Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Al Stone <ahs3@redhat.com>
Pablo Greco ceb317
Date: Tue, 27 Feb 2018 00:21:23 -0500
Pablo Greco de6db6
Subject: [PATCH 01/33] ACPI: APEI: arm64: Ignore broken HPE moonshot APEI
Pablo Greco ceb317
 support
Pablo Greco ceb317
Pablo Greco ceb317
Message-id: <20180227002123.21608-1-ahs3@redhat.com>
Pablo Greco ceb317
Patchwork-id: 206052
Pablo Greco ceb317
O-Subject: [RHEL8 BZ1518076 PATCH] ACPI: APEI: arm64: Ignore broken HPE moonshot APEI support
Pablo Greco ceb317
Bugzilla: 1518076
Pablo Greco ceb317
RH-Acked-by: Mark Salter <msalter@redhat.com>
Pablo Greco ceb317
RH-Acked-by: Jeremy McNicoll <jmcnicol@redhat.com>
Pablo Greco ceb317
Pablo Greco ceb317
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1518076
Pablo Greco ceb317
Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=15417197
Pablo Greco ceb317
Tested: compile-only; several other patches are required for full booting
Pablo Greco ceb317
        QE has tested limited boot (see comment#12 of BZ)
Pablo Greco ceb317
Pablo Greco ceb317
This is a re-post of a RHEL-ALT-7.5 patch specific to aarch64 moonshots
Pablo Greco ceb317
that we use in beaker.  It is required for these machines to boot.
Pablo Greco ceb317
Pablo Greco ceb317
    commit 8a663a264863efedf8bb4a9d76ac603920fdd739
Pablo Greco ceb317
    Author: Robert Richter <rrichter@redhat.com>
Pablo Greco ceb317
    Date:   Wed Aug 16 19:49:30 2017 -0400
Pablo Greco ceb317
Pablo Greco ceb317
    [acpi] APEI: arm64: Ignore broken HPE moonshot APEI support
Pablo Greco ceb317
Pablo Greco ceb317
    From: Mark Salter <msalter@redhat.com>
Pablo Greco ceb317
    Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1344237
Pablo Greco ceb317
    Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=13768971
Pablo Greco ceb317
    Tested: Booted on moonshot with patched 4.11.0-20 kernel
Pablo Greco ceb317
    Upstream: RHEL-only
Pablo Greco ceb317
Pablo Greco ceb317
    The aarch64 HP moonshot platforms we have in beaker and elsewhere have
Pablo Greco ceb317
    a firmware bug which causes a spurious fatal memory error via APEI at
Pablo Greco ceb317
    boot time. This platform is no longer supported and no further firmware
Pablo Greco ceb317
    updates are expected. This is a downstream-only hack to avoid the problem
Pablo Greco ceb317
    by bailing out of HEST table probing if we detect a moonshot HEST table.
Pablo Greco ceb317
Pablo Greco ceb317
    Signed-off-by: Mark Salter <msalter@redhat.com>
Pablo Greco ceb317
    Signed-off-by: Robert Richter <rrichter@redhat.com>
Pablo Greco ceb317
    Signed-off-by: Herton R. Krzesinski <herton@redhat.com>
Pablo Greco ceb317
Pablo Greco ceb317
Upstream Status: RHEL only
Pablo Greco ceb317
Signed-off-by: Al Stone <ahs3@redhat.com>
Pablo Greco ceb317
Signed-off-by: Herton R. Krzesinski <herton@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 drivers/acpi/apei/hest.c | 8 ++++++++
Pablo Greco ceb317
 1 file changed, 8 insertions(+)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/drivers/acpi/apei/hest.c b/drivers/acpi/apei/hest.c
Pablo Greco de6db6
index 317bba602ad5..61aeb949b272 100644
Pablo Greco ceb317
--- a/drivers/acpi/apei/hest.c
Pablo Greco ceb317
+++ b/drivers/acpi/apei/hest.c
Pablo Greco ceb317
@@ -94,6 +94,14 @@ int apei_hest_parse(apei_hest_func_t func, void *data)
Pablo Greco ceb317
 	if (hest_disable || !hest_tab)
Pablo Greco ceb317
 		return -EINVAL;
Pablo Greco ceb317
 
Pablo Greco ceb317
+#ifdef CONFIG_ARM64
Pablo Greco ceb317
+	/* Ignore broken firmware */
Pablo Greco ceb317
+	if (!strncmp(hest_tab->header.oem_id, "HPE   ", 6) &&
Pablo Greco ceb317
+	    !strncmp(hest_tab->header.oem_table_id, "ProLiant", 8) &&
Pablo Greco ceb317
+	    MIDR_IMPLEMENTOR(read_cpuid_id()) == ARM_CPU_IMP_APM)
Pablo Greco ceb317
+		return -EINVAL;
Pablo Greco ceb317
+#endif
Pablo Greco ceb317
+
Pablo Greco ceb317
 	hest_hdr = (struct acpi_hest_header *)(hest_tab + 1);
Pablo Greco ceb317
 	for (i = 0; i < hest_tab->error_source_count; i++) {
Pablo Greco ceb317
 		len = hest_esrc_len(hest_hdr);
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Mark Salter <msalter@redhat.com>
Pablo Greco ceb317
Date: Thu, 10 May 2018 17:38:43 -0400
Pablo Greco de6db6
Subject: [PATCH 02/33] ACPI / irq: Workaround firmware issue on X-Gene based
Pablo Greco ceb317
 m400
Pablo Greco ceb317
Pablo Greco ceb317
Message-id: <20180510173844.29580-3-msalter@redhat.com>
Pablo Greco ceb317
Patchwork-id: 214383
Pablo Greco ceb317
O-Subject: [RHEL-8 BZ1519554 2/3] ACPI / irq: Workaround firmware issue on X-Gene based m400
Pablo Greco ceb317
Bugzilla: 1519554
Pablo Greco ceb317
RH-Acked-by: Al Stone <astone@redhat.com>
Pablo Greco ceb317
RH-Acked-by: Tony Camuso <tcamuso@redhat.com>
Pablo Greco ceb317
Pablo Greco ceb317
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1519554
Pablo Greco ceb317
Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=16144520
Pablo Greco ceb317
Pablo Greco ceb317
The ACPI firmware on the xgene-based m400 platorms erroneously
Pablo Greco ceb317
describes its UART interrupt as ACPI_PRODUCER rather than
Pablo Greco ceb317
ACPI_CONSUMER. This leads to the UART driver being unable to
Pablo Greco ceb317
find its interrupt and the kernel unable find a console.
Pablo Greco ceb317
Work around this by avoiding the producer/consumer check
Pablo Greco ceb317
for X-Gene UARTs.
Pablo Greco ceb317
Pablo Greco ceb317
Upstream Status: RHEL only
Pablo Greco ceb317
Signed-off-by: Mark Salter <msalter@redhat.com>
Pablo Greco ceb317
Signed-off-by: Herton R. Krzesinski <herton@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 drivers/acpi/irq.c | 17 +++++++++++++++--
Pablo Greco ceb317
 1 file changed, 15 insertions(+), 2 deletions(-)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/drivers/acpi/irq.c b/drivers/acpi/irq.c
Pablo Greco ceb317
index c68e694fca26..146cba5ae5bc 100644
Pablo Greco ceb317
--- a/drivers/acpi/irq.c
Pablo Greco ceb317
+++ b/drivers/acpi/irq.c
Pablo Greco ceb317
@@ -130,6 +130,7 @@ struct acpi_irq_parse_one_ctx {
Pablo Greco ceb317
 	unsigned int index;
Pablo Greco ceb317
 	unsigned long *res_flags;
Pablo Greco ceb317
 	struct irq_fwspec *fwspec;
Pablo Greco ceb317
+	bool skip_producer_check;
Pablo Greco ceb317
 };
Pablo Greco ceb317
 
