in FW? */ -- lpfc_printf_log(phba, KERN_WARNING, LOG_FCP | LOG_BG, -- "9068 BLKGRD: Unknown error in cmd" -- " 0x%x lba 0x%llx blk cnt 0x%x " -- "bgstat=x%x bghm=x%x\n", cmd->cmnd[0], -- (unsigned long long)scsi_get_lba(cmd), -- scsi_logical_block_count(cmd), bgstat, bghm); -- -- /* Calculate what type of error it was */ -- lpfc_calc_bg_err(phba, lpfc_cmd); -+ } else { -+ bgf = &pIocbOut->iocb.unsli3.sli3_bg; -+ bghm = bgf->bghm; -+ bgstat = bgf->bgstat; - } -- return ret; --} -- --/* -- * This function checks for BlockGuard errors detected by -- * the HBA. In case of errors, the ASC/ASCQ fields in the -- * sense buffer will be set accordingly, paired with -- * ILLEGAL_REQUEST to signal to the kernel that the HBA -- * detected corruption. -- * -- * Returns: -- * 0 - No error found -- * 1 - BlockGuard error found -- * -1 - Internal error (bad profile, ...etc) -- */ --static int --lpfc_parse_bg_err(struct lpfc_hba *phba, struct lpfc_io_buf *lpfc_cmd, -- struct lpfc_iocbq *pIocbOut) --{ -- struct scsi_cmnd *cmd = lpfc_cmd->pCmd; -- struct sli3_bg_fields *bgf = &pIocbOut->iocb.unsli3.sli3_bg; -- int ret = 0; -- uint32_t bghm = bgf->bghm; -- uint32_t bgstat = bgf->bgstat; -- uint64_t failing_sector = 0; - - if (lpfc_bgs_get_invalid_prof(bgstat)) { - cmd->result = DID_ERROR << 16; -@@ -3120,7 +3018,6 @@ lpfc_parse_bg_err(struct lpfc_hba *phba, - - if (lpfc_bgs_get_guard_err(bgstat)) { - ret = 1; -- - scsi_build_sense_buffer(1, cmd->sense_buffer, ILLEGAL_REQUEST, - 0x10, 0x1); - cmd->result = DRIVER_SENSE << 24 | DID_ABORT << 16 | -@@ -3136,12 +3033,10 @@ lpfc_parse_bg_err(struct lpfc_hba *phba, - - if (lpfc_bgs_get_reftag_err(bgstat)) { - ret = 1; -- - scsi_build_sense_buffer(1, cmd->sense_buffer, ILLEGAL_REQUEST, - 0x10, 0x3); - cmd->result = DRIVER_SENSE << 24 | DID_ABORT << 16 | - SAM_STAT_CHECK_CONDITION; -- - phba->bg_reftag_err_cnt++; - lpfc_printf_log(phba, KERN_WARNING, LOG_FCP | LOG_BG, - "9056 BLKGRD: Ref Tag error in cmd " -@@ -3153,12 +3048,10 @@ lpfc_parse_bg_err(struct lpfc_hba *phba, - - if (lpfc_bgs_get_apptag_err(bgstat)) { - ret = 1; -- - scsi_build_sense_buffer(1, cmd->sense_buffer, ILLEGAL_REQUEST, - 0x10, 0x2); - cmd->result = DRIVER_SENSE << 24 | DID_ABORT << 16 | - SAM_STAT_CHECK_CONDITION; -- - phba->bg_apptag_err_cnt++; - lpfc_printf_log(phba, KERN_WARNING, LOG_FCP | LOG_BG, - "9061 BLKGRD: App Tag error in cmd " -@@ -4204,7 +4097,6 @@ lpfc_fcp_io_cmd_wqe_cmpl(struct lpfc_hba - struct Scsi_Host *shost; - u32 logit = LOG_FCP; - u32 status, idx; -- unsigned long iflags = 0; - u32 lat; - u8 wait_xb_clr = 0; - -@@ -4219,30 +4111,16 @@ lpfc_fcp_io_cmd_wqe_cmpl(struct lpfc_hba - rdata = lpfc_cmd->rdata; - ndlp = rdata->pnode; - -- if (bf_get(lpfc_wcqe_c_xb, wcqe)) { -- /* TOREMOVE - currently this flag is checked during -- * the release of lpfc_iocbq. Remove once we move -- * to lpfc_wqe_job construct. -- * -- * This needs to be done outside buf_lock -- */ -- spin_lock_irqsave(&phba->hbalock, iflags); -- lpfc_cmd->cur_iocbq.cmd_flag |= LPFC_EXCHANGE_BUSY; -- spin_unlock_irqrestore(&phba->hbalock, iflags); -- } -- -- /* Guard against abort handler being called at same time */ -- spin_lock(&lpfc_cmd->buf_lock); -- - /* Sanity check on return of outstanding command */ - cmd = lpfc_cmd->pCmd; - if (!cmd) { - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, - "9042 I/O completion: Not an active IO\n"); -- spin_unlock(&lpfc_cmd->buf_lock); - lpfc_release_scsi_buf(phba, lpfc_cmd); - return; - } -+ /* Guard against abort handler being called at same time */ -+ spin_lock(&lpfc_cmd->buf_lock); - idx = lpfc_cmd->cur_iocbq.hba_wqidx; - if (phba->sli4_hba.hdwq) - phba->sli4_hba.hdwq[idx].scsi_cstat.io_cmpls++; -@@ -4417,12 +4295,14 @@ lpfc_fcp_io_cmd_wqe_cmpl(struct lpfc_hba - * This is a response for a BG enabled - * cmd. Parse BG error - */ -- lpfc_sli4_parse_bg_err(phba, lpfc_cmd, -- wcqe); -+ lpfc_parse_bg_err(phba, lpfc_cmd, pwqeOut); - break; -+ } else { -+ lpfc_printf_vlog(vport, KERN_WARNING, -+ LOG_BG, -+ "9040 non-zero BGSTAT " -+ "on unprotected cmd\n"); - } -- lpfc_printf_vlog(vport, KERN_WARNING, LOG_BG, -- "9040 non-zero BGSTAT on unprotected cmd\n"); - } - lpfc_printf_vlog(vport, KERN_WARNING, logit, - "9036 Local Reject FCP cmd x%x failed" -@@ -5028,7 +4908,7 @@ lpfc_scsi_prep_cmnd(struct lpfc_vport *v - } - - /** -- * lpfc_scsi_prep_task_mgmt_cmd - Convert SLI3 scsi TM cmd to FCP info unit -+ * lpfc_scsi_prep_task_mgmt_cmd_s3 - Convert SLI3 scsi TM cmd to FCP info unit - * @vport: The virtual port for which this call is being executed. - * @lpfc_cmd: Pointer to lpfc_io_buf data structure. - * @lun: Logical unit number. -@@ -5042,10 +4922,9 @@ lpfc_scsi_prep_cmnd(struct lpfc_vport *v - * 1 - Success - **/ - static int --lpfc_scsi_prep_task_mgmt_cmd(struct lpfc_vport *vport, -- struct lpfc_io_buf *lpfc_cmd, -- uint64_t lun, -- uint8_t task_mgmt_cmd) -+lpfc_scsi_prep_task_mgmt_cmd_s3(struct lpfc_vport *vport, -+ struct lpfc_io_buf *lpfc_cmd, -+ u64 lun, u8 task_mgmt_cmd) - { - struct lpfc_iocbq *piocbq; - IOCB_t *piocb; -@@ -5066,15 +4945,10 @@ lpfc_scsi_prep_task_mgmt_cmd(struct lpfc - memset(fcp_cmnd, 0, sizeof(struct fcp_cmnd)); - int_to_scsilun(lun, &fcp_cmnd->fcp_lun); - fcp_cmnd->fcpCntl2 = task_mgmt_cmd; -- if (vport->phba->sli_rev == 3 && -- !(vport->phba->sli3_options & LPFC_SLI3_BG_ENABLED)) -+ if (!(vport->phba->sli3_options & LPFC_SLI3_BG_ENABLED)) - lpfc_fcpcmd_to_iocb(piocb->unsli3.fcp_ext.icd, fcp_cmnd); - piocb->ulpCommand = CMD_FCP_ICMND64_CR; - piocb->ulpContext = ndlp->nlp_rpi; -- if (vport->phba->sli_rev == LPFC_SLI_REV4) { -- piocb->ulpContext = -- vport->phba->sli4_hba.rpi_ids[ndlp->nlp_rpi]; -- } - piocb->ulpFCP2Rcvy = (ndlp->nlp_fcp_info & NLP_FCP_2_DEVICE) ? 1 : 0; - piocb->ulpClass = (ndlp->nlp_fcp_info & 0x0f); - piocb->ulpPU = 0; -@@ -5090,8 +4964,79 @@ lpfc_scsi_prep_task_mgmt_cmd(struct lpfc - } else - piocb->ulpTimeout = lpfc_cmd->timeout; - -- if (vport->phba->sli_rev == LPFC_SLI_REV4) -- lpfc_sli4_set_rsp_sgl_last(vport->phba, lpfc_cmd); -+ return 1; -+} -+ -+/** -+ * lpfc_scsi_prep_task_mgmt_cmd_s4 - Convert SLI4 scsi TM cmd to FCP info unit -+ * @vport: The virtual port for which this call is being executed. -+ * @lpfc_cmd: Pointer to lpfc_io_buf data structure. -+ * @lun: Logical unit number. -+ * @task_mgmt_cmd: SCSI task management command. -+ * -+ * This routine creates FCP information unit corresponding to @task_mgmt_cmd -+ * for device with SLI-4 interface spec. -+ * -+ * Return codes: -+ * 0 - Error -+ * 1 - Success -+ **/ -+static int -+lpfc_scsi_prep_task_mgmt_cmd_s4(struct lpfc_vport *vport, -+ struct lpfc_io_buf *lpfc_cmd, -+ u64 lun, u8 task_mgmt_cmd) -+{ -+ struct lpfc_iocbq *pwqeq = &lpfc_cmd->cur_iocbq; -+ union lpfc_wqe128 *wqe = &pwqeq->wqe; -+ struct fcp_cmnd *fcp_cmnd; -+ struct lpfc_rport_data *rdata = lpfc_cmd->rdata; -+ struct lpfc_nodelist *ndlp = rdata->pnode; -+ -+ if (!ndlp || ndlp->nlp_state != NLP_STE_MAPPED_NODE) -+ return 0; -+ -+ pwqeq->vport = vport; -+ /* Initialize 64 bytes only */ -+ memset(wqe, 0, sizeof(union lpfc_wqe128)); -+ -+ /* From the icmnd template, initialize words 4 - 11 */ -+ memcpy(&wqe->words[4], &lpfc_icmnd_cmd_template.words[4], -+ sizeof(uint32_t) * 8); -+ -+ fcp_cmnd = lpfc_cmd->fcp_cmnd; -+ /* Clear out any old data in the FCP command area */ -+ memset(fcp_cmnd, 0, sizeof(struct fcp_cmnd)); -+ int_to_scsilun(lun, &fcp_cmnd->fcp_lun); -+ fcp_cmnd->fcpCntl3 = 0; -+ fcp_cmnd->fcpCntl2 = task_mgmt_cmd; -+ -+ bf_set(payload_offset_len, &wqe->fcp_icmd, -+ sizeof(struct fcp_cmnd) + sizeof(struct fcp_rsp)); -+ bf_set(cmd_buff_len, &wqe->fcp_icmd, 0); -+ bf_set(wqe_ctxt_tag, &wqe->generic.wqe_com, /* ulpContext */ -+ vport->phba->sli4_hba.rpi_ids[ndlp->nlp_rpi]); -+ bf_set(wqe_erp, &wqe->fcp_icmd.wqe_com, -+ ((ndlp->nlp_fcp_info & NLP_FCP_2_DEVICE) ? 1 : 0)); -+ bf_set(wqe_class, &wqe->fcp_icmd.wqe_com, -+ (ndlp->nlp_fcp_info & 0x0f)); -+ -+ /* ulpTimeout is only one byte */ -+ if (lpfc_cmd->timeout > 0xff) { -+ /* -+ * Do not timeout the command at the firmware level. -+ * The driver will provide the timeout mechanism. -+ */ -+ bf_set(wqe_tmo, &wqe->fcp_icmd.wqe_com, 0); -+ } else { -+ bf_set(wqe_tmo, &wqe->fcp_icmd.wqe_com, lpfc_cmd->timeout); -+ } -+ -+ lpfc_prep_embed_io(vport->phba, lpfc_cmd); -+ bf_set(wqe_xri_tag, &wqe->generic.wqe_com, pwqeq->sli4_xritag); -+ wqe->generic.wqe_com.abort_tag = pwqeq->iotag; -+ bf_set(wqe_reqtag, &wqe->generic.wqe_com, pwqeq->iotag); -+ -+ lpfc_sli4_set_rsp_sgl_last(vport->phba, lpfc_cmd); - - return 1; - } -@@ -5118,6 +5063,8 @@ lpfc_scsi_api_table_setup(struct lpfc_hb - phba->lpfc_release_scsi_buf = lpfc_release_scsi_buf_s3; - phba->lpfc_get_scsi_buf = lpfc_get_scsi_buf_s3; - phba->lpfc_scsi_prep_cmnd_buf = lpfc_scsi_prep_cmnd_buf_s3; -+ phba->lpfc_scsi_prep_task_mgmt_cmd = -+ lpfc_scsi_prep_task_mgmt_cmd_s3; - break; - case LPFC_PCI_DEV_OC: - phba->lpfc_scsi_prep_dma_buf = lpfc_scsi_prep_dma_buf_s4; -@@ -5125,6 +5072,8 @@ lpfc_scsi_api_table_setup(struct lpfc_hb - phba->lpfc_release_scsi_buf = lpfc_release_scsi_buf_s4; - phba->lpfc_get_scsi_buf = lpfc_get_scsi_buf_s4; - phba->lpfc_scsi_prep_cmnd_buf = lpfc_scsi_prep_cmnd_buf_s4; -+ phba->lpfc_scsi_prep_task_mgmt_cmd = -+ lpfc_scsi_prep_task_mgmt_cmd_s4; - break; - default: - lpfc_printf_log(phba, KERN_ERR, LOG_INIT, -@@ -5344,6 +5293,7 @@ lpfc_queuecommand(struct Scsi_Host *shos - { - struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata; - struct lpfc_hba *phba = vport->phba; -+ struct lpfc_iocbq *cur_iocbq = NULL; - struct lpfc_rport_data *rdata; - struct lpfc_nodelist *ndlp; - struct lpfc_io_buf *lpfc_cmd; -@@ -5436,6 +5386,7 @@ lpfc_queuecommand(struct Scsi_Host *shos - } - lpfc_cmd->rx_cmd_start = start; - -+ cur_iocbq = &lpfc_cmd->cur_iocbq; - /* - * Store the midlayer's command structure for the completion phase - * and complete the command initialization. -@@ -5443,7 +5394,7 @@ lpfc_queuecommand(struct Scsi_Host *shos - lpfc_cmd->pCmd = cmnd; - lpfc_cmd->rdata = rdata; - lpfc_cmd->ndlp = ndlp; -- lpfc_cmd->cur_iocbq.cmd_cmpl = NULL; -+ cur_iocbq->cmd_cmpl = NULL; - cmnd->host_scribble = (unsigned char *)lpfc_cmd; - - err = lpfc_scsi_prep_cmnd(vport, lpfc_cmd, ndlp); -@@ -5485,14 +5436,12 @@ lpfc_queuecommand(struct Scsi_Host *shos - goto out_host_busy_free_buf; - } - -- - #ifdef CONFIG_SCSI_LPFC_DEBUG_FS - if (unlikely(phba->hdwqstat_on & LPFC_CHECK_SCSI_IO)) - this_cpu_inc(phba->sli4_hba.c_stat->xmt_io); - #endif - /* Issue I/O to adapter */ -- err = lpfc_sli_issue_fcp_io(phba, LPFC_FCP_RING, -- &lpfc_cmd->cur_iocbq, -+ err = lpfc_sli_issue_fcp_io(phba, LPFC_FCP_RING, cur_iocbq, - SLI_IOCB_RET_IOCB); - #ifdef CONFIG_SCSI_LPFC_DEBUG_FS - if (start) { -@@ -5505,25 +5454,25 @@ lpfc_queuecommand(struct Scsi_Host *shos - #endif - if (err) { - lpfc_printf_vlog(vport, KERN_INFO, LOG_FCP, -- "3376 FCP could not issue IOCB err %x " -- "FCP cmd x%x <%d/%llu> " -- "sid: x%x did: x%x oxid: x%x " -- "Data: x%x x%x x%x x%x\n", -- err, cmnd->cmnd[0], -- cmnd->device ? cmnd->device->id : 0xffff, -- cmnd->device ? cmnd->device->lun : (u64)-1, -- vport->fc_myDID, ndlp->nlp_DID, -- phba->sli_rev == LPFC_SLI_REV4 ? -- lpfc_cmd->cur_iocbq.sli4_xritag : 0xffff, -- phba->sli_rev == LPFC_SLI_REV4 ? -- phba->sli4_hba.rpi_ids[ndlp->nlp_rpi] : -- lpfc_cmd->cur_iocbq.iocb.ulpContext, -- lpfc_cmd->cur_iocbq.iotag, -- phba->sli_rev == LPFC_SLI_REV4 ? -- bf_get(wqe_tmo, -- &lpfc_cmd->cur_iocbq.wqe.generic.wqe_com) : -- lpfc_cmd->cur_iocbq.iocb.ulpTimeout, -- (uint32_t)(scsi_cmd_to_rq(cmnd)->timeout / 1000)); -+ "3376 FCP could not issue iocb err %x " -+ "FCP cmd x%x <%d/%llu> " -+ "sid: x%x did: x%x oxid: x%x " -+ "Data: x%x x%x x%x x%x\n", -+ err, cmnd->cmnd[0], -+ cmnd->device ? cmnd->device->id : 0xffff, -+ cmnd->device ? cmnd->device->lun : (u64)-1, -+ vport->fc_myDID, ndlp->nlp_DID, -+ phba->sli_rev == LPFC_SLI_REV4 ? -+ cur_iocbq->sli4_xritag : 0xffff, -+ phba->sli_rev == LPFC_SLI_REV4 ? -+ phba->sli4_hba.rpi_ids[ndlp->nlp_rpi] : -+ cur_iocbq->iocb.ulpContext, -+ cur_iocbq->iotag, -+ phba->sli_rev == LPFC_SLI_REV4 ? -+ bf_get(wqe_tmo, -+ &cur_iocbq->wqe.generic.wqe_com) : -+ cur_iocbq->iocb.ulpTimeout, -+ (uint32_t)(scsi_cmd_to_rq(cmnd)->timeout / 1000)); - - goto out_host_busy_free_buf; - } -@@ -5879,7 +5828,7 @@ lpfc_send_taskmgmt(struct lpfc_vport *vp - return FAILED; - pnode = rdata->pnode; - -- lpfc_cmd = lpfc_get_scsi_buf(phba, pnode, NULL); -+ lpfc_cmd = lpfc_get_scsi_buf(phba, rdata->pnode, NULL); - if (lpfc_cmd == NULL) - return FAILED; - lpfc_cmd->timeout = phba->cfg_task_mgmt_tmo; -@@ -5887,8 +5836,8 @@ lpfc_send_taskmgmt(struct lpfc_vport *vp - lpfc_cmd->pCmd = NULL; - lpfc_cmd->ndlp = pnode; - -- status = lpfc_scsi_prep_task_mgmt_cmd(vport, lpfc_cmd, lun_id, -- task_mgmt_cmd); -+ status = phba->lpfc_scsi_prep_task_mgmt_cmd(vport, lpfc_cmd, lun_id, -+ task_mgmt_cmd); - if (!status) { - lpfc_release_scsi_buf(phba, lpfc_cmd); - return FAILED; -@@ -5901,6 +5850,7 @@ lpfc_send_taskmgmt(struct lpfc_vport *vp - return FAILED; - } - iocbq->cmd_cmpl = lpfc_tskmgmt_def_cmpl; -+ iocbq->vport = vport; - - lpfc_printf_vlog(vport, KERN_INFO, LOG_FCP, - "0702 Issue %s to TGT %d LUN %llu " -@@ -5912,26 +5862,28 @@ lpfc_send_taskmgmt(struct lpfc_vport *vp - status = lpfc_sli_issue_iocb_wait(phba, LPFC_FCP_RING, - iocbq, iocbqrsp, lpfc_cmd->timeout); - if ((status != IOCB_SUCCESS) || -- (iocbqrsp->iocb.ulpStatus != IOSTAT_SUCCESS)) { -+ (get_job_ulpstatus(phba, iocbqrsp) != IOSTAT_SUCCESS)) { - if (status != IOCB_SUCCESS || -- iocbqrsp->iocb.ulpStatus != IOSTAT_FCP_RSP_ERROR) -+ get_job_ulpstatus(phba, iocbqrsp) != IOSTAT_FCP_RSP_ERROR) - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, - "0727 TMF %s to TGT %d LUN %llu " - "failed (%d, %d) cmd_flag x%x\n", - lpfc_taskmgmt_name(task_mgmt_cmd), - tgt_id, lun_id, -- iocbqrsp->iocb.ulpStatus, -- iocbqrsp->iocb.un.ulpWord[4], -+ get_job_ulpstatus(phba, iocbqrsp), -+ get_job_word4(phba, iocbqrsp), - iocbq->cmd_flag); - /* if ulpStatus != IOCB_SUCCESS, then status == IOCB_SUCCESS */ - if (status == IOCB_SUCCESS) { -- if (iocbqrsp->iocb.ulpStatus == IOSTAT_FCP_RSP_ERROR) -+ if (get_job_ulpstatus(phba, iocbqrsp) == -+ IOSTAT_FCP_RSP_ERROR) - /* Something in the FCP_RSP was invalid. - * Check conditions */ - ret = lpfc_check_fcp_rsp(vport, lpfc_cmd); - else - ret = FAILED; -- } else if (status == IOCB_TIMEDOUT) { -+ } else if ((status == IOCB_TIMEDOUT) || -+ (status == IOCB_ABORTED)) { - ret = TIMEOUT_ERROR; - } else { - ret = FAILED; -@@ -5941,7 +5893,7 @@ lpfc_send_taskmgmt(struct lpfc_vport *vp - - lpfc_sli_release_iocbq(phba, iocbqrsp); - -- if (ret != TIMEOUT_ERROR) -+ if (status != IOCB_TIMEDOUT) - lpfc_release_scsi_buf(phba, lpfc_cmd); - - return ret; ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -12488,6 +12488,7 @@ lpfc_sli_wake_iocb_wait(struct lpfc_hba - wait_queue_head_t *pdone_q; - unsigned long iflags; - struct lpfc_io_buf *lpfc_cmd; -+ size_t offset = offsetof(struct lpfc_iocbq, wqe); - - spin_lock_irqsave(&phba->hbalock, iflags); - if (cmdiocbq->cmd_flag & LPFC_IO_WAKE_TMO) { -@@ -12508,10 +12509,11 @@ lpfc_sli_wake_iocb_wait(struct lpfc_hba - return; - } - -+ /* Copy the contents of the local rspiocb into the caller's buffer. */ - cmdiocbq->cmd_flag |= LPFC_IO_WAKE; - if (cmdiocbq->context2 && rspiocbq) -- memcpy(&((struct lpfc_iocbq *)cmdiocbq->context2)->iocb, -- &rspiocbq->iocb, sizeof(IOCB_t)); -+ memcpy((char *)cmdiocbq->context2 + offset, -+ (char *)rspiocbq + offset, sizeof(*rspiocbq) - offset); - - /* Set the exchange busy flag for task management commands */ - if ((cmdiocbq->cmd_flag & LPFC_IO_FCP) && diff --git a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-base-ELS-paths-and.patch b/patches.suse/scsi-lpfc-SLI-path-split-Refactor-base-ELS-paths-and.patch deleted file mode 100644 index 7596d83..0000000 --- a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-base-ELS-paths-and.patch +++ /dev/null @@ -1,1373 +0,0 @@ -From: James Smart -Date: Thu, 24 Feb 2022 18:22:55 -0800 -Subject: scsi: lpfc: SLI path split: Refactor base ELS paths and the FLOGI - path -Patch-mainline: v5.18-rc1 -Git-commit: 6831ce129f1948f50f2d2a57995d2ebd7a6fa0b4 -References: bsc#1197675 - -The patch refactors the general ELS handling paths to migrate to SLI-4 -structures or common element abstractions. The fabric login paths are -revised as part of this patch: - - - New generic lpfc_sli_prep_els_req_rsp jump table routine - - - Introduce ls_rjt_error_be and ulp_bde64_le unions to correct legacy - endianness assignments - - - Conversion away from using SLI-3 iocb structures to set/access fields in - common routines. Use the new generic get/set routines that were added. - This move changes code from indirect structure references to using local - variables with the generic routines. - - - Refactor routines when setting non-generic fields, to have both SLI3 and - SLI4 specific sections. This replaces the set-as-SLI3 then translate to - SLI4 behavior of the past. - - - Clean up poor indentation on some of the ELS paths - -Link: https://lore.kernel.org/r/20220225022308.16486-5-jsmart2021@gmail.com -Co-developed-by: Justin Tee -Signed-off-by: Justin Tee -Signed-off-by: James Smart -Signed-off-by: Martin K. Petersen -Acked-by: Daniel Wagner ---- - drivers/scsi/lpfc/lpfc.h | 17 + - drivers/scsi/lpfc/lpfc_crtn.h | 5 - drivers/scsi/lpfc/lpfc_ct.c | 4 - drivers/scsi/lpfc/lpfc_els.c | 436 ++++++++++++++++++++++-------------------- - drivers/scsi/lpfc/lpfc_hw.h | 14 - - drivers/scsi/lpfc/lpfc_hw4.h | 29 ++ - drivers/scsi/lpfc/lpfc_sli.c | 182 +++++++++++++++-- - 7 files changed, 450 insertions(+), 237 deletions(-) - ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -873,7 +873,13 @@ struct lpfc_hba { - - int (*lpfc_bg_scsi_prep_dma_buf) - (struct lpfc_hba *, struct lpfc_io_buf *); -- /* Add new entries here */ -+ -+ /* Prep SLI WQE/IOCB jump table entries */ -+ void (*__lpfc_sli_prep_els_req_rsp)(struct lpfc_iocbq *cmdiocbq, -+ struct lpfc_vport *vport, -+ struct lpfc_dmabuf *bmp, -+ u16 cmd_size, u32 did, u32 elscmd, -+ u8 tmo, u8 expect_rsp); - - /* expedite pool */ - struct lpfc_epd_pool epd_pool; -@@ -1712,3 +1718,12 @@ u16 get_job_ulpcontext(struct lpfc_hba * - else - return iocbq->iocb.ulpContext; - } -+ -+static inline -+u32 get_job_els_rsp64_did(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq) -+{ -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ return bf_get(wqe_els_did, &iocbq->wqe.els_req.wqe_dest); -+ else -+ return iocbq->iocb.un.elsreq64.remoteID; -+} ---- a/drivers/scsi/lpfc/lpfc_crtn.h -+++ b/drivers/scsi/lpfc/lpfc_crtn.h -@@ -354,6 +354,11 @@ int lpfc_sli4_issue_wqe(struct lpfc_hba - struct lpfc_iocbq *pwqe); - int lpfc_sli4_issue_abort_iotag(struct lpfc_hba *phba, - struct lpfc_iocbq *cmdiocb, void *cmpl); -+void lpfc_sli_prep_els_req_rsp(struct lpfc_hba *phba, -+ struct lpfc_iocbq *cmdiocbq, -+ struct lpfc_vport *vport, -+ struct lpfc_dmabuf *bmp, u16 cmd_size, u32 did, -+ u32 elscmd, u8 tmo, u8 expect_rsp); - struct lpfc_sglq *__lpfc_clear_active_sglq(struct lpfc_hba *phba, uint16_t xri); - struct lpfc_sglq *__lpfc_sli_get_nvmet_sglq(struct lpfc_hba *phba, - struct lpfc_iocbq *piocbq); ---- a/drivers/scsi/lpfc/lpfc_ct.c -+++ b/drivers/scsi/lpfc/lpfc_ct.c -@@ -980,7 +980,7 @@ lpfc_cmpl_ct_cmd_gid_ft(struct lpfc_hba - lpfc_vport_set_state(vport, FC_VPORT_FAILED); - goto out; - } -- if (lpfc_error_lost_link(irsp)) { -+ if (lpfc_error_lost_link(irsp->ulpStatus, irsp->un.ulpWord[4])) { - lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY, - "0226 NS query failed due to link event\n"); - if (vport->fc_flag & FC_RSCN_MODE) -@@ -1197,7 +1197,7 @@ lpfc_cmpl_ct_cmd_gid_pt(struct lpfc_hba - lpfc_vport_set_state(vport, FC_VPORT_FAILED); - goto out; - } -- if (lpfc_error_lost_link(irsp)) { -+ if (lpfc_error_lost_link(irsp->ulpStatus, irsp->un.ulpWord[4])) { - lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY, - "4166 NS query failed due to link event\n"); - if (vport->fc_flag & FC_RSCN_MODE) ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -127,9 +127,9 @@ lpfc_els_chk_latt(struct lpfc_vport *vpo - /** - * lpfc_prep_els_iocb - Allocate and prepare a lpfc iocb data structure - * @vport: pointer to a host virtual N_Port data structure. -- * @expectRsp: flag indicating whether response is expected. -- * @cmdSize: size of the ELS command. -- * @retry: number of retries to the command IOCB when it fails. -+ * @expect_rsp: flag indicating whether response is expected. -+ * @cmd_size: size of the ELS command. -+ * @retry: number of retries to the command when it fails. - * @ndlp: pointer to a node-list data structure. - * @did: destination identifier. - * @elscmd: the ELS command code. -@@ -153,25 +153,23 @@ lpfc_els_chk_latt(struct lpfc_vport *vpo - * NULL - when els iocb data structure allocation/preparation failed - **/ - struct lpfc_iocbq * --lpfc_prep_els_iocb(struct lpfc_vport *vport, uint8_t expectRsp, -- uint16_t cmdSize, uint8_t retry, -- struct lpfc_nodelist *ndlp, uint32_t did, -- uint32_t elscmd) -+lpfc_prep_els_iocb(struct lpfc_vport *vport, u8 expect_rsp, -+ u16 cmd_size, u8 retry, -+ struct lpfc_nodelist *ndlp, u32 did, -+ u32 elscmd) - { - struct lpfc_hba *phba = vport->phba; - struct lpfc_iocbq *elsiocb; -- struct lpfc_dmabuf *pcmd, *prsp, *pbuflist; -- struct ulp_bde64 *bpl; -- IOCB_t *icmd; -- -+ struct lpfc_dmabuf *pcmd, *prsp, *pbuflist, *bmp; -+ struct ulp_bde64_le *bpl; -+ u32 timeout = 0; - - if (!lpfc_is_link_up(phba)) - return NULL; - - /* Allocate buffer for command iocb */ - elsiocb = lpfc_sli_get_iocbq(phba); -- -- if (elsiocb == NULL) -+ if (!elsiocb) - return NULL; - - /* -@@ -179,35 +177,33 @@ lpfc_prep_els_iocb(struct lpfc_vport *vp - * in FIP mode send FLOGI, FDISC and LOGO as FIP frames. - */ - if ((did == Fabric_DID) && -- (phba->hba_flag & HBA_FIP_SUPPORT) && -- ((elscmd == ELS_CMD_FLOGI) || -- (elscmd == ELS_CMD_FDISC) || -- (elscmd == ELS_CMD_LOGO))) -+ (phba->hba_flag & HBA_FIP_SUPPORT) && -+ ((elscmd == ELS_CMD_FLOGI) || -+ (elscmd == ELS_CMD_FDISC) || -+ (elscmd == ELS_CMD_LOGO))) - switch (elscmd) { - case ELS_CMD_FLOGI: -- elsiocb->cmd_flag |= -- ((LPFC_ELS_ID_FLOGI << LPFC_FIP_ELS_ID_SHIFT) -- & LPFC_FIP_ELS_ID_MASK); -- break; -+ elsiocb->cmd_flag |= -+ ((LPFC_ELS_ID_FLOGI << LPFC_FIP_ELS_ID_SHIFT) -+ & LPFC_FIP_ELS_ID_MASK); -+ break; - case ELS_CMD_FDISC: -- elsiocb->cmd_flag |= -- ((LPFC_ELS_ID_FDISC << LPFC_FIP_ELS_ID_SHIFT) -- & LPFC_FIP_ELS_ID_MASK); -- break; -+ elsiocb->cmd_flag |= -+ ((LPFC_ELS_ID_FDISC << LPFC_FIP_ELS_ID_SHIFT) -+ & LPFC_FIP_ELS_ID_MASK); -+ break; - case ELS_CMD_LOGO: -- elsiocb->cmd_flag |= -- ((LPFC_ELS_ID_LOGO << LPFC_FIP_ELS_ID_SHIFT) -- & LPFC_FIP_ELS_ID_MASK); -- break; -+ elsiocb->cmd_flag |= -+ ((LPFC_ELS_ID_LOGO << LPFC_FIP_ELS_ID_SHIFT) -+ & LPFC_FIP_ELS_ID_MASK); -+ break; - } - else - elsiocb->cmd_flag &= ~LPFC_FIP_ELS_ID_MASK; - -- icmd = &elsiocb->iocb; -- - /* fill in BDEs for command */ - /* Allocate buffer for command payload */ -- pcmd = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL); -+ pcmd = kmalloc(sizeof(*pcmd), GFP_KERNEL); - if (pcmd) - pcmd->virt = lpfc_mbuf_alloc(phba, MEM_PRI, &pcmd->phys); - if (!pcmd || !pcmd->virt) -@@ -216,19 +212,20 @@ lpfc_prep_els_iocb(struct lpfc_vport *vp - INIT_LIST_HEAD(&pcmd->list); - - /* Allocate buffer for response payload */ -- if (expectRsp) { -- prsp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL); -+ if (expect_rsp) { -+ prsp = kmalloc(sizeof(*prsp), GFP_KERNEL); - if (prsp) - prsp->virt = lpfc_mbuf_alloc(phba, MEM_PRI, - &prsp->phys); - if (!prsp || !prsp->virt) - goto els_iocb_free_prsp_exit; - INIT_LIST_HEAD(&prsp->list); -- } else -+ } else { - prsp = NULL; -+ } - - /* Allocate buffer for Buffer ptr list */ -- pbuflist = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL); -+ pbuflist = kmalloc(sizeof(*pbuflist), GFP_KERNEL); - if (pbuflist) - pbuflist->virt = lpfc_mbuf_alloc(phba, MEM_PRI, - &pbuflist->phys); -@@ -237,70 +234,42 @@ lpfc_prep_els_iocb(struct lpfc_vport *vp - - INIT_LIST_HEAD(&pbuflist->list); - -- if (expectRsp) { -- icmd->un.elsreq64.bdl.addrHigh = putPaddrHigh(pbuflist->phys); -- icmd->un.elsreq64.bdl.addrLow = putPaddrLow(pbuflist->phys); -- icmd->un.elsreq64.bdl.bdeFlags = BUFF_TYPE_BLP_64; -- icmd->un.elsreq64.bdl.bdeSize = (2 * sizeof(struct ulp_bde64)); -- -- icmd->un.elsreq64.remoteID = did; /* DID */ -- icmd->ulpCommand = CMD_ELS_REQUEST64_CR; -- if (elscmd == ELS_CMD_FLOGI) -- icmd->ulpTimeout = FF_DEF_RATOV * 2; -- else if (elscmd == ELS_CMD_LOGO) -- icmd->ulpTimeout = phba->fc_ratov; -- else -- icmd->ulpTimeout = phba->fc_ratov * 2; -- } else { -- icmd->un.xseq64.bdl.addrHigh = putPaddrHigh(pbuflist->phys); -- icmd->un.xseq64.bdl.addrLow = putPaddrLow(pbuflist->phys); -- icmd->un.xseq64.bdl.bdeFlags = BUFF_TYPE_BLP_64; -- icmd->un.xseq64.bdl.bdeSize = sizeof(struct ulp_bde64); -- icmd->un.xseq64.xmit_els_remoteID = did; /* DID */ -- icmd->ulpCommand = CMD_XMIT_ELS_RSP64_CX; -- } -- icmd->ulpBdeCount = 1; -- icmd->ulpLe = 1; -- icmd->ulpClass = CLASS3; -- -- /* -- * If we have NPIV enabled, we want to send ELS traffic by VPI. -- * For SLI4, since the driver controls VPIs we also want to include -- * all ELS pt2pt protocol traffic as well. -- */ -- if ((phba->sli3_options & LPFC_SLI3_NPIV_ENABLED) || -- ((phba->sli_rev == LPFC_SLI_REV4) && -- (vport->fc_flag & FC_PT2PT))) { -- -- if (expectRsp) { -- icmd->un.elsreq64.myID = vport->fc_myDID; -- -- /* For ELS_REQUEST64_CR, use the VPI by default */ -- icmd->ulpContext = phba->vpi_ids[vport->vpi]; -+ if (expect_rsp) { -+ switch (elscmd) { -+ case ELS_CMD_FLOGI: -+ timeout = FF_DEF_RATOV * 2; -+ break; -+ case ELS_CMD_LOGO: -+ timeout = phba->fc_ratov; -+ break; -+ default: -+ timeout = phba->fc_ratov * 2; - } - -- icmd->ulpCt_h = 0; -- /* The CT field must be 0=INVALID_RPI for the ECHO cmd */ -- if (elscmd == ELS_CMD_ECHO) -- icmd->ulpCt_l = 0; /* context = invalid RPI */ -- else -- icmd->ulpCt_l = 1; /* context = VPI */ -+ /* Fill SGE for the num bde count */ -+ elsiocb->num_bdes = 2; - } - -- bpl = (struct ulp_bde64 *) pbuflist->virt; -- bpl->addrLow = le32_to_cpu(putPaddrLow(pcmd->phys)); -- bpl->addrHigh = le32_to_cpu(putPaddrHigh(pcmd->phys)); -- bpl->tus.f.bdeSize = cmdSize; -- bpl->tus.f.bdeFlags = 0; -- bpl->tus.w = le32_to_cpu(bpl->tus.w); -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ bmp = pcmd; -+ else -+ bmp = pbuflist; - -- if (expectRsp) { -+ lpfc_sli_prep_els_req_rsp(phba, elsiocb, vport, bmp, cmd_size, did, -+ elscmd, timeout, expect_rsp); -+ -+ bpl = (struct ulp_bde64_le *)pbuflist->virt; -+ bpl->addr_low = cpu_to_le32(putPaddrLow(pcmd->phys)); -+ bpl->addr_high = cpu_to_le32(putPaddrHigh(pcmd->phys)); -+ bpl->type_size = cpu_to_le32(cmd_size); -+ bpl->type_size |= cpu_to_le32(ULP_BDE64_TYPE_BDE_64); -+ -+ if (expect_rsp) { - bpl++; -- bpl->addrLow = le32_to_cpu(putPaddrLow(prsp->phys)); -- bpl->addrHigh = le32_to_cpu(putPaddrHigh(prsp->phys)); -- bpl->tus.f.bdeSize = FCELSSIZE; -- bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64; -- bpl->tus.w = le32_to_cpu(bpl->tus.w); -+ bpl->addr_low = cpu_to_le32(putPaddrLow(prsp->phys)); -+ bpl->addr_high = cpu_to_le32(putPaddrHigh(prsp->phys)); -+ bpl->type_size = cpu_to_le32(FCELSSIZE); -+ bpl->type_size |= cpu_to_le32(ULP_BDE64_TYPE_BDE_64); - } - - elsiocb->context2 = pcmd; -@@ -309,10 +278,9 @@ lpfc_prep_els_iocb(struct lpfc_vport *vp - elsiocb->vport = vport; - elsiocb->drvrTimeout = (phba->fc_ratov << 1) + LPFC_DRVR_TIMEOUT; - -- if (prsp) { -+ if (prsp) - list_add(&prsp->list, &pcmd->list); -- } -- if (expectRsp) { -+ if (expect_rsp) { - /* Xmit ELS command to remote NPORT */ - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "0116 Xmit ELS command x%x to remote " -@@ -328,13 +296,14 @@ lpfc_prep_els_iocb(struct lpfc_vport *vp - "NPORT x%x I/O tag: x%x, size: x%x " - "port_state x%x rpi x%x fc_flag x%x\n", - elscmd, ndlp->nlp_DID, elsiocb->iotag, -- cmdSize, vport->port_state, -+ cmd_size, vport->port_state, - ndlp->nlp_rpi, vport->fc_flag); - } -+ - return elsiocb; - - els_iocb_free_pbuf_exit: -- if (expectRsp) -+ if (expect_rsp) - lpfc_mbuf_free(phba, prsp->virt, prsp->phys); - kfree(pbuflist); - -@@ -643,7 +612,7 @@ lpfc_check_clean_addr_bit(struct lpfc_vp - * @vport: pointer to a host virtual N_Port data structure. - * @ndlp: pointer to a node-list data structure. - * @sp: pointer to service parameter data structure. -- * @irsp: pointer to the IOCB within the lpfc response IOCB. -+ * @ulp_word4: command response value - * - * This routine is invoked by the lpfc_cmpl_els_flogi() completion callback - * function to handle the completion of a Fabric Login (FLOGI) into a fabric -@@ -660,7 +629,7 @@ lpfc_check_clean_addr_bit(struct lpfc_vp - **/ - static int - lpfc_cmpl_els_flogi_fabric(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, -- struct serv_parm *sp, IOCB_t *irsp) -+ struct serv_parm *sp, uint32_t ulp_word4) - { - struct Scsi_Host *shost = lpfc_shost_from_vport(vport); - struct lpfc_hba *phba = vport->phba; -@@ -685,7 +654,7 @@ lpfc_cmpl_els_flogi_fabric(struct lpfc_v - spin_unlock_irq(shost->host_lock); - } - -- vport->fc_myDID = irsp->un.ulpWord[4] & Mask_DID; -+ vport->fc_myDID = ulp_word4 & Mask_DID; - memcpy(&ndlp->nlp_portname, &sp->portName, sizeof(struct lpfc_name)); - memcpy(&ndlp->nlp_nodename, &sp->nodeName, sizeof(struct lpfc_name)); - ndlp->nlp_class_sup = 0; -@@ -896,10 +865,12 @@ lpfc_cmpl_els_flogi_nport(struct lpfc_vp - if (rc) - vport->fc_myDID = PT2PT_LocalID; - -- /* Decrement ndlp reference count indicating that ndlp can be -- * safely released when other references to it are done. -+ /* If not registered with a transport, decrement ndlp reference -+ * count indicating that ndlp can be safely released when other -+ * references are removed. - */ -- lpfc_nlp_put(ndlp); -+ if (!(ndlp->fc4_xpt_flags & (SCSI_XPT_REGD | NVME_XPT_REGD))) -+ lpfc_nlp_put(ndlp); - - ndlp = lpfc_findnode_did(vport, PT2PT_RemoteID); - if (!ndlp) { -@@ -936,11 +907,12 @@ lpfc_cmpl_els_flogi_nport(struct lpfc_vp - goto fail; - } - } else { -- /* This side will wait for the PLOGI, decrement ndlp reference -- * count indicating that ndlp can be released when other -- * references to it are done. -+ /* This side will wait for the PLOGI. If not registered with -+ * a transport, decrement node reference count indicating that -+ * ndlp can be released when other references are removed. - */ -- lpfc_nlp_put(ndlp); -+ if (!(ndlp->fc4_xpt_flags & (SCSI_XPT_REGD | NVME_XPT_REGD))) -+ lpfc_nlp_put(ndlp); - - /* Start discovery - this should just do CLEAR_LA */ - lpfc_disc_start(vport); -@@ -980,28 +952,40 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phb - { - struct lpfc_vport *vport = cmdiocb->vport; - struct Scsi_Host *shost = lpfc_shost_from_vport(vport); -- IOCB_t *irsp = &rspiocb->iocb; - struct lpfc_nodelist *ndlp = cmdiocb->context1; -+ IOCB_t *irsp; - struct lpfc_dmabuf *pcmd = cmdiocb->context2, *prsp; - struct serv_parm *sp; - uint16_t fcf_index; - int rc; -+ u32 ulp_status, ulp_word4, tmo; - - /* Check to see if link went down during discovery */ - if (lpfc_els_chk_latt(vport)) { - /* One additional decrement on node reference count to - * trigger the release of the node - */ -- lpfc_nlp_put(ndlp); -+ if (!(ndlp->fc4_xpt_flags & SCSI_XPT_REGD)) -+ lpfc_nlp_put(ndlp); - goto out; - } - -+ ulp_status = get_job_ulpstatus(phba, rspiocb); -+ ulp_word4 = get_job_word4(phba, rspiocb); -+ -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ tmo = get_wqe_tmo(cmdiocb); -+ } else { -+ irsp = &rspiocb->iocb; -+ tmo = irsp->ulpTimeout; -+ } -+ - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, - "FLOGI cmpl: status:x%x/x%x state:x%x", -- irsp->ulpStatus, irsp->un.ulpWord[4], -+ ulp_status, ulp_word4, - vport->port_state); - -- if (irsp->ulpStatus) { -+ if (ulp_status) { - /* - * In case of FIP mode, perform roundrobin FCF failover - * due to new FCF discovery -@@ -1012,8 +996,8 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phb - goto stop_rr_fcf_flogi; - if ((phba->fcoe_cvl_eventtag_attn == - phba->fcoe_cvl_eventtag) && -- (irsp->ulpStatus == IOSTAT_LOCAL_REJECT) && -- ((irsp->un.ulpWord[4] & IOERR_PARAM_MASK) == -+ (ulp_status == IOSTAT_LOCAL_REJECT) && -+ ((ulp_word4 & IOERR_PARAM_MASK) == - IOERR_SLI_ABORTED)) - goto stop_rr_fcf_flogi; - else -@@ -1024,8 +1008,7 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phb - "status:x%x/x%x, tmo:x%x, perform " - "roundrobin FCF failover\n", - phba->fcf.current_rec.fcf_indx, -- irsp->ulpStatus, irsp->un.ulpWord[4], -- irsp->ulpTimeout); -+ ulp_status, ulp_word4, tmo); - lpfc_sli4_set_fcf_flogi_fail(phba, - phba->fcf.current_rec.fcf_indx); - fcf_index = lpfc_sli4_fcf_rr_next_index_get(phba); -@@ -1036,15 +1019,14 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phb - - stop_rr_fcf_flogi: - /* FLOGI failure */ -- if (!(irsp->ulpStatus == IOSTAT_LOCAL_REJECT && -- ((irsp->un.ulpWord[4] & IOERR_PARAM_MASK) == -+ if (!(ulp_status == IOSTAT_LOCAL_REJECT && -+ ((ulp_word4 & IOERR_PARAM_MASK) == - IOERR_LOOP_OPEN_FAILURE))) - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, - "2858 FLOGI failure Status:x%x/x%x TMO" - ":x%x Data x%x x%x\n", -- irsp->ulpStatus, irsp->un.ulpWord[4], -- irsp->ulpTimeout, phba->hba_flag, -- phba->fcf.fcf_flag); -+ ulp_status, ulp_word4, tmo, -+ phba->hba_flag, phba->fcf.fcf_flag); - - /* Check for retry */ - if (lpfc_els_retry(phba, cmdiocb, rspiocb)) -@@ -1053,15 +1035,20 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phb - lpfc_printf_vlog(vport, KERN_WARNING, LOG_TRACE_EVENT, - "0150 FLOGI failure Status:x%x/x%x " - "xri x%x TMO:x%x refcnt %d\n", -- irsp->ulpStatus, irsp->un.ulpWord[4], -- cmdiocb->sli4_xritag, irsp->ulpTimeout, -- kref_read(&ndlp->kref)); -+ ulp_status, ulp_word4, cmdiocb->sli4_xritag, -+ tmo, kref_read(&ndlp->kref)); - - /* If this is not a loop open failure, bail out */ -- if (!(irsp->ulpStatus == IOSTAT_LOCAL_REJECT && -- ((irsp->un.ulpWord[4] & IOERR_PARAM_MASK) == -- IOERR_LOOP_OPEN_FAILURE))) -+ if (!(ulp_status == IOSTAT_LOCAL_REJECT && -+ ((ulp_word4 & IOERR_PARAM_MASK) == -+ IOERR_LOOP_OPEN_FAILURE))) { -+ /* FLOGI failure */ -+ lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, -+ "0100 FLOGI failure Status:x%x/x%x " -+ "TMO:x%x\n", -+ ulp_status, ulp_word4, tmo); - goto flogifail; -+ } - - /* FLOGI failed, so there is no fabric */ - spin_lock_irq(shost->host_lock); -@@ -1092,7 +1079,7 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phb - } - - /* Do not register VFI if the driver aborted FLOGI */ -- if (!lpfc_error_lost_link(irsp)) -+ if (!lpfc_error_lost_link(ulp_status, ulp_word4)) - lpfc_issue_reg_vfi(vport); - - lpfc_nlp_put(ndlp); -@@ -1116,10 +1103,10 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phb - - /* FLOGI completes successfully */ - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, -- "0101 FLOGI completes successfully, I/O tag:x%x, " -+ "0101 FLOGI completes successfully, I/O tag:x%x " - "xri x%x Data: x%x x%x x%x x%x x%x %x %d\n", - cmdiocb->iotag, cmdiocb->sli4_xritag, -- irsp->un.ulpWord[4], sp->cmn.e_d_tov, -+ ulp_word4, sp->cmn.e_d_tov, - sp->cmn.w2.r_a_tov, sp->cmn.edtovResolution, - vport->port_state, vport->fc_flag, - kref_read(&ndlp->kref)); -@@ -1130,7 +1117,8 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phb - * we are point to point, if Fport we are Fabric. - */ - if (sp->cmn.fPort) -- rc = lpfc_cmpl_els_flogi_fabric(vport, ndlp, sp, irsp); -+ rc = lpfc_cmpl_els_flogi_fabric(vport, ndlp, sp, -+ ulp_word4); - else if (!(phba->hba_flag & HBA_FCOE_MODE)) - rc = lpfc_cmpl_els_flogi_nport(vport, ndlp, sp); - else { -@@ -1197,16 +1185,16 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phb - phba->fcf.fcf_flag &= ~FCF_DISCOVERY; - spin_unlock_irq(&phba->hbalock); - -- if (!lpfc_error_lost_link(irsp)) { -+ if (!lpfc_error_lost_link(ulp_status, ulp_word4)) { - /* FLOGI failed, so just use loop map to make discovery list */ - lpfc_disc_list_loopmap(vport); - - /* Start discovery */ - lpfc_disc_start(vport); -- } else if (((irsp->ulpStatus != IOSTAT_LOCAL_REJECT) || -- (((irsp->un.ulpWord[4] & IOERR_PARAM_MASK) != -+ } else if (((ulp_status != IOSTAT_LOCAL_REJECT) || -+ (((ulp_word4 & IOERR_PARAM_MASK) != - IOERR_SLI_ABORTED) && -- ((irsp->un.ulpWord[4] & IOERR_PARAM_MASK) != -+ ((ulp_word4 & IOERR_PARAM_MASK) != - IOERR_SLI_DOWN))) && - (phba->link_state != LPFC_CLEAR_LA)) { - /* If FLOGI failed enable link interrupt. */ -@@ -1278,10 +1266,11 @@ lpfc_issue_els_flogi(struct lpfc_vport * - { - struct lpfc_hba *phba = vport->phba; - struct serv_parm *sp; -- IOCB_t *icmd; -+ union lpfc_wqe128 *wqe = NULL; -+ IOCB_t *icmd = NULL; - struct lpfc_iocbq *elsiocb; - struct lpfc_iocbq defer_flogi_acc; -- uint8_t *pcmd; -+ u8 *pcmd, ct; - uint16_t cmdsize; - uint32_t tmo, did; - int rc; -@@ -1293,8 +1282,9 @@ lpfc_issue_els_flogi(struct lpfc_vport * - if (!elsiocb) - return 1; - -- icmd = &elsiocb->iocb; -+ wqe = &elsiocb->wqe; - pcmd = (uint8_t *) (((struct lpfc_dmabuf *) elsiocb->context2)->virt); -+ icmd = &elsiocb->iocb; - - /* For FLOGI request, remainder of payload is service parameters */ - *((uint32_t *) (pcmd)) = ELS_CMD_FLOGI; -@@ -1315,12 +1305,15 @@ lpfc_issue_els_flogi(struct lpfc_vport * - if (phba->sli_rev == LPFC_SLI_REV4) { - if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) == - LPFC_SLI_INTF_IF_TYPE_0) { -- elsiocb->iocb.ulpCt_h = ((SLI4_CT_FCFI >> 1) & 1); -- elsiocb->iocb.ulpCt_l = (SLI4_CT_FCFI & 1); - /* FLOGI needs to be 3 for WQE FCFI */ -+ ct = ((SLI4_CT_FCFI >> 1) & 1) | (SLI4_CT_FCFI & 1); -+ bf_set(wqe_ct, &wqe->els_req.wqe_com, ct); -+ - /* Set the fcfi to the fcfi we registered with */ -- elsiocb->iocb.ulpContext = phba->fcf.fcfi; -+ bf_set(wqe_ctxt_tag, &wqe->els_req.wqe_com, -+ phba->fcf.fcfi); - } -+ - /* Can't do SLI4 class2 without support sequence coalescing */ - sp->cls2.classValid = 0; - sp->cls2.seqDelivery = 0; -@@ -1333,13 +1326,14 @@ lpfc_issue_els_flogi(struct lpfc_vport * - /* For FLOGI, Let FLOGI rsp set the NPortID for VPI 0 */ - icmd->ulpCt_h = 1; - icmd->ulpCt_l = 0; -- } else -+ } else { - sp->cmn.request_multiple_Nport = 0; -- } -+ } - -- if (phba->fc_topology != LPFC_TOPOLOGY_LOOP) { -- icmd->un.elsreq64.myID = 0; -- icmd->un.elsreq64.fl = 1; -+ if (phba->fc_topology != LPFC_TOPOLOGY_LOOP) { -+ icmd->un.elsreq64.myID = 0; -+ icmd->un.elsreq64.fl = 1; -+ } - } - - tmo = phba->fc_ratov; -@@ -1371,14 +1365,29 @@ lpfc_issue_els_flogi(struct lpfc_vport * - - /* Check for a deferred FLOGI ACC condition */ - if (phba->defer_flogi_acc_flag) { -+ /* lookup ndlp for received FLOGI */ -+ ndlp = lpfc_findnode_did(vport, 0); -+ if (!ndlp) -+ return 0; -+ - did = vport->fc_myDID; - vport->fc_myDID = Fabric_DID; - - memset(&defer_flogi_acc, 0, sizeof(struct lpfc_iocbq)); - -- defer_flogi_acc.iocb.ulpContext = phba->defer_flogi_acc_rx_id; -- defer_flogi_acc.iocb.unsli3.rcvsli3.ox_id = -- phba->defer_flogi_acc_ox_id; -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ bf_set(wqe_ctxt_tag, -+ &defer_flogi_acc.wqe.xmit_els_rsp.wqe_com, -+ phba->defer_flogi_acc_rx_id); -+ bf_set(wqe_rcvoxid, -+ &defer_flogi_acc.wqe.xmit_els_rsp.wqe_com, -+ phba->defer_flogi_acc_ox_id); -+ } else { -+ icmd = &defer_flogi_acc.iocb; -+ icmd->ulpContext = phba->defer_flogi_acc_rx_id; -+ icmd->unsli3.rcvsli3.ox_id = -+ phba->defer_flogi_acc_ox_id; -+ } - - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "3354 Xmit deferred FLOGI ACC: rx_id: x%x," -@@ -1391,8 +1400,12 @@ lpfc_issue_els_flogi(struct lpfc_vport * - ndlp, NULL); - - phba->defer_flogi_acc_flag = false; -- - vport->fc_myDID = did; -+ -+ /* Decrement ndlp reference count to indicate the node can be -+ * released when other references are removed. -+ */ -+ lpfc_nlp_put(ndlp); - } - - return 0; -@@ -1418,7 +1431,7 @@ lpfc_els_abort_flogi(struct lpfc_hba *ph - struct lpfc_sli_ring *pring; - struct lpfc_iocbq *iocb, *next_iocb; - struct lpfc_nodelist *ndlp; -- IOCB_t *icmd; -+ u32 ulp_command; - - /* Abort outstanding I/O on NPort */ - lpfc_printf_log(phba, KERN_INFO, LOG_DISCOVERY, -@@ -1435,8 +1448,8 @@ lpfc_els_abort_flogi(struct lpfc_hba *ph - */ - spin_lock_irq(&phba->hbalock); - list_for_each_entry_safe(iocb, next_iocb, &pring->txcmplq, list) { -- icmd = &iocb->iocb; -- if (icmd->ulpCommand == CMD_ELS_REQUEST64_CR) { -+ ulp_command = get_job_cmnd(phba, iocb); -+ if (ulp_command == CMD_ELS_REQUEST64_CR) { - ndlp = (struct lpfc_nodelist *)(iocb->context1); - if (ndlp && ndlp->nlp_DID == Fabric_DID) { - if ((phba->pport->fc_flag & FC_PT2PT) && -@@ -2011,7 +2024,7 @@ lpfc_cmpl_els_plogi(struct lpfc_hba *phb - irsp->un.ulpWord[4]); - - /* Do not call DSM for lpfc_els_abort'ed ELS cmds */ -- if (!lpfc_error_lost_link(irsp)) -+ if (!lpfc_error_lost_link(irsp->ulpStatus, irsp->un.ulpWord[4])) - lpfc_disc_state_machine(vport, ndlp, cmdiocb, - NLP_EVT_CMPL_PLOGI); - -@@ -2278,7 +2291,7 @@ lpfc_cmpl_els_prli(struct lpfc_hba *phba - irsp->un.ulpWord[4], ndlp->fc4_prli_sent); - - /* Do not call DSM for lpfc_els_abort'ed ELS cmds */ -- if (!lpfc_error_lost_link(irsp)) -+ if (!lpfc_error_lost_link(irsp->ulpStatus, irsp->un.ulpWord[4])) - lpfc_disc_state_machine(vport, ndlp, cmdiocb, - NLP_EVT_CMPL_PRLI); - -@@ -2895,7 +2908,7 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba - ndlp->nlp_DID, irsp->ulpStatus, - irsp->un.ulpWord[4]); - /* Do not call DSM for lpfc_els_abort'ed ELS cmds */ -- if (lpfc_error_lost_link(irsp)) { -+ if (lpfc_error_lost_link(irsp->ulpStatus, irsp->un.ulpWord[4])) { - skip_recovery = 1; - goto out; - } -@@ -4415,7 +4428,7 @@ lpfc_els_retry(struct lpfc_hba *phba, st - struct lpfc_iocbq *rspiocb) - { - struct lpfc_vport *vport = cmdiocb->vport; -- IOCB_t *irsp = &rspiocb->iocb; -+ union lpfc_wqe128 *irsp = &rspiocb->wqe; - struct lpfc_nodelist *ndlp = (struct lpfc_nodelist *) cmdiocb->context1; - struct lpfc_dmabuf *pcmd = (struct lpfc_dmabuf *) cmdiocb->context2; - uint32_t *elscmd; -@@ -4425,6 +4438,8 @@ lpfc_els_retry(struct lpfc_hba *phba, st - uint32_t cmd = 0; - uint32_t did; - int link_reset = 0, rc; -+ u32 ulp_status = get_job_ulpstatus(phba, rspiocb); -+ u32 ulp_word4 = get_job_word4(phba, rspiocb); - - - /* Note: context2 may be 0 for internal driver abort -@@ -4440,7 +4455,7 @@ lpfc_els_retry(struct lpfc_hba *phba, st - did = ndlp->nlp_DID; - else { - /* We should only hit this case for retrying PLOGI */ -- did = irsp->un.elsreq64.remoteID; -+ did = get_job_els_rsp64_did(phba, rspiocb); - ndlp = lpfc_findnode_did(vport, did); - if (!ndlp && (cmd != ELS_CMD_PLOGI)) - return 0; -@@ -4448,9 +4463,9 @@ lpfc_els_retry(struct lpfc_hba *phba, st - - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, - "Retry ELS: wd7:x%x wd4:x%x did:x%x", -- *(((uint32_t *)irsp) + 7), irsp->un.ulpWord[4], did); -+ *(((uint32_t *)irsp) + 7), ulp_word4, did); - -- switch (irsp->ulpStatus) { -+ switch (ulp_status) { - case IOSTAT_FCP_RSP_ERROR: - break; - case IOSTAT_REMOTE_STOP: -@@ -4464,7 +4479,7 @@ lpfc_els_retry(struct lpfc_hba *phba, st - } - break; - case IOSTAT_LOCAL_REJECT: -- switch ((irsp->un.ulpWord[4] & IOERR_PARAM_MASK)) { -+ switch ((ulp_word4 & IOERR_PARAM_MASK)) { - case IOERR_LOOP_OPEN_FAILURE: - if (cmd == ELS_CMD_FLOGI) { - if (PCI_DEVICE_ID_HORNET == -@@ -4545,7 +4560,7 @@ lpfc_els_retry(struct lpfc_hba *phba, st - - case IOSTAT_NPORT_RJT: - case IOSTAT_FABRIC_RJT: -- if (irsp->un.ulpWord[4] & RJT_UNAVAIL_TEMP) { -+ if (ulp_word4 & RJT_UNAVAIL_TEMP) { - retry = 1; - break; - } -@@ -4558,7 +4573,7 @@ lpfc_els_retry(struct lpfc_hba *phba, st - break; - - case IOSTAT_LS_RJT: -- stat.un.lsRjtError = be32_to_cpu(irsp->un.ulpWord[4]); -+ stat.un.ls_rjt_error_be = cpu_to_be32(ulp_word4); - /* Added for Vendor specifc support - * Just keep retrying for these Rsn / Exp codes - */ -@@ -4701,12 +4716,14 @@ lpfc_els_retry(struct lpfc_hba *phba, st - * on this rport. - */ - if (stat.un.b.lsRjtRsnCodeExp == -- LSEXP_REQ_UNSUPPORTED && cmd == ELS_CMD_PRLI) { -- spin_lock_irq(&ndlp->lock); -- ndlp->nlp_flag |= NLP_FCP_PRLI_RJT; -- spin_unlock_irq(&ndlp->lock); -- retry = 0; -- goto out_retry; -+ LSEXP_REQ_UNSUPPORTED) { -+ if (cmd == ELS_CMD_PRLI) { -+ spin_lock_irq(&ndlp->lock); -+ ndlp->nlp_flag |= NLP_FCP_PRLI_RJT; -+ spin_unlock_irq(&ndlp->lock); -+ retry = 0; -+ goto out_retry; -+ } - } - break; - } -@@ -4738,7 +4755,7 @@ lpfc_els_retry(struct lpfc_hba *phba, st - - if ((cmd == ELS_CMD_FLOGI) && - (phba->fc_topology != LPFC_TOPOLOGY_LOOP) && -- !lpfc_error_lost_link(irsp)) { -+ !lpfc_error_lost_link(ulp_status, ulp_word4)) { - /* FLOGI retry policy */ - retry = 1; - /* retry FLOGI forever */ -@@ -4751,7 +4768,8 @@ lpfc_els_retry(struct lpfc_hba *phba, st - delay = 5000; - else if (cmdiocb->retry >= 32) - delay = 1000; -- } else if ((cmd == ELS_CMD_FDISC) && !lpfc_error_lost_link(irsp)) { -+ } else if ((cmd == ELS_CMD_FDISC) && -+ !lpfc_error_lost_link(ulp_status, ulp_word4)) { - /* retry FDISCs every second up to devloss */ - retry = 1; - maxretry = vport->cfg_devloss_tmo; -@@ -4788,8 +4806,8 @@ lpfc_els_retry(struct lpfc_hba *phba, st - cmd, did, cmdiocb->retry, delay); - - if (((cmd == ELS_CMD_PLOGI) || (cmd == ELS_CMD_ADISC)) && -- ((irsp->ulpStatus != IOSTAT_LOCAL_REJECT) || -- ((irsp->un.ulpWord[4] & IOERR_PARAM_MASK) != -+ ((ulp_status != IOSTAT_LOCAL_REJECT) || -+ ((ulp_word4 & IOERR_PARAM_MASK) != - IOERR_NO_RESOURCES))) { - /* Don't reset timer for no resources */ - -@@ -4861,15 +4879,15 @@ lpfc_els_retry(struct lpfc_hba *phba, st - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, - "0137 No retry ELS command x%x to remote " - "NPORT x%x: Out of Resources: Error:x%x/%x\n", -- cmd, did, irsp->ulpStatus, -- irsp->un.ulpWord[4]); -+ cmd, did, ulp_status, -+ ulp_word4); - } - else { - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "0108 No retry ELS command x%x to remote " - "NPORT x%x Retried:%d Error:x%x/%x\n", -- cmd, did, cmdiocb->retry, irsp->ulpStatus, -- irsp->un.ulpWord[4]); -+ cmd, did, cmdiocb->retry, ulp_status, -+ ulp_word4); - } - return 0; - } -@@ -7820,7 +7838,7 @@ lpfc_els_rcv_flogi(struct lpfc_vport *vp - struct lpfc_hba *phba = vport->phba; - struct lpfc_dmabuf *pcmd = (struct lpfc_dmabuf *) cmdiocb->context2; - uint32_t *lp = (uint32_t *) pcmd->virt; -- IOCB_t *icmd = &cmdiocb->iocb; -+ union lpfc_wqe128 *wqe = &cmdiocb->wqe; - struct serv_parm *sp; - LPFC_MBOXQ_t *mbox; - uint32_t cmd, did; -@@ -7837,7 +7855,7 @@ lpfc_els_rcv_flogi(struct lpfc_vport *vp - - if (phba->fc_topology == LPFC_TOPOLOGY_LOOP) { - /* We should never receive a FLOGI in loop mode, ignore it */ -- did = icmd->un.elsreq64.remoteID; -+ did = bf_get(wqe_els_did, &wqe->xmit_els_rsp.wqe_dest); - - /* An FLOGI ELS command was received from DID in - Loop Mode */ -@@ -7933,9 +7951,10 @@ lpfc_els_rcv_flogi(struct lpfc_vport *vp - - /* Defer ACC response until AFTER we issue a FLOGI */ - if (!(phba->hba_flag & HBA_FLOGI_ISSUED)) { -- phba->defer_flogi_acc_rx_id = cmdiocb->iocb.ulpContext; -- phba->defer_flogi_acc_ox_id = -- cmdiocb->iocb.unsli3.rcvsli3.ox_id; -+ phba->defer_flogi_acc_rx_id = bf_get(wqe_ctxt_tag, -+ &wqe->xmit_els_rsp.wqe_com); -+ phba->defer_flogi_acc_ox_id = bf_get(wqe_rcvoxid, -+ &wqe->xmit_els_rsp.wqe_com); - - vport->fc_myDID = did; - -@@ -9905,6 +9924,9 @@ lpfc_els_unsol_buffer(struct lpfc_hba *p - } - - lpfc_els_rcv_flogi(vport, elsiocb, ndlp); -+ /* retain node if our response is deferred */ -+ if (phba->defer_flogi_acc_flag) -+ break; - if (newnode) - lpfc_disc_state_machine(vport, ndlp, NULL, - NLP_EVT_DEVICE_RM); -@@ -10625,9 +10647,11 @@ lpfc_fabric_login_reqd(struct lpfc_hba * - struct lpfc_iocbq *cmdiocb, - struct lpfc_iocbq *rspiocb) - { -+ u32 ulp_status = get_job_ulpstatus(phba, rspiocb); -+ u32 ulp_word4 = get_job_word4(phba, rspiocb); - -- if ((rspiocb->iocb.ulpStatus != IOSTAT_FABRIC_RJT) || -- (rspiocb->iocb.un.ulpWord[4] != RJT_LOGIN_REQUIRED)) -+ if (ulp_status != IOSTAT_FABRIC_RJT || -+ ulp_word4 != RJT_LOGIN_REQUIRED) - return 0; - else - return 1; -@@ -10662,15 +10686,18 @@ lpfc_cmpl_els_fdisc(struct lpfc_hba *phb - struct lpfc_nodelist *ndlp = (struct lpfc_nodelist *) cmdiocb->context1; - struct lpfc_nodelist *np; - struct lpfc_nodelist *next_np; -- IOCB_t *irsp = &rspiocb->iocb; - struct lpfc_iocbq *piocb; - struct lpfc_dmabuf *pcmd = cmdiocb->context2, *prsp; - struct serv_parm *sp; - uint8_t fabric_param_changed; -+ u32 ulp_status, ulp_word4; -+ -+ ulp_status = get_job_ulpstatus(phba, rspiocb); -+ ulp_word4 = get_job_word4(phba, rspiocb); - - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "0123 FDISC completes. x%x/x%x prevDID: x%x\n", -- irsp->ulpStatus, irsp->un.ulpWord[4], -+ ulp_status, ulp_word4, - vport->fc_prevDID); - /* Since all FDISCs are being single threaded, we - * must reset the discovery timer for ALL vports -@@ -10682,9 +10709,9 @@ lpfc_cmpl_els_fdisc(struct lpfc_hba *phb - - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, - "FDISC cmpl: status:x%x/x%x prevdid:x%x", -- irsp->ulpStatus, irsp->un.ulpWord[4], vport->fc_prevDID); -+ ulp_status, ulp_word4, vport->fc_prevDID); - -- if (irsp->ulpStatus) { -+ if (ulp_status) { - - if (lpfc_fabric_login_reqd(phba, cmdiocb, rspiocb)) { - lpfc_retry_pport_discovery(phba); -@@ -10697,7 +10724,7 @@ lpfc_cmpl_els_fdisc(struct lpfc_hba *phb - /* FDISC failed */ - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, - "0126 FDISC failed. (x%x/x%x)\n", -- irsp->ulpStatus, irsp->un.ulpWord[4]); -+ ulp_status, ulp_word4); - goto fdisc_failed; - } - -@@ -10711,7 +10738,7 @@ lpfc_cmpl_els_fdisc(struct lpfc_hba *phb - vport->fc_flag |= FC_PUBLIC_LOOP; - spin_unlock_irq(shost->host_lock); - -- vport->fc_myDID = irsp->un.ulpWord[4] & Mask_DID; -+ vport->fc_myDID = ulp_word4 & Mask_DID; - lpfc_vport_set_state(vport, FC_VPORT_ACTIVE); - prsp = list_get_first(&pcmd->list, struct lpfc_dmabuf, list); - if (!prsp) -@@ -11072,7 +11099,6 @@ lpfc_resume_fabric_iocbs(struct lpfc_hba - struct lpfc_iocbq *iocb; - unsigned long iflags; - int ret; -- IOCB_t *cmd; - - repeat: - iocb = NULL; -@@ -11092,8 +11118,8 @@ lpfc_resume_fabric_iocbs(struct lpfc_hba - iocb->cmd_flag |= LPFC_IO_FABRIC; - - lpfc_debugfs_disc_trc(iocb->vport, LPFC_DISC_TRC_ELS_CMD, -- "Fabric sched1: ste:x%x", -- iocb->vport->port_state, 0, 0); -+ "Fabric sched1: ste:x%x", -+ iocb->vport->port_state, 0, 0); - - ret = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, iocb, 0); - -@@ -11101,9 +11127,8 @@ lpfc_resume_fabric_iocbs(struct lpfc_hba - iocb->cmd_cmpl = iocb->fabric_cmd_cmpl; - iocb->fabric_cmd_cmpl = NULL; - iocb->cmd_flag &= ~LPFC_IO_FABRIC; -- cmd = &iocb->iocb; -- cmd->ulpStatus = IOSTAT_LOCAL_REJECT; -- cmd->un.ulpWord[4] = IOERR_SLI_ABORTED; -+ set_job_ulpstatus(iocb, IOSTAT_LOCAL_REJECT); -+ iocb->wcqe_cmpl.parameter = IOERR_SLI_ABORTED; - iocb->cmd_cmpl(phba, iocb, iocb); - - atomic_dec(&phba->fabric_iocb_count); -@@ -11168,18 +11193,19 @@ lpfc_block_fabric_iocbs(struct lpfc_hba - **/ - static void - lpfc_cmpl_fabric_iocb(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, -- struct lpfc_iocbq *rspiocb) -+ struct lpfc_iocbq *rspiocb) - { - struct ls_rjt stat; -+ u32 ulp_status = get_job_ulpstatus(phba, rspiocb); -+ u32 ulp_word4 = get_job_word4(phba, rspiocb); - - WARN_ON((cmdiocb->cmd_flag & LPFC_IO_FABRIC) != LPFC_IO_FABRIC); - -- switch (rspiocb->iocb.ulpStatus) { -+ switch (ulp_status) { - case IOSTAT_NPORT_RJT: - case IOSTAT_FABRIC_RJT: -- if (rspiocb->iocb.un.ulpWord[4] & RJT_UNAVAIL_TEMP) { -+ if (ulp_word4 & RJT_UNAVAIL_TEMP) - lpfc_block_fabric_iocbs(phba); -- } - break; - - case IOSTAT_NPORT_BSY: -@@ -11188,8 +11214,8 @@ lpfc_cmpl_fabric_iocb(struct lpfc_hba *p - break; - - case IOSTAT_LS_RJT: -- stat.un.lsRjtError = -- be32_to_cpu(rspiocb->iocb.un.ulpWord[4]); -+ stat.un.ls_rjt_error_be = -+ cpu_to_be32(ulp_word4); - if ((stat.un.b.lsRjtRsnCode == LSRJT_UNABLE_TPC) || - (stat.un.b.lsRjtRsnCode == LSRJT_LOGICAL_BSY)) - lpfc_block_fabric_iocbs(phba); -@@ -11257,8 +11283,8 @@ lpfc_issue_fabric_iocb(struct lpfc_hba * - iocb->cmd_flag |= LPFC_IO_FABRIC; - - lpfc_debugfs_disc_trc(iocb->vport, LPFC_DISC_TRC_ELS_CMD, -- "Fabric sched2: ste:x%x", -- iocb->vport->port_state, 0, 0); -+ "Fabric sched2: ste:x%x", -+ iocb->vport->port_state, 0, 0); - - ret = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, iocb, 0); - ---- a/drivers/scsi/lpfc/lpfc_hw.h -+++ b/drivers/scsi/lpfc/lpfc_hw.h -@@ -659,6 +659,7 @@ struct fc_vft_header { - - struct ls_rjt { /* Structure is in Big Endian format */ - union { -+ __be32 ls_rjt_error_be; - uint32_t lsRjtError; - struct { - uint8_t lsRjtRsvd0; /* FC Word 0, bit 24:31 */ -@@ -4253,16 +4254,15 @@ lpfc_is_LC_HBA(unsigned short device) - } - - /* -- * Determine if an IOCB failed because of a link event or firmware reset. -+ * Determine if failed because of a link event or firmware reset. - */ -- - static inline int --lpfc_error_lost_link(IOCB_t *iocbp) -+lpfc_error_lost_link(u32 ulp_status, u32 ulp_word4) - { -- return (iocbp->ulpStatus == IOSTAT_LOCAL_REJECT && -- (iocbp->un.ulpWord[4] == IOERR_SLI_ABORTED || -- iocbp->un.ulpWord[4] == IOERR_LINK_DOWN || -- iocbp->un.ulpWord[4] == IOERR_SLI_DOWN)); -+ return (ulp_status == IOSTAT_LOCAL_REJECT && -+ (ulp_word4 == IOERR_SLI_ABORTED || -+ ulp_word4 == IOERR_LINK_DOWN || -+ ulp_word4 == IOERR_SLI_DOWN)); - } - - #define MENLO_TRANSPORT_TYPE 0xfe ---- a/drivers/scsi/lpfc/lpfc_hw4.h -+++ b/drivers/scsi/lpfc/lpfc_hw4.h -@@ -61,6 +61,7 @@ - ((ptr)->name##_WORD & ~(name##_MASK << name##_SHIFT)))) - - #define get_wqe_reqtag(x) (((x)->wqe.words[9] >> 0) & 0xFFFF) -+#define get_wqe_tmo(x) (((x)->wqe.words[7] >> 24) & 0x00FF) - - #define get_job_ulpword(x, y) ((x)->iocb.un.ulpWord[y]) - -@@ -237,6 +238,34 @@ struct lpfc_sli_intf { - /* PORT_CAPABILITIES constants. */ - #define LPFC_MAX_SUPPORTED_PAGES 8 - -+enum ulp_bde64_word3 { -+ ULP_BDE64_SIZE_MASK = 0xffffff, -+ -+ ULP_BDE64_TYPE_SHIFT = 24, -+ ULP_BDE64_TYPE_MASK = (0xff << ULP_BDE64_TYPE_SHIFT), -+ -+ /* BDE (Host_resident) */ -+ ULP_BDE64_TYPE_BDE_64 = (0x00 << ULP_BDE64_TYPE_SHIFT), -+ /* Immediate Data BDE */ -+ ULP_BDE64_TYPE_BDE_IMMED = (0x01 << ULP_BDE64_TYPE_SHIFT), -+ /* BDE (Port-resident) */ -+ ULP_BDE64_TYPE_BDE_64P = (0x02 << ULP_BDE64_TYPE_SHIFT), -+ /* Input BDE (Host-resident) */ -+ ULP_BDE64_TYPE_BDE_64I = (0x08 << ULP_BDE64_TYPE_SHIFT), -+ /* Input BDE (Port-resident) */ -+ ULP_BDE64_TYPE_BDE_64IP = (0x0A << ULP_BDE64_TYPE_SHIFT), -+ /* BLP (Host-resident) */ -+ ULP_BDE64_TYPE_BLP_64 = (0x40 << ULP_BDE64_TYPE_SHIFT), -+ /* BLP (Port-resident) */ -+ ULP_BDE64_TYPE_BLP_64P = (0x42 << ULP_BDE64_TYPE_SHIFT), -+}; -+ -+struct ulp_bde64_le { -+ __le32 type_size; /* type 31:24, size 23:0 */ -+ __le32 addr_low; -+ __le32 addr_high; -+}; -+ - struct ulp_bde64 { - union ULP_BDE_TUS { - uint32_t w; ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -10997,6 +10997,130 @@ int - return phba->__lpfc_sli_issue_iocb(phba, ring_number, piocb, flag); - } - -+static void -+__lpfc_sli_prep_els_req_rsp_s3(struct lpfc_iocbq *cmdiocbq, -+ struct lpfc_vport *vport, -+ struct lpfc_dmabuf *bmp, u16 cmd_size, u32 did, -+ u32 elscmd, u8 tmo, u8 expect_rsp) -+{ -+ struct lpfc_hba *phba = vport->phba; -+ IOCB_t *cmd; -+ -+ cmd = &cmdiocbq->iocb; -+ memset(cmd, 0, sizeof(*cmd)); -+ -+ cmd->un.elsreq64.bdl.addrHigh = putPaddrHigh(bmp->phys); -+ cmd->un.elsreq64.bdl.addrLow = putPaddrLow(bmp->phys); -+ cmd->un.elsreq64.bdl.bdeFlags = BUFF_TYPE_BLP_64; -+ -+ if (expect_rsp) { -+ cmd->un.elsreq64.bdl.bdeSize = (2 * sizeof(struct ulp_bde64)); -+ cmd->un.elsreq64.remoteID = did; /* DID */ -+ cmd->ulpCommand = CMD_ELS_REQUEST64_CR; -+ cmd->ulpTimeout = tmo; -+ } else { -+ cmd->un.elsreq64.bdl.bdeSize = sizeof(struct ulp_bde64); -+ cmd->un.genreq64.xmit_els_remoteID = did; /* DID */ -+ cmd->ulpCommand = CMD_XMIT_ELS_RSP64_CX; -+ } -+ cmd->ulpBdeCount = 1; -+ cmd->ulpLe = 1; -+ cmd->ulpClass = CLASS3; -+ -+ /* If we have NPIV enabled, we want to send ELS traffic by VPI. */ -+ if (phba->sli3_options & LPFC_SLI3_NPIV_ENABLED) { -+ if (expect_rsp) { -+ cmd->un.elsreq64.myID = vport->fc_myDID; -+ -+ /* For ELS_REQUEST64_CR, use the VPI by default */ -+ cmd->ulpContext = phba->vpi_ids[vport->vpi]; -+ } -+ -+ cmd->ulpCt_h = 0; -+ /* The CT field must be 0=INVALID_RPI for the ECHO cmd */ -+ if (elscmd == ELS_CMD_ECHO) -+ cmd->ulpCt_l = 0; /* context = invalid RPI */ -+ else -+ cmd->ulpCt_l = 1; /* context = VPI */ -+ } -+} -+ -+static void -+__lpfc_sli_prep_els_req_rsp_s4(struct lpfc_iocbq *cmdiocbq, -+ struct lpfc_vport *vport, -+ struct lpfc_dmabuf *bmp, u16 cmd_size, u32 did, -+ u32 elscmd, u8 tmo, u8 expect_rsp) -+{ -+ struct lpfc_hba *phba = vport->phba; -+ union lpfc_wqe128 *wqe; -+ struct ulp_bde64_le *bde; -+ -+ wqe = &cmdiocbq->wqe; -+ memset(wqe, 0, sizeof(*wqe)); -+ -+ /* Word 0 - 2 BDE */ -+ bde = (struct ulp_bde64_le *)&wqe->generic.bde; -+ bde->addr_low = cpu_to_le32(putPaddrLow(bmp->phys)); -+ bde->addr_high = cpu_to_le32(putPaddrHigh(bmp->phys)); -+ bde->type_size = cpu_to_le32(cmd_size); -+ bde->type_size |= cpu_to_le32(ULP_BDE64_TYPE_BDE_64); -+ -+ if (expect_rsp) { -+ bf_set(wqe_cmnd, &wqe->els_req.wqe_com, CMD_ELS_REQUEST64_CR); -+ -+ /* Transfer length */ -+ wqe->els_req.payload_len = cmd_size; -+ wqe->els_req.max_response_payload_len = FCELSSIZE; -+ -+ /* DID */ -+ bf_set(wqe_els_did, &wqe->els_req.wqe_dest, did); -+ } else { -+ /* DID */ -+ bf_set(wqe_els_did, &wqe->xmit_els_rsp.wqe_dest, did); -+ -+ /* Transfer length */ -+ wqe->xmit_els_rsp.response_payload_len = cmd_size; -+ -+ bf_set(wqe_cmnd, &wqe->xmit_els_rsp.wqe_com, -+ CMD_XMIT_ELS_RSP64_CX); -+ } -+ -+ bf_set(wqe_tmo, &wqe->generic.wqe_com, tmo); -+ bf_set(wqe_reqtag, &wqe->generic.wqe_com, cmdiocbq->iotag); -+ bf_set(wqe_class, &wqe->generic.wqe_com, CLASS3); -+ -+ /* If we have NPIV enabled, we want to send ELS traffic by VPI. -+ * For SLI4, since the driver controls VPIs we also want to include -+ * all ELS pt2pt protocol traffic as well. -+ */ -+ if ((phba->sli3_options & LPFC_SLI3_NPIV_ENABLED) || -+ (vport->fc_flag & FC_PT2PT)) { -+ if (expect_rsp) { -+ bf_set(els_req64_sid, &wqe->els_req, vport->fc_myDID); -+ -+ /* For ELS_REQUEST64_CR, use the VPI by default */ -+ bf_set(wqe_ctxt_tag, &wqe->els_req.wqe_com, -+ phba->vpi_ids[vport->vpi]); -+ } -+ -+ /* The CT field must be 0=INVALID_RPI for the ECHO cmd */ -+ if (elscmd == ELS_CMD_ECHO) -+ bf_set(wqe_ct, &wqe->generic.wqe_com, 0); -+ else -+ bf_set(wqe_ct, &wqe->generic.wqe_com, 1); -+ } -+} -+ -+void -+lpfc_sli_prep_els_req_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocbq, -+ struct lpfc_vport *vport, struct lpfc_dmabuf *bmp, -+ u16 cmd_size, u32 did, u32 elscmd, u8 tmo, -+ u8 expect_rsp) -+{ -+ phba->__lpfc_sli_prep_els_req_rsp(cmdiocbq, vport, bmp, cmd_size, did, -+ elscmd, tmo, expect_rsp); -+} -+ - /** - * lpfc_sli_api_table_setup - Set up sli api function jump table - * @phba: The hba struct for which this call is being executed. -@@ -11015,11 +11139,13 @@ lpfc_sli_api_table_setup(struct lpfc_hba - phba->__lpfc_sli_issue_iocb = __lpfc_sli_issue_iocb_s3; - phba->__lpfc_sli_release_iocbq = __lpfc_sli_release_iocbq_s3; - phba->__lpfc_sli_issue_fcp_io = __lpfc_sli_issue_fcp_io_s3; -+ phba->__lpfc_sli_prep_els_req_rsp = __lpfc_sli_prep_els_req_rsp_s3; - break; - case LPFC_PCI_DEV_OC: - phba->__lpfc_sli_issue_iocb = __lpfc_sli_issue_iocb_s4; - phba->__lpfc_sli_release_iocbq = __lpfc_sli_release_iocbq_s4; - phba->__lpfc_sli_issue_fcp_io = __lpfc_sli_issue_fcp_io_s4; -+ phba->__lpfc_sli_prep_els_req_rsp = __lpfc_sli_prep_els_req_rsp_s4; - break; - default: - lpfc_printf_log(phba, KERN_ERR, LOG_INIT, -@@ -19053,7 +19179,7 @@ lpfc_sli4_handle_mds_loopback(struct lpf - struct fc_frame_header *fc_hdr; - struct lpfc_hba *phba = vport->phba; - struct lpfc_iocbq *iocbq = NULL; -- union lpfc_wqe *wqe; -+ union lpfc_wqe128 *pwqe; - struct lpfc_dmabuf *pcmd = NULL; - uint32_t frame_len; - int rc; -@@ -19088,34 +19214,46 @@ lpfc_sli4_handle_mds_loopback(struct lpf - /* copyin the payload */ - memcpy(pcmd->virt, dmabuf->dbuf.virt, frame_len); - -- /* fill in BDE's for command */ -- iocbq->iocb.un.xseq64.bdl.addrHigh = putPaddrHigh(pcmd->phys); -- iocbq->iocb.un.xseq64.bdl.addrLow = putPaddrLow(pcmd->phys); -- iocbq->iocb.un.xseq64.bdl.bdeFlags = BUFF_TYPE_BDE_64; -- iocbq->iocb.un.xseq64.bdl.bdeSize = frame_len; -- - iocbq->context2 = pcmd; - iocbq->vport = vport; - iocbq->cmd_flag &= ~LPFC_FIP_ELS_ID_MASK; - iocbq->cmd_flag |= LPFC_USE_FCPWQIDX; -+ iocbq->num_bdes = 0; - -- /* -- * Setup rest of the iocb as though it were a WQE -- * Build the SEND_FRAME WQE -- */ -- wqe = (union lpfc_wqe *)&iocbq->iocb; -- -- wqe->send_frame.frame_len = frame_len; -- wqe->send_frame.fc_hdr_wd0 = be32_to_cpu(*((uint32_t *)fc_hdr)); -- wqe->send_frame.fc_hdr_wd1 = be32_to_cpu(*((uint32_t *)fc_hdr + 1)); -- wqe->send_frame.fc_hdr_wd2 = be32_to_cpu(*((uint32_t *)fc_hdr + 2)); -- wqe->send_frame.fc_hdr_wd3 = be32_to_cpu(*((uint32_t *)fc_hdr + 3)); -- wqe->send_frame.fc_hdr_wd4 = be32_to_cpu(*((uint32_t *)fc_hdr + 4)); -- wqe->send_frame.fc_hdr_wd5 = be32_to_cpu(*((uint32_t *)fc_hdr + 5)); -+ pwqe = &iocbq->wqe; -+ /* fill in BDE's for command */ -+ pwqe->gen_req.bde.addrHigh = putPaddrHigh(pcmd->phys); -+ pwqe->gen_req.bde.addrLow = putPaddrLow(pcmd->phys); -+ pwqe->gen_req.bde.tus.f.bdeSize = frame_len; -+ pwqe->gen_req.bde.tus.f.bdeFlags = BUFF_TYPE_BDE_64; -+ -+ pwqe->send_frame.frame_len = frame_len; -+ pwqe->send_frame.fc_hdr_wd0 = be32_to_cpu(*((__be32 *)fc_hdr)); -+ pwqe->send_frame.fc_hdr_wd1 = be32_to_cpu(*((__be32 *)fc_hdr + 1)); -+ pwqe->send_frame.fc_hdr_wd2 = be32_to_cpu(*((__be32 *)fc_hdr + 2)); -+ pwqe->send_frame.fc_hdr_wd3 = be32_to_cpu(*((__be32 *)fc_hdr + 3)); -+ pwqe->send_frame.fc_hdr_wd4 = be32_to_cpu(*((__be32 *)fc_hdr + 4)); -+ pwqe->send_frame.fc_hdr_wd5 = be32_to_cpu(*((__be32 *)fc_hdr + 5)); -+ -+ pwqe->generic.wqe_com.word7 = 0; -+ pwqe->generic.wqe_com.word10 = 0; -+ -+ bf_set(wqe_cmnd, &pwqe->generic.wqe_com, CMD_SEND_FRAME); -+ bf_set(wqe_sof, &pwqe->generic.wqe_com, 0x2E); /* SOF byte */ -+ bf_set(wqe_eof, &pwqe->generic.wqe_com, 0x41); /* EOF byte */ -+ bf_set(wqe_lenloc, &pwqe->generic.wqe_com, 1); -+ bf_set(wqe_xbl, &pwqe->generic.wqe_com, 1); -+ bf_set(wqe_dbde, &pwqe->generic.wqe_com, 1); -+ bf_set(wqe_xc, &pwqe->generic.wqe_com, 1); -+ bf_set(wqe_cmd_type, &pwqe->generic.wqe_com, 0xA); -+ bf_set(wqe_cqid, &pwqe->generic.wqe_com, LPFC_WQE_CQ_ID_DEFAULT); -+ bf_set(wqe_xri_tag, &pwqe->generic.wqe_com, iocbq->sli4_xritag); -+ bf_set(wqe_reqtag, &pwqe->generic.wqe_com, iocbq->iotag); -+ bf_set(wqe_class, &pwqe->generic.wqe_com, CLASS3); -+ pwqe->generic.wqe_com.abort_tag = iocbq->iotag; - -- iocbq->iocb.ulpCommand = CMD_SEND_FRAME; -- iocbq->iocb.ulpLe = 1; - iocbq->cmd_cmpl = lpfc_sli4_mds_loopback_cmpl; -+ - rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, iocbq, 0); - if (rc == IOCB_ERROR) - goto exit; diff --git a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-fast-and-slow-path.patch b/patches.suse/scsi-lpfc-SLI-path-split-Refactor-fast-and-slow-path.patch deleted file mode 100644 index 8e31f21..0000000 --- a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-fast-and-slow-path.patch +++ /dev/null @@ -1,874 +0,0 @@ -From: James Smart -Date: Thu, 24 Feb 2022 18:22:53 -0800 -Subject: scsi: lpfc: SLI path split: Refactor fast and slow paths to native - SLI4 -Patch-mainline: v5.18-rc1 -Git-commit: 1b64aa9eae28ac598a03ed3d62a63ac5e5b295fc -References: bsc#1197675 - -Convert the SLI4 fast and slow paths to use native SLI4 wqe constructs -instead of iocb SLI3-isms. - -Includes the following: - - - Create simple get_xxx and set_xxx routines to wrapper access to common - elements in both SLI3 and SLI4 commands - allowing calling routines to - avoid sli-rev-specific structures to access the elements. - - - using the wqe in the job structure as the primary element - - - use defines from SLI-4, not SLI-3 - - - Removal of iocb to wqe conversion from fast and slow path - - - Add below routines to handle fast path - lpfc_prep_embed_io - prepares the wqe for fast path - lpfc_wqe_bpl2sgl - manages bpl to sgl conversion - lpfc_sli_wqe2iocb - converts a WQE to IOCB for SLI-3 path - - - Add lpfc_sli3_iocb2wcqecmpl in completion path to convert an SLI-3 - iocb completion to wcqe completion - - - Refactor some of the code that works on both revs for clarity - -Link: https://lore.kernel.org/r/20220225022308.16486-3-jsmart2021@gmail.com -Co-developed-by: Justin Tee -Signed-off-by: Justin Tee -Signed-off-by: James Smart -Signed-off-by: Martin K. Petersen -Acked-by: Daniel Wagner ---- - drivers/scsi/lpfc/lpfc.h | 36 ++ - drivers/scsi/lpfc/lpfc_crtn.h | 1 - drivers/scsi/lpfc/lpfc_hw4.h | 7 - drivers/scsi/lpfc/lpfc_sli.c | 513 +++++++++++++++++------------------------- - drivers/scsi/lpfc/lpfc_sli.h | 2 - 5 files changed, 256 insertions(+), 303 deletions(-) - ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -1676,3 +1676,39 @@ static const char *routine(enum enum_nam - } \ - return name; \ - } -+ -+static inline -+u8 get_job_ulpstatus(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq) -+{ -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ return bf_get(lpfc_wcqe_c_status, &iocbq->wcqe_cmpl); -+ else -+ return iocbq->iocb.ulpStatus; -+} -+ -+static inline -+u32 get_job_word4(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq) -+{ -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ return iocbq->wcqe_cmpl.parameter; -+ else -+ return iocbq->iocb.un.ulpWord[4]; -+} -+ -+static inline -+u8 get_job_cmnd(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq) -+{ -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ return bf_get(wqe_cmnd, &iocbq->wqe.generic.wqe_com); -+ else -+ return iocbq->iocb.ulpCommand; -+} -+ -+static inline -+u16 get_job_ulpcontext(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq) -+{ -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ return bf_get(wqe_ctxt_tag, &iocbq->wqe.generic.wqe_com); -+ else -+ return iocbq->iocb.ulpContext; -+} ---- a/drivers/scsi/lpfc/lpfc_crtn.h -+++ b/drivers/scsi/lpfc/lpfc_crtn.h -@@ -130,6 +130,7 @@ void lpfc_disc_list_loopmap(struct lpfc_ - void lpfc_disc_start(struct lpfc_vport *); - void lpfc_cleanup_discovery_resources(struct lpfc_vport *); - void lpfc_cleanup(struct lpfc_vport *); -+void lpfc_prep_embed_io(struct lpfc_hba *phba, struct lpfc_io_buf *lpfc_ncmd); - void lpfc_disc_timeout(struct timer_list *); - - int lpfc_unregister_fcf_prep(struct lpfc_hba *); ---- a/drivers/scsi/lpfc/lpfc_hw4.h -+++ b/drivers/scsi/lpfc/lpfc_hw4.h -@@ -60,6 +60,13 @@ - ((ptr)->name##_WORD = ((((value) & name##_MASK) << name##_SHIFT) | \ - ((ptr)->name##_WORD & ~(name##_MASK << name##_SHIFT)))) - -+#define get_wqe_reqtag(x) (((x)->wqe.words[9] >> 0) & 0xFFFF) -+ -+#define get_job_ulpword(x, y) ((x)->iocb.un.ulpWord[y]) -+ -+#define set_job_ulpstatus(x, y) bf_set(lpfc_wcqe_c_status, &(x)->wcqe_cmpl, y) -+#define set_job_ulpword4(x, y) ((&(x)->wcqe_cmpl)->parameter = y) -+ - struct dma_address { - uint32_t addr_lo; - uint32_t addr_hi; ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -73,8 +73,9 @@ static int lpfc_sli_issue_mbox_s4(struct - uint32_t); - static int lpfc_sli4_read_rev(struct lpfc_hba *, LPFC_MBOXQ_t *, - uint8_t *, uint32_t *); --static struct lpfc_iocbq *lpfc_sli4_els_wcqe_to_rspiocbq(struct lpfc_hba *, -- struct lpfc_iocbq *); -+static struct lpfc_iocbq * -+lpfc_sli4_els_preprocess_rspiocbq(struct lpfc_hba *phba, -+ struct lpfc_iocbq *rspiocbq); - static void lpfc_sli4_send_seq_to_ulp(struct lpfc_vport *, - struct hbq_dmabuf *); - static void lpfc_sli4_handle_mds_loopback(struct lpfc_vport *vport, -@@ -92,6 +93,9 @@ static struct lpfc_cqe *lpfc_sli4_cq_get - static void __lpfc_sli4_consume_cqe(struct lpfc_hba *phba, - struct lpfc_queue *cq, - struct lpfc_cqe *cqe); -+static uint16_t lpfc_wqe_bpl2sgl(struct lpfc_hba *phba, -+ struct lpfc_iocbq *pwqeq, -+ struct lpfc_sglq *sglq); - - union lpfc_wqe128 lpfc_iread_cmd_template; - union lpfc_wqe128 lpfc_iwrite_cmd_template; -@@ -3415,17 +3419,12 @@ lpfc_sli_iocbq_lookup(struct lpfc_hba *p - struct lpfc_iocbq *prspiocb) - { - struct lpfc_iocbq *cmd_iocb = NULL; -- uint16_t iotag; -- spinlock_t *temp_lock = NULL; -- unsigned long iflag = 0; -+ u16 iotag; - - if (phba->sli_rev == LPFC_SLI_REV4) -- temp_lock = &pring->ring_lock; -+ iotag = get_wqe_reqtag(prspiocb); - else -- temp_lock = &phba->hbalock; -- -- spin_lock_irqsave(temp_lock, iflag); -- iotag = prspiocb->iocb.ulpIoTag; -+ iotag = prspiocb->iocb.ulpIoTag; - - if (iotag != 0 && iotag <= phba->sli.last_iotag) { - cmd_iocb = phba->sli.iocbq_lookup[iotag]; -@@ -3434,17 +3433,14 @@ lpfc_sli_iocbq_lookup(struct lpfc_hba *p - list_del_init(&cmd_iocb->list); - cmd_iocb->cmd_flag &= ~LPFC_IO_ON_TXCMPLQ; - pring->txcmplq_cnt--; -- spin_unlock_irqrestore(temp_lock, iflag); - return cmd_iocb; - } - } - -- spin_unlock_irqrestore(temp_lock, iflag); - lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, - "0317 iotag x%x is out of " -- "range: max iotag x%x wd0 x%x\n", -- iotag, phba->sli.last_iotag, -- *(((uint32_t *) &prspiocb->iocb) + 7)); -+ "range: max iotag x%x\n", -+ iotag, phba->sli.last_iotag); - return NULL; - } - -@@ -3465,15 +3461,7 @@ lpfc_sli_iocbq_lookup_by_tag(struct lpfc - struct lpfc_sli_ring *pring, uint16_t iotag) - { - struct lpfc_iocbq *cmd_iocb = NULL; -- spinlock_t *temp_lock = NULL; -- unsigned long iflag = 0; - -- if (phba->sli_rev == LPFC_SLI_REV4) -- temp_lock = &pring->ring_lock; -- else -- temp_lock = &phba->hbalock; -- -- spin_lock_irqsave(temp_lock, iflag); - if (iotag != 0 && iotag <= phba->sli.last_iotag) { - cmd_iocb = phba->sli.iocbq_lookup[iotag]; - if (cmd_iocb->cmd_flag & LPFC_IO_ON_TXCMPLQ) { -@@ -3481,12 +3469,10 @@ lpfc_sli_iocbq_lookup_by_tag(struct lpfc - list_del_init(&cmd_iocb->list); - cmd_iocb->cmd_flag &= ~LPFC_IO_ON_TXCMPLQ; - pring->txcmplq_cnt--; -- spin_unlock_irqrestore(temp_lock, iflag); - return cmd_iocb; - } - } - -- spin_unlock_irqrestore(temp_lock, iflag); - lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, - "0372 iotag x%x lookup error: max iotag (x%x) " - "cmd_flag x%x\n", -@@ -3519,18 +3505,29 @@ lpfc_sli_process_sol_iocb(struct lpfc_hb - struct lpfc_iocbq *cmdiocbp; - int rc = 1; - unsigned long iflag; -+ u32 ulp_command, ulp_status, ulp_word4, ulp_context, iotag; - - cmdiocbp = lpfc_sli_iocbq_lookup(phba, pring, saveq); -+ -+ ulp_command = get_job_cmnd(phba, saveq); -+ ulp_status = get_job_ulpstatus(phba, saveq); -+ ulp_word4 = get_job_word4(phba, saveq); -+ ulp_context = get_job_ulpcontext(phba, saveq); -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ iotag = get_wqe_reqtag(saveq); -+ else -+ iotag = saveq->iocb.ulpIoTag; -+ - if (cmdiocbp) { -+ ulp_command = get_job_cmnd(phba, cmdiocbp); - if (cmdiocbp->cmd_cmpl) { - /* - * If an ELS command failed send an event to mgmt - * application. - */ -- if (saveq->iocb.ulpStatus && -+ if (ulp_status && - (pring->ringno == LPFC_ELS_RING) && -- (cmdiocbp->iocb.ulpCommand == -- CMD_ELS_REQUEST64_CR)) -+ (ulp_command == CMD_ELS_REQUEST64_CR)) - lpfc_send_els_failure_event(phba, - cmdiocbp, saveq); - -@@ -3592,20 +3589,20 @@ lpfc_sli_process_sol_iocb(struct lpfc_hb - ~LPFC_DRIVER_ABORTED; - spin_unlock_irqrestore( - &phba->hbalock, iflag); -- cmdiocbp->iocb.ulpStatus = -- IOSTAT_LOCAL_REJECT; -- cmdiocbp->iocb.un.ulpWord[4] = -- IOERR_ABORT_REQUESTED; -+ set_job_ulpstatus(cmdiocbp, -+ IOSTAT_LOCAL_REJECT); -+ set_job_ulpword4(cmdiocbp, -+ IOERR_ABORT_REQUESTED); - /* - * For SLI4, irsiocb contains - * NO_XRI in sli_xritag, it - * shall not affect releasing - * sgl (xri) process. - */ -- saveq->iocb.ulpStatus = -- IOSTAT_LOCAL_REJECT; -- saveq->iocb.un.ulpWord[4] = -- IOERR_SLI_ABORTED; -+ set_job_ulpstatus(saveq, -+ IOSTAT_LOCAL_REJECT); -+ set_job_ulpword4(saveq, -+ IOERR_SLI_ABORTED); - spin_lock_irqsave( - &phba->hbalock, iflag); - saveq->cmd_flag |= -@@ -3633,12 +3630,8 @@ lpfc_sli_process_sol_iocb(struct lpfc_hb - "0322 Ring %d handler: " - "unexpected completion IoTag x%x " - "Data: x%x x%x x%x x%x\n", -- pring->ringno, -- saveq->iocb.ulpIoTag, -- saveq->iocb.ulpStatus, -- saveq->iocb.un.ulpWord[4], -- saveq->iocb.ulpCommand, -- saveq->iocb.ulpContext); -+ pring->ringno, iotag, ulp_status, -+ ulp_word4, ulp_command, ulp_context); - } - } - -@@ -3953,155 +3946,159 @@ lpfc_sli_sp_handle_rspiocb(struct lpfc_h - struct lpfc_iocbq *rspiocbp) - { - struct lpfc_iocbq *saveq; -- struct lpfc_iocbq *cmdiocbp; -+ struct lpfc_iocbq *cmdiocb; - struct lpfc_iocbq *next_iocb; -- IOCB_t *irsp = NULL; -+ IOCB_t *irsp; - uint32_t free_saveq; -- uint8_t iocb_cmd_type; -+ u8 cmd_type; - lpfc_iocb_type type; - unsigned long iflag; -+ u32 ulp_status = get_job_ulpstatus(phba, rspiocbp); -+ u32 ulp_word4 = get_job_word4(phba, rspiocbp); -+ u32 ulp_command = get_job_cmnd(phba, rspiocbp); - int rc; - - spin_lock_irqsave(&phba->hbalock, iflag); - /* First add the response iocb to the countinueq list */ -- list_add_tail(&rspiocbp->list, &(pring->iocb_continueq)); -+ list_add_tail(&rspiocbp->list, &pring->iocb_continueq); - pring->iocb_continueq_cnt++; - -- /* Now, determine whether the list is completed for processing */ -- irsp = &rspiocbp->iocb; -- if (irsp->ulpLe) { -- /* -- * By default, the driver expects to free all resources -- * associated with this iocb completion. -- */ -- free_saveq = 1; -- saveq = list_get_first(&pring->iocb_continueq, -- struct lpfc_iocbq, list); -- irsp = &(saveq->iocb); -- list_del_init(&pring->iocb_continueq); -- pring->iocb_continueq_cnt = 0; -+ /* -+ * By default, the driver expects to free all resources -+ * associated with this iocb completion. -+ */ -+ free_saveq = 1; -+ saveq = list_get_first(&pring->iocb_continueq, -+ struct lpfc_iocbq, list); -+ list_del_init(&pring->iocb_continueq); -+ pring->iocb_continueq_cnt = 0; - -- pring->stats.iocb_rsp++; -+ pring->stats.iocb_rsp++; - -- /* -- * If resource errors reported from HBA, reduce -- * queuedepths of the SCSI device. -- */ -- if ((irsp->ulpStatus == IOSTAT_LOCAL_REJECT) && -- ((irsp->un.ulpWord[4] & IOERR_PARAM_MASK) == -- IOERR_NO_RESOURCES)) { -- spin_unlock_irqrestore(&phba->hbalock, iflag); -- phba->lpfc_rampdown_queue_depth(phba); -- spin_lock_irqsave(&phba->hbalock, iflag); -- } -+ /* -+ * If resource errors reported from HBA, reduce -+ * queuedepths of the SCSI device. -+ */ -+ if (ulp_status == IOSTAT_LOCAL_REJECT && -+ ((ulp_word4 & IOERR_PARAM_MASK) == -+ IOERR_NO_RESOURCES)) { -+ spin_unlock_irqrestore(&phba->hbalock, iflag); -+ phba->lpfc_rampdown_queue_depth(phba); -+ spin_lock_irqsave(&phba->hbalock, iflag); -+ } - -- if (irsp->ulpStatus) { -- /* Rsp ring error: IOCB */ -+ if (ulp_status) { -+ /* Rsp ring error: IOCB */ -+ if (phba->sli_rev < LPFC_SLI_REV4) { -+ irsp = &rspiocbp->iocb; -+ lpfc_printf_log(phba, KERN_WARNING, LOG_SLI, -+ "0328 Rsp Ring %d error: ulp_status x%x " -+ "IOCB Data: " -+ "x%08x x%08x x%08x x%08x " -+ "x%08x x%08x x%08x x%08x " -+ "x%08x x%08x x%08x x%08x " -+ "x%08x x%08x x%08x x%08x\n", -+ pring->ringno, ulp_status, -+ get_job_ulpword(rspiocbp, 0), -+ get_job_ulpword(rspiocbp, 1), -+ get_job_ulpword(rspiocbp, 2), -+ get_job_ulpword(rspiocbp, 3), -+ get_job_ulpword(rspiocbp, 4), -+ get_job_ulpword(rspiocbp, 5), -+ *(((uint32_t *)irsp) + 6), -+ *(((uint32_t *)irsp) + 7), -+ *(((uint32_t *)irsp) + 8), -+ *(((uint32_t *)irsp) + 9), -+ *(((uint32_t *)irsp) + 10), -+ *(((uint32_t *)irsp) + 11), -+ *(((uint32_t *)irsp) + 12), -+ *(((uint32_t *)irsp) + 13), -+ *(((uint32_t *)irsp) + 14), -+ *(((uint32_t *)irsp) + 15)); -+ } else { - lpfc_printf_log(phba, KERN_WARNING, LOG_SLI, -- "0328 Rsp Ring %d error: " -+ "0321 Rsp Ring %d error: " - "IOCB Data: " -- "x%x x%x x%x x%x " -- "x%x x%x x%x x%x " -- "x%x x%x x%x x%x " - "x%x x%x x%x x%x\n", - pring->ringno, -- irsp->un.ulpWord[0], -- irsp->un.ulpWord[1], -- irsp->un.ulpWord[2], -- irsp->un.ulpWord[3], -- irsp->un.ulpWord[4], -- irsp->un.ulpWord[5], -- *(((uint32_t *) irsp) + 6), -- *(((uint32_t *) irsp) + 7), -- *(((uint32_t *) irsp) + 8), -- *(((uint32_t *) irsp) + 9), -- *(((uint32_t *) irsp) + 10), -- *(((uint32_t *) irsp) + 11), -- *(((uint32_t *) irsp) + 12), -- *(((uint32_t *) irsp) + 13), -- *(((uint32_t *) irsp) + 14), -- *(((uint32_t *) irsp) + 15)); -+ rspiocbp->wcqe_cmpl.word0, -+ rspiocbp->wcqe_cmpl.total_data_placed, -+ rspiocbp->wcqe_cmpl.parameter, -+ rspiocbp->wcqe_cmpl.word3); - } -+ } - -- /* -- * Fetch the IOCB command type and call the correct completion -- * routine. Solicited and Unsolicited IOCBs on the ELS ring -- * get freed back to the lpfc_iocb_list by the discovery -- * kernel thread. -- */ -- iocb_cmd_type = irsp->ulpCommand & CMD_IOCB_MASK; -- type = lpfc_sli_iocb_cmd_type(iocb_cmd_type); -- switch (type) { -- case LPFC_SOL_IOCB: -- spin_unlock_irqrestore(&phba->hbalock, iflag); -- rc = lpfc_sli_process_sol_iocb(phba, pring, saveq); -- spin_lock_irqsave(&phba->hbalock, iflag); -- break; - -- case LPFC_UNSOL_IOCB: -- spin_unlock_irqrestore(&phba->hbalock, iflag); -- rc = lpfc_sli_process_unsol_iocb(phba, pring, saveq); -- spin_lock_irqsave(&phba->hbalock, iflag); -- if (!rc) -- free_saveq = 0; -- break; -- -- case LPFC_ABORT_IOCB: -- cmdiocbp = NULL; -- if (irsp->ulpCommand != CMD_XRI_ABORTED_CX) { -+ /* -+ * Fetch the iocb command type and call the correct completion -+ * routine. Solicited and Unsolicited IOCBs on the ELS ring -+ * get freed back to the lpfc_iocb_list by the discovery -+ * kernel thread. -+ */ -+ cmd_type = ulp_command & CMD_IOCB_MASK; -+ type = lpfc_sli_iocb_cmd_type(cmd_type); -+ switch (type) { -+ case LPFC_SOL_IOCB: -+ spin_unlock_irqrestore(&phba->hbalock, iflag); -+ rc = lpfc_sli_process_sol_iocb(phba, pring, saveq); -+ spin_lock_irqsave(&phba->hbalock, iflag); -+ break; -+ case LPFC_UNSOL_IOCB: -+ spin_unlock_irqrestore(&phba->hbalock, iflag); -+ rc = lpfc_sli_process_unsol_iocb(phba, pring, saveq); -+ spin_lock_irqsave(&phba->hbalock, iflag); -+ if (!rc) -+ free_saveq = 0; -+ break; -+ case LPFC_ABORT_IOCB: -+ cmdiocb = NULL; -+ if (ulp_command != CMD_XRI_ABORTED_CX) -+ cmdiocb = lpfc_sli_iocbq_lookup(phba, pring, -+ saveq); -+ if (cmdiocb) { -+ /* Call the specified completion routine */ -+ if (cmdiocb->cmd_cmpl) { - spin_unlock_irqrestore(&phba->hbalock, iflag); -- cmdiocbp = lpfc_sli_iocbq_lookup(phba, pring, -- saveq); -+ cmdiocb->cmd_cmpl(phba, cmdiocb, saveq); - spin_lock_irqsave(&phba->hbalock, iflag); -- } -- if (cmdiocbp) { -- /* Call the specified completion routine */ -- if (cmdiocbp->cmd_cmpl) { -- spin_unlock_irqrestore(&phba->hbalock, -- iflag); -- (cmdiocbp->cmd_cmpl)(phba, cmdiocbp, -- saveq); -- spin_lock_irqsave(&phba->hbalock, -- iflag); -- } else -- __lpfc_sli_release_iocbq(phba, -- cmdiocbp); -- } -- break; -- -- case LPFC_UNKNOWN_IOCB: -- if (irsp->ulpCommand == CMD_ADAPTER_MSG) { -- char adaptermsg[LPFC_MAX_ADPTMSG]; -- memset(adaptermsg, 0, LPFC_MAX_ADPTMSG); -- memcpy(&adaptermsg[0], (uint8_t *)irsp, -- MAX_MSG_DATA); -- dev_warn(&((phba->pcidev)->dev), -- "lpfc%d: %s\n", -- phba->brd_no, adaptermsg); - } else { -- /* Unknown IOCB command */ -- lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, -- "0335 Unknown IOCB " -- "command Data: x%x " -- "x%x x%x x%x\n", -- irsp->ulpCommand, -- irsp->ulpStatus, -- irsp->ulpIoTag, -- irsp->ulpContext); -+ __lpfc_sli_release_iocbq(phba, cmdiocb); - } -- break; - } -+ break; -+ case LPFC_UNKNOWN_IOCB: -+ if (ulp_command == CMD_ADAPTER_MSG) { -+ char adaptermsg[LPFC_MAX_ADPTMSG]; -+ -+ memset(adaptermsg, 0, LPFC_MAX_ADPTMSG); -+ memcpy(&adaptermsg[0], (uint8_t *)&rspiocbp->wqe, -+ MAX_MSG_DATA); -+ dev_warn(&((phba->pcidev)->dev), -+ "lpfc%d: %s\n", -+ phba->brd_no, adaptermsg); -+ } else { -+ /* Unknown command */ -+ lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, -+ "0335 Unknown IOCB " -+ "command Data: x%x " -+ "x%x x%x x%x\n", -+ ulp_command, -+ ulp_status, -+ get_wqe_reqtag(rspiocbp), -+ get_job_ulpcontext(phba, rspiocbp)); -+ } -+ break; -+ } - -- if (free_saveq) { -- list_for_each_entry_safe(rspiocbp, next_iocb, -- &saveq->list, list) { -- list_del_init(&rspiocbp->list); -- __lpfc_sli_release_iocbq(phba, rspiocbp); -- } -- __lpfc_sli_release_iocbq(phba, saveq); -+ if (free_saveq) { -+ list_for_each_entry_safe(rspiocbp, next_iocb, -+ &saveq->list, list) { -+ list_del_init(&rspiocbp->list); -+ __lpfc_sli_release_iocbq(phba, rspiocbp); - } -- rspiocbp = NULL; -+ __lpfc_sli_release_iocbq(phba, saveq); - } -+ rspiocbp = NULL; - spin_unlock_irqrestore(&phba->hbalock, iflag); - return rspiocbp; - } -@@ -4294,8 +4291,8 @@ lpfc_sli_handle_slow_ring_event_s4(struc - irspiocbq = container_of(cq_event, struct lpfc_iocbq, - cq_event); - /* Translate ELS WCQE to response IOCBQ */ -- irspiocbq = lpfc_sli4_els_wcqe_to_rspiocbq(phba, -- irspiocbq); -+ irspiocbq = lpfc_sli4_els_preprocess_rspiocbq(phba, -+ irspiocbq); - if (irspiocbq) - lpfc_sli_sp_handle_rspiocb(phba, pring, - irspiocbq); -@@ -10809,7 +10806,16 @@ static int - int rc; - struct lpfc_io_buf *lpfc_cmd = - (struct lpfc_io_buf *)piocb->context1; -- union lpfc_wqe128 *wqe = &piocb->wqe; -+ -+ lpfc_prep_embed_io(phba, lpfc_cmd); -+ rc = lpfc_sli4_issue_wqe(phba, lpfc_cmd->hdwq, piocb); -+ return rc; -+} -+ -+void -+lpfc_prep_embed_io(struct lpfc_hba *phba, struct lpfc_io_buf *lpfc_cmd) -+{ -+ union lpfc_wqe128 *wqe = &lpfc_cmd->cur_iocbq.wqe; - struct sli4_sge *sgl; - - /* 128 byte wqe support here */ -@@ -10845,9 +10851,6 @@ static int - bf_set(wqe_dbde, &wqe->generic.wqe_com, 1); - bf_set(wqe_wqes, &wqe->generic.wqe_com, 0); - } -- -- rc = lpfc_sli4_issue_wqe(phba, lpfc_cmd->hdwq, piocb); -- return rc; - } - - /** -@@ -10869,9 +10872,10 @@ static int - struct lpfc_iocbq *piocb, uint32_t flag) - { - struct lpfc_sglq *sglq; -- union lpfc_wqe128 wqe; -+ union lpfc_wqe128 *wqe; - struct lpfc_queue *wq; - struct lpfc_sli_ring *pring; -+ u32 ulp_command = get_job_cmnd(phba, piocb); - - /* Get the WQ */ - if ((piocb->cmd_flag & LPFC_IO_FCP) || -@@ -10889,10 +10893,9 @@ static int - */ - - lockdep_assert_held(&pring->ring_lock); -- -+ wqe = &piocb->wqe; - if (piocb->sli4_xritag == NO_XRI) { -- if (piocb->iocb.ulpCommand == CMD_ABORT_XRI_CN || -- piocb->iocb.ulpCommand == CMD_CLOSE_XRI_CN) -+ if (ulp_command == CMD_ABORT_XRI_WQE) - sglq = NULL; - else { - if (!list_empty(&pring->txq)) { -@@ -10933,14 +10936,24 @@ static int - if (sglq) { - piocb->sli4_lxritag = sglq->sli4_lxritag; - piocb->sli4_xritag = sglq->sli4_xritag; -- if (NO_XRI == lpfc_sli4_bpl2sgl(phba, piocb, sglq)) -+ -+ /* ABTS sent by initiator to CT exchange, the -+ * RX_ID field will be filled with the newly -+ * allocated responder XRI. -+ */ -+ if (ulp_command == CMD_XMIT_BLS_RSP64_CX && -+ piocb->abort_bls == LPFC_ABTS_UNSOL_INT) -+ bf_set(xmit_bls_rsp64_rxid, &wqe->xmit_bls_rsp, -+ piocb->sli4_xritag); -+ -+ bf_set(wqe_xri_tag, &wqe->generic.wqe_com, -+ piocb->sli4_xritag); -+ -+ if (lpfc_wqe_bpl2sgl(phba, piocb, sglq) == NO_XRI) - return IOCB_ERROR; - } - -- if (lpfc_sli4_iocb2wqe(phba, piocb, &wqe)) -- return IOCB_ERROR; -- -- if (lpfc_sli4_wq_put(wq, &wqe)) -+ if (lpfc_sli4_wq_put(wq, wqe)) - return IOCB_ERROR; - lpfc_sli_ringtxcmpl_put(phba, pring, piocb); - -@@ -13938,123 +13951,7 @@ void lpfc_sli4_els_xri_abort_event_proc( - } - - /** -- * lpfc_sli4_iocb_param_transfer - Transfer pIocbOut and cmpl status to pIocbIn -- * @phba: pointer to lpfc hba data structure -- * @pIocbIn: pointer to the rspiocbq -- * @pIocbOut: pointer to the cmdiocbq -- * @wcqe: pointer to the complete wcqe -- * -- * This routine transfers the fields of a command iocbq to a response iocbq -- * by copying all the IOCB fields from command iocbq and transferring the -- * completion status information from the complete wcqe. -- **/ --static void --lpfc_sli4_iocb_param_transfer(struct lpfc_hba *phba, -- struct lpfc_iocbq *pIocbIn, -- struct lpfc_iocbq *pIocbOut, -- struct lpfc_wcqe_complete *wcqe) --{ -- int numBdes, i; -- unsigned long iflags; -- uint32_t status, max_response; -- struct lpfc_dmabuf *dmabuf; -- struct ulp_bde64 *bpl, bde; -- size_t offset = offsetof(struct lpfc_iocbq, iocb); -- -- memcpy((char *)pIocbIn + offset, (char *)pIocbOut + offset, -- sizeof(struct lpfc_iocbq) - offset); -- /* Map WCQE parameters into irspiocb parameters */ -- status = bf_get(lpfc_wcqe_c_status, wcqe); -- pIocbIn->iocb.ulpStatus = (status & LPFC_IOCB_STATUS_MASK); -- if (pIocbOut->cmd_flag & LPFC_IO_FCP) -- if (pIocbIn->iocb.ulpStatus == IOSTAT_FCP_RSP_ERROR) -- pIocbIn->iocb.un.fcpi.fcpi_parm = -- pIocbOut->iocb.un.fcpi.fcpi_parm - -- wcqe->total_data_placed; -- else -- pIocbIn->iocb.un.ulpWord[4] = wcqe->parameter; -- else { -- pIocbIn->iocb.un.ulpWord[4] = wcqe->parameter; -- switch (pIocbOut->iocb.ulpCommand) { -- case CMD_ELS_REQUEST64_CR: -- dmabuf = (struct lpfc_dmabuf *)pIocbOut->context3; -- bpl = (struct ulp_bde64 *)dmabuf->virt; -- bde.tus.w = le32_to_cpu(bpl[1].tus.w); -- max_response = bde.tus.f.bdeSize; -- break; -- case CMD_GEN_REQUEST64_CR: -- max_response = 0; -- if (!pIocbOut->context3) -- break; -- numBdes = pIocbOut->iocb.un.genreq64.bdl.bdeSize/ -- sizeof(struct ulp_bde64); -- dmabuf = (struct lpfc_dmabuf *)pIocbOut->context3; -- bpl = (struct ulp_bde64 *)dmabuf->virt; -- for (i = 0; i < numBdes; i++) { -- bde.tus.w = le32_to_cpu(bpl[i].tus.w); -- if (bde.tus.f.bdeFlags != BUFF_TYPE_BDE_64) -- max_response += bde.tus.f.bdeSize; -- } -- break; -- default: -- max_response = wcqe->total_data_placed; -- break; -- } -- if (max_response < wcqe->total_data_placed) -- pIocbIn->iocb.un.genreq64.bdl.bdeSize = max_response; -- else -- pIocbIn->iocb.un.genreq64.bdl.bdeSize = -- wcqe->total_data_placed; -- } -- -- /* Convert BG errors for completion status */ -- if (status == CQE_STATUS_DI_ERROR) { -- pIocbIn->iocb.ulpStatus = IOSTAT_LOCAL_REJECT; -- -- if (bf_get(lpfc_wcqe_c_bg_edir, wcqe)) -- pIocbIn->iocb.un.ulpWord[4] = IOERR_RX_DMA_FAILED; -- else -- pIocbIn->iocb.un.ulpWord[4] = IOERR_TX_DMA_FAILED; -- -- pIocbIn->iocb.unsli3.sli3_bg.bgstat = 0; -- if (bf_get(lpfc_wcqe_c_bg_ge, wcqe)) /* Guard Check failed */ -- pIocbIn->iocb.unsli3.sli3_bg.bgstat |= -- BGS_GUARD_ERR_MASK; -- if (bf_get(lpfc_wcqe_c_bg_ae, wcqe)) /* App Tag Check failed */ -- pIocbIn->iocb.unsli3.sli3_bg.bgstat |= -- BGS_APPTAG_ERR_MASK; -- if (bf_get(lpfc_wcqe_c_bg_re, wcqe)) /* Ref Tag Check failed */ -- pIocbIn->iocb.unsli3.sli3_bg.bgstat |= -- BGS_REFTAG_ERR_MASK; -- -- /* Check to see if there was any good data before the error */ -- if (bf_get(lpfc_wcqe_c_bg_tdpv, wcqe)) { -- pIocbIn->iocb.unsli3.sli3_bg.bgstat |= -- BGS_HI_WATER_MARK_PRESENT_MASK; -- pIocbIn->iocb.unsli3.sli3_bg.bghm = -- wcqe->total_data_placed; -- } -- -- /* -- * Set ALL the error bits to indicate we don't know what -- * type of error it is. -- */ -- if (!pIocbIn->iocb.unsli3.sli3_bg.bgstat) -- pIocbIn->iocb.unsli3.sli3_bg.bgstat |= -- (BGS_REFTAG_ERR_MASK | BGS_APPTAG_ERR_MASK | -- BGS_GUARD_ERR_MASK); -- } -- -- /* Pick up HBA exchange busy condition */ -- if (bf_get(lpfc_wcqe_c_xb, wcqe)) { -- spin_lock_irqsave(&phba->hbalock, iflags); -- pIocbIn->cmd_flag |= LPFC_EXCHANGE_BUSY; -- spin_unlock_irqrestore(&phba->hbalock, iflags); -- } --} -- --/** -- * lpfc_sli4_els_wcqe_to_rspiocbq - Get response iocbq from els wcqe -+ * lpfc_sli4_els_preprocess_rspiocbq - Get response iocbq from els wcqe - * @phba: Pointer to HBA context object. - * @irspiocbq: Pointer to work-queue completion queue entry. - * -@@ -14065,8 +13962,8 @@ lpfc_sli4_iocb_param_transfer(struct lpf - * Return: Pointer to the receive IOCBQ, NULL otherwise. - **/ - static struct lpfc_iocbq * --lpfc_sli4_els_wcqe_to_rspiocbq(struct lpfc_hba *phba, -- struct lpfc_iocbq *irspiocbq) -+lpfc_sli4_els_preprocess_rspiocbq(struct lpfc_hba *phba, -+ struct lpfc_iocbq *irspiocbq) - { - struct lpfc_sli_ring *pring; - struct lpfc_iocbq *cmdiocbq; -@@ -14078,11 +13975,13 @@ lpfc_sli4_els_wcqe_to_rspiocbq(struct lp - return NULL; - - wcqe = &irspiocbq->cq_event.cqe.wcqe_cmpl; -+ spin_lock_irqsave(&pring->ring_lock, iflags); - pring->stats.iocb_event++; - /* Look up the ELS command IOCB and create pseudo response IOCB */ - cmdiocbq = lpfc_sli_iocbq_lookup_by_tag(phba, pring, - bf_get(lpfc_wcqe_c_request_tag, wcqe)); - if (unlikely(!cmdiocbq)) { -+ spin_unlock_irqrestore(&pring->ring_lock, iflags); - lpfc_printf_log(phba, KERN_WARNING, LOG_SLI, - "0386 ELS complete with no corresponding " - "cmdiocb: 0x%x 0x%x 0x%x 0x%x\n", -@@ -14092,13 +13991,18 @@ lpfc_sli4_els_wcqe_to_rspiocbq(struct lp - return NULL; - } - -- spin_lock_irqsave(&pring->ring_lock, iflags); -+ memcpy(&irspiocbq->wqe, &cmdiocbq->wqe, sizeof(union lpfc_wqe128)); -+ memcpy(&irspiocbq->wcqe_cmpl, wcqe, sizeof(*wcqe)); -+ - /* Put the iocb back on the txcmplq */ - lpfc_sli_ringtxcmpl_put(phba, pring, cmdiocbq); - spin_unlock_irqrestore(&pring->ring_lock, iflags); - -- /* Fake the irspiocbq and copy necessary response information */ -- lpfc_sli4_iocb_param_transfer(phba, irspiocbq, cmdiocbq, wcqe); -+ if (bf_get(lpfc_wcqe_c_xb, wcqe)) { -+ spin_lock_irqsave(&phba->hbalock, iflags); -+ cmdiocbq->cmd_flag |= LPFC_EXCHANGE_BUSY; -+ spin_unlock_irqrestore(&phba->hbalock, iflags); -+ } - - return irspiocbq; - } -@@ -14924,9 +14828,9 @@ lpfc_sli4_fp_handle_fcp_wcqe(struct lpfc - /* Look up the FCP command IOCB and create pseudo response IOCB */ - spin_lock_irqsave(&pring->ring_lock, iflags); - pring->stats.iocb_event++; -- spin_unlock_irqrestore(&pring->ring_lock, iflags); - cmdiocbq = lpfc_sli_iocbq_lookup_by_tag(phba, pring, - bf_get(lpfc_wcqe_c_request_tag, wcqe)); -+ spin_unlock_irqrestore(&pring->ring_lock, iflags); - if (unlikely(!cmdiocbq)) { - lpfc_printf_log(phba, KERN_WARNING, LOG_SLI, - "0374 FCP complete with no corresponding " -@@ -18788,13 +18692,16 @@ lpfc_sli4_seq_abort_rsp(struct lpfc_vpor - ctiocb->sli4_lxritag = NO_XRI; - ctiocb->sli4_xritag = NO_XRI; - -- if (fctl & FC_FC_EX_CTX) -+ if (fctl & FC_FC_EX_CTX) { - /* Exchange responder sent the abort so we - * own the oxid. - */ -+ ctiocb->abort_bls = LPFC_ABTS_UNSOL_RSP; - xri = oxid; -- else -+ } else { -+ ctiocb->abort_bls = LPFC_ABTS_UNSOL_INT; - xri = rxid; -+ } - lxri = lpfc_sli4_xri_inrange(phba, xri); - if (lxri != NO_XRI) - lpfc_set_rrq_active(phba, ndlp, lxri, ---- a/drivers/scsi/lpfc/lpfc_sli.h -+++ b/drivers/scsi/lpfc/lpfc_sli.h -@@ -70,6 +70,8 @@ struct lpfc_iocbq { - struct lpfc_wcqe_complete wcqe_cmpl; /* WQE cmpl */ - - uint8_t num_bdes; -+ uint8_t abort_bls; /* ABTS by initiator or responder */ -+ - uint8_t priority; /* OAS priority */ - uint8_t retry; /* retry counter for IOCB cmd - if needed */ - u32 cmd_flag; diff --git a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-lpfc_iocbq.patch b/patches.suse/scsi-lpfc-SLI-path-split-Refactor-lpfc_iocbq.patch deleted file mode 100644 index 0f64a4b..0000000 --- a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-lpfc_iocbq.patch +++ /dev/null @@ -1,2552 +0,0 @@ -From: James Smart -Date: Thu, 24 Feb 2022 18:22:52 -0800 -Subject: scsi: lpfc: SLI path split: Refactor lpfc_iocbq -Patch-mainline: v5.18-rc1 -Git-commit: a680a9298e7b4ff344aca3456177356b276e5038 -References: bsc#1197675 - -Currently, SLI3 and SLI4 data paths use the same lpfc_iocbq structure. -This is a "common" structure but many of the components refer to sli-rev -specific entities which can lead the developer astray as to what they -actually mean, should be set to, or when they should be used. - -This first patch prepares the lpfc_iocbq structure so that elements common -to both SLI3 and SLI4 data paths are more appropriately named, making it -clear they apply generically. - -Fieldnames based on 'iocb' (sli3) or 'wqe' (sli4) which are actually -generic to the paths are renamed to 'cmd': - - - iocb_flag is renamed to cmd_flag - - - lpfc_vmid_iocb_tag is renamed to lpfc_vmid_tag - - - fabric_iocb_cmpl is renamed to fabric_cmd_cmpl - - - wait_iocb_cmpl is renamed to wait_cmd_cmpl - - - iocb_cmpl and wqe_cmpl are combined and renamed to cmd_cmpl - - - rsvd2 member is renamed to num_bdes due to pre-existing usage - -The structure name itself will retain the iocb reference as changing to a -more relevant "job" or "cmd" title induces many hundreds of line changes -for only a name change. - -lpfc_post_buffer is also renamed to lpfc_sli3_post_buffer to indicate use -in the SLI3 path only. - -Link: https://lore.kernel.org/r/20220225022308.16486-2-jsmart2021@gmail.com -Co-developed-by: Justin Tee -Signed-off-by: Justin Tee -Signed-off-by: James Smart -Signed-off-by: Martin K. Petersen -Acked-by: Daniel Wagner ---- - drivers/scsi/lpfc/lpfc_bsg.c | 51 ++--- - drivers/scsi/lpfc/lpfc_crtn.h | 4 - drivers/scsi/lpfc/lpfc_ct.c | 8 - drivers/scsi/lpfc/lpfc_els.c | 135 +++++++------- - drivers/scsi/lpfc/lpfc_init.c | 11 - - drivers/scsi/lpfc/lpfc_nportdisc.c | 4 - drivers/scsi/lpfc/lpfc_nvme.c | 36 ++- - drivers/scsi/lpfc/lpfc_nvmet.c | 69 +++---- - drivers/scsi/lpfc/lpfc_scsi.c | 73 ++++--- - drivers/scsi/lpfc/lpfc_sli.c | 339 +++++++++++++++++-------------------- - drivers/scsi/lpfc/lpfc_sli.h | 20 -- - 11 files changed, 371 insertions(+), 379 deletions(-) - ---- a/drivers/scsi/lpfc/lpfc_bsg.c -+++ b/drivers/scsi/lpfc/lpfc_bsg.c -@@ -325,7 +325,7 @@ lpfc_bsg_send_mgmt_cmd_cmp(struct lpfc_h - - /* Close the timeout handler abort window */ - spin_lock_irqsave(&phba->hbalock, flags); -- cmdiocbq->iocb_flag &= ~LPFC_IO_CMD_OUTSTANDING; -+ cmdiocbq->cmd_flag &= ~LPFC_IO_CMD_OUTSTANDING; - spin_unlock_irqrestore(&phba->hbalock, flags); - - iocb = &dd_data->context_un.iocb; -@@ -481,11 +481,11 @@ lpfc_bsg_send_mgmt_cmd(struct bsg_job *j - cmd->ulpOwner = OWN_CHIP; - cmdiocbq->vport = phba->pport; - cmdiocbq->context3 = bmp; -- cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC; -+ cmdiocbq->cmd_flag |= LPFC_IO_LIBDFC; - timeout = phba->fc_ratov * 2; - cmd->ulpTimeout = timeout; - -- cmdiocbq->iocb_cmpl = lpfc_bsg_send_mgmt_cmd_cmp; -+ cmdiocbq->cmd_cmpl = lpfc_bsg_send_mgmt_cmd_cmp; - cmdiocbq->context1 = dd_data; - cmdiocbq->context2 = cmp; - cmdiocbq->context3 = bmp; -@@ -516,9 +516,9 @@ lpfc_bsg_send_mgmt_cmd(struct bsg_job *j - if (iocb_stat == IOCB_SUCCESS) { - spin_lock_irqsave(&phba->hbalock, flags); - /* make sure the I/O had not been completed yet */ -- if (cmdiocbq->iocb_flag & LPFC_IO_LIBDFC) { -+ if (cmdiocbq->cmd_flag & LPFC_IO_LIBDFC) { - /* open up abort window to timeout handler */ -- cmdiocbq->iocb_flag |= LPFC_IO_CMD_OUTSTANDING; -+ cmdiocbq->cmd_flag |= LPFC_IO_CMD_OUTSTANDING; - } - spin_unlock_irqrestore(&phba->hbalock, flags); - return 0; /* done for now */ -@@ -600,7 +600,7 @@ lpfc_bsg_rport_els_cmp(struct lpfc_hba * - - /* Close the timeout handler abort window */ - spin_lock_irqsave(&phba->hbalock, flags); -- cmdiocbq->iocb_flag &= ~LPFC_IO_CMD_OUTSTANDING; -+ cmdiocbq->cmd_flag &= ~LPFC_IO_CMD_OUTSTANDING; - spin_unlock_irqrestore(&phba->hbalock, flags); - - rsp = &rspiocbq->iocb; -@@ -726,10 +726,10 @@ lpfc_bsg_rport_els(struct bsg_job *job) - cmdiocbq->iocb.ulpContext = phba->sli4_hba.rpi_ids[rpi]; - else - cmdiocbq->iocb.ulpContext = rpi; -- cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC; -+ cmdiocbq->cmd_flag |= LPFC_IO_LIBDFC; - cmdiocbq->context1 = dd_data; - cmdiocbq->context_un.ndlp = ndlp; -- cmdiocbq->iocb_cmpl = lpfc_bsg_rport_els_cmp; -+ cmdiocbq->cmd_cmpl = lpfc_bsg_rport_els_cmp; - dd_data->type = TYPE_IOCB; - dd_data->set_job = job; - dd_data->context_un.iocb.cmdiocbq = cmdiocbq; -@@ -757,9 +757,9 @@ lpfc_bsg_rport_els(struct bsg_job *job) - if (rc == IOCB_SUCCESS) { - spin_lock_irqsave(&phba->hbalock, flags); - /* make sure the I/O had not been completed/released */ -- if (cmdiocbq->iocb_flag & LPFC_IO_LIBDFC) { -+ if (cmdiocbq->cmd_flag & LPFC_IO_LIBDFC) { - /* open up abort window to timeout handler */ -- cmdiocbq->iocb_flag |= LPFC_IO_CMD_OUTSTANDING; -+ cmdiocbq->cmd_flag |= LPFC_IO_CMD_OUTSTANDING; - } - spin_unlock_irqrestore(&phba->hbalock, flags); - return 0; /* done for now */ -@@ -1056,7 +1056,7 @@ lpfc_bsg_ct_unsol_event(struct lpfc_hba - lpfc_in_buf_free(phba, - dmabuf); - } else { -- lpfc_post_buffer(phba, -+ lpfc_sli3_post_buffer(phba, - pring, - 1); - } -@@ -1064,7 +1064,7 @@ lpfc_bsg_ct_unsol_event(struct lpfc_hba - default: - if (!(phba->sli3_options & - LPFC_SLI3_HBQ_ENABLED)) -- lpfc_post_buffer(phba, -+ lpfc_sli3_post_buffer(phba, - pring, - 1); - break; -@@ -1400,7 +1400,7 @@ lpfc_issue_ct_rsp_cmp(struct lpfc_hba *p - - /* Close the timeout handler abort window */ - spin_lock_irqsave(&phba->hbalock, flags); -- cmdiocbq->iocb_flag &= ~LPFC_IO_CMD_OUTSTANDING; -+ cmdiocbq->cmd_flag &= ~LPFC_IO_CMD_OUTSTANDING; - spin_unlock_irqrestore(&phba->hbalock, flags); - - ndlp = dd_data->context_un.iocb.ndlp; -@@ -1553,14 +1553,13 @@ lpfc_issue_ct_rsp(struct lpfc_hba *phba, - "2722 Xmit CT response on exchange x%x Data: x%x x%x x%x\n", - icmd->ulpContext, icmd->ulpIoTag, tag, phba->link_state); - -- ctiocb->iocb_cmpl = NULL; -- ctiocb->iocb_flag |= LPFC_IO_LIBDFC; -+ ctiocb->cmd_flag |= LPFC_IO_LIBDFC; - ctiocb->vport = phba->pport; - ctiocb->context1 = dd_data; - ctiocb->context2 = cmp; - ctiocb->context3 = bmp; - ctiocb->context_un.ndlp = ndlp; -- ctiocb->iocb_cmpl = lpfc_issue_ct_rsp_cmp; -+ ctiocb->cmd_cmpl = lpfc_issue_ct_rsp_cmp; - - dd_data->type = TYPE_IOCB; - dd_data->set_job = job; -@@ -1587,9 +1586,9 @@ lpfc_issue_ct_rsp(struct lpfc_hba *phba, - if (rc == IOCB_SUCCESS) { - spin_lock_irqsave(&phba->hbalock, flags); - /* make sure the I/O had not been completed/released */ -- if (ctiocb->iocb_flag & LPFC_IO_LIBDFC) { -+ if (ctiocb->cmd_flag & LPFC_IO_LIBDFC) { - /* open up abort window to timeout handler */ -- ctiocb->iocb_flag |= LPFC_IO_CMD_OUTSTANDING; -+ ctiocb->cmd_flag |= LPFC_IO_CMD_OUTSTANDING; - } - spin_unlock_irqrestore(&phba->hbalock, flags); - return 0; /* done for now */ -@@ -2718,9 +2717,9 @@ static int lpfcdiag_loop_get_xri(struct - cmd->ulpClass = CLASS3; - cmd->ulpContext = rpi; - -- cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC; -+ cmdiocbq->cmd_flag |= LPFC_IO_LIBDFC; - cmdiocbq->vport = phba->pport; -- cmdiocbq->iocb_cmpl = NULL; -+ cmdiocbq->cmd_cmpl = NULL; - - iocb_stat = lpfc_sli_issue_iocb_wait(phba, LPFC_ELS_RING, cmdiocbq, - rspiocbq, -@@ -3291,10 +3290,10 @@ lpfc_bsg_diag_loopback_run(struct bsg_jo - cmdiocbq->sli4_xritag = NO_XRI; - cmd->unsli3.rcvsli3.ox_id = 0xffff; - } -- cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC; -- cmdiocbq->iocb_flag |= LPFC_IO_LOOPBACK; -+ cmdiocbq->cmd_flag |= LPFC_IO_LIBDFC; -+ cmdiocbq->cmd_flag |= LPFC_IO_LOOPBACK; - cmdiocbq->vport = phba->pport; -- cmdiocbq->iocb_cmpl = NULL; -+ cmdiocbq->cmd_cmpl = NULL; - iocb_stat = lpfc_sli_issue_iocb_wait(phba, LPFC_ELS_RING, cmdiocbq, - rspiocbq, (phba->fc_ratov * 2) + - LPFC_DRVR_TIMEOUT); -@@ -5276,11 +5275,11 @@ lpfc_menlo_cmd(struct bsg_job *job) - cmd->ulpClass = CLASS3; - cmd->ulpOwner = OWN_CHIP; - cmd->ulpLe = 1; /* Limited Edition */ -- cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC; -+ cmdiocbq->cmd_flag |= LPFC_IO_LIBDFC; - cmdiocbq->vport = phba->pport; - /* We want the firmware to timeout before we do */ - cmd->ulpTimeout = MENLO_TIMEOUT - 5; -- cmdiocbq->iocb_cmpl = lpfc_bsg_menlo_cmd_cmp; -+ cmdiocbq->cmd_cmpl = lpfc_bsg_menlo_cmd_cmp; - cmdiocbq->context1 = dd_data; - cmdiocbq->context2 = cmp; - cmdiocbq->context3 = bmp; -@@ -6004,7 +6003,7 @@ lpfc_bsg_timeout(struct bsg_job *job) - - spin_lock_irqsave(&phba->hbalock, flags); - /* make sure the I/O abort window is still open */ -- if (!(cmdiocb->iocb_flag & LPFC_IO_CMD_OUTSTANDING)) { -+ if (!(cmdiocb->cmd_flag & LPFC_IO_CMD_OUTSTANDING)) { - spin_unlock_irqrestore(&phba->hbalock, flags); - return -EAGAIN; - } ---- a/drivers/scsi/lpfc/lpfc_crtn.h -+++ b/drivers/scsi/lpfc/lpfc_crtn.h -@@ -212,7 +212,7 @@ int lpfc_sli4_refresh_params(struct lpfc - int lpfc_hba_down_prep(struct lpfc_hba *); - int lpfc_hba_down_post(struct lpfc_hba *); - void lpfc_hba_init(struct lpfc_hba *, uint32_t *); --int lpfc_post_buffer(struct lpfc_hba *, struct lpfc_sli_ring *, int); -+int lpfc_sli3_post_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, int cnt); - void lpfc_decode_firmware_rev(struct lpfc_hba *, char *, int); - int lpfc_online(struct lpfc_hba *); - void lpfc_unblock_mgmt_io(struct lpfc_hba *); -@@ -606,7 +606,7 @@ void lpfc_nvmet_unsol_fcp_event(struct l - void lpfc_nvme_mod_param_dep(struct lpfc_hba *phba); - void lpfc_nvme_abort_fcreq_cmpl(struct lpfc_hba *phba, - struct lpfc_iocbq *cmdiocb, -- struct lpfc_wcqe_complete *abts_cmpl); -+ struct lpfc_iocbq *rspwqe); - void lpfc_create_multixri_pools(struct lpfc_hba *phba); - void lpfc_create_destroy_pools(struct lpfc_hba *phba); - void lpfc_move_xri_pvt_to_pbl(struct lpfc_hba *phba, u32 hwqid); ---- a/drivers/scsi/lpfc/lpfc_ct.c -+++ b/drivers/scsi/lpfc/lpfc_ct.c -@@ -237,7 +237,7 @@ lpfc_ct_reject_event(struct lpfc_nodelis - cmdiocbq->context1 = lpfc_nlp_get(ndlp); - cmdiocbq->context2 = (uint8_t *)mp; - cmdiocbq->context3 = (uint8_t *)bmp; -- cmdiocbq->iocb_cmpl = lpfc_ct_unsol_cmpl; -+ cmdiocbq->cmd_cmpl = lpfc_ct_unsol_cmpl; - icmd->ulpContext = rx_id; /* Xri / rx_id */ - icmd->unsli3.rcvsli3.ox_id = ox_id; - icmd->un.ulpWord[3] = -@@ -368,7 +368,7 @@ lpfc_ct_unsol_event(struct lpfc_hba *phb - /* Not enough posted buffers; Try posting more buffers */ - phba->fc_stat.NoRcvBuf++; - if (!(phba->sli3_options & LPFC_SLI3_HBQ_ENABLED)) -- lpfc_post_buffer(phba, pring, 2); -+ lpfc_sli3_post_buffer(phba, pring, 2); - return; - } - -@@ -445,7 +445,7 @@ lpfc_ct_unsol_event(struct lpfc_hba *phb - lpfc_ct_unsol_buffer(phba, iocbq, mp, size); - lpfc_in_buf_free(phba, mp); - } -- lpfc_post_buffer(phba, pring, i); -+ lpfc_sli3_post_buffer(phba, pring, i); - } - list_del(&head); - } -@@ -650,7 +650,7 @@ lpfc_gen_req(struct lpfc_vport *vport, s - "Data: x%x x%x\n", - ndlp->nlp_DID, icmd->ulpIoTag, - vport->port_state); -- geniocb->iocb_cmpl = cmpl; -+ geniocb->cmd_cmpl = cmpl; - geniocb->drvrTimeout = icmd->ulpTimeout + LPFC_DRVR_TIMEOUT; - geniocb->vport = vport; - geniocb->retry = retry; ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -185,23 +185,23 @@ lpfc_prep_els_iocb(struct lpfc_vport *vp - (elscmd == ELS_CMD_LOGO))) - switch (elscmd) { - case ELS_CMD_FLOGI: -- elsiocb->iocb_flag |= -+ elsiocb->cmd_flag |= - ((LPFC_ELS_ID_FLOGI << LPFC_FIP_ELS_ID_SHIFT) - & LPFC_FIP_ELS_ID_MASK); - break; - case ELS_CMD_FDISC: -- elsiocb->iocb_flag |= -+ elsiocb->cmd_flag |= - ((LPFC_ELS_ID_FDISC << LPFC_FIP_ELS_ID_SHIFT) - & LPFC_FIP_ELS_ID_MASK); - break; - case ELS_CMD_LOGO: -- elsiocb->iocb_flag |= -+ elsiocb->cmd_flag |= - ((LPFC_ELS_ID_LOGO << LPFC_FIP_ELS_ID_SHIFT) - & LPFC_FIP_ELS_ID_MASK); - break; - } - else -- elsiocb->iocb_flag &= ~LPFC_FIP_ELS_ID_MASK; -+ elsiocb->cmd_flag &= ~LPFC_FIP_ELS_ID_MASK; - - icmd = &elsiocb->iocb; - -@@ -1242,10 +1242,10 @@ lpfc_cmpl_els_link_down(struct lpfc_hba - "6445 ELS completes after LINK_DOWN: " - " Status %x/%x cmd x%x flg x%x\n", - irsp->ulpStatus, irsp->un.ulpWord[4], cmd, -- cmdiocb->iocb_flag); -+ cmdiocb->cmd_flag); - -- if (cmdiocb->iocb_flag & LPFC_IO_FABRIC) { -- cmdiocb->iocb_flag &= ~LPFC_IO_FABRIC; -+ if (cmdiocb->cmd_flag & LPFC_IO_FABRIC) { -+ cmdiocb->cmd_flag &= ~LPFC_IO_FABRIC; - atomic_dec(&phba->fabric_iocb_count); - } - lpfc_els_free_iocb(phba, cmdiocb); -@@ -1348,7 +1348,7 @@ lpfc_issue_els_flogi(struct lpfc_vport * - phba->fc_ratov = tmo; - - phba->fc_stat.elsXmitFLOGI++; -- elsiocb->iocb_cmpl = lpfc_cmpl_els_flogi; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_flogi; - - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, - "Issue FLOGI: opt:x%x", -@@ -1441,7 +1441,7 @@ lpfc_els_abort_flogi(struct lpfc_hba *ph - if (ndlp && ndlp->nlp_DID == Fabric_DID) { - if ((phba->pport->fc_flag & FC_PT2PT) && - !(phba->pport->fc_flag & FC_PT2PT_PLOGI)) -- iocb->fabric_iocb_cmpl = -+ iocb->fabric_cmd_cmpl = - lpfc_ignore_els_cmpl; - lpfc_sli_issue_abort_iotag(phba, pring, iocb, - NULL); -@@ -2178,7 +2178,7 @@ lpfc_issue_els_plogi(struct lpfc_vport * - } - - phba->fc_stat.elsXmitPLOGI++; -- elsiocb->iocb_cmpl = lpfc_cmpl_els_plogi; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_plogi; - - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, - "Issue PLOGI: did:x%x refcnt %d", -@@ -2437,7 +2437,7 @@ lpfc_issue_els_prli(struct lpfc_vport *v - /* For FCP support */ - npr->prliType = PRLI_FCP_TYPE; - npr->initiatorFunc = 1; -- elsiocb->iocb_flag |= LPFC_PRLI_FCP_REQ; -+ elsiocb->cmd_flag |= LPFC_PRLI_FCP_REQ; - - /* Remove FCP type - processed. */ - local_nlp_type &= ~NLP_FC4_FCP; -@@ -2471,14 +2471,14 @@ lpfc_issue_els_prli(struct lpfc_vport *v - - npr_nvme->word1 = cpu_to_be32(npr_nvme->word1); - npr_nvme->word4 = cpu_to_be32(npr_nvme->word4); -- elsiocb->iocb_flag |= LPFC_PRLI_NVME_REQ; -+ elsiocb->cmd_flag |= LPFC_PRLI_NVME_REQ; - - /* Remove NVME type - processed. */ - local_nlp_type &= ~NLP_FC4_NVME; - } - - phba->fc_stat.elsXmitPRLI++; -- elsiocb->iocb_cmpl = lpfc_cmpl_els_prli; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_prli; - spin_lock_irq(&ndlp->lock); - ndlp->nlp_flag |= NLP_PRLI_SND; - -@@ -2801,7 +2801,7 @@ lpfc_issue_els_adisc(struct lpfc_vport * - ap->DID = be32_to_cpu(vport->fc_myDID); - - phba->fc_stat.elsXmitADISC++; -- elsiocb->iocb_cmpl = lpfc_cmpl_els_adisc; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_adisc; - spin_lock_irq(&ndlp->lock); - ndlp->nlp_flag |= NLP_ADISC_SND; - spin_unlock_irq(&ndlp->lock); -@@ -3024,7 +3024,7 @@ lpfc_issue_els_logo(struct lpfc_vport *v - memcpy(pcmd, &vport->fc_portname, sizeof(struct lpfc_name)); - - phba->fc_stat.elsXmitLOGO++; -- elsiocb->iocb_cmpl = lpfc_cmpl_els_logo; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_logo; - spin_lock_irq(&ndlp->lock); - ndlp->nlp_flag |= NLP_LOGO_SND; - ndlp->nlp_flag &= ~NLP_ISSUE_LOGO; -@@ -3376,7 +3376,7 @@ lpfc_issue_els_scr(struct lpfc_vport *vp - ndlp->nlp_DID, 0, 0); - - phba->fc_stat.elsXmitSCR++; -- elsiocb->iocb_cmpl = lpfc_cmpl_els_disc_cmd; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_disc_cmd; - elsiocb->context1 = lpfc_nlp_get(ndlp); - if (!elsiocb->context1) { - lpfc_els_free_iocb(phba, elsiocb); -@@ -3473,7 +3473,7 @@ lpfc_issue_els_rscn(struct lpfc_vport *v - event->portid.rscn_fid[2] = nportid & 0x000000FF; - - phba->fc_stat.elsXmitRSCN++; -- elsiocb->iocb_cmpl = lpfc_cmpl_els_cmd; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_cmd; - elsiocb->context1 = lpfc_nlp_get(ndlp); - if (!elsiocb->context1) { - lpfc_els_free_iocb(phba, elsiocb); -@@ -3572,7 +3572,7 @@ lpfc_issue_els_farpr(struct lpfc_vport * - ndlp->nlp_DID, 0, 0); - - phba->fc_stat.elsXmitFARPR++; -- elsiocb->iocb_cmpl = lpfc_cmpl_els_cmd; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_cmd; - elsiocb->context1 = lpfc_nlp_get(ndlp); - if (!elsiocb->context1) { - lpfc_els_free_iocb(phba, elsiocb); -@@ -3663,7 +3663,7 @@ lpfc_issue_els_rdf(struct lpfc_vport *vp - phba->cgn_reg_fpin); - - phba->cgn_fpin_frequency = LPFC_FPIN_INIT_FREQ; -- elsiocb->iocb_cmpl = lpfc_cmpl_els_disc_cmd; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_disc_cmd; - elsiocb->context1 = lpfc_nlp_get(ndlp); - if (!elsiocb->context1) { - lpfc_els_free_iocb(phba, elsiocb); -@@ -4134,7 +4134,7 @@ lpfc_issue_els_edc(struct lpfc_vport *vp - ndlp->nlp_DID, phba->cgn_reg_signal, - phba->cgn_reg_fpin); - -- elsiocb->iocb_cmpl = lpfc_cmpl_els_disc_cmd; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_disc_cmd; - elsiocb->context1 = lpfc_nlp_get(ndlp); - if (!elsiocb->context1) { - lpfc_els_free_iocb(phba, elsiocb); -@@ -4961,12 +4961,12 @@ lpfc_els_free_iocb(struct lpfc_hba *phba - - /* context2 = cmd, context2->next = rsp, context3 = bpl */ - if (elsiocb->context2) { -- if (elsiocb->iocb_flag & LPFC_DELAY_MEM_FREE) { -+ if (elsiocb->cmd_flag & LPFC_DELAY_MEM_FREE) { - /* Firmware could still be in progress of DMAing - * payload, so don't free data buffer till after - * a hbeat. - */ -- elsiocb->iocb_flag &= ~LPFC_DELAY_MEM_FREE; -+ elsiocb->cmd_flag &= ~LPFC_DELAY_MEM_FREE; - buf_ptr = elsiocb->context2; - elsiocb->context2 = NULL; - if (buf_ptr) { -@@ -5474,9 +5474,9 @@ lpfc_els_rsp_acc(struct lpfc_vport *vpor - ndlp->nlp_flag & NLP_REG_LOGIN_SEND)) - ndlp->nlp_flag &= ~NLP_LOGO_ACC; - spin_unlock_irq(&ndlp->lock); -- elsiocb->iocb_cmpl = lpfc_cmpl_els_logo_acc; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_logo_acc; - } else { -- elsiocb->iocb_cmpl = lpfc_cmpl_els_rsp; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_rsp; - } - - phba->fc_stat.elsXmitACC++; -@@ -5571,7 +5571,7 @@ lpfc_els_rsp_reject(struct lpfc_vport *v - ndlp->nlp_DID, ndlp->nlp_flag, rejectError); - - phba->fc_stat.elsXmitLSRJT++; -- elsiocb->iocb_cmpl = lpfc_cmpl_els_rsp; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_rsp; - elsiocb->context1 = lpfc_nlp_get(ndlp); - if (!elsiocb->context1) { - lpfc_els_free_iocb(phba, elsiocb); -@@ -5652,7 +5652,7 @@ lpfc_issue_els_edc_rsp(struct lpfc_vport - "Issue EDC ACC: did:x%x flg:x%x refcnt %d", - ndlp->nlp_DID, ndlp->nlp_flag, - kref_read(&ndlp->kref)); -- elsiocb->iocb_cmpl = lpfc_cmpl_els_rsp; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_rsp; - - phba->fc_stat.elsXmitACC++; - elsiocb->context1 = lpfc_nlp_get(ndlp); -@@ -5745,7 +5745,7 @@ lpfc_els_rsp_adisc_acc(struct lpfc_vport - ndlp->nlp_DID, ndlp->nlp_flag, kref_read(&ndlp->kref)); - - phba->fc_stat.elsXmitACC++; -- elsiocb->iocb_cmpl = lpfc_cmpl_els_rsp; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_rsp; - elsiocb->context1 = lpfc_nlp_get(ndlp); - if (!elsiocb->context1) { - lpfc_els_free_iocb(phba, elsiocb); -@@ -5919,7 +5919,7 @@ lpfc_els_rsp_prli_acc(struct lpfc_vport - ndlp->nlp_DID, ndlp->nlp_flag, kref_read(&ndlp->kref)); - - phba->fc_stat.elsXmitACC++; -- elsiocb->iocb_cmpl = lpfc_cmpl_els_rsp; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_rsp; - elsiocb->context1 = lpfc_nlp_get(ndlp); - if (!elsiocb->context1) { - lpfc_els_free_iocb(phba, elsiocb); -@@ -6020,7 +6020,7 @@ lpfc_els_rsp_rnid_acc(struct lpfc_vport - ndlp->nlp_DID, ndlp->nlp_flag, kref_read(&ndlp->kref)); - - phba->fc_stat.elsXmitACC++; -- elsiocb->iocb_cmpl = lpfc_cmpl_els_rsp; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_rsp; - elsiocb->context1 = lpfc_nlp_get(ndlp); - if (!elsiocb->context1) { - lpfc_els_free_iocb(phba, elsiocb); -@@ -6134,7 +6134,7 @@ lpfc_els_rsp_echo_acc(struct lpfc_vport - ndlp->nlp_DID, ndlp->nlp_flag, kref_read(&ndlp->kref)); - - phba->fc_stat.elsXmitACC++; -- elsiocb->iocb_cmpl = lpfc_cmpl_els_rsp; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_rsp; - elsiocb->context1 = lpfc_nlp_get(ndlp); - if (!elsiocb->context1) { - lpfc_els_free_iocb(phba, elsiocb); -@@ -6798,7 +6798,7 @@ lpfc_els_rdp_cmpl(struct lpfc_hba *phba, - rdp_context->page_a0, vport); - - rdp_res->length = cpu_to_be32(len - 8); -- elsiocb->iocb_cmpl = lpfc_cmpl_els_rsp; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_rsp; - - /* Now that we know the true size of the payload, update the BPL */ - bpl = (struct ulp_bde64 *) -@@ -6839,7 +6839,7 @@ lpfc_els_rdp_cmpl(struct lpfc_hba *phba, - stat->un.b.lsRjtRsnCode = LSRJT_UNABLE_TPC; - - phba->fc_stat.elsXmitLSRJT++; -- elsiocb->iocb_cmpl = lpfc_cmpl_els_rsp; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_rsp; - elsiocb->context1 = lpfc_nlp_get(ndlp); - if (!elsiocb->context1) { - lpfc_els_free_iocb(phba, elsiocb); -@@ -7061,7 +7061,7 @@ lpfc_els_lcb_rsp(struct lpfc_hba *phba, - lcb_res->capability = lcb_context->capability; - lcb_res->lcb_frequency = lcb_context->frequency; - lcb_res->lcb_duration = lcb_context->duration; -- elsiocb->iocb_cmpl = lpfc_cmpl_els_rsp; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_rsp; - phba->fc_stat.elsXmitACC++; - - elsiocb->context1 = lpfc_nlp_get(ndlp); -@@ -7100,7 +7100,7 @@ lpfc_els_lcb_rsp(struct lpfc_hba *phba, - if (shdr_add_status == ADD_STATUS_OPERATION_ALREADY_ACTIVE) - stat->un.b.lsRjtRsnCodeExp = LSEXP_CMD_IN_PROGRESS; - -- elsiocb->iocb_cmpl = lpfc_cmpl_els_rsp; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_rsp; - phba->fc_stat.elsXmitLSRJT++; - elsiocb->context1 = lpfc_nlp_get(ndlp); - if (!elsiocb->context1) { -@@ -8167,7 +8167,7 @@ lpfc_els_rsp_rls_acc(struct lpfc_hba *ph - elsiocb->iotag, elsiocb->iocb.ulpContext, - ndlp->nlp_DID, ndlp->nlp_flag, ndlp->nlp_state, - ndlp->nlp_rpi); -- elsiocb->iocb_cmpl = lpfc_cmpl_els_rsp; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_rsp; - phba->fc_stat.elsXmitACC++; - elsiocb->context1 = lpfc_nlp_get(ndlp); - if (!elsiocb->context1) { -@@ -8319,7 +8319,7 @@ lpfc_els_rcv_rtv(struct lpfc_vport *vpor - ndlp->nlp_DID, ndlp->nlp_flag, ndlp->nlp_state, - ndlp->nlp_rpi, - rtv_rsp->ratov, rtv_rsp->edtov, rtv_rsp->qtov); -- elsiocb->iocb_cmpl = lpfc_cmpl_els_rsp; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_rsp; - phba->fc_stat.elsXmitACC++; - elsiocb->context1 = lpfc_nlp_get(ndlp); - if (!elsiocb->context1) { -@@ -8396,7 +8396,7 @@ lpfc_issue_els_rrq(struct lpfc_vport *vp - "Issue RRQ: did:x%x", - did, rrq->xritag, rrq->rxid); - elsiocb->context_un.rrq = rrq; -- elsiocb->iocb_cmpl = lpfc_cmpl_els_rrq; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_rrq; - - lpfc_nlp_get(ndlp); - elsiocb->context1 = ndlp; -@@ -8502,7 +8502,7 @@ lpfc_els_rsp_rpl_acc(struct lpfc_vport * - elsiocb->iotag, elsiocb->iocb.ulpContext, - ndlp->nlp_DID, ndlp->nlp_flag, ndlp->nlp_state, - ndlp->nlp_rpi); -- elsiocb->iocb_cmpl = lpfc_cmpl_els_rsp; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_rsp; - phba->fc_stat.elsXmitACC++; - elsiocb->context1 = lpfc_nlp_get(ndlp); - if (!elsiocb->context1) { -@@ -8942,7 +8942,7 @@ lpfc_els_timeout_handler(struct lpfc_vpo - list_for_each_entry_safe(piocb, tmp_iocb, &pring->txcmplq, list) { - cmd = &piocb->iocb; - -- if ((piocb->iocb_flag & LPFC_IO_LIBDFC) != 0 || -+ if ((piocb->cmd_flag & LPFC_IO_LIBDFC) != 0 || - piocb->iocb.ulpCommand == CMD_ABORT_XRI_CN || - piocb->iocb.ulpCommand == CMD_CLOSE_XRI_CN) - continue; -@@ -9055,13 +9055,13 @@ lpfc_els_flush_cmd(struct lpfc_vport *vp - - /* First we need to issue aborts to outstanding cmds on txcmpl */ - list_for_each_entry_safe(piocb, tmp_iocb, &pring->txcmplq, list) { -- if (piocb->iocb_flag & LPFC_IO_LIBDFC) -+ if (piocb->cmd_flag & LPFC_IO_LIBDFC) - continue; - - if (piocb->vport != vport) - continue; - -- if (piocb->iocb_flag & LPFC_DRIVER_ABORTED) -+ if (piocb->cmd_flag & LPFC_DRIVER_ABORTED) - continue; - - /* On the ELS ring we can have ELS_REQUESTs or -@@ -9079,7 +9079,7 @@ lpfc_els_flush_cmd(struct lpfc_vport *vp - * and avoid any retry logic. - */ - if (phba->link_state == LPFC_LINK_DOWN) -- piocb->iocb_cmpl = lpfc_cmpl_els_link_down; -+ piocb->cmd_cmpl = lpfc_cmpl_els_link_down; - } - if (cmd->ulpCommand == CMD_GEN_REQUEST64_CR) - list_add_tail(&piocb->dlist, &abort_list); -@@ -9114,9 +9114,8 @@ lpfc_els_flush_cmd(struct lpfc_vport *vp - list_for_each_entry_safe(piocb, tmp_iocb, &pring->txq, list) { - cmd = &piocb->iocb; - -- if (piocb->iocb_flag & LPFC_IO_LIBDFC) { -+ if (piocb->cmd_flag & LPFC_IO_LIBDFC) - continue; -- } - - /* Do not flush out the QUE_RING and ABORT/CLOSE iocbs */ - if (cmd->ulpCommand == CMD_QUE_RING_BUF_CN || -@@ -9759,7 +9758,7 @@ lpfc_els_unsol_buffer(struct lpfc_hba *p - payload_len = elsiocb->iocb.unsli3.rcvsli3.acc_len; - cmd = *payload; - if ((phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) == 0) -- lpfc_post_buffer(phba, pring, 1); -+ lpfc_sli3_post_buffer(phba, pring, 1); - - did = icmd->un.rcvels.remoteID; - if (icmd->ulpStatus) { -@@ -10232,7 +10231,7 @@ lpfc_els_unsol_event(struct lpfc_hba *ph - phba->fc_stat.NoRcvBuf++; - /* Not enough posted buffers; Try posting more buffers */ - if (!