Pablo Greco ceb317
 /**
Pablo Greco ceb317
@@ -201,7 +202,8 @@ static acpi_status acpi_irq_parse_one_cb(struct acpi_resource *ares,
Pablo Greco ceb317
 		return AE_CTRL_TERMINATE;
Pablo Greco ceb317
 	case ACPI_RESOURCE_TYPE_EXTENDED_IRQ:
Pablo Greco ceb317
 		eirq = &ares->data.extended_irq;
Pablo Greco ceb317
-		if (eirq->producer_consumer == ACPI_PRODUCER)
Pablo Greco ceb317
+		if (!ctx->skip_producer_check &&
Pablo Greco ceb317
+		    eirq->producer_consumer == ACPI_PRODUCER)
Pablo Greco ceb317
 			return AE_OK;
Pablo Greco ceb317
 		if (ctx->index >= eirq->interrupt_count) {
Pablo Greco ceb317
 			ctx->index -= eirq->interrupt_count;
Pablo Greco ceb317
@@ -236,8 +238,19 @@ static acpi_status acpi_irq_parse_one_cb(struct acpi_resource *ares,
Pablo Greco ceb317
 static int acpi_irq_parse_one(acpi_handle handle, unsigned int index,
Pablo Greco ceb317
 			      struct irq_fwspec *fwspec, unsigned long *flags)
Pablo Greco ceb317
 {
Pablo Greco ceb317
-	struct acpi_irq_parse_one_ctx ctx = { -EINVAL, index, flags, fwspec };
Pablo Greco ceb317
+	struct acpi_irq_parse_one_ctx ctx = { -EINVAL, index, flags, fwspec, false };
Pablo Greco ceb317
 
Pablo Greco ceb317
+	/*
Pablo Greco ceb317
+	 * Firmware on arm64-based HPE m400 platform incorrectly marks
Pablo Greco ceb317
+	 * its UART interrupt as ACPI_PRODUCER rather than ACPI_CONSUMER.
Pablo Greco ceb317
+	 * Don't do the producer/consumer check for that device.
Pablo Greco ceb317
+	 */
Pablo Greco ceb317
+	if (IS_ENABLED(CONFIG_ARM64)) {
Pablo Greco ceb317
+		struct acpi_device *adev = acpi_bus_get_acpi_device(handle);
Pablo Greco ceb317
+
Pablo Greco ceb317
+		if (adev && !strcmp(acpi_device_hid(adev), "APMC0D08"))
Pablo Greco ceb317
+			ctx.skip_producer_check = true;
Pablo Greco ceb317
+	}
Pablo Greco ceb317
 	acpi_walk_resources(handle, METHOD_NAME__CRS, acpi_irq_parse_one_cb, &ctx;;
Pablo Greco ceb317
 	return ctx.rc;
Pablo Greco ceb317
 }
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Mark Salter <msalter@redhat.com>
Pablo Greco ceb317
Date: Thu, 10 May 2018 17:38:44 -0400
Pablo Greco de6db6
Subject: [PATCH 03/33] aarch64: acpi scan: Fix regression related to X-Gene
Pablo Greco ceb317
 UARTs
Pablo Greco ceb317
Pablo Greco ceb317
Message-id: <20180510173844.29580-4-msalter@redhat.com>
Pablo Greco ceb317
Patchwork-id: 214381
Pablo Greco ceb317
O-Subject: [RHEL-8 BZ1519554 3/3] aarch64: acpi scan: Fix regression related to X-Gene UARTs
Pablo Greco ceb317
Bugzilla: 1519554
Pablo Greco ceb317
RH-Acked-by: Al Stone <astone@redhat.com>
Pablo Greco ceb317
RH-Acked-by: Tony Camuso <tcamuso@redhat.com>
Pablo Greco ceb317
Pablo Greco ceb317
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1519554
Pablo Greco ceb317
Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=16144520
Pablo Greco ceb317
Pablo Greco ceb317
Commit e361d1f85855 ("ACPI / scan: Fix enumeration for special UART
Pablo Greco ceb317
devices") caused a regression with some X-Gene based platforms (Mustang
Pablo Greco ceb317
and M400) with invalid DSDT. The DSDT makes it appear that the UART
Pablo Greco ceb317
device is also a slave device attached to itself. With the above commit
Pablo Greco ceb317
the UART won't be enumerated by ACPI scan (slave serial devices shouldn't
Pablo Greco ceb317
be). So check for X-Gene UART device and skip slace device check on it.
Pablo Greco ceb317
Pablo Greco ceb317
Upstream Status: RHEL only
Pablo Greco ceb317
Signed-off-by: Mark Salter <msalter@redhat.com>
Pablo Greco ceb317
Signed-off-by: Herton R. Krzesinski <herton@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 drivers/acpi/scan.c | 9 +++++++++
Pablo Greco ceb317
 1 file changed, 9 insertions(+)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
Pablo Greco 08fca0
index 6e9cd41c5f9b..07db2f6afa17 100644
Pablo Greco ceb317
--- a/drivers/acpi/scan.c
Pablo Greco ceb317
+++ b/drivers/acpi/scan.c
Pablo Greco 08fca0
@@ -1727,6 +1727,15 @@ static bool acpi_device_enumeration_by_parent(struct acpi_device *device)
Pablo Greco 08fca0
 	if (!acpi_match_device_ids(device, ignore_serial_bus_ids))
Pablo Greco ceb317
 		return false;
Pablo Greco ceb317
 
Pablo Greco ceb317
+	/*
Pablo Greco ceb317
+	 * Firmware on some arm64 X-Gene platforms will make the UART
Pablo Greco ceb317
+	 * device appear as both a UART and a slave of that UART. Just
Pablo Greco ceb317
+	 * bail out here for X-Gene UARTs.
Pablo Greco ceb317
+	 */
Pablo Greco ceb317
+	if (IS_ENABLED(CONFIG_ARM64) &&
Pablo Greco ceb317
+	    !strcmp(acpi_device_hid(device), "APMC0D08"))
Pablo Greco ceb317
+		return false;
Pablo Greco ceb317
+
Pablo Greco ceb317
 	INIT_LIST_HEAD(&resource_list);
Pablo Greco ceb317
 	acpi_dev_get_resources(device, &resource_list,
Pablo Greco ceb317
 			       acpi_check_serial_bus_slave,
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Mark Salter <msalter@redhat.com>
Pablo Greco ceb317
Date: Fri, 11 May 2018 21:01:17 -0400
Pablo Greco de6db6
Subject: [PATCH 04/33] acpi: prefer booting with ACPI over DTS
Pablo Greco ceb317
Pablo Greco ceb317
Message-id: <20180511210117.10457-1-msalter@redhat.com>
Pablo Greco ceb317
Patchwork-id: 214708
Pablo Greco ceb317
O-Subject: [RHEL-8 BZ1576869] [RHEL only] acpi: prefer booting with ACPI over DTS
Pablo Greco ceb317
Bugzilla: 1576869
Pablo Greco ceb317
RH-Acked-by: Jonathan Toppins <jtoppins@redhat.com>
Pablo Greco ceb317
RH-Acked-by: Tony Camuso <tcamuso@redhat.com>
Pablo Greco ceb317
RH-Acked-by: Bhupesh Sharma <bhsharma@redhat.com>
Pablo Greco ceb317
RH-Acked-by: Dean Nelson <dnelson@redhat.com>
Pablo Greco ceb317
Pablo Greco ceb317
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1576869
Pablo Greco ceb317
Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=16208479
Pablo Greco ceb317
Testing: Verified kernel defaults to ACPI on Mustang
Pablo Greco ceb317
Pablo Greco ceb317
From: Jonathan Toppins <jtoppins@redhat.com>
Pablo Greco ceb317
Pablo Greco ceb317
    This patch forces ACPI boot tables to be preferred over DTS.
Pablo Greco ceb317
Pablo Greco ceb317
    Currently for ACPI to be used a user either has to set acpi=on on the
Pablo Greco ceb317
    kernel command line or make sure any device tree passed to the kernel
Pablo Greco ceb317
    is empty. If the dtb passed to the kernel is non-empty then device-tree
Pablo Greco ceb317
    will be chosen as the boot method of choice.
Pablo Greco ceb317
Pablo Greco ceb317
    RHEL does not wish to support this boot method so change table boot
Pablo Greco ceb317
    preferences to use ACPI. In the event ACPI table checks fail the kernel
Pablo Greco ceb317
    will fallback to using DTS to boot.
Pablo Greco ceb317
Pablo Greco ceb317
    Signed-off-by: Jonathan Toppins <jtoppins@redhat.com>
Pablo Greco ceb317
Pablo Greco ceb317
Upstream Status: RHEL only
Pablo Greco ceb317
Signed-off-by: Mark Salter <msalter@redhat.com>
Pablo Greco ceb317
Signed-off-by: Herton R. Krzesinski <herton@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 arch/arm64/kernel/acpi.c | 2 +-
Pablo Greco ceb317
 1 file changed, 1 insertion(+), 1 deletion(-)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/arch/arm64/kernel/acpi.c b/arch/arm64/kernel/acpi.c
Pablo Greco ceb317
index f3851724fe35..cac21da49455 100644
Pablo Greco ceb317
--- a/arch/arm64/kernel/acpi.c
Pablo Greco ceb317
+++ b/arch/arm64/kernel/acpi.c
Pablo Greco ceb317
@@ -40,7 +40,7 @@ int acpi_pci_disabled = 1;	/* skip ACPI PCI scan and IRQ initialization */
Pablo Greco ceb317
 EXPORT_SYMBOL(acpi_pci_disabled);
Pablo Greco ceb317
 