(phba->sli3_options & LPFC_SLI3_HBQ_ENABLED)) -- lpfc_post_buffer(phba, pring, 0); -+ lpfc_sli3_post_buffer(phba, pring, 0); - return; - } - -@@ -10868,7 +10867,7 @@ lpfc_issue_els_fdisc(struct lpfc_vport * - lpfc_set_disctmo(vport); - - phba->fc_stat.elsXmitFDISC++; -- elsiocb->iocb_cmpl = lpfc_cmpl_els_fdisc; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_fdisc; - - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, - "Issue FDISC: did:x%x", -@@ -11001,7 +11000,7 @@ lpfc_issue_els_npiv_logo(struct lpfc_vpo - "Issue LOGO npiv did:x%x flg:x%x", - ndlp->nlp_DID, ndlp->nlp_flag, 0); - -- elsiocb->iocb_cmpl = lpfc_cmpl_els_npiv_logo; -+ elsiocb->cmd_cmpl = lpfc_cmpl_els_npiv_logo; - spin_lock_irq(&ndlp->lock); - ndlp->nlp_flag |= NLP_LOGO_SND; - spin_unlock_irq(&ndlp->lock); -@@ -11086,9 +11085,9 @@ lpfc_resume_fabric_iocbs(struct lpfc_hba - } - spin_unlock_irqrestore(&phba->hbalock, iflags); - if (iocb) { -- iocb->fabric_iocb_cmpl = iocb->iocb_cmpl; -- iocb->iocb_cmpl = lpfc_cmpl_fabric_iocb; -- iocb->iocb_flag |= LPFC_IO_FABRIC; -+ iocb->fabric_cmd_cmpl = iocb->cmd_cmpl; -+ iocb->cmd_cmpl = lpfc_cmpl_fabric_iocb; -+ iocb->cmd_flag |= LPFC_IO_FABRIC; - - lpfc_debugfs_disc_trc(iocb->vport, LPFC_DISC_TRC_ELS_CMD, - "Fabric sched1: ste:x%x", -@@ -11097,13 +11096,13 @@ lpfc_resume_fabric_iocbs(struct lpfc_hba - ret = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, iocb, 0); - - if (ret == IOCB_ERROR) { -- iocb->iocb_cmpl = iocb->fabric_iocb_cmpl; -- iocb->fabric_iocb_cmpl = NULL; -- iocb->iocb_flag &= ~LPFC_IO_FABRIC; -+ iocb->cmd_cmpl = iocb->fabric_cmd_cmpl; -+ iocb->fabric_cmd_cmpl = NULL; -+ iocb->cmd_flag &= ~LPFC_IO_FABRIC; - cmd = &iocb->iocb; - cmd->ulpStatus = IOSTAT_LOCAL_REJECT; - cmd->un.ulpWord[4] = IOERR_SLI_ABORTED; -- iocb->iocb_cmpl(phba, iocb, iocb); -+ iocb->cmd_cmpl(phba, iocb, iocb); - - atomic_dec(&phba->fabric_iocb_count); - goto repeat; -@@ -11159,8 +11158,8 @@ lpfc_block_fabric_iocbs(struct lpfc_hba - * @rspiocb: pointer to lpfc response iocb data structure. - * - * This routine is the callback function that is put to the fabric iocb's -- * callback function pointer (iocb->iocb_cmpl). The original iocb's callback -- * function pointer has been stored in iocb->fabric_iocb_cmpl. This callback -+ * callback function pointer (iocb->cmd_cmpl). The original iocb's callback -+ * function pointer has been stored in iocb->fabric_cmd_cmpl. This callback - * function first restores and invokes the original iocb's callback function - * and then invokes the lpfc_resume_fabric_iocbs() routine to issue the next - * fabric bound iocb from the driver internal fabric iocb list onto the wire. -@@ -11171,7 +11170,7 @@ lpfc_cmpl_fabric_iocb(struct lpfc_hba *p - { - struct ls_rjt stat; - -- BUG_ON((cmdiocb->iocb_flag & LPFC_IO_FABRIC) != LPFC_IO_FABRIC); -+ WARN_ON((cmdiocb->cmd_flag & LPFC_IO_FABRIC) != LPFC_IO_FABRIC); - - switch (rspiocb->iocb.ulpStatus) { - case IOSTAT_NPORT_RJT: -@@ -11197,10 +11196,10 @@ lpfc_cmpl_fabric_iocb(struct lpfc_hba *p - - BUG_ON(atomic_read(&phba->fabric_iocb_count) == 0); - -- cmdiocb->iocb_cmpl = cmdiocb->fabric_iocb_cmpl; -- cmdiocb->fabric_iocb_cmpl = NULL; -- cmdiocb->iocb_flag &= ~LPFC_IO_FABRIC; -- cmdiocb->iocb_cmpl(phba, cmdiocb, rspiocb); -+ cmdiocb->cmd_cmpl = cmdiocb->fabric_cmd_cmpl; -+ cmdiocb->fabric_cmd_cmpl = NULL; -+ cmdiocb->cmd_flag &= ~LPFC_IO_FABRIC; -+ cmdiocb->cmd_cmpl(phba, cmdiocb, rspiocb); - - atomic_dec(&phba->fabric_iocb_count); - if (!test_bit(FABRIC_COMANDS_BLOCKED, &phba->bit_flags)) { -@@ -11251,9 +11250,9 @@ lpfc_issue_fabric_iocb(struct lpfc_hba * - atomic_inc(&phba->fabric_iocb_count); - spin_unlock_irqrestore(&phba->hbalock, iflags); - if (ready) { -- iocb->fabric_iocb_cmpl = iocb->iocb_cmpl; -- iocb->iocb_cmpl = lpfc_cmpl_fabric_iocb; -- iocb->iocb_flag |= LPFC_IO_FABRIC; -+ iocb->fabric_cmd_cmpl = iocb->cmd_cmpl; -+ iocb->cmd_cmpl = lpfc_cmpl_fabric_iocb; -+ iocb->cmd_flag |= LPFC_IO_FABRIC; - - lpfc_debugfs_disc_trc(iocb->vport, LPFC_DISC_TRC_ELS_CMD, - "Fabric sched2: ste:x%x", -@@ -11262,9 +11261,9 @@ lpfc_issue_fabric_iocb(struct lpfc_hba * - ret = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, iocb, 0); - - if (ret == IOCB_ERROR) { -- iocb->iocb_cmpl = iocb->fabric_iocb_cmpl; -- iocb->fabric_iocb_cmpl = NULL; -- iocb->iocb_flag &= ~LPFC_IO_FABRIC; -+ iocb->cmd_cmpl = iocb->fabric_cmd_cmpl; -+ iocb->fabric_cmd_cmpl = NULL; -+ iocb->cmd_flag &= ~LPFC_IO_FABRIC; - atomic_dec(&phba->fabric_iocb_count); - } - } else { ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -1018,7 +1018,7 @@ lpfc_hba_clean_txcmplq(struct lpfc_hba * - spin_lock_irq(&pring->ring_lock); - list_for_each_entry_safe(piocb, next_iocb, - &pring->txcmplq, list) -- piocb->iocb_flag &= ~LPFC_IO_ON_TXCMPLQ; -+ piocb->cmd_flag &= ~LPFC_IO_ON_TXCMPLQ; - list_splice_init(&pring->txcmplq, &completions); - pring->txcmplq_cnt = 0; - spin_unlock_irq(&pring->ring_lock); -@@ -2679,7 +2679,7 @@ lpfc_get_hba_model_desc(struct lpfc_hba - } - - /** -- * lpfc_post_buffer - Post IOCB(s) with DMA buffer descriptor(s) to a IOCB ring -+ * lpfc_sli3_post_buffer - Post IOCB(s) with DMA buffer descriptor(s) to a IOCB ring - * @phba: pointer to lpfc hba data structure. - * @pring: pointer to a IOCB ring. - * @cnt: the number of IOCBs to be posted to the IOCB ring. -@@ -2691,7 +2691,7 @@ lpfc_get_hba_model_desc(struct lpfc_hba - * The number of IOCBs NOT able to be posted to the IOCB ring. - **/ - int --lpfc_post_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, int cnt) -+lpfc_sli3_post_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, int cnt) - { - IOCB_t *icmd; - struct lpfc_iocbq *iocb; -@@ -2797,7 +2797,7 @@ lpfc_post_rcv_buf(struct lpfc_hba *phba) - struct lpfc_sli *psli = &phba->sli; - - /* Ring 0, ELS / CT buffers */ -- lpfc_post_buffer(phba, &psli->sli3_ring[LPFC_ELS_RING], LPFC_BUF_RING0); -+ lpfc_sli3_post_buffer(phba, &psli->sli3_ring[LPFC_ELS_RING], LPFC_BUF_RING0); - /* Ring 2 - FCP no buffers needed */ - - return 0; -@@ -4247,8 +4247,7 @@ lpfc_io_buf_replenish(struct lpfc_hba *p - qp = &phba->sli4_hba.hdwq[idx]; - lpfc_cmd->hdwq_no = idx; - lpfc_cmd->hdwq = qp; -- lpfc_cmd->cur_iocbq.wqe_cmpl = NULL; -- lpfc_cmd->cur_iocbq.iocb_cmpl = NULL; -+ lpfc_cmd->cur_iocbq.cmd_cmpl = NULL; - spin_lock(&qp->io_buf_list_put_lock); - list_add_tail(&lpfc_cmd->list, - &qp->lpfc_io_buf_list_put); ---- a/drivers/scsi/lpfc/lpfc_nportdisc.c -+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c -@@ -2130,9 +2130,9 @@ lpfc_cmpl_prli_prli_issue(struct lpfc_vp - npr = NULL; - nvpr = NULL; - temp_ptr = lpfc_check_elscmpl_iocb(phba, cmdiocb, rspiocb); -- if (cmdiocb->iocb_flag & LPFC_PRLI_FCP_REQ) -+ if (cmdiocb->cmd_flag & LPFC_PRLI_FCP_REQ) - npr = (PRLI *) temp_ptr; -- else if (cmdiocb->iocb_flag & LPFC_PRLI_NVME_REQ) -+ else if (cmdiocb->cmd_flag & LPFC_PRLI_NVME_REQ) - nvpr = (struct lpfc_nvme_prli *) temp_ptr; - - irsp = &rspiocb->iocb; ---- a/drivers/scsi/lpfc/lpfc_nvme.c -+++ b/drivers/scsi/lpfc/lpfc_nvme.c -@@ -237,9 +237,10 @@ lpfc_nvme_remoteport_delete(struct nvme_ - - static void - lpfc_nvme_cmpl_gen_req(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe, -- struct lpfc_wcqe_complete *wcqe) -+ struct lpfc_iocbq *rspwqe) - { - struct lpfc_vport *vport = cmdwqe->vport; -+ struct lpfc_wcqe_complete *wcqe = &rspwqe->wcqe_cmpl; - struct lpfc_nvme_lport *lport; - uint32_t status; - struct nvmefc_ls_req *pnvme_lsreq; -@@ -300,7 +301,7 @@ lpfc_nvme_gen_req(struct lpfc_vport *vpo - struct lpfc_dmabuf *inp, - struct nvmefc_ls_req *pnvme_lsreq, - void (*cmpl)(struct lpfc_hba *, struct lpfc_iocbq *, -- struct lpfc_wcqe_complete *), -+ struct lpfc_iocbq *), - struct lpfc_nodelist *ndlp, uint32_t num_entry, - uint32_t tmo, uint8_t retry) - { -@@ -321,7 +322,7 @@ lpfc_nvme_gen_req(struct lpfc_vport *vpo - memset(wqe, 0, sizeof(union lpfc_wqe)); - - genwqe->context3 = (uint8_t *)bmp; -- genwqe->iocb_flag |= LPFC_IO_NVME_LS; -+ genwqe->cmd_flag |= LPFC_IO_NVME_LS; - - /* Save for completion so we can release these resources */ - genwqe->context1 = lpfc_nlp_get(ndlp); -@@ -352,7 +353,7 @@ lpfc_nvme_gen_req(struct lpfc_vport *vpo - first_len = xmit_len; - } - -- genwqe->rsvd2 = num_entry; -+ genwqe->num_bdes = num_entry; - genwqe->hba_wqidx = 0; - - /* Words 0 - 2 */ -@@ -410,8 +411,7 @@ lpfc_nvme_gen_req(struct lpfc_vport *vpo - ndlp->nlp_DID, genwqe->iotag, - vport->port_state, - genwqe, pnvme_lsreq, bmp, xmit_len, first_len); -- genwqe->wqe_cmpl = cmpl; -- genwqe->iocb_cmpl = NULL; -+ genwqe->cmd_cmpl = cmpl; - genwqe->drvrTimeout = tmo + LPFC_DRVR_TIMEOUT; - genwqe->vport = vport; - genwqe->retry = retry; -@@ -633,7 +633,7 @@ lpfc_nvme_ls_abort(struct nvme_fc_local_ - list_for_each_entry_safe(wqe, next_wqe, &pring->txcmplq, list) { - /* Add to abort_list on on NDLP match. */ - if (lpfc_check_sli_ndlp(phba, pring, wqe, ndlp)) { -- wqe->iocb_flag |= LPFC_DRIVER_ABORTED; -+ wqe->cmd_flag |= LPFC_DRIVER_ABORTED; - list_add_tail(&wqe->dlist, &abort_list); - } - } -@@ -749,7 +749,7 @@ lpfc_nvme_adj_fcp_sgls(struct lpfc_vport - - - /** -- * lpfc_nvme_io_cmd_wqe_cmpl - Complete an NVME-over-FCP IO -+ * lpfc_nvme_io_cmd_cmpl - Complete an NVME-over-FCP IO - * @lpfc_pnvme: Pointer to the driver's nvme instance data - * @lpfc_nvme_lport: Pointer to the driver's local port data - * @lpfc_nvme_rport: Pointer to the rport getting the @lpfc_nvme_ereq -@@ -763,11 +763,12 @@ lpfc_nvme_adj_fcp_sgls(struct lpfc_vport - * TODO: What are the failure codes. - **/ - static void --lpfc_nvme_io_cmd_wqe_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pwqeIn, -- struct lpfc_wcqe_complete *wcqe) -+lpfc_nvme_io_cmd_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pwqeIn, -+ struct lpfc_iocbq *pwqeOut) - { - struct lpfc_io_buf *lpfc_ncmd = - (struct lpfc_io_buf *)pwqeIn->context1; -+ struct lpfc_wcqe_complete *wcqe = &pwqeOut->wcqe_cmpl; - struct lpfc_vport *vport = pwqeIn->vport; - struct nvmefc_fcp_req *nCmd; - struct nvme_fc_ersp_iu *ep; -@@ -1591,8 +1592,10 @@ lpfc_nvme_fcp_io_submit(struct nvme_fc_l - **/ - void - lpfc_nvme_abort_fcreq_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, -- struct lpfc_wcqe_complete *abts_cmpl) -+ struct lpfc_iocbq *rspwqe) - { -+ struct lpfc_wcqe_complete *abts_cmpl = &rspwqe->wcqe_cmpl; -+ - lpfc_printf_log(phba, KERN_INFO, LOG_NVME, - "6145 ABORT_XRI_CN completing on rpi x%x " - "original iotag x%x, abort cmd iotag x%x " -@@ -1719,7 +1722,7 @@ lpfc_nvme_fcp_abort(struct nvme_fc_local - } - - /* Don't abort IOs no longer on the pending queue. */ -- if (!(nvmereq_wqe->iocb_flag & LPFC_IO_ON_TXCMPLQ)) { -+ if (!(nvmereq_wqe->cmd_flag & LPFC_IO_ON_TXCMPLQ)) { - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, - "6142 NVME IO req x%px not queued - skipping " - "abort req xri x%x\n", -@@ -1733,7 +1736,7 @@ lpfc_nvme_fcp_abort(struct nvme_fc_local - nvmereq_wqe->hba_wqidx, pnvme_rport->port_id); - - /* Outstanding abort is in progress */ -- if (nvmereq_wqe->iocb_flag & LPFC_DRIVER_ABORTED) { -+ if (nvmereq_wqe->cmd_flag & LPFC_DRIVER_ABORTED) { - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, - "6144 Outstanding NVME I/O Abort Request " - "still pending on nvme_fcreq x%px, " -@@ -1828,8 +1831,8 @@ lpfc_get_nvme_buf(struct lpfc_hba *phba, - /* Setup key fields in buffer that may have been changed - * if other protocols used this buffer. - */ -- pwqeq->iocb_flag = LPFC_IO_NVME; -- pwqeq->wqe_cmpl = lpfc_nvme_io_cmd_wqe_cmpl; -+ pwqeq->cmd_flag = LPFC_IO_NVME; -+ pwqeq->cmd_cmpl = lpfc_nvme_io_cmd_cmpl; - lpfc_ncmd->start_time = jiffies; - lpfc_ncmd->flags = 0; - -@@ -2594,6 +2597,7 @@ lpfc_nvme_cancel_iocb(struct lpfc_hba *p - if (phba->sli.sli_flag & LPFC_SLI_ACTIVE) - bf_set(lpfc_wcqe_c_xb, wcqep, 1); - -- (pwqeIn->wqe_cmpl)(phba, pwqeIn, wcqep); -+ memcpy(&pwqeIn->wcqe_cmpl, wcqep, sizeof(*wcqep)); -+ (pwqeIn->cmd_cmpl)(phba, pwqeIn, pwqeIn); - #endif - } ---- a/drivers/scsi/lpfc/lpfc_nvmet.c -+++ b/drivers/scsi/lpfc/lpfc_nvmet.c -@@ -291,7 +291,7 @@ lpfc_nvmet_defer_release(struct lpfc_hba - * lpfc_nvmet_xmt_ls_rsp_cmp - Completion handler for LS Response - * @phba: Pointer to HBA context object. - * @cmdwqe: Pointer to driver command WQE object. -- * @wcqe: Pointer to driver response CQE object. -+ * @rspwqe: Pointer to driver response WQE object. - * - * The function is called from SLI ring event handler with no - * lock held. This function is the completion handler for NVME LS commands -@@ -299,12 +299,13 @@ lpfc_nvmet_defer_release(struct lpfc_hba - **/ - static void - lpfc_nvmet_xmt_ls_rsp_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe, -- struct lpfc_wcqe_complete *wcqe) -+ struct lpfc_iocbq *rspwqe) - { - struct lpfc_nvmet_tgtport *tgtp; - struct nvmefc_tgt_ls_req *rsp; - struct lpfc_nvmet_rcv_ctx *ctxp; - uint32_t status, result; -+ struct lpfc_wcqe_complete *wcqe = &rspwqe->wcqe_cmpl; - - status = bf_get(lpfc_wcqe_c_status, wcqe); - result = wcqe->parameter; -@@ -692,7 +693,7 @@ lpfc_nvmet_ktime(struct lpfc_hba *phba, - * lpfc_nvmet_xmt_fcp_op_cmp - Completion handler for FCP Response - * @phba: Pointer to HBA context object. - * @cmdwqe: Pointer to driver command WQE object. -- * @wcqe: Pointer to driver response CQE object. -+ * @rspwqe: Pointer to driver response WQE object. - * - * The function is called from SLI ring event handler with no - * lock held. This function is the completion handler for NVME FCP commands -@@ -700,7 +701,7 @@ lpfc_nvmet_ktime(struct lpfc_hba *phba, - **/ - static void - lpfc_nvmet_xmt_fcp_op_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe, -- struct lpfc_wcqe_complete *wcqe) -+ struct lpfc_iocbq *rspwqe) - { - struct lpfc_nvmet_tgtport *tgtp; - struct nvmefc_tgt_fcp_req *rsp; -@@ -709,6 +710,7 @@ lpfc_nvmet_xmt_fcp_op_cmp(struct lpfc_hb - #ifdef CONFIG_SCSI_LPFC_DEBUG_FS - int id; - #endif -+ struct lpfc_wcqe_complete *wcqe = &rspwqe->wcqe_cmpl; - - ctxp = cmdwqe->context2; - ctxp->flag &= ~LPFC_NVMET_IO_INP; -@@ -802,7 +804,7 @@ lpfc_nvmet_xmt_fcp_op_cmp(struct lpfc_hb - /* lpfc_nvmet_xmt_fcp_release() will recycle the context */ - } else { - ctxp->entry_cnt++; -- start_clean = offsetof(struct lpfc_iocbq, iocb_flag); -+ start_clean = offsetof(struct lpfc_iocbq, cmd_flag); - memset(((char *)cmdwqe) + start_clean, 0, - (sizeof(struct lpfc_iocbq) - start_clean)); - #ifdef CONFIG_SCSI_LPFC_DEBUG_FS -@@ -872,7 +874,7 @@ lpfc_nvmet_xmt_ls_rsp(struct nvmet_fc_ta - } - - /* Save numBdes for bpl2sgl */ -- nvmewqeq->rsvd2 = 1; -+ nvmewqeq->num_bdes = 1; - nvmewqeq->hba_wqidx = 0; - nvmewqeq->context3 = &dmabuf; - dmabuf.virt = &bpl; -@@ -882,8 +884,7 @@ lpfc_nvmet_xmt_ls_rsp(struct nvmet_fc_ta - bpl.tus.f.bdeFlags = 0; - bpl.tus.w = le32_to_cpu(bpl.tus.w); - -- nvmewqeq->wqe_cmpl = lpfc_nvmet_xmt_ls_rsp_cmp; -- nvmewqeq->iocb_cmpl = NULL; -+ nvmewqeq->cmd_cmpl = lpfc_nvmet_xmt_ls_rsp_cmp; - nvmewqeq->context2 = ctxp; - - lpfc_nvmeio_data(phba, "NVMET LS RESP: xri x%x wqidx x%x len x%x\n", -@@ -980,10 +981,9 @@ lpfc_nvmet_xmt_fcp_op(struct nvmet_fc_ta - goto aerr; - } - -- nvmewqeq->wqe_cmpl = lpfc_nvmet_xmt_fcp_op_cmp; -- nvmewqeq->iocb_cmpl = NULL; -+ nvmewqeq->cmd_cmpl = lpfc_nvmet_xmt_fcp_op_cmp; - nvmewqeq->context2 = ctxp; -- nvmewqeq->iocb_flag |= LPFC_IO_NVMET; -+ nvmewqeq->cmd_flag |= LPFC_IO_NVMET; - ctxp->wqeq->hba_wqidx = rsp->hwqid; - - lpfc_nvmeio_data(phba, "NVMET FCP CMND: xri x%x op x%x len x%x\n", -@@ -1353,7 +1353,7 @@ lpfc_nvmet_setup_io_context(struct lpfc_ - "6406 Ran out of NVMET iocb/WQEs\n"); - return -ENOMEM; - } -- ctx_buf->iocbq->iocb_flag = LPFC_IO_NVMET; -+ ctx_buf->iocbq->cmd_flag = LPFC_IO_NVMET; - nvmewqe = ctx_buf->iocbq; - wqe = &nvmewqe->wqe; - -@@ -1799,8 +1799,10 @@ lpfc_nvmet_wqfull_flush(struct lpfc_hba - list_del(&nvmewqeq->list); - spin_unlock_irqrestore(&pring->ring_lock, - iflags); -+ memcpy(&nvmewqeq->wcqe_cmpl, wcqep, -+ sizeof(*wcqep)); - lpfc_nvmet_xmt_fcp_op_cmp(phba, nvmewqeq, -- wcqep); -+ nvmewqeq); - return; - } - continue; -@@ -1808,7 +1810,8 @@ lpfc_nvmet_wqfull_flush(struct lpfc_hba - /* Flush all IOs */ - list_del(&nvmewqeq->list); - spin_unlock_irqrestore(&pring->ring_lock, iflags); -- lpfc_nvmet_xmt_fcp_op_cmp(phba, nvmewqeq, wcqep); -+ memcpy(&nvmewqeq->wcqe_cmpl, wcqep, sizeof(*wcqep)); -+ lpfc_nvmet_xmt_fcp_op_cmp(phba, nvmewqeq, nvmewqeq); - spin_lock_irqsave(&pring->ring_lock, iflags); - } - } -@@ -2535,7 +2538,7 @@ lpfc_nvmet_prep_ls_wqe(struct lpfc_hba * - nvmewqe->retry = 1; - nvmewqe->vport = phba->pport; - nvmewqe->drvrTimeout = (phba->fc_ratov * 3) + LPFC_DRVR_TIMEOUT; -- nvmewqe->iocb_flag |= LPFC_IO_NVME_LS; -+ nvmewqe->cmd_flag |= LPFC_IO_NVME_LS; - - /* Xmit NVMET response to remote NPORT */ - lpfc_printf_log(phba, KERN_INFO, LOG_NVME_DISC, -@@ -2890,7 +2893,7 @@ lpfc_nvmet_prep_fcp_wqe(struct lpfc_hba - * lpfc_nvmet_sol_fcp_abort_cmp - Completion handler for ABTS - * @phba: Pointer to HBA context object. - * @cmdwqe: Pointer to driver command WQE object. -- * @wcqe: Pointer to driver response CQE object. -+ * @rspwqe: Pointer to driver response WQE object. - * - * The function is called from SLI ring event handler with no - * lock held. This function is the completion handler for NVME ABTS for FCP cmds -@@ -2898,13 +2901,14 @@ lpfc_nvmet_prep_fcp_wqe(struct lpfc_hba - **/ - static void - lpfc_nvmet_sol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe, -- struct lpfc_wcqe_complete *wcqe) -+ struct lpfc_iocbq *rspwqe) - { - struct lpfc_nvmet_rcv_ctx *ctxp; - struct lpfc_nvmet_tgtport *tgtp; - uint32_t result; - unsigned long flags; - bool released = false; -+ struct lpfc_wcqe_complete *wcqe = &rspwqe->wcqe_cmpl; - - ctxp = cmdwqe->context2; - result = wcqe->parameter; -@@ -2959,7 +2963,7 @@ lpfc_nvmet_sol_fcp_abort_cmp(struct lpfc - * lpfc_nvmet_unsol_fcp_abort_cmp - Completion handler for ABTS - * @phba: Pointer to HBA context object. - * @cmdwqe: Pointer to driver command WQE object. -- * @wcqe: Pointer to driver response CQE object. -+ * @rspwqe: Pointer to driver response WQE object. - * - * The function is called from SLI ring event handler with no - * lock held. This function is the completion handler for NVME ABTS for FCP cmds -@@ -2967,13 +2971,14 @@ lpfc_nvmet_sol_fcp_abort_cmp(struct lpfc - **/ - static void - lpfc_nvmet_unsol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe, -- struct lpfc_wcqe_complete *wcqe) -+ struct lpfc_iocbq *rspwqe) - { - struct lpfc_nvmet_rcv_ctx *ctxp; - struct lpfc_nvmet_tgtport *tgtp; - unsigned long flags; - uint32_t result; - bool released = false; -+ struct lpfc_wcqe_complete *wcqe = &rspwqe->wcqe_cmpl; - - ctxp = cmdwqe->context2; - result = wcqe->parameter; -@@ -3040,7 +3045,7 @@ lpfc_nvmet_unsol_fcp_abort_cmp(struct lp - * lpfc_nvmet_xmt_ls_abort_cmp - Completion handler for ABTS - * @phba: Pointer to HBA context object. - * @cmdwqe: Pointer to driver command WQE object. -- * @wcqe: Pointer to driver response CQE object. -+ * @rspwqe: Pointer to driver response WQE object. - * - * The function is called from SLI ring event handler with no - * lock held. This function is the completion handler for NVME ABTS for LS cmds -@@ -3048,11 +3053,12 @@ lpfc_nvmet_unsol_fcp_abort_cmp(struct lp - **/ - static void - lpfc_nvmet_xmt_ls_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe, -- struct lpfc_wcqe_complete *wcqe) -+ struct lpfc_iocbq *rspwqe) - { - struct lpfc_nvmet_rcv_ctx *ctxp; - struct lpfc_nvmet_tgtport *tgtp; - uint32_t result; -+ struct lpfc_wcqe_complete *wcqe = &rspwqe->wcqe_cmpl; - - ctxp = cmdwqe->context2; - result = wcqe->parameter; -@@ -3172,7 +3178,7 @@ lpfc_nvmet_unsol_issue_abort(struct lpfc - abts_wqeq->context1 = ndlp; - abts_wqeq->context2 = ctxp; - abts_wqeq->context3 = NULL; -- abts_wqeq->rsvd2 = 0; -+ abts_wqeq->num_bdes = 0; - /* hba_wqidx should already be setup from command we are aborting */ - abts_wqeq->iocb.ulpCommand = CMD_XMIT_SEQUENCE64_CR; - abts_wqeq->iocb.ulpLe = 1; -@@ -3301,7 +3307,7 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lp - } - - /* Outstanding abort is in progress */ -- if (abts_wqeq->iocb_flag & LPFC_DRIVER_ABORTED) { -+ if (abts_wqeq->cmd_flag & LPFC_DRIVER_ABORTED) { - spin_unlock_irqrestore(&phba->hbalock, flags); - atomic_inc(&tgtp->xmt_abort_rsp_error); - lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, -@@ -3316,15 +3322,14 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lp - } - - /* Ready - mark outstanding as aborted by driver. */ -- abts_wqeq->iocb_flag |= LPFC_DRIVER_ABORTED; -+ abts_wqeq->cmd_flag |= LPFC_DRIVER_ABORTED; - - lpfc_nvmet_prep_abort_wqe(abts_wqeq, ctxp->wqeq->sli4_xritag, opt); - - /* ABTS WQE must go to the same WQ as the WQE to be aborted */ - abts_wqeq->hba_wqidx = ctxp->wqeq->hba_wqidx; -- abts_wqeq->wqe_cmpl = lpfc_nvmet_sol_fcp_abort_cmp; -- abts_wqeq->iocb_cmpl = NULL; -- abts_wqeq->iocb_flag |= LPFC_IO_NVME; -+ abts_wqeq->cmd_cmpl = lpfc_nvmet_sol_fcp_abort_cmp; -+ abts_wqeq->cmd_flag |= LPFC_IO_NVME; - abts_wqeq->context2 = ctxp; - abts_wqeq->vport = phba->pport; - if (!ctxp->hdwq) -@@ -3381,9 +3386,8 @@ lpfc_nvmet_unsol_fcp_issue_abort(struct - - spin_lock_irqsave(&phba->hbalock, flags); - abts_wqeq = ctxp->wqeq; -- abts_wqeq->wqe_cmpl = lpfc_nvmet_unsol_fcp_abort_cmp; -- abts_wqeq->iocb_cmpl = NULL; -- abts_wqeq->iocb_flag |= LPFC_IO_NVMET; -+ abts_wqeq->cmd_cmpl = lpfc_nvmet_unsol_fcp_abort_cmp; -+ abts_wqeq->cmd_flag |= LPFC_IO_NVMET; - if (!ctxp->hdwq) - ctxp->hdwq = &phba->sli4_hba.hdwq[abts_wqeq->hba_wqidx]; - -@@ -3457,9 +3461,8 @@ lpfc_nvmet_unsol_ls_issue_abort(struct l - } - - spin_lock_irqsave(&phba->hbalock, flags); -- abts_wqeq->wqe_cmpl = lpfc_nvmet_xmt_ls_abort_cmp; -- abts_wqeq->iocb_cmpl = NULL; -- abts_wqeq->iocb_flag |= LPFC_IO_NVME_LS; -+ abts_wqeq->cmd_cmpl = lpfc_nvmet_xmt_ls_abort_cmp; -+ abts_wqeq->cmd_flag |= LPFC_IO_NVME_LS; - rc = lpfc_sli4_issue_wqe(phba, ctxp->hdwq, abts_wqeq); - spin_unlock_irqrestore(&phba->hbalock, flags); - if (rc == WQE_SUCCESS) { ---- a/drivers/scsi/lpfc/lpfc_scsi.c -+++ b/drivers/scsi/lpfc/lpfc_scsi.c -@@ -353,7 +353,7 @@ lpfc_new_scsi_buf_s3(struct lpfc_vport * - kfree(psb); - break; - } -- psb->cur_iocbq.iocb_flag |= LPFC_IO_FCP; -+ psb->cur_iocbq.cmd_flag |= LPFC_IO_FCP; - - psb->fcp_cmnd = psb->data; - psb->fcp_rsp = psb->data + sizeof(struct fcp_cmnd); -@@ -459,7 +459,7 @@ lpfc_sli4_vport_delete_fcp_xri_aborted(s - spin_lock(&qp->abts_io_buf_list_lock); - list_for_each_entry_safe(psb, next_psb, - &qp->lpfc_abts_io_buf_list, list) { -- if (psb->cur_iocbq.iocb_flag & LPFC_IO_NVME) -+ if (psb->cur_iocbq.cmd_flag & LPFC_IO_NVME) - continue; - - if (psb->rdata && psb->rdata->pnode && -@@ -515,7 +515,7 @@ lpfc_sli4_io_xri_aborted(struct lpfc_hba - list_del_init(&psb->list); - psb->flags &= ~LPFC_SBUF_XBUSY; - psb->status = IOSTAT_SUCCESS; -- if (psb->cur_iocbq.iocb_flag & LPFC_IO_NVME) { -+ if (psb->cur_iocbq.cmd_flag & LPFC_IO_NVME) { - qp->abts_nvme_io_bufs--; - spin_unlock(&qp->abts_io_buf_list_lock); - spin_unlock_irqrestore(&phba->hbalock, iflag); -@@ -562,7 +562,7 @@ lpfc_sli4_io_xri_aborted(struct lpfc_hba - * for command completion wake up the thread. - */ - spin_lock_irqsave(&psb->buf_lock, iflag); -- psb->cur_iocbq.iocb_flag &= -+ psb->cur_iocbq.cmd_flag &= - ~LPFC_DRIVER_ABORTED; - if (psb->waitq) - wake_up(psb->waitq); -@@ -584,8 +584,8 @@ lpfc_sli4_io_xri_aborted(struct lpfc_hba - for (i = 1; i <= phba->sli.last_iotag; i++) { - iocbq = phba->sli.iocbq_lookup[i]; - -- if (!(iocbq->iocb_flag & LPFC_IO_FCP) || -- (iocbq->iocb_flag & LPFC_IO_LIBDFC)) -+ if (!(iocbq->cmd_flag & LPFC_IO_FCP) || -+ (iocbq->cmd_flag & LPFC_IO_LIBDFC)) - continue; - if (iocbq->sli4_xritag != xri) - continue; -@@ -686,7 +686,7 @@ lpfc_get_scsi_buf_s4(struct lpfc_hba *ph - /* Setup key fields in buffer that may have been changed - * if other protocols used this buffer. - */ -- lpfc_cmd->cur_iocbq.iocb_flag = LPFC_IO_FCP; -+ lpfc_cmd->cur_iocbq.cmd_flag = LPFC_IO_FCP; - lpfc_cmd->prot_seg_cnt = 0; - lpfc_cmd->seg_cnt = 0; - lpfc_cmd->timeout = 0; -@@ -774,7 +774,7 @@ lpfc_release_scsi_buf_s3(struct lpfc_hba - - spin_lock_irqsave(&phba->scsi_buf_list_put_lock, iflag); - psb->pCmd = NULL; -- psb->cur_iocbq.iocb_flag = LPFC_IO_FCP; -+ psb->cur_iocbq.cmd_flag = LPFC_IO_FCP; - list_add_tail(&psb->list, &phba->lpfc_scsi_buf_list_put); - spin_unlock_irqrestore(&phba->scsi_buf_list_put_lock, iflag); - } -@@ -922,7 +922,7 @@ lpfc_scsi_prep_dma_buf_s3(struct lpfc_hb - physaddr = sg_dma_address(sgel); - if (phba->sli_rev == 3 && - !(phba->sli3_options & LPFC_SLI3_BG_ENABLED) && -- !(iocbq->iocb_flag & DSS_SECURITY_OP) && -+ !(iocbq->cmd_flag & DSS_SECURITY_OP) && - nseg <= LPFC_EXT_DATA_BDE_COUNT) { - data_bde->tus.f.bdeFlags = BUFF_TYPE_BDE_64; - data_bde->tus.f.bdeSize = sg_dma_len(sgel); -@@ -950,7 +950,7 @@ lpfc_scsi_prep_dma_buf_s3(struct lpfc_hb - */ - if (phba->sli_rev == 3 && - !(phba->sli3_options & LPFC_SLI3_BG_ENABLED) && -- !(iocbq->iocb_flag & DSS_SECURITY_OP)) { -+ !(iocbq->cmd_flag & DSS_SECURITY_OP)) { - if (num_bde > LPFC_EXT_DATA_BDE_COUNT) { - /* - * The extended IOCB format can only fit 3 BDE or a BPL. -@@ -3443,7 +3443,7 @@ lpfc_scsi_prep_dma_buf_s4(struct lpfc_hb - */ - if ((phba->cfg_fof) && ((struct lpfc_device_data *) - scsi_cmnd->device->hostdata)->oas_enabled) { -- lpfc_cmd->cur_iocbq.iocb_flag |= (LPFC_IO_OAS | LPFC_IO_FOF); -+ lpfc_cmd->cur_iocbq.cmd_flag |= (LPFC_IO_OAS | LPFC_IO_FOF); - lpfc_cmd->cur_iocbq.priority = ((struct lpfc_device_data *) - scsi_cmnd->device->hostdata)->priority; - -@@ -3600,15 +3600,15 @@ lpfc_bg_scsi_prep_dma_buf_s4(struct lpfc - switch (scsi_get_prot_op(scsi_cmnd)) { - case SCSI_PROT_WRITE_STRIP: - case SCSI_PROT_READ_STRIP: -- lpfc_cmd->cur_iocbq.iocb_flag |= LPFC_IO_DIF_STRIP; -+ lpfc_cmd->cur_iocbq.cmd_flag |= LPFC_IO_DIF_STRIP; - break; - case SCSI_PROT_WRITE_INSERT: - case SCSI_PROT_READ_INSERT: -- lpfc_cmd->cur_iocbq.iocb_flag |= LPFC_IO_DIF_INSERT; -+ lpfc_cmd->cur_iocbq.cmd_flag |= LPFC_IO_DIF_INSERT; - break; - case SCSI_PROT_WRITE_PASS: - case SCSI_PROT_READ_PASS: -- lpfc_cmd->cur_iocbq.iocb_flag |= LPFC_IO_DIF_PASS; -+ lpfc_cmd->cur_iocbq.cmd_flag |= LPFC_IO_DIF_PASS; - break; - } - -@@ -3639,7 +3639,7 @@ lpfc_bg_scsi_prep_dma_buf_s4(struct lpfc - */ - if ((phba->cfg_fof) && ((struct lpfc_device_data *) - scsi_cmnd->device->hostdata)->oas_enabled) { -- lpfc_cmd->cur_iocbq.iocb_flag |= (LPFC_IO_OAS | LPFC_IO_FOF); -+ lpfc_cmd->cur_iocbq.cmd_flag |= (LPFC_IO_OAS | LPFC_IO_FOF); - - /* Word 10 */ - bf_set(wqe_oas, &wqe->generic.wqe_com, 1); -@@ -3649,14 +3649,14 @@ lpfc_bg_scsi_prep_dma_buf_s4(struct lpfc - } - - /* Word 7. DIF Flags */ -- if (lpfc_cmd->cur_iocbq.iocb_flag & LPFC_IO_DIF_PASS) -+ if (lpfc_cmd->cur_iocbq.cmd_flag & LPFC_IO_DIF_PASS) - bf_set(wqe_dif, &wqe->generic.wqe_com, LPFC_WQE_DIF_PASSTHRU); -- else if (lpfc_cmd->cur_iocbq.iocb_flag & LPFC_IO_DIF_STRIP) -+ else if (lpfc_cmd->cur_iocbq.cmd_flag & LPFC_IO_DIF_STRIP) - bf_set(wqe_dif, &wqe->generic.wqe_com, LPFC_WQE_DIF_STRIP); -- else if (lpfc_cmd->cur_iocbq.iocb_flag & LPFC_IO_DIF_INSERT) -+ else if (lpfc_cmd->cur_iocbq.cmd_flag & LPFC_IO_DIF_INSERT) - bf_set(wqe_dif, &wqe->generic.wqe_com, LPFC_WQE_DIF_INSERT); - -- lpfc_cmd->cur_iocbq.iocb_flag &= ~(LPFC_IO_DIF_PASS | -+ lpfc_cmd->cur_iocbq.cmd_flag &= ~(LPFC_IO_DIF_PASS | - LPFC_IO_DIF_STRIP | LPFC_IO_DIF_INSERT); - - return 0; -@@ -4182,7 +4182,7 @@ lpfc_handle_fcp_err(struct lpfc_vport *v - * lpfc_fcp_io_cmd_wqe_cmpl - Complete a FCP IO - * @phba: The hba for which this call is being executed. - * @pwqeIn: The command WQE for the scsi cmnd. -- * @wcqe: Pointer to driver response CQE object. -+ * @pwqeOut: Pointer to driver response WQE object. - * - * This routine assigns scsi command result by looking into response WQE - * status field appropriately. This routine handles QUEUE FULL condition as -@@ -4190,10 +4190,11 @@ lpfc_handle_fcp_err(struct lpfc_vport *v - **/ - static void - lpfc_fcp_io_cmd_wqe_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pwqeIn, -- struct lpfc_wcqe_complete *wcqe) -+ struct lpfc_iocbq *pwqeOut) - { - struct lpfc_io_buf *lpfc_cmd = - (struct lpfc_io_buf *)pwqeIn->context1; -+ struct lpfc_wcqe_complete *wcqe = &pwqeOut->wcqe_cmpl; - struct lpfc_vport *vport = pwqeIn->vport; - struct lpfc_rport_data *rdata; - struct lpfc_nodelist *ndlp; -@@ -4226,7 +4227,7 @@ lpfc_fcp_io_cmd_wqe_cmpl(struct lpfc_hba - * This needs to be done outside buf_lock - */ - spin_lock_irqsave(&phba->hbalock, iflags); -- lpfc_cmd->cur_iocbq.iocb_flag |= LPFC_EXCHANGE_BUSY; -+ lpfc_cmd->cur_iocbq.cmd_flag |= LPFC_EXCHANGE_BUSY; - spin_unlock_irqrestore(&phba->hbalock, iflags); - } - -@@ -4519,7 +4520,7 @@ lpfc_fcp_io_cmd_wqe_cmpl(struct lpfc_hba - * wake up the thread. - */ - spin_lock(&lpfc_cmd->buf_lock); -- lpfc_cmd->cur_iocbq.iocb_flag &= ~LPFC_DRIVER_ABORTED; -+ lpfc_cmd->cur_iocbq.cmd_flag &= ~LPFC_DRIVER_ABORTED; - if (lpfc_cmd->waitq) - wake_up(lpfc_cmd->waitq); - spin_unlock(&lpfc_cmd->buf_lock); -@@ -4579,7 +4580,7 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba - lpfc_cmd->status = pIocbOut->iocb.ulpStatus; - /* pick up SLI4 exchange busy status from HBA */ - lpfc_cmd->flags &= ~LPFC_SBUF_XBUSY; -- if (pIocbOut->iocb_flag & LPFC_EXCHANGE_BUSY) -+ if (pIocbOut->cmd_flag & LPFC_EXCHANGE_BUSY) - lpfc_cmd->flags |= LPFC_SBUF_XBUSY; - - #ifdef CONFIG_SCSI_LPFC_DEBUG_FS -@@ -4788,7 +4789,7 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba - * wake up the thread. - */ - spin_lock(&lpfc_cmd->buf_lock); -- lpfc_cmd->cur_iocbq.iocb_flag &= ~LPFC_DRIVER_ABORTED; -+ lpfc_cmd->cur_iocbq.cmd_flag &= ~LPFC_DRIVER_ABORTED; - if (lpfc_cmd->waitq) - wake_up(lpfc_cmd->waitq); - spin_unlock(&lpfc_cmd->buf_lock); -@@ -4866,8 +4867,8 @@ static int lpfc_scsi_prep_cmnd_buf_s3(st - - piocbq->iocb.ulpClass = (pnode->nlp_fcp_info & 0x0f); - piocbq->context1 = lpfc_cmd; -- if (!piocbq->iocb_cmpl) -- piocbq->iocb_cmpl = lpfc_scsi_cmd_iocb_cmpl; -+ if (!piocbq->cmd_cmpl) -+ piocbq->cmd_cmpl = lpfc_scsi_cmd_iocb_cmpl; - piocbq->iocb.ulpTimeout = tmo; - piocbq->vport = vport; - return 0; -@@ -4980,7 +4981,7 @@ static int lpfc_scsi_prep_cmnd_buf_s4(st - pwqeq->vport = vport; - pwqeq->context1 = lpfc_cmd; - pwqeq->hba_wqidx = lpfc_cmd->hdwq_no; -- pwqeq->wqe_cmpl = lpfc_fcp_io_cmd_wqe_cmpl; -+ pwqeq->cmd_cmpl = lpfc_fcp_io_cmd_wqe_cmpl; - - return 0; - } -@@ -5442,7 +5443,7 @@ lpfc_queuecommand(struct Scsi_Host *shos - lpfc_cmd->pCmd = cmnd; - lpfc_cmd->rdata = rdata; - lpfc_cmd->ndlp = ndlp; -- lpfc_cmd->cur_iocbq.iocb_cmpl = NULL; -+ lpfc_cmd->cur_iocbq.cmd_cmpl = NULL; - cmnd->host_scribble = (unsigned char *)lpfc_cmd; - - err = lpfc_scsi_prep_cmnd(vport, lpfc_cmd, ndlp); -@@ -5644,7 +5645,7 @@ lpfc_abort_handler(struct scsi_cmnd *cmn - spin_lock(&pring_s4->ring_lock); - } - /* the command is in process of being cancelled */ -- if (!(iocb->iocb_flag & LPFC_IO_ON_TXCMPLQ)) { -+ if (!(iocb->cmd_flag & LPFC_IO_ON_TXCMPLQ)) { - lpfc_printf_vlog(vport, KERN_WARNING, LOG_FCP, - "3169 SCSI Layer abort requested I/O has been " - "cancelled by LLD.\n"); -@@ -5667,7 +5668,7 @@ lpfc_abort_handler(struct scsi_cmnd *cmn - BUG_ON(iocb->context1 != lpfc_cmd); - - /* abort issued in recovery is still in progress */ -- if (iocb->iocb_flag & LPFC_DRIVER_ABORTED) { -+ if (iocb->cmd_flag & LPFC_DRIVER_ABORTED) { - lpfc_printf_vlog(vport, KERN_WARNING, LOG_FCP, - "3389 SCSI Layer I/O Abort Request is pending\n"); - if (phba->sli_rev == LPFC_SLI_REV4) -@@ -5710,7 +5711,7 @@ lpfc_abort_handler(struct scsi_cmnd *cmn - - wait_for_cmpl: - /* -- * iocb_flag is set to LPFC_DRIVER_ABORTED before we wait -+ * cmd_flag is set to LPFC_DRIVER_ABORTED before we wait - * for abort to complete. - */ - wait_event_timeout(waitq, -@@ -5899,14 +5900,14 @@ lpfc_send_taskmgmt(struct lpfc_vport *vp - lpfc_release_scsi_buf(phba, lpfc_cmd); - return FAILED; - } -- iocbq->iocb_cmpl = lpfc_tskmgmt_def_cmpl; -+ iocbq->cmd_cmpl = lpfc_tskmgmt_def_cmpl; - - lpfc_printf_vlog(vport, KERN_INFO, LOG_FCP, - "0702 Issue %s to TGT %d LUN %llu " - "rpi x%x nlp_flag x%x Data: x%x x%x\n", - lpfc_taskmgmt_name(task_mgmt_cmd), tgt_id, lun_id, - pnode->nlp_rpi, pnode->nlp_flag, iocbq->sli4_xritag, -- iocbq->iocb_flag); -+ iocbq->cmd_flag); - - status = lpfc_sli_issue_iocb_wait(phba, LPFC_FCP_RING, - iocbq, iocbqrsp, lpfc_cmd->timeout); -@@ -5916,12 +5917,12 @@ lpfc_send_taskmgmt(struct lpfc_vport *vp - iocbqrsp->iocb.ulpStatus != IOSTAT_FCP_RSP_ERROR) - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, - "0727 TMF %s to TGT %d LUN %llu " -- "failed (%d, %d) iocb_flag x%x\n", -+ "failed (%d, %d) cmd_flag x%x\n", - lpfc_taskmgmt_name(task_mgmt_cmd), - tgt_id, lun_id, - iocbqrsp->iocb.ulpStatus, - iocbqrsp->iocb.un.ulpWord[4], -- iocbq->iocb_flag); -+ iocbq->cmd_flag); - /* if ulpStatus != IOCB_SUCCESS, then status == IOCB_SUCCESS */ - if (status == IOCB_SUCCESS) { - if (iocbqrsp->iocb.ulpStatus == IOSTAT_FCP_RSP_ERROR) ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -1257,21 +1257,21 @@ static struct lpfc_sglq * - struct lpfc_sli_ring *pring = NULL; - int found = 0; - -- if (piocbq->iocb_flag & LPFC_IO_NVME_LS) -+ if (piocbq->cmd_flag & LPFC_IO_NVME_LS) - pring = phba->sli4_hba.nvmels_wq->pring; - else - pring = lpfc_phba_elsring(phba); - - lockdep_assert_held(&pring->ring_lock); - -- if (piocbq->iocb_flag & LPFC_IO_FCP) { -+ if (piocbq->cmd_flag & LPFC_IO_FCP) { - lpfc_cmd = (struct lpfc_io_buf *) piocbq->context1; - ndlp = lpfc_cmd->rdata->pnode; - } else if ((piocbq->iocb.ulpCommand == CMD_GEN_REQUEST64_CR) && -- !(piocbq->iocb_flag & LPFC_IO_LIBDFC)) { -+ !(piocbq->cmd_flag & LPFC_IO_LIBDFC)) { - ndlp = piocbq->context_un.ndlp; -- } else if (piocbq->iocb_flag & LPFC_IO_LIBDFC) { -- if (piocbq->iocb_flag & LPFC_IO_LOOPBACK) -+ } else if (piocbq->cmd_flag & LPFC_IO_LIBDFC) { -+ if (piocbq->cmd_flag & LPFC_IO_LOOPBACK) - ndlp = NULL; - else - ndlp = piocbq->context_un.ndlp; -@@ -1394,7 +1394,7 @@ static void - - - if (sglq) { -- if (iocbq->iocb_flag & LPFC_IO_NVMET) { -+ if (iocbq->cmd_flag & LPFC_IO_NVMET) { - spin_lock_irqsave(&phba->sli4_hba.sgl_list_lock, - iflag); - sglq->state = SGL_FREED; -@@ -1406,7 +1406,7 @@ static void - goto out; - } - -- if ((iocbq->iocb_flag & LPFC_EXCHANGE_BUSY) && -+ if ((iocbq->cmd_flag & LPFC_EXCHANGE_BUSY) && - (!(unlikely(pci_channel_offline(phba->pcidev)))) && - sglq->state != SGL_XRI_ABORTED) { - spin_lock_irqsave(&phba->sli4_hba.sgl_list_lock, -@@ -1443,7 +1443,7 @@ static void - memset((char *)iocbq + start_clean, 0, sizeof(*iocbq) - start_clean); - iocbq->sli4_lxritag = NO_XRI; - iocbq->sli4_xritag = NO_XRI; -- iocbq->iocb_flag &= ~(LPFC_IO_NVME | LPFC_IO_NVMET | LPFC_IO_CMF | -+ iocbq->cmd_flag &= ~(LPFC_IO_NVME | LPFC_IO_NVMET | LPFC_IO_CMF | - LPFC_IO_NVME_LS); - list_add_tail(&iocbq->list, &phba->lpfc_iocb_list); - } -@@ -1533,17 +1533,17 @@ lpfc_sli_cancel_iocbs(struct lpfc_hba *p - - while (!list_empty(iocblist)) { - list_remove_head(iocblist, piocb, struct lpfc_iocbq, list); -- if (piocb->wqe_cmpl) { -- if (piocb->iocb_flag & LPFC_IO_NVME) -+ if (piocb->cmd_cmpl) { -+ if (piocb->cmd_flag & LPFC_IO_NVME) - lpfc_nvme_cancel_iocb(phba, piocb, - ulpstatus, ulpWord4); - else - lpfc_sli_release_iocbq(phba, piocb); - -- } else if (piocb->iocb_cmpl) { -+ } else if (piocb->cmd_cmpl) { - piocb->iocb.ulpStatus = ulpstatus; - piocb->iocb.un.ulpWord[4] = ulpWord4; -- (piocb->iocb_cmpl) (phba, piocb, piocb); -+ (piocb->cmd_cmpl) (phba, piocb, piocb); - } else { - lpfc_sli_release_iocbq(phba, piocb); - } -@@ -1735,7 +1735,7 @@ lpfc_sli_ringtxcmpl_put(struct lpfc_hba - BUG_ON(!piocb); - - list_add_tail(&piocb->list, &pring->txcmplq); -- piocb->iocb_flag |= LPFC_IO_ON_TXCMPLQ; -+ piocb->cmd_flag |= LPFC_IO_ON_TXCMPLQ; - pring->txcmplq_cnt++; - - if ((unlikely(pring->ringno == LPFC_ELS_RING)) && -@@ -1776,7 +1776,7 @@ lpfc_sli_ringtx_get(struct lpfc_hba *phb - * lpfc_cmf_sync_cmpl - Process a CMF_SYNC_WQE cmpl - * @phba: Pointer to HBA context object. - * @cmdiocb: Pointer to driver command iocb object. -- * @cmf_cmpl: Pointer to completed WCQE. -+ * @rspiocb: Pointer to driver response iocb object. - * - * This routine will inform the driver of any BW adjustments we need - * to make. These changes will be picked up during the next CMF -@@ -1785,10 +1785,11 @@ lpfc_sli_ringtx_get(struct lpfc_hba *phb - **/ - static void - lpfc_cmf_sync_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, -- struct lpfc_wcqe_complete *cmf_cmpl) -+ struct lpfc_iocbq *rspiocb) - { - union lpfc_wqe128 *wqe; - uint32_t status, info; -+ struct lpfc_wcqe_complete *wcqe = &rspiocb->wcqe_cmpl; - uint64_t bw, bwdif, slop; - uint64_t pcent, bwpcent; - int asig, afpin, sigcnt, fpincnt; -@@ -1796,22 +1797,22 @@ lpfc_cmf_sync_cmpl(struct lpfc_hba *phba - char *s; - - /* First check for error */ -- status = bf_get(lpfc_wcqe_c_status, cmf_cmpl); -+ status = bf_get(lpfc_wcqe_c_status, wcqe); - if (status) { - lpfc_printf_log(phba, KERN_INFO, LOG_CGN_MGMT, - "6211 CMF_SYNC_WQE Error " - "req_tag x%x status x%x hwstatus x%x " - "tdatap x%x parm x%x\n", -- bf_get(lpfc_wcqe_c_request_tag, cmf_cmpl), -- bf_get(lpfc_wcqe_c_status, cmf_cmpl), -- bf_get(lpfc_wcqe_c_hw_status, cmf_cmpl), -- cmf_cmpl->total_data_placed, -- cmf_cmpl->parameter); -+ bf_get(lpfc_wcqe_c_request_tag, wcqe), -+ bf_get(lpfc_wcqe_c_status, wcqe), -+ bf_get(lpfc_wcqe_c_hw_status, wcqe), -+ wcqe->total_data_placed, -+ wcqe->parameter); - goto out; - } - - /* Gather congestion information on a successful cmpl */ -- info = cmf_cmpl->parameter; -+ info = wcqe->parameter; - phba->cmf_active_info = info; - - /* See if firmware info count is valid or has changed */ -@@ -1820,15 +1821,15 @@ lpfc_cmf_sync_cmpl(struct lpfc_hba *phba - else - phba->cmf_info_per_interval = info; - -- tdp = bf_get(lpfc_wcqe_c_cmf_bw, cmf_cmpl); -- cg = bf_get(lpfc_wcqe_c_cmf_cg, cmf_cmpl); -+ tdp = bf_get(lpfc_wcqe_c_cmf_bw, wcqe); -+ cg = bf_get(lpfc_wcqe_c_cmf_cg, wcqe); - - /* Get BW requirement from firmware */ - bw = (uint64_t)tdp * LPFC_CMF_BLK_SIZE; - if (!bw) { - lpfc_printf_log(phba, KERN_INFO, LOG_CGN_MGMT, - "6212 CMF_SYNC_WQE x%x: NULL bw\n", -- bf_get(lpfc_wcqe_c_request_tag, cmf_cmpl)); -+ bf_get(lpfc_wcqe_c_request_tag, wcqe)); - goto out; - } - -@@ -2002,14 +2003,13 @@ lpfc_issue_cmf_sync_wqe(struct lpfc_hba - bf_set(cmf_sync_cqid, &wqe->cmf_sync, LPFC_WQE_CQ_ID_DEFAULT); - - sync_buf->vport = phba->pport; -- sync_buf->wqe_cmpl = lpfc_cmf_sync_cmpl; -- sync_buf->iocb_cmpl = NULL; -+ sync_buf->cmd_cmpl = lpfc_cmf_sync_cmpl; - sync_buf->context1 = NULL; - sync_buf->context2 = NULL; - sync_buf->context3 = NULL; - sync_buf->sli4_xritag = NO_XRI; - -- sync_buf->iocb_flag |= LPFC_IO_CMF; -+ sync_buf->cmd_flag |= LPFC_IO_CMF; - ret_val = lpfc_sli4_issue_wqe(phba, &phba->sli4_hba.hdwq[0], sync_buf); - if (ret_val) - lpfc_printf_log(phba, KERN_INFO, LOG_CGN_MGMT, -@@ -2176,7 +2176,7 @@ lpfc_sli_submit_iocb(struct lpfc_hba *ph - /* - * Set up an iotag - */ -- nextiocb->iocb.ulpIoTag = (nextiocb->iocb_cmpl) ? nextiocb->iotag : 0; -+ nextiocb->iocb.ulpIoTag = (nextiocb->cmd_cmpl) ? nextiocb->iotag : 0; - - - if (pring->ringno == LPFC_ELS_RING) { -@@ -2197,9 +2197,9 @@ lpfc_sli_submit_iocb(struct lpfc_hba *ph - /* - * If there is no completion routine to call, we can release the - * IOCB buffer back right now. For IOCBs, like QUE_RING_BUF, -- * that have no rsp ring completion, iocb_cmpl MUST be NULL. -+ * that have no rsp ring completion, cmd_cmpl MUST be NULL. - */ -- if (nextiocb->iocb_cmpl) -+ if (nextiocb->cmd_cmpl) - lpfc_sli_ringtxcmpl_put(phba, pring, nextiocb); - else - __lpfc_sli_release_iocbq(phba, nextiocb); -@@ -3429,10 +3429,10 @@ lpfc_sli_iocbq_lookup(struct lpfc_hba *p - - if (iotag != 0 && iotag <= phba->sli.last_iotag) { - cmd_iocb = phba->sli.iocbq_lookup[iotag]; -- if (cmd_iocb->iocb_flag & LPFC_IO_ON_TXCMPLQ) { -+ if (cmd_iocb->cmd_flag & LPFC_IO_ON_TXCMPLQ) { - /* remove from txcmpl queue list */ - list_del_init(&cmd_iocb->list); -- cmd_iocb->iocb_flag &= ~LPFC_IO_ON_TXCMPLQ; -+ cmd_iocb->cmd_flag &= ~LPFC_IO_ON_TXCMPLQ; - pring->txcmplq_cnt--; - spin_unlock_irqrestore(temp_lock, iflag); - return cmd_iocb; -@@ -3476,10 +3476,10 @@ lpfc_sli_iocbq_lookup_by_tag(struct lpfc - spin_lock_irqsave(temp_lock, iflag); - if (iotag != 0 && iotag <= phba->sli.last_iotag) { - cmd_iocb = phba->sli.iocbq_lookup[iotag]; -- if (cmd_iocb->iocb_flag & LPFC_IO_ON_TXCMPLQ) { -+ if (cmd_iocb->cmd_flag & LPFC_IO_ON_TXCMPLQ) { - /* remove from txcmpl queue list */ - list_del_init(&cmd_iocb->list); -- cmd_iocb->iocb_flag &= ~LPFC_IO_ON_TXCMPLQ; -+ cmd_iocb->cmd_flag &= ~LPFC_IO_ON_TXCMPLQ; - pring->txcmplq_cnt--; - spin_unlock_irqrestore(temp_lock, iflag); - return cmd_iocb; -@@ -3489,9 +3489,9 @@ lpfc_sli_iocbq_lookup_by_tag(struct lpfc - spin_unlock_irqrestore(temp_lock, iflag); - lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, - "0372 iotag x%x lookup error: max iotag (x%x) " -- "iocb_flag x%x\n", -+ "cmd_flag x%x\n", - iotag, phba->sli.last_iotag, -- cmd_iocb ? cmd_iocb->iocb_flag : 0xffff); -+ cmd_iocb ? cmd_iocb->cmd_flag : 0xffff); - return NULL; - } - -@@ -3522,7 +3522,7 @@ lpfc_sli_process_sol_iocb(struct lpfc_hb - - cmdiocbp = lpfc_sli_iocbq_lookup(phba, pring, saveq); - if (cmdiocbp) { -- if (cmdiocbp->iocb_cmpl) { -+ if (cmdiocbp->cmd_cmpl) { - /* - * If an ELS command failed send an event to mgmt - * application. -@@ -3540,11 +3540,11 @@ lpfc_sli_process_sol_iocb(struct lpfc_hb - */ - if (pring->ringno == LPFC_ELS_RING) { - if ((phba->sli_rev < LPFC_SLI_REV4) && -- (cmdiocbp->iocb_flag & -+ (cmdiocbp->cmd_flag & - LPFC_DRIVER_ABORTED)) { - spin_lock_irqsave(&phba->hbalock, - iflag); -- cmdiocbp->iocb_flag &= -+ cmdiocbp->cmd_flag &= - ~LPFC_DRIVER_ABORTED; - spin_unlock_irqrestore(&phba->hbalock, - iflag); -@@ -3559,12 +3559,12 @@ lpfc_sli_process_sol_iocb(struct lpfc_hb - */ - spin_lock_irqsave(&phba->hbalock, - iflag); -- saveq->iocb_flag |= LPFC_DELAY_MEM_FREE; -+ saveq->cmd_flag |= LPFC_DELAY_MEM_FREE; - spin_unlock_irqrestore(&phba->hbalock, - iflag); - } - if (phba->sli_rev == LPFC_SLI_REV4) { -- if (saveq->iocb_flag & -+ if (saveq->cmd_flag & - LPFC_EXCHANGE_BUSY) { - /* Set cmdiocb flag for the - * exchange busy so sgl (xri) -@@ -3574,12 +3574,12 @@ lpfc_sli_process_sol_iocb(struct lpfc_hb - */ - spin_lock_irqsave( - &phba->hbalock, iflag); -- cmdiocbp->iocb_flag |= -+ cmdiocbp->cmd_flag |= - LPFC_EXCHANGE_BUSY; - spin_unlock_irqrestore( - &phba->hbalock, iflag); - } -- if (cmdiocbp->iocb_flag & -+ if (cmdiocbp->cmd_flag & - LPFC_DRIVER_ABORTED) { - /* - * Clear LPFC_DRIVER_ABORTED -@@ -3588,7 +3588,7 @@ lpfc_sli_process_sol_iocb(struct lpfc_hb - */ - spin_lock_irqsave( - &phba->hbalock, iflag); -- cmdiocbp->iocb_flag &= -+ cmdiocbp->cmd_flag &= - ~LPFC_DRIVER_ABORTED; - spin_unlock_irqrestore( - &phba->hbalock, iflag); -@@ -3608,14 +3608,14 @@ lpfc_sli_process_sol_iocb(struct lpfc_hb - IOERR_SLI_ABORTED; - spin_lock_irqsave( - &phba->hbalock, iflag); -- saveq->iocb_flag |= -+ saveq->cmd_flag |= - LPFC_DELAY_MEM_FREE; - spin_unlock_irqrestore( - &phba->hbalock, iflag); - } - } - } -- (cmdiocbp->iocb_cmpl) (phba, cmdiocbp, saveq); -+ (cmdiocbp->cmd_cmpl) (phba, cmdiocbp, saveq); - } else - lpfc_sli_release_iocbq(phba, cmdiocbp); - } else { -@@ -3857,11 +3857,11 @@ lpfc_sli_handle_fast_ring_event(struct l - spin_lock_irqsave(&phba->hbalock, iflag); - if (unlikely(!cmdiocbq)) - break; -- if (cmdiocbq->iocb_flag & LPFC_DRIVER_ABORTED) -- cmdiocbq->iocb_flag &= ~LPFC_DRIVER_ABORTED; -- if (cmdiocbq->iocb_cmpl) { -+ if (cmdiocbq->cmd_flag & LPFC_DRIVER_ABORTED) -+ cmdiocbq->cmd_flag &= ~LPFC_DRIVER_ABORTED; -+ if (cmdiocbq->cmd_cmpl) { - spin_unlock_irqrestore(&phba->hbalock, iflag); -- (cmdiocbq->iocb_cmpl)(phba, cmdiocbq, -+ (cmdiocbq->cmd_cmpl)(phba, cmdiocbq, - &rspiocbq); - spin_lock_irqsave(&phba->hbalock, iflag); - } -@@ -4056,10 +4056,10 @@ lpfc_sli_sp_handle_rspiocb(struct lpfc_h - } - if (cmdiocbp) { - /* Call the specified completion routine */ -- if (cmdiocbp->iocb_cmpl) { -+ if (cmdiocbp->cmd_cmpl) { - spin_unlock_irqrestore(&phba->hbalock, - iflag); -- (cmdiocbp->iocb_cmpl)(phba, cmdiocbp, -+ (cmdiocbp->cmd_cmpl)(phba, cmdiocbp, - saveq); - spin_lock_irqsave(&phba->hbalock, - iflag); -@@ -4438,7 +4438,7 @@ lpfc_sli_flush_io_rings(struct lpfc_hba - list_splice_init(&pring->txq, &txq); - list_for_each_entry_safe(piocb, next_iocb, - &pring->txcmplq, list) -- piocb->iocb_flag &= ~LPFC_IO_ON_TXCMPLQ; -+ piocb->cmd_flag &= ~LPFC_IO_ON_TXCMPLQ; - /* Retrieve everything on the txcmplq */ - list_splice_init(&pring->txcmplq, &txcmplq); - pring->txq_cnt = 0; -@@ -4464,7 +4464,7 @@ lpfc_sli_flush_io_rings(struct lpfc_hba - list_splice_init(&pring->txq, &txq); - list_for_each_entry_safe(piocb, next_iocb, - &pring->txcmplq, list) -- piocb->iocb_flag &= ~LPFC_IO_ON_TXCMPLQ; -+ piocb->cmd_flag &= ~LPFC_IO_ON_TXCMPLQ; - /* Retrieve everything on the txcmplq */ - list_splice_init(&pring->txcmplq, &txcmplq); - pring->txq_cnt = 0; -@@ -9952,7 +9952,7 @@ static int - - lockdep_assert_held(&phba->hbalock); - -- if (piocb->iocb_cmpl && (!piocb->vport) && -+ if (piocb->cmd_cmpl && (!piocb->vport) && - (piocb->iocb.ulpCommand != CMD_ABORT_XRI_CN) && - (piocb->iocb.ulpCommand != CMD_CLOSE_XRI_CN)) { - lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, -@@ -10004,10 +10004,10 @@ static int - case CMD_QUE_RING_BUF64_CN: - /* - * For IOCBs, like QUE_RING_BUF, that have no rsp ring -- * completion, iocb_cmpl MUST be 0. -+ * completion, cmd_cmpl MUST be 0. - */ -- if (piocb->iocb_cmpl) -- piocb->iocb_cmpl = NULL; -+ if (piocb->cmd_cmpl) -+ piocb->cmd_cmpl = NULL; - /*FALLTHROUGH*/ - case CMD_CREATE_XRI_CR: - case CMD_CLOSE_XRI_CN: -@@ -10198,9 +10198,9 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba - - fip = phba->hba_flag & HBA_FIP_SUPPORT; - /* The fcp commands will set command type */ -- if (iocbq->iocb_flag & LPFC_IO_FCP) -+ if (iocbq->cmd_flag & LPFC_IO_FCP) - command_type = FCP_COMMAND; -- else if (fip && (iocbq->iocb_flag & LPFC_FIP_ELS_ID_MASK)) -+ else if (fip && (iocbq->cmd_flag & LPFC_FIP_ELS_ID_MASK)) - command_type = ELS_COMMAND_FIP; - else - command_type = ELS_COMMAND_NON_FIP; -@@ -10245,7 +10245,7 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba - - switch (iocbq->iocb.ulpCommand) { - case CMD_ELS_REQUEST64_CR: -- if (iocbq->iocb_flag & LPFC_IO_LIBDFC) -+ if (iocbq->cmd_flag & LPFC_IO_LIBDFC) - ndlp = iocbq->context_un.ndlp; - else - ndlp = (struct lpfc_nodelist *)iocbq->context1; -@@ -10272,7 +10272,7 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba - bf_set(wqe_pu, &wqe->els_req.wqe_com, 0); - /* CCP CCPE PV PRI in word10 were set in the memcpy */ - if (command_type == ELS_COMMAND_FIP) -- els_id = ((iocbq->iocb_flag & LPFC_FIP_ELS_ID_MASK) -+ els_id = ((iocbq->cmd_flag & LPFC_FIP_ELS_ID_MASK) - >> LPFC_FIP_ELS_ID_SHIFT); - pcmd = (uint32_t *) (((struct lpfc_dmabuf *) - iocbq->context2)->virt); -@@ -10372,7 +10372,7 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba - LPFC_WQE_LENLOC_WORD4); - bf_set(wqe_pu, &wqe->fcp_iwrite.wqe_com, iocbq->iocb.ulpPU); - bf_set(wqe_dbde, &wqe->fcp_iwrite.wqe_com, 1); -- if (iocbq->iocb_flag & LPFC_IO_OAS) { -+ if (iocbq->cmd_flag & LPFC_IO_OAS) { - bf_set(wqe_oas, &wqe->fcp_iwrite.wqe_com, 1); - bf_set(wqe_ccpe, &wqe->fcp_iwrite.wqe_com, 1); - if (iocbq->priority) { -@@ -10436,7 +10436,7 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba - LPFC_WQE_LENLOC_WORD4); - bf_set(wqe_pu, &wqe->fcp_iread.wqe_com, iocbq->iocb.ulpPU); - bf_set(wqe_dbde, &wqe->fcp_iread.wqe_com, 1); -- if (iocbq->iocb_flag & LPFC_IO_OAS) { -+ if (iocbq->cmd_flag & LPFC_IO_OAS) { - bf_set(wqe_oas, &wqe->fcp_iread.wqe_com, 1); - bf_set(wqe_ccpe, &wqe->fcp_iread.wqe_com, 1); - if (iocbq->priority) { -@@ -10499,7 +10499,7 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba - LPFC_WQE_LENLOC_NONE); - bf_set(wqe_erp, &wqe->fcp_icmd.wqe_com, - iocbq->iocb.ulpFCP2Rcvy); -- if (iocbq->iocb_flag & LPFC_IO_OAS) { -+ if (iocbq->cmd_flag & LPFC_IO_OAS) { - bf_set(wqe_oas, &wqe->fcp_icmd.wqe_com, 1); - bf_set(wqe_ccpe, &wqe->fcp_icmd.wqe_com, 1); - if (iocbq->priority) { -@@ -10633,7 +10633,7 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba - abrt_iotag = iocbq->iocb.un.acxri.abortContextTag; - if (abrt_iotag != 0 && abrt_iotag <= phba->sli.last_iotag) { - abrtiocbq = phba->sli.iocbq_lookup[abrt_iotag]; -- fip = abrtiocbq->iocb_flag & LPFC_FIP_ELS_ID_MASK; -+ fip = abrtiocbq->cmd_flag & LPFC_FIP_ELS_ID_MASK; - } else - fip = 0; - -@@ -10742,13 +10742,13 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba - return IOCB_ERROR; - } - -- if (iocbq->iocb_flag & LPFC_IO_DIF_PASS) -+ if (iocbq->cmd_flag & LPFC_IO_DIF_PASS) - bf_set(wqe_dif, &wqe->generic.wqe_com, LPFC_WQE_DIF_PASSTHRU); -- else if (iocbq->iocb_flag & LPFC_IO_DIF_STRIP) -+ else if (iocbq->cmd_flag & LPFC_IO_DIF_STRIP) - bf_set(wqe_dif, &wqe->generic.wqe_com, LPFC_WQE_DIF_STRIP); -- else if (iocbq->iocb_flag & LPFC_IO_DIF_INSERT) -+ else if (iocbq->cmd_flag & LPFC_IO_DIF_INSERT) - bf_set(wqe_dif, &wqe->generic.wqe_com, LPFC_WQE_DIF_INSERT); -- iocbq->iocb_flag &= ~(LPFC_IO_DIF_PASS | LPFC_IO_DIF_STRIP | -+ iocbq->cmd_flag &= ~(LPFC_IO_DIF_PASS | LPFC_IO_DIF_STRIP | - LPFC_IO_DIF_INSERT); - bf_set(wqe_xri_tag, &wqe->generic.wqe_com, xritag); - bf_set(wqe_reqtag, &wqe->generic.wqe_com, iocbq->iotag); -@@ -10874,8 +10874,8 @@ static int - struct lpfc_sli_ring *pring; - - /* Get the WQ */ -- if ((piocb->iocb_flag & LPFC_IO_FCP) || -- (piocb->iocb_flag & LPFC_USE_FCPWQIDX)) { -+ if ((piocb->cmd_flag & LPFC_IO_FCP) || -+ (piocb->cmd_flag & LPFC_USE_FCPWQIDX)) { - wq = phba->sli4_hba.hdwq[piocb->hba_wqidx].io_wq; - } else { - wq = phba->sli4_hba.els_wq; -@@ -10916,7 +10916,7 @@ static int - } - } - } -- } else if (piocb->iocb_flag & LPFC_IO_FCP) { -+ } else if (piocb->cmd_flag & LPFC_IO_FCP) { - /* These IO's already have an XRI and a mapped sgl. */ - sglq = NULL; - } -@@ -11033,14 +11033,14 @@ lpfc_sli4_calc_ring(struct lpfc_hba *phb - { - struct lpfc_io_buf *lpfc_cmd; - -- if (piocb->iocb_flag & (LPFC_IO_FCP | LPFC_USE_FCPWQIDX)) { -+ if (piocb->cmd_flag & (LPFC_IO_FCP | LPFC_USE_FCPWQIDX)) { - if (unlikely(!phba->sli4_hba.hdwq)) - return NULL; - /* - * for abort iocb hba_wqidx should already - * be setup based on what work queue we used. - */ -- if (!(piocb->iocb_flag & LPFC_USE_FCPWQIDX)) { -+ if (!(piocb->cmd_flag & LPFC_USE_FCPWQIDX)) { - lpfc_cmd = (struct lpfc_io_buf *)piocb->context1; - piocb->hba_wqidx = lpfc_cmd->hdwq_no; - } -@@ -12182,14 +12182,14 @@ lpfc_sli_issue_abort_iotag(struct lpfc_h - icmd = &cmdiocb->iocb; - if (icmd->ulpCommand == CMD_ABORT_XRI_CN || - icmd->ulpCommand == CMD_CLOSE_XRI_CN || -- cmdiocb->iocb_flag & LPFC_DRIVER_ABORTED) -+ cmdiocb->cmd_flag & LPFC_DRIVER_ABORTED) - return IOCB_ABORTING; - - if (!pring) { -- if (cmdiocb->iocb_flag & LPFC_IO_FABRIC) -- cmdiocb->fabric_iocb_cmpl = lpfc_ignore_els_cmpl; -+ if (cmdiocb->cmd_flag & LPFC_IO_FABRIC) -+ cmdiocb->fabric_cmd_cmpl = lpfc_ignore_els_cmpl; - else -- cmdiocb->iocb_cmpl = lpfc_ignore_els_cmpl; -+ cmdiocb->cmd_cmpl = lpfc_ignore_els_cmpl; - return retval; - } - -@@ -12199,10 +12199,10 @@ lpfc_sli_issue_abort_iotag(struct lpfc_h - */ - if ((vport->load_flag & FC_UNLOADING) && - pring->ringno == LPFC_ELS_RING) { -- if (cmdiocb->iocb_flag & LPFC_IO_FABRIC) -- cmdiocb->fabric_iocb_cmpl = lpfc_ignore_els_cmpl; -+ if (cmdiocb->cmd_flag & LPFC_IO_FABRIC) -+ cmdiocb->fabric_cmd_cmpl = lpfc_ignore_els_cmpl; - else -- cmdiocb->iocb_cmpl = lpfc_ignore_els_cmpl; -+ cmdiocb->cmd_cmpl = lpfc_ignore_els_cmpl; - return retval; - } - -@@ -12214,7 +12214,7 @@ lpfc_sli_issue_abort_iotag(struct lpfc_h - /* This signals the response to set the correct status - * before calling the completion handler - */ -- cmdiocb->iocb_flag |= LPFC_DRIVER_ABORTED; -+ cmdiocb->cmd_flag |= LPFC_DRIVER_ABORTED; - - iabt = &abtsiocbp->iocb; - iabt->un.acxri.abortType = ABORT_TYPE_ABTS; -@@ -12235,10 +12235,10 @@ lpfc_sli_issue_abort_iotag(struct lpfc_h - - /* ABTS WQE must go to the same WQ as the WQE to be aborted */ - abtsiocbp->hba_wqidx = cmdiocb->hba_wqidx; -- if (cmdiocb->iocb_flag & LPFC_IO_FCP) -- abtsiocbp->iocb_flag |= (LPFC_IO_FCP | LPFC_USE_FCPWQIDX); -- if (cmdiocb->iocb_flag & LPFC_IO_FOF) -- abtsiocbp->iocb_flag |= LPFC_IO_FOF; -+ if (cmdiocb->cmd_flag & LPFC_IO_FCP) -+ abtsiocbp->cmd_flag |= (LPFC_IO_FCP | LPFC_USE_FCPWQIDX); -+ if (cmdiocb->cmd_flag & LPFC_IO_FOF) -+ abtsiocbp->cmd_flag |= LPFC_IO_FOF; - - if (phba->link_state < LPFC_LINK_UP || - (phba->sli_rev == LPFC_SLI_REV4 && -@@ -12248,9 +12248,9 @@ lpfc_sli_issue_abort_iotag(struct lpfc_h - iabt->ulpCommand = CMD_ABORT_XRI_CN; - - if (cmpl) -- abtsiocbp->iocb_cmpl = cmpl; -+ abtsiocbp->cmd_cmpl = cmpl; - else -- abtsiocbp->iocb_cmpl = lpfc_sli_abort_els_cmpl; -+ abtsiocbp->cmd_cmpl = lpfc_sli_abort_els_cmpl; - abtsiocbp->vport = vport; - - if (phba->sli_rev == LPFC_SLI_REV4) { -@@ -12277,7 +12277,7 @@ lpfc_sli_issue_abort_iotag(struct lpfc_h - abtsiocbp->iotag, retval); - - if (retval) { -- cmdiocb->iocb_flag &= ~LPFC_DRIVER_ABORTED; -+ cmdiocb->cmd_flag &= ~LPFC_DRIVER_ABORTED; - __lpfc_sli_release_iocbq(phba, abtsiocbp); - } - -@@ -12345,9 +12345,9 @@ lpfc_sli_validate_fcp_iocb_for_abort(str - * can't be premarked as driver aborted, nor be an ABORT iocb itself - */ - icmd = &iocbq->iocb; -- if (!(iocbq->iocb_flag & LPFC_IO_FCP) || -- !(iocbq->iocb_flag & LPFC_IO_ON_TXCMPLQ) || -- (iocbq->iocb_flag & LPFC_DRIVER_ABORTED) || -+ if (!(iocbq->cmd_flag & LPFC_IO_FCP) || -+ !(iocbq->cmd_flag & LPFC_IO_ON_TXCMPLQ) || -+ (iocbq->cmd_flag & LPFC_DRIVER_ABORTED) || - (icmd->ulpCommand == CMD_ABORT_XRI_CN || - icmd->ulpCommand == CMD_CLOSE_XRI_CN)) - return -EINVAL; -@@ -12451,8 +12451,8 @@ lpfc_sli_sum_iocb(struct lpfc_vport *vpo - - if (!iocbq || iocbq->vport != vport) - continue; -- if (!(iocbq->iocb_flag & LPFC_IO_FCP) || -- !(iocbq->iocb_flag & LPFC_IO_ON_TXCMPLQ)) -+ if (!(iocbq->cmd_flag & LPFC_IO_FCP) || -+ !(iocbq->cmd_flag & LPFC_IO_ON_TXCMPLQ)) - continue; - - /* Include counting outstanding aborts */ -@@ -12678,8 +12678,8 @@ lpfc_sli_abort_taskmgmt(struct lpfc_vpor - * If the iocbq is already being aborted, don't take a second - * action, but do count it. - */ -- if ((iocbq->iocb_flag & LPFC_DRIVER_ABORTED) || -- !(iocbq->iocb_flag & LPFC_IO_ON_TXCMPLQ)) { -+ if ((iocbq->cmd_flag & LPFC_DRIVER_ABORTED) || -+ !(iocbq->cmd_flag & LPFC_IO_ON_TXCMPLQ)) { - if (phba->sli_rev == LPFC_SLI_REV4) - spin_unlock(&pring_s4->ring_lock); - spin_unlock(&lpfc_cmd->buf_lock); -@@ -12709,10 +12709,10 @@ lpfc_sli_abort_taskmgmt(struct lpfc_vpor - - /* ABTS WQE must go to the same WQ as the WQE to be aborted */ - abtsiocbq->hba_wqidx = iocbq->hba_wqidx; -- if (iocbq->iocb_flag & LPFC_IO_FCP) -- abtsiocbq->iocb_flag |= LPFC_USE_FCPWQIDX; -- if (iocbq->iocb_flag & LPFC_IO_FOF) -- abtsiocbq->iocb_flag |= LPFC_IO_FOF; -+ if (iocbq->cmd_flag & LPFC_IO_FCP) -+ abtsiocbq->cmd_flag |= LPFC_USE_FCPWQIDX; -+ if (iocbq->cmd_flag & LPFC_IO_FOF) -+ abtsiocbq->cmd_flag |= LPFC_IO_FOF; - - ndlp = lpfc_cmd->rdata->pnode; - -@@ -12723,13 +12723,13 @@ lpfc_sli_abort_taskmgmt(struct lpfc_vpor - abtsiocbq->iocb.ulpCommand = CMD_CLOSE_XRI_CN; - - /* Setup callback routine and issue the command. */ -- abtsiocbq->iocb_cmpl = lpfc_sli_abort_fcp_cmpl; -+ abtsiocbq->cmd_cmpl = lpfc_sli_abort_fcp_cmpl; - - /* - * Indicate the IO is being aborted by the driver and set - * the caller's flag into the aborted IO. - */ -- iocbq->iocb_flag |= LPFC_DRIVER_ABORTED; -+ iocbq->cmd_flag |= LPFC_DRIVER_ABORTED; - - if (phba->sli_rev == LPFC_SLI_REV4) { - ret_val = __lpfc_sli_issue_iocb(phba, pring_s4->ringno, -@@ -12778,7 +12778,7 @@ lpfc_sli_wake_iocb_wait(struct lpfc_hba - struct lpfc_io_buf *lpfc_cmd; - - spin_lock_irqsave(&phba->hbalock, iflags); -- if (cmdiocbq->iocb_flag & LPFC_IO_WAKE_TMO) { -+ if (cmdiocbq->cmd_flag & LPFC_IO_WAKE_TMO) { - - /* - * A time out has occurred for the iocb. If a time out -@@ -12787,26 +12787,26 @@ lpfc_sli_wake_iocb_wait(struct lpfc_hba - */ - - spin_unlock_irqrestore(&phba->hbalock, iflags); -- cmdiocbq->iocb_cmpl = cmdiocbq->wait_iocb_cmpl; -- cmdiocbq->wait_iocb_cmpl = NULL; -- if (cmdiocbq->iocb_cmpl) -- (cmdiocbq->iocb_cmpl)(phba, cmdiocbq, NULL); -+ cmdiocbq->cmd_cmpl = cmdiocbq->wait_cmd_cmpl; -+ cmdiocbq->wait_cmd_cmpl = NULL; -+ if (cmdiocbq->cmd_cmpl) -+ (cmdiocbq->cmd_cmpl)(phba, cmdiocbq, NULL); - else - lpfc_sli_release_iocbq(phba, cmdiocbq); - return; - } - -- cmdiocbq->iocb_flag |= LPFC_IO_WAKE; -+ cmdiocbq->cmd_flag |= LPFC_IO_WAKE; - if (cmdiocbq->context2 && rspiocbq) - memcpy(&((struct lpfc_iocbq *)cmdiocbq->context2)->iocb, - &rspiocbq->iocb, sizeof(IOCB_t)); - - /* Set the exchange busy flag for task management commands */ -- if ((cmdiocbq->iocb_flag & LPFC_IO_FCP) && -- !(cmdiocbq->iocb_flag & LPFC_IO_LIBDFC)) { -+ if ((cmdiocbq->cmd_flag & LPFC_IO_FCP) && -+ !(cmdiocbq->cmd_flag & LPFC_IO_LIBDFC)) { - lpfc_cmd = container_of(cmdiocbq, struct lpfc_io_buf, - cur_iocbq); -- if (rspiocbq && (rspiocbq->iocb_flag & LPFC_EXCHANGE_BUSY)) -+ if (rspiocbq && (rspiocbq->cmd_flag & LPFC_EXCHANGE_BUSY)) - lpfc_cmd->flags |= LPFC_SBUF_XBUSY; - else - lpfc_cmd->flags &= ~LPFC_SBUF_XBUSY; -@@ -12825,7 +12825,7 @@ lpfc_sli_wake_iocb_wait(struct lpfc_hba - * @piocbq: Pointer to command iocb. - * @flag: Flag to test. - * -- * This routine grabs the hbalock and then test the iocb_flag to -+ * This routine grabs the hbalock and then test the cmd_flag to - * see if the passed in flag is set. - * Returns: - * 1 if flag is set. -@@ -12839,7 +12839,7 @@ lpfc_chk_iocb_flg(struct lpfc_hba *phba, - int ret; - - spin_lock_irqsave(&phba->hbalock, iflags); -- ret = piocbq->iocb_flag & flag; -+ ret = piocbq->cmd_flag & flag; - spin_unlock_irqrestore(&phba->hbalock, iflags); - return ret; - -@@ -12854,14 +12854,14 @@ lpfc_chk_iocb_flg(struct lpfc_hba *phba, - * @timeout: Timeout in number of seconds. - * - * This function issues the iocb to firmware and waits for the -- * iocb to complete. The iocb_cmpl field of the shall be used -+ * iocb to complete. The cmd_cmpl field of the shall be used - * to handle iocbs which time out. If the field is NULL, the - * function shall free the iocbq structure. If more clean up is - * needed, the caller is expected to provide a completion function - * that will provide the needed clean up. If the iocb command is - * not completed within timeout seconds, the function will either -- * free the iocbq structure (if iocb_cmpl == NULL) or execute the -- * completion function set in the iocb_cmpl field and then return -+ * free the iocbq structure (if cmd_cmpl == NULL) or execute the -+ * completion function set in the cmd_cmpl field and then return - * a status of IOCB_TIMEDOUT. The caller should not free the iocb - * resources if this function returns IOCB_TIMEDOUT. - * The function waits for the iocb completion using an -@@ -12873,7 +12873,7 @@ lpfc_chk_iocb_flg(struct lpfc_hba *phba, - * This function assumes that the iocb completions occur while - * this function sleep. So, this function cannot be called from - * the thread which process iocb completion for this ring. -- * This function clears the iocb_flag of the iocb object before -+ * This function clears the cmd_flag of the iocb object before - * issuing the iocb and the iocb completion handler sets this - * flag and wakes this thread when the iocb completes. - * The contents of the response iocb will be copied to prspiocbq -@@ -12913,10 +12913,10 @@ lpfc_sli_issue_iocb_wait(struct lpfc_hba - piocb->context2 = prspiocbq; - } - -- piocb->wait_iocb_cmpl = piocb->iocb_cmpl; -- piocb->iocb_cmpl = lpfc_sli_wake_iocb_wait; -+ piocb->wait_cmd_cmpl = piocb->cmd_cmpl; -+ piocb->cmd_cmpl = lpfc_sli_wake_iocb_wait; - piocb->context_un.wait_queue = &done_q; -- piocb->iocb_flag &= ~(LPFC_IO_WAKE | LPFC_IO_WAKE_TMO); -+ piocb->cmd_flag &= ~(LPFC_IO_WAKE | LPFC_IO_WAKE_TMO); - - if (phba->cfg_poll & DISABLE_FCP_RING_INT) { - if (lpfc_readl(phba->HCregaddr, &creg_val)) -@@ -12934,7 +12934,7 @@ lpfc_sli_issue_iocb_wait(struct lpfc_hba - lpfc_chk_iocb_flg(phba, piocb, LPFC_IO_WAKE), - timeout_req); - spin_lock_irqsave(&phba->hbalock, iflags); -- if (!