Pablo Greco ceb317
 static bool param_acpi_off __initdata;
Pablo Greco ceb317
-static bool param_acpi_on __initdata;
Pablo Greco ceb317
+static bool param_acpi_on __initdata = true;
Pablo Greco ceb317
 static bool param_acpi_force __initdata;
Pablo Greco ceb317
 
Pablo Greco ceb317
 static int __init parse_acpi(char *arg)
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Robert Richter <rrichter@redhat.com>
Pablo Greco ceb317
Date: Thu, 7 Jun 2018 22:59:32 -0400
Pablo Greco de6db6
Subject: [PATCH 05/33] Vulcan: AHCI PCI bar fix for Broadcom Vulcan early
Pablo Greco ceb317
 silicon
Pablo Greco ceb317
Pablo Greco ceb317
Message-id: <1528412373-19128-2-git-send-email-rrichter@redhat.com>
Pablo Greco ceb317
Patchwork-id: 220950
Pablo Greco ceb317
O-Subject: [RHEL-8.0 BZ 1563590 v2 1/2] PCI: Vulcan: AHCI PCI bar fix for Broadcom Vulcan early silicon
Pablo Greco ceb317
Bugzilla: 1563590
Pablo Greco ceb317
RH-Acked-by: Dean Nelson <dnelson@redhat.com>
Pablo Greco ceb317
RH-Acked-by: Mark Langsdorf <mlangsdo@redhat.com>
Pablo Greco ceb317
RH-Acked-by: Mark Salter <msalter@redhat.com>
Pablo Greco ceb317
Pablo Greco ceb317
From: Ashok Kumar Sekar <asekar@redhat.com>
Pablo Greco ceb317
Pablo Greco ceb317
PCI BAR 5 is not setup correctly for the on-board AHCI
Pablo Greco ceb317
controller on Broadcom's Vulcan processor. Added a quirk to fix BAR 5
Pablo Greco ceb317
by using BAR 4's resources which are populated correctly but NOT used
Pablo Greco ceb317
by the AHCI controller actually.
Pablo Greco ceb317
Pablo Greco ceb317
RHEL-only:
Pablo Greco ceb317
Pablo Greco ceb317
Both patches are in RHEL-7.6 also. Inclusion of the patches into RHEL-8
Pablo Greco ceb317
was discussed. Since there are partners with Ax system configurations it
Pablo Greco ceb317
was decided to carry them in RHEL8 too. See:
Pablo Greco ceb317
Pablo Greco ceb317
 https://bugzilla.redhat.com/show_bug.cgi?id=1563590#c1
Pablo Greco ceb317
Pablo Greco ceb317
Upstream Status: RHEL only
Pablo Greco ceb317
Signed-off-by: Ashok Kumar Sekar <asekar@redhat.com>
Pablo Greco ceb317
Signed-off-by: Jayachandran C <jchandra@broadcom.com>
Pablo Greco ceb317
Signed-off-by: Robert Richter <rrichter@redhat.com>
Pablo Greco ceb317
Signed-off-by: Herton R. Krzesinski <herton@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 drivers/pci/quirks.c | 24 ++++++++++++++++++++++++
Pablo Greco ceb317
 1 file changed, 24 insertions(+)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
Pablo Greco 422940
index a531064233f9..0d76bbb4b3b9 100644
Pablo Greco ceb317
--- a/drivers/pci/quirks.c
Pablo Greco ceb317
+++ b/drivers/pci/quirks.c
Pablo Greco de6db6
@@ -4284,6 +4284,30 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_BROADCOM, 0x9000,
Pablo Greco ceb317
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_BROADCOM, 0x9084,
Pablo Greco ceb317
 				quirk_bridge_cavm_thrx2_pcie_root);
Pablo Greco ceb317
 