(piocb->iocb_flag & LPFC_IO_WAKE)) { -+ if (!(piocb->cmd_flag & LPFC_IO_WAKE)) { - - /* - * IOCB timed out. Inform the wake iocb wait -@@ -12942,7 +12942,7 @@ lpfc_sli_issue_iocb_wait(struct lpfc_hba - */ - - iocb_completed = false; -- piocb->iocb_flag |= LPFC_IO_WAKE_TMO; -+ piocb->cmd_flag |= LPFC_IO_WAKE_TMO; - } - spin_unlock_irqrestore(&phba->hbalock, iflags); - if (iocb_completed) { -@@ -12997,7 +12997,7 @@ lpfc_sli_issue_iocb_wait(struct lpfc_hba - piocb->context2 = NULL; - - piocb->context_un.wait_queue = NULL; -- piocb->iocb_cmpl = NULL; -+ piocb->cmd_cmpl = NULL; - return retval; - } - -@@ -13966,7 +13966,7 @@ lpfc_sli4_iocb_param_transfer(struct lpf - /* Map WCQE parameters into irspiocb parameters */ - status = bf_get(lpfc_wcqe_c_status, wcqe); - pIocbIn->iocb.ulpStatus = (status & LPFC_IOCB_STATUS_MASK); -- if (pIocbOut->iocb_flag & LPFC_IO_FCP) -+ if (pIocbOut->cmd_flag & LPFC_IO_FCP) - if (pIocbIn->iocb.ulpStatus == IOSTAT_FCP_RSP_ERROR) - pIocbIn->iocb.un.fcpi.fcpi_parm = - pIocbOut->iocb.un.fcpi.fcpi_parm - -@@ -14048,7 +14048,7 @@ lpfc_sli4_iocb_param_transfer(struct lpf - /* Pick up HBA exchange busy condition */ - if (bf_get(lpfc_wcqe_c_xb, wcqe)) { - spin_lock_irqsave(&phba->hbalock, iflags); -- pIocbIn->iocb_flag |= LPFC_EXCHANGE_BUSY; -+ pIocbIn->cmd_flag |= LPFC_EXCHANGE_BUSY; - spin_unlock_irqrestore(&phba->hbalock, iflags); - } - } -@@ -14899,7 +14899,6 @@ lpfc_sli4_fp_handle_fcp_wcqe(struct lpfc - { - struct lpfc_sli_ring *pring = cq->pring; - struct lpfc_iocbq *cmdiocbq; -- struct lpfc_iocbq irspiocbq; - unsigned long iflags; - - /* Check for response status */ -@@ -14938,39 +14937,31 @@ lpfc_sli4_fp_handle_fcp_wcqe(struct lpfc - #ifdef CONFIG_SCSI_LPFC_DEBUG_FS - cmdiocbq->isr_timestamp = cq->isr_timestamp; - #endif -- if (cmdiocbq->iocb_cmpl == NULL) { -- if (cmdiocbq->wqe_cmpl) { -- /* For FCP the flag is cleared in wqe_cmpl */ -- if (!(cmdiocbq->iocb_flag & LPFC_IO_FCP) && -- cmdiocbq->iocb_flag & LPFC_DRIVER_ABORTED) { -- spin_lock_irqsave(&phba->hbalock, iflags); -- cmdiocbq->iocb_flag &= ~LPFC_DRIVER_ABORTED; -- spin_unlock_irqrestore(&phba->hbalock, iflags); -- } -+ if (bf_get(lpfc_wcqe_c_xb, wcqe)) { -+ spin_lock_irqsave(&phba->hbalock, iflags); -+ cmdiocbq->cmd_flag |= LPFC_EXCHANGE_BUSY; -+ spin_unlock_irqrestore(&phba->hbalock, iflags); -+ } - -- /* Pass the cmd_iocb and the wcqe to the upper layer */ -- (cmdiocbq->wqe_cmpl)(phba, cmdiocbq, wcqe); -- return; -+ if (cmdiocbq->cmd_cmpl) { -+ /* For FCP the flag is cleared in cmd_cmpl */ -+ if (!(cmdiocbq->cmd_flag & LPFC_IO_FCP) && -+ cmdiocbq->cmd_flag & LPFC_DRIVER_ABORTED) { -+ spin_lock_irqsave(&phba->hbalock, iflags); -+ cmdiocbq->cmd_flag &= ~LPFC_DRIVER_ABORTED; -+ spin_unlock_irqrestore(&phba->hbalock, iflags); - } -+ -+ /* Pass the cmd_iocb and the wcqe to the upper layer */ -+ memcpy(&cmdiocbq->wcqe_cmpl, wcqe, -+ sizeof(struct lpfc_wcqe_complete)); -+ (cmdiocbq->cmd_cmpl)(phba, cmdiocbq, cmdiocbq); -+ } else { - lpfc_printf_log(phba, KERN_WARNING, LOG_SLI, - "0375 FCP cmdiocb not callback function " - "iotag: (%d)\n", - bf_get(lpfc_wcqe_c_request_tag, wcqe)); -- return; -- } -- -- /* Only SLI4 non-IO commands stil use IOCB */ -- /* Fake the irspiocb and copy necessary response information */ -- lpfc_sli4_iocb_param_transfer(phba, &irspiocbq, cmdiocbq, wcqe); -- -- if (cmdiocbq->iocb_flag & LPFC_DRIVER_ABORTED) { -- spin_lock_irqsave(&phba->hbalock, iflags); -- cmdiocbq->iocb_flag &= ~LPFC_DRIVER_ABORTED; -- spin_unlock_irqrestore(&phba->hbalock, iflags); - } -- -- /* Pass the cmd_iocb and the rsp state to the upper layer */ -- (cmdiocbq->iocb_cmpl)(phba, cmdiocbq, &irspiocbq); - } - - /** -@@ -18792,9 +18783,8 @@ lpfc_sli4_seq_abort_rsp(struct lpfc_vpor - return; - } - -- ctiocb->iocb_cmpl = NULL; - ctiocb->vport = phba->pport; -- ctiocb->iocb_cmpl = lpfc_sli4_seq_abort_rsp_cmpl; -+ ctiocb->cmd_cmpl = lpfc_sli4_seq_abort_rsp_cmpl; - ctiocb->sli4_lxritag = NO_XRI; - ctiocb->sli4_xritag = NO_XRI; - -@@ -19195,8 +19185,8 @@ lpfc_sli4_handle_mds_loopback(struct lpf - - iocbq->context2 = pcmd; - iocbq->vport = vport; -- iocbq->iocb_flag &= ~LPFC_FIP_ELS_ID_MASK; -- iocbq->iocb_flag |= LPFC_USE_FCPWQIDX; -+ iocbq->cmd_flag &= ~LPFC_FIP_ELS_ID_MASK; -+ iocbq->cmd_flag |= LPFC_USE_FCPWQIDX; - - /* - * Setup rest of the iocb as though it were a WQE -@@ -19214,7 +19204,7 @@ lpfc_sli4_handle_mds_loopback(struct lpf - - iocbq->iocb.ulpCommand = CMD_SEND_FRAME; - iocbq->iocb.ulpLe = 1; -- iocbq->iocb_cmpl = lpfc_sli4_mds_loopback_cmpl; -+ iocbq->cmd_cmpl = lpfc_sli4_mds_loopback_cmpl; - rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, iocbq, 0); - if (rc == IOCB_ERROR) - goto exit; -@@ -21056,7 +21046,7 @@ lpfc_wqe_bpl2sgl(struct lpfc_hba *phba, - cmd = bf_get(wqe_cmnd, &wqe->generic.wqe_com); - if (cmd == CMD_XMIT_BLS_RSP64_WQE) - return sglq->sli4_xritag; -- numBdes = pwqeq->rsvd2; -+ numBdes = pwqeq->num_bdes; - if (numBdes) { - /* The addrHigh and addrLow fields within the WQE - * have not been byteswapped yet so there is no -@@ -21157,7 +21147,7 @@ lpfc_sli4_issue_wqe(struct lpfc_hba *phb - uint32_t ret = 0; - - /* NVME_LS and NVME_LS ABTS requests. */ -- if (pwqe->iocb_flag & LPFC_IO_NVME_LS) { -+ if (pwqe->cmd_flag & LPFC_IO_NVME_LS) { - pring = phba->sli4_hba.nvmels_wq->pring; - lpfc_qp_spin_lock_irqsave(&pring->ring_lock, iflags, - qp, wq_access); -@@ -21188,7 +21178,7 @@ lpfc_sli4_issue_wqe(struct lpfc_hba *phb - } - - /* NVME_FCREQ and NVME_ABTS requests */ -- if (pwqe->iocb_flag & (LPFC_IO_NVME | LPFC_IO_FCP | LPFC_IO_CMF)) { -+ if (pwqe->cmd_flag & (LPFC_IO_NVME | LPFC_IO_FCP | LPFC_IO_CMF)) { - /* Get the IO distribution (hba_wqidx) for WQ assignment. */ - wq = qp->io_wq; - pring = wq->pring; -@@ -21210,7 +21200,7 @@ lpfc_sli4_issue_wqe(struct lpfc_hba *phb - } - - /* NVMET requests */ -- if (pwqe->iocb_flag & LPFC_IO_NVMET) { -+ if (pwqe->cmd_flag & LPFC_IO_NVMET) { - /* Get the IO distribution (hba_wqidx) for WQ assignment. */ - wq = qp->io_wq; - pring = wq->pring; -@@ -21276,7 +21266,7 @@ lpfc_sli4_issue_abort_iotag(struct lpfc_ - return WQE_NORESOURCE; - - /* Indicate the IO is being aborted by the driver. */ -- cmdiocb->iocb_flag |= LPFC_DRIVER_ABORTED; -+ cmdiocb->cmd_flag |= LPFC_DRIVER_ABORTED; - - abtswqe = &abtsiocb->wqe; - memset(abtswqe, 0, sizeof(*abtswqe)); -@@ -21295,15 +21285,15 @@ lpfc_sli4_issue_abort_iotag(struct lpfc_ - - /* ABTS WQE must go to the same WQ as the WQE to be aborted */ - abtsiocb->hba_wqidx = cmdiocb->hba_wqidx; -- abtsiocb->iocb_flag |= LPFC_USE_FCPWQIDX; -- if (cmdiocb->iocb_flag & LPFC_IO_FCP) -- abtsiocb->iocb_flag |= LPFC_IO_FCP; -- if (cmdiocb->iocb_flag & LPFC_IO_NVME) -- abtsiocb->iocb_flag |= LPFC_IO_NVME; -- if (cmdiocb->iocb_flag & LPFC_IO_FOF) -- abtsiocb->iocb_flag |= LPFC_IO_FOF; -+ abtsiocb->cmd_flag |= LPFC_USE_FCPWQIDX; -+ if (cmdiocb->cmd_flag & LPFC_IO_FCP) -+ abtsiocb->cmd_flag |= LPFC_IO_FCP; -+ if (cmdiocb->cmd_flag & LPFC_IO_NVME) -+ abtsiocb->cmd_flag |= LPFC_IO_NVME; -+ if (cmdiocb->cmd_flag & LPFC_IO_FOF) -+ abtsiocb->cmd_flag |= LPFC_IO_FOF; - abtsiocb->vport = vport; -- abtsiocb->wqe_cmpl = cmpl; -+ abtsiocb->cmd_cmpl = cmpl; - - lpfc_cmd = container_of(cmdiocb, struct lpfc_io_buf, cur_iocbq); - retval = lpfc_sli4_issue_wqe(phba, lpfc_cmd->hdwq, abtsiocb); -@@ -21314,7 +21304,7 @@ lpfc_sli4_issue_abort_iotag(struct lpfc_ - xritag, cmdiocb->iotag, abtsiocb->iotag, retval); - - if (retval) { -- cmdiocb->iocb_flag &= ~LPFC_DRIVER_ABORTED; -+ cmdiocb->cmd_flag &= ~LPFC_DRIVER_ABORTED; - __lpfc_sli_release_iocbq(phba, abtsiocb); - } - -@@ -21676,8 +21666,7 @@ void lpfc_release_io_buf(struct lpfc_hba - - /* MUST zero fields if buffer is reused by another protocol */ - lpfc_ncmd->nvmeCmd = NULL; -- lpfc_ncmd->cur_iocbq.wqe_cmpl = NULL; -- lpfc_ncmd->cur_iocbq.iocb_cmpl = NULL; -+ lpfc_ncmd->cur_iocbq.cmd_cmpl = NULL; - - if (phba->cfg_xpsgl && !phba->nvmet_support && - !list_empty(&lpfc_ncmd->dma_sgl_xtra_list)) ---- a/drivers/scsi/lpfc/lpfc_sli.h -+++ b/drivers/scsi/lpfc/lpfc_sli.h -@@ -63,16 +63,16 @@ struct lpfc_iocbq { - uint16_t sli4_xritag; /* pre-assigned XRI, (OXID) tag. */ - uint16_t hba_wqidx; /* index to HBA work queue */ - struct lpfc_cq_event cq_event; -- struct lpfc_wcqe_complete wcqe_cmpl; /* WQE cmpl */ - uint64_t isr_timestamp; - - union lpfc_wqe128 wqe; /* SLI-4 */ - IOCB_t iocb; /* SLI-3 */ -+ struct lpfc_wcqe_complete wcqe_cmpl; /* WQE cmpl */ - -- uint8_t rsvd2; -+ uint8_t num_bdes; - uint8_t priority; /* OAS priority */ - uint8_t retry; /* retry counter for IOCB cmd - if needed */ -- uint32_t iocb_flag; -+ u32 cmd_flag; - #define LPFC_IO_LIBDFC 1 /* libdfc iocb */ - #define LPFC_IO_WAKE 2 /* Synchronous I/O completed */ - #define LPFC_IO_WAKE_TMO LPFC_IO_WAKE /* Synchronous I/O timed out */ -@@ -116,14 +116,12 @@ struct lpfc_iocbq { - struct lpfc_node_rrq *rrq; - } context_un; - -- void (*fabric_iocb_cmpl)(struct lpfc_hba *, struct lpfc_iocbq *, -- struct lpfc_iocbq *); -- void (*wait_iocb_cmpl)(struct lpfc_hba *, struct lpfc_iocbq *, -- struct lpfc_iocbq *); -- void (*iocb_cmpl)(struct lpfc_hba *, struct lpfc_iocbq *, -- struct lpfc_iocbq *); -- void (*wqe_cmpl)(struct lpfc_hba *, struct lpfc_iocbq *, -- struct lpfc_wcqe_complete *); -+ void (*fabric_cmd_cmpl)(struct lpfc_hba *phba, struct lpfc_iocbq *cmd, -+ struct lpfc_iocbq *rsp); -+ void (*wait_cmd_cmpl)(struct lpfc_hba *phba, struct lpfc_iocbq *cmd, -+ struct lpfc_iocbq *rsp); -+ void (*cmd_cmpl)(struct lpfc_hba *phba, struct lpfc_iocbq *cmd, -+ struct lpfc_iocbq *rsp); - }; - - #define SLI_IOCB_RET_IOCB 1 /* Return IOCB if cmd ring full */ diff --git a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-misc-ELS-paths.patch b/patches.suse/scsi-lpfc-SLI-path-split-Refactor-misc-ELS-paths.patch deleted file mode 100644 index 6cb0cc6..0000000 --- a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-misc-ELS-paths.patch +++ /dev/null @@ -1,1593 +0,0 @@ -From: James Smart -Date: Thu, 24 Feb 2022 18:23:02 -0800 -Subject: scsi: lpfc: SLI path split: Refactor misc ELS paths -Patch-mainline: v5.18-rc1 -Git-commit: 2d1928c57df623db4babcb2e1a2b332b82fad4df -References: bsc#1197675 - -This patch refactors the remaining ELS paths to use SLI-4 as the primary -interface. Paths include RRQ, RSCN, unsolicited ELS RQST and RSP paths, ELS -timeouts, etc.: - - - Remove unused routines lpfc_sli4_bpl2sgl and lpfc_sli4_iocb2wqe - - - Conversion away from using SLI-3 iocb structures to set/access fields in - common routines. Use the new generic get/set routines that were added. - This move changes code from indirect structure references to using local - variables with the generic routines. - - - Refactor routines when setting non-generic fields, to have both SLI3 and - SLI4 specific sections. This replaces the set-as-SLI3 then translate to - SLI4 behavior of the past. - -Link: https://lore.kernel.org/r/20220225022308.16486-12-jsmart2021@gmail.com -Co-developed-by: Justin Tee -Signed-off-by: Justin Tee -Signed-off-by: James Smart -Signed-off-by: Martin K. Petersen -Acked-by: Daniel Wagner ---- - drivers/scsi/lpfc/lpfc_els.c | 224 ++++++---- - drivers/scsi/lpfc/lpfc_hbadisc.c | 44 +- - drivers/scsi/lpfc/lpfc_nportdisc.c | 38 + - drivers/scsi/lpfc/lpfc_sli.c | 807 ++----------------------------------- - 4 files changed, 241 insertions(+), 872 deletions(-) - ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -1219,18 +1219,20 @@ static void - lpfc_cmpl_els_link_down(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - struct lpfc_iocbq *rspiocb) - { -- IOCB_t *irsp; - uint32_t *pcmd; - uint32_t cmd; -+ u32 ulp_status, ulp_word4; - - pcmd = (uint32_t *)(((struct lpfc_dmabuf *)cmdiocb->context2)->virt); - cmd = *pcmd; -- irsp = &rspiocb->iocb; -+ -+ ulp_status = get_job_ulpstatus(phba, rspiocb); -+ ulp_word4 = get_job_word4(phba, rspiocb); - - lpfc_printf_log(phba, KERN_INFO, LOG_ELS, - "6445 ELS completes after LINK_DOWN: " - " Status %x/%x cmd x%x flg x%x\n", -- irsp->ulpStatus, irsp->un.ulpWord[4], cmd, -+ ulp_status, ulp_word4, cmd, - cmdiocb->cmd_flag); - - if (cmdiocb->cmd_flag & LPFC_IO_FABRIC) { -@@ -1884,43 +1886,43 @@ lpfc_end_rscn(struct lpfc_vport *vport) - - static void - lpfc_cmpl_els_rrq(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, -- struct lpfc_iocbq *rspiocb) -+ struct lpfc_iocbq *rspiocb) - { - struct lpfc_vport *vport = cmdiocb->vport; -- IOCB_t *irsp; - struct lpfc_nodelist *ndlp = cmdiocb->context1; - struct lpfc_node_rrq *rrq; -+ u32 ulp_status = get_job_ulpstatus(phba, rspiocb); -+ u32 ulp_word4 = get_job_word4(phba, rspiocb); - - /* we pass cmdiocb to state machine which needs rspiocb as well */ - rrq = cmdiocb->context_un.rrq; - cmdiocb->context_un.rsp_iocb = rspiocb; - -- irsp = &rspiocb->iocb; - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, - "RRQ cmpl: status:x%x/x%x did:x%x", -- irsp->ulpStatus, irsp->un.ulpWord[4], -- irsp->un.elsreq64.remoteID); -+ ulp_status, ulp_word4, -+ get_job_els_rsp64_did(phba, cmdiocb)); -+ - - /* rrq completes to NPort */ - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "2880 RRQ completes to DID x%x " - "Data: x%x x%x x%x x%x x%x\n", -- irsp->un.elsreq64.remoteID, -- irsp->ulpStatus, irsp->un.ulpWord[4], -- irsp->ulpTimeout, rrq->xritag, rrq->rxid); -+ ndlp->nlp_DID, ulp_status, ulp_word4, -+ get_wqe_tmo(cmdiocb), rrq->xritag, rrq->rxid); - -- if (irsp->ulpStatus) { -+ if (ulp_status) { - /* Check for retry */ - /* RRQ failed Don't print the vport to vport rjts */ -- if (irsp->ulpStatus != IOSTAT_LS_RJT || -- (((irsp->un.ulpWord[4]) >> 16 != LSRJT_INVALID_CMD) && -- ((irsp->un.ulpWord[4]) >> 16 != LSRJT_UNABLE_TPC)) || -- (phba)->pport->cfg_log_verbose & LOG_ELS) -+ if (ulp_status != IOSTAT_LS_RJT || -+ (((ulp_word4) >> 16 != LSRJT_INVALID_CMD) && -+ ((ulp_word4) >> 16 != LSRJT_UNABLE_TPC)) || -+ (phba)->pport->cfg_log_verbose & LOG_ELS) - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, - "2881 RRQ failure DID:%06X Status:" - "x%x/x%x\n", -- ndlp->nlp_DID, irsp->ulpStatus, -- irsp->un.ulpWord[4]); -+ ndlp->nlp_DID, ulp_status, -+ ulp_word4); - } - - lpfc_clr_rrq_active(phba, rrq->xritag, rrq); -@@ -5293,7 +5295,9 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, - && (ndlp->nlp_flag & NLP_ACC_REGLOGIN)) { - if (!lpfc_unreg_rpi(vport, ndlp) && - (!(vport->fc_flag & FC_PT2PT))) { -- if (ndlp->nlp_state == NLP_STE_REG_LOGIN_ISSUE) { -+ if (ndlp->nlp_state == NLP_STE_PLOGI_ISSUE || -+ ndlp->nlp_state == -+ NLP_STE_REG_LOGIN_ISSUE) { - lpfc_printf_vlog(vport, KERN_INFO, - LOG_DISCOVERY, - "0314 PLOGI recov " -@@ -5374,12 +5378,15 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, - (vport && vport->port_type == LPFC_NPIV_PORT) && - !(ndlp->fc4_xpt_flags & SCSI_XPT_REGD) && - ndlp->nlp_flag & NLP_RELEASE_RPI) { -- lpfc_sli4_free_rpi(phba, ndlp->nlp_rpi); -- spin_lock_irq(&ndlp->lock); -- ndlp->nlp_rpi = LPFC_RPI_ALLOC_ERROR; -- ndlp->nlp_flag &= ~NLP_RELEASE_RPI; -- spin_unlock_irq(&ndlp->lock); -- lpfc_drop_node(vport, ndlp); -+ if (ndlp->nlp_state != NLP_STE_PLOGI_ISSUE && -+ ndlp->nlp_state != NLP_STE_REG_LOGIN_ISSUE) { -+ lpfc_sli4_free_rpi(phba, ndlp->nlp_rpi); -+ spin_lock_irq(&ndlp->lock); -+ ndlp->nlp_rpi = LPFC_RPI_ALLOC_ERROR; -+ ndlp->nlp_flag &= ~NLP_RELEASE_RPI; -+ spin_unlock_irq(&ndlp->lock); -+ lpfc_drop_node(vport, ndlp); -+ } - } - - /* Release the originating I/O reference. */ -@@ -7873,6 +7880,13 @@ lpfc_els_rcv_rscn(struct lpfc_vport *vpo - - lpfc_els_rsp_acc(vport, ELS_CMD_ACC, cmdiocb, - ndlp, NULL); -+ /* Restart disctmo if its already running */ -+ if (vport->fc_flag & FC_DISC_TMO) { -+ tmo = ((phba->fc_ratov * 3) + 3); -+ mod_timer(&vport->fc_disctmo, -+ jiffies + -+ msecs_to_jiffies(1000 * tmo)); -+ } - return 0; - } - } -@@ -9231,6 +9245,7 @@ lpfc_els_timeout_handler(struct lpfc_vpo - uint32_t timeout; - uint32_t remote_ID = 0xffffffff; - LIST_HEAD(abort_list); -+ u32 ulp_command = 0, ulp_context = 0, did = 0, iotag = 0; - - - timeout = (uint32_t)(phba->fc_ratov << 1); -@@ -9247,11 +9262,21 @@ lpfc_els_timeout_handler(struct lpfc_vpo - spin_lock(&pring->ring_lock); - - list_for_each_entry_safe(piocb, tmp_iocb, &pring->txcmplq, list) { -- cmd = &piocb->iocb; -+ ulp_command = get_job_cmnd(phba, piocb); -+ ulp_context = get_job_ulpcontext(phba, piocb); -+ did = get_job_els_rsp64_did(phba, piocb); -+ -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ iotag = get_wqe_reqtag(piocb); -+ } else { -+ cmd = &piocb->iocb; -+ iotag = cmd->ulpIoTag; -+ } - - if ((piocb->cmd_flag & LPFC_IO_LIBDFC) != 0 || -- piocb->iocb.ulpCommand == CMD_ABORT_XRI_CN || -- piocb->iocb.ulpCommand == CMD_CLOSE_XRI_CN) -+ ulp_command == CMD_ABORT_XRI_CX || -+ ulp_command == CMD_ABORT_XRI_CN || -+ ulp_command == CMD_CLOSE_XRI_CN) - continue; - - if (piocb->vport != vport) -@@ -9275,11 +9300,11 @@ lpfc_els_timeout_handler(struct lpfc_vpo - } - - remote_ID = 0xffffffff; -- if (cmd->ulpCommand != CMD_GEN_REQUEST64_CR) -- remote_ID = cmd->un.elsreq64.remoteID; -- else { -+ if (ulp_command != CMD_GEN_REQUEST64_CR) { -+ remote_ID = did; -+ } else { - struct lpfc_nodelist *ndlp; -- ndlp = __lpfc_findnode_rpi(vport, cmd->ulpContext); -+ ndlp = __lpfc_findnode_rpi(vport, ulp_context); - if (ndlp) - remote_ID = ndlp->nlp_DID; - } -@@ -9290,11 +9315,11 @@ lpfc_els_timeout_handler(struct lpfc_vpo - spin_unlock_irq(&phba->hbalock); - - list_for_each_entry_safe(piocb, tmp_iocb, &abort_list, dlist) { -- cmd = &piocb->iocb; - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, - "0127 ELS timeout Data: x%x x%x x%x " - "x%x\n", els_command, -- remote_ID, cmd->ulpCommand, cmd->ulpIoTag); -+ remote_ID, ulp_command, iotag); -+ - spin_lock_irq(&phba->hbalock); - list_del_init(&piocb->dlist); - lpfc_sli_issue_abort_iotag(phba, pring, piocb, NULL); -@@ -9337,7 +9362,7 @@ lpfc_els_flush_cmd(struct lpfc_vport *vp - struct lpfc_hba *phba = vport->phba; - struct lpfc_sli_ring *pring; - struct lpfc_iocbq *tmp_iocb, *piocb; -- IOCB_t *cmd = NULL; -+ u32 ulp_command; - unsigned long iflags = 0; - - lpfc_fabric_abort_vport(vport); -@@ -9374,8 +9399,8 @@ lpfc_els_flush_cmd(struct lpfc_vport *vp - /* On the ELS ring we can have ELS_REQUESTs or - * GEN_REQUESTs waiting for a response. - */ -- cmd = &piocb->iocb; -- if (cmd->ulpCommand == CMD_ELS_REQUEST64_CR) { -+ ulp_command = get_job_cmnd(phba, piocb); -+ if (ulp_command == CMD_ELS_REQUEST64_CR) { - list_add_tail(&piocb->dlist, &abort_list); - - /* If the link is down when flushing ELS commands -@@ -9388,7 +9413,7 @@ lpfc_els_flush_cmd(struct lpfc_vport *vp - if (phba->link_state == LPFC_LINK_DOWN) - piocb->cmd_cmpl = lpfc_cmpl_els_link_down; - } -- if (cmd->ulpCommand == CMD_GEN_REQUEST64_CR) -+ if (ulp_command == CMD_GEN_REQUEST64_CR) - list_add_tail(&piocb->dlist, &abort_list); - } - -@@ -9419,16 +9444,17 @@ lpfc_els_flush_cmd(struct lpfc_vport *vp - * just queue them up for lpfc_sli_cancel_iocbs - */ - list_for_each_entry_safe(piocb, tmp_iocb, &pring->txq, list) { -- cmd = &piocb->iocb; -+ ulp_command = get_job_cmnd(phba, piocb); - - if (piocb->cmd_flag & LPFC_IO_LIBDFC) - continue; - - /* Do not flush out the QUE_RING and ABORT/CLOSE iocbs */ -- if (cmd->ulpCommand == CMD_QUE_RING_BUF_CN || -- cmd->ulpCommand == CMD_QUE_RING_BUF64_CN || -- cmd->ulpCommand == CMD_CLOSE_XRI_CN || -- cmd->ulpCommand == CMD_ABORT_XRI_CN) -+ if (ulp_command == CMD_QUE_RING_BUF_CN || -+ ulp_command == CMD_QUE_RING_BUF64_CN || -+ ulp_command == CMD_CLOSE_XRI_CN || -+ ulp_command == CMD_ABORT_XRI_CN || -+ ulp_command == CMD_ABORT_XRI_CX) - continue; - - if (piocb->vport != vport) -@@ -9442,7 +9468,6 @@ lpfc_els_flush_cmd(struct lpfc_vport *vp - if (vport == phba->pport) { - list_for_each_entry_safe(piocb, tmp_iocb, - &phba->fabric_iocb_list, list) { -- cmd = &piocb->iocb; - list_del_init(&piocb->list); - list_add_tail(&piocb->list, &abort_list); - } -@@ -9510,12 +9535,16 @@ lpfc_send_els_failure_event(struct lpfc_ - struct ls_rjt stat; - struct lpfc_nodelist *ndlp; - uint32_t *pcmd; -+ u32 ulp_status, ulp_word4; - - ndlp = cmdiocbp->context1; - if (!ndlp) - return; - -- if (rspiocbp->iocb.ulpStatus == IOSTAT_LS_RJT) { -+ ulp_status = get_job_ulpstatus(phba, rspiocbp); -+ ulp_word4 = get_job_word4(phba, rspiocbp); -+ -+ if (ulp_status == IOSTAT_LS_RJT) { - lsrjt_event.header.event_type = FC_REG_ELS_EVENT; - lsrjt_event.header.subcategory = LPFC_EVENT_LSRJT_RCV; - memcpy(lsrjt_event.header.wwpn, &ndlp->nlp_portname, -@@ -9525,7 +9554,7 @@ lpfc_send_els_failure_event(struct lpfc_ - pcmd = (uint32_t *) (((struct lpfc_dmabuf *) - cmdiocbp->context2)->virt); - lsrjt_event.command = (pcmd != NULL) ? *pcmd : 0; -- stat.un.lsRjtError = be32_to_cpu(rspiocbp->iocb.un.ulpWord[4]); -+ stat.un.ls_rjt_error_be = cpu_to_be32(ulp_word4); - lsrjt_event.reason_code = stat.un.b.lsRjtRsnCode; - lsrjt_event.explanation = stat.un.b.lsRjtRsnCodeExp; - fc_host_post_vendor_event(shost, -@@ -9535,10 +9564,10 @@ lpfc_send_els_failure_event(struct lpfc_ - LPFC_NL_VENDOR_ID); - return; - } -- if ((rspiocbp->iocb.ulpStatus == IOSTAT_NPORT_BSY) || -- (rspiocbp->iocb.ulpStatus == IOSTAT_FABRIC_BSY)) { -+ if (ulp_status == IOSTAT_NPORT_BSY || -+ ulp_status == IOSTAT_FABRIC_BSY) { - fabric_event.event_type = FC_REG_FABRIC_EVENT; -- if (rspiocbp->iocb.ulpStatus == IOSTAT_NPORT_BSY) -+ if (ulp_status == IOSTAT_NPORT_BSY) - fabric_event.subcategory = LPFC_EVENT_PORT_BUSY; - else - fabric_event.subcategory = LPFC_EVENT_FABRIC_BUSY; -@@ -10051,27 +10080,32 @@ lpfc_els_unsol_buffer(struct lpfc_hba *p - { - struct lpfc_nodelist *ndlp; - struct ls_rjt stat; -- uint32_t *payload, payload_len; -- uint32_t cmd, did, newnode; -+ u32 *payload, payload_len; -+ u32 cmd = 0, did = 0, newnode, status = 0; - uint8_t rjt_exp, rjt_err = 0, init_link = 0; -- IOCB_t *icmd = &elsiocb->iocb; -+ struct lpfc_wcqe_complete *wcqe_cmpl = NULL; - LPFC_MBOXQ_t *mbox; - - if (!vport || !(elsiocb->context2)) - goto dropit; - - newnode = 0; -+ wcqe_cmpl = &elsiocb->wcqe_cmpl; - payload = ((struct lpfc_dmabuf *)elsiocb->context2)->virt; -- payload_len = elsiocb->iocb.unsli3.rcvsli3.acc_len; -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ payload_len = wcqe_cmpl->total_data_placed; -+ else -+ payload_len = elsiocb->iocb.unsli3.rcvsli3.acc_len; -+ status = get_job_ulpstatus(phba, elsiocb); - cmd = *payload; - if ((phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) == 0) - lpfc_sli3_post_buffer(phba, pring, 1); - -- did = icmd->un.rcvels.remoteID; -- if (icmd->ulpStatus) { -+ did = get_job_els_rsp64_did(phba, elsiocb); -+ if (status) { - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_UNSOL, - "RCV Unsol ELS: status:x%x/x%x did:x%x", -- icmd->ulpStatus, icmd->un.ulpWord[4], did); -+ status, get_job_word4(phba, elsiocb), did); - goto dropit; - } - -@@ -10157,7 +10191,9 @@ lpfc_els_unsol_buffer(struct lpfc_hba *p - * the vfi. This is done in lpfc_rcv_plogi but - * that is called after the reg_vfi. - */ -- vport->fc_myDID = elsiocb->iocb.un.rcvels.parmRo; -+ vport->fc_myDID = -+ bf_get(els_rsp64_sid, -+ &elsiocb->wqe.xmit_els_rsp); - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "3312 Remote port assigned DID x%x " - "%x\n", vport->fc_myDID, -@@ -10502,8 +10538,9 @@ lpfc_els_unsol_buffer(struct lpfc_hba *p - if (vport && !(vport->load_flag & FC_UNLOADING)) - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, - "0111 Dropping received ELS cmd " -- "Data: x%x x%x x%x\n", -- icmd->ulpStatus, icmd->un.ulpWord[4], icmd->ulpTimeout); -+ "Data: x%x x%x x%x x%x\n", -+ cmd, status, get_job_word4(phba, elsiocb), did); -+ - phba->fc_stat.elsRcvDrop++; - } - -@@ -10523,20 +10560,31 @@ void - lpfc_els_unsol_event(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, - struct lpfc_iocbq *elsiocb) - { -- struct lpfc_vport *vport = phba->pport; -- IOCB_t *icmd = &elsiocb->iocb; -- dma_addr_t paddr; -+ struct lpfc_vport *vport = elsiocb->vport; -+ u32 ulp_command, status, parameter, bde_count = 0; -+ IOCB_t *icmd; -+ struct lpfc_wcqe_complete *wcqe_cmpl = NULL; - struct lpfc_dmabuf *bdeBuf1 = elsiocb->context2; - struct lpfc_dmabuf *bdeBuf2 = elsiocb->context3; -+ dma_addr_t paddr; - - elsiocb->context1 = NULL; - elsiocb->context2 = NULL; - elsiocb->context3 = NULL; - -- if (icmd->ulpStatus == IOSTAT_NEED_BUFFER) { -+ wcqe_cmpl = &elsiocb->wcqe_cmpl; -+ ulp_command = get_job_cmnd(phba, elsiocb); -+ status = get_job_ulpstatus(phba, elsiocb); -+ parameter = get_job_word4(phba, elsiocb); -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ bde_count = wcqe_cmpl->word3; -+ else -+ bde_count = elsiocb->iocb.ulpBdeCount; -+ -+ if (status == IOSTAT_NEED_BUFFER) { - lpfc_sli_hbqbuf_add_hbqs(phba, LPFC_ELS_HBQ); -- } else if (icmd->ulpStatus == IOSTAT_LOCAL_REJECT && -- (icmd->un.ulpWord[4] & IOERR_PARAM_MASK) == -+ } else if (status == IOSTAT_LOCAL_REJECT && -+ (parameter & IOERR_PARAM_MASK) == - IOERR_RCV_BUFFER_WAITING) { - phba->fc_stat.NoRcvBuf++; - /* Not enough posted buffers; Try posting more buffers */ -@@ -10545,32 +10593,43 @@ lpfc_els_unsol_event(struct lpfc_hba *ph - return; - } - -- if ((phba->sli3_options & LPFC_SLI3_NPIV_ENABLED) && -- (icmd->ulpCommand == CMD_IOCB_RCV_ELS64_CX || -- icmd->ulpCommand == CMD_IOCB_RCV_SEQ64_CX)) { -- if (icmd->unsli3.rcvsli3.vpi == 0xffff) -- vport = phba->pport; -- else -- vport = lpfc_find_vport_by_vpid(phba, -+ if (phba->sli_rev == LPFC_SLI_REV3) { -+ icmd = &elsiocb->iocb; -+ if ((phba->sli3_options & LPFC_SLI3_NPIV_ENABLED) && -+ (ulp_command == CMD_IOCB_RCV_ELS64_CX || -+ ulp_command == CMD_IOCB_RCV_SEQ64_CX)) { -+ if (icmd->unsli3.rcvsli3.vpi == 0xffff) -+ vport = phba->pport; -+ else -+ vport = lpfc_find_vport_by_vpid(phba, - icmd->unsli3.rcvsli3.vpi); -+ } - } - - /* If there are no BDEs associated - * with this IOCB, there is nothing to do. - */ -- if (icmd->ulpBdeCount == 0) -+ if (bde_count == 0) - return; - -- /* type of ELS cmd is first 32bit word -- * in packet -- */ -+ /* Account for SLI2 or SLI3 and later unsolicited buffering */ - if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) { - elsiocb->context2 = bdeBuf1; -+ if (bde_count == 2) -+ elsiocb->context3 = bdeBuf2; - } else { -+ icmd = &elsiocb->iocb; - paddr = getPaddr(icmd->un.cont64[0].addrHigh, - icmd->un.cont64[0].addrLow); - elsiocb->context2 = lpfc_sli_ringpostbuf_get(phba, pring, - paddr); -+ if (bde_count == 2) { -+ paddr = getPaddr(icmd->un.cont64[1].addrHigh, -+ icmd->un.cont64[1].addrLow); -+ elsiocb->context3 = lpfc_sli_ringpostbuf_get(phba, -+ pring, -+ paddr); -+ } - } - - lpfc_els_unsol_buffer(phba, pring, vport, elsiocb); -@@ -10583,16 +10642,9 @@ lpfc_els_unsol_event(struct lpfc_hba *ph - elsiocb->context2 = NULL; - } - -- /* RCV_ELS64_CX provide for 2 BDEs - process 2nd if included */ -- if ((phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) && -- icmd->ulpBdeCount == 2) { -- elsiocb->context2 = bdeBuf2; -- lpfc_els_unsol_buffer(phba, pring, vport, elsiocb); -- /* free mp if we are done with it */ -- if (elsiocb->context2) { -- lpfc_in_buf_free(phba, elsiocb->context2); -- elsiocb->context2 = NULL; -- } -+ if (elsiocb->context3) { -+ lpfc_in_buf_free(phba, elsiocb->context3); -+ elsiocb->context3 = NULL; - } - } - ---- a/drivers/scsi/lpfc/lpfc_hbadisc.c -+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c -@@ -4907,7 +4907,8 @@ lpfc_can_disctmo(struct lpfc_vport *vpor - vport->port_state, vport->fc_ns_retry, vport->fc_flag); - - /* Turn off discovery timer if its running */ -- if (vport->fc_flag & FC_DISC_TMO) { -+ if (vport->fc_flag & FC_DISC_TMO || -+ timer_pending(&vport->fc_disctmo)) { - spin_lock_irqsave(shost->host_lock, iflags); - vport->fc_flag &= ~FC_DISC_TMO; - spin_unlock_irqrestore(shost->host_lock, iflags); -@@ -4936,20 +4937,26 @@ lpfc_check_sli_ndlp(struct lpfc_hba *phb - struct lpfc_iocbq *iocb, - struct lpfc_nodelist *ndlp) - { -- IOCB_t *icmd = &iocb->iocb; -- struct lpfc_vport *vport = ndlp->vport; -+ struct lpfc_vport *vport = ndlp->vport; -+ u8 ulp_command; -+ u16 ulp_context; -+ u32 remote_id; - - if (iocb->vport != vport) - return 0; - -+ ulp_command = get_job_cmnd(phba, iocb); -+ ulp_context = get_job_ulpcontext(phba, iocb); -+ remote_id = get_job_els_rsp64_did(phba, iocb); -+ - if (pring->ringno == LPFC_ELS_RING) { -- switch (icmd->ulpCommand) { -+ switch (ulp_command) { - case CMD_GEN_REQUEST64_CR: - if (iocb->context_un.ndlp == ndlp) - return 1; - /* fall through */ - case CMD_ELS_REQUEST64_CR: -- if (icmd->un.elsreq64.remoteID == ndlp->nlp_DID) -+ if (remote_id == ndlp->nlp_DID) - return 1; - /* fall through */ - case CMD_XMIT_ELS_RSP64_CX: -@@ -4963,9 +4970,8 @@ lpfc_check_sli_ndlp(struct lpfc_hba *phb - (ndlp->nlp_flag & NLP_DELAY_TMO)) { - return 0; - } -- if (icmd->ulpContext == (volatile ushort)ndlp->nlp_rpi) { -+ if (ulp_context == ndlp->nlp_rpi) - return 1; -- } - } - return 0; - } -@@ -5876,9 +5882,9 @@ static void - lpfc_free_tx(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp) - { - LIST_HEAD(completions); -- IOCB_t *icmd; - struct lpfc_iocbq *iocb, *next_iocb; - struct lpfc_sli_ring *pring; -+ u32 ulp_command; - - pring = lpfc_phba_elsring(phba); - if (unlikely(!pring)) -@@ -5889,12 +5895,13 @@ lpfc_free_tx(struct lpfc_hba *phba, stru - */ - spin_lock_irq(&phba->hbalock); - list_for_each_entry_safe(iocb, next_iocb, &pring->txq, list) { -- if (iocb->context1 != ndlp) { -+ if (iocb->context1 != ndlp) - continue; -- } -- icmd = &iocb->iocb; -- if ((icmd->ulpCommand == CMD_ELS_REQUEST64_CR) || -- (icmd->ulpCommand == CMD_XMIT_ELS_RSP64_CX)) { -+ -+ ulp_command = get_job_cmnd(phba, iocb); -+ -+ if (ulp_command == CMD_ELS_REQUEST64_CR || -+ ulp_command == CMD_XMIT_ELS_RSP64_CX) { - - list_move_tail(&iocb->list, &completions); - } -@@ -5902,12 +5909,13 @@ lpfc_free_tx(struct lpfc_hba *phba, stru - - /* Next check the txcmplq */ - list_for_each_entry_safe(iocb, next_iocb, &pring->txcmplq, list) { -- if (iocb->context1 != ndlp) { -+ if (iocb->context1 != ndlp) - continue; -- } -- icmd = &iocb->iocb; -- if (icmd->ulpCommand == CMD_ELS_REQUEST64_CR || -- icmd->ulpCommand == CMD_XMIT_ELS_RSP64_CX) { -+ -+ ulp_command = get_job_cmnd(phba, iocb); -+ -+ if (ulp_command == CMD_ELS_REQUEST64_CR || -+ ulp_command == CMD_XMIT_ELS_RSP64_CX) { - lpfc_sli_issue_abort_iotag(phba, pring, iocb, NULL); - } - } ---- a/drivers/scsi/lpfc/lpfc_nportdisc.c -+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c -@@ -173,9 +173,8 @@ lpfc_check_elscmpl_iocb(struct lpfc_hba - struct lpfc_dmabuf *pcmd, *prsp; - uint32_t *lp; - void *ptr = NULL; -- IOCB_t *irsp; -+ u32 ulp_status = get_job_ulpstatus(phba, rspiocb); - -- irsp = &rspiocb->iocb; - pcmd = (struct lpfc_dmabuf *) cmdiocb->context2; - - /* For lpfc_els_abort, context2 could be zero'ed to delay -@@ -189,10 +188,16 @@ lpfc_check_elscmpl_iocb(struct lpfc_hba - ptr = (void *)((uint8_t *)lp + sizeof(uint32_t)); - } - } else { -- /* Force ulpStatus error since we are returning NULL ptr */ -- if (!(irsp->ulpStatus)) { -- irsp->ulpStatus = IOSTAT_LOCAL_REJECT; -- irsp->un.ulpWord[4] = IOERR_SLI_ABORTED; -+ /* Force ulp_status error since we are returning NULL ptr */ -+ if (!(ulp_status)) { -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ bf_set(lpfc_wcqe_c_status, &rspiocb->wcqe_cmpl, -+ IOSTAT_LOCAL_REJECT); -+ rspiocb->wcqe_cmpl.parameter = IOERR_SLI_ABORTED; -+ } else { -+ rspiocb->iocb.ulpStatus = IOSTAT_LOCAL_REJECT; -+ rspiocb->iocb.un.ulpWord[4] = IOERR_SLI_ABORTED; -+ } - } - ptr = NULL; - } -@@ -327,6 +332,7 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, - struct lpfc_dmabuf *mp; - uint64_t nlp_portwwn = 0; - uint32_t *lp; -+ union lpfc_wqe128 *wqe; - IOCB_t *icmd; - struct serv_parm *sp; - uint32_t ed_tov; -@@ -336,6 +342,7 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, - struct ls_rjt stat; - uint32_t vid, flag; - int rc; -+ u32 remote_did; - - memset(&stat, 0, sizeof (struct ls_rjt)); - pcmd = (struct lpfc_dmabuf *) cmdiocb->context2; -@@ -369,7 +376,11 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, - NULL); - return 0; - } -- icmd = &cmdiocb->iocb; -+ -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ wqe = &cmdiocb->wqe; -+ else -+ icmd = &cmdiocb->iocb; - - /* PLOGI chkparm OK */ - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, -@@ -454,7 +465,12 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, - if ((vport->fc_flag & FC_PT2PT) && - !(vport->fc_flag & FC_PT2PT_PLOGI)) { - /* rcv'ed PLOGI decides what our NPortId will be */ -- vport->fc_myDID = icmd->un.rcvels.parmRo; -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ vport->fc_myDID = bf_get(els_rsp64_sid, -+ &cmdiocb->wqe.xmit_els_rsp); -+ } else { -+ vport->fc_myDID = icmd->un.rcvels.parmRo; -+ } - - /* If there is an outstanding FLOGI, abort it now. - * The remote NPort is not going to ACC our FLOGI -@@ -535,7 +551,11 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, - /* Issue REG_LOGIN first, before ACCing the PLOGI, thus we will - * always be deferring the ACC. - */ -- rc = lpfc_reg_rpi(phba, vport->vpi, icmd->un.rcvels.remoteID, -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ remote_did = bf_get(wqe_els_did, &wqe->xmit_els_rsp.wqe_dest); -+ else -+ remote_did = icmd->un.rcvels.remoteID; -+ rc = lpfc_reg_rpi(phba, vport->vpi, remote_did, - (uint8_t *)sp, login_mbox, ndlp->nlp_rpi); - if (rc) - goto out; ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -1538,16 +1538,20 @@ lpfc_sli_cancel_iocbs(struct lpfc_hba *p - while (!list_empty(iocblist)) { - list_remove_head(iocblist, piocb, struct lpfc_iocbq, list); - if (piocb->cmd_cmpl) { -- if (piocb->cmd_flag & LPFC_IO_NVME) -+ if (piocb->cmd_flag & LPFC_IO_NVME) { - lpfc_nvme_cancel_iocb(phba, piocb, - ulpstatus, ulpWord4); -- else -- lpfc_sli_release_iocbq(phba, piocb); -- -- } else if (piocb->cmd_cmpl) { -- piocb->iocb.ulpStatus = ulpstatus; -- piocb->iocb.un.ulpWord[4] = ulpWord4; -- (piocb->cmd_cmpl) (phba, piocb, piocb); -+ } else { -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ bf_set(lpfc_wcqe_c_status, -+ &piocb->wcqe_cmpl, ulpstatus); -+ piocb->wcqe_cmpl.parameter = ulpWord4; -+ } else { -+ piocb->iocb.ulpStatus = ulpstatus; -+ piocb->iocb.un.ulpWord[4] = ulpWord4; -+ } -+ (piocb->cmd_cmpl) (phba, piocb, piocb); -+ } - } else { - lpfc_sli_release_iocbq(phba, piocb); - } -@@ -10051,713 +10055,6 @@ static int - } - - /** -- * lpfc_sli4_bpl2sgl - Convert the bpl/bde to a sgl. -- * @phba: Pointer to HBA context object. -- * @piocbq: Pointer to command iocb. -- * @sglq: Pointer to the scatter gather queue object. -- * -- * This routine converts the bpl or bde that is in the IOCB -- * to a sgl list for the sli4 hardware. The physical address -- * of the bpl/bde is converted back to a virtual address. -- * If the IOCB contains a BPL then the list of BDE's is -- * converted to sli4_sge's. If the IOCB contains a single -- * BDE then it is converted to a single sli_sge. -- * The IOCB is still in cpu endianess so the contents of -- * the bpl can be used without byte swapping. -- * -- * Returns valid XRI = Success, NO_XRI = Failure. --**/ --static uint16_t --lpfc_sli4_bpl2sgl(struct lpfc_hba *phba, struct lpfc_iocbq *piocbq, -- struct lpfc_sglq *sglq) --{ -- uint16_t xritag = NO_XRI; -- struct ulp_bde64 *bpl = NULL; -- struct ulp_bde64 bde; -- struct sli4_sge *sgl = NULL; -- struct lpfc_dmabuf *dmabuf; -- IOCB_t *icmd; -- int numBdes = 0; -- int i = 0; -- uint32_t offset = 0; /* accumulated offset in the sg request list */ -- int inbound = 0; /* number of sg reply entries inbound from firmware */ -- -- if (!piocbq || !sglq) -- return xritag; -- -- sgl = (struct sli4_sge *)sglq->sgl; -- icmd = &piocbq->iocb; -- if (icmd->ulpCommand == CMD_XMIT_BLS_RSP64_CX) -- return sglq->sli4_xritag; -- if (icmd->un.genreq64.bdl.bdeFlags == BUFF_TYPE_BLP_64) { -- numBdes = icmd->un.genreq64.bdl.bdeSize / -- sizeof(struct ulp_bde64); -- /* The addrHigh and addrLow fields within the IOCB -- * have not been byteswapped yet so there is no -- * need to swap them back. -- */ -- if (piocbq->context3) -- dmabuf = (struct lpfc_dmabuf *)piocbq->context3; -- else -- return xritag; -- -- bpl = (struct ulp_bde64 *)dmabuf->virt; -- if (!bpl) -- return xritag; -- -- for (i = 0; i < numBdes; i++) { -- /* Should already be byte swapped. */ -- sgl->addr_hi = bpl->addrHigh; -- sgl->addr_lo = bpl->addrLow; -- -- sgl->word2 = le32_to_cpu(sgl->word2); -- if ((i+1) == numBdes) -- bf_set(lpfc_sli4_sge_last, sgl, 1); -- else -- bf_set(lpfc_sli4_sge_last, sgl, 0); -- /* swap the size field back to the cpu so we -- * can assign it to the sgl. -- */ -- bde.tus.w = le32_to_cpu(bpl->tus.w); -- sgl->sge_len = cpu_to_le32(bde.tus.f.bdeSize); -- /* The offsets in the sgl need to be accumulated -- * separately for the request and reply lists. -- * The request is always first, the reply follows. -- */ -- if (piocbq->iocb.ulpCommand == CMD_GEN_REQUEST64_CR) { -- /* add up the reply sg entries */ -- if (bpl->tus.f.bdeFlags == BUFF_TYPE_BDE_64I) -- inbound++; -- /* first inbound? reset the offset */ -- if (inbound == 1) -- offset = 0; -- bf_set(lpfc_sli4_sge_offset, sgl, offset); -- bf_set(lpfc_sli4_sge_type, sgl, -- LPFC_SGE_TYPE_DATA); -- offset += bde.tus.f.bdeSize; -- } -- sgl->word2 = cpu_to_le32(sgl->word2); -- bpl++; -- sgl++; -- } -- } else if (icmd->un.genreq64.bdl.bdeFlags == BUFF_TYPE_BDE_64) { -- /* The addrHigh and addrLow fields of the BDE have not -- * been byteswapped yet so they need to be swapped -- * before putting them in the sgl. -- */ -- sgl->addr_hi = -- cpu_to_le32(icmd->un.genreq64.bdl.addrHigh); -- sgl->addr_lo = -- cpu_to_le32(icmd->un.genreq64.bdl.addrLow); -- sgl->word2 = le32_to_cpu(sgl->word2); -- bf_set(lpfc_sli4_sge_last, sgl, 1); -- sgl->word2 = cpu_to_le32(sgl->word2); -- sgl->sge_len = -- cpu_to_le32(icmd->un.genreq64.bdl.bdeSize); -- } -- return sglq->sli4_xritag; --} -- --/** -- * lpfc_sli4_iocb2wqe - Convert the IOCB to a work queue entry. -- * @phba: Pointer to HBA context object. -- * @iocbq: Pointer to command iocb. -- * @wqe: Pointer to the work queue entry. -- * -- * This routine converts the iocb command to its Work Queue Entry -- * equivalent. The wqe pointer should not have any fields set when -- * this routine is called because it will memcpy over them. -- * This routine does not set the CQ_ID or the WQEC bits in the -- * wqe. -- * -- * Returns: 0 = Success, IOCB_ERROR = Failure. -- **/ --static int --lpfc_sli4_iocb2wqe(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq, -- union lpfc_wqe128 *wqe) --{ -- uint32_t xmit_len = 0, total_len = 0; -- uint8_t ct = 0; -- uint32_t fip; -- uint32_t abort_tag; -- uint8_t command_type = ELS_COMMAND_NON_FIP; -- uint8_t cmnd; -- uint16_t xritag; -- uint16_t abrt_iotag; -- struct lpfc_iocbq *abrtiocbq; -- struct ulp_bde64 *bpl = NULL; -- uint32_t els_id = LPFC_ELS_ID_DEFAULT; -- int numBdes, i; -- struct ulp_bde64 bde; -- struct lpfc_nodelist *ndlp; -- uint32_t *pcmd; -- uint32_t if_type; -- -- fip = phba->hba_flag & HBA_FIP_SUPPORT; -- /* The fcp commands will set command type */ -- if (iocbq->cmd_flag & LPFC_IO_FCP) -- command_type = FCP_COMMAND; -- else if (fip && (iocbq->cmd_flag & LPFC_FIP_ELS_ID_MASK)) -- command_type = ELS_COMMAND_FIP; -- else -- command_type = ELS_COMMAND_NON_FIP; -- -- if (phba->fcp_embed_io) -- memset(wqe, 0, sizeof(union lpfc_wqe128)); -- /* Some of the fields are in the right position already */ -- memcpy(wqe, &iocbq->iocb, sizeof(union lpfc_wqe)); -- /* The ct field has moved so reset */ -- wqe->generic.wqe_com.word7 = 0; -- wqe->generic.wqe_com.word10 = 0; -- -- abort_tag = (uint32_t) iocbq->iotag; -- xritag = iocbq->sli4_xritag; -- /* words0-2 bpl convert bde */ -- if (iocbq->iocb.un.genreq64.bdl.bdeFlags == BUFF_TYPE_BLP_64) { -- numBdes = iocbq->iocb.un.genreq64.bdl.bdeSize / -- sizeof(struct ulp_bde64); -- bpl = (struct ulp_bde64 *) -- ((struct lpfc_dmabuf *)iocbq->context3)->virt; -- if (!bpl) -- return IOCB_ERROR; -- -- /* Should already be byte swapped. */ -- wqe->generic.bde.addrHigh = le32_to_cpu(bpl->addrHigh); -- wqe->generic.bde.addrLow = le32_to_cpu(bpl->addrLow); -- /* swap the size field back to the cpu so we -- * can assign it to the sgl. -- */ -- wqe->generic.bde.tus.w = le32_to_cpu(bpl->tus.w); -- xmit_len = wqe->generic.bde.tus.f.bdeSize; -- total_len = 0; -- for (i = 0; i < numBdes; i++) { -- bde.tus.w = le32_to_cpu(bpl[i].tus.w); -- total_len += bde.tus.f.bdeSize; -- } -- } else -- xmit_len = iocbq->iocb.un.fcpi64.bdl.bdeSize; -- -- iocbq->iocb.ulpIoTag = iocbq->iotag; -- cmnd = iocbq->iocb.ulpCommand; -- -- switch (iocbq->iocb.ulpCommand) { -- case CMD_ELS_REQUEST64_CR: -- if (iocbq->cmd_flag & LPFC_IO_LIBDFC) -- ndlp = iocbq->context_un.ndlp; -- else -- ndlp = (struct lpfc_nodelist *)iocbq->context1; -- if (!iocbq->iocb.ulpLe) { -- lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, -- "2007 Only Limited Edition cmd Format" -- " supported 0x%x\n", -- iocbq->iocb.ulpCommand); -- return IOCB_ERROR; -- } -- -- wqe->els_req.payload_len = xmit_len; -- /* Els_reguest64 has a TMO */ -- bf_set(wqe_tmo, &wqe->els_req.wqe_com, -- iocbq->iocb.ulpTimeout); -- /* Need a VF for word 4 set the vf bit*/ -- bf_set(els_req64_vf, &wqe->els_req, 0); -- /* And a VFID for word 12 */ -- bf_set(els_req64_vfid, &wqe->els_req, 0); -- ct = ((iocbq->iocb.ulpCt_h << 1) | iocbq->iocb.ulpCt_l); -- bf_set(wqe_ctxt_tag, &wqe->els_req.wqe_com, -- iocbq->iocb.ulpContext); -- bf_set(wqe_ct, &wqe->els_req.wqe_com, ct); -- bf_set(wqe_pu, &wqe->els_req.wqe_com, 0); -- /* CCP CCPE PV PRI in word10 were set in the memcpy */ -- if (command_type == ELS_COMMAND_FIP) -- els_id = ((iocbq->cmd_flag & LPFC_FIP_ELS_ID_MASK) -- >> LPFC_FIP_ELS_ID_SHIFT); -- pcmd = (uint32_t *) (((struct lpfc_dmabuf *) -- iocbq->context2)->virt); -- if_type = bf_get(lpfc_sli_intf_if_type, -- &phba->sli4_hba.sli_intf); -- if (if_type >= LPFC_SLI_INTF_IF_TYPE_2) { -- if (pcmd && (*pcmd == ELS_CMD_FLOGI || -- *pcmd == ELS_CMD_SCR || -- *pcmd == ELS_CMD_RDF || -- *pcmd == ELS_CMD_EDC || -- *pcmd == ELS_CMD_RSCN_XMT || -- *pcmd == ELS_CMD_FDISC || -- *pcmd == ELS_CMD_LOGO || -- *pcmd == ELS_CMD_PLOGI)) { -- bf_set(els_req64_sp, &wqe->els_req, 1); -- bf_set(els_req64_sid, &wqe->els_req, -- iocbq->vport->fc_myDID); -- if ((*pcmd == ELS_CMD_FLOGI) && -- !(phba->fc_topology == -- LPFC_TOPOLOGY_LOOP)) -- bf_set(els_req64_sid, &wqe->els_req, 0); -- bf_set(wqe_ct, &wqe->els_req.wqe_com, 1); -- bf_set(wqe_ctxt_tag, &wqe->els_req.wqe_com, -- phba->vpi_ids[iocbq->vport->vpi]); -- } else if (pcmd && iocbq->context1) { -- bf_set(wqe_ct, &wqe->els_req.wqe_com, 0); -- bf_set(wqe_ctxt_tag, &wqe->els_req.wqe_com, -- phba->sli4_hba.rpi_ids[ndlp->nlp_rpi]); -- } -- } -- bf_set(wqe_temp_rpi, &wqe->els_req.wqe_com, -- phba->sli4_hba.rpi_ids[ndlp->nlp_rpi]); -- bf_set(wqe_els_id, &wqe->els_req.wqe_com, els_id); -- bf_set(wqe_dbde, &wqe->els_req.wqe_com, 1); -- bf_set(wqe_iod, &wqe->els_req.wqe_com, LPFC_WQE_IOD_READ); -- bf_set(wqe_qosd, &wqe->els_req.wqe_com, 1); -- bf_set(wqe_lenloc, &wqe->els_req.wqe_com, LPFC_WQE_LENLOC_NONE); -- bf_set(wqe_ebde_cnt, &wqe->els_req.wqe_com, 0); -- wqe->els_req.max_response_payload_len = total_len - xmit_len; -- break; -- case CMD_XMIT_SEQUENCE64_CX: -- bf_set(wqe_ctxt_tag, &wqe->xmit_sequence.wqe_com, -- iocbq->iocb.un.ulpWord[3]); -- bf_set(wqe_rcvoxid, &wqe->xmit_sequence.wqe_com, -- iocbq->iocb.unsli3.rcvsli3.ox_id); -- /* The entire sequence is transmitted for this IOCB */ -- xmit_len = total_len; -- cmnd = CMD_XMIT_SEQUENCE64_CR; -- if (phba->link_flag & LS_LOOPBACK_MODE) -- bf_set(wqe_xo, &wqe->xmit_sequence.wge_ctl, 1); -- /* fall through */ -- case CMD_XMIT_SEQUENCE64_CR: -- /* word3 iocb=io_tag32 wqe=reserved */ -- wqe->xmit_sequence.rsvd3 = 0; -- /* word4 relative_offset memcpy */ -- /* word5 r_ctl/df_ctl memcpy */ -- bf_set(wqe_pu, &wqe->xmit_sequence.wqe_com, 0); -- bf_set(wqe_dbde, &wqe->xmit_sequence.wqe_com, 1); -- bf_set(wqe_iod, &wqe->xmit_sequence.wqe_com, -- LPFC_WQE_IOD_WRITE); -- bf_set(wqe_lenloc, &wqe->xmit_sequence.wqe_com, -- LPFC_WQE_LENLOC_WORD12); -- bf_set(wqe_ebde_cnt, &wqe->xmit_sequence.wqe_com, 0); -- wqe->xmit_sequence.xmit_len = xmit_len; -- command_type = OTHER_COMMAND; -- break; -- case CMD_XMIT_BCAST64_CN: -- /* word3 iocb=iotag32 wqe=seq_payload_len */ -- wqe->xmit_bcast64.seq_payload_len = xmit_len; -- /* word4 iocb=rsvd wqe=rsvd */ -- /* word5 iocb=rctl/type/df_ctl wqe=rctl/type/df_ctl memcpy */ -- /* word6 iocb=ctxt_tag/io_tag wqe=ctxt_tag/xri */ -- bf_set(wqe_ct, &wqe->xmit_bcast64.wqe_com, -- ((iocbq->iocb.ulpCt_h << 1) | iocbq->iocb.ulpCt_l)); -- bf_set(wqe_dbde, &wqe->xmit_bcast64.wqe_com, 1); -- bf_set(wqe_iod, &wqe->xmit_bcast64.wqe_com, LPFC_WQE_IOD_WRITE); -- bf_set(wqe_lenloc, &wqe->xmit_bcast64.wqe_com, -- LPFC_WQE_LENLOC_WORD3); -- bf_set(wqe_ebde_cnt, &wqe->xmit_bcast64.wqe_com, 0); -- break; -- case CMD_FCP_IWRITE64_CR: -- command_type = FCP_COMMAND_DATA_OUT; -- /* word3 iocb=iotag wqe=payload_offset_len */ -- /* Add the FCP_CMD and FCP_RSP sizes to get the offset */ -- bf_set(payload_offset_len, &wqe->fcp_iwrite, -- xmit_len + sizeof(struct fcp_rsp)); -- bf_set(cmd_buff_len, &wqe->fcp_iwrite, -- 0); -- /* word4 iocb=parameter wqe=total_xfer_length memcpy */ -- /* word5 iocb=initial_xfer_len wqe=initial_xfer_len memcpy */ -- bf_set(wqe_erp, &wqe->fcp_iwrite.wqe_com, -- iocbq->iocb.ulpFCP2Rcvy); -- bf_set(wqe_lnk, &wqe->fcp_iwrite.wqe_com, iocbq->iocb.ulpXS); -- /* Always open the exchange */ -- bf_set(wqe_iod, &wqe->fcp_iwrite.wqe_com, LPFC_WQE_IOD_WRITE); -- bf_set(wqe_lenloc, &wqe->fcp_iwrite.wqe_com, -- LPFC_WQE_LENLOC_WORD4); -- bf_set(wqe_pu, &wqe->fcp_iwrite.wqe_com, iocbq->iocb.ulpPU); -- bf_set(wqe_dbde, &wqe->fcp_iwrite.wqe_com, 1); -- if (iocbq->cmd_flag & LPFC_IO_OAS) { -- bf_set(wqe_oas, &wqe->fcp_iwrite.wqe_com, 1); -- bf_set(wqe_ccpe, &wqe->fcp_iwrite.wqe_com, 1); -- if (iocbq->priority) { -- bf_set(wqe_ccp, &wqe->fcp_iwrite.wqe_com, -- (iocbq->priority << 1)); -- } else { -- bf_set(wqe_ccp, &wqe->fcp_iwrite.wqe_com, -- (phba->cfg_XLanePriority << 1)); -- } -- } -- /* Note, word 10 is already initialized to 0 */ -- -- /* Don't set PBDE for Perf hints, just lpfc_enable_pbde */ -- if (phba->cfg_enable_pbde) -- bf_set(wqe_pbde, &wqe->fcp_iwrite.wqe_com, 1); -- else -- bf_set(wqe_pbde, &wqe->fcp_iwrite.wqe_com, 0); -- -- if (phba->fcp_embed_io) { -- struct lpfc_io_buf *lpfc_cmd; -- struct sli4_sge *sgl; -- struct fcp_cmnd *fcp_cmnd; -- uint32_t *ptr; -- -- /* 128 byte wqe support here */ -- -- lpfc_cmd = iocbq->context1; -- sgl = (struct sli4_sge *)lpfc_cmd->dma_sgl; -- fcp_cmnd = lpfc_cmd->fcp_cmnd; -- -- /* Word 0-2 - FCP_CMND */ -- wqe->generic.bde.tus.f.bdeFlags = -- BUFF_TYPE_BDE_IMMED; -- wqe->generic.bde.tus.f.bdeSize = sgl->sge_len; -- wqe->generic.bde.addrHigh = 0; -- wqe->generic.bde.addrLow = 88; /* Word 22 */ -- -- bf_set(wqe_wqes, &wqe->fcp_iwrite.wqe_com, 1); -- bf_set(wqe_dbde, &wqe->fcp_iwrite.wqe_com, 0); -- -- /* Word 22-29 FCP CMND Payload */ -- ptr = &wqe->words[22]; -- memcpy(ptr, fcp_cmnd, sizeof(struct fcp_cmnd)); -- } -- break; -- case CMD_FCP_IREAD64_CR: -- /* word3 iocb=iotag wqe=payload_offset_len */ -- /* Add the FCP_CMD and FCP_RSP sizes to get the offset */ -- bf_set(payload_offset_len, &wqe->fcp_iread, -- xmit_len + sizeof(struct fcp_rsp)); -- bf_set(cmd_buff_len, &wqe->fcp_iread, -- 0); -- /* word4 iocb=parameter wqe=total_xfer_length memcpy */ -- /* word5 iocb=initial_xfer_len wqe=initial_xfer_len memcpy */ -- bf_set(wqe_erp, &wqe->fcp_iread.wqe_com, -- iocbq->iocb.ulpFCP2Rcvy); -- bf_set(wqe_lnk, &wqe->fcp_iread.wqe_com, iocbq->iocb.ulpXS); -- /* Always open the exchange */ -- bf_set(wqe_iod, &wqe->fcp_iread.wqe_com, LPFC_WQE_IOD_READ); -- bf_set(wqe_lenloc, &wqe->fcp_iread.wqe_com, -- LPFC_WQE_LENLOC_WORD4); -- bf_set(wqe_pu, &wqe->fcp_iread.wqe_com, iocbq->iocb.ulpPU); -- bf_set(wqe_dbde, &wqe->fcp_iread.wqe_com, 1); -- if (iocbq->cmd_flag & LPFC_IO_OAS) { -- bf_set(wqe_oas, &wqe->fcp_iread.wqe_com, 1); -- bf_set(wqe_ccpe, &wqe->fcp_iread.wqe_com, 1); -- if (iocbq->priority) { -- bf_set(wqe_ccp, &wqe->fcp_iread.wqe_com, -- (iocbq->priority << 1)); -- } else { -- bf_set(wqe_ccp, &wqe->fcp_iread.wqe_com, -- (phba->cfg_XLanePriority << 1)); -- } -- } -- /* Note, word 10 is already initialized to 0 */ -- -- /* Don't set PBDE for Perf hints, just lpfc_enable_pbde */ -- if (phba->cfg_enable_pbde) -- bf_set(wqe_pbde, &wqe->fcp_iread.wqe_com, 1); -- else -- bf_set(wqe_pbde, &wqe->fcp_iread.wqe_com, 0); -- -- if (phba->fcp_embed_io) { -- struct lpfc_io_buf *lpfc_cmd; -- struct sli4_sge *sgl; -- struct fcp_cmnd *fcp_cmnd; -- uint32_t *ptr; -- -- /* 128 byte wqe support here */ -- -- lpfc_cmd = iocbq->context1; -- sgl = (struct sli4_sge *)lpfc_cmd->dma_sgl; -- fcp_cmnd = lpfc_cmd->fcp_cmnd; -- -- /* Word 0-2 - FCP_CMND */ -- wqe->generic.bde.tus.f.bdeFlags = -- BUFF_TYPE_BDE_IMMED; -- wqe->generic.bde.tus.f.bdeSize = sgl->sge_len; -- wqe->generic.bde.addrHigh = 0; -- wqe->generic.bde.addrLow = 88; /* Word 22 */ -- -- bf_set(wqe_wqes, &wqe->fcp_iread.wqe_com, 1); -- bf_set(wqe_dbde, &wqe->fcp_iread.wqe_com, 0); -- -- /* Word 22-29 FCP CMND Payload */ -- ptr = &wqe->words[22]; -- memcpy(ptr, fcp_cmnd, sizeof(struct fcp_cmnd)); -- } -- break; -- case CMD_FCP_ICMND64_CR: -- /* word3 iocb=iotag wqe=payload_offset_len */ -- /* Add the FCP_CMD and FCP_RSP sizes to get the offset */ -- bf_set(payload_offset_len, &wqe->fcp_icmd, -- xmit_len + sizeof(struct fcp_rsp)); -- bf_set(cmd_buff_len, &wqe->fcp_icmd, -- 0); -- /* word3 iocb=IO_TAG wqe=reserved */ -- bf_set(wqe_pu, &wqe->fcp_icmd.wqe_com, 0); -- /* Always open the exchange */ -- bf_set(wqe_dbde, &wqe->fcp_icmd.wqe_com, 1); -- bf_set(wqe_iod, &wqe->fcp_icmd.wqe_com, LPFC_WQE_IOD_WRITE); -- bf_set(wqe_qosd, &wqe->fcp_icmd.wqe_com, 1); -- bf_set(wqe_lenloc, &wqe->fcp_icmd.wqe_com, -- LPFC_WQE_LENLOC_NONE); -- bf_set(wqe_erp, &wqe->fcp_icmd.wqe_com, -- iocbq->iocb.ulpFCP2Rcvy); -- if (iocbq->cmd_flag & LPFC_IO_OAS) { -- bf_set(wqe_oas, &wqe->fcp_icmd.wqe_com, 1); -- bf_set(wqe_ccpe, &wqe->fcp_icmd.wqe_com, 1); -- if (iocbq->priority) { -- bf_set(wqe_ccp, &wqe->fcp_icmd.wqe_com, -- (iocbq->priority << 1)); -- } else { -- bf_set(wqe_ccp, &wqe->fcp_icmd.wqe_com, -- (phba->cfg_XLanePriority << 1)); -- } -- } -- /* Note, word 10 is already initialized to 0 */ -- -- if (phba->fcp_embed_io) { -- struct lpfc_io_buf *lpfc_cmd; -- struct sli4_sge *sgl; -- struct fcp_cmnd *fcp_cmnd; -- uint32_t *ptr; -- -- /* 128 byte wqe support here */ -- -- lpfc_cmd = iocbq->context1; -- sgl = (struct sli4_sge *)lpfc_cmd->dma_sgl; -- fcp_cmnd = lpfc_cmd->fcp_cmnd; -- -- /* Word 0-2 - FCP_CMND */ -- wqe->generic.bde.tus.f.bdeFlags = -- BUFF_TYPE_BDE_IMMED; -- wqe->generic.bde.tus.f.bdeSize = sgl->sge_len; -- wqe->generic.bde.addrHigh = 0; -- wqe->generic.bde.addrLow = 88; /* Word 22 */ -- -- bf_set(wqe_wqes, &wqe->fcp_icmd.wqe_com, 1); -- bf_set(wqe_dbde, &wqe->fcp_icmd.wqe_com, 0); -- -- /* Word 22-29 FCP CMND Payload */ -- ptr = &wqe->words[22]; -- memcpy(ptr, fcp_cmnd, sizeof(struct fcp_cmnd)); -- } -- break; -- case CMD_GEN_REQUEST64_CR: -- /* For this command calculate the xmit length of the -- * request bde. -- */ -- xmit_len = 0; -- numBdes = iocbq->iocb.un.genreq64.bdl.bdeSize / -- sizeof(struct ulp_bde64); -- for (i = 0; i < numBdes; i++) { -- bde.tus.w = le32_to_cpu(bpl[i].tus.w); -- if (bde.tus.f.bdeFlags != BUFF_TYPE_BDE_64) -- break; -- xmit_len += bde.tus.f.bdeSize; -- } -- /* word3 iocb=IO_TAG wqe=request_payload_len */ -- wqe->gen_req.request_payload_len = xmit_len; -- /* word4 iocb=parameter wqe=relative_offset memcpy */ -- /* word5 [rctl, type, df_ctl, la] copied in memcpy */ -- /* word6 context tag copied in memcpy */ -- if (iocbq->iocb.ulpCt_h || iocbq->iocb.ulpCt_l) { -- ct = ((iocbq->iocb.ulpCt_h << 1) | iocbq->iocb.ulpCt_l); -- lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, -- "2015 Invalid CT %x command 0x%x\n", -- ct, iocbq->iocb.ulpCommand); -- return IOCB_ERROR; -- } -- bf_set(wqe_ct, &wqe->gen_req.wqe_com, 0); -- bf_set(wqe_tmo, &wqe->gen_req.wqe_com, iocbq->iocb.ulpTimeout); -- bf_set(wqe_pu, &wqe->gen_req.wqe_com, iocbq->iocb.ulpPU); -- bf_set(wqe_dbde, &wqe->gen_req.wqe_com, 1); -- bf_set(wqe_iod, &wqe->gen_req.wqe_com, LPFC_WQE_IOD_READ); -- bf_set(wqe_qosd, &wqe->gen_req.wqe_com, 1); -- bf_set(wqe_lenloc, &wqe->gen_req.wqe_com, LPFC_WQE_LENLOC_NONE); -- bf_set(wqe_ebde_cnt, &wqe->gen_req.wqe_com, 0); -- wqe->gen_req.max_response_payload_len = total_len - xmit_len; -- command_type = OTHER_COMMAND; -- break; -- case CMD_XMIT_ELS_RSP64_CX: -- ndlp = (struct lpfc_nodelist *)iocbq->context1; -- /* words0-2 BDE memcpy */ -- /* word3 iocb=iotag32 wqe=response_payload_len */ -- wqe->xmit_els_rsp.response_payload_len = xmit_len; -- /* word4 */ -- wqe->xmit_els_rsp.word4 = 0; -- /* word5 iocb=rsvd wge=did */ -- bf_set(wqe_els_did, &wqe->xmit_els_rsp.wqe_dest, -- iocbq->iocb.un.xseq64.xmit_els_remoteID); -- -- if_type = bf_get(lpfc_sli_intf_if_type, -- &phba->sli4_hba.sli_intf); -- if (if_type >= LPFC_SLI_INTF_IF_TYPE_2) { -- if (iocbq->vport->fc_flag & FC_PT2PT) { -- bf_set(els_rsp64_sp, &wqe->xmit_els_rsp, 1); -- bf_set(els_rsp64_sid, &wqe->xmit_els_rsp, -- iocbq->vport->fc_myDID); -- if (iocbq->vport->fc_myDID == Fabric_DID) { -- bf_set(wqe_els_did, -- &wqe->xmit_els_rsp.wqe_dest, 0); -- } -- } -- } -- bf_set(wqe_ct, &wqe->xmit_els_rsp.wqe_com, -- ((iocbq->iocb.ulpCt_h << 1) | iocbq->iocb.ulpCt_l)); -- bf_set(wqe_pu, &wqe->xmit_els_rsp.wqe_com, iocbq->iocb.ulpPU); -- bf_set(wqe_rcvoxid, &wqe->xmit_els_rsp.wqe_com, -- iocbq->iocb.unsli3.rcvsli3.ox_id); -- if (!iocbq->iocb.ulpCt_h && iocbq->iocb.ulpCt_l) -- bf_set(wqe_ctxt_tag, &wqe->xmit_els_rsp.wqe_com, -- phba->vpi_ids[iocbq->vport->vpi]); -- bf_set(wqe_dbde, &wqe->xmit_els_rsp.wqe_com, 1); -- bf_set(wqe_iod, &wqe->xmit_els_rsp.wqe_com, LPFC_WQE_IOD_WRITE); -- bf_set(wqe_qosd, &wqe->xmit_els_rsp.wqe_com, 1); -- bf_set(wqe_lenloc, &wqe->xmit_els_rsp.wqe_com, -- LPFC_WQE_LENLOC_WORD3); -- bf_set(wqe_ebde_cnt, &wqe->xmit_els_rsp.wqe_com, 0); -- bf_set(wqe_rsp_temp_rpi, &wqe->xmit_els_rsp, -- phba->sli4_hba.rpi_ids[ndlp->nlp_rpi]); -- if (phba->fc_topology == LPFC_TOPOLOGY_LOOP) { -- bf_set(els_rsp64_sp, &wqe->xmit_els_rsp, 1); -- bf_set(els_rsp64_sid, &wqe->xmit_els_rsp, -- iocbq->vport->fc_myDID); -- bf_set(wqe_ct, &wqe->xmit_els_rsp.wqe_com, 1); -- bf_set(wqe_ctxt_tag, &wqe->xmit_els_rsp.wqe_com, -- phba->vpi_ids[phba->pport->vpi]); -- } -- command_type = OTHER_COMMAND; -- break; -- case CMD_CLOSE_XRI_CN: -- case CMD_ABORT_XRI_CN: -- case CMD_ABORT_XRI_CX: -- /* words 0-2 memcpy should be 0 rserved */ -- /* port will send abts */ -- abrt_iotag = iocbq->iocb.un.acxri.abortContextTag; -- if (abrt_iotag != 0 && abrt_iotag <= phba->sli.last_iotag) { -- abrtiocbq = phba->sli.iocbq_lookup[abrt_iotag]; -- fip = abrtiocbq->cmd_flag & LPFC_FIP_ELS_ID_MASK; -- } else -- fip = 0; -- -- if ((iocbq->iocb.ulpCommand == CMD_CLOSE_XRI_CN) || fip) -- /* -- * The link is down, or the command was ELS_FIP -- * so the fw does not need to send abts -- * on the wire. -- */ -- bf_set(abort_cmd_ia, &wqe->abort_cmd, 1); -- else -- bf_set(abort_cmd_ia, &wqe->abort_cmd, 0); -- bf_set(abort_cmd_criteria, &wqe->abort_cmd, T_XRI_TAG); -- /* word5 iocb=CONTEXT_TAG|IO_TAG wqe=reserved */ -- wqe->abort_cmd.rsrvd5 = 0; -- bf_set(wqe_ct, &wqe->abort_cmd.wqe_com, -- ((iocbq->iocb.ulpCt_h << 1) | iocbq->iocb.ulpCt_l)); -- abort_tag = iocbq->iocb.un.acxri.abortIoTag; -- /* -- * The abort handler will send us CMD_ABORT_XRI_CN or -- * CMD_CLOSE_XRI_CN and the fw only accepts CMD_ABORT_XRI_CX -- */ -- bf_set(wqe_cmnd, &wqe->abort_cmd.wqe_com, CMD_ABORT_XRI_CX); -- bf_set(wqe_qosd, &wqe->abort_cmd.wqe_com, 1); -- bf_set(wqe_lenloc, &wqe->abort_cmd.wqe_com, -- LPFC_WQE_LENLOC_NONE); -- cmnd = CMD_ABORT_XRI_CX; -- command_type = OTHER_COMMAND; -- xritag = 0; -- break; -- case CMD_XMIT_BLS_RSP64_CX: -- ndlp = (struct lpfc_nodelist *)iocbq->context1; -- /* As BLS ABTS RSP WQE is very different from other WQEs, -- * we re-construct this WQE here based on information in -- * iocbq from scratch. -- */ -- memset(wqe, 0, sizeof(*wqe)); -- /* OX_ID is invariable to who sent ABTS to CT exchange */ -- bf_set(xmit_bls_rsp64_oxid, &wqe->xmit_bls_rsp, -- bf_get(lpfc_abts_oxid, &iocbq->iocb.un.bls_rsp)); -- if (bf_get(lpfc_abts_orig, &iocbq->iocb.un.bls_rsp) == -- LPFC_ABTS_UNSOL_INT) { -- /* ABTS sent by initiator to CT exchange, the -- * RX_ID field will be filled with the newly -- * allocated responder XRI. -- */ -- bf_set(xmit_bls_rsp64_rxid, &wqe->xmit_bls_rsp, -- iocbq->sli4_xritag); -- } else { -- /* ABTS sent by responder to CT exchange, the -- * RX_ID field will be filled with the responder -- * RX_ID from ABTS. -- */ -- bf_set(xmit_bls_rsp64_rxid, &wqe->xmit_bls_rsp, -- bf_get(lpfc_abts_rxid, &iocbq->iocb.un.bls_rsp)); -- } -- bf_set(xmit_bls_rsp64_seqcnthi, &wqe->xmit_bls_rsp, 0xffff); -- bf_set(wqe_xmit_bls_pt, &wqe->xmit_bls_rsp.wqe_dest, 0x1); -- -- /* Use CT=VPI */ -- bf_set(wqe_els_did, &wqe->xmit_bls_rsp.wqe_dest, -- ndlp->nlp_DID); -- bf_set(xmit_bls_rsp64_temprpi, &wqe->xmit_bls_rsp, -- iocbq->iocb.ulpContext); -- bf_set(wqe_ct, &wqe->xmit_bls_rsp.wqe_com, 1); -- bf_set(wqe_ctxt_tag, &wqe->xmit_bls_rsp.wqe_com, -- phba->vpi_ids[phba->pport->vpi]); -- bf_set(wqe_qosd, &wqe->xmit_bls_rsp.wqe_com, 1); -- bf_set(wqe_lenloc, &wqe->xmit_bls_rsp.wqe_com, -- LPFC_WQE_LENLOC_NONE); -- /* Overwrite the pre-set comnd type with OTHER_COMMAND */ -- command_type = OTHER_COMMAND; -- if (iocbq->iocb.un.xseq64.w5.hcsw.Rctl == FC_RCTL_BA_RJT) { -- bf_set(xmit_bls_rsp64_rjt_vspec, &wqe->xmit_bls_rsp, -- bf_get(lpfc_vndr_code, &iocbq->iocb.un.bls_rsp)); -- bf_set(xmit_bls_rsp64_rjt_expc, &wqe->xmit_bls_rsp, -- bf_get(lpfc_rsn_expln, &iocbq->iocb.un.bls_rsp)); -- bf_set(xmit_bls_rsp64_rjt_rsnc, &wqe->xmit_bls_rsp, -- bf_get(lpfc_rsn_code, &iocbq->iocb.un.bls_rsp)); -- } -- -- break; -- case CMD_SEND_FRAME: -- bf_set(wqe_cmnd, &wqe->generic.wqe_com, CMD_SEND_FRAME); -- bf_set(wqe_sof, &wqe->generic.wqe_com, 0x2E); /* SOF byte */ -- bf_set(wqe_eof, &wqe->generic.wqe_com, 0x41); /* EOF byte */ -- bf_set(wqe_lenloc, &wqe->generic.wqe_com, 1); -- bf_set(wqe_xbl, &wqe->generic.wqe_com, 1); -- bf_set(wqe_dbde, &wqe->generic.wqe_com, 1); -- bf_set(wqe_xc, &wqe->generic.wqe_com, 1); -- bf_set(wqe_cmd_type, &wqe->generic.wqe_com, 0xA); -- bf_set(wqe_cqid, &wqe->generic.wqe_com, LPFC_WQE_CQ_ID_DEFAULT); -- bf_set(wqe_xri_tag, &wqe->generic.wqe_com, xritag); -- bf_set(wqe_reqtag, &wqe->generic.wqe_com, iocbq->iotag); -- return 0; -- case CMD_XRI_ABORTED_CX: -- case CMD_CREATE_XRI_CR: /* Do we expect to use this? */ -- case CMD_IOCB_FCP_IBIDIR64_CR: /* bidirectional xfer */ -- case CMD_FCP_TSEND64_CX: /* Target mode send xfer-ready */ -- case CMD_FCP_TRSP64_CX: /* Target mode rcv */ -- case CMD_FCP_AUTO_TRSP_CX: /* Auto target rsp */ -- default: -- lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, -- "2014 Invalid command 0x%x\n", -- iocbq->iocb.ulpCommand); -- return IOCB_ERROR; -- } -- -- if (iocbq->cmd_flag & LPFC_IO_DIF_PASS) -- bf_set(wqe_dif, &wqe->generic.wqe_com, LPFC_WQE_DIF_PASSTHRU); -- else if (iocbq->cmd_flag & LPFC_IO_DIF_STRIP) -- bf_set(wqe_dif, &wqe->generic.wqe_com, LPFC_WQE_DIF_STRIP); -- else if (iocbq->cmd_flag & LPFC_IO_DIF_INSERT) -- bf_set(wqe_dif, &wqe->generic.wqe_com, LPFC_WQE_DIF_INSERT); -- iocbq->cmd_flag &= ~(LPFC_IO_DIF_PASS | LPFC_IO_DIF_STRIP | -- LPFC_IO_DIF_INSERT); -- bf_set(wqe_xri_tag, &wqe->generic.wqe_com, xritag); -- bf_set(wqe_reqtag, &wqe->generic.wqe_com, iocbq->iotag); -- wqe->generic.wqe_com.abort_tag = abort_tag; -- bf_set(wqe_cmd_type, &wqe->generic.wqe_com, command_type); -- bf_set(wqe_cmnd, &wqe->generic.wqe_com, cmnd); -- bf_set(wqe_class, &wqe->generic.wqe_com, iocbq->iocb.ulpClass); -- bf_set(wqe_cqid, &wqe->generic.wqe_com, LPFC_WQE_CQ_ID_DEFAULT); -- return 0; --} -- --/** - * __lpfc_sli_issue_fcp_io_s3 - SLI3 device for sending fcp io iocb - * @phba: Pointer to HBA context object. - * @ring_number: SLI ring number to issue wqe on. -@@ -10895,28 +10192,19 @@ static int - lockdep_assert_held(&pring->ring_lock); - wqe = &piocb->wqe; - if (piocb->sli4_xritag == NO_XRI) { -- if (ulp_command == CMD_ABORT_XRI_WQE) -+ if (ulp_command == CMD_ABORT_XRI_CX) - sglq = NULL; - else { -- if (!list_empty(&pring->txq)) { -+ sglq = __lpfc_sli_get_els_sglq(phba, piocb); -+ if (!sglq) { - if (!