Pablo Greco ceb317
+/*
Pablo Greco ceb317
+ * PCI BAR 5 is not setup correctly for the on-board AHCI controller
Pablo Greco ceb317
+ * on Broadcom's Vulcan processor. Added a quirk to fix BAR 5 by
Pablo Greco ceb317
+ * using BAR 4's resources which are populated correctly and NOT
Pablo Greco ceb317
+ * actually used by the AHCI controller.
Pablo Greco ceb317
+ */
Pablo Greco ceb317
+static void quirk_fix_vulcan_ahci_bars(struct pci_dev *dev)
Pablo Greco ceb317
+{
Pablo Greco ceb317
+	struct resource *r =  &dev->resource[4];
Pablo Greco ceb317
+
Pablo Greco ceb317
+	if (!(r->flags & IORESOURCE_MEM) || (r->start == 0))
Pablo Greco ceb317
+		return;
Pablo Greco ceb317
+
Pablo Greco ceb317
+	/* Set BAR5 resource to BAR4 */
Pablo Greco ceb317
+	dev->resource[5] = *r;
Pablo Greco ceb317
+
Pablo Greco ceb317
+	/* Update BAR5 in pci config space */
Pablo Greco ceb317
+	pci_write_config_dword(dev, PCI_BASE_ADDRESS_5, r->start);
Pablo Greco ceb317
+
Pablo Greco ceb317
+	/* Clear BAR4's resource */
Pablo Greco ceb317
+	memset(r, 0, sizeof(*r));
Pablo Greco ceb317
+}
Pablo Greco ceb317
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_BROADCOM, 0x9027, quirk_fix_vulcan_ahci_bars);
Pablo Greco ceb317
+
Pablo Greco ceb317
 /*
Pablo Greco ceb317
  * Intersil/Techwell TW686[4589]-based video capture cards have an empty (zero)
Pablo Greco ceb317
  * class code.  Fix it.
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Robert Richter <rrichter@redhat.com>
Pablo Greco ceb317
Date: Thu, 7 Jun 2018 22:59:33 -0400
Pablo Greco de6db6
Subject: [PATCH 06/33] ahci: thunderx2: Fix for errata that affects stop
Pablo Greco ceb317
 engine
Pablo Greco ceb317
Pablo Greco ceb317
Message-id: <1528412373-19128-3-git-send-email-rrichter@redhat.com>
Pablo Greco ceb317
Patchwork-id: 220952
Pablo Greco ceb317
O-Subject: [RHEL-8.0 BZ 1563590 v2 2/2] ahci: thunderx2: Fix for errata that affects stop engine
Pablo Greco ceb317
Bugzilla: 1563590
Pablo Greco ceb317
RH-Acked-by: Dean Nelson <dnelson@redhat.com>
Pablo Greco ceb317
RH-Acked-by: Mark Langsdorf <mlangsdo@redhat.com>
Pablo Greco ceb317
RH-Acked-by: Mark Salter <msalter@redhat.com>
Pablo Greco ceb317
Pablo Greco ceb317
From: Jayachandran C <jnair@caviumnetworks.com>
Pablo Greco ceb317
Pablo Greco ceb317
Apply workaround for this errata:
Pablo Greco ceb317
  Synopsis: Resetting PxCMD.ST may hang the SATA device
Pablo Greco ceb317
Pablo Greco ceb317
  Description: An internal ping-pong buffer state is not reset
Pablo Greco ceb317
  correctly for an PxCMD.ST=0 command for a SATA channel. This
Pablo Greco ceb317
  may cause the SATA interface to hang when a PxCMD.ST=0 command
Pablo Greco ceb317
  is received.
Pablo Greco ceb317
Pablo Greco ceb317
  Workaround: A SATA_BIU_CORE_ENABLE.sw_init_bsi must be asserted
Pablo Greco ceb317
  by the driver whenever the PxCMD.ST needs to be de-asserted. This
Pablo Greco ceb317
  will reset both the ports. So, it may not always work in a 2
Pablo Greco ceb317
  channel SATA system.
Pablo Greco ceb317
Pablo Greco ceb317
  Resolution: Fix in B0.
Pablo Greco ceb317
Pablo Greco ceb317
Add the code to ahci_stop_engine() to do this. It is not easy to
Pablo Greco ceb317
stop the other "port" since it is associated with a different AHCI
Pablo Greco ceb317
interface. Please note that with this fix, SATA reset does not
Pablo Greco ceb317
hang any more, but it can cause failures on the other interface
Pablo Greco ceb317
if that is in active use.
Pablo Greco ceb317
Pablo Greco ceb317
Unfortunately, we have nothing other the the CPU ID to check if the
Pablo Greco ceb317
SATA block has this issue.
Pablo Greco ceb317
Pablo Greco ceb317
RHEL-only:
Pablo Greco ceb317
Pablo Greco ceb317
Both patches are in RHEL-7.6 also. Inclusion of the patches into RHEL-8
Pablo Greco ceb317
was discussed. Since there are partners with Ax system configurations it
Pablo Greco ceb317
was decided to carry them in RHEL8 too. See:
Pablo Greco ceb317
Pablo Greco ceb317
 https://bugzilla.redhat.com/show_bug.cgi?id=1563590#c1
Pablo Greco ceb317
Pablo Greco ceb317
[v3 with new delays]
Pablo Greco ceb317
Signed-off-by: Jayachandran C <jnair@caviumnetworks.com>
Pablo Greco ceb317
Pablo Greco ceb317
Upstream Status: RHEL only
Pablo Greco ceb317
Signed-off-by: Robert Richter <rrichter@redhat.com>
Pablo Greco ceb317
Signed-off-by: Herton R. Krzesinski <herton@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 drivers/ata/libahci.c | 18 ++++++++++++++++++
Pablo Greco ceb317
 1 file changed, 18 insertions(+)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
Pablo Greco ceb317
index 395772fa3943..35aa1b420262 100644
Pablo Greco ceb317
--- a/drivers/ata/libahci.c
Pablo Greco ceb317
+++ b/drivers/ata/libahci.c
Pablo Greco ceb317
@@ -672,6 +672,24 @@ int ahci_stop_engine(struct ata_port *ap)
Pablo Greco ceb317
 	tmp &= ~PORT_CMD_START;
Pablo Greco ceb317
 	writel(tmp, port_mmio + PORT_CMD);
Pablo Greco ceb317
 
Pablo Greco ceb317
+#ifdef CONFIG_ARM64
Pablo Greco ceb317
+	/* Rev Ax of Cavium CN99XX needs a hack for port stop */
Pablo Greco ceb317
+	if (dev_is_pci(ap->host->dev) &&
Pablo Greco ceb317
+	    to_pci_dev(ap->host->dev)->vendor == 0x14e4 &&
Pablo Greco ceb317
+	    to_pci_dev(ap->host->dev)->device == 0x9027 &&
Pablo Greco ceb317
+	    midr_is_cpu_model_range(read_cpuid_id(),
Pablo Greco ceb317
+			MIDR_CPU_MODEL(ARM_CPU_IMP_BRCM, BRCM_CPU_PART_VULCAN),
Pablo Greco ceb317
+			MIDR_CPU_VAR_REV(0, 0),
Pablo Greco ceb317
+			MIDR_CPU_VAR_REV(0, MIDR_REVISION_MASK))) {
Pablo Greco ceb317
+		tmp = readl(hpriv->mmio + 0x8000);
Pablo Greco ceb317
+		udelay(100);
Pablo Greco ceb317
+		writel(tmp | (1 << 26), hpriv->mmio + 0x8000);
Pablo Greco ceb317
+		udelay(100);
Pablo Greco ceb317
+		writel(tmp & ~(1 << 26), hpriv->mmio + 0x8000);
Pablo Greco ceb317
+		dev_warn(ap->host->dev, "CN99XX SATA reset workaround applied\n");
Pablo Greco ceb317
+	}
Pablo Greco ceb317
+#endif
Pablo Greco ceb317
+
Pablo Greco ceb317
 	/* wait for engine to stop. This could be as long as 500 msec */
Pablo Greco ceb317
 	tmp = ata_wait_register(ap, port_mmio + PORT_CMD,
Pablo Greco ceb317
 				PORT_CMD_LIST_ON, PORT_CMD_LIST_ON, 1, 500);
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Laura Abbott <labbott@redhat.com>
Pablo Greco ceb317
Date: Sun, 10 Feb 2019 01:27:54 +0000
Pablo Greco de6db6
Subject: [PATCH 07/33] ipmi: do not configure ipmi for HPE m400
Pablo Greco ceb317
Pablo Greco ceb317
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1670017
Pablo Greco ceb317
Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=20147017
Pablo Greco ceb317
Pablo Greco ceb317
Commit 913a89f009d9 ("ipmi: Don't initialize anything in the core until
Pablo Greco ceb317
something uses it") added new locking which broke context.
Pablo Greco ceb317
Pablo Greco ceb317
    Message-id: <20180713142210.15700-1-tcamuso@redhat.com>
Pablo Greco ceb317
    Patchwork-id: 224899
Pablo Greco ceb317
    O-Subject: [RHEL8 BZ 1583537 1/1] ipmi: do not configure ipmi for HPE m400
Pablo Greco ceb317
    Bugzilla: 1583537
Pablo Greco ceb317
    RH-Acked-by: Dean Nelson <dnelson@redhat.com>
Pablo Greco ceb317
    RH-Acked-by: Al Stone <ahs3@redhat.com>
Pablo Greco ceb317
    RH-Acked-by: Mark Salter <msalter@redhat.com>
Pablo Greco ceb317
Pablo Greco ceb317
    bugzilla:https://bugzilla.redhat.com/show_bug.cgi?id=1583537
Pablo Greco ceb317
    brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=17150528
Pablo Greco ceb317
Pablo Greco ceb317
    RHEL-only
Pablo Greco ceb317
Pablo Greco ceb317
    The ARM-based HPE m400 reports host-side ipmi as residing in intel
Pablo Greco ceb317
    port-io space, which does not exist in ARM processors. Therefore, when
Pablo Greco ceb317
    running on an m400, host-side ipmi configuration code must simply return
Pablo Greco ceb317
    zero without trying to configure the host-side ipmi.
Pablo Greco ceb317
Pablo Greco ceb317
    This patch prevents panic on boot by averting attempts to configure
Pablo Greco ceb317
    host-side ipmi on this platform.
Pablo Greco ceb317
Pablo Greco ceb317
    Though HPE m400 is not certified with RHEL, and HPE has relegated it to
Pablo Greco ceb317
    EOL status, the platform is still used extensively in ARM development
Pablo Greco ceb317
    and test for RHEL.
Pablo Greco ceb317
Pablo Greco ceb317
    Testing:
Pablo Greco ceb317
    Boot without blacklisting ipmi and check to see that no ipmi modules
Pablo Greco ceb317
    are loaded.
Pablo Greco ceb317
Pablo Greco ceb317
    Signed-off-by: Tony Camuso <tcamuso@redhat.com>
Pablo Greco ceb317
Pablo Greco ceb317
    cc: Prarit Bhargava <prarit@redhat.com>
Pablo Greco ceb317
    cc: Brendan Conoboy <blc@redhat.com>
Pablo Greco ceb317
    cc: Jeff Bastian <jbastian@redhat.com>
Pablo Greco ceb317
    cc: Scott Herold <sherold@redhat.com>
Pablo Greco ceb317
    Signed-off-by: Herton R. Krzesinski <herton@redhat.com>
Pablo Greco ceb317
Pablo Greco ceb317
Upstream Status: RHEL only
Pablo Greco ceb317
Signed-off-by: Laura Abbott <labbott@redhat.com>
Pablo Greco ceb317
Acked-by: Tony Camuso <tcamuso@redhat.com>
Pablo Greco ceb317
Acked-by: Dean Nelson <dnelson@redhat.com>
Pablo Greco ceb317
Acked-by: Jarod Wilson <jarod@redhat.com>
Pablo Greco ceb317
Acked-by: Mark Salter <msalter@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 drivers/char/ipmi/ipmi_dmi.c        | 15 +++++++++++++++
Pablo Greco ceb317
 drivers/char/ipmi/ipmi_msghandler.c | 16 +++++++++++++++-
Pablo Greco ceb317
 2 files changed, 30 insertions(+), 1 deletion(-)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/drivers/char/ipmi/ipmi_dmi.c b/drivers/char/ipmi/ipmi_dmi.c
Pablo Greco ceb317
index bbf7029e224b..cf7faa970dd6 100644
Pablo Greco ceb317
--- a/drivers/char/ipmi/ipmi_dmi.c
Pablo Greco ceb317
+++ b/drivers/char/ipmi/ipmi_dmi.c
Pablo Greco ceb317
@@ -215,6 +215,21 @@ static int __init scan_for_dmi_ipmi(void)
Pablo Greco ceb317
 {
Pablo Greco ceb317
 	const struct dmi_device *dev = NULL;
Pablo Greco ceb317
 
Pablo Greco ceb317
+#ifdef CONFIG_ARM64
Pablo Greco ceb317
+	/* RHEL-only
Pablo Greco ceb317
+	 * If this is ARM-based HPE m400, return now, because that platform
Pablo Greco ceb317
+	 * reports the host-side ipmi address as intel port-io space, which
Pablo Greco ceb317
+	 * does not exist in the ARM architecture.
Pablo Greco ceb317
+	 */
Pablo Greco ceb317
+	const char *dmistr = dmi_get_system_info(DMI_PRODUCT_NAME);
Pablo Greco ceb317
+
Pablo Greco ceb317
+	if (dmistr && (strcmp("ProLiant m400 Server", dmistr) == 0)) {
Pablo Greco ceb317
+		pr_debug("%s does not support host ipmi\n", dmistr);
Pablo Greco ceb317
+		return 0;
Pablo Greco ceb317
+	}
Pablo Greco ceb317
+	/* END RHEL-only */
Pablo Greco ceb317
+#endif
Pablo Greco ceb317
+
Pablo Greco ceb317
 	while ((dev = dmi_find_device(DMI_DEV_TYPE_IPMI, NULL, dev)))
Pablo Greco ceb317
 		dmi_decode_ipmi((const struct dmi_header *) dev->device_data);
Pablo Greco ceb317
 
Pablo Greco ceb317
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
Pablo Greco 7163c5
index 2badf36d4816..703836cadb4e 100644
Pablo Greco ceb317
--- a/drivers/char/ipmi/ipmi_msghandler.c
Pablo Greco ceb317
+++ b/drivers/char/ipmi/ipmi_msghandler.c
Pablo Greco ceb317
@@ -35,6 +35,7 @@
Pablo Greco ceb317
 #include <linux/uuid.h>
Pablo Greco ceb317
 #include <linux/nospec.h>
Pablo Greco ceb317
 #include <linux/vmalloc.h>
Pablo Greco ceb317
+#include <linux/dmi.h>
Pablo Greco ceb317
 #include <linux/delay.h>
Pablo Greco ceb317
 
Pablo Greco ceb317
 #define IPMI_DRIVER_VERSION "39.2"
Pablo Greco 08fca0
@@ -5178,8 +5179,21 @@ static int __init ipmi_init_msghandler_mod(void)
Pablo Greco ceb317
 {
Pablo Greco ceb317
 	int rv;
Pablo Greco ceb317
 
Pablo Greco ceb317
-	pr_info("version " IPMI_DRIVER_VERSION "\n");
Pablo Greco ceb317
+#ifdef CONFIG_ARM64
Pablo Greco ceb317
+	/* RHEL-only
Pablo Greco ceb317
+	 * If this is ARM-based HPE m400, return now, because that platform
Pablo Greco ceb317
+	 * reports the host-side ipmi address as intel port-io space, which
Pablo Greco ceb317
+	 * does not exist in the ARM architecture.
Pablo Greco ceb317
+	 */
Pablo Greco ceb317
+	const char *dmistr = dmi_get_system_info(DMI_PRODUCT_NAME);
Pablo Greco ceb317
 