(flag & SLI_IOCB_RET_IOCB)) { - __lpfc_sli_ringtx_put(phba, -- pring, piocb); -+ pring, -+ piocb); - return IOCB_SUCCESS; - } else { - return IOCB_BUSY; - } -- } else { -- sglq = __lpfc_sli_get_els_sglq(phba, piocb); -- if (!sglq) { -- if (!(flag & SLI_IOCB_RET_IOCB)) { -- __lpfc_sli_ringtx_put(phba, -- pring, -- piocb); -- return IOCB_SUCCESS; -- } else -- return IOCB_BUSY; -- } - } - } - } else if (piocb->cmd_flag & LPFC_IO_FCP) { -@@ -10955,6 +10243,7 @@ static int - - if (lpfc_sli4_wq_put(wq, wqe)) - return IOCB_ERROR; -+ - lpfc_sli_ringtxcmpl_put(phba, pring, piocb); - - return 0; -@@ -12265,19 +11554,31 @@ lpfc_ignore_els_cmpl(struct lpfc_hba *ph - struct lpfc_iocbq *rspiocb) - { - struct lpfc_nodelist *ndlp = NULL; -- IOCB_t *irsp = &rspiocb->iocb; -+ IOCB_t *irsp; -+ u32 ulp_command, ulp_status, ulp_word4, iotag; -+ -+ ulp_command = get_job_cmnd(phba, cmdiocb); -+ ulp_status = get_job_ulpstatus(phba, rspiocb); -+ ulp_word4 = get_job_word4(phba, rspiocb); -+ -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ iotag = get_wqe_reqtag(cmdiocb); -+ } else { -+ irsp = &rspiocb->iocb; -+ iotag = irsp->ulpIoTag; -+ } - - /* ELS cmd tag completes */ - lpfc_printf_log(phba, KERN_INFO, LOG_ELS, - "0139 Ignoring ELS cmd code x%x completion Data: " - "x%x x%x x%x\n", -- irsp->ulpIoTag, irsp->ulpStatus, -- irsp->un.ulpWord[4], irsp->ulpTimeout); -+ ulp_command, ulp_status, ulp_word4, iotag); -+ - /* - * Deref the ndlp after free_iocb. sli_release_iocb will access the ndlp - * if exchange is busy. - */ -- if (cmdiocb->iocb.ulpCommand == CMD_GEN_REQUEST64_CR) { -+ if (ulp_command == CMD_GEN_REQUEST64_CR) { - ndlp = cmdiocb->context_un.ndlp; - lpfc_ct_free_iocb(phba, cmdiocb); - } else { -@@ -20968,10 +20269,9 @@ lpfc_drain_txq(struct lpfc_hba *phba) - struct lpfc_iocbq *piocbq = NULL; - unsigned long iflags = 0; - char *fail_msg = NULL; -- struct lpfc_sglq *sglq; -- union lpfc_wqe128 wqe; - uint32_t txq_cnt = 0; - struct lpfc_queue *wq; -+ int ret = 0; - - if (phba->link_flag & LS_MDS_LOOPBACK) { - /* MDS WQE are posted only to first WQ*/ -@@ -21010,44 +20310,33 @@ lpfc_drain_txq(struct lpfc_hba *phba) - txq_cnt); - break; - } -- sglq = __lpfc_sli_get_els_sglq(phba, piocbq); -- if (!sglq) { -- __lpfc_sli_ringtx_put(phba, pring, piocbq); -- spin_unlock_irqrestore(&pring->ring_lock, iflags); -- break; -- } - txq_cnt--; - -- /* The xri and iocb resources secured, -- * attempt to issue request -- */ -- piocbq->sli4_lxritag = sglq->sli4_lxritag; -- piocbq->sli4_xritag = sglq->sli4_xritag; -- if (NO_XRI == lpfc_sli4_bpl2sgl(phba, piocbq, sglq)) -- fail_msg = "to convert bpl to sgl"; -- else if (lpfc_sli4_iocb2wqe(phba, piocbq, &wqe)) -- fail_msg = "to convert iocb to wqe"; -- else if (lpfc_sli4_wq_put(wq, &wqe)) -- fail_msg = " - Wq is full"; -- else -- lpfc_sli_ringtxcmpl_put(phba, pring, piocbq); -+ ret = __lpfc_sli_issue_iocb(phba, pring->ringno, piocbq, 0); - -+ if (ret && ret != IOCB_BUSY) { -+ fail_msg = " - Cannot send IO "; -+ piocbq->cmd_flag &= ~LPFC_DRIVER_ABORTED; -+ } - if (fail_msg) { -+ piocbq->cmd_flag |= LPFC_DRIVER_ABORTED; - /* Failed means we can't issue and need to cancel */ - lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, - "2822 IOCB failed %s iotag 0x%x " -- "xri 0x%x\n", -- fail_msg, -- piocbq->iotag, piocbq->sli4_xritag); -+ "xri 0x%x %d flg x%x\n", -+ fail_msg, piocbq->iotag, -+ piocbq->sli4_xritag, ret, -+ piocbq->cmd_flag); - list_add_tail(&piocbq->list, &completions); - fail_msg = NULL; - } - spin_unlock_irqrestore(&pring->ring_lock, iflags); -+ if (txq_cnt == 0 || ret == IOCB_BUSY) -+ break; - } -- - /* Cancel all the IOCBs that cannot be issued */ - lpfc_sli_cancel_iocbs(phba, &completions, IOSTAT_LOCAL_REJECT, -- IOERR_SLI_ABORTED); -+ IOERR_SLI_ABORTED); - - return txq_cnt; - } diff --git a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-the-RSCN-SCR-RDF-E.patch b/patches.suse/scsi-lpfc-SLI-path-split-Refactor-the-RSCN-SCR-RDF-E.patch deleted file mode 100644 index 2f0b073..0000000 --- a/patches.suse/scsi-lpfc-SLI-path-split-Refactor-the-RSCN-SCR-RDF-E.patch +++ /dev/null @@ -1,266 +0,0 @@ -From: James Smart -Date: Thu, 24 Feb 2022 18:22:57 -0800 -Subject: scsi: lpfc: SLI path split: Refactor the RSCN/SCR/RDF/EDC/FARPR paths -Patch-mainline: v5.18-rc1 -Git-commit: 3bea83b68d54478e541caea3c21033c03c1d9920 -References: bsc#1197675 - -This patch refactors the SLI3/SLI4 RSCN/SCR/RDF/EDC/FARPR paths to use -SLI-4 as the primary interface: - - - Conversion away from using SLI-3 iocb structures to set/access fields in - common routines. Use the new generic get/set routines that were added. - This move changes code from indirect structure references to using local - variables with the generic routines. - - - Refactor routines when setting non-generic fields, to have both SLI3 and - SLI4 specific sections. This replaces the set-as-SLI3 then translate to - SLI4 behavior of the past. - -Link: https://lore.kernel.org/r/20220225022308.16486-7-jsmart2021@gmail.com -Co-developed-by: Justin Tee -Signed-off-by: Justin Tee -Signed-off-by: James Smart -Signed-off-by: Martin K. Petersen -Acked-by: Daniel Wagner ---- - drivers/scsi/lpfc/lpfc_els.c | 115 ++++++++++++++++++++++++++++++------------- - 1 file changed, 81 insertions(+), 34 deletions(-) - ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -3131,19 +3131,29 @@ lpfc_cmpl_els_cmd(struct lpfc_hba *phba, - struct lpfc_vport *vport = cmdiocb->vport; - struct lpfc_nodelist *free_ndlp; - IOCB_t *irsp; -+ u32 ulp_status, ulp_word4, tmo, did, iotag; - -- irsp = &rspiocb->iocb; -+ ulp_status = get_job_ulpstatus(phba, rspiocb); -+ ulp_word4 = get_job_word4(phba, rspiocb); -+ did = get_job_els_rsp64_did(phba, cmdiocb); -+ -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ tmo = get_wqe_tmo(cmdiocb); -+ iotag = get_wqe_reqtag(cmdiocb); -+ } else { -+ irsp = &rspiocb->iocb; -+ tmo = irsp->ulpTimeout; -+ iotag = irsp->ulpIoTag; -+ } - - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, - "ELS cmd cmpl: status:x%x/x%x did:x%x", -- irsp->ulpStatus, irsp->un.ulpWord[4], -- irsp->un.elsreq64.remoteID); -+ ulp_status, ulp_word4, did); - - /* ELS cmd tag completes */ - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "0106 ELS cmd tag x%x completes Data: x%x x%x x%x\n", -- irsp->ulpIoTag, irsp->ulpStatus, -- irsp->un.ulpWord[4], irsp->ulpTimeout); -+ iotag, ulp_status, ulp_word4, tmo); - - /* Check to see if link went down during discovery */ - lpfc_els_chk_latt(vport); -@@ -3265,20 +3275,29 @@ lpfc_cmpl_els_disc_cmd(struct lpfc_hba * - u32 *pdata; - u32 cmd; - struct lpfc_nodelist *ndlp = cmdiocb->context1; -+ u32 ulp_status, ulp_word4, tmo, did, iotag; - -- irsp = &rspiocb->iocb; -+ ulp_status = get_job_ulpstatus(phba, rspiocb); -+ ulp_word4 = get_job_word4(phba, rspiocb); -+ did = get_job_els_rsp64_did(phba, cmdiocb); -+ -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ tmo = get_wqe_tmo(cmdiocb); -+ iotag = get_wqe_reqtag(cmdiocb); -+ } else { -+ irsp = &rspiocb->iocb; -+ tmo = irsp->ulpTimeout; -+ iotag = irsp->ulpIoTag; -+ } - - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, - "ELS cmd cmpl: status:x%x/x%x did:x%x", -- irsp->ulpStatus, irsp->un.ulpWord[4], -- irsp->un.elsreq64.remoteID); -+ ulp_status, ulp_word4, did); -+ - /* ELS cmd tag completes */ - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS | LOG_CGN_MGMT, -- "0217 ELS cmd tag x%x completes Data: x%x x%x x%x " -- "x%x\n", -- irsp->ulpIoTag, irsp->ulpStatus, -- irsp->un.ulpWord[4], irsp->ulpTimeout, -- cmdiocb->retry); -+ "0217 ELS cmd tag x%x completes Data: x%x x%x x%x x%x\n", -+ iotag, ulp_status, ulp_word4, tmo, cmdiocb->retry); - - pcmd = (struct lpfc_dmabuf *)cmdiocb->context2; - if (!pcmd) -@@ -3290,8 +3309,8 @@ lpfc_cmpl_els_disc_cmd(struct lpfc_hba * - cmd = *pdata; - - /* Only 1 retry for ELS Timeout only */ -- if (irsp->ulpStatus == IOSTAT_LOCAL_REJECT && -- ((irsp->un.ulpWord[4] & IOERR_PARAM_MASK) == -+ if (ulp_status == IOSTAT_LOCAL_REJECT && -+ ((ulp_word4 & IOERR_PARAM_MASK) == - IOERR_SEQUENCE_TIMEOUT)) { - cmdiocb->retry++; - if (cmdiocb->retry <= 1) { -@@ -3316,11 +3335,11 @@ lpfc_cmpl_els_disc_cmd(struct lpfc_hba * - lpfc_cmpl_els_edc(phba, cmdiocb, rspiocb); - return; - } -- if (irsp->ulpStatus) { -+ if (ulp_status) { - /* ELS discovery cmd completes with error */ -- lpfc_printf_vlog(vport, KERN_WARNING, LOG_ELS, -+ lpfc_printf_vlog(vport, KERN_WARNING, LOG_ELS | LOG_CGN_MGMT, - "4203 ELS cmd x%x error: x%x x%X\n", cmd, -- irsp->ulpStatus, irsp->un.ulpWord[4]); -+ ulp_status, ulp_word4); - goto out; - } - -@@ -3345,7 +3364,7 @@ lpfc_cmpl_els_disc_cmd(struct lpfc_hba * - "4677 Fabric RDF Notification Grant " - "Data: 0x%08x Reg: %x %x\n", - be32_to_cpu( -- prdf->reg_d1.desc_tags[i]), -+ prdf->reg_d1.desc_tags[i]), - phba->cgn_reg_signal, - phba->cgn_reg_fpin); - } -@@ -3590,7 +3609,7 @@ lpfc_issue_els_farpr(struct lpfc_vport * - } - - elsiocb = lpfc_prep_els_iocb(vport, 1, cmdsize, retry, ndlp, -- ndlp->nlp_DID, ELS_CMD_RNID); -+ ndlp->nlp_DID, ELS_CMD_FARPR); - if (!elsiocb) - return 1; - -@@ -3892,7 +3911,7 @@ static void - lpfc_cmpl_els_edc(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - struct lpfc_iocbq *rspiocb) - { -- IOCB_t *irsp; -+ IOCB_t *irsp_iocb; - struct fc_els_edc_resp *edc_rsp; - struct fc_tlv_desc *tlv; - struct fc_diag_cg_sig_desc *pcgd; -@@ -3903,20 +3922,31 @@ lpfc_cmpl_els_edc(struct lpfc_hba *phba, - int desc_cnt = 0, bytes_remain; - bool rcv_cap_desc = false; - struct lpfc_nodelist *ndlp; -+ u32 ulp_status, ulp_word4, tmo, did, iotag; - -- irsp = &rspiocb->iocb; - ndlp = cmdiocb->context1; - -+ ulp_status = get_job_ulpstatus(phba, rspiocb); -+ ulp_word4 = get_job_word4(phba, rspiocb); -+ did = get_job_els_rsp64_did(phba, rspiocb); -+ -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ tmo = get_wqe_tmo(rspiocb); -+ iotag = get_wqe_reqtag(rspiocb); -+ } else { -+ irsp_iocb = &rspiocb->iocb; -+ tmo = irsp_iocb->ulpTimeout; -+ iotag = irsp_iocb->ulpIoTag; -+ } -+ - lpfc_debugfs_disc_trc(phba->pport, LPFC_DISC_TRC_ELS_CMD, - "EDC cmpl: status:x%x/x%x did:x%x", -- irsp->ulpStatus, irsp->un.ulpWord[4], -- irsp->un.elsreq64.remoteID); -+ ulp_status, ulp_word4, did); - - /* ELS cmd tag completes */ - lpfc_printf_log(phba, KERN_INFO, LOG_ELS | LOG_CGN_MGMT, - "4201 EDC cmd tag x%x completes Data: x%x x%x x%x\n", -- irsp->ulpIoTag, irsp->ulpStatus, -- irsp->un.ulpWord[4], irsp->ulpTimeout); -+ iotag, ulp_status, ulp_word4, tmo); - - pcmd = (struct lpfc_dmabuf *)cmdiocb->context2; - if (!pcmd) -@@ -3927,7 +3957,7 @@ lpfc_cmpl_els_edc(struct lpfc_hba *phba, - goto out; - - /* Need to clear signal values, send features MB and RDF with FPIN. */ -- if (irsp->ulpStatus) -+ if (ulp_status) - goto out; - - prsp = list_get_first(&pcmd->list, struct lpfc_dmabuf, list); -@@ -6239,12 +6269,18 @@ lpfc_els_rsp_echo_acc(struct lpfc_vport - struct lpfc_iocbq *oldiocb, struct lpfc_nodelist *ndlp) - { - struct lpfc_hba *phba = vport->phba; -+ IOCB_t *icmd, *oldcmd; -+ union lpfc_wqe128 *wqe; - struct lpfc_iocbq *elsiocb; - uint8_t *pcmd; - uint16_t cmdsize; - int rc; -+ u32 ulp_context; - -- cmdsize = oldiocb->iocb.unsli3.rcvsli3.acc_len; -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ cmdsize = oldiocb->wcqe_cmpl.total_data_placed; -+ else -+ cmdsize = oldiocb->iocb.unsli3.rcvsli3.acc_len; - - /* The accumulated length can exceed the BPL_SIZE. For - * now, use this as the limit -@@ -6256,13 +6292,26 @@ lpfc_els_rsp_echo_acc(struct lpfc_vport - if (!elsiocb) - return 1; - -- elsiocb->iocb.ulpContext = oldiocb->iocb.ulpContext; /* Xri / rx_id */ -- elsiocb->iocb.unsli3.rcvsli3.ox_id = oldiocb->iocb.unsli3.rcvsli3.ox_id; -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ wqe = &elsiocb->wqe; -+ bf_set(wqe_ctxt_tag, &wqe->generic.wqe_com, -+ get_job_ulpcontext(phba, oldiocb)); /* Xri / rx_id */ -+ ulp_context = get_job_ulpcontext(phba, elsiocb); -+ bf_set(wqe_rcvoxid, &wqe->xmit_els_rsp.wqe_com, -+ get_job_rcvoxid(phba, oldiocb)); -+ } else { -+ icmd = &elsiocb->iocb; -+ oldcmd = &oldiocb->iocb; -+ icmd->ulpContext = oldcmd->ulpContext; /* Xri / rx_id */ -+ ulp_context = elsiocb->iocb.ulpContext; -+ icmd->unsli3.rcvsli3.ox_id = -+ oldcmd->unsli3.rcvsli3.ox_id; -+ } - - /* Xmit ECHO ACC response tag */ - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "2876 Xmit ECHO ACC response tag x%x xri x%x\n", -- elsiocb->iotag, elsiocb->iocb.ulpContext); -+ elsiocb->iotag, ulp_context); - pcmd = (uint8_t *) (((struct lpfc_dmabuf *) elsiocb->context2)->virt); - *((uint32_t *) (pcmd)) = ELS_CMD_ACC; - pcmd += sizeof(uint32_t); -@@ -8821,11 +8870,9 @@ lpfc_els_rcv_farpr(struct lpfc_vport *vp - { - struct lpfc_dmabuf *pcmd; - uint32_t *lp; -- IOCB_t *icmd; - uint32_t did; - -- icmd = &cmdiocb->iocb; -- did = icmd->un.elsreq64.remoteID; -+ did = get_job_els_rsp64_did(vport->phba, cmdiocb); - pcmd = (struct lpfc_dmabuf *) cmdiocb->context2; - lp = (uint32_t *) pcmd->virt; - diff --git a/patches.suse/scsi-lpfc-Update-lpfc-version-to-14.2.0.0.patch b/patches.suse/scsi-lpfc-Update-lpfc-version-to-14.2.0.0.patch deleted file mode 100644 index 11ba812..0000000 --- a/patches.suse/scsi-lpfc-Update-lpfc-version-to-14.2.0.0.patch +++ /dev/null @@ -1,30 +0,0 @@ -From: James Smart -Date: Thu, 24 Feb 2022 18:23:07 -0800 -Subject: scsi: lpfc: Update lpfc version to 14.2.0.0 -Patch-mainline: v5.18-rc1 -Git-commit: 64de6108f41003fbb15fc687b584939edd278f41 -References: bsc#1197675 - -Update lpfc version to 14.2.0.0 - -Link: https://lore.kernel.org/r/20220225022308.16486-17-jsmart2021@gmail.com -Co-developed-by: Justin Tee -Signed-off-by: Justin Tee -Signed-off-by: James Smart -Signed-off-by: Martin K. Petersen -Acked-by: Daniel Wagner ---- - drivers/scsi/lpfc/lpfc_version.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/scsi/lpfc/lpfc_version.h -+++ b/drivers/scsi/lpfc/lpfc_version.h -@@ -20,7 +20,7 @@ - * included with this package. * - *******************************************************************/ - --#define LPFC_DRIVER_VERSION "14.0.0.4" -+#define LPFC_DRIVER_VERSION "14.2.0.0" - #define LPFC_DRIVER_NAME "lpfc" - - /* Used for SLI 2/3 */ diff --git a/patches.suse/scsi-lpfc-fix-broken-sli4-abort-path.patch b/patches.suse/scsi-lpfc-fix-broken-sli4-abort-path.patch deleted file mode 100644 index a7e3ab0..0000000 --- a/patches.suse/scsi-lpfc-fix-broken-sli4-abort-path.patch +++ /dev/null @@ -1,54 +0,0 @@ -From: James Smart -Date: Wed, 23 Mar 2022 13:55:44 -0700 -Subject: scsi: lpfc: Fix broken SLI4 abort path -Patch-mainline: Queued in subsystem maintainer repository -Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git -Git-commit: 7294a9bcaa7ee0d3b96aab1a277317315fd46f09 -References: bsc#1197675 - -There was a merge error in ther 14.2.0.0 patches that resulted in the SLI4 -path using the SLI3 issue_abort_iotag() routine. This resulted in txcmplq -corruption. - -Fix to use the SLI4 routine when SLI4. - -Link: https://lore.kernel.org/r/20220323205545.81814-2-jsmart2021@gmail.com -Fixes: 31a59f75702f ("scsi: lpfc: SLI path split: Refactor Abort paths") -Cc: # v5.2+ -Co-developed-by: Dick Kennedy -Signed-off-by: Dick Kennedy -Signed-off-by: James Smart -Signed-off-by: Martin K. Petersen -Acked-by: Daniel Wagner ---- - drivers/scsi/lpfc/lpfc_scsi.c | 12 +++++++----- - 1 file changed, 7 insertions(+), 5 deletions(-) - -diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c -index 3c132604fd91..ba9dbb51b75f 100644 ---- a/drivers/scsi/lpfc/lpfc_scsi.c -+++ b/drivers/scsi/lpfc/lpfc_scsi.c -@@ -5929,13 +5929,15 @@ lpfc_abort_handler(struct scsi_cmnd *cmnd) - } - - lpfc_cmd->waitq = &waitq; -- if (phba->sli_rev == LPFC_SLI_REV4) -+ if (phba->sli_rev == LPFC_SLI_REV4) { - spin_unlock(&pring_s4->ring_lock); -- else -+ ret_val = lpfc_sli4_issue_abort_iotag(phba, iocb, -+ lpfc_sli_abort_fcp_cmpl); -+ } else { - pring = &phba->sli.sli3_ring[LPFC_FCP_RING]; -- -- ret_val = lpfc_sli_issue_abort_iotag(phba, pring, iocb, -- lpfc_sli_abort_fcp_cmpl); -+ ret_val = lpfc_sli_issue_abort_iotag(phba, pring, iocb, -+ lpfc_sli_abort_fcp_cmpl); -+ } - - /* Make sure HBA is alive */ - lpfc_issue_hb_tmo(phba); --- -2.29.2 - diff --git a/patches.suse/scsi-lpfc-fix-locking-for-lpfc_sli_iocbq_lookup.patch b/patches.suse/scsi-lpfc-fix-locking-for-lpfc_sli_iocbq_lookup.patch deleted file mode 100644 index 6a9824d..0000000 --- a/patches.suse/scsi-lpfc-fix-locking-for-lpfc_sli_iocbq_lookup.patch +++ /dev/null @@ -1,63 +0,0 @@ -From: James Smart -Date: Wed, 23 Mar 2022 13:55:45 -0700 -Subject: scsi: lpfc: Fix locking for lpfc_sli_iocbq_lookup() -Patch-mainline: Queued in subsystem maintainer repository -Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git -Git-commit: c26bd6602e1d348bfa754dc55e5608c922dd2801 -References: bsc#1197675 - -The rules changed for lpfc_sli_iocbq_lookup() vs locking. Prior, the -routine properly took out the lock. In newly refactored code, the locks -must be held when calling the routine. - -Fix lpfc_sli_process_sol_iocb() to take the locks before calling the -routine. - -Fix lpfc_sli_handle_fast_ring_event() to not release the locks to call the -routine. - -Link: https://lore.kernel.org/r/20220323205545.81814-3-jsmart2021@gmail.com -Fixes: 1b64aa9eae28 ("scsi: lpfc: SLI path split: Refactor fast and slow paths to native SLI4") -Co-developed-by: Dick Kennedy -Signed-off-by: Dick Kennedy -Signed-off-by: James Smart -Signed-off-by: Martin K. Petersen -Acked-by: Daniel Wagner ---- - drivers/scsi/lpfc/lpfc_sli.c | 10 ++++++++-- - 1 file changed, 8 insertions(+), 2 deletions(-) - -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index 70c3929a9fb4..bda2a7ba4e77 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -3721,7 +3721,15 @@ lpfc_sli_process_sol_iocb(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, - unsigned long iflag; - u32 ulp_command, ulp_status, ulp_word4, ulp_context, iotag; - -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ spin_lock_irqsave(&pring->ring_lock, iflag); -+ else -+ spin_lock_irqsave(&phba->hbalock, iflag); - cmdiocbp = lpfc_sli_iocbq_lookup(phba, pring, saveq); -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ spin_unlock_irqrestore(&pring->ring_lock, iflag); -+ else -+ spin_unlock_irqrestore(&phba->hbalock, iflag); - - ulp_command = get_job_cmnd(phba, saveq); - ulp_status = get_job_ulpstatus(phba, saveq); -@@ -4058,10 +4066,8 @@ lpfc_sli_handle_fast_ring_event(struct lpfc_hba *phba, - break; - } - -- spin_unlock_irqrestore(&phba->hbalock, iflag); - cmdiocbq = lpfc_sli_iocbq_lookup(phba, pring, - &rspiocbq); -- spin_lock_irqsave(&phba->hbalock, iflag); - if (unlikely(!cmdiocbq)) - break; - if (cmdiocbq->cmd_flag & LPFC_DRIVER_ABORTED) --- -2.29.2 - diff --git a/patches.suse/scsi-lpfc-fix-queue-failures-when-recovering-from-pci-parity-error.patch b/patches.suse/scsi-lpfc-fix-queue-failures-when-recovering-from-pci-parity-error.patch deleted file mode 100644 index c84cef8..0000000 --- a/patches.suse/scsi-lpfc-fix-queue-failures-when-recovering-from-pci-parity-error.patch +++ /dev/null @@ -1,45 +0,0 @@ -From: James Smart -Date: Wed, 16 Mar 2022 20:27:36 -0700 -Subject: scsi: lpfc: Fix queue failures when recovering from PCI parity error -Patch-mainline: Queued in subsystem maintainer repository -Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git -Git-commit: df0101197c4d9596682901631f3ee193ed354873 -References: bsc#1197675 bsc#1196478 - -When recovering from a pci-parity error the driver is failing to re-create -queues, causing recovery to fail. Looking deeper, it was found that the -interrupt vector count allocated on the recovery was fewer than the vectors -originally allocated. This disparity resulted in CPU map entries with stale -information. When the driver tries to re-create the queues, it attempts to -use the stale information which indicates an eq/interrupt vector that was -no longer created. - -Fix by clearng the cpup map array before enabling and requesting the IRQs -in the lpfc_sli_reset_slot_s4 routine(). - -Link: https://lore.kernel.org/r/20220317032737.45308-4-jsmart2021@gmail.com -Co-developed-by: Justin Tee -Signed-off-by: Justin Tee -Signed-off-by: James Smart -Signed-off-by: Martin K. Petersen -Acked-by: Daniel Wagner ---- - drivers/scsi/lpfc/lpfc_init.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c -index cf83bc0e27c0..461d333b1b3a 100644 ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -15236,6 +15236,8 @@ lpfc_io_slot_reset_s4(struct pci_dev *pdev) - psli->sli_flag &= ~LPFC_SLI_ACTIVE; - spin_unlock_irq(&phba->hbalock); - -+ /* Init cpu_map array */ -+ lpfc_cpu_map_array_init(phba); - /* Configure and enable interrupt */ - intr_mode = lpfc_sli4_enable_intr(phba, phba->intr_mode); - if (intr_mode == LPFC_INTR_ERROR) { --- -2.29.2 - diff --git a/patches.suse/scsi-lpfc-fix-unload-hang-after-back-to-back-pci-eeh-faults.patch b/patches.suse/scsi-lpfc-fix-unload-hang-after-back-to-back-pci-eeh-faults.patch deleted file mode 100644 index 53840d7..0000000 --- a/patches.suse/scsi-lpfc-fix-unload-hang-after-back-to-back-pci-eeh-faults.patch +++ /dev/null @@ -1,226 +0,0 @@ -From: James Smart -Date: Wed, 16 Mar 2022 20:27:35 -0700 -Subject: scsi: lpfc: Fix unload hang after back to back PCI EEH faults -Patch-mainline: Queued in subsystem maintainer repository -Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git -Git-commit: a4691038b4071ff0d9ae486d8822a2c0d41d5796 -References: bsc#1197675 bsc#1196478 - -When injecting EEH errors the port is getting hung up waiting on the node -list to empty, message number 0233. The driver is stuck at this point and -also can't unload. The driver makes transport remoteport delete calls which -try to abort I/O's, but the EEH daemon has already called the driver to -detach and the detachment has set the global FC_UNLOADING flag. There are -several code paths that will avoid I/O cleanup if the FC_UNLOADING flag is -set, resulting in transports waiting for I/O while the driver is waiting on -transports to clean up. - -Additionally, during study of the list, a locking issue was found in -lpfc_sli_abort_iocb_ring that could corrupt the list. - -A special case was added to the lpfc_cleanup() routine to call -lpfc_sli_flush_rings() if the driver is FC_UNLOADING and if the pci-slot -is offline (e.g. EEH). - -The SLI4 part of lpfc_sli_abort_iocb_ring() is changed to use the -ring_lock. Also added code to cancel the I/Os if the pci-slot is offline -and added checks and returns for the FC_UNLOADING and HBA_IOQ_FLUSH flags -to prevent trying to send an I/O that we cannot handle. - -Link: https://lore.kernel.org/r/20220317032737.45308-3-jsmart2021@gmail.com -Co-developed-by: Justin Tee -Signed-off-by: Justin Tee -Signed-off-by: James Smart -Signed-off-by: Martin K. Petersen -Acked-by: Daniel Wagner ---- - drivers/scsi/lpfc/lpfc_hbadisc.c | 1 - drivers/scsi/lpfc/lpfc_init.c | 26 +++++++++++++++++--- - drivers/scsi/lpfc/lpfc_nvme.c | 8 +++++- - drivers/scsi/lpfc/lpfc_sli.c | 50 +++++++++++++++++++++++++++------------ - 4 files changed, 66 insertions(+), 19 deletions(-) - ---- a/drivers/scsi/lpfc/lpfc_hbadisc.c -+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c -@@ -5271,6 +5271,7 @@ lpfc_unreg_rpi(struct lpfc_vport *vport, - ndlp->nlp_flag &= ~NLP_UNREG_INP; - mempool_free(mbox, phba->mbox_mem_pool); - acc_plogi = 1; -+ lpfc_nlp_put(ndlp); - } - } else { - lpfc_printf_vlog(vport, KERN_INFO, ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -97,6 +97,7 @@ static void lpfc_sli4_oas_verify(struct - static uint16_t lpfc_find_cpu_handle(struct lpfc_hba *, uint16_t, int); - static void lpfc_setup_bg(struct lpfc_hba *, struct Scsi_Host *); - static int lpfc_sli4_cgn_parm_chg_evt(struct lpfc_hba *); -+static void lpfc_sli4_prep_dev_for_reset(struct lpfc_hba *phba); - - static struct scsi_transport_template *lpfc_transport_template = NULL; - static struct scsi_transport_template *lpfc_vport_transport_template = NULL; -@@ -1986,6 +1987,7 @@ lpfc_handle_eratt_s4(struct lpfc_hba *ph - if (pci_channel_offline(phba->pcidev)) { - lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, - "3166 pci channel is offline\n"); -+ lpfc_sli_flush_io_rings(phba); - return; - } - -@@ -2970,6 +2972,22 @@ lpfc_cleanup(struct lpfc_vport *vport) - NLP_EVT_DEVICE_RM); - } - -+ /* This is a special case flush to return all -+ * IOs before entering this loop. There are -+ * two points in the code where a flush is -+ * avoided if the FC_UNLOADING flag is set. -+ * one is in the multipool destroy, -+ * (this prevents a crash) and the other is -+ * in the nvme abort handler, ( also prevents -+ * a crash). Both of these exceptions are -+ * cases where the slot is still accessible. -+ * The flush here is only when the pci slot -+ * is offline. -+ */ -+ if (vport->load_flag & FC_UNLOADING && -+ pci_channel_offline(phba->pcidev)) -+ lpfc_sli_flush_io_rings(vport->phba); -+ - /* At this point, ALL ndlp's should be gone - * because of the previous NLP_EVT_DEVICE_RM. - * Lets wait for this to happen, if needed. -@@ -2982,7 +3000,7 @@ lpfc_cleanup(struct lpfc_vport *vport) - list_for_each_entry_safe(ndlp, next_ndlp, - &vport->fc_nodes, nlp_listp) { - lpfc_printf_vlog(ndlp->vport, KERN_ERR, -- LOG_TRACE_EVENT, -+ LOG_DISCOVERY, - "0282 did:x%x ndlp:x%px " - "refcnt:%d xflags x%x nflag x%x\n", - ndlp->nlp_DID, (void *)ndlp, -@@ -13250,8 +13268,9 @@ lpfc_sli4_hba_unset(struct lpfc_hba *phb - /* Abort all iocbs associated with the hba */ - lpfc_sli_hba_iocb_abort(phba); - -- /* Wait for completion of device XRI exchange busy */ -- lpfc_sli4_xri_exchange_busy_wait(phba); -+ if (!pci_channel_offline(phba->pcidev)) -+ /* Wait for completion of device XRI exchange busy */ -+ lpfc_sli4_xri_exchange_busy_wait(phba); - - /* per-phba callback de-registration for hotplug event */ - if (phba->pport) -@@ -14155,6 +14174,7 @@ lpfc_sli_prep_dev_for_perm_failure(struc - "2711 PCI channel permanent disable for failure\n"); - /* Block all SCSI devices' I/Os on the host */ - lpfc_scsi_dev_block(phba); -+ lpfc_sli4_prep_dev_for_reset(phba); - - /* stop all timers */ - lpfc_stop_hba_timers(phba); ---- a/drivers/scsi/lpfc/lpfc_nvme.c -+++ b/drivers/scsi/lpfc/lpfc_nvme.c -@@ -95,6 +95,11 @@ lpfc_nvme_create_queue(struct nvme_fc_lo - - lport = (struct lpfc_nvme_lport *)pnvme_lport->private; - vport = lport->vport; -+ -+ if (!vport || vport->load_flag & FC_UNLOADING || -+ vport->phba->hba_flag & HBA_IOQ_FLUSH) -+ return -ENODEV; -+ - qhandle = kzalloc(sizeof(struct lpfc_nvme_qhandle), GFP_KERNEL); - if (qhandle == NULL) - return -ENOMEM; -@@ -1368,7 +1373,8 @@ lpfc_nvme_fcp_io_submit(struct nvme_fc_l - - phba = vport->phba; - -- if (unlikely(vport->load_flag & FC_UNLOADING)) { -+ if ((unlikely(vport->load_flag & FC_UNLOADING)) || -+ phba->hba_flag & HBA_IOQ_FLUSH) { - lpfc_printf_vlog(vport, KERN_INFO, LOG_NVME_IOERR, - "6124 Fail IO, Driver unload\n"); - atomic_inc(&lport->xmt_fcp_err); ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -4407,42 +4407,62 @@ lpfc_sli_handle_slow_ring_event_s4(struc - void - lpfc_sli_abort_iocb_ring(struct lpfc_hba *phba, struct lpfc_sli_ring *pring) - { -- LIST_HEAD(completions); -+ LIST_HEAD(tx_completions); -+ LIST_HEAD(txcmplq_completions); - struct lpfc_iocbq *iocb, *next_iocb; -+ int offline; - - if (pring->ringno == LPFC_ELS_RING) { - lpfc_fabric_abort_hba(phba); - } -+ offline = pci_channel_offline(phba->pcidev); - - /* Error everything on txq and txcmplq - * First do the txq. - */ - if (phba->sli_rev >= LPFC_SLI_REV4) { - spin_lock_irq(&pring->ring_lock); -- list_splice_init(&pring->txq, &completions); -+ list_splice_init(&pring->txq, &tx_completions); - pring->txq_cnt = 0; -- spin_unlock_irq(&pring->ring_lock); - -- spin_lock_irq(&phba->hbalock); -- /* Next issue ABTS for everything on the txcmplq */ -- list_for_each_entry_safe(iocb, next_iocb, &pring->txcmplq, list) -- lpfc_sli_issue_abort_iotag(phba, pring, iocb, NULL); -- spin_unlock_irq(&phba->hbalock); -+ if (offline) { -+ list_splice_init(&pring->txcmplq, -+ &txcmplq_completions); -+ } else { -+ /* Next issue ABTS for everything on the txcmplq */ -+ list_for_each_entry_safe(iocb, next_iocb, -+ &pring->txcmplq, list) -+ lpfc_sli_issue_abort_iotag(phba, pring, -+ iocb, NULL); -+ } -+ spin_unlock_irq(&pring->ring_lock); - } else { - spin_lock_irq(&phba->hbalock); -- list_splice_init(&pring->txq, &completions); -+ list_splice_init(&pring->txq, &tx_completions); - pring->txq_cnt = 0; - -- /* Next issue ABTS for everything on the txcmplq */ -- list_for_each_entry_safe(iocb, next_iocb, &pring->txcmplq, list) -- lpfc_sli_issue_abort_iotag(phba, pring, iocb, NULL); -+ if (offline) { -+ list_splice_init(&pring->txcmplq, &txcmplq_completions); -+ } else { -+ /* Next issue ABTS for everything on the txcmplq */ -+ list_for_each_entry_safe(iocb, next_iocb, -+ &pring->txcmplq, list) -+ lpfc_sli_issue_abort_iotag(phba, pring, -+ iocb, NULL); -+ } - spin_unlock_irq(&phba->hbalock); - } -- /* Make sure HBA is alive */ -- lpfc_issue_hb_tmo(phba); - -+ if (offline) { -+ /* Cancel all the IOCBs from the completions list */ -+ lpfc_sli_cancel_iocbs(phba, &txcmplq_completions, -+ IOSTAT_LOCAL_REJECT, IOERR_SLI_ABORTED); -+ } else { -+ /* Make sure HBA is alive */ -+ lpfc_issue_hb_tmo(phba); -+ } - /* Cancel all the IOCBs from the completions list */ -- lpfc_sli_cancel_iocbs(phba, &completions, IOSTAT_LOCAL_REJECT, -+ lpfc_sli_cancel_iocbs(phba, &tx_completions, IOSTAT_LOCAL_REJECT, - IOERR_SLI_ABORTED); - } - diff --git a/patches.suse/scsi-lpfc-improve-pci-eeh-error-and-recovery-handling.patch b/patches.suse/scsi-lpfc-improve-pci-eeh-error-and-recovery-handling.patch deleted file mode 100644 index b1d008d..0000000 --- a/patches.suse/scsi-lpfc-improve-pci-eeh-error-and-recovery-handling.patch +++ /dev/null @@ -1,578 +0,0 @@ -From: James Smart -Date: Wed, 16 Mar 2022 20:27:34 -0700 -Subject: scsi: lpfc: Improve PCI EEH Error and Recovery Handling -Patch-mainline: Queued in subsystem maintainer repository -Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git -Git-commit: 35ed9613d83f3c1f011877d591fd7d36f2666106 -References: bsc#1197675 bsc#1196478 - -Following EEH errors, the driver can crash or hang when deleting the -localport or when attempting to unload. - -The EEH handlers in the driver did not notify the NVMe-FC transport before -tearing the driver down. This was delayed until the resume steps. This -worked for SCSI because lpfc_block_scsi() would notify the -scsi_fc_transport that the target was not available but it would not clean -up all the references to the ndlp. - -The SLI3 prep for dev reset handler did the lpfc_offline_prep() and -lpfc_offline() calls to get the port stopped before restarting. The SLI4 -version of the prep for dev reset just destroyed the queues and did not -stop NVMe from continuing. Also because the port was not really stopped -the localport destroy would hang because the transport was still waiting -for I/O. Additionally, a devloss tmo can fire and post events to a stopped -worker thread creating another hang condition. - -lpfc_sli4_prep_dev_for_reset() is modified to call lpfc_offline_prep() and -lpfc_offline() rather than just lpfc_scsi_dev_block() to ensure both SCSI -and NVMe transports are notified to block I/O to the driver. - -Logic is added to devloss handler and worker thread to clean up ndlp -references and quiesce appropriately. - -Link: https://lore.kernel.org/r/20220317032737.45308-2-jsmart2021@gmail.com -Co-developed-by: Justin Tee -Signed-off-by: Justin Tee -Signed-off-by: James Smart -Signed-off-by: Martin K. Petersen -Acked-by: Daniel Wagner ---- - drivers/scsi/lpfc/lpfc.h | 7 +- - drivers/scsi/lpfc/lpfc_crtn.h | 3 + - drivers/scsi/lpfc/lpfc_hbadisc.c | 117 +++++++++++++++++++++++++++++++-------- - drivers/scsi/lpfc/lpfc_init.c | 60 ++++++++++++-------- - drivers/scsi/lpfc/lpfc_nvme.c | 11 +-- - drivers/scsi/lpfc/lpfc_sli.c | 15 +++-- - 6 files changed, 156 insertions(+), 57 deletions(-) - ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -808,6 +808,11 @@ enum lpfc_irq_chann_mode { - NHT_MODE, - }; - -+enum lpfc_hba_bit_flags { -+ FABRIC_COMANDS_BLOCKED, -+ HBA_PCI_ERR, -+}; -+ - struct lpfc_hba { - /* SCSI interface function jump table entries */ - struct lpfc_io_buf * (*lpfc_get_scsi_buf) -@@ -954,7 +959,6 @@ struct lpfc_hba { - * Firmware supports Forced Link Speed - * capability - */ --#define HBA_PCI_ERR 0x80000 /* The PCI slot is offline */ - #define HBA_FLOGI_ISSUED 0x100000 /* FLOGI was issued */ - #define HBA_SHORT_CMF 0x200000 /* shorter CMF timer routine */ - #define HBA_CGN_DAY_WRAP 0x400000 /* HBA Congestion info day wraps */ -@@ -1253,7 +1257,6 @@ struct lpfc_hba { - atomic_t fabric_iocb_count; - struct timer_list fabric_block_timer; - unsigned long bit_flags; --#define FABRIC_COMANDS_BLOCKED 0 - atomic_t num_rsrc_err; - atomic_t num_cmd_success; - unsigned long last_rsrc_error_time; ---- a/drivers/scsi/lpfc/lpfc_crtn.h -+++ b/drivers/scsi/lpfc/lpfc_crtn.h -@@ -656,3 +656,6 @@ extern int lpfc_use_cgn_signal; - extern union lpfc_wqe128 lpfc_iread_cmd_template; - extern union lpfc_wqe128 lpfc_iwrite_cmd_template; - extern union lpfc_wqe128 lpfc_icmnd_cmd_template; -+ -+void lpfc_sli_rpi_release(struct lpfc_vport *vport, -+ struct lpfc_nodelist *ndlp); ---- a/drivers/scsi/lpfc/lpfc_hbadisc.c -+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c -@@ -109,8 +109,8 @@ lpfc_rport_invalid(struct fc_rport *rpor - - ndlp = rdata->pnode; - if (!rdata->pnode) { -- pr_err("**** %s: NULL ndlp on rport x%px SID x%x\n", -- __func__, rport, rport->scsi_target_id); -+ pr_info("**** %s: NULL ndlp on rport x%px SID x%x\n", -+ __func__, rport, rport->scsi_target_id); - return -EINVAL; - } - -@@ -169,9 +169,10 @@ lpfc_dev_loss_tmo_callbk(struct fc_rport - - lpfc_printf_vlog(ndlp->vport, KERN_INFO, LOG_NODE, - "3181 dev_loss_callbk x%06x, rport x%px flg x%x " -- "load_flag x%x refcnt %d\n", -+ "load_flag x%x refcnt %d state %d xpt x%x\n", - ndlp->nlp_DID, ndlp->rport, ndlp->nlp_flag, -- vport->load_flag, kref_read(&ndlp->kref)); -+ vport->load_flag, kref_read(&ndlp->kref), -+ ndlp->nlp_state, ndlp->fc4_xpt_flags); - - /* Don't schedule a worker thread event if the vport is going down. - * The teardown process cleans up the node via lpfc_drop_node. -@@ -181,6 +182,11 @@ lpfc_dev_loss_tmo_callbk(struct fc_rport - ndlp->rport = NULL; - - ndlp->fc4_xpt_flags &= ~SCSI_XPT_REGD; -+ /* clear the NLP_XPT_REGD if the node is not registered -+ * with nvme-fc -+ */ -+ if (ndlp->fc4_xpt_flags == NLP_XPT_REGD) -+ ndlp->fc4_xpt_flags &= ~NLP_XPT_REGD; - - /* Remove the node reference from remote_port_add now. - * The driver will not call remote_port_delete. -@@ -225,18 +231,36 @@ lpfc_dev_loss_tmo_callbk(struct fc_rport - ndlp->rport = NULL; - spin_unlock_irqrestore(&ndlp->lock, iflags); - -- /* We need to hold the node by incrementing the reference -- * count until this queued work is done -- */ -- evtp->evt_arg1 = lpfc_nlp_get(ndlp); -+ if (phba->worker_thread) { -+ /* We need to hold the node by incrementing the reference -+ * count until this queued work is done -+ */ -+ evtp->evt_arg1 = lpfc_nlp_get(ndlp); -+ -+ spin_lock_irqsave(&phba->hbalock, iflags); -+ if (evtp->evt_arg1) { -+ evtp->evt = LPFC_EVT_DEV_LOSS; -+ list_add_tail(&evtp->evt_listp, &phba->work_list); -+ lpfc_worker_wake_up(phba); -+ } -+ spin_unlock_irqrestore(&phba->hbalock, iflags); -+ } else { -+ lpfc_printf_vlog(ndlp->vport, KERN_INFO, LOG_NODE, -+ "3188 worker thread is stopped %s x%06x, " -+ " rport x%px flg x%x load_flag x%x refcnt " -+ "%d\n", __func__, ndlp->nlp_DID, -+ ndlp->rport, ndlp->nlp_flag, -+ vport->load_flag, kref_read(&ndlp->kref)); -+ if (!(ndlp->fc4_xpt_flags & NVME_XPT_REGD)) { -+ spin_lock_irqsave(&ndlp->lock, iflags); -+ /* Node is in dev loss. No further transaction. */ -+ ndlp->nlp_flag &= ~NLP_IN_DEV_LOSS; -+ spin_unlock_irqrestore(&ndlp->lock, iflags); -+ lpfc_disc_state_machine(vport, ndlp, NULL, -+ NLP_EVT_DEVICE_RM); -+ } - -- spin_lock_irqsave(&phba->hbalock, iflags); -- if (evtp->evt_arg1) { -- evtp->evt = LPFC_EVT_DEV_LOSS; -- list_add_tail(&evtp->evt_listp, &phba->work_list); -- lpfc_worker_wake_up(phba); - } -- spin_unlock_irqrestore(&phba->hbalock, iflags); - - return; - } -@@ -399,11 +423,12 @@ lpfc_dev_loss_tmo_handler(struct lpfc_no - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, - "0203 Devloss timeout on " - "WWPN %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x " -- "NPort x%06x Data: x%x x%x x%x\n", -+ "NPort x%06x Data: x%x x%x x%x refcnt %d\n", - *name, *(name+1), *(name+2), *(name+3), - *(name+4), *(name+5), *(name+6), *(name+7), - ndlp->nlp_DID, ndlp->nlp_flag, -- ndlp->nlp_state, ndlp->nlp_rpi); -+ ndlp->nlp_state, ndlp->nlp_rpi, -+ kref_read(&ndlp->kref)); - } else { - lpfc_printf_vlog(vport, KERN_INFO, LOG_TRACE_EVENT, - "0204 Devloss timeout on " -@@ -625,18 +650,22 @@ lpfc_work_list_done(struct lpfc_hba *phb - int free_evt; - int fcf_inuse; - uint32_t nlp_did; -+ bool hba_pci_err; - - spin_lock_irq(&phba->hbalock); - while (!list_empty(&phba->work_list)) { - list_remove_head((&phba->work_list), evtp, typeof(*evtp), - evt_listp); - spin_unlock_irq(&phba->hbalock); -+ hba_pci_err = test_bit(HBA_PCI_ERR, &phba->bit_flags); - free_evt = 1; - switch (evtp->evt) { - case LPFC_EVT_ELS_RETRY: - ndlp = (struct lpfc_nodelist *) (evtp->evt_arg1); -- lpfc_els_retry_delay_handler(ndlp); -- free_evt = 0; /* evt is part of ndlp */ -+ if (!hba_pci_err) { -+ lpfc_els_retry_delay_handler(ndlp); -+ free_evt = 0; /* evt is part of ndlp */ -+ } - /* decrement the node reference count held - * for this queued work - */ -@@ -658,8 +687,10 @@ lpfc_work_list_done(struct lpfc_hba *phb - break; - case LPFC_EVT_RECOVER_PORT: - ndlp = (struct lpfc_nodelist *)(evtp->evt_arg1); -- lpfc_sli_abts_recover_port(ndlp->vport, ndlp); -- free_evt = 0; -+ if (!hba_pci_err) { -+ lpfc_sli_abts_recover_port(ndlp->vport, ndlp); -+ free_evt = 0; -+ } - /* decrement the node reference count held for - * this queued work - */ -@@ -729,14 +760,18 @@ lpfc_work_done(struct lpfc_hba *phba) - struct lpfc_vport **vports; - struct lpfc_vport *vport; - int i; -+ bool hba_pci_err; - -+ hba_pci_err = test_bit(HBA_PCI_ERR, &phba->bit_flags); - spin_lock_irq(&phba->hbalock); - ha_copy = phba->work_ha; - phba->work_ha = 0; - spin_unlock_irq(&phba->hbalock); -+ if (hba_pci_err) -+ ha_copy = 0; - - /* First, try to post the next mailbox command to SLI4 device */ -- if (phba->pci_dev_grp == LPFC_PCI_DEV_OC) -+ if (phba->pci_dev_grp == LPFC_PCI_DEV_OC && !hba_pci_err) - lpfc_sli4_post_async_mbox(phba); - - if (ha_copy & HA_ERATT) { -@@ -790,6 +825,8 @@ lpfc_work_done(struct lpfc_hba *phba) - work_port_events = vport->work_port_events; - vport->work_port_events &= ~work_port_events; - spin_unlock_irq(&vport->work_port_lock); -+ if (hba_pci_err) -+ continue; - if (work_port_events & WORKER_DISC_TMO) - lpfc_disc_timeout_handler(vport); - if (work_port_events & WORKER_ELS_TMO) -@@ -1021,12 +1058,14 @@ lpfc_linkdown(struct lpfc_hba *phba) - struct lpfc_vport **vports; - LPFC_MBOXQ_t *mb; - int i; -+ int offline; - - if (phba->link_state == LPFC_LINK_DOWN) - return 0; - - /* Block all SCSI stack I/Os */ - lpfc_scsi_dev_block(phba); -+ offline = pci_channel_offline(phba->pcidev); - - phba->defer_flogi_acc_flag = false; - -@@ -1067,7 +1106,7 @@ lpfc_linkdown(struct lpfc_hba *phba) - lpfc_destroy_vport_work_array(phba, vports); - - /* Clean up any SLI3 firmware default rpi's */ -- if (phba->sli_rev > LPFC_SLI_REV3) -+ if (phba->sli_rev > LPFC_SLI_REV3 || offline) - goto skip_unreg_did; - - mb = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL); -@@ -4560,6 +4599,11 @@ lpfc_nlp_unreg_node(struct lpfc_vport *v - spin_lock_irqsave(&ndlp->lock, iflags); - if (!(ndlp->fc4_xpt_flags & NLP_XPT_REGD)) { - spin_unlock_irqrestore(&ndlp->lock, iflags); -+ lpfc_printf_vlog(vport, KERN_INFO, LOG_SLI, -+ "0999 %s Not regd: ndlp x%px rport x%px DID " -+ "x%x FLG x%x XPT x%x\n", -+ __func__, ndlp, ndlp->rport, ndlp->nlp_DID, -+ ndlp->nlp_flag, ndlp->fc4_xpt_flags); - return; - } - -@@ -4570,6 +4614,13 @@ lpfc_nlp_unreg_node(struct lpfc_vport *v - ndlp->fc4_xpt_flags & SCSI_XPT_REGD) { - vport->phba->nport_event_cnt++; - lpfc_unregister_remote_port(ndlp); -+ } else if (!ndlp->rport) { -+ lpfc_printf_vlog(vport, KERN_INFO, LOG_SLI, -+ "1999 %s NDLP in devloss x%px DID x%x FLG x%x" -+ " XPT x%x refcnt %d\n", -+ __func__, ndlp, ndlp->nlp_DID, ndlp->nlp_flag, -+ ndlp->fc4_xpt_flags, -+ kref_read(&ndlp->kref)); - } - - if (ndlp->fc4_xpt_flags & NVME_XPT_REGD) { -@@ -5946,12 +5997,34 @@ lpfc_disc_flush_list(struct lpfc_vport * - } - } - -+/* -+ * lpfc_notify_xport_npr - notifies xport of node disappearance -+ * @vport: Pointer to Virtual Port object. -+ * -+ * Transitions all ndlps to NPR state. When lpfc_nlp_set_state -+ * calls lpfc_nlp_state_cleanup, the ndlp->rport is unregistered -+ * and transport notified that the node is gone. -+ * Return Code: -+ * none -+ */ -+static void -+lpfc_notify_xport_npr(struct lpfc_vport *vport) -+{ -+ struct lpfc_nodelist *ndlp, *next_ndlp; -+ -+ list_for_each_entry_safe(ndlp, next_ndlp, &vport->fc_nodes, -+ nlp_listp) { -+ lpfc_nlp_set_state(vport, ndlp, NLP_STE_NPR_NODE); -+ } -+} - void - lpfc_cleanup_discovery_resources(struct lpfc_vport *vport) - { - lpfc_els_flush_rscn(vport); - lpfc_els_flush_cmd(vport); - lpfc_disc_flush_list(vport); -+ if (pci_channel_offline(vport->phba->pcidev)) -+ lpfc_notify_xport_npr(vport); - } - - /*****************************************************************************/ ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -1643,7 +1643,7 @@ lpfc_sli4_offline_eratt(struct lpfc_hba - { - spin_lock_irq(&phba->hbalock); - if (phba->link_state == LPFC_HBA_ERROR && -- phba->hba_flag & HBA_PCI_ERR) { -+ test_bit(HBA_PCI_ERR, &phba->bit_flags)) { - spin_unlock_irq(&phba->hbalock); - return; - } -@@ -3679,7 +3679,8 @@ lpfc_offline_prep(struct lpfc_hba *phba, - struct lpfc_vport **vports; - struct Scsi_Host *shost; - int i; -- int offline = 0; -+ int offline; -+ bool hba_pci_err; - - if (vport->fc_flag & FC_OFFLINE_MODE) - return; -@@ -3689,6 +3690,7 @@ lpfc_offline_prep(struct lpfc_hba *phba, - lpfc_linkdown(phba); - - offline = pci_channel_offline(phba->pcidev); -+ hba_pci_err = test_bit(HBA_PCI_ERR, &phba->bit_flags); - - /* Issue an unreg_login to all nodes on all vports */ - vports = lpfc_create_vport_work_array(phba); -@@ -3712,11 +3714,14 @@ lpfc_offline_prep(struct lpfc_hba *phba, - ndlp->nlp_flag &= ~NLP_NPR_ADISC; - spin_unlock_irq(&ndlp->lock); - -- if (offline) { -+ if (offline || hba_pci_err) { - spin_lock_irq(&ndlp->lock); - ndlp->nlp_flag &= ~(NLP_UNREG_INP | - NLP_RPI_REGISTERED); - spin_unlock_irq(&ndlp->lock); -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ lpfc_sli_rpi_release(vports[i], -+ ndlp); - } else { - lpfc_unreg_rpi(vports[i], ndlp); - } -@@ -13265,15 +13270,12 @@ lpfc_sli4_hba_unset(struct lpfc_hba *phb - /* Disable FW logging to host memory */ - lpfc_ras_stop_fwlog(phba); - -- /* Unset the queues shared with the hardware then release all -- * allocated resources. -- */ -- lpfc_sli4_queue_unset(phba); -- lpfc_sli4_queue_destroy(phba); -- - /* Reset SLI4 HBA FCoE function */ - lpfc_pci_function_reset(phba); - -+ /* release all queue allocated resources. */ -+ lpfc_sli4_queue_destroy(phba); -+ - /* Free RAS DMA memory */ - if (phba->ras_fwlog.ras_enabled) - lpfc_sli4_ras_dma_free(phba); -@@ -14952,24 +14954,28 @@ lpfc_sli4_prep_dev_for_recover(struct lp - static void - lpfc_sli4_prep_dev_for_reset(struct lpfc_hba *phba) - { -- lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, -- "2826 PCI channel disable preparing for reset\n"); -+ int offline = pci_channel_offline(phba->pcidev); -+ -+ lpfc_printf_log(phba, KERN_ERR, LOG_INIT, -+ "2826 PCI channel disable preparing for reset offline" -+ " %d\n", offline); - - /* Block any management I/Os to the device */ - lpfc_block_mgmt_io(phba, LPFC_MBX_NO_WAIT); - -- /* Block all SCSI devices' I/Os on the host */ -- lpfc_scsi_dev_block(phba); - -+ /* HBA_PCI_ERR was set in io_error_detect */ -+ lpfc_offline_prep(phba, LPFC_MBX_NO_WAIT); - /* Flush all driver's outstanding I/Os as we are to reset */ - lpfc_sli_flush_io_rings(phba); -+ lpfc_offline(phba); - - /* stop all timers */ - lpfc_stop_hba_timers(phba); - -+ lpfc_sli4_queue_destroy(phba); - /* Disable interrupt and pci device */ - lpfc_sli4_disable_intr(phba); -- lpfc_sli4_queue_destroy(phba); - pci_disable_device(phba->pcidev); - } - -@@ -15018,6 +15024,7 @@ lpfc_io_error_detected_s4(struct pci_dev - { - struct Scsi_Host *shost = pci_get_drvdata(pdev); - struct lpfc_hba *phba = ((struct lpfc_vport *)shost->hostdata)->phba; -+ bool hba_pci_err; - - switch (state) { - case pci_channel_io_normal: -@@ -15025,17 +15032,24 @@ lpfc_io_error_detected_s4(struct pci_dev - lpfc_sli4_prep_dev_for_recover(phba); - return PCI_ERS_RESULT_CAN_RECOVER; - case pci_channel_io_frozen: -- phba->hba_flag |= HBA_PCI_ERR; -+ hba_pci_err = test_and_set_bit(HBA_PCI_ERR, &phba->bit_flags); - /* Fatal error, prepare for slot reset */ -- lpfc_sli4_prep_dev_for_reset(phba); -+ if (!hba_pci_err) -+ lpfc_sli4_prep_dev_for_reset(phba); -+ else -+ lpfc_printf_log(phba, KERN_ERR, LOG_INIT, -+ "2832 Already handling PCI error " -+ "state: x%x\n", state); - return PCI_ERS_RESULT_NEED_RESET; - case pci_channel_io_perm_failure: -- phba->hba_flag |= HBA_PCI_ERR; -+ set_bit(HBA_PCI_ERR, &phba->bit_flags); - /* Permanent failure, prepare for device down */ - lpfc_sli4_prep_dev_for_perm_failure(phba); - return PCI_ERS_RESULT_DISCONNECT; - default: -- phba->hba_flag |= HBA_PCI_ERR; -+ hba_pci_err = test_and_set_bit(HBA_PCI_ERR, &phba->bit_flags); -+ if (!hba_pci_err) -+ lpfc_sli4_prep_dev_for_reset(phba); - /* Unknown state, prepare and request slot reset */ - lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, - "2825 Unknown PCI error state: x%x\n", state); -@@ -15069,17 +15083,21 @@ lpfc_io_slot_reset_s4(struct pci_dev *pd - struct lpfc_hba *phba = ((struct lpfc_vport *)shost->hostdata)->phba; - struct lpfc_sli *psli = &phba->sli; - uint32_t intr_mode; -+ bool hba_pci_err; - - dev_printk(KERN_INFO, &pdev->dev, "recovering from a slot reset.\n"); - if (pci_enable_device_mem(pdev)) { - printk(KERN_ERR "lpfc: Cannot re-enable " -- "PCI device after reset.\n"); -+ "PCI device after reset.\n"); - return PCI_ERS_RESULT_DISCONNECT; - } - - pci_restore_state(pdev); - -- phba->hba_flag &= ~HBA_PCI_ERR; -+ hba_pci_err = test_and_clear_bit(HBA_PCI_ERR, &phba->bit_flags); -+ if (!hba_pci_err) -+ dev_info(&pdev->dev, -+ "hba_pci_err was not set, recovering slot reset.\n"); - /* - * As the new kernel behavior of pci_restore_state() API call clears - * device saved_state flag, need to save the restored state again. -@@ -15134,8 +15152,6 @@ lpfc_io_resume_s4(struct pci_dev *pdev) - */ - if (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE)) { - /* Perform device reset */ -- lpfc_offline_prep(phba, LPFC_MBX_WAIT); -- lpfc_offline(phba); - lpfc_sli_brdrestart(phba); - /* Bring the device back online */ - lpfc_online(phba); ---- a/drivers/scsi/lpfc/lpfc_nvme.c -+++ b/drivers/scsi/lpfc/lpfc_nvme.c -@@ -2023,8 +2023,7 @@ lpfc_nvme_lport_unreg_wait(struct lpfc_v - abts_nvme = 0; - for (i = 0; i < phba->cfg_hdw_queue; i++) { - qp = &phba->sli4_hba.hdwq[i]; -- if (!vport || !vport->localport || -- !qp || !qp->io_wq) -+ if (!vport->localport || !qp || !qp->io_wq) - return; - - pring = qp->io_wq->pring; -@@ -2034,8 +2033,9 @@ lpfc_nvme_lport_unreg_wait(struct lpfc_v - abts_scsi += qp->abts_scsi_io_bufs; - abts_nvme += qp->abts_nvme_io_bufs; - } -- if (!vport || !vport->localport || -- vport->phba->hba_flag & HBA_PCI_ERR) -+ if (!vport->localport || -+ test_bit(HBA_PCI_ERR, &vport->phba->bit_flags) || -+ vport->load_flag & FC_UNLOADING) - return; - - lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, -@@ -2395,8 +2395,7 @@ lpfc_nvme_unregister_port(struct lpfc_vp - * return values is ignored. The upcall is a courtesy to the - * transport. - */ -- if (vport->load_flag & FC_UNLOADING || -- unlikely(vport->phba->hba_flag & HBA_PCI_ERR)) -+ if (vport->load_flag & FC_UNLOADING) - (void)nvme_fc_set_remoteport_devloss(remoteport, 0); - - ret = nvme_fc_unregister_remoteport(remoteport); ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -2831,6 +2831,12 @@ static void - ndlp->nlp_flag &= ~NLP_UNREG_INP; - } - -+void -+lpfc_sli_rpi_release(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp) -+{ -+ __lpfc_sli_rpi_release(vport, ndlp); -+} -+ - /** - * lpfc_sli_def_mbox_cmpl - Default mailbox completion handler - * @phba: Pointer to HBA context object. -@@ -4489,11 +4495,6 @@ lpfc_sli_flush_io_rings(struct lpfc_hba - struct lpfc_iocbq *piocb, *next_iocb; - - spin_lock_irq(&phba->hbalock); -- if (phba->hba_flag & HBA_IOQ_FLUSH || -- !phba->sli4_hba.hdwq) { -- spin_unlock_irq(&phba->hbalock); -- return; -- } - /* Indicate the I/O queues are flushed */ - phba->hba_flag |= HBA_IOQ_FLUSH; - spin_unlock_irq(&phba->hbalock); -@@ -10837,6 +10838,10 @@ lpfc_sli_issue_iocb(struct lpfc_hba *phb - unsigned long iflags; - int rc; - -+ /* If the PCI channel is in offline state, do not post iocbs. */ -+ if (unlikely(pci_channel_offline(phba->pcidev))) -+ return IOCB_ERROR; -+ - if (phba->sli_rev == LPFC_SLI_REV4) { - lpfc_sli_prep_wqe(phba, piocb); - diff --git a/patches.suse/scsi-lpfc-update-lpfc-version-to-14.2.0.1.patch b/patches.suse/scsi-lpfc-update-lpfc-version-to-14.2.0.1.patch deleted file mode 100644 index 107fa06..0000000 --- a/patches.suse/scsi-lpfc-update-lpfc-version-to-14.2.0.1.patch +++ /dev/null @@ -1,36 +0,0 @@ -From: James Smart -Date: Wed, 16 Mar 2022 20:27:37 -0700 -Subject: scsi: lpfc: Update lpfc version to 14.2.0.1 -Patch-mainline: Queued in subsystem maintainer repository -Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git -Git-commit: 4f3beb36b1e46f1a04967a84e3a1bd55bf7a9e7a -References: bsc#1197675 - -Update lpfc version to 14.2.0.1 - -Link: https://lore.kernel.org/r/20220317032737.45308-5-jsmart2021@gmail.com -Co-developed-by: Justin Tee -Signed-off-by: Justin Tee -Signed-off-by: James Smart -Signed-off-by: Martin K. Petersen -Acked-by: Daniel Wagner ---- - drivers/scsi/lpfc/lpfc_version.