Pablo Greco ceb317
+	if (dmistr && (strcmp("ProLiant m400 Server", dmistr) == 0)) {
Pablo Greco ceb317
+		pr_debug("%s does not support host ipmi\n", dmistr);
Pablo Greco ceb317
+		return -ENOSYS;
Pablo Greco ceb317
+	}
Pablo Greco ceb317
+	/* END RHEL-only */
Pablo Greco ceb317
+#endif
Pablo Greco ceb317
+	pr_info("version " IPMI_DRIVER_VERSION "\n");
Pablo Greco ceb317
 	mutex_lock(&ipmi_interfaces_mutex);
Pablo Greco ceb317
 	rv = ipmi_register_driver();
Pablo Greco ceb317
 	mutex_unlock(&ipmi_interfaces_mutex);
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Laura Abbott <labbott@redhat.com>
Pablo Greco ceb317
Date: Mon, 20 May 2019 22:21:02 -0400
Pablo Greco de6db6
Subject: [PATCH 08/33] iommu/arm-smmu: workaround DMA mode issues
Pablo Greco ceb317
Pablo Greco ceb317
Message-id: <20190520222102.19488-1-labbott@redhat.com>
Pablo Greco ceb317
Patchwork-id: 259215
Pablo Greco ceb317
O-Subject: [ARK INTERNAL PATCH] iommu/arm-smmu: workaround DMA mode issues
Pablo Greco ceb317
Bugzilla:
Pablo Greco ceb317
RH-Acked-by: Mark Langsdorf <mlangsdo@redhat.com>
Pablo Greco ceb317
RH-Acked-by: Mark Salter <msalter@redhat.com>
Pablo Greco ceb317
Pablo Greco ceb317
From: Mark Salter <msalter@redhat.com>
Pablo Greco ceb317
Pablo Greco ceb317
Rebased for v5.2-rc1
Pablo Greco ceb317
Pablo Greco ceb317
	Bugzilla: 1652259
Pablo Greco ceb317
	Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=19244562
Pablo Greco ceb317
	Upstream status: RHEL only.
Pablo Greco ceb317
Pablo Greco ceb317
	rhel8 commit 65feb1ed0ec9a088a63a90d46c0f7563ac96ad0f
Pablo Greco ceb317
	Author: Mark Salter <msalter@redhat.com>
Pablo Greco ceb317
	Date:   Wed Nov 21 17:15:59 2018 +0100
Pablo Greco ceb317
Pablo Greco ceb317
	    [iommu] iommu/arm-smmu: workaround DMA mode issues
Pablo Greco ceb317
Pablo Greco ceb317
	    Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1624077
Pablo Greco ceb317
	    Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=18112820
Pablo Greco ceb317
	    Testing: Verified iommu.passthrough=1 no longer needed on gigabyte platforms.
Pablo Greco ceb317
	    Upstream Status: RHEL-only
Pablo Greco ceb317
Pablo Greco ceb317
	    In RHEL_ALT 7.5 we carried a RHEL-only patch which forced the arm smmuv2
Pablo Greco ceb317
	    into bypass mode due to performance issues on CN88xx. This was intended
Pablo Greco ceb317
	    to be a temporary hack until the issues were resolved. Another vendor
Pablo Greco ceb317
	    had issues with the iommu in bypass mode so we reverted the RHEL-only
Pablo Greco ceb317
	    patch so that iommu is in DMA mode by default (upstream default).
Pablo Greco ceb317
Pablo Greco ceb317
	    It turns on that there are remaining SMMU DMA mode issues on Gigabyte
Pablo Greco ceb317
	    platformws with CN88xx cpus. The problem manifests itself by pcie
Pablo Greco ceb317
	    card drivers failing to initialize the cards when SMMU is in DMA mode.
Pablo Greco ceb317
	    The root cause has not been determined yet, but looks likely to be
Pablo Greco ceb317
	    a hw or firmware issue. This patch forces bypass mode for Gigabyte
Pablo Greco ceb317
	    platforms. CN88xx isn't officially supported in RHEL but we have a
Pablo Greco ceb317
	    lot of them being used internally for testing, so I think we want
Pablo Greco ceb317
	    this to support that use case in RHEL8.
Pablo Greco ceb317
Pablo Greco ceb317
	    Signed-off-by: Mark Salter <msalter@redhat.com>
Pablo Greco ceb317
	    Signed-off-by: Herton R. Krzesinski <herton@redhat.com>
Pablo Greco ceb317
Pablo Greco ceb317
	Acked-by: Mark Salter <msalter@redhat.com>
Pablo Greco ceb317
	Acked-by: Donald Dutile <ddutile@redhat.com>
Pablo Greco ceb317
Pablo Greco ceb317
Upstream Status: RHEL only
Pablo Greco ceb317
Signed-off-by: Laura Abbott <labbott@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 drivers/iommu/iommu.c | 22 ++++++++++++++++++++++
Pablo Greco ceb317
 1 file changed, 22 insertions(+)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
Pablo Greco de6db6
index 7f409e9eea4b..976473a4895b 100644
Pablo Greco ceb317
--- a/drivers/iommu/iommu.c
Pablo Greco ceb317
+++ b/drivers/iommu/iommu.c
Pablo Greco ceb317
@@ -7,6 +7,7 @@
Pablo Greco ceb317
 #define pr_fmt(fmt)    "iommu: " fmt
Pablo Greco ceb317
 
Pablo Greco ceb317
 #include <linux/device.h>
Pablo Greco ceb317
+#include <linux/dmi.h>
Pablo Greco ceb317
 #include <linux/dma-iommu.h>
Pablo Greco ceb317
 #include <linux/kernel.h>
Pablo Greco ceb317
 #include <linux/bits.h>
Pablo Greco de6db6
@@ -3124,6 +3125,27 @@ u32 iommu_sva_get_pasid(struct iommu_sva *handle)
Pablo Greco ceb317
 }
Pablo Greco ceb317
 EXPORT_SYMBOL_GPL(iommu_sva_get_pasid);
Pablo Greco ceb317
 
Pablo Greco ceb317
+#ifdef CONFIG_ARM64
Pablo Greco ceb317
+static int __init iommu_quirks(void)
Pablo Greco ceb317
+{
Pablo Greco ceb317
+	const char *vendor, *name;
Pablo Greco ceb317
+
Pablo Greco ceb317
+	vendor = dmi_get_system_info(DMI_SYS_VENDOR);
Pablo Greco ceb317
+	name = dmi_get_system_info(DMI_PRODUCT_NAME);
Pablo Greco ceb317
+
Pablo Greco ceb317
+	if (vendor &&
Pablo Greco ceb317
+	    (strncmp(vendor, "GIGABYTE", 8) == 0 && name &&
Pablo Greco ceb317
+	     (strncmp(name, "R120", 4) == 0 ||
Pablo Greco ceb317
+	      strncmp(name, "R270", 4) == 0))) {
Pablo Greco ceb317
+		pr_warn("Gigabyte %s detected, force iommu passthrough mode", name);
Pablo Greco ceb317
+		iommu_def_domain_type = IOMMU_DOMAIN_IDENTITY;
Pablo Greco ceb317
+	}
Pablo Greco ceb317
+
Pablo Greco ceb317
+	return 0;
Pablo Greco ceb317
+}
Pablo Greco ceb317
+arch_initcall(iommu_quirks);
Pablo Greco ceb317
+#endif
Pablo Greco ceb317
+
Pablo Greco ceb317
 /*
Pablo Greco ceb317
  * Changes the default domain of an iommu group that has *only* one device
Pablo Greco ceb317
  *
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Jeremy Cline <jcline@redhat.com>
Pablo Greco ceb317
Date: Tue, 1 Oct 2019 15:51:23 +0000
Pablo Greco de6db6
Subject: [PATCH 09/33] arm: aarch64: Drop the EXPERT setting from
Pablo Greco ceb317
 ARM64_FORCE_52BIT
Pablo Greco ceb317
Pablo Greco ceb317
Message-id: <20191001181256.22935-1-jcline@redhat.com>
Pablo Greco ceb317
Patchwork-id: 275498
Pablo Greco ceb317
O-Subject: [ARK INTERNAL PATCH] [ARK INTERNAL PATCH] [redhat] Add patch
Pablo Greco ceb317
    to drop the EXPERT setting from ARM64_FORCE_52BIT
Pablo Greco ceb317
Bugzilla:
Pablo Greco ceb317
RH-Acked-by: Laura Abbott <labbott@redhat.com>
Pablo Greco ceb317
Pablo Greco ceb317
We don't turn on EXPERT as there are few settings we actually want to
Pablo Greco ceb317
mess with. Remove the dependency for ARM64_FORCE_52BIT as we do want
Pablo Greco ceb317
that on in debug builds to help find 52-bit bugs.
Pablo Greco ceb317
Pablo Greco ceb317
Upstream Status: RHEL only
Pablo Greco ceb317
Signed-off-by: Jeremy Cline <jcline@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 arch/arm64/Kconfig | 2 +-
Pablo Greco ceb317
 1 file changed, 1 insertion(+), 1 deletion(-)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
Pablo Greco 422940
index 24cce3b9ff1a..22caf88c64ca 100644
Pablo Greco ceb317
--- a/arch/arm64/Kconfig
Pablo Greco ceb317
+++ b/arch/arm64/Kconfig
Pablo Greco 422940
@@ -945,7 +945,7 @@ endchoice
Pablo Greco ceb317
 
Pablo Greco ceb317
 config ARM64_FORCE_52BIT
Pablo Greco ceb317
 	bool "Force 52-bit virtual addresses for userspace"
Pablo Greco ceb317
-	depends on ARM64_VA_BITS_52 && EXPERT
Pablo Greco ceb317
+	depends on ARM64_VA_BITS_52
Pablo Greco ceb317
 	help
Pablo Greco ceb317
 	  For systems with 52-bit userspace VAs enabled, the kernel will attempt
Pablo Greco ceb317
 	  to maintain compatibility with older software by providing 48-bit VAs
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Peter Jones <pjones@redhat.com>
Pablo Greco ceb317
Date: Mon, 2 Oct 2017 18:22:13 -0400
Pablo Greco de6db6
Subject: [PATCH 10/33] Add efi_status_to_str() and rework efi_status_to_err().
Pablo Greco ceb317
Pablo Greco ceb317
This adds efi_status_to_str() for use when printing efi_status_t
Pablo Greco ceb317
messages, and reworks efi_status_to_err() so that the two use a common
Pablo Greco ceb317
list of errors.
Pablo Greco ceb317
Pablo Greco ceb317
Upstream Status: RHEL only
Pablo Greco ceb317
Signed-off-by: Peter Jones <pjones@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 drivers/firmware/efi/efi.c | 124 +++++++++++++++++++++++++++----------
Pablo Greco ceb317
 include/linux/efi.h        |   3 +
Pablo Greco ceb317
 2 files changed, 96 insertions(+), 31 deletions(-)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
Pablo Greco de6db6
index e3df82d5d37a..56274356784b 100644
Pablo Greco ceb317
--- a/drivers/firmware/efi/efi.c
Pablo Greco ceb317
+++ b/drivers/firmware/efi/efi.c
Pablo Greco ceb317
@@ -31,6 +31,7 @@
Pablo Greco ceb317
 #include <linux/ucs2_string.h>
Pablo Greco ceb317
 #include <linux/memblock.h>
Pablo Greco ceb317
 #include <linux/security.h>
Pablo Greco ceb317
+#include <linux/bsearch.h>
Pablo Greco ceb317
 
Pablo Greco ceb317
 #include <asm/early_ioremap.h>
Pablo Greco ceb317
 
Pablo Greco de6db6
@@ -848,40 +849,101 @@ int efi_mem_type(unsigned long phys_addr)
Pablo Greco ceb317
 }
Pablo Greco ceb317
 #endif
Pablo Greco ceb317
 
Pablo Greco ceb317
+struct efi_error_code {
Pablo Greco ceb317
+	efi_status_t status;
Pablo Greco ceb317
+	int errno;
Pablo Greco ceb317
+	const char *description;
Pablo Greco ceb317
+};
Pablo Greco ceb317
+
Pablo Greco ceb317
+static const struct efi_error_code efi_error_codes[] = {
Pablo Greco ceb317
+	{ EFI_SUCCESS, 0, "Success"},
Pablo Greco ceb317
+#if 0
Pablo Greco ceb317
+	{ EFI_LOAD_ERROR, -EPICK_AN_ERRNO, "Load Error"},
Pablo Greco ceb317
+#endif
Pablo Greco ceb317
+	{ EFI_INVALID_PARAMETER, -EINVAL, "Invalid Parameter"},
Pablo Greco ceb317
+	{ EFI_UNSUPPORTED, -ENOSYS, "Unsupported"},
Pablo Greco ceb317
+	{ EFI_BAD_BUFFER_SIZE, -ENOSPC, "Bad Buffer Size"},
Pablo Greco ceb317
+	{ EFI_BUFFER_TOO_SMALL, -ENOSPC, "Buffer Too Small"},
Pablo Greco ceb317
+	{ EFI_NOT_READY, -EAGAIN, "Not Ready"},
Pablo Greco ceb317
+	{ EFI_DEVICE_ERROR, -EIO, "Device Error"},
Pablo Greco ceb317
+	{ EFI_WRITE_PROTECTED, -EROFS, "Write Protected"},
Pablo Greco ceb317
+	{ EFI_OUT_OF_RESOURCES, -ENOMEM, "Out of Resources"},
Pablo Greco ceb317
+#if 0
Pablo Greco ceb317
+	{ EFI_VOLUME_CORRUPTED, -EPICK_AN_ERRNO, "Volume Corrupt"},
Pablo Greco ceb317
+	{ EFI_VOLUME_FULL, -EPICK_AN_ERRNO, "Volume Full"},
Pablo Greco ceb317
+	{ EFI_NO_MEDIA, -EPICK_AN_ERRNO, "No Media"},
Pablo Greco ceb317
+	{ EFI_MEDIA_CHANGED, -EPICK_AN_ERRNO, "Media changed"},
Pablo Greco ceb317
+#endif
Pablo Greco ceb317
+	{ EFI_NOT_FOUND, -ENOENT, "Not Found"},
Pablo Greco ceb317
+#if 0
Pablo Greco ceb317
+	{ EFI_ACCESS_DENIED, -EPICK_AN_ERRNO, "Access Denied"},
Pablo Greco ceb317
+	{ EFI_NO_RESPONSE, -EPICK_AN_ERRNO, "No Response"},
Pablo Greco ceb317
+	{ EFI_NO_MAPPING, -EPICK_AN_ERRNO, "No mapping"},
Pablo Greco ceb317
+	{ EFI_TIMEOUT, -EPICK_AN_ERRNO, "Time out"},
Pablo Greco ceb317
+	{ EFI_NOT_STARTED, -EPICK_AN_ERRNO, "Not started"},
Pablo Greco ceb317
+	{ EFI_ALREADY_STARTED, -EPICK_AN_ERRNO, "Already started"},
Pablo Greco ceb317
+#endif
Pablo Greco ceb317
+	{ EFI_ABORTED, -EINTR, "Aborted"},
Pablo Greco ceb317
+#if 0
Pablo Greco ceb317
+	{ EFI_ICMP_ERROR, -EPICK_AN_ERRNO, "ICMP Error"},
Pablo Greco ceb317
+	{ EFI_TFTP_ERROR, -EPICK_AN_ERRNO, "TFTP Error"},
Pablo Greco ceb317
+	{ EFI_PROTOCOL_ERROR, -EPICK_AN_ERRNO, "Protocol Error"},
Pablo Greco ceb317
+	{ EFI_INCOMPATIBLE_VERSION, -EPICK_AN_ERRNO, "Incompatible Version"},
Pablo Greco ceb317
+#endif
Pablo Greco ceb317
+	{ EFI_SECURITY_VIOLATION, -EACCES, "Security Policy Violation"},
Pablo Greco ceb317
+#if 0
Pablo Greco ceb317
+	{ EFI_CRC_ERROR, -EPICK_AN_ERRNO, "CRC Error"},
Pablo Greco ceb317
+	{ EFI_END_OF_MEDIA, -EPICK_AN_ERRNO, "End of Media"},
Pablo Greco ceb317
+	{ EFI_END_OF_FILE, -EPICK_AN_ERRNO, "End of File"},
Pablo Greco ceb317
+	{ EFI_INVALID_LANGUAGE, -EPICK_AN_ERRNO, "Invalid Languages"},
Pablo Greco ceb317
+	{ EFI_COMPROMISED_DATA, -EPICK_AN_ERRNO, "Compromised Data"},
Pablo Greco ceb317
+
Pablo Greco ceb317
+	// warnings
Pablo Greco ceb317
+	{ EFI_WARN_UNKOWN_GLYPH, -EPICK_AN_ERRNO, "Warning Unknown Glyph"},
Pablo Greco ceb317
+	{ EFI_WARN_DELETE_FAILURE, -EPICK_AN_ERRNO, "Warning Delete Failure"},
Pablo Greco ceb317
+	{ EFI_WARN_WRITE_FAILURE, -EPICK_AN_ERRNO, "Warning Write Failure"},
Pablo Greco ceb317
+	{ EFI_WARN_BUFFER_TOO_SMALL, -EPICK_AN_ERRNO, "Warning Buffer Too Small"},
Pablo Greco ceb317
+#endif
Pablo Greco ceb317
+};
Pablo Greco ceb317
+
Pablo Greco ceb317
+static int
Pablo Greco ceb317
+efi_status_cmp_bsearch(const void *key, const void *item)
Pablo Greco ceb317
+{
Pablo Greco ceb317
+	u64 status = (u64)(uintptr_t)key;
Pablo Greco ceb317
+	struct efi_error_code *code = (struct efi_error_code *)item;
Pablo Greco ceb317
+
Pablo Greco ceb317
+	if (status < code->status)
Pablo Greco ceb317
+		return -1;
Pablo Greco ceb317
+	if (status > code->status)
Pablo Greco ceb317
+		return 1;
Pablo Greco ceb317
+	return 0;
Pablo Greco ceb317
+}
Pablo Greco ceb317
+
Pablo Greco ceb317
 int efi_status_to_err(efi_status_t status)
Pablo Greco ceb317
 {
Pablo Greco ceb317
-	int err;
Pablo Greco ceb317
-
Pablo Greco ceb317
-	switch (status) {
Pablo Greco ceb317
-	case EFI_SUCCESS:
Pablo Greco ceb317
-		err = 0;
Pablo Greco ceb317
-		break;
Pablo Greco ceb317
-	case EFI_INVALID_PARAMETER:
Pablo Greco ceb317
-		err = -EINVAL;
Pablo Greco ceb317
-		break;
Pablo Greco ceb317
-	case EFI_OUT_OF_RESOURCES:
Pablo Greco ceb317
-		err = -ENOSPC;
Pablo Greco ceb317
-		break;
Pablo Greco ceb317
-	case EFI_DEVICE_ERROR:
Pablo Greco ceb317
-		err = -EIO;
Pablo Greco ceb317
-		break;
Pablo Greco ceb317
-	case EFI_WRITE_PROTECTED:
Pablo Greco ceb317
-		err = -EROFS;
Pablo Greco ceb317
-		break;
Pablo Greco ceb317
-	case EFI_SECURITY_VIOLATION:
Pablo Greco ceb317
-		err = -EACCES;
Pablo Greco ceb317
-		break;
Pablo Greco ceb317
-	case EFI_NOT_FOUND:
Pablo Greco ceb317
-		err = -ENOENT;
Pablo Greco ceb317
-		break;
Pablo Greco ceb317
-	case EFI_ABORTED:
Pablo Greco ceb317
-		err = -EINTR;
Pablo Greco ceb317
-		break;
Pablo Greco ceb317
-	default:
Pablo Greco ceb317
-		err = -EINVAL;
Pablo Greco ceb317
-	}
Pablo Greco ceb317
+	struct efi_error_code *found;
Pablo Greco ceb317
+	size_t num = sizeof(efi_error_codes) / sizeof(struct efi_error_code);
Pablo Greco ceb317
 