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/scsi/lpfc/lpfc_version.h b/drivers/scsi/lpfc/lpfc_version.h -index e52f37e5d896..a4d3259b8c52 100644 ---- a/drivers/scsi/lpfc/lpfc_version.h -+++ b/drivers/scsi/lpfc/lpfc_version.h -@@ -20,7 +20,7 @@ - * included with this package. * - *******************************************************************/ - --#define LPFC_DRIVER_VERSION "14.2.0.0" -+#define LPFC_DRIVER_VERSION "14.2.0.1" - #define LPFC_DRIVER_NAME "lpfc" - - /* Used for SLI 2/3 */ --- -2.29.2 - diff --git a/patches.suse/scsi-pm8001-Fix-NCQ-NON-DATA-command-completion-handling b/patches.suse/scsi-pm8001-Fix-NCQ-NON-DATA-command-completion-handling new file mode 100644 index 0000000..38c9b30 --- /dev/null +++ b/patches.suse/scsi-pm8001-Fix-NCQ-NON-DATA-command-completion-handling @@ -0,0 +1,54 @@ +From: Damien Le Moal +Date: Sun, 20 Feb 2022 12:17:54 +0900 +Subject: scsi: pm8001: Fix NCQ NON DATA command completion handling +Git-commit: 1d6736c3e162061dc811c76e605f35ef3234bffa +Patch-mainline: v5.18-rc1 +References: git-fixes + +NCQ NON DATA is an NCQ command with the DMA_NONE DMA direction and so a +register-device-to-host-FIS response is expected for it. + +However, for an IO_SUCCESS case, mpi_sata_completion() expects a +set-device-bits-FIS for any ata task with an use_ncq field true, which +includes NCQ NON DATA commands. + +Fix this to correctly treat NCQ NON DATA commands as non-data by also +testing for the DMA_NONE DMA direction. + +[lduncan: hand applied then refreshed.] + +Link: https://lore.kernel.org/r/20220220031810.738362-16-damien.lemoal@opensource.wdc.com +Fixes: dbf9bfe61571 ("[SCSI] pm8001: add SAS/SATA HBA driver") +Reviewed-by: Jack Wang +Signed-off-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Acked-by: Lee Duncan +--- + drivers/scsi/pm8001/pm8001_hwi.c | 3 ++- + drivers/scsi/pm8001/pm80xx_hwi.c | 3 ++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/pm8001/pm8001_hwi.c ++++ b/drivers/scsi/pm8001/pm8001_hwi.c +@@ -2418,7 +2418,8 @@ mpi_sata_completion(struct pm8001_hba_in + len = sizeof(struct pio_setup_fis); + PM8001_IO_DBG(pm8001_ha, + pm8001_printk("PIO read len = %d\n", len)); +- } else if (t->ata_task.use_ncq) { ++ } else if (t->ata_task.use_ncq && ++ t->data_dir != PCI_DMA_NONE) { + len = sizeof(struct set_dev_bits_fis); + PM8001_IO_DBG(pm8001_ha, + pm8001_printk("FPDMA len = %d\n", len)); +--- a/drivers/scsi/pm8001/pm80xx_hwi.c ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c +@@ -2128,7 +2128,8 @@ mpi_sata_completion(struct pm8001_hba_in + len = sizeof(struct pio_setup_fis); + PM8001_IO_DBG(pm8001_ha, + pm8001_printk("PIO read len = %d\n", len)); +- } else if (t->ata_task.use_ncq) { ++ } else if (t->ata_task.use_ncq && ++ t->data_dir != PCI_DMA_NONE) { + len = sizeof(struct set_dev_bits_fis); + PM8001_IO_DBG(pm8001_ha, + pm8001_printk("FPDMA len = %d\n", len)); diff --git a/patches.suse/scsi-pm8001-Fix-NCQ-NON-DATA-command-task-initialization b/patches.suse/scsi-pm8001-Fix-NCQ-NON-DATA-command-task-initialization new file mode 100644 index 0000000..8e960d2 --- /dev/null +++ b/patches.suse/scsi-pm8001-Fix-NCQ-NON-DATA-command-task-initialization @@ -0,0 +1,93 @@ +From: Damien Le Moal +Date: Sun, 20 Feb 2022 12:17:53 +0900 +Subject: scsi: pm8001: Fix NCQ NON DATA command task initialization +Git-commit: aa028141ab0bc62c44a84d42f09db35d82df82a2 +Patch-mainline: v5.18-rc1 +References: git-fixes + +In the pm8001_chip_sata_req() and pm80xx_chip_sata_req() functions, all +tasks with a DMA direction of DMA_NONE (no data transfer) are initialized +using the ATAP value 0x04. However, NCQ NON DATA commands, while being +DMA_NONE commands are NCQ commands and need to be initialized using the +value 0x07 for ATAP, similarly to other NCQ commands. + +Make sure that NCQ NON DATA command tasks are initialized similarly to +other NCQ commands by also testing the task "use_ncq" field in addition to +the DMA direction. While at it, reorganize the code into a chain of if - +else if - else to avoid useless affectations and debug messages. + +[lduncan: hand applied then refreshed.] + +Link: https://lore.kernel.org/r/20220220031810.738362-15-damien.lemoal@opensource.wdc.com +Fixes: dbf9bfe61571 ("[SCSI] pm8001: add SAS/SATA HBA driver") +Reviewed-by: Jack Wang +Signed-off-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Acked-by: Lee Duncan +--- + drivers/scsi/pm8001/pm8001_hwi.c | 13 ++++++------- + drivers/scsi/pm8001/pm80xx_hwi.c | 13 ++++++------- + 2 files changed, 12 insertions(+), 14 deletions(-) + +--- a/drivers/scsi/pm8001/pm8001_hwi.c ++++ b/drivers/scsi/pm8001/pm8001_hwi.c +@@ -4369,22 +4369,21 @@ static int pm8001_chip_sata_req(struct p + u32 opc = OPC_INB_SATA_HOST_OPSTART; + memset(&sata_cmd, 0, sizeof(sata_cmd)); + circularQ = &pm8001_ha->inbnd_q_tbl[0]; +- if (task->data_dir == PCI_DMA_NONE) { ++ if (task->data_dir == PCI_DMA_NONE && !task->ata_task.use_ncq) { + ATAP = 0x04; /* no data*/ + PM8001_IO_DBG(pm8001_ha, pm8001_printk("no data\n")); + } else if (likely(!task->ata_task.device_control_reg_update)) { +- if (task->ata_task.dma_xfer) { ++ if (task->ata_task.use_ncq && ++ dev->sata_dev.class != ATA_DEV_ATAPI) { ++ ATAP = 0x07; /* FPDMA */ ++ PM8001_IO_DBG(pm8001_ha, pm8001_printk("FPDMA\n")); ++ } else if (task->ata_task.dma_xfer) { + ATAP = 0x06; /* DMA */ + PM8001_IO_DBG(pm8001_ha, pm8001_printk("DMA\n")); + } else { + ATAP = 0x05; /* PIO*/ + PM8001_IO_DBG(pm8001_ha, pm8001_printk("PIO\n")); + } +- if (task->ata_task.use_ncq && +- dev->sata_dev.class != ATA_DEV_ATAPI) { +- ATAP = 0x07; /* FPDMA */ +- PM8001_IO_DBG(pm8001_ha, pm8001_printk("FPDMA\n")); +- } + } + if (task->ata_task.use_ncq && pm8001_get_ncq_tag(task, &hdr_tag)) { + task->ata_task.fis.sector_count |= (u8) (hdr_tag << 3); +--- a/drivers/scsi/pm8001/pm80xx_hwi.c ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c +@@ -4166,22 +4166,21 @@ static int pm80xx_chip_sata_req(struct p + q_index = (u32) (pm8001_ha_dev->id & 0x00ffffff) % PM8001_MAX_INB_NUM; + circularQ = &pm8001_ha->inbnd_q_tbl[q_index]; + +- if (task->data_dir == PCI_DMA_NONE) { ++ if (task->data_dir == PCI_DMA_NONE && !task->ata_task.use_ncq) { + ATAP = 0x04; /* no data*/ + PM8001_IO_DBG(pm8001_ha, pm8001_printk("no data\n")); + } else if (likely(!task->ata_task.device_control_reg_update)) { +- if (task->ata_task.dma_xfer) { ++ if (task->ata_task.use_ncq && ++ dev->sata_dev.class != ATA_DEV_ATAPI) { ++ ATAP = 0x07; /* FPDMA */ ++ PM8001_IO_DBG(pm8001_ha, pm8001_printk("FPDMA\n")); ++ } else if (task->ata_task.dma_xfer) { + ATAP = 0x06; /* DMA */ + PM8001_IO_DBG(pm8001_ha, pm8001_printk("DMA\n")); + } else { + ATAP = 0x05; /* PIO*/ + PM8001_IO_DBG(pm8001_ha, pm8001_printk("PIO\n")); + } +- if (task->ata_task.use_ncq && +- dev->sata_dev.class != ATA_DEV_ATAPI) { +- ATAP = 0x07; /* FPDMA */ +- PM8001_IO_DBG(pm8001_ha, pm8001_printk("FPDMA\n")); +- } + } + if (task->ata_task.use_ncq && pm8001_get_ncq_tag(task, &hdr_tag)) { + task->ata_task.fis.sector_count |= (u8) (hdr_tag << 3); diff --git a/patches.suse/scsi-pm8001-Fix-abort-all-task-initialization b/patches.suse/scsi-pm8001-Fix-abort-all-task-initialization new file mode 100644 index 0000000..a041229 --- /dev/null +++ b/patches.suse/scsi-pm8001-Fix-abort-all-task-initialization @@ -0,0 +1,93 @@ +From: Damien Le Moal +Date: Sun, 20 Feb 2022 12:17:55 +0900 +Subject: scsi: pm8001: Fix abort all task initialization +Git-commit: 7f12845c8389855dbcc67baa068b6832dc4a396e +Patch-mainline: v5.18-rc1 +References: git-fixes + +In pm80xx_send_abort_all(), the n_elem field of the ccb used is not +initialized to 0. This missing initialization sometimes lead to the task +completion path seeing the ccb with a non-zero n_elem resulting in the +execution of invalid dma_unmap_sg() calls in pm8001_ccb_task_free(), +causing a crash such as: + +[ 197.676341] RIP: 0010:iommu_dma_unmap_sg+0x6d/0x280 +[ 197.700204] RSP: 0018:ffff889bbcf89c88 EFLAGS: 00010012 +[ 197.705485] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff83d0bda0 +[ 197.712687] RDX: 0000000000000002 RSI: 0000000000000000 RDI: ffff88810dffc0d0 +[ 197.719887] RBP: 0000000000000000 R08: 0000000000000000 R09: ffff8881c790098b +[ 197.727089] R10: ffffed1038f20131 R11: 0000000000000001 R12: 0000000000000000 +[ 197.734296] R13: ffff88810dffc0d0 R14: 0000000000000010 R15: 0000000000000000 +[ 197.741493] FS: 0000000000000000(0000) GS:ffff889bbcf80000(0000) knlGS:0000000000000000 +[ 197.749659] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 197.755459] CR2: 00007f16c1b42734 CR3: 0000000004814000 CR4: 0000000000350ee0 +[ 197.762656] Call Trace: +[ 197.765127] +[ 197.767162] pm8001_ccb_task_free+0x5f1/0x820 [pm80xx] +[ 197.772364] ? do_raw_spin_unlock+0x54/0x220 +[ 197.776680] pm8001_mpi_task_abort_resp+0x2ce/0x4f0 [pm80xx] +[ 197.782406] process_oq+0xe85/0x7890 [pm80xx] +[ 197.786817] ? lock_acquire+0x194/0x490 +[ 197.790697] ? handle_irq_event+0x10e/0x1b0 +[ 197.794920] ? mpi_sata_completion+0x2d70/0x2d70 [pm80xx] +[ 197.800378] ? __wake_up_bit+0x100/0x100 +[ 197.804340] ? lock_is_held_type+0x98/0x110 +[ 197.808565] pm80xx_chip_isr+0x94/0x130 [pm80xx] +[ 197.813243] tasklet_action_common.constprop.0+0x24b/0x2f0 +[ 197.818785] __do_softirq+0x1b5/0x82d +[ 197.822485] ? do_raw_spin_unlock+0x54/0x220 +[ 197.826799] __irq_exit_rcu+0x17e/0x1e0 +[ 197.830678] irq_exit_rcu+0xa/0x20 +[ 197.834114] common_interrupt+0x78/0x90 +[ 197.840051] +[ 197.844236] +[ 197.848397] asm_common_interrupt+0x1e/0x40 + +Avoid this issue by always initializing the ccb n_elem field to 0 in +pm8001_send_abort_all(), pm8001_send_read_log() and +pm80xx_send_abort_all(). + +Link: https://lore.kernel.org/r/20220220031810.738362-17-damien.lemoal@opensource.wdc.com +Fixes: c6b9ef5779c3 ("[SCSI] pm80xx: NCQ error handling changes") +Reviewed-by: Jack Wang +Signed-off-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Acked-by: Lee Duncan +--- + drivers/scsi/pm8001/pm8001_hwi.c | 2 ++ + drivers/scsi/pm8001/pm80xx_hwi.c | 1 + + 2 files changed, 3 insertions(+) + +diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c +index 35eda16a2743..cfeefdf26f5d 100644 +--- a/drivers/scsi/pm8001/pm8001_hwi.c ++++ b/drivers/scsi/pm8001/pm8001_hwi.c +@@ -1787,6 +1787,7 @@ static void pm8001_send_abort_all(struct pm8001_hba_info *pm8001_ha, + ccb->device = pm8001_ha_dev; + ccb->ccb_tag = ccb_tag; + ccb->task = task; ++ ccb->n_elem = 0; + + circularQ = &pm8001_ha->inbnd_q_tbl[0]; + +@@ -1848,6 +1849,7 @@ static void pm8001_send_read_log(struct pm8001_hba_info *pm8001_ha, + ccb->device = pm8001_ha_dev; + ccb->ccb_tag = ccb_tag; + ccb->task = task; ++ ccb->n_elem = 0; + pm8001_ha_dev->id |= NCQ_READ_LOG_FLAG; + pm8001_ha_dev->id |= NCQ_2ND_RLE_FLAG; + +diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c +index ac2178a13e4c..8fd38e54f07c 100644 +--- a/drivers/scsi/pm8001/pm80xx_hwi.c ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c +@@ -1800,6 +1800,7 @@ static void pm80xx_send_abort_all(struct pm8001_hba_info *pm8001_ha, + ccb->device = pm8001_ha_dev; + ccb->ccb_tag = ccb_tag; + ccb->task = task; ++ ccb->n_elem = 0; + + circularQ = &pm8001_ha->inbnd_q_tbl[0]; + + diff --git a/patches.suse/scsi-pm8001-Fix-command-initialization-in-pm8001_chip_ssp_tm_req b/patches.suse/scsi-pm8001-Fix-command-initialization-in-pm8001_chip_ssp_tm_req new file mode 100644 index 0000000..4c79368 --- /dev/null +++ b/patches.suse/scsi-pm8001-Fix-command-initialization-in-pm8001_chip_ssp_tm_req @@ -0,0 +1,38 @@ +From: Damien Le Moal +Date: Sun, 20 Feb 2022 12:17:45 +0900 +Subject: scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() +Git-commit: cd2268a180117aa8ebb23e090ba204324b2d0e93 +Patch-mainline: v5.18-rc1 +References: git-fixes + +The ds_ads_m field of struct ssp_ini_tm_start_req has the type __le32. +Assigning a value to it should thus use cpu_to_le32(). This fixes the +sparse warning: + +warning: incorrect type in assignment (different base types) + expected restricted __le32 [addressable] [assigned] [usertype] ds_ads_m + got int + +[lduncan: hand applied then refreshed.] + +Link: https://lore.kernel.org/r/20220220031810.738362-7-damien.lemoal@opensource.wdc.com +Fixes: dbf9bfe61571 ("[SCSI] pm8001: add SAS/SATA HBA driver") +Reviewed-by: Jack Wang +Signed-off-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Acked-by: Lee Duncan +--- + drivers/scsi/pm8001/pm8001_hwi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/pm8001/pm8001_hwi.c ++++ b/drivers/scsi/pm8001/pm8001_hwi.c +@@ -4721,7 +4721,7 @@ int pm8001_chip_ssp_tm_req(struct pm8001 + memcpy(sspTMCmd.lun, task->ssp_task.LUN, 8); + sspTMCmd.tag = cpu_to_le32(ccb->ccb_tag); + if (pm8001_ha->chip_id != chip_8001) +- sspTMCmd.ds_ads_m = 0x08; ++ sspTMCmd.ds_ads_m = cpu_to_le32(0x08); + circularQ = &pm8001_ha->inbnd_q_tbl[0]; + ret = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sspTMCmd, 0); + return ret; diff --git a/patches.suse/scsi-pm8001-Fix-command-initialization-in-pm80XX_send_read_log b/patches.suse/scsi-pm8001-Fix-command-initialization-in-pm80XX_send_read_log new file mode 100644 index 0000000..b46208f --- /dev/null +++ b/patches.suse/scsi-pm8001-Fix-command-initialization-in-pm80XX_send_read_log @@ -0,0 +1,52 @@ +From: Damien Le Moal +Date: Sun, 20 Feb 2022 12:17:43 +0900 +Subject: scsi: pm8001: Fix command initialization in pm80XX_send_read_log() +Git-commit: 1a37b6738b58d86f6b144b3fc754ace0f2e0166d +Patch-mainline: v5.18-rc1 +References: git-fixes + +Since the sata_cmd struct is zeroed out before its fields are initialized, +there is no need for using "|=" to initialize the ncqtag_atap_dir_m +field. Using a standard assignment removes the sparse warning: + +warning: invalid assignment: |= + +Also, since the ncqtag_atap_dir_m field has type __le32, use cpu_to_le32() +to generate the assigned value. + +[lduncan: hand applied then refreshed.] + +Link: https://lore.kernel.org/r/20220220031810.738362-5-damien.lemoal@opensource.wdc.com +Fixes: c6b9ef5779c3 ("[SCSI] pm80xx: NCQ error handling changes") +Reviewed-by: John Garry +Reviewed-by: Jack Wang +Signed-off-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Acked-by: Lee Duncan +--- + drivers/scsi/pm8001/pm8001_hwi.c | 2 +- + drivers/scsi/pm8001/pm80xx_hwi.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/pm8001/pm8001_hwi.c ++++ b/drivers/scsi/pm8001/pm8001_hwi.c +@@ -1820,7 +1820,7 @@ static void pm8001_send_read_log(struct + + sata_cmd.tag = cpu_to_le32(ccb_tag); + sata_cmd.device_id = cpu_to_le32(pm8001_ha_dev->device_id); +- sata_cmd.ncqtag_atap_dir_m |= ((0x1 << 7) | (0x5 << 9)); ++ sata_cmd.ncqtag_atap_dir_m = cpu_to_le32((0x1 << 7) | (0x5 << 9)); + memcpy(&sata_cmd.sata_fis, &fis, sizeof(struct host_to_dev_fis)); + + res = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sata_cmd, 0); +--- a/drivers/scsi/pm8001/pm80xx_hwi.c ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c +@@ -1506,7 +1506,7 @@ static void pm80xx_send_read_log(struct + + sata_cmd.tag = cpu_to_le32(ccb_tag); + sata_cmd.device_id = cpu_to_le32(pm8001_ha_dev->device_id); +- sata_cmd.ncqtag_atap_dir_m_dad |= ((0x1 << 7) | (0x5 << 9)); ++ sata_cmd.ncqtag_atap_dir_m_dad = cpu_to_le32(((0x1 << 7) | (0x5 << 9))); + memcpy(&sata_cmd.sata_fis, &fis, sizeof(struct host_to_dev_fis)); + + res = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sata_cmd, 0); diff --git a/patches.suse/scsi-pm8001-Fix-le32-values-handling-in-pm80xx_chip_sata_req b/patches.suse/scsi-pm8001-Fix-le32-values-handling-in-pm80xx_chip_sata_req new file mode 100644 index 0000000..438cbef --- /dev/null +++ b/patches.suse/scsi-pm8001-Fix-le32-values-handling-in-pm80xx_chip_sata_req @@ -0,0 +1,203 @@ +From: Damien Le Moal +Date: Sun, 20 Feb 2022 12:17:50 +0900 +Subject: scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req() +Git-commit: fd6d0e376211d7ed759db96b0fbd9a1cee67d462 +Patch-mainline: v5.18-rc1 +References: git-fixes + +Make sure that the __le32 fields of struct sata_cmd are manipulated after +applying the correct endian conversion. That is, use cpu_to_le32() for +assigning values and le32_to_cpu() for consulting a field value. In +particular, make sure that the calculations for the 4G boundary check are +done using CPU endianness and *not* little endian values. With these fixes, +many sparse warnings are removed. + +While at it, fix some code identation and add blank lines after variable +declarations and in some other places to make this code more readable. + +[lduncan: hand applied then refreshed.] + +Link: https://lore.kernel.org/r/20220220031810.738362-12-damien.lemoal@opensource.wdc.com +Fixes: 0ecdf00ba6e5 ("[SCSI] pm80xx: 4G boundary fix.") +Reviewed-by: Jack Wang +Signed-off-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Acked-by: Lee Duncan +--- + drivers/scsi/pm8001/pm80xx_hwi.c | 99 ++++++++++++++++++++------------------- + 1 file changed, 53 insertions(+), 46 deletions(-) + +--- a/drivers/scsi/pm8001/pm80xx_hwi.c ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c +@@ -4155,7 +4155,7 @@ static int pm80xx_chip_sata_req(struct p + u32 q_index; + struct sata_start_req sata_cmd; + u32 hdr_tag, ncg_tag = 0; +- u64 phys_addr, start_addr, end_addr; ++ u64 phys_addr, end_addr; + u32 end_addr_high, end_addr_low; + u32 ATAP = 0x0; + u32 dir; +@@ -4216,27 +4216,33 @@ static int pm80xx_chip_sata_req(struct p + ccb->n_elem, ccb->buf_prd); + phys_addr = ccb->ccb_dma_handle + + offsetof(struct pm8001_ccb_info, buf_prd[0]); +- sata_cmd.enc_addr_low = lower_32_bits(phys_addr); +- sata_cmd.enc_addr_high = upper_32_bits(phys_addr); ++ sata_cmd.enc_addr_low = ++ cpu_to_le32(lower_32_bits(phys_addr)); ++ sata_cmd.enc_addr_high = ++ cpu_to_le32(upper_32_bits(phys_addr)); + sata_cmd.enc_esgl = cpu_to_le32(1 << 31); + } else if (task->num_scatter == 1) { + u64 dma_addr = sg_dma_address(task->scatter); +- sata_cmd.enc_addr_low = lower_32_bits(dma_addr); +- sata_cmd.enc_addr_high = upper_32_bits(dma_addr); ++ ++ sata_cmd.enc_addr_low = ++ cpu_to_le32(lower_32_bits(dma_addr)); ++ sata_cmd.enc_addr_high = ++ cpu_to_le32(upper_32_bits(dma_addr)); + sata_cmd.enc_len = cpu_to_le32(task->total_xfer_len); + sata_cmd.enc_esgl = 0; ++ + /* Check 4G Boundary */ +- start_addr = cpu_to_le64(dma_addr); +- end_addr = (start_addr + sata_cmd.enc_len) - 1; +- end_addr_low = cpu_to_le32(lower_32_bits(end_addr)); +- end_addr_high = cpu_to_le32(upper_32_bits(end_addr)); +- if (end_addr_high != sata_cmd.enc_addr_high) { ++ end_addr = dma_addr + le32_to_cpu(sata_cmd.enc_len) - 1; ++ end_addr_low = lower_32_bits(end_addr); ++ end_addr_high = upper_32_bits(end_addr); ++ if (end_addr_high != le32_to_cpu(sata_cmd.enc_addr_high)) { + PM8001_FAIL_DBG(pm8001_ha, + pm8001_printk("The sg list address " + "start_addr=0x%016llx data_len=0x%x " + "end_addr_high=0x%08x end_addr_low" + "=0x%08x has crossed 4G boundary\n", +- start_addr, sata_cmd.enc_len, ++ dma_addr, ++ le32_to_cpu(sata_cmd.enc_len), + end_addr_high, end_addr_low)); + pm8001_chip_make_sg(task->scatter, 1, + ccb->buf_prd); +@@ -4244,9 +4250,9 @@ static int pm80xx_chip_sata_req(struct p + offsetof(struct pm8001_ccb_info, + buf_prd[0]); + sata_cmd.enc_addr_low = +- lower_32_bits(phys_addr); ++ cpu_to_le32(lower_32_bits(phys_addr)); + sata_cmd.enc_addr_high = +- upper_32_bits(phys_addr); ++ cpu_to_le32(upper_32_bits(phys_addr)); + sata_cmd.enc_esgl = + cpu_to_le32(1 << 31); + } +@@ -4257,7 +4263,8 @@ static int pm80xx_chip_sata_req(struct p + sata_cmd.enc_esgl = 0; + } + /* XTS mode. All other fields are 0 */ +- sata_cmd.key_index_mode = 0x6 << 4; ++ sata_cmd.key_index_mode = cpu_to_le32(0x6 << 4); ++ + /* set tweak values. Should be the start lba */ + sata_cmd.twk_val0 = + cpu_to_le32((sata_cmd.sata_fis.lbal_exp << 24) | +@@ -4284,36 +4291,36 @@ static int pm80xx_chip_sata_req(struct p + offsetof(struct pm8001_ccb_info, buf_prd[0]); + sata_cmd.addr_low = lower_32_bits(phys_addr); + sata_cmd.addr_high = upper_32_bits(phys_addr); +- sata_cmd.esgl = cpu_to_le32(1 << 31); ++ sata_cmd.esgl = cpu_to_le32(1U << 31); + } else if (task->num_scatter == 1) { + u64 dma_addr = sg_dma_address(task->scatter); ++ + sata_cmd.addr_low = lower_32_bits(dma_addr); + sata_cmd.addr_high = upper_32_bits(dma_addr); + sata_cmd.len = cpu_to_le32(task->total_xfer_len); + sata_cmd.esgl = 0; ++ + /* Check 4G Boundary */ +- start_addr = cpu_to_le64(dma_addr); +- end_addr = (start_addr + sata_cmd.len) - 1; +- end_addr_low = cpu_to_le32(lower_32_bits(end_addr)); +- end_addr_high = cpu_to_le32(upper_32_bits(end_addr)); ++ end_addr = dma_addr + le32_to_cpu(sata_cmd.len) - 1; ++ end_addr_low = lower_32_bits(end_addr); ++ end_addr_high = upper_32_bits(end_addr); + if (end_addr_high != sata_cmd.addr_high) { + PM8001_FAIL_DBG(pm8001_ha, + pm8001_printk("The sg list address " + "start_addr=0x%016llx data_len=0x%x" + "end_addr_high=0x%08x end_addr_low=" + "0x%08x has crossed 4G boundary\n", +- start_addr, sata_cmd.len, ++ dma_addr, ++ le32_to_cpu(sata_cmd.len), + end_addr_high, end_addr_low)); + pm8001_chip_make_sg(task->scatter, 1, + ccb->buf_prd); + phys_addr = ccb->ccb_dma_handle + + offsetof(struct pm8001_ccb_info, + buf_prd[0]); +- sata_cmd.addr_low = +- lower_32_bits(phys_addr); +- sata_cmd.addr_high = +- upper_32_bits(phys_addr); +- sata_cmd.esgl = cpu_to_le32(1 << 31); ++ sata_cmd.addr_low = lower_32_bits(phys_addr); ++ sata_cmd.addr_high = upper_32_bits(phys_addr); ++ sata_cmd.esgl = cpu_to_le32(1U << 31); + } + } else if (task->num_scatter == 0) { + sata_cmd.addr_low = 0; +@@ -4321,27 +4328,27 @@ static int pm80xx_chip_sata_req(struct p + sata_cmd.len = cpu_to_le32(task->total_xfer_len); + sata_cmd.esgl = 0; + } +- /* scsi cdb */ +- sata_cmd.atapi_scsi_cdb[0] = +- cpu_to_le32(((task->ata_task.atapi_packet[0]) | +- (task->ata_task.atapi_packet[1] << 8) | +- (task->ata_task.atapi_packet[2] << 16) | +- (task->ata_task.atapi_packet[3] << 24))); +- sata_cmd.atapi_scsi_cdb[1] = +- cpu_to_le32(((task->ata_task.atapi_packet[4]) | +- (task->ata_task.atapi_packet[5] << 8) | +- (task->ata_task.atapi_packet[6] << 16) | +- (task->ata_task.atapi_packet[7] << 24))); +- sata_cmd.atapi_scsi_cdb[2] = +- cpu_to_le32(((task->ata_task.atapi_packet[8]) | +- (task->ata_task.atapi_packet[9] << 8) | +- (task->ata_task.atapi_packet[10] << 16) | +- (task->ata_task.atapi_packet[11] << 24))); +- sata_cmd.atapi_scsi_cdb[3] = +- cpu_to_le32(((task->ata_task.atapi_packet[12]) | +- (task->ata_task.atapi_packet[13] << 8) | +- (task->ata_task.atapi_packet[14] << 16) | +- (task->ata_task.atapi_packet[15] << 24))); ++ /* scsi cdb */ ++ sata_cmd.atapi_scsi_cdb[0] = ++ cpu_to_le32(((task->ata_task.atapi_packet[0]) | ++ (task->ata_task.atapi_packet[1] << 8) | ++ (task->ata_task.atapi_packet[2] << 16) | ++ (task->ata_task.atapi_packet[3] << 24))); ++ sata_cmd.atapi_scsi_cdb[1] = ++ cpu_to_le32(((task->ata_task.atapi_packet[4]) | ++ (task->ata_task.atapi_packet[5] << 8) | ++ (task->ata_task.atapi_packet[6] << 16) | ++ (task->ata_task.atapi_packet[7] << 24))); ++ sata_cmd.atapi_scsi_cdb[2] = ++ cpu_to_le32(((task->ata_task.atapi_packet[8]) | ++ (task->ata_task.atapi_packet[9] << 8) | ++ (task->ata_task.atapi_packet[10] << 16) | ++ (task->ata_task.atapi_packet[11] << 24))); ++ sata_cmd.atapi_scsi_cdb[3] = ++ cpu_to_le32(((task->ata_task.atapi_packet[12]) | ++ (task->ata_task.atapi_packet[13] << 8) | ++ (task->ata_task.atapi_packet[14] << 16) | ++ (task->ata_task.atapi_packet[15] << 24))); + } + + /* Check for read log for failed drive and return */ diff --git a/patches.suse/scsi-pm8001-Fix-le32-values-handling-in-pm80xx_chip_ssp_io_req b/patches.suse/scsi-pm8001-Fix-le32-values-handling-in-pm80xx_chip_ssp_io_req new file mode 100644 index 0000000..a0bdf4b --- /dev/null +++ b/patches.suse/scsi-pm8001-Fix-le32-values-handling-in-pm80xx_chip_ssp_io_req @@ -0,0 +1,144 @@ +From: Damien Le Moal +Date: Sun, 20 Feb 2022 12:17:49 +0900 +Subject: scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req() +Git-commit: 970404cc5744b1033b6ee601be4ef0e2d1fbcf72 +Patch-mainline: v5.18-rc1 +References: git-fixes + +Make sure that the __le32 fields of struct ssp_ini_io_start_req are +manipulated after applying the correct endian conversion. That is, use +cpu_to_le32() for assigning values and le32_to_cpu() for consulting a field +value. In particular, make sure that the calculations for the 4G boundary +check are done using CPU endianness and *not* little endian values. With +these fixes, many sparse warnings are removed. + +While at it, add blank lines after variable declarations and in some other +places to make this code more readable. + +[lduncan: hand applied then refreshed.] + +Link: https://lore.kernel.org/r/20220220031810.738362-11-damien.lemoal@opensource.wdc.com +Fixes: 0ecdf00ba6e5 ("[SCSI] pm80xx: 4G boundary fix.") +Reviewed-by: Jack Wang +Signed-off-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Acked-by: Lee Duncan +--- + drivers/scsi/pm8001/pm80xx_hwi.c | 41 +++++++++++++++++++++++---------------- + 1 file changed, 25 insertions(+), 16 deletions(-) + +--- a/drivers/scsi/pm8001/pm80xx_hwi.c ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c +@@ -3984,13 +3984,15 @@ static int pm80xx_chip_ssp_io_req(struct + struct ssp_ini_io_start_req ssp_cmd; + u32 tag = ccb->ccb_tag; + int ret; +- u64 phys_addr, start_addr, end_addr; ++ u64 phys_addr, end_addr; + u32 end_addr_high, end_addr_low; + struct inbound_queue_table *circularQ; + u32 q_index; + u32 opc = OPC_INB_SSPINIIOSTART; ++ + memset(&ssp_cmd, 0, sizeof(ssp_cmd)); + memcpy(ssp_cmd.ssp_iu.lun, task->ssp_task.LUN, 8); ++ + /* data address domain added for spcv; set to 0 by host, + * used internally by controller + * 0 for SAS 1.1 and SAS 2.0 compatible TLR +@@ -4001,7 +4003,7 @@ static int pm80xx_chip_ssp_io_req(struct + ssp_cmd.device_id = cpu_to_le32(pm8001_dev->device_id); + ssp_cmd.tag = cpu_to_le32(tag); + if (task->ssp_task.enable_first_burst) +- ssp_cmd.ssp_iu.efb_prio_attr |= 0x80; ++ ssp_cmd.ssp_iu.efb_prio_attr = 0x80; + ssp_cmd.ssp_iu.efb_prio_attr |= (task->ssp_task.task_prio << 3); + ssp_cmd.ssp_iu.efb_prio_attr |= (task->ssp_task.task_attr & 7); + memcpy(ssp_cmd.ssp_iu.cdb, task->ssp_task.cmd->cmnd, +@@ -4033,24 +4035,27 @@ static int pm80xx_chip_ssp_io_req(struct + ssp_cmd.enc_esgl = cpu_to_le32(1<<31); + } else if (task->num_scatter == 1) { + u64 dma_addr = sg_dma_address(task->scatter); ++ + ssp_cmd.enc_addr_low = + cpu_to_le32(lower_32_bits(dma_addr)); + ssp_cmd.enc_addr_high = + cpu_to_le32(upper_32_bits(dma_addr)); + ssp_cmd.enc_len = cpu_to_le32(task->total_xfer_len); + ssp_cmd.enc_esgl = 0; ++ + /* Check 4G Boundary */ +- start_addr = cpu_to_le64(dma_addr); +- end_addr = (start_addr + ssp_cmd.enc_len) - 1; +- end_addr_low = cpu_to_le32(lower_32_bits(end_addr)); +- end_addr_high = cpu_to_le32(upper_32_bits(end_addr)); +- if (end_addr_high != ssp_cmd.enc_addr_high) { ++ end_addr = dma_addr + le32_to_cpu(ssp_cmd.enc_len) - 1; ++ end_addr_low = lower_32_bits(end_addr); ++ end_addr_high = upper_32_bits(end_addr); ++ ++ if (end_addr_high != le32_to_cpu(ssp_cmd.enc_addr_high)) { + PM8001_FAIL_DBG(pm8001_ha, + pm8001_printk("The sg list address " + "start_addr=0x%016llx data_len=0x%x " + "end_addr_high=0x%08x end_addr_low=" + "0x%08x has crossed 4G boundary\n", +- start_addr, ssp_cmd.enc_len, ++ dma_addr, ++ le32_to_cpu(ssp_cmd.enc_len), + end_addr_high, end_addr_low)); + pm8001_chip_make_sg(task->scatter, 1, + ccb->buf_prd); +@@ -4061,7 +4066,7 @@ static int pm80xx_chip_ssp_io_req(struct + cpu_to_le32(lower_32_bits(phys_addr)); + ssp_cmd.enc_addr_high = + cpu_to_le32(upper_32_bits(phys_addr)); +- ssp_cmd.enc_esgl = cpu_to_le32(1<<31); ++ ssp_cmd.enc_esgl = cpu_to_le32(1U<<31); + } + } else if (task->num_scatter == 0) { + ssp_cmd.enc_addr_low = 0; +@@ -4069,8 +4074,10 @@ static int pm80xx_chip_ssp_io_req(struct + ssp_cmd.enc_len = cpu_to_le32(task->total_xfer_len); + ssp_cmd.enc_esgl = 0; + } ++ + /* XTS mode. All other fields are 0 */ +- ssp_cmd.key_cmode = 0x6 << 4; ++ ssp_cmd.key_cmode = cpu_to_le32(0x6 << 4); ++ + /* set tweak values. Should be the start lba */ + ssp_cmd.twk_val0 = cpu_to_le32((task->ssp_task.cmd->cmnd[2] << 24) | + (task->ssp_task.cmd->cmnd[3] << 16) | +@@ -4093,23 +4100,25 @@ static int pm80xx_chip_ssp_io_req(struct + ssp_cmd.esgl = cpu_to_le32(1<<31); + } else if (task->num_scatter == 1) { + u64 dma_addr = sg_dma_address(task->scatter); ++ + ssp_cmd.addr_low = cpu_to_le32(lower_32_bits(dma_addr)); + ssp_cmd.addr_high = + cpu_to_le32(upper_32_bits(dma_addr)); + ssp_cmd.len = cpu_to_le32(task->total_xfer_len); + ssp_cmd.esgl = 0; ++ + /* Check 4G Boundary */ +- start_addr = cpu_to_le64(dma_addr); +- end_addr = (start_addr + ssp_cmd.len) - 1; +- end_addr_low = cpu_to_le32(lower_32_bits(end_addr)); +- end_addr_high = cpu_to_le32(upper_32_bits(end_addr)); +- if (end_addr_high != ssp_cmd.addr_high) { ++ end_addr = dma_addr + le32_to_cpu(ssp_cmd.len) - 1; ++ end_addr_low = lower_32_bits(end_addr); ++ end_addr_high = upper_32_bits(end_addr); ++ if (end_addr_high != le32_to_cpu(ssp_cmd.addr_high)) { + PM8001_FAIL_DBG(pm8001_ha, + pm8001_printk("The sg list address " + "start_addr=0x%016llx data_len=0x%x " + "end_addr_high=0x%08x end_addr_low=" + "0x%08x has crossed 4G boundary\n", +- start_addr, ssp_cmd.len, ++ dma_addr, ++ le32_to_cpu(ssp_cmd.len), + end_addr_high, end_addr_low)); + pm8001_chip_make_sg(task->scatter, 1, + ccb->buf_prd); diff --git a/patches.suse/scsi-pm8001-Fix-le32-values-handling-in-pm80xx_set_sas_protocol_timer_config b/patches.suse/scsi-pm8001-Fix-le32-values-handling-in-pm80xx_set_sas_protocol_timer_config new file mode 100644 index 0000000..698468a --- /dev/null +++ b/patches.suse/scsi-pm8001-Fix-le32-values-handling-in-pm80xx_set_sas_protocol_timer_config @@ -0,0 +1,115 @@ +From: Damien Le Moal +Date: Sun, 20 Feb 2022 12:17:47 +0900 +Subject: scsi: pm8001: Fix le32 values handling in + pm80xx_set_sas_protocol_timer_config() +Git-commit: ca374f5d92b8ae778f6a37dd3e7ed809bbf7a953 +Patch-mainline: v5.18-rc1 +References: git-fixes + +All fields of the SASProtocolTimerConfig structure have the __le32 type. +As such, use cpu_to_le32() to initialize them. This change suppresses many +sparse warnings: + +warning: incorrect type in assignment (different base types) + expected restricted __le32 [addressable] [usertype] pageCode + got int + +Note that the check to limit the value of the STP_IDLE_TMO field is removed +as this field is initialized using the fixed (and small) value defined by +the STP_IDLE_TIME macro. + +The pm8001_dbg() calls printing the values of the SASProtocolTimerConfig +structure fileds are changed to use le32_to_cpu() to present the values in +human readable form. + +[lduncan: hand applied then refreshed.] + +Link: https://lore.kernel.org/r/20220220031810.738362-9-damien.lemoal@opensource.wdc.com +Fixes: a6cb3d012b98 ("[SCSI] pm80xx: thermal, sas controller config and error handling update") +Reviewed-by: Jack Wang +Signed-off-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Acked-by: Lee Duncan +--- + drivers/scsi/pm8001/pm80xx_hwi.c | 52 ++++++++++++++++++--------------------- + 1 file changed, 25 insertions(+), 27 deletions(-) + +--- a/drivers/scsi/pm8001/pm80xx_hwi.c ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c +@@ -917,51 +917,49 @@ pm80xx_set_sas_protocol_timer_config(str + circularQ = &pm8001_ha->inbnd_q_tbl[0]; + payload.tag = cpu_to_le32(tag); + +- SASConfigPage.pageCode = SAS_PROTOCOL_TIMER_CONFIG_PAGE; +- SASConfigPage.MST_MSI = 3 << 15; +- SASConfigPage.STP_SSP_MCT_TMO = (STP_MCT_TMO << 16) | SSP_MCT_TMO; +- SASConfigPage.STP_FRM_TMO = (SAS_MAX_OPEN_TIME << 24) | +- (SMP_MAX_CONN_TIMER << 16) | STP_FRM_TIMER; +- SASConfigPage.STP_IDLE_TMO = STP_IDLE_TIME; +- +- if (SASConfigPage.STP_IDLE_TMO > 0x3FFFFFF) +- SASConfigPage.STP_IDLE_TMO = 0x3FFFFFF; +- +- +- SASConfigPage.OPNRJT_RTRY_INTVL = (SAS_MFD << 16) | +- SAS_OPNRJT_RTRY_INTVL; +- SASConfigPage.Data_Cmd_OPNRJT_RTRY_TMO = (SAS_DOPNRJT_RTRY_TMO << 16) +- | SAS_COPNRJT_RTRY_TMO; +- SASConfigPage.Data_Cmd_OPNRJT_RTRY_THR = (SAS_DOPNRJT_RTRY_THR << 16) +- | SAS_COPNRJT_RTRY_THR; +- SASConfigPage.MAX_AIP = SAS_MAX_AIP; ++ SASConfigPage.pageCode = cpu_to_le32(SAS_PROTOCOL_TIMER_CONFIG_PAGE); ++ SASConfigPage.MST_MSI = cpu_to_le32(3 << 15); ++ SASConfigPage.STP_SSP_MCT_TMO = ++ cpu_to_le32((STP_MCT_TMO << 16) | SSP_MCT_TMO); ++ SASConfigPage.STP_FRM_TMO = ++ cpu_to_le32((SAS_MAX_OPEN_TIME << 24) | ++ (SMP_MAX_CONN_TIMER << 16) | STP_FRM_TIMER); ++ SASConfigPage.STP_IDLE_TMO = cpu_to_le32(STP_IDLE_TIME); ++ ++ SASConfigPage.OPNRJT_RTRY_INTVL = ++ cpu_to_le32((SAS_MFD << 16) | SAS_OPNRJT_RTRY_INTVL); ++ SASConfigPage.Data_Cmd_OPNRJT_RTRY_TMO = ++ cpu_to_le32((SAS_DOPNRJT_RTRY_TMO << 16) | SAS_COPNRJT_RTRY_TMO); ++ SASConfigPage.Data_Cmd_OPNRJT_RTRY_THR = ++ cpu_to_le32((SAS_DOPNRJT_RTRY_THR << 16) | SAS_COPNRJT_RTRY_THR); ++ SASConfigPage.MAX_AIP = cpu_to_le32(SAS_MAX_AIP); + + PM8001_INIT_DBG(pm8001_ha, + pm8001_printk("SASConfigPage.pageCode " +- "0x%08x\n", SASConfigPage.pageCode)); ++ "0x%08x\n", le32_to_cpu(SASConfigPage.pageCode))); + PM8001_INIT_DBG(pm8001_ha, + pm8001_printk("SASConfigPage.MST_MSI " +- " 0x%08x\n", SASConfigPage.MST_MSI)); ++ " 0x%08x\n", le32_to_cpu(SASConfigPage.MST_MSI))); + PM8001_INIT_DBG(pm8001_ha, + pm8001_printk("SASConfigPage.STP_SSP_MCT_TMO " +- " 0x%08x\n", SASConfigPage.STP_SSP_MCT_TMO)); ++ " 0x%08x\n", le32_to_cpu(SASConfigPage.STP_SSP_MCT_TMO))); + PM8001_INIT_DBG(pm8001_ha, + pm8001_printk("SASConfigPage.STP_FRM_TMO " +- " 0x%08x\n", SASConfigPage.STP_FRM_TMO)); ++ " 0x%08x\n", le32_to_cpu(SASConfigPage.STP_FRM_TMO))); + PM8001_INIT_DBG(pm8001_ha, + pm8001_printk("SASConfigPage.STP_IDLE_TMO " +- " 0x%08x\n", SASConfigPage.STP_IDLE_TMO)); ++ " 0x%08x\n", le32_to_cpu(SASConfigPage.STP_IDLE_TMO))); + PM8001_INIT_DBG(pm8001_ha, + pm8001_printk("SASConfigPage.OPNRJT_RTRY_INTVL " +- " 0x%08x\n", SASConfigPage.OPNRJT_RTRY_INTVL)); ++ " 0x%08x\n", le32_to_cpu(SASConfigPage.OPNRJT_RTRY_INTVL))); + PM8001_INIT_DBG(pm8001_ha, + pm8001_printk("SASConfigPage.Data_Cmd_OPNRJT_RTRY_TMO " +- " 0x%08x\n", SASConfigPage.Data_Cmd_OPNRJT_RTRY_TMO)); ++ " 0x%08x\n", le32_to_cpu(SASConfigPage.Data_Cmd_OPNRJT_RTRY_TMO))); + PM8001_INIT_DBG(pm8001_ha, + pm8001_printk("SASConfigPage.Data_Cmd_OPNRJT_RTRY_THR " +- " 0x%08x\n", SASConfigPage.Data_Cmd_OPNRJT_RTRY_THR)); ++ " 0x%08x\n", le32_to_cpu(SASConfigPage.Data_Cmd_OPNRJT_RTRY_THR))); + PM8001_INIT_DBG(pm8001_ha, pm8001_printk("SASConfigPage.MAX_AIP " +- " 0x%08x\n", SASConfigPage.MAX_AIP)); ++ " 0x%08x\n", le32_to_cpu(SASConfigPage.MAX_AIP))); + + memcpy(&payload.cfg_pg, &SASConfigPage, + sizeof(SASProtocolTimerConfig_t)); diff --git a/patches.suse/scsi-pm8001-Fix-payload-initialization-in-pm80xx_encrypt_update b/patches.suse/scsi-pm8001-Fix-payload-initialization-in-pm80xx_encrypt_update new file mode 100644 index 0000000..cd563c8 --- /dev/null +++ b/patches.suse/scsi-pm8001-Fix-payload-initialization-in-pm80xx_encrypt_update @@ -0,0 +1,41 @@ +From: Damien Le Moal +Date: Sun, 20 Feb 2022 12:17:48 +0900 +Subject: scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update() +Git-commit: f8b12dfb476dad38ce755aaf5e2df46f06f1822e +Patch-mainline: v5.18-rc1 +References: git-fixes + +All fields of the kek_mgmt_req structure have the type __le32. So make sure +to use cpu_to_le32() to initialize them. This suppresses the sparse +warning: + +warning: incorrect type in assignment (different base types) + expected restricted __le32 [addressable] [assigned] [usertype] new_curidx_ksop + got int + +[lduncan: hand applied then refreshed.] + +Link: https://lore.kernel.org/r/20220220031810.738362-10-damien.lemoal@opensource.wdc.com +Fixes: f5860992db55 ("[SCSI] pm80xx: Added SPCv/ve specific hardware functionalities and relevant changes in common files") +Reviewed-by: Jack Wang +Signed-off-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Acked-by: Lee Duncan +--- + drivers/scsi/pm8001/pm80xx_hwi.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/pm8001/pm80xx_hwi.c ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c +@@ -1084,8 +1084,9 @@ static int pm80xx_encrypt_update(struct + /* Currently only one key is used. New KEK index is 1. + * Current KEK index is 1. Store KEK to NVRAM is 1. + */ +- payload.new_curidx_ksop = ((1 << 24) | (1 << 16) | (1 << 8) | +- KEK_MGMT_SUBOP_KEYCARDUPDATE); ++ payload.new_curidx_ksop = ++ cpu_to_le32(((1 << 24) | (1 << 16) | (1 << 8) | ++ KEK_MGMT_SUBOP_KEYCARDUPDATE)); + + rc = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &payload, 0); + if (rc) diff --git a/patches.suse/scsi-pm8001-Fix-payload-initialization-in-pm80xx_set_thermal_config b/patches.suse/scsi-pm8001-Fix-payload-initialization-in-pm80xx_set_thermal_config new file mode 100644 index 0000000..b924da0 --- /dev/null +++ b/patches.suse/scsi-pm8001-Fix-payload-initialization-in-pm80xx_set_thermal_config @@ -0,0 +1,46 @@ +From: Damien Le Moal +Date: Sun, 20 Feb 2022 12:17:46 +0900 +Subject: scsi: pm8001: Fix payload initialization in + pm80xx_set_thermal_config() +Git-commit: bb225b12dbcc82d53d637d10b8d70b64494f8c16 +Patch-mainline: v5.18-rc1 +References: git-fixes + +The fields of the set_ctrl_cfg_req structure have the __le32 type, so use +cpu_to_le32() to assign them. This removes the sparse warnings: + +warning: incorrect type in assignment (different base types) + expected restricted __le32 + got unsigned int + +[lduncan: hand applied then refreshed.] + +Link: https://lore.kernel.org/r/20220220031810.738362-8-damien.lemoal@opensource.wdc.com +Fixes: 842784e0d15b ("pm80xx: Update For Thermal Page Code") +Fixes: f5860992db55 ("[SCSI] pm80xx: Added SPCv/ve specific hardware functionalities and relevant changes in common files") +Reviewed-by: John Garry +Reviewed-by: Jack Wang +Signed-off-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Acked-by: Lee Duncan +--- + drivers/scsi/pm8001/pm80xx_hwi.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/scsi/pm8001/pm80xx_hwi.c ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c +@@ -878,9 +878,11 @@ pm80xx_set_thermal_config(struct pm8001_ + else + page_code = THERMAL_PAGE_CODE_8H; + +- payload.cfg_pg[0] = (THERMAL_LOG_ENABLE << 9) | +- (THERMAL_ENABLE << 8) | page_code; +- payload.cfg_pg[1] = (LTEMPHIL << 24) | (RTEMPHIL << 8); ++ payload.cfg_pg[0] = ++ cpu_to_le32((THERMAL_LOG_ENABLE << 9) | ++ (THERMAL_ENABLE << 8) | page_code); ++ payload.cfg_pg[1] = ++ cpu_to_le32((LTEMPHIL << 24) | (RTEMPHIL << 8)); + + rc = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &payload, 0); + if (rc) diff --git a/patches.suse/scsi-qla2xxx-Fix-missed-DMA-unmap-for-aborted-comman.patch b/patches.suse/scsi-qla2xxx-Fix-missed-DMA-unmap-for-aborted-comman.patch new file mode 100644 index 0000000..06d3cba --- /dev/null +++ b/patches.suse/scsi-qla2xxx-Fix-missed-DMA-unmap-for-aborted-comman.patch @@ -0,0 +1,44 @@ +From: Gleb Chesnokov +Date: Fri, 15 Apr 2022 12:42:29 +0000 +Subject: scsi: qla2xxx: Fix missed DMA unmap for aborted commands +Patch-mainline: v5.18-rc7 +Git-commit: 26f9ce53817a8fd84b69a73473a7de852a24c897 +References: bsc#1200045 + +Aborting commands that have already been sent to the firmware can +cause BUG in qlt_free_cmd(): BUG_ON(cmd->sg_mapped) + +For instance: + + - Command passes rdx_to_xfer state, maps sgl, sends to the firmware + + - Reset occurs, qla2xxx performs ISP error recovery, aborts the command + + - Target stack calls qlt_abort_cmd() and then qlt_free_cmd() + + - BUG_ON(cmd->sg_mapped) in qlt_free_cmd() occurs because sgl was not + unmapped + +Thus, unmap sgl in qlt_abort_cmd() for commands with the aborted flag set. + +Link: https://lore.kernel.org/r/AS8PR10MB4952D545F84B6B1DFD39EC1E9DEE9@AS8PR10MB4952.EURPRD10.PROD.OUTLOOK.COM +Reviewed-by: Himanshu Madhani +Signed-off-by: Gleb Chesnokov +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/qla2xxx/qla_target.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -3837,6 +3837,9 @@ int qlt_abort_cmd(struct qla_tgt_cmd *cm + + spin_lock_irqsave(&cmd->cmd_lock, flags); + if (cmd->aborted) { ++ if (cmd->sg_mapped) ++ qlt_unmap_sg(vha, cmd); ++ + spin_unlock_irqrestore(&cmd->cmd_lock, flags); + /* + * It's normal to see 2 calls in this path: diff --git a/patches.suse/scsi-qla2xxx-Remove-free_sg-command-flag.patch b/patches.suse/scsi-qla2xxx-Remove-free_sg-command-flag.patch new file mode 100644 index 0000000..97c2c6e --- /dev/null +++ b/patches.suse/scsi-qla2xxx-Remove-free_sg-command-flag.patch @@ -0,0 +1,41 @@ +From: Gleb Chesnokov +Date: Fri, 15 Apr 2022 12:42:24 +0000 +Subject: scsi: qla2xxx: Remove free_sg command flag +Patch-mainline: v5.19-rc1 +Git-commit: ad14649fc5ab216e0abb6b38115898238a0991f5 +References: bsc#1200045 + +The use of the free_sg command flag was dropped in commit 2c39b5ca2a8c +("qla2xxx: Remove SRR code"). Hence remove this flag and its check. + +Link: https://lore.kernel.org/r/AS8PR10MB4952747D20B76DC8FE793CCA9DEE9@AS8PR10MB4952.EURPRD10.PROD.OUTLOOK.COM +Reviewed-by: Himanshu Madhani +Signed-off-by: Gleb Chesnokov +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/qla2xxx/qla_target.c | 2 -- + drivers/scsi/qla2xxx/qla_target.h | 1 - + 2 files changed, 3 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -3877,8 +3877,6 @@ void qlt_free_cmd(struct qla_tgt_cmd *cm + + BUG_ON(cmd->sg_mapped); + cmd->jiffies_at_free = get_jiffies_64(); +- if (unlikely(cmd->free_sg)) +- kfree(cmd->sg); + + if (!sess || !sess->se_sess) { + WARN_ON(1); +--- a/drivers/scsi/qla2xxx/qla_target.h ++++ b/drivers/scsi/qla2xxx/qla_target.h +@@ -892,7 +892,6 @@ struct qla_tgt_cmd { + /* to save extra sess dereferences */ + unsigned int conf_compl_supported:1; + unsigned int sg_mapped:1; +- unsigned int free_sg:1; + unsigned int write_data_transferred:1; + unsigned int q_full:1; + unsigned int term_exchg:1; diff --git a/patches.suse/scsi-qla2xxx-Remove-unneeded-flush_workqueue.patch b/patches.suse/scsi-qla2xxx-Remove-unneeded-flush_workqueue.patch new file mode 100644 index 0000000..ba97eb3 --- /dev/null +++ b/patches.suse/scsi-qla2xxx-Remove-unneeded-flush_workqueue.patch @@ -0,0 +1,29 @@ +From: ran jianping +Date: Sun, 24 Apr 2022 06:24:13 +0000 +Subject: scsi: qla2xxx: Remove unneeded flush_workqueue() +Patch-mainline: v5.19-rc1 +Git-commit: cf97628fe1a1f25f3a5617fa10619d7bef904da1 +References: bsc#1200045 + +All work currently pending will be done first by calling +destroy_workqueue(). There is no need to flush it explicitly. + +Link: https://lore.kernel.org/r/20220424062413.3220315-1-ran.jianping@zte.com.cn +Reported-by: Zeal Robot +Signed-off-by: ran jianping +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/qla2xxx/qla_os.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -3972,7 +3972,6 @@ qla2x00_free_device(scsi_qla_host_t *vha + + /* Flush the work queue and remove it */ + if (ha->wq) { +- flush_workqueue(ha->wq); + destroy_workqueue(ha->wq); + ha->wq = NULL; + } diff --git a/patches.suse/scsi-qla2xxx-edif-Remove-unneeded-variable.patch b/patches.suse/scsi-qla2xxx-edif-Remove-unneeded-variable.patch new file mode 100644 index 0000000..ab2e8e8 --- /dev/null +++ b/patches.suse/scsi-qla2xxx-edif-Remove-unneeded-variable.patch @@ -0,0 +1,40 @@ +From: Guo Zhengkui +Date: Tue, 26 Apr 2022 15:43:34 +0800 +Subject: scsi: qla2xxx: edif: Remove unneeded variable +Patch-mainline: v5.19-rc1 +Git-commit: 1497e95e22c3be382217da290106ab4f865dc1fa +References: bsc#1200045 + +Fix the following coccicheck warning: + +drivers/scsi/qla2xxx/qla_edif.c:660:11-15: Unneeded variable: "rval". + +Return "0" on line 761. + +Link: https://lore.kernel.org/r/20220426074334.9281-1-guozhengkui@vivo.com +Signed-off-by: Guo Zhengkui +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/qla2xxx/qla_edif.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_edif.c ++++ b/drivers/scsi/qla2xxx/qla_edif.c +@@ -657,7 +657,6 @@ qla_edif_app_chk_sa_update(scsi_qla_host + static int + qla_edif_app_authok(scsi_qla_host_t *vha, struct bsg_job *bsg_job) + { +- int32_t rval = 0; + struct auth_complete_cmd appplogiok; + struct app_plogi_reply appplogireply = {0}; + struct fc_bsg_reply *bsg_reply = bsg_job->reply; +@@ -758,7 +757,7 @@ qla_edif_app_authok(scsi_qla_host_t *vha + &appplogireply, + sizeof(struct app_plogi_reply)); + +- return rval; ++ return 0; + } + + /** diff --git a/patches.suse/scsi-scsi_dh_alua-Avoid-crash-during-alua_bus_detach.patch b/patches.suse/scsi-scsi_dh_alua-Avoid-crash-during-alua_bus_detach.patch new file mode 100644 index 0000000..b5db661 --- /dev/null +++ b/patches.suse/scsi-scsi_dh_alua-Avoid-crash-during-alua_bus_detach.patch @@ -0,0 +1,72 @@ +From 5faf50e9e9fdc2117c61ff7e20da49cd6a29e0ca Mon Sep 17 00:00:00 2001 +From: Hannes Reinecke +Date: Thu, 24 Sep 2020 12:45:59 +0200 +Subject: [PATCH] scsi: scsi_dh_alua: Avoid crash during alua_bus_detach() +References: bsc#1028340 bsc#1198825 +Git-commit: 5faf50e9e9fdc2117c61ff7e20da49cd6a29e0ca +Patch-mainline: v5.10-rc3 + +alua_bus_detach() might be running concurrently with alua_rtpg_work(), so +we might trip over h->sdev == NULL and call BUG_ON(). The correct way of +handling it is to not set h->sdev to NULL in alua_bus_detach(), and call +rcu_synchronize() before the final delete to ensure that all concurrent +threads have left the critical section. Then we can get rid of the +BUG_ON() and replace it with a simple if condition. + +Link: https://lore.kernel.org/r/1600167537-12509-1-git-send-email-jitendra.khasdev@oracle.com +Link: https://lore.kernel.org/r/20200924104559.26753-1-hare@suse.de +Cc: Brian Bunker +Acked-by: Brian Bunker +Tested-by: Jitendra Khasdev +Reviewed-by: Jitendra Khasdev +Signed-off-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Thomas Abraham +--- + drivers/scsi/device_handler/scsi_dh_alua.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c +index f32da0ca529e..308bda2e9c00 100644 +--- a/drivers/scsi/device_handler/scsi_dh_alua.c ++++ b/drivers/scsi/device_handler/scsi_dh_alua.c +@@ -658,8 +658,8 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg) + rcu_read_lock(); + list_for_each_entry_rcu(h, + &tmp_pg->dh_list, node) { +- /* h->sdev should always be valid */ +- BUG_ON(!h->sdev); ++ if (!h->sdev) ++ continue; + h->sdev->access_state = desc[0]; + } + rcu_read_unlock(); +@@ -705,7 +705,8 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg) + pg->expiry = 0; + rcu_read_lock(); + list_for_each_entry_rcu(h, &pg->dh_list, node) { +- BUG_ON(!h->sdev); ++ if (!h->sdev) ++ continue; + h->sdev->access_state = + (pg->state & SCSI_ACCESS_STATE_MASK); + if (pg->pref) +@@ -1147,7 +1148,6 @@ static void alua_bus_detach(struct scsi_device *sdev) + spin_lock(&h->pg_lock); + pg = rcu_dereference_protected(h->pg, lockdep_is_held(&h->pg_lock)); + rcu_assign_pointer(h->pg, NULL); +- h->sdev = NULL; + spin_unlock(&h->pg_lock); + if (pg) { + spin_lock_irq(&pg->lock); +@@ -1156,6 +1156,7 @@ static void alua_bus_detach(struct scsi_device *sdev) + kref_put(&pg->kref, release_port_group); + } + sdev->handler_data = NULL; ++ synchronize_rcu(); + kfree(h); + } + +-- +2.34.1 + diff --git a/patches.suse/scsi-sr-Do-not-leak-information-in-ioctl b/patches.suse/scsi-sr-Do-not-leak-information-in-ioctl new file mode 100644 index 0000000..e2cc0e6 --- /dev/null +++ b/patches.suse/scsi-sr-Do-not-leak-information-in-ioctl @@ -0,0 +1,115 @@ +From: Tom Rix +Date: Mon, 11 Apr 2022 13:47:56 -0400 +Subject: scsi: sr: Do not leak information in ioctl +Git-commit: faad6cebded8e0fd902b672f220449b93db479eb +Patch-mainline: v5.18-rc4 +References: git-fixes + +sr_ioctl.c uses this pattern: + + result = sr_do_ioctl(cd, &cgc); + to-user = buffer[]; + kfree(buffer); + return result; + +Use of a buffer without checking leaks information. Check result and jump +over the use of buffer if there is an error. + + result = sr_do_ioctl(cd, &cgc); + if (result) + goto err; + to-user = buffer[]; +err: + kfree(buffer); + return result; + +Additionally, initialize the buffer to zero. + +This problem can be seen in the 2.4.0 kernel. + +[lduncan: hand applied then refreshed.] + +Link: https://lore.kernel.org/r/20220411174756.2418435-1-trix@redhat.com +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reviewed-by: Christoph Hellwig +Signed-off-by: Tom Rix +Signed-off-by: Martin K. Petersen +Acked-by: Lee Duncan +--- + drivers/scsi/sr_ioctl.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +--- a/drivers/scsi/sr_ioctl.c ++++ b/drivers/scsi/sr_ioctl.c +@@ -44,7 +44,7 @@ static int sr_read_tochdr(struct cdrom_d + int result; + unsigned char *buffer; + +- buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); ++ buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + if (!buffer) + return -ENOMEM; + +@@ -58,10 +58,13 @@ static int sr_read_tochdr(struct cdrom_d + cgc.data_direction = DMA_FROM_DEVICE; + + result = sr_do_ioctl(cd, &cgc); ++ if (result) ++ goto err; + + tochdr->cdth_trk0 = buffer[2]; + tochdr->cdth_trk1 = buffer[3]; + ++err: + kfree(buffer); + return result; + } +@@ -74,7 +77,7 @@ static int sr_read_tocentry(struct cdrom + int result; + unsigned char *buffer; + +- buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); ++ buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + if (!buffer) + return -ENOMEM; + +@@ -89,6 +92,8 @@ static int sr_read_tocentry(struct cdrom + cgc.data_direction = DMA_FROM_DEVICE; + + result = sr_do_ioctl(cd, &cgc); ++ if (result) ++ goto err; + + tocentry->cdte_ctrl = buffer[5] & 0xf; + tocentry->cdte_adr = buffer[5] >> 4; +@@ -101,6 +106,7 @@ static int sr_read_tocentry(struct cdrom + tocentry->cdte_addr.lba = (((((buffer[8] << 8) + buffer[9]) << 8) + + buffer[10]) << 8) + buffer[11]; + ++err: + kfree(buffer); + return result; + } +@@ -383,7 +389,7 @@ int sr_get_mcn(struct cdrom_device_info + { + Scsi_CD *cd = cdi->handle; + struct packet_command cgc; +- char *buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); ++ char *buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + int result; + + if (!buffer) +@@ -399,10 +405,13 @@ int sr_get_mcn(struct cdrom_device_info + cgc.data_direction = DMA_FROM_DEVICE; + cgc.timeout = IOCTL_TIMEOUT; + result = sr_do_ioctl(cd, &cgc); ++ if (result) ++ goto err; + + memcpy(mcn->medium_catalog_number, buffer + 9, 13); + mcn->medium_catalog_number[13] = 0; + ++err: + kfree(buffer); + return result; + } diff --git a/patches.suse/scsi-virtio-scsi-Eliminate-anonymous-module_init-module_exit b/patches.suse/scsi-virtio-scsi-Eliminate-anonymous-module_init-module_exit new file mode 100644 index 0000000..5efe9db --- /dev/null +++ b/patches.suse/scsi-virtio-scsi-Eliminate-anonymous-module_init-module_exit @@ -0,0 +1,80 @@ +From: Randy Dunlap +Date: Wed, 16 Mar 2022 12:20:06 -0700 +Subject: scsi: virtio-scsi: Eliminate anonymous module_init & module_exit +Git-commit: 41b8c2a31472a97349fe54c3a6b3176d9cdc31be +Patch-mainline: v5.18-rc2 +References: git-fixes + +Eliminate anonymous module_init() and module_exit(), which can lead to +confusion or ambiguity when reading System.map, crashes/oops/bugs, or an +initcall_debug log. + +Give each of these init and exit functions unique driver-specific names to +eliminate the anonymous names. + +Example 1: (System.map) + ffffffff832fc78c t init + ffffffff832fc79e t init + ffffffff832fc8f8 t init + +Example 2: (initcall_debug log) + calling init+0x0/0x12 @ 1 + initcall init+0x0/0x12 returned 0 after 15 usecs + calling init+0x0/0x60 @ 1 + initcall init+0x0/0x60 returned 0 after 2 usecs + calling init+0x0/0x9a @ 1 + initcall init+0x0/0x9a returned 0 after 74 usecs + +Link: https://lore.kernel.org/r/20220316192010.19001-6-rdunlap@infradead.org +Fixes: 4fe74b1cb051 ("[SCSI] virtio-scsi: SCSI driver for QEMU based virtual machines") +Cc: "Michael S. Tsirkin" +Cc: Jason Wang +Cc: Paolo Bonzini +Cc: Stefan Hajnoczi +Cc: "James E.J. Bottomley" +Cc: "Martin K. Petersen" +Cc: linux-scsi@vger.kernel.org +Cc: virtualization@lists.linux-foundation.org +Reviewed-by: Stefan Hajnoczi +Reviewed-by: Ira Weiny +Acked-by: Jason Wang +Acked-by: Michael S. Tsirkin +Signed-off-by: Randy Dunlap +Signed-off-by: Martin K. Petersen +Acked-by: Lee Duncan +--- + drivers/scsi/virtio_scsi.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c +index 0e6110da69e7..578c4b6d0f7d 100644 +--- a/drivers/scsi/virtio_scsi.c ++++ b/drivers/scsi/virtio_scsi.c +@@ -988,7 +988,7 @@ static struct virtio_driver virtio_scsi_driver = { + .remove = virtscsi_remove, + }; + +-static int __init init(void) ++static int __init virtio_scsi_init(void) + { + int ret = -ENOMEM; + +@@ -1020,14 +1020,14 @@ static int __init init(void) + return ret; + } + +-static void __exit fini(void) ++static void __exit virtio_scsi_fini(void) + { + unregister_virtio_driver(&virtio_scsi_driver); + mempool_destroy(virtscsi_cmd_pool); + kmem_cache_destroy(virtscsi_cmd_cache); + } +-module_init(init); +-module_exit(fini); ++module_init(virtio_scsi_init); ++module_exit(virtio_scsi_fini); + + MODULE_DEVICE_TABLE(virtio, id_table); + MODULE_DESCRIPTION("Virtio SCSI HBA driver"); + diff --git a/patches.suse/scsi-zorro7xx-Fix-a-resource-leak-in-zorro7xx_remove_one b/patches.suse/scsi-zorro7xx-Fix-a-resource-leak-in-zorro7xx_remove_one new file mode 100644 index 0000000..f7b5b34 --- /dev/null +++ b/patches.suse/scsi-zorro7xx-Fix-a-resource-leak-in-zorro7xx_remove_one @@ -0,0 +1,36 @@ +From: Christophe JAILLET +Date: Sat, 19 Mar 2022 08:01:24 +0100 +Subject: scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one() +Git-commit: 16ed828b872d12ccba8f07bcc446ae89ba662f9c +Patch-mainline: v5.18-rc2 +References: git-fixes + +The error handling path of the probe releases a resource that is not freed +in the remove function. In some cases, a ioremap() must be undone. + +Add the missing iounmap() call in the remove function. + +Link: https://lore.kernel.org/r/247066a3104d25f9a05de8b3270fc3c848763bcc.1647673264.git.christophe.jaillet@wanadoo.fr +Fixes: 45804fbb00ee ("[SCSI] 53c700: Amiga Zorro NCR53c710 SCSI") +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Christophe JAILLET +Signed-off-by: Martin K. Petersen +Acked-by: Lee Duncan +--- + drivers/scsi/zorro7xx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/zorro7xx.c b/drivers/scsi/zorro7xx.c +index 27b9e2baab1a..7acf9193a9e8 100644 +--- a/drivers/scsi/zorro7xx.c ++++ b/drivers/scsi/zorro7xx.c +@@ -159,6 +159,8 @@ static void zorro7xx_remove_one(struct zorro_dev *z) + scsi_remove_host(host); + + NCR_700_release(host); ++ if (host->base > 0x01000000) ++ iounmap(hostdata->base); + kfree(hostdata); + free_irq(host->irq, host); + zorro_release_device(z); + diff --git a/patches.suse/smp-Fix-offline-cpu-check-in-flush_smp_call_function.patch b/patches.suse/smp-Fix-offline-cpu-check-in-flush_smp_call_function.patch new file mode 100644 index 0000000..b8789a8 --- /dev/null +++ b/patches.suse/smp-Fix-offline-cpu-check-in-flush_smp_call_function.patch @@ -0,0 +1,45 @@ +Patch-mainline: v5.18-rc3 +Git-commit: 9e949a3886356fe9112c6f6f34a6e23d1d35407f +References: git-fixes +From: Nadav Amit +Date: Sat, 19 Mar 2022 00:20:15 -0700 +Subject: [PATCH] smp: Fix offline cpu check in flush_smp_call_function_queue() + +The check in flush_smp_call_function_queue() for callbacks that are sent +to offline CPUs currently checks whether the queue is empty. + +However, flush_smp_call_function_queue() has just deleted all the +callbacks from the queue and moved all the entries into a local list. +This checks would only be positive if some callbacks were added in the +short time after llist_del_all() was called. This does not seem to be +the intention of this check. + +Change the check to look at the local list to which the entries were +moved instead of the queue from which all the callbacks were just +removed. + +Fixes: 8d056c48e4862 ("CPU hotplug, smp: flush any pending IPI callbacks before CPU offline") +Signed-off-by: Nadav Amit +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20220319072015.1495036-1-namit@vmware.com +Signed-off-by: Juergen Gross +--- + kernel/smp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/smp.c b/kernel/smp.c +index 01a7c1706a58..65a630f62363 100644 +--- a/kernel/smp.c ++++ b/kernel/smp.c +@@ -579,7 +579,7 @@ static void flush_smp_call_function_queue(bool warn_cpu_offline) + + /* There shouldn't be any pending callbacks on an offline CPU. */ + if (unlikely(warn_cpu_offline && !cpu_online(smp_processor_id()) && +- !warned && !llist_empty(head))) { ++ !warned && entry != NULL)) { + warned = true; + WARN(1, "IPI on offline CPU %d\n", smp_processor_id()); + +-- +2.35.3 + diff --git a/patches.suse/timekeeping-Really-make-sure-wall_to_monotonic-isn-t.patch b/patches.suse/timekeeping-Really-make-sure-wall_to_monotonic-isn-t.patch new file mode 100644 index 0000000..bbb2518 --- /dev/null +++ b/patches.suse/timekeeping-Really-make-sure-wall_to_monotonic-isn-t.patch @@ -0,0 +1,70 @@ +From 4e8c11b6b3f0b6a283e898344f154641eda94266 Mon Sep 17 00:00:00 2001 +From: Yu Liao +Date: Mon, 13 Dec 2021 21:57:27 +0800 +Subject: [PATCH] timekeeping: Really make sure wall_to_monotonic isn't + positive +Git-commit: 4e8c11b6b3f0b6a283e898344f154641eda94266 +Patch-mainline: v5.16-rc6 +References: git-fixes + +Even after commit e1d7ba873555 ("time: Always make sure wall_to_monotonic +isn't positive") it is still possible to make wall_to_monotonic positive +by running the following code: + + int main(void) + { + struct timespec time; + + clock_gettime(CLOCK_MONOTONIC, &time); + time.tv_nsec = 0; + clock_settime(CLOCK_REALTIME, &time); + return 0; + } + +The reason is that the second parameter of timespec64_compare(), ts_delta, +may be unnormalized because the delta is calculated with an open coded +substraction which causes the comparison of tv_sec to yield the wrong +Result: + + wall_to_monotonic = { .tv_sec = -10, .tv_nsec = 900000000 } + ts_delta = { .tv_sec = -9, .tv_nsec = -900000000 } + +That makes timespec64_compare() claim that wall_to_monotonic < ts_delta, +but actually the result should be wall_to_monotonic > ts_delta. + +After normalization, the result of timespec64_compare() is correct because +the tv_sec comparison is not longer misleading: + + wall_to_monotonic = { .tv_sec = -10, .tv_nsec = 900000000 } + ts_delta = { .tv_sec = -10, .tv_nsec = 100000000 } + +Use timespec64_sub() to ensure that ts_delta is normalized, which fixes the +issue. + +Fixes: e1d7ba873555 ("time: Always make sure wall_to_monotonic isn't positive") +Signed-off-by: Yu Liao +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20211213135727.1656662-1-liaoyu15@huawei.com +Signed-off-by: Frederic Weisbecker +--- + kernel/time/timekeeping.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c +index b348749a9fc6..dcdcb85121e4 100644 +--- a/kernel/time/timekeeping.c ++++ b/kernel/time/timekeeping.c +@@ -1306,8 +1306,7 @@ int do_settimeofday64(const struct timespec64 *ts) + timekeeping_forward_now(tk); + + xt = tk_xtime(tk); +- ts_delta.tv_sec = ts->tv_sec - xt.tv_sec; +- ts_delta.tv_nsec = ts->tv_nsec - xt.tv_nsec; ++ ts_delta = timespec64_sub(*ts, xt); + + if (timespec64_compare(&tk->wall_to_monotonic, &ts_delta) > 0) { + ret = -EINVAL; +-- +2.25.1 + diff --git a/patches.suse/tpm-ibmvtpm-Correct-the-return-value-in-tpm_ibmvtpm_.patch b/patches.suse/tpm-ibmvtpm-Correct-the-return-value-in-tpm_ibmvtpm_.patch new file mode 100644 index 0000000..5d13a10 --- /dev/null +++ b/patches.suse/tpm-ibmvtpm-Correct-the-return-value-in-tpm_ibmvtpm_.patch @@ -0,0 +1,37 @@ +From d0dc1a7100f19121f6e7450f9cdda11926aa3838 Mon Sep 17 00:00:00 2001 +From: Xiu Jianfeng +Date: Fri, 18 Mar 2022 14:02:01 +0800 +Subject: [PATCH] tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe() + +References: bsc#1065729 +Patch-mainline: v5.19-rc1 +Git-commit: d0dc1a7100f19121f6e7450f9cdda11926aa3838 + +Currently it returns zero when CRQ response timed out, it should return +an error code instead. + +Fixes: d8d74ea3c002 ("tpm: ibmvtpm: Wait for buffer to be set before proceeding") +Signed-off-by: Xiu Jianfeng +Reviewed-by: Stefan Berger +Acked-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Acked-by: Michal Suchanek +--- + drivers/char/tpm/tpm_ibmvtpm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c +index 3af4c07a9342..d3989b257f42 100644 +--- a/drivers/char/tpm/tpm_ibmvtpm.c ++++ b/drivers/char/tpm/tpm_ibmvtpm.c +@@ -681,6 +681,7 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev, + if (!wait_event_timeout(ibmvtpm->crq_queue.wq, + ibmvtpm->rtce_buf != NULL, + HZ)) { ++ rc = -ENODEV; + dev_err(dev, "CRQ response timed out\n"); + goto init_irq_cleanup; + } +-- +2.35.3 + diff --git a/patches.suse/usb-cdc-wdm-fix-reading-stuck-on-device-close.patch b/patches.suse/usb-cdc-wdm-fix-reading-stuck-on-device-close.patch new file mode 100644 index 0000000..b854c27 --- /dev/null +++ b/patches.suse/usb-cdc-wdm-fix-reading-stuck-on-device-close.patch @@ -0,0 +1,56 @@ +From 01e01f5c89773c600a9f0b32c888de0146066c3a Mon Sep 17 00:00:00 2001 +From: Sergey Ryazanov +Date: Sun, 1 May 2022 20:58:28 +0300 +Subject: [PATCH] usb: cdc-wdm: fix reading stuck on device close +Git-commit: 01e01f5c89773c600a9f0b32c888de0146066c3a +References: git-fixes +Patch-mainline: v5.18-rc7 + +cdc-wdm tracks whether a response reading request is in-progress and +blocks the next request from being sent until the previous request is +completed. As soon as last user closes the cdc-wdm device file, the +driver cancels any ongoing requests, resets the pending response +counter, but leaves the response reading in-progress flag +(WDM_RESPONDING) untouched. + +So if the user closes the device file during the response receive +request is being performed, no more data will be obtained from the +modem. The request will be cancelled, effectively preventing the +WDM_RESPONDING flag from being reseted. Keeping the flag set will +prevent a new response receive request from being sent, permanently +blocking the read path. The read path will staying blocked until the +module will be reloaded or till the modem will be re-attached. + +This stuck has been observed with a Huawei E3372 modem attached to an +OpenWrt router and using the comgt utility to set up a network +connection. + +Fix this issue by clearing the WDM_RESPONDING flag on the device file +close. + +Without this fix, the device reading stuck can be easily reproduced in a +few connection establishing attempts. With this fix, a load test for +modem connection re-establishing worked for several hours without any +issues. + +Fixes: 922a5eadd5a3 ("usb: cdc-wdm: Fix race between autosuspend and reading from the device") +Signed-off-by: Sergey Ryazanov +Cc: stable +Acked-by: Oliver Neukum +Link: https://lore.kernel.org/r/20220501175828.8185-1-ryazanov.s.a@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Oliver Neukum +--- + drivers/usb/class/cdc-wdm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -742,6 +742,7 @@ static int wdm_release(struct inode *ino + kill_urbs(desc); + spin_lock_irq(&desc->iuspin); + desc->resp_count = 0; ++ clear_bit(WDM_RESPONDING, &desc->flags); + spin_unlock_irq(&desc->iuspin); + desc->manage_power(desc->intf, 0); + } else { diff --git a/patches.suse/usb-dwc3-core-Only-handle-soft-reset-in-DCTL.patch b/patches.suse/usb-dwc3-core-Only-handle-soft-reset-in-DCTL.patch new file mode 100644 index 0000000..c83d57a --- /dev/null +++ b/patches.suse/usb-dwc3-core-Only-handle-soft-reset-in-DCTL.patch @@ -0,0 +1,35 @@ +From f4fd84ae0765a80494b28c43b756a95100351a94 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Thu, 21 Apr 2022 19:33:56 -0700 +Subject: [PATCH] usb: dwc3: core: Only handle soft-reset in DCTL +Git-commit: f4fd84ae0765a80494b28c43b756a95100351a94 +References: git-fixes +Patch-mainline: v5.18-rc5 + +Make sure not to set run_stop bit or link state change request while +initiating soft-reset. Register read-modify-write operation may +unintentionally start the controller before the initialization completes +with its previous DCTL value, which can cause initialization failure. + +Fixes: f59dcab17629 ("usb: dwc3: core: improve reset sequence") +Cc: +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/6aecbd78328f102003d40ccf18ceeebd411d3703.1650594792.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Oliver Neukum +--- + drivers/usb/dwc3/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -225,7 +225,8 @@ static int dwc3_core_soft_reset(struct d + + reg = dwc3_readl(dwc->regs, DWC3_DCTL); + reg |= DWC3_DCTL_CSFTRST; +- dwc3_writel(dwc->regs, DWC3_DCTL, reg); ++ reg &= ~DWC3_DCTL_RUN_STOP; ++ dwc3_gadget_dctl_write_safe(dwc, reg); + + do { + reg = dwc3_readl(dwc->regs, DWC3_DCTL); diff --git a/patches.suse/usb-dwc3-gadget-Don-t-send-unintended-link-state-cha.patch b/patches.suse/usb-dwc3-gadget-Don-t-send-unintended-link-state-cha.patch new file mode 100644 index 0000000..9f27815 --- /dev/null +++ b/patches.suse/usb-dwc3-gadget-Don-t-send-unintended-link-state-cha.patch @@ -0,0 +1,107 @@ +From 5b738211fb59e114727381d07c647a77c0010996 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Wed, 23 Oct 2019 19:15:43 -0700 +Subject: [PATCH] usb: dwc3: gadget: Don't send unintended link state change +Git-commit: 5b738211fb59e114727381d07c647a77c0010996 +References: git-fixes +Patch-mainline: v5.6-rc1 + +DCTL.ULSTCHNGREQ is a write-only field. When doing a read-modify-write +to DCTL, the driver must make sure that there's no unintended link state +change request from whatever is read from DCTL.ULSTCHNGREQ. Set link +state change to no-action when the driver writes to DCTL. + +Signed-off-by: Thinh Nguyen +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Oliver Neukum +--- + drivers/usb/dwc3/gadget.c | 16 +++++++--------- + drivers/usb/dwc3/gadget.h | 14 ++++++++++++++ + 2 files changed, 21 insertions(+), 9 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -63,7 +63,7 @@ int dwc3_gadget_set_test_mode(struct dwc + return -EINVAL; + } + +- dwc3_writel(dwc->regs, DWC3_DCTL, reg); ++ dwc3_gadget_dctl_write_safe(dwc, reg); + + return 0; + } +@@ -1692,7 +1692,7 @@ static int dwc3_gadget_run_stop(struct d + dwc->pullups_connected = false; + } + +- dwc3_writel(dwc->regs, DWC3_DCTL, reg); ++ dwc3_gadget_dctl_write_safe(dwc, reg); + + do { + reg = dwc3_readl(dwc->regs, DWC3_DSTS); +@@ -2583,10 +2583,8 @@ static void dwc3_gadget_disconnect_inter + + reg = dwc3_readl(dwc->regs, DWC3_DCTL); + reg &= ~DWC3_DCTL_INITU1ENA; +- dwc3_writel(dwc->regs, DWC3_DCTL, reg); +- + reg &= ~DWC3_DCTL_INITU2ENA; +- dwc3_writel(dwc->regs, DWC3_DCTL, reg); ++ dwc3_gadget_dctl_write_safe(dwc, reg); + + dwc3_disconnect_gadget(dwc); + +@@ -2638,7 +2636,7 @@ static void dwc3_gadget_reset_interrupt( + + reg = dwc3_readl(dwc->regs, DWC3_DCTL); + reg &= ~DWC3_DCTL_TSTCTRL_MASK; +- dwc3_writel(dwc->regs, DWC3_DCTL, reg); ++ dwc3_gadget_dctl_write_safe(dwc, reg); + dwc->test_mode = false; + dwc3_clear_stall_all_ep(dwc); + +@@ -2741,11 +2739,11 @@ static void dwc3_gadget_conndone_interru + if (dwc->has_lpm_erratum && dwc->revision >= DWC3_REVISION_240A) + reg |= DWC3_DCTL_LPM_ERRATA(dwc->lpm_nyet_threshold); + +- dwc3_writel(dwc->regs, DWC3_DCTL, reg); ++ dwc3_gadget_dctl_write_safe(dwc, reg); + } else { + reg = dwc3_readl(dwc->regs, DWC3_DCTL); + reg &= ~DWC3_DCTL_HIRD_THRES_MASK; +- dwc3_writel(dwc->regs, DWC3_DCTL, reg); ++ dwc3_gadget_dctl_write_safe(dwc, reg); + } + + dep = dwc->eps[0]; +@@ -2854,7 +2852,7 @@ static void dwc3_gadget_linksts_change_i + + reg &= ~u1u2; + +- dwc3_writel(dwc->regs, DWC3_DCTL, reg); ++ dwc3_gadget_dctl_write_safe(dwc, reg); + break; + default: + /* do nothing */ +--- a/drivers/usb/dwc3/gadget.h ++++ b/drivers/usb/dwc3/gadget.h +@@ -116,4 +116,18 @@ static inline u32 dwc3_gadget_ep_get_tra + return DWC3_DEPCMD_GET_RSC_IDX(res_id); + } + ++/** ++ * dwc3_gadget_dctl_write_safe - write to DCTL safe from link state change ++ * @dwc: pointer to our context structure ++ * @value: value to write to DCTL ++ * ++ * Use this function when doing read-modify-write to DCTL. It will not ++ * send link state change request. ++ */ ++static inline void dwc3_gadget_dctl_write_safe(struct dwc3 *dwc, u32 value) ++{ ++ value &= ~DWC3_DCTL_ULSTCHNGREQ_MASK; ++ dwc3_writel(dwc->regs, DWC3_DCTL, value); ++} ++ + #endif /* __DRIVERS_USB_DWC3_GADGET_H */ diff --git a/patches.suse/usb-hub-Fix-locking-issues-with-address0_mutex.patch b/patches.suse/usb-hub-Fix-locking-issues-with-address0_mutex.patch new file mode 100644 index 0000000..16798c2 --- /dev/null +++ b/patches.suse/usb-hub-Fix-locking-issues-with-address0_mutex.patch @@ -0,0 +1,104 @@ +From 6cca13de26eea6d32a98d96d916a048d16a12822 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 23 Nov 2021 12:16:56 +0200 +Subject: [PATCH] usb: hub: Fix locking issues with address0_mutex +Git-commit: 6cca13de26eea6d32a98d96d916a048d16a12822 +References: git-fixes +Patch-mainline: v5.16-rc3 + +Fix the circular lock dependency and unbalanced unlock of addess0_mutex +introduced when fixing an address0_mutex enumeration retry race in commit +ae6dc22d2d1 ("usb: hub: Fix usb enumeration issue due to address0 race") + +Make sure locking order between port_dev->status_lock and address0_mutex +is correct, and that address0_mutex is not unlocked in hub_port_connect +"done:" codepath which may be reached without locking address0_mutex + +Fixes: 6ae6dc22d2d1 ("usb: hub: Fix usb enumeration issue due to address0 race") +Cc: +Reported-by: Marek Szyprowski +Tested-by: Hans de Goede +Tested-by: Marek Szyprowski +Acked-by: Hans de Goede +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20211123101656.1113518-1-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Oliver Neukum +--- + drivers/usb/core/hub.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -4837,6 +4837,7 @@ static void hub_port_connect(struct usb_ + struct usb_port *port_dev = hub->ports[port1 - 1]; + struct usb_device *udev = port_dev->child; + static int unreliable_port = -1; ++ bool retry_locked; + + /* Disconnect any existing devices under this port */ + if (udev) { +@@ -4893,10 +4894,10 @@ static void hub_port_connect(struct usb_ + + status = 0; + +- mutex_lock(hcd->address0_mutex); +- + for (i = 0; i < SET_CONFIG_TRIES; i++) { +- ++ usb_lock_port(port_dev); ++ mutex_lock(hcd->address0_mutex); ++ retry_locked = true; + /* reallocate for each attempt, since references + * to the previous one can escape in various ways + */ +@@ -4904,6 +4905,8 @@ static void hub_port_connect(struct usb_ + if (!udev) { + dev_err(&port_dev->dev, + "couldn't allocate usb_device\n"); ++ mutex_unlock(hcd->address0_mutex); ++ usb_unlock_port(port_dev); + goto done; + } + +@@ -4925,13 +4928,13 @@ static void hub_port_connect(struct usb_ + } + + /* reset (non-USB 3.0 devices) and get descriptor */ +- usb_lock_port(port_dev); + status = hub_port_init(hub, udev, port1, i); +- usb_unlock_port(port_dev); + if (status < 0) + goto loop; + + mutex_unlock(hcd->address0_mutex); ++ usb_unlock_port(port_dev); ++ retry_locked = false; + + if (udev->quirks & USB_QUIRK_DELAY_INIT) + msleep(2000); +@@ -5021,11 +5024,14 @@ static void hub_port_connect(struct usb_ + + loop_disable: + hub_port_disable(hub, port1, 1); +- mutex_lock(hcd->address0_mutex); + loop: + usb_ep0_reinit(udev); + release_devnum(udev); + hub_free_dev(udev); ++ if (retry_locked) { ++ mutex_unlock(hcd->address0_mutex); ++ usb_unlock_port(port_dev); ++ } + usb_put_dev(udev); + if ((status == -ENOTCONN) || (status == -ENOTSUPP)) + break; +@@ -5048,8 +5054,6 @@ loop: + } + + done: +- mutex_unlock(hcd->address0_mutex); +- + hub_port_disable(hub, port1, 1); + if (hcd->driver->relinquish_port && !hub->hdev->parent) { + if (status != -ENOTCONN && status != -ENODEV) diff --git a/patches.suse/usb-hub-Fix-usb-enumeration-issue-due-to-address0-ra.patch b/patches.suse/usb-hub-Fix-usb-enumeration-issue-due-to-address0-ra.patch new file mode 100644 index 0000000..04f13bf --- /dev/null +++ b/patches.suse/usb-hub-Fix-usb-enumeration-issue-due-to-address0-ra.patch @@ -0,0 +1,108 @@ +From 6ae6dc22d2d1ce6aa77a6da8a761e61aca216f8b Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 16 Nov 2021 00:16:30 +0200 +Subject: [PATCH] usb: hub: Fix usb enumeration issue due to address0 race +Git-commit: 6ae6dc22d2d1ce6aa77a6da8a761e61aca216f8b +References: git-fixes +Patch-mainline: v5.16-rc3 + +xHC hardware can only have one slot in default state with address 0 +waiting for a unique address at a time, otherwise "undefined behavior +may occur" according to xhci spec 5.4.3.4 + +The address0_mutex exists to prevent this across both xhci roothubs. + +If hub_port_init() fails, it may unlock the mutex and exit with a xhci +slot in default state. If the other xhci roothub calls hub_port_init() +at this point we end up with two slots in default state. + +Make sure the address0_mutex protects the slot default state across +hub_port_init() retries, until slot is addressed or disabled. + +Note, one known minor case is not fixed by this patch. +If device needs to be reset during resume, but fails all hub_port_init() +retries in usb_reset_and_verify_device(), then it's possible the slot is +still left in default state when address0_mutex is unlocked. + +Cc: +Fixes: 638139eb95d2 ("usb: hub: allow to process more usb hub events in parallel") +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20211115221630.871204-1-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Oliver Neukum +--- + drivers/usb/core/hub.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -4462,8 +4462,6 @@ hub_port_init(struct usb_hub *hub, struc + if (oldspeed == USB_SPEED_LOW) + delay = HUB_LONG_RESET_TIME; + +- mutex_lock(hcd->address0_mutex); +- + /* Reset the device; full speed may morph to high speed */ + /* FIXME a USB 2.0 device may morph into SuperSpeed on reset. */ + retval = hub_port_reset(hub, port1, udev, delay, false); +@@ -4750,7 +4748,6 @@ fail: + hub_port_disable(hub, port1, 0); + update_devnum(udev, devnum); /* for disconnect processing */ + } +- mutex_unlock(hcd->address0_mutex); + return retval; + } + +@@ -4895,6 +4892,9 @@ static void hub_port_connect(struct usb_ + unit_load = 100; + + status = 0; ++ ++ mutex_lock(hcd->address0_mutex); ++ + for (i = 0; i < SET_CONFIG_TRIES; i++) { + + /* reallocate for each attempt, since references +@@ -4931,6 +4931,8 @@ static void hub_port_connect(struct usb_ + if (status < 0) + goto loop; + ++ mutex_unlock(hcd->address0_mutex); ++ + if (udev->quirks & USB_QUIRK_DELAY_INIT) + msleep(2000); + +@@ -5019,6 +5021,7 @@ static void hub_port_connect(struct usb_ + + loop_disable: + hub_port_disable(hub, port1, 1); ++ mutex_lock(hcd->address0_mutex); + loop: + usb_ep0_reinit(udev); + release_devnum(udev); +@@ -5045,6 +5048,8 @@ loop: + } + + done: ++ mutex_unlock(hcd->address0_mutex); ++ + hub_port_disable(hub, port1, 1); + if (hcd->driver->relinquish_port && !hub->hdev->parent) { + if (status != -ENOTCONN && status != -ENODEV) +@@ -5574,6 +5579,8 @@ static int usb_reset_and_verify_device(s + bos = udev->bos; + udev->bos = NULL; + ++ mutex_lock(hcd->address0_mutex); ++ + for (i = 0; i < SET_CONFIG_TRIES; ++i) { + + /* ep0 maxpacket size may change; let the HCD know about it. +@@ -5583,6 +5590,7 @@ static int usb_reset_and_verify_device(s + if (ret >= 0 || ret == -ENOTCONN || ret == -ENODEV) + break; + } ++ mutex_unlock(hcd->address0_mutex); + + if (ret < 0) + goto re_enumerate; diff --git a/patches.suse/usb-mtu3-fix-USB-3.0-dual-role-switch-from-device-to.patch b/patches.suse/usb-mtu3-fix-USB-3.0-dual-role-switch-from-device-to.patch new file mode 100644 index 0000000..a994fac --- /dev/null +++ b/patches.suse/usb-mtu3-fix-USB-3.0-dual-role-switch-from-device-to.patch @@ -0,0 +1,56 @@ +From 456244aeecd54249096362a173dfe06b82a5cafa Mon Sep 17 00:00:00 2001 +From: Macpaul Lin +Date: Tue, 19 Apr 2022 16:12:45 +0800 +Subject: [PATCH] usb: mtu3: fix USB 3.0 dual-role-switch from device to host +Git-commit: 456244aeecd54249096362a173dfe06b82a5cafa +References: git-fixes +Patch-mainline: v5.18-rc5 + +Issue description: + When an OTG port has been switched to device role and then switch back + to host role again, the USB 3.0 Host (XHCI) will not be able to detect + "plug in event of a connected USB 2.0/1.0 ((Highspeed and Fullspeed) + devices until system reboot. + +Root cause and Solution: + There is a condition checking flag "ssusb->otg_switch.is_u3_drd" in + toggle_opstate(). At the end of role switch procedure, toggle_opstate() + will be called to set DC_SESSION and SOFT_CONN bit. If "is_u3_drd" was + set and switched the role to USB host 3.0, bit DC_SESSION and SOFT_CONN + will be skipped hence caused the port cannot detect connected USB 2.0 + (Highspeed and Fullspeed) devices. Simply remove the condition check to + solve this issue. + +Fixes: d0ed062a8b75 ("usb: mtu3: dual-role mode support") +Cc: stable@vger.kernel.org +Tested-by: Fabien Parent +Reviewed-by: Chunfeng Yun +Signed-off-by: Macpaul Lin +Signed-off-by: Tainping Fang +Link: https://lore.kernel.org/r/20220419081245.21015-1-macpaul.lin@mediatek.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Oliver Neukum +--- + drivers/usb/mtu3/mtu3_dr.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/usb/mtu3/mtu3_dr.c b/drivers/usb/mtu3/mtu3_dr.c +index a6b04831b20b..9b8aded3d95e 100644 +--- a/drivers/usb/mtu3/mtu3_dr.c ++++ b/drivers/usb/mtu3/mtu3_dr.c +@@ -21,10 +21,8 @@ static inline struct ssusb_mtk *otg_sx_to_ssusb(struct otg_switch_mtk *otg_sx) + + static void toggle_opstate(struct ssusb_mtk *ssusb) + { +- if (!ssusb->otg_switch.is_u3_drd) { +- mtu3_setbits(ssusb->mac_base, U3D_DEVICE_CONTROL, DC_SESSION); +- mtu3_setbits(ssusb->mac_base, U3D_POWER_MANAGEMENT, SOFT_CONN); +- } ++ mtu3_setbits(ssusb->mac_base, U3D_DEVICE_CONTROL, DC_SESSION); ++ mtu3_setbits(ssusb->mac_base, U3D_POWER_MANAGEMENT, SOFT_CONN); + } + + /* only port0 supports dual-role mode */ +-- +2.35.3 + diff --git a/patches.suse/usb-typec-tcpm-Wait-in-SNK_DEBOUNCED-until-disconnec.patch b/patches.suse/usb-typec-tcpm-Wait-in-SNK_DEBOUNCED-until-disconnec.patch new file mode 100644 index 0000000..168ba3d --- /dev/null +++ b/patches.suse/usb-typec-tcpm-Wait-in-SNK_DEBOUNCED-until-disconnec.patch @@ -0,0 +1,87 @@ +From fbcd13df1e78eb2ba83a3c160eefe2d6f574beaf Mon Sep 17 00:00:00 2001 +From: Badhri Jagan Sridharan +Date: Mon, 29 Nov 2021 16:18:25 -0800 +Subject: [PATCH] usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect +Git-commit: fbcd13df1e78eb2ba83a3c160eefe2d6f574beaf +References: git-fixes +Patch-mainline: v5.16-rc4 + +Stub from the spec: +"4.5.2.2.4.2 Exiting from AttachWait.SNK State +A Sink shall transition to Unattached.SNK when the state of both +the CC1 and CC2 pins is SNK.Open for at least tPDDebounce. +A DRP shall transition to Unattached.SRC when the state of both +the CC1 and CC2 pins is SNK.Open for at least tPDDebounce." + +This change makes TCPM to wait in SNK_DEBOUNCED state until +CC1 and CC2 pins is SNK.Open for at least tPDDebounce. Previously, +TCPM resets the port if vbus is not present in PD_T_PS_SOURCE_ON. +This causes TCPM to loop continuously when connected to a +faulty power source that does not present vbus. Waiting in +SNK_DEBOUNCED also ensures that TCPM is adherant to +"4.5.2.2.4.2 Exiting from AttachWait.SNK State" requirements. + +[ 6169.280751] CC1: 0 -> 0, CC2: 0 -> 5 [state TOGGLING, polarity 0, connected] +[ 6169.280759] state change TOGGLING -> SNK_ATTACH_WAIT [rev2 NONE_AMS] +[ 6169.280771] pending state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED @ 170 ms [rev2 NONE_AMS] +[ 6169.282427] CC1: 0 -> 0, CC2: 5 -> 5 [state SNK_ATTACH_WAIT, polarity 0, connected] +[ 6169.450825] state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED [delayed 170 ms] +[ 6169.450834] pending state change SNK_DEBOUNCED -> PORT_RESET @ 480 ms [rev2 NONE_AMS] +[ 6169.930892] state change SNK_DEBOUNCED -> PORT_RESET [delayed 480 ms] +[ 6169.931296] disable vbus discharge ret:0 +[ 6169.931301] Setting usb_comm capable false +[ 6169.932783] Setting voltage/current limit 0 mV 0 mA +[ 6169.932802] polarity 0 +[ 6169.933706] Requesting mux state 0, usb-role 0, orientation 0 +[ 6169.936689] cc:=0 +[ 6169.936812] pending state change PORT_RESET -> PORT_RESET_WAIT_OFF @ 100 ms [rev2 NONE_AMS] +[ 6169.937157] CC1: 0 -> 0, CC2: 5 -> 0 [state PORT_RESET, polarity 0, disconnected] +[ 6170.036880] state change PORT_RESET -> PORT_RESET_WAIT_OFF [delayed 100 ms] +[ 6170.036890] state change PORT_RESET_WAIT_OFF -> SNK_UNATTACHED [rev2 NONE_AMS] +[ 6170.036896] Start toggling +[ 6170.041412] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0, disconnected] +[ 6170.042973] CC1: 0 -> 0, CC2: 0 -> 5 [state TOGGLING, polarity 0, connected] +[ 6170.042976] state change TOGGLING -> SNK_ATTACH_WAIT [rev2 NONE_AMS] +[ 6170.042981] pending state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED @ 170 ms [rev2 NONE_AMS] +[ 6170.213014] state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED [delayed 170 ms] +[ 6170.213019] pending state change SNK_DEBOUNCED -> PORT_RESET @ 480 ms [rev2 NONE_AMS] +[ 6170.693068] state change SNK_DEBOUNCED -> PORT_RESET [delayed 480 ms] +[ 6170.693304] disable vbus discharge ret:0 +[ 6170.693308] Setting usb_comm capable false +[ 6170.695193] Setting voltage/current limit 0 mV 0 mA +[ 6170.695210] polarity 0 +[ 6170.695990] Requesting mux state 0, usb-role 0, orientation 0 +[ 6170.701896] cc:=0 +[ 6170.702181] pending state change PORT_RESET -> PORT_RESET_WAIT_OFF @ 100 ms [rev2 NONE_AMS] +[ 6170.703343] CC1: 0 -> 0, CC2: 5 -> 0 [state PORT_RESET, polarity 0, disconnected] + +Fixes: f0690a25a140b8 ("staging: typec: USB Type-C Port Manager (tcpm)") +Cc: stable@vger.kernel.org +Acked-by: Heikki Krogerus +Signed-off-by: Badhri Jagan Sridharan +Link: https://lore.kernel.org/r/20211130001825.3142830-1-badhri@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Oliver Neukum +--- + drivers/usb/typec/tcpm/tcpm.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c +index 7f2f3ff1b391..6010b9901126 100644 +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -4110,11 +4110,7 @@ static void run_state_machine(struct tcpm_port *port) + tcpm_try_src(port) ? SRC_TRY + : SNK_ATTACHED, + 0); +- else +- /* Wait for VBUS, but not forever */ +- tcpm_set_state(port, PORT_RESET, PD_T_PS_SOURCE_ON); + break; +- + case SRC_TRY: + port->try_src_count++; + tcpm_set_cc(port, tcpm_rp_cc(port)); +-- +2.34.1 + diff --git a/patches.suse/usb-ulpi-Call-of_node_put-correctly.patch b/patches.suse/usb-ulpi-Call-of_node_put-correctly.patch new file mode 100644 index 0000000..cc0a263 --- /dev/null +++ b/patches.suse/usb-ulpi-Call-of_node_put-correctly.patch @@ -0,0 +1,51 @@ +From 0a907ee9d95e3ac35eb023d71f29eae0aaa52d1b Mon Sep 17 00:00:00 2001 +From: Sean Anderson +Date: Thu, 27 Jan 2022 14:00:03 -0500 +Subject: [PATCH] usb: ulpi: Call of_node_put correctly +Git-commit: 0a907ee9d95e3ac35eb023d71f29eae0aaa52d1b +References: git-fixes +Patch-mainline: v5.17-rc4 + +of_node_put should always be called on device nodes gotten from +of_get_*. Additionally, it should only be called after there are no +remaining users. To address the first issue, call of_node_put if later +steps in ulpi_register fail. To address the latter, call put_device if +device_register fails, which will call ulpi_dev_release if necessary. + +Fixes: ef6a7bcfb01c ("usb: ulpi: Support device discovery via DT") +Cc: stable +Reviewed-by: Heikki Krogerus +Signed-off-by: Sean Anderson +Link: https://lore.kernel.org/r/20220127190004.1446909-3-sean.anderson@seco.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Oliver Neukum +--- + drivers/usb/common/ulpi.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c +index 09ad569a1a35..5509d3847af4 100644 +--- a/drivers/usb/common/ulpi.c ++++ b/drivers/usb/common/ulpi.c +@@ -248,12 +248,16 @@ static int ulpi_register(struct device *dev, struct ulpi *ulpi) + return ret; + + ret = ulpi_read_id(ulpi); +- if (ret) ++ if (ret) { ++ of_node_put(ulpi->dev.of_node); + return ret; ++ } + + ret = device_register(&ulpi->dev); +- if (ret) ++ if (ret) { ++ put_device(&ulpi->dev); + return ret; ++ } + + dev_dbg(&ulpi->dev, "registered ULPI PHY: vendor %04x, product %04x\n", + ulpi->id.vendor, ulpi->id.product); +-- +2.34.1 + diff --git a/patches.suse/usb-ulpi-Move-of_node_put-to-ulpi_dev_release.patch b/patches.suse/usb-ulpi-Move-of_node_put-to-ulpi_dev_release.patch new file mode 100644 index 0000000..aebd0f1 --- /dev/null +++ b/patches.suse/usb-ulpi-Move-of_node_put-to-ulpi_dev_release.patch @@ -0,0 +1,46 @@ +From 092f45b13e51666fe8ecbf2d6cd247aa7e6c1f74 Mon Sep 17 00:00:00 2001 +From: Sean Anderson +Date: Thu, 27 Jan 2022 14:00:02 -0500 +Subject: [PATCH] usb: ulpi: Move of_node_put to ulpi_dev_release +Git-commit: 092f45b13e51666fe8ecbf2d6cd247aa7e6c1f74 +References: git-fixes +Patch-mainline: v5.17-rc4 + +Drivers are not unbound from the device when ulpi_unregister_interface +is called. Move of_node-freeing code to ulpi_dev_release which is called +only after all users are gone. + +Fixes: ef6a7bcfb01c ("usb: ulpi: Support device discovery via DT") +Cc: stable +Reviewed-by: Heikki Krogerus +Signed-off-by: Sean Anderson +Link: https://lore.kernel.org/r/20220127190004.1446909-2-sean.anderson@seco.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Oliver Neukum +--- + drivers/usb/common/ulpi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c +index 8f8405b0d608..09ad569a1a35 100644 +--- a/drivers/usb/common/ulpi.c ++++ b/drivers/usb/common/ulpi.c +@@ -130,6 +130,7 @@ static const struct attribute_group *ulpi_dev_attr_groups[] = { + + static void ulpi_dev_release(struct device *dev) + { ++ of_node_put(dev->of_node); + kfree(to_ulpi_dev(dev)); + } + +@@ -299,7 +300,6 @@ EXPORT_SYMBOL_GPL(ulpi_register_interface); + */ + void ulpi_unregister_interface(struct ulpi *ulpi) + { +- of_node_put(ulpi->dev.of_node); + device_unregister(&ulpi->dev); + } + EXPORT_SYMBOL_GPL(ulpi_unregister_interface); +-- +2.34.1 + diff --git a/patches.suse/veth-Ensure-eth-header-is-in-skb-s-linear-part.patch b/patches.suse/veth-Ensure-eth-header-is-in-skb-s-linear-part.patch new file mode 100644 index 0000000..1792c70 --- /dev/null +++ b/patches.suse/veth-Ensure-eth-header-is-in-skb-s-linear-part.patch @@ -0,0 +1,71 @@ +From b6fa694ac2cf0b372afc650855a595784e1d1f75 Mon Sep 17 00:00:00 2001 +From: Guillaume Nault +Date: Wed, 6 Apr 2022 16:18:54 +0200 +Subject: [PATCH 8/8] veth: Ensure eth header is in skb's linear part +Git-commit: 726e2c5929de841fdcef4e2bf995680688ae1b87 +Patch-mainline: v5.18-rc3 +References: git-fixes + +After feeding a decapsulated packet to a veth device with act_mirred, +skb_headlen() may be 0. But veth_xmit() calls __dev_forward_skb(), +which expects at least ETH_HLEN byte of linear data (as +__dev_forward_skb2() calls eth_type_trans(), which pulls ETH_HLEN bytes +unconditionally). + +Use pskb_may_pull() to ensure veth_xmit() respects this constraint. + +kernel BUG at include/linux/skbuff.h:2328! +RIP: 0010:eth_type_trans+0xcf/0x140 +Call Trace: + + __dev_forward_skb2+0xe3/0x160 + veth_xmit+0x6e/0x250 [veth] + dev_hard_start_xmit+0xc7/0x200 + __dev_queue_xmit+0x47f/0x520 + ? skb_ensure_writable+0x85/0xa0 + ? skb_mpls_pop+0x98/0x1c0 + tcf_mirred_act+0x442/0x47e [act_mirred] + tcf_action_exec+0x86/0x140 + fl_classify+0x1d8/0x1e0 [cls_flower] + ? dma_pte_clear_level+0x129/0x1a0 + ? dma_pte_clear_level+0x129/0x1a0 + ? prb_fill_curr_block+0x2f/0xc0 + ? skb_copy_bits+0x11a/0x220 + __tcf_classify+0x58/0x110 + tcf_classify_ingress+0x6b/0x140 + __netif_receive_skb_core.constprop.0+0x47d/0xfd0 + ? __iommu_dma_unmap_swiotlb+0x44/0x90 + __netif_receive_skb_one_core+0x3d/0xa0 + netif_receive_skb+0x116/0x170 + be_process_rx+0x22f/0x330 [be2net] + be_poll+0x13c/0x370 [be2net] + __napi_poll+0x2a/0x170 + net_rx_action+0x22f/0x2f0 + __do_softirq+0xca/0x2a8 + __irq_exit_rcu+0xc1/0xe0 + common_interrupt+0x83/0xa0 + +Fixes: e314dbdc1c0d ("[NET]: Virtual ethernet device driver.") +Signed-off-by: Guillaume Nault +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/veth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/veth.c b/drivers/net/veth.c +index 287f996e7095..f1c402cd4e99 100644 +--- a/drivers/net/veth.c ++++ b/drivers/net/veth.c +@@ -195,7 +195,7 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev) + + rcu_read_lock(); + rcv = rcu_dereference(priv->peer); +- if (unlikely(!rcv)) { ++ if (unlikely(!rcv) || !pskb_may_pull(skb, ETH_HLEN)) { + kfree_skb(skb); + goto drop; + } +-- +2.16.4 + diff --git a/patches.suse/vxlan-fix-memleak-of-fdb.patch b/patches.suse/vxlan-fix-memleak-of-fdb.patch new file mode 100644 index 0000000..67f2d7e --- /dev/null +++ b/patches.suse/vxlan-fix-memleak-of-fdb.patch @@ -0,0 +1,93 @@ +From e37a51ed2ef5d8ae0ff4ffe3c8e02471db95a808 Mon Sep 17 00:00:00 2001 +From: Taehee Yoo +Date: Sat, 1 Aug 2020 07:07:50 +0000 +Subject: [PATCH] vxlan: fix memleak of fdb +Git-commit: fda2ec62cf1aa7cbee52289dc8059cd3662795da +References: git-fixes +Patch-mainline: v5.8 + +When vxlan interface is deleted, all fdbs are deleted by vxlan_flush(). +vxlan_flush() flushes fdbs but it doesn't delete fdb, which contains +all-zeros-mac because it is deleted by vxlan_uninit(). +But vxlan_uninit() deletes only the fdb, which contains both all-zeros-mac +and default vni. +So, the fdb, which contains both all-zeros-mac and non-default vni +will not be deleted. + +Test commands: + ip link add vxlan0 type vxlan dstport 4789 external + ip link set vxlan0 up + bridge fdb add to 00:00:00:00:00:00 dst 172.0.0.1 dev vxlan0 via lo \ + src_vni 10000 self permanent + ip link del vxlan0 + +kmemleak reports as follows: +unreferenced object 0xffff9486b25ced88 (size 96): + comm "bridge", pid 2151, jiffies 4294701712 (age 35506.901s) + hex dump (first 32 bytes): + 02 00 00 00 ac 00 00 01 40 00 09 b1 86 94 ff ff ........@....... + 46 02 00 00 00 00 00 00 a7 03 00 00 12 b5 6a 6b F.............jk + backtrace: + [<00000000c10cf651>] vxlan_fdb_append.part.51+0x3c/0xf0 [vxlan] + [<000000006b31a8d9>] vxlan_fdb_create+0x184/0x1a0 [vxlan] + [<0000000049399045>] vxlan_fdb_update+0x12f/0x220 [vxlan] + [<0000000090b1ef00>] vxlan_fdb_add+0x12a/0x1b0 [vxlan] + [<0000000056633c2c>] rtnl_fdb_add+0x187/0x270 + [<00000000dd5dfb6b>] rtnetlink_rcv_msg+0x264/0x490 + [<00000000fc44dd54>] netlink_rcv_skb+0x4a/0x110 + [<00000000dff433e7>] netlink_unicast+0x18e/0x250 + [<00000000b87fb421>] netlink_sendmsg+0x2e9/0x400 + [<000000002ed55153>] ____sys_sendmsg+0x237/0x260 + [<00000000faa51c66>] ___sys_sendmsg+0x88/0xd0 + [<000000006c3982f1>] __sys_sendmsg+0x4e/0x80 + [<00000000a8f875d2>] do_syscall_64+0x56/0xe0 + [<000000003610eefa>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 +unreferenced object 0xffff9486b1c40080 (size 128): + comm "bridge", pid 2157, jiffies 4294701754 (age 35506.866s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 f8 dc 42 b2 86 94 ff ff ..........B..... + 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk + backtrace: + [<00000000a2981b60>] vxlan_fdb_create+0x67/0x1a0 [vxlan] + [<0000000049399045>] vxlan_fdb_update+0x12f/0x220 [vxlan] + [<0000000090b1ef00>] vxlan_fdb_add+0x12a/0x1b0 [vxlan] + [<0000000056633c2c>] rtnl_fdb_add+0x187/0x270 + [<00000000dd5dfb6b>] rtnetlink_rcv_msg+0x264/0x490 + [<00000000fc44dd54>] netlink_rcv_skb+0x4a/0x110 + [<00000000dff433e7>] netlink_unicast+0x18e/0x250 + [<00000000b87fb421>] netlink_sendmsg+0x2e9/0x400 + [<000000002ed55153>] ____sys_sendmsg+0x237/0x260 + [<00000000faa51c66>] ___sys_sendmsg+0x88/0xd0 + [<000000006c3982f1>] __sys_sendmsg+0x4e/0x80 + [<00000000a8f875d2>] do_syscall_64+0x56/0xe0 + [<000000003610eefa>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Fixes: 3ad7a4b141eb ("vxlan: support fdb and learning in COLLECT_METADATA mode") +Signed-off-by: Taehee Yoo +Acked-by: Roopa Prabhu +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/vxlan.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index d9cea25098c3..d535a87f3e18 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -2589,8 +2589,10 @@ static void vxlan_flush(struct vxlan_dev *vxlan, bool do_all) + if (!do_all && (f->state & (NUD_PERMANENT | NUD_NOARP))) + continue; + /* the all_zeros_mac entry is deleted at vxlan_uninit */ +- if (!is_zero_ether_addr(f->eth_addr)) +- vxlan_fdb_destroy(vxlan, f, true); ++ if (is_zero_ether_addr(f->eth_addr) && ++ f->vni == vxlan->cfg.vni) ++ continue; ++ vxlan_fdb_destroy(vxlan, f, true); + } + } + spin_unlock_bh(&vxlan->hash_lock); +-- +2.16.4 + diff --git a/patches.suse/watchdog-iTCO_wdt-Account-for-rebooting-on-second-ti.patch b/patches.suse/watchdog-iTCO_wdt-Account-for-rebooting-on-second-ti.patch deleted file mode 100644 index c337ec7..0000000 --- a/patches.suse/watchdog-iTCO_wdt-Account-for-rebooting-on-second-ti.patch +++ /dev/null @@ -1,71 +0,0 @@ -From cb011044e34c293e139570ce5c01aed66a34345c Mon Sep 17 00:00:00 2001 -From: Jan Kiszka -Date: Sun, 30 May 2021 13:24:23 +0200 -Subject: [PATCH] watchdog: iTCO_wdt: Account for rebooting on second timeout -Git-commit: cb011044e34c293e139570ce5c01aed66a34345c -Patch-mainline: v5.14-rc1 -References: git-fixes - -This was already attempted to fix via 1fccb73011ea: If the BIOS did not -enable TCO SMIs, the timer definitely needs to trigger twice in order to -cause a reboot. If TCO SMIs are on, as well as SMIs in general, we can -continue to assume that the BIOS will perform a reboot on the first -timeout. - -QEMU with its ICH9 and related BIOS falls into the former category, -currently taking twice the configured timeout in order to reboot the -machine. For iTCO version that fall under turn_SMI_watchdog_clear_off, -this is also true and was currently only addressed for v1, irrespective -of the turn_SMI_watchdog_clear_off value. - -Signed-off-by: Jan Kiszka -Reviewed-by: Guenter Roeck -Link: https://lore.kernel.org/r/0b8bb307-d08b-41b5-696c-305cdac6789c@siemens.com -Signed-off-by: Guenter Roeck -Signed-off-by: Wim Van Sebroeck -Acked-by: Takashi Iwai - ---- - drivers/watchdog/iTCO_wdt.c | 12 +++++++++--- - 1 file changed, 9 insertions(+), 3 deletions(-) - -diff --git a/drivers/watchdog/iTCO_wdt.c b/drivers/watchdog/iTCO_wdt.c -index bf31d7b67a69..3f1324871cfd 100644 ---- a/drivers/watchdog/iTCO_wdt.c -+++ b/drivers/watchdog/iTCO_wdt.c -@@ -71,6 +71,8 @@ - #define TCOBASE(p) ((p)->tco_res->start) - /* SMI Control and Enable Register */ - #define SMI_EN(p) ((p)->smi_res->start) -+#define TCO_EN (1 << 13) -+#define GBL_SMI_EN (1 << 0) - - #define TCO_RLD(p) (TCOBASE(p) + 0x00) /* TCO Timer Reload/Curr. Value */ - #define TCOv1_TMR(p) (TCOBASE(p) + 0x01) /* TCOv1 Timer Initial Value*/ -@@ -355,8 +357,12 @@ static int iTCO_wdt_set_timeout(struct watchdog_device *wd_dev, unsigned int t) - - tmrval = seconds_to_ticks(p, t); - -- /* For TCO v1 the timer counts down twice before rebooting */ -- if (p->iTCO_version == 1) -+ /* -+ * If TCO SMIs are off, the timer counts down twice before rebooting. -+ * Otherwise, the BIOS generally reboots when the SMI triggers. -+ */ -+ if (p->smi_res && -+ (SMI_EN(p) & (TCO_EN | GBL_SMI_EN)) != (TCO_EN | GBL_SMI_EN)) - tmrval /= 2; - - /* from the specs: */ -@@ -521,7 +527,7 @@ static int iTCO_wdt_probe(struct platform_device *pdev) - * Disables TCO logic generating an SMI# - */ - val32 = inl(SMI_EN(p)); -- val32 &= 0xffffdfff; /* Turn off SMI clearing watchdog */ -+ val32 &= ~TCO_EN; /* Turn off SMI clearing watchdog */ - outl(val32, SMI_EN(p)); - } - --- -2.26.2 - diff --git a/patches.suse/wcn36xx-Fix-HT40-capability-for-2Ghz-band.patch b/patches.suse/wcn36xx-Fix-HT40-capability-for-2Ghz-band.patch new file mode 100644 index 0000000..a45991f --- /dev/null +++ b/patches.suse/wcn36xx-Fix-HT40-capability-for-2Ghz-band.patch @@ -0,0 +1,41 @@ +From 960ae77f25631bbe4e3aafefe209b52e044baf31 Mon Sep 17 00:00:00 2001 +From: Loic Poulain +Date: Wed, 20 Oct 2021 15:38:53 +0200 +Subject: [PATCH] wcn36xx: Fix HT40 capability for 2Ghz band +Git-commit: 960ae77f25631bbe4e3aafefe209b52e044baf31 +References: git-fixes +Patch-mainline: v5.16-rc1 + +All wcn36xx controllers are supposed to support HT40 (and SGI40), +This doubles the maximum bitrate/throughput with compatible APs. + +Tested with wcn3620 & wcn3680B. + +Cc: stable@vger.kernel.org +Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware") +Signed-off-by: Loic Poulain +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1634737133-22336-1-git-send-email-loic.poulain@linaro.org +Signed-off-by: Oliver Neukum +--- + drivers/net/wireless/ath/wcn36xx/main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c +index 644b8523df68..1cddb78aa00e 100644 +--- a/drivers/net/wireless/ath/wcn36xx/main.c ++++ b/drivers/net/wireless/ath/wcn36xx/main.c +@@ -135,7 +135,9 @@ static struct ieee80211_supported_band wcn_band_2ghz = { + .cap = IEEE80211_HT_CAP_GRN_FLD | + IEEE80211_HT_CAP_SGI_20 | + IEEE80211_HT_CAP_DSSSCCK40 | +- IEEE80211_HT_CAP_LSIG_TXOP_PROT, ++ IEEE80211_HT_CAP_LSIG_TXOP_PROT | ++ IEEE80211_HT_CAP_SGI_40 | ++ IEEE80211_HT_CAP_SUP_WIDTH_20_40, + .ht_supported = true, + .ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K, + .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16, +-- +2.34.1 + diff --git a/patches.suse/wcn36xx-add-proper-DMA-memory-barriers-in-rx-path.patch b/patches.suse/wcn36xx-add-proper-DMA-memory-barriers-in-rx-path.patch new file mode 100644 index 0000000..c9624ca --- /dev/null +++ b/patches.suse/wcn36xx-add-proper-DMA-memory-barriers-in-rx-path.patch @@ -0,0 +1,65 @@ +From 9bfe38e064af5decba2ffce66a2958ab8b10eaa4 Mon Sep 17 00:00:00 2001 +From: Benjamin Li +Date: Fri, 22 Oct 2021 17:15:28 -0700 +Subject: [PATCH] wcn36xx: add proper DMA memory barriers in rx path +Git-commit: 9bfe38e064af5decba2ffce66a2958ab8b10eaa4 +References: git-fixes +Patch-mainline: v5.16-rc1 + +This is essentially exactly following the dma_wmb()/dma_rmb() usage +instructions in Documentation/memory-barriers.txt. + +The theoretical races here are: + +1. DXE (the DMA Transfer Engine in the Wi-Fi subsystem) seeing the +dxe->ctrl & WCN36xx_DXE_CTRL_VLD write before the dxe->dst_addr_l +write, thus performing DMA into the wrong address. + +2. CPU reading dxe->dst_addr_l before DXE unsets dxe->ctrl & +WCN36xx_DXE_CTRL_VLD. This should generally be harmless since DXE +doesn't write dxe->dst_addr_l (no risk of freeing the wrong skb). + +Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware") +Signed-off-by: Benjamin Li +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211023001528.3077822-1-benl@squareup.com +Signed-off-by: Oliver Neukum +--- + drivers/net/wireless/ath/wcn36xx/dxe.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c +index 0e0bbcd11300..aff04ef66266 100644 +--- a/drivers/net/wireless/ath/wcn36xx/dxe.c ++++ b/drivers/net/wireless/ath/wcn36xx/dxe.c +@@ -606,6 +606,10 @@ static int wcn36xx_rx_handle_packets(struct wcn36xx *wcn, + dxe = ctl->desc; + + while (!(READ_ONCE(dxe->ctrl) & WCN36xx_DXE_CTRL_VLD)) { ++ /* do not read until we own DMA descriptor */ ++ dma_rmb(); ++ ++ /* read/modify DMA descriptor */ + skb = ctl->skb; + dma_addr = dxe->dst_addr_l; + ret = wcn36xx_dxe_fill_skb(wcn->dev, ctl, GFP_ATOMIC); +@@ -616,9 +620,15 @@ static int wcn36xx_rx_handle_packets(struct wcn36xx *wcn, + dma_unmap_single(wcn->dev, dma_addr, WCN36XX_PKT_SIZE, + DMA_FROM_DEVICE); + wcn36xx_rx_skb(wcn, skb); +- } /* else keep old skb not submitted and use it for rx DMA */ ++ } ++ /* else keep old skb not submitted and reuse it for rx DMA ++ * (dropping the packet that it contained) ++ */ + ++ /* flush descriptor changes before re-marking as valid */ ++ dma_wmb(); + dxe->ctrl = ctrl; ++ + ctl = ctl->next; + dxe = ctl->desc; + } +-- +2.34.1 + diff --git a/patches.suse/x86-pm-save-the-msr-validity-status-at-context-setup.patch b/patches.suse/x86-pm-save-the-msr-validity-status-at-context-setup.patch new file mode 100644 index 0000000..12bf486 --- /dev/null +++ b/patches.suse/x86-pm-save-the-msr-validity-status-at-context-setup.patch @@ -0,0 +1,55 @@ +From: Pawan Gupta +Date: Mon, 4 Apr 2022 17:34:19 -0700 +Subject: x86/pm: Save the MSR validity status at context setup +Git-commit: 73924ec4d560257004d5b5116b22a3647661e364 +Patch-mainline: v5.18 or v5.18-rc2 (next release) +References: bsc#1198400 + +The mechanism to save/restore MSRs during S3 suspend/resume checks for +the MSR validity during suspend, and only restores the MSR if its a +valid MSR. This is not optimal, as an invalid MSR will unnecessarily +throw an exception for every suspend cycle. The more invalid MSRs, +higher the impact will be. + +Check and save the MSR validity at setup. This ensures that only valid +MSRs that are guaranteed to not throw an exception will be attempted +during suspend. + +Fixes: 7a9c2dd08ead ("x86/pm: Introduce quirk framework to save/restore extra MSR registers around suspend/resume") +Suggested-by: Dave Hansen +Signed-off-by: Pawan Gupta +Reviewed-by: Dave Hansen +Acked-by: Borislav Petkov +Cc: stable@vger.kernel.org +Signed-off-by: Linus Torvalds +--- + arch/x86/power/cpu.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c +index 9f2b251e83c5..eaec0cb3fe04 100644 +--- a/arch/x86/power/cpu.c ++++ b/arch/x86/power/cpu.c +@@ -40,7 +40,8 @@ static void msr_save_context(struct saved_context *ctxt) + struct saved_msr *end = msr + ctxt->saved_msrs.num; + + while (msr < end) { +- msr->valid = !rdmsrl_safe(msr->info.msr_no, &msr->info.reg.q); ++ if (msr->valid) ++ rdmsrl(msr->info.msr_no, msr->info.reg.q); + msr++; + } + } +@@ -424,8 +425,10 @@ static int msr_build_context(const u32 *msr_id, const int num) + } + + for (i = saved_msrs->num, j = 0; i < total_num; i++, j++) { ++ u64 dummy; ++ + msr_array[i].info.msr_no = msr_id[j]; +- msr_array[i].valid = false; ++ msr_array[i].valid = !rdmsrl_safe(msr_id[j], &dummy); + msr_array[i].info.reg.q = 0; + } + saved_msrs->num = total_num; + diff --git a/patches.suse/x86-speculation-add-special-register-buffer-data-sampling-srbds-mitigation.patch b/patches.suse/x86-speculation-add-special-register-buffer-data-sampling-srbds-mitigation.patch index 3fa9556..3e49efe 100644 --- a/patches.suse/x86-speculation-add-special-register-buffer-data-sampling-srbds-mitigation.patch +++ b/patches.suse/x86-speculation-add-special-register-buffer-data-sampling-srbds-mitigation.patch @@ -73,9 +73,9 @@ Tested-by: Neelima Krishnan #endif /* _ASM_X86_CPUFEATURES_H */ --- a/arch/x86/include/asm/msr-index.h +++ b/arch/x86/include/asm/msr-index.h -@@ -118,6 +118,10 @@ - #define TSX_CTRL_RTM_DISABLE BIT(0) /* Disable RTM feature */ - #define TSX_CTRL_CPUID_CLEAR BIT(1) /* Disable TSX enumeration */ +@@ -120,6 +120,10 @@ + + #define MSR_IA32_MCU_OPT_CTRL 0x00000123 +/* SRBDS support */ +#define MSR_IA32_MCU_OPT_CTRL 0x00000123 diff --git a/patches.suse/x86-speculation-restore-speculation-related-msrs-during-s3-resume.patch b/patches.suse/x86-speculation-restore-speculation-related-msrs-during-s3-resume.patch new file mode 100644 index 0000000..6400847 --- /dev/null +++ b/patches.suse/x86-speculation-restore-speculation-related-msrs-during-s3-resume.patch @@ -0,0 +1,75 @@ +From: Pawan Gupta +Date: Mon, 4 Apr 2022 17:35:45 -0700 +Subject: x86/speculation: Restore speculation related MSRs during S3 resume +Git-commit: e2a1256b17b16f9b9adf1b6fea56819e7b68e463 +Patch-mainline: v5.18 or v5.18-rc2 (next release) +References: bsc#1198400 + +After resuming from suspend-to-RAM, the MSRs that control CPU's +speculative execution behavior are not being restored on the boot CPU. + +These MSRs are used to mitigate speculative execution vulnerabilities. +Not restoring them correctly may leave the CPU vulnerable. Secondary +CPU's MSRs are correctly being restored at S3 resume by +identify_secondary_cpu(). + +During S3 resume, restore these MSRs for boot CPU when restoring its +processor state. + +Fixes: 772439717dbf ("x86/bugs/intel: Set proper CPU features and setup RDS") +Reported-by: Neelima Krishnan +Signed-off-by: Pawan Gupta +Tested-by: Neelima Krishnan +Acked-by: Borislav Petkov +Reviewed-by: Dave Hansen +Cc: stable@vger.kernel.org +Signed-off-by: Linus Torvalds + + [ bp: Backporting note: I've added the MSR_IA32_MCU_OPT_CTRL definition so + that it builds. The branches merging this one will potentially already have + it due to additional backports so it will conflict but resolving should be + simple: simply remove the definition of that MSR here. Thx. ] + +--- + arch/x86/include/asm/msr-index.h | 2 ++ + arch/x86/power/cpu.c | 14 ++++++++++++++ + 2 files changed, 16 insertions(+) + +--- a/arch/x86/include/asm/msr-index.h ++++ b/arch/x86/include/asm/msr-index.h +@@ -109,6 +109,8 @@ + #define TSX_CTRL_RTM_DISABLE BIT(0) /* Disable RTM feature */ + #define TSX_CTRL_CPUID_CLEAR BIT(1) /* Disable TSX enumeration */ + ++#define MSR_IA32_MCU_OPT_CTRL 0x00000123 ++ + #define MSR_IA32_SYSENTER_CS 0x00000174 + #define MSR_IA32_SYSENTER_ESP 0x00000175 + #define MSR_IA32_SYSENTER_EIP 0x00000176 +--- a/arch/x86/power/cpu.c ++++ b/arch/x86/power/cpu.c +@@ -503,10 +503,24 @@ static int pm_cpu_check(const struct x86 + return ret; + } + ++static void pm_save_spec_msr(void) ++{ ++ u32 spec_msr_id[] = { ++ MSR_IA32_SPEC_CTRL, ++ MSR_IA32_TSX_CTRL, ++ MSR_TSX_FORCE_ABORT, ++ MSR_IA32_MCU_OPT_CTRL, ++ MSR_AMD64_LS_CFG, ++ }; ++ ++ msr_build_context(spec_msr_id, ARRAY_SIZE(spec_msr_id)); ++} ++ + static int pm_check_save_msr(void) + { + dmi_check_system(msr_save_dmi_table); + pm_cpu_check(msr_save_cpu_table); ++ pm_save_spec_msr(); + + return 0; + } diff --git a/patches.suse/xhci-stop-polling-roothubs-after-shutdown.patch b/patches.suse/xhci-stop-polling-roothubs-after-shutdown.patch new file mode 100644 index 0000000..38c31ec --- /dev/null +++ b/patches.suse/xhci-stop-polling-roothubs-after-shutdown.patch @@ -0,0 +1,54 @@ +From dc92944a014cd6a6f6c94299aaa36164dd2c238a Mon Sep 17 00:00:00 2001 +From: Henry Lin +Date: Fri, 8 Apr 2022 16:48:22 +0300 +Subject: [PATCH] xhci: stop polling roothubs after shutdown +Git-commit: dc92944a014cd6a6f6c94299aaa36164dd2c238a +References: git-fixes +Patch-mainline: v5.18-rc5 + +While rebooting, XHCI controller and its bus device will be shut down +in order by .shutdown callback. Stopping roothubs polling in +xhci_shutdown() can prevent XHCI driver from accessing port status +after its bus device shutdown. + +Take PCIe XHCI controller as example, if XHCI driver doesn't stop roothubs +polling, XHCI driver may access PCIe BAR register for port status after +parent PCIe root port driver is shutdown and cause PCIe bus error. + +[check shared hcd exist before stopping its roothub polling -Mathias] + +Cc: stable@vger.kernel.org +Signed-off-by: Henry Lin +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20220408134823.2527272-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Oliver Neukum +--- + drivers/usb/host/xhci.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 642610c78f58..25b87e99b4dd 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -781,6 +781,17 @@ void xhci_shutdown(struct usb_hcd *hcd) + if (xhci->quirks & XHCI_SPURIOUS_REBOOT) + usb_disable_xhci_ports(to_pci_dev(hcd->self.sysdev)); + ++ /* Don't poll the roothubs after shutdown. */ ++ xhci_dbg(xhci, "%s: stopping usb%d port polling.\n", ++ __func__, hcd->self.busnum); ++ clear_bit(HCD_FLAG_POLL_RH, &hcd->flags); ++ del_timer_sync(&hcd->rh_timer); ++ ++ if (xhci->shared_hcd) { ++ clear_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags); ++ del_timer_sync(&xhci->shared_hcd->rh_timer); ++ } ++ + spin_lock_irq(&xhci->lock); + xhci_halt(xhci); + /* Workaround for spurious wakeups at shutdown with HSW */ +-- +2.35.3 + diff --git a/scripts/bs-upload-kernel b/scripts/bs-upload-kernel index b592cc8..c97c25a 100755 --- a/scripts/bs-upload-kernel +++ b/scripts/bs-upload-kernel @@ -103,6 +103,9 @@ my @macros = ("%is_kotd 1"); if ($ignore_kabi) { push(@macros, "%ignore_kabi_badness 1"); } +if (-e "$dir/klp-symbols") { + push(@macros, "%klp_symbols 1"); +} my @remove_packages = qw(kernel-dummy); if (!$enable_checks) { push(@remove_packages, "post-build-checks", "rpmlint-Factory", diff --git a/scripts/git_sort/lib.py b/scripts/git_sort/lib.py index 9442b37..c656116 100644 --- a/scripts/git_sort/lib.py +++ b/scripts/git_sort/lib.py @@ -280,6 +280,11 @@ class InputEntry(object): if not commit_tags: self.dest_head = git_sort.oot mainline = mainline_tags[0] + if re.match("^(v[1-9]|Queued)", mainline, re.IGNORECASE): + raise exc.KSError( + "There is a problem with patch \"%s\". " + "The Patch-mainline tag \"%s\" requires Git-commit." % ( + name, mainline,)) if not re.match("^(Submitted|Not yet)", mainline, re.IGNORECASE): raise exc.KSError( "There is a problem with patch \"%s\". " diff --git a/scripts/git_sort/tests/test_series_sort.py b/scripts/git_sort/tests/test_series_sort.py index 96f54e8..f0ffe5b 100755 --- a/scripts/git_sort/tests/test_series_sort.py +++ b/scripts/git_sort/tests/test_series_sort.py @@ -955,6 +955,18 @@ class TestFromPatch(unittest.TestCase): "Error: There is a problem with patch \"%s\". The Git-repo tag is incorrect or the patch is in the wrong section of series.conf and (the Git-commit tag is incorrect or the relevant remote is outdated or not available locally) or an entry for this repository is missing from \"remotes\". In the last case, please edit \"remotes\" in \"scripts/git_sort/git_sort.py\" and commit the result. Manual intervention is required.\n" % (name,)) + def test_malformed(self): + """ + Generate a series and destroy the Git-commit tag on one of the patches + This should report a specific error so that this situation is not conflated with wrong Patch-mainline tag in out-of-tree section + """ + + name, series2 = self.prepare_found_indexed_upstream_good() + subprocess.call(['sed', '-i', '-e', 's/commit/comit/', name]) + self.check_failure( +'Error: There is a problem with patch "%s". The Patch-mainline tag "Queued in subsystem maintainer repository" requires Git-commit.\n' % (name)) + + if __name__ == '__main__': # Run a single testcase suite = unittest.TestLoader().loadTestsFromTestCase(TestFromPatch) diff --git a/scripts/gitlog2changes b/scripts/gitlog2changes index 7f59a5d..15435c5 100755 --- a/scripts/gitlog2changes +++ b/scripts/gitlog2changes @@ -63,11 +63,22 @@ sub parse_gitlog { my $cur = { message => [] }; my @states = qw(commit tree parent author committer blank message); my $st = 0; + my $gpgsig = 0; while (my $line = <$fh>) { next if $line =~ /^#/; chomp($line); my $expect = $states[$st]; if ($expect eq "blank") { + if ($gpgsig > 0) { + if ($line =~ /-----END PGP SIGNATURE-----/) { + $gpgsig = 0; + } + next; + } + if ($line =~ /^gpgsig/) { + $gpgsig = 1; + next; + } if ($line ne "") { die "Malformed git rev-parse output ($cur->{commit}): expected blank line, got \"$line\"\n"; } diff --git a/scripts/python/check-patchhdr b/scripts/python/check-patchhdr index 0f8f89e..165eae2 100755 --- a/scripts/python/check-patchhdr +++ b/scripts/python/check-patchhdr @@ -1,9 +1,5 @@ -#!/usr/bin/python3 -# -*- coding: utf-8 -*-, - -from __future__ import absolute_import -from __future__ import print_function -from __future__ import division +#!/usr/bin/env python3 +# vim: sw=4 ts=4 et si: import sys from optparse import OptionParser diff --git a/scripts/python/suse_git/header.py b/scripts/python/suse_git/header.py index 423a756..7540558 100755 --- a/scripts/python/suse_git/header.py +++ b/scripts/python/suse_git/header.py @@ -1,5 +1,5 @@ -#!/usr/bin/python -# -*- coding: utf-8 -*-, +#!/usr/bin/env python3 +# vim: sw=4 ts=4 et si: import sys import re @@ -330,7 +330,7 @@ class HeaderChecker(patch.PatchChecker): target[tag].append(new_req) def do_patch(self): - for line in self.stream: + for line in self.stream.readlines(): if diffstart.match(line): break diff --git a/scripts/python/suse_git/patch.py b/scripts/python/suse_git/patch.py index 13ff659..2116d15 100644 --- a/scripts/python/suse_git/patch.py +++ b/scripts/python/suse_git/patch.py @@ -1,5 +1,5 @@ -#!/usr/bin/python -# -*- coding: utf-8 -*-, +#!/usr/bin/env python3 +# vim: sw=4 ts=4 et si: import sys diff --git a/scripts/python/test-all.sh b/scripts/python/test-all.sh old mode 100644 new mode 100755 index 77cb2eb..8308965 --- a/scripts/python/test-all.sh +++ b/scripts/python/test-all.sh @@ -1 +1,2 @@ -python3 -m unittest discover +#! /bin/sh +python3 -m unittest discover "$@" diff --git a/scripts/python/tests/test_header.py b/scripts/python/tests/test_header.py index b0b8360..98f0ad4 100755 --- a/scripts/python/tests/test_header.py +++ b/scripts/python/tests/test_header.py @@ -1,10 +1,10 @@ -#!/usr/bin/python3 +#!/usr/bin/env python3 # -*- coding: utf-8 -*-, +# vim:set shiftwidth=4 softtabstop=4 expandtab textwidth=79: import sys import os.path import unittest -from io import StringIO from suse_git import header diff --git a/series.conf b/series.conf index 4c93fa5..f9b4e57 100644 --- a/series.conf +++ b/series.conf @@ -885,6 +885,9 @@ patches.suse/irq_data_get_effective_affinity_mask.patch patches.suse/include-add-additional-sizes.patch + patches.rpmify/elfcore-fix-building-with-clang.patch + patches.rpmify/elfcore-correct-reference-to-CONFIG_UML.patch + ######################################################## # The sorted section contains everything that is a backport # or has been submitted upstream with an expectation of @@ -16493,6 +16496,7 @@ patches.suse/ARM-DRA722-remove-redundant-definition-of-1.0-device.patch patches.suse/dt-bindings-add-compatible-string-for-allwinner-v3s-soc.patch patches.suse/ARM-sunxi-fix-the-core-number-of-V3s-in-sunxi-README.patch + patches.suse/arm64-dts-marvell-Fix-A37xx-UART0-register-size.patch patches.suse/0130-soc-fsl-qman-Sleep-instead-of-stuck-hacking-jiffies.patch patches.suse/0131-soc-fsl-guts-Add-compatible-string-for-LS1088.patch patches.suse/0132-soc-fsl-qbman-Add-common-routine-for-QBMan-private-a.patch @@ -36140,6 +36144,7 @@ patches.suse/0001-btrfs-Don-t-remove-block-group-still-has-pinned-down.patch patches.suse/0015-btrfs-tree-checker-Verify-block_group_item.patch patches.suse/0016-btrfs-tree-checker-Detect-invalid-and-empty-essentia.patch + patches.suse/btrfs-relocation-Only-remove-reloc-rb_trees-if-reloc.patch patches.suse/btrfs-use-customized-batch-size-for-total_bytes_pinned.patch patches.suse/btrfs-refactor-block-group-replication-factor-calculation-to-a-helper.patch patches.suse/Btrfs-fix-btrfs_write_inode-vs-delayed-iput-deadlock.patch @@ -39133,6 +39138,7 @@ patches.suse/8781-drm-scheduler-fix-timeout-worker-setup-for-out-of-order-job-completions patches.suse/8782-drm-scheduler-fix-param-documentation patches.suse/8783-drm-amdgpu-sriov-give-8s-for-recover-vram-under-runtime + patches.suse/media-vim2m-Remove-surplus-name-initialization.patch patches.suse/media-mem2mem-Remove-excessive-try_run-call patches.suse/media-tm6000-add-error-handling-for-dvb_register_ada.patch patches.suse/media-Revert-media-tvp5150-fix-pad-format-frame-heig.patch @@ -39408,6 +39414,7 @@ patches.suse/0004-ARM-module-fix-modsign-build-error.patch patches.suse/powerpc-pci-Remove-legacy-debug-code.patch patches.suse/powerpc-kdump-Handle-crashkernel-memory-reservation-.patch + patches.suse/powerpc-Remove-Power8-DD1-from-cputable.patch patches.suse/powerpc-xive-Replace-msleep-x-with-msleep-OPAL_BUSY_.patch patches.suse/powerpc-64s-Remove-POWER9-DD1-support.patch patches.suse/powerpc-powernv-Move-TCE-manupulation-code-to-its-ow.patch @@ -41548,6 +41555,7 @@ patches.suse/x86-mce-add-macros-for-the-corrected-error-count-bit-field.patch patches.suse/sched-numa-remove-unused-code-from-update_numa_stats.patch patches.suse/sched-numa-remove-unused-nr_running-field.patch + patches.suse/sched-core-Fix-comment-regarding-nr_iowait_cpu-and-g.patch patches.suse/x86-fsgsbase-64-fix-ptrace-to-read-the-fs-gs-base-accurately.patch patches.suse/x86-fsgsbase-64-introduce-fs-gs-base-helper-functions.patch patches.suse/x86-fsgsbase-64-make-ptrace-use-the-new-fs-gs-base-helpers.patch @@ -42605,6 +42613,7 @@ patches.suse/0001-ACPI-property-Allow-multiple-property-compatible-_DS.patch patches.suse/0001-PCI-ACPI-Whitelist-D3-for-more-PCIe-hotplug-ports.patch patches.suse/PCI-ERR-Remove-duplicated-include-from-err.c.patch + patches.suse/PCI-ACPI-Mark-expected-switch-fall-through.patch patches.suse/PCI-Remove-pci_unmap_addr-wrappers-for-DMA-API.patch patches.suse/PCI-Add-Device-IDs-for-Intel-GPU-spurious-interrupt-.patch patches.suse/PCI-MSI-Warn-and-return-error-if-driver-enables-MSI-.patch @@ -42901,6 +42910,7 @@ patches.suse/s390-sles15sp1-00-07-26-s390-doc-detailed-specifications-for-AP-virtualizati.patch patches.suse/KVM-PPC-Validate-all-tces-before-updating-tables.patch patches.suse/KVM-PPC-Validate-TCEs-against-preregistered-memory-p.patch + patches.suse/KVM-PPC-Propagate-errors-to-the-guest-when-failed-in.patch patches.suse/KVM-PPC-Remove-redundand-permission-bits-removal.patch patches.suse/kvm-s390-fix-locking-for-crypto-setting-error-path.patch patches.suse/kvm-s390-tracing-apcb-changes.patch @@ -46815,6 +46825,7 @@ patches.suse/mm-page_alloc-fix-a-division-by-zero-error-when-boosting-watermarks-v2.patch patches.suse/tmpfs-fix-link-accounting-when-a-tmpfile-is-linked-i.patch patches.suse/arm64-fix-SSBS-sanitization.patch + patches.suse/arm64-Relax-GIC-version-check-during-early-boot.patch patches.suse/libceph-handle-an-empty-authorize-reply.patch patches.suse/ceph-avoid-repeatedly-adding-inode-to-mdsc-snap_flush_list.patch patches.suse/clk-sunxi-ng-v3s-Fix-TCON-reset-de-assert-bit.patch @@ -47329,6 +47340,7 @@ patches.suse/ALSA-usb-audio-Add-quirk-for-MOTU-MicroBook-II.patch patches.suse/hpet-Fix-missing-character-in-the-__setup-code-of-hp.patch patches.suse/applicom-Fix-potential-Spectre-v1-vulnerabilities.patch + patches.suse/io-64-nonatomic-add-io-read-write-64-be-_lo_hi-_hi_l.patch patches.suse/nvmem-allow-to-select-i.MX-nvmem-driver-for-i.MX-7D.patch patches.suse/parport_pc-fix-find_superio-io-compare-code-should-u.patch patches.suse/intel_th-Don-t-reference-unassigned-outputs.patch @@ -47836,7 +47848,10 @@ patches.suse/scsi-cxgb4i-validate-tcp-sequence-number-only-if-chip-version-t5 patches.suse/dm-fix-to_sector-for-32bit.patch patches.suse/dm-integrity-limit-the-rate-of-error-messages.patch + patches.suse/arm64-Fix-HCR.TGE-status-for-NMI-contexts.patch patches.suse/0002-lib-raid6-use-vdupq_n_u8-to-avoid-endianness-warning.patch + patches.suse/arm64-debug-Don-t-propagate-UNKNOWN-FAR-into-si_code-for-debug-signals.patch + patches.suse/arm64-debug-Ensure-debug-handlers-check-triggering-exception-level.patch patches.suse/iommu-vt-d-check-identity-map-for-hot-added-devices patches.suse/iommu-vt-d-disable-ats-support-on-untrusted-devices patches.suse/iommu-vt-d-fix-null-pointer-reference-in-intel_svm_bind_mm @@ -48222,6 +48237,7 @@ patches.suse/0001-s390-qeth-be-drop-monitor-friendly.patch patches.suse/mlxsw-core-mlxsw-core-avoid-Wint-in-bool-context-war.patch patches.suse/net-stmmac-fix-memory-corruption-with-large-MTUs.patch + patches.suse/net-sysfs-call-dev_hold-if-kobject_init_and_add-succ.patch patches.suse/tcp-do-not-use-ipv6-header-for-ipv4-flow.patch patches.suse/dccp-do-not-use-ipv6-header-for-ipv4-flow.patch patches.suse/net-packet-Set-__GFP_NOWARN-upon-allocation-in-alloc.patch @@ -48484,6 +48500,7 @@ patches.suse/x86-perf-amd-remove-need-to-check-running-bit-in-nmi-handler.patch patches.suse/sched-do-not-re-read-h_load_next-during-hierarchical-load-calculation.patch patches.suse/arm64-backtrace-Don-t-bother-trying-to-unwind-the-us.patch + patches.suse/arm64-futex-Fix-FUTEX_WAKE_OP-atomic-ops-with-non-zero-result-value.patch patches.suse/powerpc-vdso32-fix-CLOCK_MONOTONIC-on-PPC64.patch patches.suse/PCI-Add-function-1-DMA-alias-quirk-for-Marvell-9170-.patch patches.suse/0001-PCI-pciehp-Ignore-Link-State-Changes-after-powering-.patch @@ -48575,6 +48592,7 @@ patches.suse/drm-amdgpu-gmc9-fix-VM_L2_CNTL3-programming.patch patches.suse/drm-amd-display-If-one-stream-full-updates-full-upda.patch patches.suse/crypto-x86-poly1305-fix-overflow-during-partial-redu.patch + patches.suse/arm64-futex-Restore-oldval-initialization-to-work-around-buggy-compilers.patch patches.suse/Input-elan_i2c-add-hardware-ID-for-multiple-Lenovo-l.patch patches.suse/HID-input-add-mapping-for-Expose-Overview-key.patch patches.suse/HID-input-add-mapping-for-keyboard-Brightness-Up-Dow.patch @@ -48767,7 +48785,13 @@ patches.suse/s390-enable-processes-for-mio-instructions patches.suse/s390-unwind-introduce-stack-unwind-api.patch patches.suse/s390-ftrace-use-have_function_graph_ret_addr_ptr.patch + patches.suse/arm64-Clear-OSDLR_EL1-on-CPU-boot.patch + patches.suse/arm64-Save-and-restore-OSDLR_EL1-across-suspend-resume.patch + patches.suse/arm64-compat-Reduce-address-limit.patch + patches.suse/arm64-Fix-size-of-__early_cpu_boot_status.patch patches.suse/0001-locking-futex-Allow-low-level-atomic-operations-to-r.patch + patches.suse/arm64-futex-Bound-number-of-LDXR-STXR-loops-in-FUTEX_WAKE_OP.patch + patches.suse/arm64-futex-Avoid-copying-out-uninitialised-stack-in-failed-cmpxchg.patch patches.suse/arm64-Provide-a-command-line-to-disable-spectre_v2-m.patch patches.suse/arm64-Add-sysfs-vulnerability-show-for-spectre-v1.patch patches.suse/arm64-add-sysfs-vulnerability-show-for-meltdown.patch @@ -48825,6 +48849,7 @@ patches.suse/hwrng-stm32-fix-unbalanced-pm_runtime_enable.patch patches.suse/crypto-ccp-Do-not-free-psp_master-when-PLATFORM_INIT.patch patches.suse/crypto-arm-aes-neonbs-don-t-access-already-freed-wal.patch + patches.suse/crypto-arm64-aes-neonbs-don-t-access-already-freed-walk.iv.patch patches.suse/crypto-vmx-return-correct-error-code-on-failed-setke.patch patches.suse/crypto-gcm-fix-incompatibility-between-gcm-and-gcm_b.patch patches.suse/crypto-ccm-fix-incompatibility-between-ccm-and-ccm_b.patch @@ -50026,7 +50051,9 @@ patches.suse/usbnet-ipheth-fix-racing-condition.patch patches.suse/ipv6-Consider-sk_bound_dev_if-when-binding-a-raw-soc.patch patches.suse/usbnet-fix-kernel-crash-after-disconnect.patch + patches.suse/arm64-iommu-handle-non-remapped-addresses-in-mmap-and-get_sgtable.patch patches.suse/drivers-perf-arm_spe-don-t-error-on-high-order-pages-for-aux-buf.patch + patches.suse/arm64-mm-Inhibit-huge-vmap-with-ptdump.patch patches.suse/drm-vmwgfx-Don-t-send-drm-sysfs-hotplug-events-on-in.patch patches.suse/0001-drm-vmwgfx-NULL-pointer-dereference-from-vmw_cmd_dx_.patch patches.suse/drm-vmwgfx-integer-underflow-in-vmw_cmd_dx_set_shade.patch @@ -50491,6 +50518,7 @@ patches.suse/Documentation-ABI-Document-umwait-control-sysfs-inte.patch patches.suse/0001-x86-ptrace-Fix-possible-spectre-v1-in-ptrace_get_deb.patch patches.suse/x86-tls-fix-possible-spectre-v1-in-do_get_thread_area.patch + patches.suse/sched-core-Add-__sched-tag-for-io_schedule.patch patches.suse/x86-alternatives-add-int3_emulate_call-selftest.patch patches.suse/proc-add-proc-pid-arch_status patches.suse/x86-process-add-avx-512-usage-elapsed-time-to-proc-pid-arch_status @@ -51446,6 +51474,7 @@ patches.suse/nvme-fix-multipath-crash-when-ANA-is-deactivated.patch patches.suse/btrfs-fix-extent_state-leak-in-btrfs_lock_and_flush_.patch patches.suse/arm64-Force-SSBS-on-context-switch.patch + patches.suse/arm64-entry-SP-Alignment-Fault-doesn-t-write-to-FAR_EL1.patch patches.suse/ACPI-IORT-Fix-off-by-one-check-in-iort_dev_find_its_.patch patches.suse/drm-msm-stop-abusing-dma_map-unmap-for-cache.patch patches.suse/drm-silence-variable-conn-set-but-not-used.patch @@ -51511,6 +51540,9 @@ patches.suse/s390-dasd-fix-endless-loop-after-read-unit-address-c.patch patches.suse/scsi-mpt3sas-Use-63-bit-DMA-addressing-on-SAS35-HBA.patch patches.suse/scsi-qla2xxx-Fix-possible-fcport-null-pointer-derefe.patch + patches.suse/arm64-compat-Allow-single-byte-watchpoints-on-all-addresses.patch + patches.suse/arm64-cpufeature-Fix-feature-comparison-for-CTR_EL0.-CWG-ERG.patch + patches.suse/arm64-kprobes-Recover-pstate.D-in-single-step-exception-handler.patch patches.suse/0001-xen-swiotlb-fix-condition-for-calling-xen_destroy_co.patch patches.suse/drm-i915-perf-fix-ICL-perf-register-offsets.patch patches.suse/drm-i915-perf-ensure-we-keep-a-reference-on-the-driv.patch @@ -52814,6 +52846,7 @@ patches.suse/Revert-drm-radeon-Fix-EEH-during-kexec.patch patches.suse/drm-edid-Add-6-bpc-quirk-for-SDC-panel-in-Lenovo-G50.patch patches.suse/0001-drm-msm-dsi-Implement-reset-correctly.patch + patches.suse/arm64-hibernate-check-pgd-table-allocation.patch patches.suse/PCI-PM-Fix-pci_power_up.patch patches.suse/cpufreq-Avoid-cpufreq_suspend-deadlock-on-system-shu.patch patches.suse/ACPI-CPPC-Set-pcc_data-pcc_ss_id-to-NULL-in-acpi_cpp.patch @@ -53149,6 +53182,7 @@ patches.suse/iommu-vt-d-fix-qi_dev_iotlb_pfsid-and-qi_dev_eiotlb_pfsid-macros patches.suse/gpiolib-acpi-Add-Terra-Pad-1061-to-the-run_edge_even.patch patches.suse/gpio-max77620-Fixup-debounce-delays.patch + patches.suse/arm64-uaccess-Ensure-PAN-is-re-enabled-after-unhandled-uaccess-fault.patch patches.suse/0001-drm-amd-powerplay-issue-no-PPSMC_MSG_GetCurrPkgPwr-o.patch patches.suse/0002-drm-i915-pmu-Frequency-is-reported-as-accumulated-cy.patch patches.suse/mm-ksm-c-don-t-warn-if-page-is-still-mapped-in-remove_stable_node.patch @@ -53259,6 +53293,7 @@ patches.suse/crypto-ecdh-fix-big-endian-bug-in-ECC-library.patch patches.suse/crypto-crypto4xx-fix-double-free-in-crypto4xx_destro.patch patches.suse/crypto-tgr192-remove-unneeded-semicolon.patch + patches.suse/crypto-virtio-deal-with-unsupported-input-sizes.patch patches.suse/mvpp2-remove-misleading-comment.patch patches.suse/0002-net-phy-broadcom-Fix-RGMII-delays-configuration-for-.patch patches.suse/net-ena-change-num_queues-to-num_io_queues-for-clari.patch @@ -53278,6 +53313,7 @@ patches.suse/dpaa_eth-add-newline-in-dev_err-msg.patch patches.suse/Bluetooth-hci_core-fix-init-for-HCI_USER_CHANNEL.patch patches.suse/bpf-stackmap-Fix-deadlock-with-rq_lock-in-bpf_get_st.patch + patches.suse/i40e-Refactoring-VF-MAC-filters-counting-to-make-mor.patch patches.suse/0003-net-dsa-LAN9303-select-REGMAP-when-LAN9303-enable.patch patches.suse/e1000e-Add-support-for-Comet-Lake.patch patches.suse/e1000e-Use-rtnl_lock-to-prevent-race-conditions-betw.patch @@ -53798,6 +53834,7 @@ patches.suse/PCI-PTM-Remove-spurious-d-from-granularity-message.patch patches.suse/PCI-MSI-Fix-incorrect-MSI-X-masking-on-resume.patch patches.suse/PCI-PM-Clear-PCIe-PME-Status-even-for-legacy-power-m.patch + patches.suse/PCI-switchtec-Read-all-64-bits-of-part_event_bitmap.patch patches.suse/PCI-Fix-Intel-ACS-quirk-UPDCR-register-address.patch patches.suse/PCI-Add-DMA-alias-quirk-for-Intel-VCA-NTB.patch patches.suse/PCI-Apply-Cavium-ACS-quirk-to-ThunderX2-and-ThunderX.patch @@ -54178,6 +54215,7 @@ patches.suse/x86-resctrl-fix-potential-memory-leak.patch patches.suse/drm-i915-Add-missing-include-file-linux-math64.h.patch patches.suse/sh_eth-check-sh_eth_cpu_data-dual_port-when-dumping-.patch + patches.suse/i40e-Fix-virtchnl_queue_select-bitmap-validation.patch patches.suse/ixgbevf-Remove-limit-of-10-entries-for-unicast-filte.patch patches.suse/net-tls-fix-async-operation.patch patches.suse/qmi_wwan-Add-support-for-Quectel-RM500Q.patch @@ -54252,6 +54290,10 @@ patches.suse/firestream-fix-memory-leaks.patch patches.suse/do_last-fetch-directory--i_mode-and--i_uid-before-its-too-late.patch patches.suse/scsi-fnic-do-not-queue-commands-during-fwreset.patch + patches.suse/arm64-kbuild-remove-compressed-images-on-make-ARCH-arm64-dist-clean.patch + patches.suse/arm64-cpufeature-Fix-the-type-of-no-FP-SIMD-capability.patch + patches.suse/arm64-cpufeature-Set-the-FP-SIMD-compat-HWCAP-bits-properly.patch + patches.suse/arm64-ptrace-nofpsimd-Fail-FP-SIMD-regset-operations.patch patches.suse/EDAC-skx_common-downgrade-message-importance-on-miss.patch patches.suse/x86-mce-amd-edac-mce_amd-add-new-load-store-unit-mcatype.patch patches.suse/edac-mce_amd-always-load-on-smca-systems.patch @@ -54413,6 +54455,7 @@ patches.suse/pinctrl-sh-pfc-sh7269-Fix-CAN-function-GPIOs.patch patches.suse/pinctrl-baytrail-Do-not-clear-IRQ-flags-on-direct-ir.patch patches.suse/usbip-Fix-unsafe-unaligned-pointer-usage.patch + patches.suse/usb-dwc3-gadget-Don-t-send-unintended-link-state-cha.patch patches.suse/usb-dwc2-Fix-IN-FIFO-allocation.patch patches.suse/usb-gadget-legacy-set-max_speed-to-super-speed.patch patches.suse/usb-gadget-udc-fix-possible-sleep-in-atomic-context-.patch @@ -54703,6 +54746,7 @@ patches.suse/kconfig-fix-broken-dependency-in-randconfig-generate.patch patches.suse/arm64-ssbs-Fix-context-switch-when-SSBS-is-present-o.patch patches.suse/drm-msm-Set-dma-maximum-segment-size-for-mdss.patch + patches.suse/0001-drm-vgem-Close-use-after-free-race-in-vgem_gem_creat.patch patches.suse/ALSA-usb-audio-Apply-48kHz-fixed-rate-playback-for-J.patch patches.suse/ALSA-usb-audio-Fix-UAC2-3-effect-unit-parsing.patch patches.suse/0001-ALSA-usb-audio-Apply-sample-rate-quirk-for-Audioengi.patch @@ -54712,6 +54756,7 @@ patches.suse/qmi_wwan-re-add-DW5821e-pre-production-variant.patch patches.suse/qmi_wwan-unconditionally-reject-2-ep-interfaces.patch patches.suse/core-Don-t-skip-generic-XDP-program-execution-for-cl.patch + patches.suse/i40e-Fix-the-conditional-for-i40e_vc_validate_vqs_bi.patch patches.suse/net-smc-fix-leak-of-kernel-memory-to-user-space.patch patches.suse/net-ena-fix-potential-crash-when-rxfh-key-is-NULL.patch patches.suse/net-ena-fix-uses-of-round_jiffies.patch @@ -55031,6 +55076,8 @@ patches.suse/iio-magnetometer-ak8974-Fix-negative-raw-values-in-s.patch patches.suse/intel_th-Fix-user-visible-error-codes.patch patches.suse/intel_th-pci-Add-Elkhart-Lake-CPU-support.patch + patches.suse/arm64-smp-fix-smp_send_stop-behaviour.patch + patches.suse/arm64-smp-fix-crash_smp_send_stop-behaviour.patch patches.suse/nvme-rdma-Avoid-double-freeing-of-async-event-data.patch patches.suse/memcg-fix-null-pointer-dereference-in-_mem_cgroup_usage_unregister_event.patch patches.suse/x86-mm-split-vmalloc_sync_all.patch @@ -55508,6 +55555,7 @@ patches.suse/watchdog-reset-last_hw_keepalive-time-at-start.patch patches.suse/ceph-check-if-file-lock-exists-before-sending-unlock-request.patch patches.suse/powerpc-pseries-ddw-Extend-upper-limit-for-huge-DMA-.patch + patches.suse/arm64-armv8_deprecated-Fix-undef_hook-mask-for-thumb-setend.patch patches.suse/s390-cio-avoid-duplicated-add-uevents patches.suse/s390-cio-generate-delayed-uevent-for-vfio-ccw-subchannels patches.suse/block-fix-busy-device-checking-in-blk_drop_partition.patch @@ -55767,6 +55815,7 @@ patches.suse/net-mlx4_core-Fix-use-of-ENOSPC-around-mlx4_counter_.patch patches.suse/nfp-abm-fix-a-memory-leak-bug.patch patches.suse/net-stricter-validation-of-untrusted-gso-packets.patch + patches.suse/arm64-hugetlb-avoid-potential-NULL-dereference.patch patches.suse/tracing-add-a-vmalloc_sync_mappings-for-safe-measure.patch patches.suse/mm-page_alloc-fix-watchdog-soft-lockups-during-set_zone_contiguous.patch patches.suse/scripts-decodecode-fix-trapping-instruction-formatti.patch @@ -55814,6 +55863,7 @@ patches.suse/ALSA-hda-realtek-Enable-headset-mic-of-ASUS-UX581LV-.patch patches.suse/ALSA-hda-realtek-Add-COEF-workaround-for-ASUS-ZenBoo.patch patches.suse/ALSA-hda-realtek-Limit-int-mic-boost-for-Thinkpad-T5.patch + patches.suse/arm64-fix-the-flush_icache_range-arguments-in-machine_kexec.patch patches.suse/i40iw-Fix-error-handling-in-i40iw_manage_arp_cache.patch patches.suse/IB-mlx4-Test-return-value-of-calls-to-ib_get_cached_.patch patches.suse/IB-hfi1-Fix-another-case-where-pq-is-left-on-waitlis.patch @@ -56288,6 +56338,7 @@ patches.suse/mtd-spi-nor-fix-kernel-doc-for-spi_nor-reg_proto.patch patches.suse/mtd-spi-nor-fix-kernel-doc-for-spi_nor-info.patch patches.suse/crypto-virtio-Fix-src-dst-scatterlist-calculation-in.patch + patches.suse/crypto-virtio-Fix-dest-length-calculation-in-__virti.patch patches.suse/ACPI-PM-Avoid-using-power-resources-if-there-are-non.patch patches.suse/sunrpc-svcauth_gss_register_pseudoflavor-must-reject.patch patches.suse/sunrpc-clean-up-properly-in-gss_mech_unregister.patch @@ -56332,6 +56383,7 @@ patches.suse/rocker-fix-incorrect-error-handling-in-dma_rings_ini.patch patches.suse/tcp-grow-window-for-OOO-packets-only-for-SACK-flows.patch patches.suse/e1000e-Do-not-wake-up-the-system-via-WOL-if-device-w.patch + patches.suse/arm64-hw_breakpoint-Don-t-invoke-overflow-handler-on-uaccess-watchpoints.patch patches.suse/libceph-don-t-omit-recovery_deletes-in-target_copy.patch patches.suse/0001-drm-i915-icl-Fix-hotplug-interrupt-disabling-after-s.patch patches.suse/0001-drm-amdgpu-Replace-invalid-device-ID-with-a-valid-de.patch @@ -56413,6 +56465,7 @@ patches.suse/iommu-vt-d-enable-pci-acs-for-platform-opt-in-hint patches.suse/ACPI-configfs-Disallow-loading-ACPI-tables-when-lock.patch patches.suse/ACPI-sysfs-Fix-pm_profile_attr-type.patch + patches.suse/arm64-perf-Report-the-PC-value-in-REGS_ABI_32-mode.patch patches.suse/0007-dm-zoned-assign-max_io_len-correctly.patch patches.suse/0008-dm-writecache-correct-uncommitted_block-when-discard.patch patches.suse/0009-dm-writecache-add-cond_resched-to-loop-in-persistent.patch @@ -56484,6 +56537,8 @@ patches.suse/0001-drm-mediatek-Check-plane-visibility-in-atomic_update.patch patches.suse/0001-drm-radeon-fix-double-free.patch patches.suse/s390-mm-fix-huge-pte-soft-dirty-copying + patches.suse/KVM-arm64-Fix-definition-of-PAGE_HYP_DEVICE.patch + patches.suse/arm64-kgdb-Fix-single-step-exception-handling-oops.patch patches.suse/gpio-arizona-handle-pm_runtime_get_sync-failure-case.patch patches.suse/pinctrl-amd-fix-npins-for-uart0-in-kerncz_groups.patch patches.suse/nbd-Fix-memory-leak-in-nbd_add_socket.patch @@ -56552,6 +56607,7 @@ patches.suse/spi-spi-sun6i-sun6i_spi_transfer_one-fix-setting-of-.patch patches.suse/fuse-fix-parameter-for-fs_ioc_-get-set-flags.patch patches.suse/nvme-explicitly-update-mpath-disk-capacity-on-revali.patch + patches.suse/arm64-ptrace-Override-SPSR.SS-when-single-stepping-is-enabled.patch patches.suse/xprtrdma-fix-incorrect-header-size-calculations.patch patches.suse/powerpc-book3s64-pkeys-Fix-pkey_access_permitted-for.patch patches.suse/hwmon-aspeed-pwm-tacho-Avoid-possible-buffer-overflo.patch @@ -56642,6 +56698,7 @@ patches.suse/ALSA-hda-Workaround-for-spurious-wakeups-on-some-Int.patch patches.suse/ALSA-hda-fix-NULL-pointer-dereference-during-suspend.patch patches.suse/ALSA-hda-realtek-Fixed-HP-right-speaker-no-sound.patch + patches.suse/arm64-csum-Fix-handling-of-bad-packets.patch patches.suse/net-hns3-fix-a-TX-timeout-issue.patch patches.suse/usb-hso-check-for-return-value-in-hso_serial_common_.patch patches.suse/net-lan78xx-add-missing-endpoint-sanity-check.patch @@ -56665,6 +56722,7 @@ patches.suse/net-mlx5e-fix-bpf_prog-reference-count-leaks-in-mlx5.patch patches.suse/0006-af_key-pfkey_dump-needs-parameter-validation.patch patches.suse/bpf-Fix-map-leak-in-HASH_OF_MAPS-map.patch + patches.suse/vxlan-fix-memleak-of-fdb.patch patches.suse/kvm-svm-fix-disable-pause-loop-exit-pause-filtering-capability-on-svm patches.suse/x86-i8259-use-printk_deferred-to-prevent-deadlock.patch patches.suse/0001-btrfs-inode-refactor-the-parameters-of-insert_reserv.patch @@ -56798,6 +56856,7 @@ patches.suse/drm-msm-ratelimit-crtc-event-overflow-error.patch patches.suse/0058-amd-xgbe-Convert-to-generic-power-management.patch patches.suse/0014-net-mlx5e-vxlan-Use-RCU-for-vxlan-table-lookup.patch + patches.suse/i40e-Remove-scheduling-while-atomic-possibility.patch patches.suse/ena_netdev-use-generic-power-management.patch patches.suse/0005-ipvs-allow-connection-reuse-for-unconfirmed-conntrac.patch patches.suse/0004-net-make-symbol-flush_works-static.patch @@ -57033,11 +57092,13 @@ patches.suse/tracing-use-trace_sched_process_free-instead-of-exit-for-pid-tracing.patch patches.suse/PCI-ASPM-Add-missing-newline-in-sysfs-policy.patch patches.suse/PCI-Fix-pci_cfg_wait-queue-locking-problem.patch + patches.suse/PCI-Add-device-even-if-driver-attach-failed.patch patches.suse/PCI-Fix-pci_create_slot-reference-count-leak.patch patches.suse/PCI-Release-IVRS-table-in-AMD-ACS-quirk.patch patches.suse/PCI-switchtec-Add-missing-__iomem-and-__user-tags-to.patch patches.suse/PCI-switchtec-Add-missing-__iomem-tag-to-fix-sparse-.patch patches.suse/PCI-qcom-Add-missing-ipq806x-clocks-in-PCIe-driver.patch + patches.suse/PCI-qcom-Change-duplicate-PCI-reset-to-phy-reset.patch patches.suse/PCI-qcom-Add-missing-reset-for-ipq806x.patch patches.suse/PCI-qcom-Define-some-PARF-params-needed-for-ipq8064-.patch patches.suse/PCI-qcom-Add-support-for-tx-term-offset-for-rev-2.1..patch @@ -57376,6 +57437,8 @@ patches.suse/hdlc_ppp-add-range-checks-in-ppp_cp_parse_cr.patch patches.suse/s390-qeth-delay-draining-the-tx-buffers patches.suse/net-DCB-Validate-DCB_ATTR_DCB_BUFFER-argument.patch + patches.suse/i40e-fix-return-of-uninitialized-aq_ret-in-i40e_set_.patch + patches.suse/i40e-always-propagate-error-value-in-i40e_set_vsi_pr.patch patches.suse/tipc-use-skb_unshare-instead-in-tipc_buf_append.patch patches.suse/ipv4-Update-exception-handling-for-multipath-routes-.patch patches.suse/geneve-add-transport-ports-in-route-lookup-for-genev.patch @@ -57418,6 +57481,7 @@ patches.suse/Input-i8042-add-nopnp-quirk-for-Acer-Aspire-5-A515.patch patches.suse/i2c-cpm-Fix-i2c_ram-structure.patch patches.suse/xen-events-don-t-use-chip_data-for-legacy-IRQs.patch + patches.suse/iavf-Fix-incorrect-adapter-get-in-iavf_resume.patch patches.suse/vmxnet3-fix-cksum-offload-issues-for-non-udp-tunnels.patch patches.suse/bonding-set-dev-needed_headroom-in-bond_setup_by_sla.patch patches.suse/team-set-dev-needed_headroom-in-team_setup_by_port.patch @@ -57491,6 +57555,8 @@ patches.suse/btrfs-fix-possible-infinite-loop-in-data-async-reclaim.patch patches.suse/btrfs-qgroup-fix-wrong-qgroup-metadata-reserve-for-d.patch patches.suse/btrfs-qgroup-fix-qgroup-meta-rsv-leak-for-subvolume-.patch + patches.suse/0001-btrfs-extent-tree-kill-BUG_ON-in-__btrfs_free_extent.patch + patches.suse/0002-btrfs-extent-tree-kill-the-BUG_ON-in-insert_inline_e.patch patches.suse/btrfs-tree-checker-fix-false-alert-caused-by-legacy-.patch patches.suse/btrfs-send-orphanize-first-all-conflicting-inodes-when-processing-references.patch patches.suse/btrfs-send-recompute-reference-path-after-orphanization-of-a-directory.patch @@ -57776,6 +57842,7 @@ patches.suse/powerpc-pseries-explicitly-reschedule-during-drmem_l.patch patches.suse/pseries-drmem-don-t-cache-node-id-in-drmem_lmb-struc.patch patches.suse/powerepc-book3s64-hash-Align-start-end-address-corre.patch + patches.suse/powerpc-numa-Prefer-node-id-queried-from-vphn.patch patches.suse/powerpc-powernv-elog-Fix-race-while-processing-OPAL-.patch patches.suse/powerpc-pseries-add-new-branch-prediction-security-b.patch patches.suse/powerpc-rtas-Restrict-RTAS-requests-from-userspace.patch @@ -57845,6 +57912,8 @@ patches.suse/ext4-limit-entries-returned-when-counting-fsmap-reco.patch patches.suse/ext4-fix-invalid-inode-checksum.patch patches.suse/x86-PCI-Fix-intel_mid_pci.c-build-error-when-ACPI-is.patch + patches.suse/PCI-iproc-Set-affinity-mask-on-MSI-interrupts.patch + patches.suse/PCI-qcom-Make-sure-PCIe-is-reset-before-init-for-rev.patch patches.suse/clk-ti-clockdomain-fix-static-checker-warning.patch patches.suse/clk-at91-remove-the-checking-of-parent_name.patch patches.suse/clk-at91-clk-main-update-key-before-writing-AT91_CKG.patch @@ -57885,6 +57954,7 @@ patches.suse/net-hdlc-In-hdlc_rcv-check-to-make-sure-dev-is-an-HD.patch patches.suse/net-hdlc_raw_eth-Clear-the-IFF_TX_SKB_SHARING-flag-a.patch patches.suse/ibmvnic-save-changed-mac-address-to-adapter-mac_addr.patch + patches.suse/netfilter-conntrack-connection-timeout-after-re-regi.patch patches.suse/netfilter-Drop-fragmented-ndisc-packets-assembled-in.patch patches.suse/tcp-fix-to-update-snd_wl1-in-bulk-receiver-fast-path.patch patches.suse/drm-ttm-fix-eviction-valuable-range-check.patch @@ -57941,6 +58011,9 @@ patches.suse/ACPI-dock-fix-enum-conversion-warning.patch patches.suse/device-property-Keep-secondary-firmware-node-seconda.patch patches.suse/device-property-Don-t-clear-secondary-pointer-for-sh.patch + patches.suse/arm64-berlin-Select-DW_APB_TIMER_OF.patch + patches.suse/arm64-avoid-Woverride-init-warning.patch + patches.suse/btrfs-tree-checker-fix-incorrect-printk-format.patch patches.suse/btrfs-fix-use-after-free-on-readahead-extent-after-f.patch patches.suse/nvme-fc-track-error_recovery-while-connecting.patch patches.suse/nvme-fc-remove-err_work-work-item.patch @@ -58005,6 +58078,7 @@ patches.suse/ALSA-usb-audio-add-usb-vendor-id-as-DSD-capable-for-.patch patches.suse/ALSA-usb-audio-Add-implicit-feedback-quirk-for-MODX.patch patches.suse/ALSA-usb-audio-Add-implicit-feedback-quirk-for-Qu-16.patch + patches.suse/scsi-scsi_dh_alua-Avoid-crash-during-alua_bus_detach.patch patches.suse/ceph-check-session-state-after-bumping-session-s_seq.patch patches.suse/nvme-introduce-nvme_sync_io_queues.patch patches.suse/nvme-rdma-avoid-race-between-time-out-and-tear-down.patch @@ -58034,6 +58108,7 @@ patches.suse/bpf-Zero-fill-re-used-per-cpu-map-element.patch patches.suse/net-af_iucv-fix-null-pointer-dereference-on-shutdown patches.suse/cosa-Add-missing-kfree-in-error-path-of-cosa_write.patch + patches.suse/i40e-Fix-MAC-address-setting-for-a-VF-via-Host-VM.patch patches.suse/igc-Fix-returning-wrong-statistics.patch patches.suse/0003-drm-gma500-Fix-out-of-bounds-access-to-struct-drm_de.patch patches.suse/mmc-sdhci-of-esdhc-Handle-pulse-width-detection-erra.patch @@ -58232,7 +58307,6 @@ patches.suse/pinctrl-baytrail-Avoid-clearing-debounce-value-when-.patch patches.suse/pinctrl-amd-remove-debounce-filter-setting-in-IRQ-ty.patch patches.suse/0001-pinctrl-aspeed-Fix-GPIO-requests-on-pass-through-ban.patch - patches.suse/elfcore-fix-building-with-clang.patch patches.suse/Input-cros_ec_keyb-send-scancodes-in-addition-to-key.patch patches.suse/Input-i8042-add-Acer-laptops-to-the-i8042-reset-list.patch patches.suse/Input-cm109-do-not-stomp-on-control-URB.patch @@ -58367,6 +58441,7 @@ patches.suse/spi-pic32-Don-t-leak-DMA-channels-in-probe-error-pat.patch patches.suse/spi-st-ssc4-Fix-unbalanced-pm_runtime_disable-in-pro.patch patches.suse/spi-davinci-Fix-use-after-free-on-unbind.patch + patches.suse/media-netup_unidvb-Don-t-leak-SPI-master-in-probe-er.patch patches.suse/memstick-fix-a-double-free-bug-in-memstick_check.patch patches.suse/memstick-r592-Fix-error-return-in-r592_probe.patch patches.suse/Revert-platform-x86-wmi-Destroy-on-cleanup-rather-th.patch @@ -58386,7 +58461,9 @@ patches.suse/cpufreq-scpi-Add-missing-MODULE_ALIAS.patch patches.suse/Revert-ACPI-resources-Use-AE_CTRL_TERMINATE-to-termi.patch patches.suse/PCI-Fix-pci_slot_release-NULL-pointer-dereference.patch + patches.suse/PCI-Fix-overflow-in-command-line-resource-alignment-.patch patches.suse/PCI-Add-function-1-DMA-alias-quirk-for-Marvell-9215-.patch + patches.suse/PCI-iproc-Fix-out-of-bound-array-accesses.patch patches.suse/btrfs-remove-err-variable-from-do_relocation.patch patches.suse/jfs-Fix-array-index-bounds-check-in-dbAdjTree.patch patches.suse/nfsd-Fix-message-level-for-normal-termination.patch @@ -58860,6 +58937,7 @@ patches.suse/0007-xen-netback-don-t-handle-error-by-BUG.patch patches.suse/0008-xen-scsiback-don-t-handle-error-by-BUG.patch patches.suse/0009-xen-blkback-fix-error-handling-in-xen_blkbk_map.patch + patches.suse/arm64-Extend-workaround-for-erratum-1024718-to-all-versions-of-Cortex-A55.patch patches.suse/msft-hv-2226-Drivers-hv-vmbus-Avoid-use-after-free-in-vmbus_onoff.patch patches.suse/kvm-do-not-assume-pte-is-writable-after-follow_pfn.patch patches.suse/x86-reboot-force-all-cpus-to-exit-vmx-root-if-vmx-is-supported.patch @@ -58869,6 +58947,7 @@ patches.suse/media-media-pci-Fix-memleak-in-empress_init.patch patches.suse/media-tm6000-Fix-memleak-in-tm6000_start_stream.patch patches.suse/media-pwc-Use-correct-device-for-DMA.patch + patches.suse/media-lmedm04-Fix-misuse-of-comma.patch patches.suse/media-qm1d1c0042-fix-error-return-code-in-qm1d1c0042.patch patches.suse/media-cx25821-Fix-a-bug-when-reallocating-some-dma-m.patch patches.suse/media-pxa_camera-declare-variable-when-DEBUG-is-defi.patch @@ -58985,6 +59064,9 @@ patches.suse/mm-fix-memory_failure-handling-of-dax-namespace-meta.patch patches.suse/0008-mm-rmap-fix-potential-pte_unmap-on-an-not-mapped-pte.patch patches.suse/x86-fix-seq_file-iteration-for-pat-memtype.c.patch + patches.suse/arm64-module-set-plt-section-addresses-to-0x0.patch + patches.suse/arm64-uprobe-Return-EOPNOTSUPP-for-AARCH32-instruction-probing.patch + patches.suse/arm64-Add-missing-ISB-after-invalidating-TLB-in-__primary_switch.patch patches.suse/cifs-New-optype-for-session-operations-.patch patches.suse/cifs-Fix-in-error-types-returned-for-out-of-credit-situations-.patch patches.suse/cifs-Fix-cifsacl-ACE-mask-for-group-and-others-.patch @@ -59149,6 +59231,7 @@ patches.suse/igb-check-timestamp-validity.patch patches.suse/can-peak_usb-Revert-can-peak_usb-add-forgotten-suppo.patch patches.suse/net-mlx5e-Fix-error-path-for-ethtool-set-priv-flag.patch + patches.suse/arm64-kdump-update-ppos-when-reading-elfcorehdr.patch patches.suse/RDMA-cxgb4-Fix-adapter-LE-hash-errors-while-destroyi.patch patches.suse/drm-msm-fix-shutdown-hook-in-case-GPU-components-fai.patch patches.suse/bus-omap_l3_noc-mark-l3-irqs-as-IRQF_NO_THREAD.patch @@ -59225,6 +59308,7 @@ patches.suse/usbip-vudc-synchronize-sysfs-code-paths.patch patches.suse/usbip-synchronize-event-handler-with-sysfs-code-path.patch patches.suse/dmaengine-dw-Make-it-dependent-to-HAS_IOMEM.patch + patches.suse/arm64-fix-inline-asm-in-load_unaligned_zeropad.patch patches.suse/s390-entry-save-the-caller-of-psw_idle.patch patches.suse/Input-i8042-fix-Pegatron-C15B-ID-entry.patch patches.suse/Input-nspire-keypad-enable-interrupts-only-when-open.patch @@ -59737,6 +59821,7 @@ patches.suse/ASoC-cs42l42-Regmap-must-use_single_read-write.patch patches.suse/ASoC-sti-sas-add-missing-MODULE_DEVICE_TABLE.patch patches.suse/ASoC-cs35l33-fix-an-error-code-in-probe.patch + patches.suse/fs-nfs-Use-fatal_signal_pending-instead-of-signal_pe.patch patches.suse/NFS-fix-an-incorrect-limit-in-filelayout_decode_layo.patch patches.suse/SUNRPC-in-case-of-backlog-hand-free-slots-directly-t.patch patches.suse/NFSv4-Fix-a-NULL-pointer-dereference-in-pnfs_mark_ma.patch @@ -59885,6 +59970,7 @@ patches.suse/media-siano-fix-device-register-error-path.patch patches.suse/media-s5p-g2d-Fix-a-memory-leak-on-ctx-fh.m2m_ctx.patch patches.suse/crypto-ccp-annotate-sev-firmware-file-names + patches.suse/crypto-ixp4xx-dma_unmap-the-correct-address.patch patches.suse/crypto-ux500-Fix-error-return-code-in-hash_hw_final.patch patches.suse/crypto-ccp-fix-a-resource-leak-in-an-error-handling-path.patch patches.suse/crypto-cavium-nitrox-Fix-an-error-rhandling-path-in-.patch @@ -60124,7 +60210,6 @@ patches.suse/watchdog-sc520_wdt-Fix-possible-use-after-free-in-wd.patch patches.suse/watchdog-Fix-possible-use-after-free-by-calling-del_.patch patches.suse/watchdog-aspeed-fix-hardware-timeout-calculation.patch - patches.suse/watchdog-iTCO_wdt-Account-for-rebooting-on-second-ti.patch patches.suse/power-supply-ab8500-Avoid-NULL-pointers.patch patches.suse/power-reset-gpio-poweroff-add-missing-MODULE_DEVICE_.patch patches.suse/power-supply-charger-manager-add-missing-MODULE_DEVI.patch @@ -60244,6 +60329,7 @@ patches.suse/smb3-rc-uninitialized-in-one-fallocate-path.patch patches.suse/clk-stm32f4-fix-post-divisor-setup-for-I2S-SAI-PLLs.patch patches.suse/media-rtl28xxu-fix-zero-length-control-request.patch + patches.suse/media-videobuf2-core-dequeue-if-start_streaming-fail.patch patches.suse/pcmcia-i82092-fix-a-null-pointer-dereference-bug.patch patches.suse/Bluetooth-defer-cleanup-of-resources-in-hci_unregist.patch patches.suse/nfp-update-ethtool-reporting-of-pauseframe-control.patch @@ -60347,7 +60433,12 @@ patches.suse/tty-hvc-replace-BUG_ON-with-negative-return-value.patch patches.suse/tty-serial-fsl_lpuart-fix-the-wrong-mapbase-value.patch patches.suse/usb-host-xhci-rcar-Don-t-reload-firmware-after-the-c.patch + patches.suse/media-uvc-don-t-do-DMA-on-stack.patch + patches.suse/media-rc-loopback-return-number-of-emitters-rather-t.patch + patches.suse/media-dvb-usb-fix-uninit-value-in-dvb_usb_adapter_dv.patch + patches.suse/media-dvb-usb-fix-uninit-value-in-vp702x_read_mac_ad.patch patches.suse/media-go7007-fix-memory-leak-in-go7007_usb_probe.patch + patches.suse/media-stkwebcam-fix-memory-leak-in-stk_camera_probe.patch patches.suse/0007-drm-gma500-Fix-end-of-loop-tests-for-list_for_each_e.patch patches.suse/drm-add-a-locked-version-of-drm_is_current_master.patch patches.suse/drm-serialize-drm_file.master-with-a-new-spinlock.patch @@ -60480,6 +60571,7 @@ patches.suse/powerpc-perf-Fix-the-check-for-SIAR-value.patch patches.suse/SUNRPC-Simplify-socket-shutdown-when-not-reusing-TCP.patch patches.suse/fuse-truncate-pagecache-on-atomic_o_trunc.patch + patches.suse/0002-backlight-pwm_bl-Improve-bootloader-kernel-device-ha.patch patches.suse/KVM-s390-index-kvm-arch.idle_mask-by-vcpu_idx patches.suse/net-hso-add-failure-handler-for-add_net_device.patch patches.suse/qlcnic-Remove-redundant-unlock-in-qlcnic_pinit_from_.patch @@ -60488,6 +60580,8 @@ patches.suse/SUNRPC-improve-error-response-to-over-size-gss-crede.patch patches.suse/mm-hugetlb-initialize-hugetlb_usage-in-mm_init.patch patches.suse/s390-unwind-use-current_frame_address-to-unwind-current-task.patch + patches.suse/0001-ARM-9110-1-oabi-compat-fix-oabi-epoll-sparse-warning.patch + patches.suse/0003-fbmem-don-t-allow-too-huge-resolutions.patch patches.suse/cifs-properly-invalidate-cached-root-handle-when-closing-it.patch patches.suse/time-Handle-negative-seconds-correctly-in-timespec64.patch patches.suse/drivers-base-cacheinfo-Get-rid-of-DEFINE_SMP_CALL_CA.patch @@ -60538,6 +60632,7 @@ patches.suse/scsi-csiostor-Add-module-softdep-on-cxgb4 patches.suse/ext4-fix-reserved-space-counter-leakage.patch patches.suse/ext4-fix-potential-infinite-loop-in-ext4_dx_readdir.patch + patches.suse/ovl-fix-missing-negative-dentry-check-in-ovl_rename.patch patches.suse/gve-Correct-available-tx-qpl-check.patch patches.suse/gve-Avoid-freeing-NULL-pointer.patch patches.suse/gve-Properly-handle-errors-in-gve_assign_qpl.patch @@ -60561,8 +60656,10 @@ patches.suse/platform-mellanox-mlxreg-io-Fix-argument-base-in-kst.patch patches.suse/nfc-nci-fix-the-UAF-of-rf_conn_info-object.patch patches.suse/mqprio-Correct-stats-in-mqprio_dump_class_stats.patch + patches.suse/isdn-cpai-check-ctr-cnr-to-avoid-array-index-out-of-bound.patch patches.suse/msft-hv-2444-net-mana-Fix-error-handling-in-mana_create_rxq.patch patches.suse/sctp-account-stream-padding-length-for-reconf-chunk.patch + patches.suse/Input-xpad-add-support-for-another-USB-ID-of-Nacon-G.patch patches.suse/USB-xhci-dbc-fix-tty-registration-race.patch patches.suse/xhci-Enable-trust-tx-length-quirk-for-Fresco-FL11-US.patch patches.suse/USB-serial-option-add-Telit-LE910Cx-composition-0x12.patch @@ -60573,7 +60670,6 @@ patches.suse/virtio-write-back-F_VERSION_1-before-validate patches.suse/ocfs2-fix-data-corruption-after-conversion-from-inli.patch patches.suse/ocfs2-mount-fails-with-buffer-overflow-in-strlen.patch - patches.suse/elfcore-correct-reference-to-CONFIG_UML.patch patches.suse/vfs-check-fd-has-read-access-in-kernel_read_file_from_fd.patch patches.suse/e1000e-Fix-packet-loss-on-Tiger-Lake-and-later.patch patches.suse/usbnet-sanity-check-for-maxpacket.patch @@ -60601,6 +60697,10 @@ patches.suse/x86-bugs-unconditionally-allow-spectre_v2-retpoline-amd.patch patches.suse/edac-amd64-handle-three-rank-interleaving-mode.patch patches.suse/edac-sb_edac-fix-top-of-high-memory-value-for-broadwell-haswell.patch + patches.suse/media-dvb-usb-fix-ununit-value-in-az6027_rc_query.patch + patches.suse/media-v4l2-ioctl-S_CTRL-output-the-right-value.patch + patches.suse/media-mtk-vpu-Fix-a-resource-leak-in-the-error-handl.patch + patches.suse/media-cx23885-Fix-snd_card_free-call-on-null-card-po.patch patches.suse/tracing-use-ps-format-string-to-print-symbols.patch patches.suse/crypto-qat-detect-PFVF-collision-after-ACK.patch patches.suse/crypto-qat-disregard-spurious-PFVF-interrupts.patch @@ -60616,10 +60716,23 @@ patches.suse/gve-Add-netif_set_xps_queue-call.patch patches.suse/gve-Allow-pageflips-on-larger-pages.patch patches.suse/gve-Track-RX-buffer-allocation-failures.patch + patches.suse/b43legacy-fix-a-lower-bounds-test.patch + patches.suse/b43-fix-a-lower-bounds-test.patch + patches.suse/mwifiex-Read-a-PCI-register-after-writing-the-TX-rin.patch + patches.suse/mwifiex-Send-DELBA-requests-according-to-spec.patch + patches.suse/ath9k-Fix-potential-interrupt-storm-on-queue-reset.patch + patches.suse/ath10k-fix-max-antenna-gain-unit.patch patches.suse/gve-Add-RX-context.patch patches.suse/gve-Implement-packet-continuation-for-RX.patch patches.suse/gve-Add-a-jumbo-frame-device-option.patch patches.suse/msft-hv-2459-net-mana-Allow-setting-the-number-of-queues-while-th.patch + patches.suse/libertas_tf-Fix-possible-memory-leak-in-probe-and-di.patch + patches.suse/libertas-Fix-possible-memory-leak-in-probe-and-disco.patch + patches.suse/wcn36xx-Fix-HT40-capability-for-2Ghz-band.patch + patches.suse/wcn36xx-add-proper-DMA-memory-barriers-in-rx-path.patch + patches.suse/ath6kl-fix-control-message-timeout.patch + patches.suse/ath6kl-fix-division-by-zero-in-send-path.patch + patches.suse/rtl8187-fix-control-message-timeouts.patch patches.suse/msft-hv-2473-net-mana-Fix-the-netdev_err-s-vPort-argument-in-mana.patch patches.suse/msft-hv-2475-net-mana-Improve-the-HWC-error-handling.patch patches.suse/msft-hv-2476-net-mana-Support-hibernation-and-kexec.patch @@ -60638,6 +60751,7 @@ patches.suse/USB-chipidea-fix-interrupt-deadlock.patch patches.suse/USB-iowarrior-fix-control-message-timeouts.patch patches.suse/USB-serial-keyspan-fix-memleak-on-probe-errors.patch + patches.suse/0004-video-fbdev-chipsfb-use-memset_io-instead-of-memset.patch patches.suse/powerpc-pseries-cpuhp-cache-node-corrections.patch patches.suse/powerpc-pseries-cpuhp-delete-add-remove_by_count-cod.patch patches.suse/powerpc-pseries-mobility-ignore-ibm-platform-facilit.patch @@ -60680,12 +60794,14 @@ patches.suse/scsi-lpfc-Allow-fabric-node-recovery-if-recovery-is-.patch patches.suse/scsi-lpfc-Update-lpfc-version-to-14.0.0.3.patch patches.suse/ocfs2-do-not-zero-pages-beyond-i_size.patch + patches.suse/0002-PCI-Do-not-enable-AtomicOps-on-VFs.patch patches.suse/s390-cio-make-ccw_device_dma_-more-robust patches.suse/s390-pci-add-s390_iommu_aperture-kernel-parameter patches.suse/quota-check-block-number-when-reading-the-block-in-q.patch patches.suse/quota-correct-error-number-in-free_dqentry.patch patches.suse/isofs-Fix-out-of-bound-access-for-corrupted-isofs-im.patch patches.suse/cifs-To-match-file-servers-make-sure-the-server-hostname-matches.patch + patches.suse/0003-video-backlight-Drop-maximum-brightness-override-for.patch patches.suse/fuse-annotate-lock-in-fuse_reverse_inval_entry.patch patches.suse/fuse-fix-page-stealing.patch patches.suse/xen-pciback-Fix-return-in-pm_ctrl_init.patch @@ -60703,6 +60819,7 @@ patches.suse/gve-fix-unmatched-u64_stats_update_end.patch patches.suse/cxgb4-fix-eeprom-len-when-diagnostics-not-implemente.patch patches.suse/ring-buffer-Protect-ring_buffer_reset-from-reentrancy.patch + patches.suse/Input-elantench-fix-misreporting-trackpoint-coordina.patch patches.suse/drm-nouveau-use-drm_dev_unplug-during-device-removal.patch patches.suse/drm-nouveau-Add-a-dedicated-mutex-for-the-clients-li.patch patches.suse/drm-nouveau-clean-up-all-clients-on-device-removal.patch @@ -60735,6 +60852,7 @@ patches.suse/cifs-fix-memory-leak-of-smb3_fs_context_dup-server_hostname.patch patches.suse/cifs-fix-potential-use-after-free-bugs.patch patches.suse/printk-Remove-printk.h-inclusion-in-percpu.h.patch + patches.suse/0005-parisc-sticon-fix-reverse-colors.patch patches.suse/btrfs-fix-memory-ordering-between-normal-and-ordered-work-functions.patch patches.suse/atlantic-Fix-OOB-read-and-write-in-hw_atl_utils_fw_r.patch patches.suse/iavf-prevent-accidental-free-of-filter-structure.patch @@ -60756,6 +60874,8 @@ patches.suse/xen-don-t-continue-xenstore-initialization-in-case-o.patch patches.suse/xen-detect-uninitialized-xenbus-in-xenbus_init.patch patches.suse/usb-dwc2-hcd_queue-Fix-use-of-floating-point-literal.patch + patches.suse/usb-hub-Fix-usb-enumeration-issue-due-to-address0-ra.patch + patches.suse/usb-hub-Fix-locking-issues-with-address0_mutex.patch patches.suse/USB-serial-option-add-Telit-LE910S1-0x9200-compositi.patch patches.suse/USB-serial-option-add-Fibocom-FM101-GL-variants.patch patches.suse/fuse-release-pipe-buf-after-last-use.patch @@ -60774,6 +60894,7 @@ patches.suse/scsi-lpfc-Fix-non-recovery-of-remote-ports-following.patch patches.suse/cifs-fix-missed-refcounting-of-ipc-tcon.patch patches.suse/x86-xen-add-xenpv_restore_regs_and_return_to_usermode.patch + patches.suse/usb-typec-tcpm-Wait-in-SNK_DEBOUNCED-until-disconnec.patch patches.suse/x86-sme-explicitly-map-new-efi-memmap-table-as-encrypted.patch patches.suse/net-cdc_ncm-Allow-for-dwNtbOutMaxSize-to-be-unset-or.patch patches.suse/gve-fix-for-null-pointer-dereference.patch @@ -60794,6 +60915,7 @@ patches.suse/net-usb-lan78xx-add-Allied-Telesis-AT29M2-AF.patch patches.suse/igb-Fix-removal-of-unicast-MAC-filters-of-VFs.patch patches.suse/USB-serial-option-add-Telit-FN990-compositions.patch + patches.suse/timekeeping-Really-make-sure-wall_to_monotonic-isn-t.patch patches.suse/xen-blkfront-harden-blkfront-against-event-channel-s.patch patches.suse/xen-netfront-harden-netfront-against-event-channel-s.patch patches.suse/xen-console-harden-hvc_xen-against-event-channel-sto.patch @@ -60808,17 +60930,34 @@ patches.suse/xhci-Fresco-FL1100-controller-should-not-have-BROKEN.patch patches.suse/net-usb-pegasus-Do-not-drop-long-Ethernet-frames.patch patches.suse/scsi-lpfc-Terminate-string-in-lpfc_debugfs_nvmeio_trc_write + patches.suse/Input-appletouch-initialize-work-before-device-regis.patch + patches.suse/Input-spaceball-fix-parsing-of-movement-data-packets.patch patches.suse/net-ena-Fix-undefined-state-when-tx-request-id-is-ou.patch patches.suse/net-ena-Fix-wrong-rx-request-id-by-resetting-device.patch patches.suse/net-ena-Fix-error-handling-when-calculating-max-IO-q.patch patches.suse/rndis_host-support-Hytera-digital-radios.patch patches.suse/i40e-Fix-for-displaying-message-regarding-NVM-versio.patch + patches.suse/i40e-Fix-incorrect-netdev-s-real-number-of-RX-TX-que.patch patches.suse/iavf-Fix-limit-of-total-number-of-queues-to-active-q.patch + patches.suse/ieee802154-atusb-fix-uninit-value-in-atusb_set_exten.patch patches.suse/tracing-Fix-check-for-trace_percpu_buffer-validity-in-get_trace_buf.patch patches.suse/RDMA-core-Don-t-infoleak-GRH-fields.patch patches.suse/cgroup-Use-open-time-credentials-for-process-migraton-perm-checks.patch patches.suse/cgroup-Allocate-cgroup_file_ctx-for-kernfs_open_file-priv.patch patches.suse/cgroup-Use-open-time-cgroup-namespace-for-process-migration-perm-checks.patch + patches.suse/arm64-clear_page-shouldn-t-use-DC-ZVA-when-DCZID_EL0.DZP-1.patch + patches.suse/random-fix-data-race-on-crng_node_pool.patch + patches.suse/media-em28xx-fix-memory-leak-in-em28xx_init_dev.patch + patches.suse/media-mceusb-fix-control-message-timeouts.patch + patches.suse/media-redrat3-fix-control-message-timeouts.patch + patches.suse/media-flexcop-usb-fix-control-message-timeouts.patch + patches.suse/media-cpia2-fix-control-message-timeouts.patch + patches.suse/media-em28xx-fix-control-message-timeouts.patch + patches.suse/media-pvrusb2-fix-control-message-timeouts.patch + patches.suse/media-s2255-fix-control-message-timeouts.patch + patches.suse/media-stk1160-fix-control-message-timeouts.patch + patches.suse/media-dmxdev-fix-UAF-when-dvb_register_device-fails.patch + patches.suse/media-dib0700-fix-undefined-behavior-in-tuner-shutdo.patch patches.suse/Bluetooth-bfusb-fix-division-by-zero-in-send-path.patch patches.suse/msft-hv-2486-net-mana-Add-XDP-support.patch patches.suse/ibmvnic-Update-driver-return-codes.patch @@ -60830,6 +60969,7 @@ patches.suse/gve-Implement-suspend-resume-shutdown.patch patches.suse/gve-Add-consumed-counts-to-ethtool-stats.patch patches.suse/msft-hv-2498-net-mana-Add-RX-fencing.patch + patches.suse/net-ethernet-mtk_eth_soc-fix-return-values-and-refac.patch patches.suse/net-ena-Change-return-value-of-ena_calc_io_queue_siz.patch patches.suse/net-ena-Add-capabilities-field-with-support-for-ENI-.patch patches.suse/net-ena-Change-ENI-stats-support-check-to-use-capabi.patch @@ -60839,6 +60979,9 @@ patches.suse/net-ena-Add-debug-prints-for-invalid-req_id-resets.patch patches.suse/net-ena-Change-the-name-of-bad_csum-variable.patch patches.suse/net-ena-Extract-recurring-driver-reset-code-into-a-f.patch + patches.suse/can-gs_usb-fix-use-of-uninitialized-variable-detach-.patch + patches.suse/ppp-ensure-minimum-packet-size-in-ppp_write.patch + patches.suse/fsl-fman-Check-for-null-pointer-after-calling-devm_i.patch patches.suse/net-mlx5e-Fix-page-DMA-map-unmap-attributes.patch patches.suse/net-mcs7830-handle-usb-read-errors-properly.patch patches.suse/select-Fix-indefinitely-sleeping-task-in-poll_schedu.patch @@ -60851,11 +60994,14 @@ patches.suse/ext4-avoid-trim-error-on-fs-with-small-groups.patch patches.suse/ext4-set-csum-seed-in-tmp-inode-while-migrating-to-extents.patch patches.suse/ext4-don-t-use-the-orphan-list-when-migrating-an-ino.patch + patches.suse/cputime-cpuacct-Include-guest-time-in-user-time-in-c.patch patches.suse/nvme-add-iopolicy-module-parameter.patch patches.suse/0001-usb-Add-Xen-pvUSB-protocol-description.patch patches.suse/0002-usb-Introduce-Xen-pvUSB-frontend-xen-hcd.patch patches.suse/usb-host-xen-hcd-add-missing-unlock-in-error-path.patch patches.suse/usb-ftdi-elan-fix-memory-leak-on-device-disconnect.patch + patches.suse/USB-Fix-slab-out-of-bounds-Write-bug-in-usb_hcd_poll.patch + patches.suse/USB-core-Fix-bug-in-resuming-hub-s-handling-of-wakeu.patch patches.suse/RDMA-bnxt_re-Scan-the-whole-bitmap-when-checking-if-.patch patches.suse/RDMA-hns-Validate-the-pkey-index.patch patches.suse/RDMA-core-Let-ib_find_gid-continue-search-even-after.patch @@ -60873,9 +61019,12 @@ patches.suse/scsi-lpfc-Update-lpfc-version-to-14.0.0.4.patch patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch patches.suse/powerpc-prom_init-Fix-improper-check-of-prom_getprop.patch + patches.suse/char-mwave-Adjust-io-port-register-size.patch patches.suse/PCI-Add-function-1-DMA-alias-quirk-for-Marvell-88SE9.patch patches.suse/livepatch-Avoid-CPU-hogging-with-cond_resched.patch patches.suse/tracing-kprobes-nmissed-not-showed-correctly-for-kretprobe.patch + patches.suse/Input-ti_am335x_tsc-set-ADCREFM-for-X-configuration.patch + patches.suse/Input-ti_am335x_tsc-fix-STEPCONFIG-setup-for-Z2.patch patches.suse/f2fs-fix-to-do-sanity-check-on-inode-type-during-gar.patch patches.suse/nfc-st21nfca-Fix-potential-buffer-overflows-in-EVT_T.patch patches.suse/s390-cpumf-Support-for-CPU-Measurement-Facility-CSVN-7 @@ -60897,6 +61046,7 @@ patches.suse/udf-Fix-NULL-ptr-deref-when-converting-from-inline-f.patch patches.suse/udf-Restore-i_lenAlloc-when-inode-expansion-fails.patch patches.suse/s390-hypfs-include-z-VM-guests-with-access-control-group-set + patches.suse/0005-video-hyperv_fb-Fix-validation-of-screen-resolution.patch patches.suse/scsi-zfcp-Fix-failed-recovery-on-gone-remote-port-with-non-NPIV-FCP-devices patches.suse/scsi-bnx2fc-Flush-destroy_work-queue-before-calling-bnx2fc_interface_put patches.suse/usb-typec-tcpm-Do-not-disconnect-while-receiving-VBU.patch @@ -60908,6 +61058,7 @@ patches.suse/cgroup-v1-Require-capabilities-to-set-release_agent.patch patches.suse/Revert-module-async-async_synchronize_full-on-module.patch patches.suse/gve-fix-the-wrong-AdminQ-buffer-queue-index-check.patch + patches.suse/scsi-bnx2fc-Make-bnx2fc_recv_frame-mp-safe patches.suse/IB-rdmavt-Validate-remote_addr-during-loopback-atomi.patch patches.suse/RDMA-mlx4-Don-t-continue-event-handler-after-memory-.patch patches.suse/edac-xgene-fix-deferred-probing.patch @@ -60919,11 +61070,17 @@ patches.suse/NFSD-Clamp-WRITE-offsets.patch patches.suse/tipc-improve-size-validations-for-received-domain-re.patch patches.suse/ixgbevf-Require-large-buffers-for-build_skb-on-82599.patch + patches.suse/netfilter-conntrack-move-synack-init-code-to-helper.patch + patches.suse/netfilter-conntrack-re-init-state-for-retransmitted-.patch patches.suse/gve-Recording-rx-queue-before-sending-to-napi.patch + patches.suse/bonding-pair-enable_port-with-slave_arr_updates.patch + patches.suse/usb-ulpi-Move-of_node_put-to-ulpi_dev_release.patch + patches.suse/usb-ulpi-Call-of_node_put-correctly.patch patches.suse/net-usb-ax88179_178a-Fix-out-of-bounds-accesses-in-R.patch patches.suse/USB-serial-ch341-add-support-for-GW-Instek-USB2.0-Se.patch patches.suse/USB-serial-option-add-ZTE-MF286D-modem.patch patches.suse/USB-serial-ftdi_sio-add-support-for-Brainboxes-US-15.patch + patches.suse/USB-serial-cp210x-add-NCR-Retail-IO-box-id.patch patches.suse/USB-serial-cp210x-add-CPI-Bulk-Coin-Recycler-id.patch patches.suse/scsi-lpfc-Remove-NVMe-support-if-kernel-has-NVME_FC-.patch patches.suse/scsi-lpfc-Reduce-log-messages-seen-after-firmware-do.patch @@ -60960,6 +61117,7 @@ patches.suse/x86-speculation-use-generic-retpoline-by-default-on-amd.patch patches.suse/x86-speculation-warn-about-spectre-v2-lfence-mitigation.patch patches.suse/x86-speculation-warn-about-eibrs-lfence-unprivileged-ebpf-smt.patch + patches.suse/fuse-fix-pipe-buffer-lifetime-for-direct_io.patch patches.suse/xen-xenbus-don-t-let-xenbus_grant_ring-remove-grants.patch patches.suse/xen-grant-table-add-gnttab_try_end_foreign_access.patch patches.suse/xen-blkfront-don-t-use-gnttab_query_foreign_access-f.patch @@ -60970,17 +61128,49 @@ patches.suse/xen-9p-use-alloc-free_pages_exact.patch patches.suse/xen-gnttab-fix-gnttab_end_foreign_access-without-pag.patch patches.suse/xen-netfront-react-properly-to-failing-gnttab_end_fo.patch + patches.suse/net-qlogic-check-the-return-value-of-dma_alloc_coher.patch + patches.suse/qed-return-status-of-qed_iov_get_link.patch patches.suse/esp-Fix-possible-buffer-overflow-in-ESP-transformati.patch + patches.suse/net-bcmgenet-Don-t-claim-WOL-when-its-not-available.patch + patches.suse/af_key-add-__GFP_ZERO-flag-for-compose_sadb_supporte.patch + patches.suse/Input-aiptek-properly-check-endpoint-type.patch + patches.suse/arm64-module-remove-NOLOAD-from-linker-script.patch + patches.suse/arm64-mm-avoid-fixmap-race-condition-when-create-pud-mapping.patch + patches.suse/hwrng-cavium-HW_RANDOM_CAVIUM-should-depend-on-ARCH_.patch + patches.suse/crypto-rsa-pkcs1pad-fix-buffer-overread-in-pkcs1pad_.patch + patches.suse/crypto-qat-don-t-cast-parameter-in-bit-operations.patch + patches.suse/hwrng-atmel-disable-trng-on-failure-path.patch + patches.suse/NFSD-prevent-underflow-in-nfssvc_decode_writeargs.patch + patches.suse/sched-debug-Remove-mpol_get-put-and-task_lock-unlock.patch patches.suse/printk-Add-panic_in_progress-helper.patch patches.suse/printk-disable-optimistic-spin-during-panic.patch + patches.suse/0008-video-fbdev-smscufx-Fix-null-ptr-deref-in-ufx_usb_pr.patch + patches.suse/0009-video-fbdev-atmel_lcdfb-fix-an-error-code-in-atmel_l.patch + patches.suse/0010-video-fbdev-fbcvt.c-fix-printing-in-fb_cvt_print_nam.patch + patches.suse/0011-video-fbdev-atari-Atari-2-bpp-STe-palette-bugfix.patch + patches.suse/0012-video-fbdev-sm712fb-Fix-crash-in-smtcfb_read.patch + patches.suse/0013-video-fbdev-omapfb-Add-missing-of_node_put-in-dvic_p.patch patches.suse/ALSA-pcm-Fix-races-among-concurrent-hw_params-and-hw.patch patches.suse/ALSA-pcm-Fix-races-among-concurrent-read-write-and-b.patch patches.suse/ALSA-pcm-Fix-races-among-concurrent-prepare-and-hw_p.patch patches.suse/ALSA-pcm-Fix-races-among-concurrent-prealloc-proc-wr.patch + patches.suse/msft-hv-2514-net-mana-Use-struct_size-helper-in-mana_gd_create_dm.patch + patches.suse/msft-hv-2516-net-mana-Add-counter-for-packet-dropped-by-XDP.patch + patches.suse/msft-hv-2517-net-mana-Add-counter-for-XDP_TX.patch + patches.suse/msft-hv-2518-net-mana-Reuse-XDP-dropped-page.patch + patches.suse/msft-hv-2523-net-mana-Add-handling-of-CQE_RX_TRUNCATED.patch + patches.suse/msft-hv-2524-net-mana-Remove-unnecessary-check-of-cqe_type-in-man.patch patches.suse/net-asix-add-proper-error-handling-of-usb-read-error.patch patches.suse/net-ibmvnic-Cleanup-workaround-doing-an-EOI-after-pa.patch + patches.suse/qed-display-VF-trust-config.patch + patches.suse/qed-validate-and-restrict-untrusted-VFs-vlan-promisc.patch + patches.suse/ixgbe-add-the-ability-for-the-PF-to-disable-VF-link-.patch + patches.suse/ixgbe-add-improvement-for-MDD-response-functionality.patch + patches.suse/ixgbevf-add-disable-link-state.patch + patches.suse/drivers-net-xgene-Fix-regression-in-CRC-stripping.patch patches.suse/llc-fix-netdevice-reference-leaks-in-llc_ui_bind.patch patches.suse/netfilter-nf_tables-initialize-registers-in-nft_do_c.patch + patches.suse/0006-drm-fb-helper-Mark-screen-buffers-in-system-memory-w.patch patches.suse/scsi-qla2xxx-Refactor-asynchronous-command-initializ.patch patches.suse/scsi-qla2xxx-Implement-ref-count-for-SRB.patch patches.suse/scsi-qla2xxx-Fix-stuck-session-in-gpdb.patch @@ -61001,10 +61191,22 @@ patches.suse/scsi-lpfc-Remove-redundant-flush_workqueue-call.patch patches.suse/scsi-qla2xxx-Add-qla2x00_async_done-for-async-routin.patch patches.suse/scsi-qla2xxx-Remove-unused-qla_sess_op_cmd_list-from.patch + patches.suse/scsi-fnic-Fix-a-tracing-statement patches.suse/scsi-qla2xxx-Stop-using-the-SCSI-pointer.patch patches.suse/scsi-qla2xxx-Use-named-initializers-for-port_-d-stat.patch patches.suse/scsi-qla2xxx-Use-named-initializers-for-q_dev_state.patch patches.suse/scsi-libsas-Fix-sas_ata_qc_issue-handling-of-NCQ-NON-DATA-commands + patches.suse/scsi-pm8001-Fix-command-initialization-in-pm80XX_send_read_log + patches.suse/scsi-pm8001-Fix-command-initialization-in-pm8001_chip_ssp_tm_req + patches.suse/scsi-pm8001-Fix-payload-initialization-in-pm80xx_set_thermal_config + patches.suse/scsi-pm8001-Fix-le32-values-handling-in-pm80xx_set_sas_protocol_timer_config + patches.suse/scsi-pm8001-Fix-payload-initialization-in-pm80xx_encrypt_update + patches.suse/scsi-pm8001-Fix-le32-values-handling-in-pm80xx_chip_ssp_io_req + patches.suse/scsi-pm8001-Fix-le32-values-handling-in-pm80xx_chip_sata_req + patches.suse/scsi-pm8001-Fix-NCQ-NON-DATA-command-task-initialization + patches.suse/scsi-pm8001-Fix-NCQ-NON-DATA-command-completion-handling + patches.suse/scsi-pm8001-Fix-abort-all-task-initialization + patches.suse/scsi-hisi_sas-Change-permission-of-parameter-prot_mask patches.suse/scsi-lpfc-Kill-lpfc_bus_reset_handler.patch patches.suse/scsi-lpfc-Drop-lpfc_no_handler.patch patches.suse/scsi-lpfc-Use-fc_block_rport.patch @@ -61027,34 +61229,26 @@ patches.suse/scsi-lpfc-Fix-typos-in-comments.patch patches.suse/scsi-qla2xxx-Fix-typos-in-comments.patch patches.suse/scsi-lpfc-Use-kcalloc.patch - patches.suse/scsi-lpfc-SLI-path-split-Refactor-lpfc_iocbq.patch - patches.suse/scsi-lpfc-SLI-path-split-Refactor-fast-and-slow-path.patch - patches.suse/scsi-lpfc-SLI-path-split-Introduce-lpfc_prep_wqe.patch - patches.suse/scsi-lpfc-SLI-path-split-Refactor-base-ELS-paths-and.patch - patches.suse/scsi-lpfc-SLI-path-split-Refactor-PLOGI-PRLI-ADISC-L.patch - patches.suse/scsi-lpfc-SLI-path-split-Refactor-the-RSCN-SCR-RDF-E.patch - patches.suse/scsi-lpfc-SLI-path-split-Refactor-LS_ACC-paths.patch - patches.suse/scsi-lpfc-SLI-path-split-Refactor-LS_RJT-paths.patch - patches.suse/scsi-lpfc-SLI-path-split-Refactor-FDISC-paths.patch - patches.suse/scsi-lpfc-SLI-path-split-Refactor-misc-ELS-paths.patch - patches.suse/scsi-lpfc-SLI-path-split-Refactor-CT-paths.patch - patches.suse/scsi-lpfc-SLI-path-split-Refactor-SCSI-paths.patch - patches.suse/scsi-lpfc-SLI-path-split-Refactor-Abort-paths.patch - patches.suse/scsi-lpfc-SLI-path-split-Refactor-BSG-paths.patch - patches.suse/scsi-lpfc-Update-lpfc-version-to-14.2.0.0.patch - patches.suse/scsi-lpfc-Copyright-updates-for-14.2.0.0-patches.patch patches.suse/powerpc-add-link-stack-flush-mitigation-status-in-de.patch patches.suse/powerpc-pseries-read-the-lpar-name-from-the-firmware.patch patches.suse/rpadlpar_io-Add-MODULE_DESCRIPTION-entries-to-kernel.patch + patches.suse/powerpc-xive-Add-some-error-handling-code-to-xive_sp.patch patches.suse/powerpc-sysdev-fix-incorrect-use-to-determine-if-lis.patch patches.suse/powerpc-xive-fix-return-value-of-__setup-handler.patch patches.suse/powerpc-tm-Fix-more-userspace-r13-corruption.patch patches.suse/powerpc-pseries-Fix-use-after-free-in-remove_phb_dyn.patch + patches.suse/USB-serial-simple-add-Nokia-phone-driver.patch + patches.suse/USB-serial-pl2303-add-IBM-device-IDs.patch patches.suse/USB-storage-ums-realtek-fix-error-code-in-rts51x_rea.patch + patches.suse/USB-usb-storage-Fix-use-of-bitfields-for-hardware-da.patch + patches.suse/mxser-fix-xmit_buf-leak-in-activate-when-LSR-0xff.patch patches.suse/xen-fix-is_xen_pmu.patch patches.suse/livepatch-Don-t-block-removal-of-patches-that-are-safe-to-unload.patch - patches.suse/ptrace-Check-PTRACE_O_SUSPEND_SECCOMP-permission-on-PTRACE_SEIZE.patch + patches.suse/net-x25-Fix-null-ptr-deref-caused-by-x25_disconnect.patch + patches.suse/netfilter-nf_conntrack_tcp-preserve-liberal-flag-in-.patch + patches.suse/ptrace-Check-PTRACE_O_SUSPEND_SECCOMP-permission-on-.patch patches.suse/NFS-Return-valid-errors-from-nfs2-3_decode_dirent.patch + patches.suse/SUNRPC-avoid-race-between-mod_timer-and-del_timer_sy.patch patches.suse/NFSv4.1-don-t-retry-BIND_CONN_TO_SESSION-on-session-.patch patches.suse/NFSv4-pNFS-Fix-another-issue-with-a-list-iterator-po.patch patches.suse/can-ems_usb-ems_usb_start_xmit-fix-double-dev_kfree_.patch @@ -61063,6 +61257,66 @@ patches.suse/cifs-do-not-skip-link-targets-when-an-I-O-fails.patch patches.suse/xen-blkfront-fix-comment-for-need_copy.patch patches.suse/x86-sev-unroll-string-mmio-with-cc_attr_guest_unroll_string_io + patches.suse/x86-pm-save-the-msr-validity-status-at-context-setup.patch + patches.suse/x86-speculation-restore-speculation-related-msrs-during-s3-resume.patch + patches.suse/random-check-for-signal_pending-outside-of-need_resc.patch + patches.suse/Revert-NFSv4-Handle-the-special-Linux-file-open-acce.patch + patches.suse/NFSv4-fix-open-failure-with-O_ACCMODE-flag.patch + patches.suse/SUNRPC-Handle-low-memory-situations-in-call_status.patch + patches.suse/drbd-Fix-five-use-after-free-bugs-in-get_initial_state + patches.suse/drbd-fix-an-invalid-memory-access-caused-by-incorrect-use-of-list-iterator + patches.suse/scsi-virtio-scsi-Eliminate-anonymous-module_init-module_exit + patches.suse/scsi-zorro7xx-Fix-a-resource-leak-in-zorro7xx_remove_one + patches.suse/veth-Ensure-eth-header-is-in-skb-s-linear-part.patch + patches.suse/mm-page_alloc-fix-build_zonerefs_node.patch + patches.suse/smp-Fix-offline-cpu-check-in-flush_smp_call_function.patch + patches.suse/scsi-sr-Do-not-leak-information-in-ioctl + patches.suse/KVM-PPC-Fix-TCE-handling-for-VFIO.patch + patches.suse/powerpc-perf-Fix-power9-event-alternatives.patch + patches.suse/0014-video-fbdev-udlfb-properly-check-endpoint-type.patch + patches.suse/bnx2x-fix-napi-API-usage-sequence.patch + patches.suse/Revert-ibmvnic-Add-ethtool-private-flag-for-driver-d.patch + patches.suse/netfilter-nf_conntrack_tcp-re-init-for-syn-packets-o.patch + patches.suse/USB-Fix-xhci-event-ring-dequeue-pointer-ERDP-update-.patch + patches.suse/xhci-stop-polling-roothubs-after-shutdown.patch + patches.suse/USB-quirks-add-a-Realtek-card-reader.patch + patches.suse/USB-quirks-add-STRING-quirk-for-VCOM-device.patch + patches.suse/usb-mtu3-fix-USB-3.0-dual-role-switch-from-device-to.patch + patches.suse/usb-dwc3-core-Only-handle-soft-reset-in-DCTL.patch + patches.suse/USB-serial-option-add-Telit-0x1057-0x1058-0x1075-com.patch + patches.suse/USB-serial-option-add-support-for-Cinterion-MV32-WA-.patch + patches.suse/USB-serial-cp210x-add-PIDs-for-Kamstrup-USB-Meter-Re.patch + patches.suse/USB-serial-whiteheat-fix-heap-overflow-in-WHITEHEAT_.patch + patches.suse/nfc-replace-improper-check-device_is_registered-in-n.patch + patches.suse/nfc-nfcmrvl-main-reorder-destructive-operations-in-n.patch + patches.suse/NFC-netlink-fix-sleep-in-atomic-bug-when-firmware-do.patch + patches.suse/NFSv4-Don-t-invalidate-inode-attributes-on-delegatio.patch + patches.suse/SUNRPC-Ensure-gss-proxy-connects-on-setup.patch + patches.suse/Revert-SUNRPC-attempt-AF_LOCAL-connect-on-setup.patch + patches.suse/floppy-use-a-statically-allocated-error-counter.patch + patches.suse/cgroup-cpuset-Remove-cpus_allowed-mems_allowed-setup-in-cpuset_init_smp.patch + patches.suse/Revert-SUNRPC-Ensure-gss-proxy-connects-on-setup.patch + patches.suse/SUNRPC-Ensure-that-the-gssproxy-client-can-start-in-.patch + patches.suse/scsi-qla2xxx-Fix-missed-DMA-unmap-for-aborted-comman.patch + patches.suse/usb-cdc-wdm-fix-reading-stuck-on-device-close.patch + patches.suse/USB-serial-pl2303-add-device-id-for-HP-LM930-Display.patch + patches.suse/USB-serial-option-add-Fibocom-L610-modem.patch + patches.suse/USB-serial-option-add-Fibocom-MA510-modem.patch + patches.suse/USB-serial-qcserial-add-support-for-Sierra-Wireless-.patch + patches.suse/perf-fix-sys_perf_event_open-race-against-self.patch + patches.suse/tpm-ibmvtpm-Correct-the-return-value-in-tpm_ibmvtpm_.patch + patches.suse/ACPI-property-Release-subnode-properties-with-data-n.patch + patches.suse/ext4-verify-dir-block-before-splitting-it.patch + patches.suse/ext4-avoid-cycles-in-directory-h-tree.patch + patches.suse/scsi-qla2xxx-Remove-free_sg-command-flag.patch + patches.suse/scsi-qla2xxx-Remove-unneeded-flush_workqueue.patch + patches.suse/scsi-qla2xxx-edif-Remove-unneeded-variable.patch + patches.suse/scsi-fnic-Replace-DMA-mask-of-64-bits-with-47-bits + patches.suse/powerpc-xive-Fix-refcount-leak-in-xive_spapr_init.patch + patches.suse/powerpc-64s-Add-CPU_FTRS_POWER9_DD2_2-to-CPU_FTRS_AL.patch + patches.suse/powerpc-Enable-the-DAWR-on-POWER9-DD2.3-and-above.patch + patches.suse/netfilter-nf_tables-disallow-non-stateful-expression.patch + patches.suse/net-sched-fixed-barrier-to-prevent-skbuff-sticking-i.patch # dhowells/linux-fs keys-uefi patches.suse/0001-KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch @@ -61097,14 +61351,6 @@ # end of sorted patches ######################################################## - # mkp/scsi staging - patches.suse/scsi-lpfc-improve-pci-eeh-error-and-recovery-handling.patch - patches.suse/scsi-lpfc-fix-unload-hang-after-back-to-back-pci-eeh-faults.patch - patches.suse/scsi-lpfc-fix-queue-failures-when-recovering-from-pci-parity-error.patch - patches.suse/scsi-lpfc-update-lpfc-version-to-14.2.0.1.patch - patches.suse/scsi-lpfc-fix-broken-sli4-abort-path.patch - patches.suse/scsi-lpfc-fix-locking-for-lpfc_sli_iocbq_lookup.patch - ######################################################## # upstream patches broken after a merge ######################################################## @@ -61361,6 +61607,9 @@ patches.suse/powerpc-pseries-Fix-update-of-LPAR-security-flavor-a.patch patches.suse/powerpc-security-Add-a-helper-to-query-stf_barrier-t.patch patches.suse/powerpc-bpf-Emit-stf-barrier-instruction-sequences-f.patch + patches.suse/powerpc-powernv-Remove-POWER9-PVR-version-check-for-.patch + patches.suse/powerpc-powernv-Get-L1D-flush-requirements-from-devi.patch + patches.suse/powerpc-powernv-Get-STF-barrier-requirements-from-de.patch ######################################################## # cephfs @@ -61369,6 +61618,7 @@ ######################################################## # Suse specific stuff ######################################################## + patches.suse/PCI-hv-Do-not-set-PCI_COMMAND_MEMORY-to-reduce-VM-bo.patch patches.suse/suse-hv-mana-netdev_lockdep_set_classes.patch patches.suse/suse-hv-mana-ndo_select_queue-API.patch patches.suse/suse-hv-netvsc-bpf-api.patch @@ -61504,7 +61754,7 @@ patches.suse/SUNRPC-prevent-port-reuse-on-transports-which-don-t-.patch patches.suse/sunrpc-gss-timeout.patch patches.suse/SUNRPC-change-locking-for-xs_swap_enable-disable.patch - patches.suse/SUNRPC-avoid-race-between-mod_timer-and-del_timer_sy.patch + patches.suse/nfs-access-cache-no-negative.patch ######################################################## # Overlayfs @@ -61524,9 +61774,13 @@ patches.suse/qla2xxx-always-allocate-qla_tgt_wq.patch patches.suse/lpfc-decouple-port_template-and-vport_template.patch patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch + patches.suse/lpfc-set-default-protocol-support-to-fcp-only.patch patches.suse/block-Fix-a-NULL-pointer-dereference-in-generic_make.patch patches.suse/dasd_fba-Display-00000000-for-zero-page-when-dumping.patch + #bsc#1198438 + patches.suse/revert-scsi-qla2xxx-Changes-to-support-FCP2-Target.patch + # NVMe patches.suse/nvme-Do-not-remove-namespaces-during-reset.patch patches.suse/nvme-flush-scan_work-when-resetting-controller.patch @@ -61817,6 +62071,8 @@ patches.suse/0056-acpi-Disable-ACPI-table-override-if-the-kernel-is-lo.patch patches.suse/0057-acpi-Disable-APEI-error-injection-if-the-kernel-is-l.patch patches.suse/0005-modsign-print-module-name-along-with-error-message.patch + # Bug 1199426 CVE-2022-21499: kernel-source,kernel-source-rt,kernel-source-azure: break out of lockdown with kgdb + patches.suse/debug-Lock-down-kgdb.patch ######################################################## # Grab certificate from MokList (MODSIGN) FATE#314508 @@ -62072,6 +62328,8 @@ patches.kabi/tcp-fix-race-condition-when-creating-child-sockets-from-syncookies-kABI-fix.patch patches.kabi/NFSv4-Wait-for-stateid-updates-after-CLOSE-OPEN_DOWN_kabi.patch + patches.kabi/fuse-handle-kabi-change-in-struct-fuse_req.patch + patches.kabi/Revert-NFSv4-Handle-the-special-Linux-file-open-acce.kabi ######################################################## # You'd better have a good reason for adding a patch