Pablo Greco ceb317
-	return err;
Pablo Greco ceb317
+	found = bsearch((void *)(uintptr_t)status, efi_error_codes,
Pablo Greco ceb317
+			sizeof(struct efi_error_code), num,
Pablo Greco ceb317
+			efi_status_cmp_bsearch);
Pablo Greco ceb317
+	if (!found)
Pablo Greco ceb317
+		return -EINVAL;
Pablo Greco ceb317
+	return found->errno;
Pablo Greco ceb317
+}
Pablo Greco ceb317
+
Pablo Greco ceb317
+const char *
Pablo Greco ceb317
+efi_status_to_str(efi_status_t status)
Pablo Greco ceb317
+{
Pablo Greco ceb317
+	struct efi_error_code *found;
Pablo Greco ceb317
+	size_t num = sizeof(efi_error_codes) / sizeof(struct efi_error_code);
Pablo Greco ceb317
+
Pablo Greco ceb317
+	found = bsearch((void *)(uintptr_t)status, efi_error_codes,
Pablo Greco ceb317
+			sizeof(struct efi_error_code), num,
Pablo Greco ceb317
+			efi_status_cmp_bsearch);
Pablo Greco ceb317
+	if (!found)
Pablo Greco ceb317
+		return "Unknown error code";
Pablo Greco ceb317
+	return found->description;
Pablo Greco ceb317
 }
Pablo Greco ceb317
 
Pablo Greco ceb317
 static DEFINE_SPINLOCK(efi_mem_reserve_persistent_lock);
Pablo Greco ceb317
diff --git a/include/linux/efi.h b/include/linux/efi.h
Pablo Greco 7163c5
index d34e8a7ed4d5..43c0667259a6 100644
Pablo Greco ceb317
--- a/include/linux/efi.h
Pablo Greco ceb317
+++ b/include/linux/efi.h
Pablo Greco ceb317
@@ -43,6 +43,8 @@
Pablo Greco ceb317
 #define EFI_ABORTED		(21 | (1UL << (BITS_PER_LONG-1)))
Pablo Greco ceb317
 #define EFI_SECURITY_VIOLATION	(26 | (1UL << (BITS_PER_LONG-1)))
Pablo Greco ceb317
 
Pablo Greco ceb317
+#define EFI_IS_ERROR(x)		((x) & (1UL << (BITS_PER_LONG-1)))
Pablo Greco ceb317
+
Pablo Greco ceb317
 typedef unsigned long efi_status_t;
Pablo Greco ceb317
 typedef u8 efi_bool_t;
Pablo Greco ceb317
 typedef u16 efi_char16_t;		/* UNICODE character */
Pablo Greco 7163c5
@@ -827,6 +829,7 @@ static inline bool efi_rt_services_supported(unsigned int mask)
Pablo Greco ceb317
 #endif
Pablo Greco ceb317
 
Pablo Greco ceb317
 extern int efi_status_to_err(efi_status_t status);
Pablo Greco ceb317
+extern const char *efi_status_to_str(efi_status_t status);
Pablo Greco ceb317
 
Pablo Greco ceb317
 /*
Pablo Greco ceb317
  * Variable Attributes
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Peter Jones <pjones@redhat.com>
Pablo Greco ceb317
Date: Mon, 2 Oct 2017 18:18:30 -0400
Pablo Greco de6db6
Subject: [PATCH 11/33] Make get_cert_list() use efi_status_to_str() to print
Pablo Greco ceb317
 error messages.
Pablo Greco ceb317
Pablo Greco ceb317
Upstream Status: RHEL only
Pablo Greco ceb317
Signed-off-by: Peter Jones <pjones@redhat.com>
Pablo Greco ceb317
Signed-off-by: Jeremy Cline <jcline@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 security/integrity/platform_certs/load_uefi.c | 6 ++++--
Pablo Greco ceb317
 1 file changed, 4 insertions(+), 2 deletions(-)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
Pablo Greco 422940
index 185c609c6e38..011d49f601ce 100644
Pablo Greco ceb317
--- a/security/integrity/platform_certs/load_uefi.c
Pablo Greco ceb317
+++ b/security/integrity/platform_certs/load_uefi.c
Pablo Greco 7163c5
@@ -72,7 +72,8 @@ static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid,
Pablo Greco ceb317
 		return NULL;
Pablo Greco ceb317
 
Pablo Greco ceb317
 	if (*status != EFI_BUFFER_TOO_SMALL) {
Pablo Greco ceb317
-		pr_err("Couldn't get size: 0x%lx\n", *status);
Pablo Greco ceb317
+		pr_err("Couldn't get size: %s (0x%lx)\n",
Pablo Greco ceb317
+		       efi_status_to_str(*status), *status);
Pablo Greco ceb317
 		return NULL;
Pablo Greco ceb317
 	}
Pablo Greco ceb317
 
Pablo Greco 7163c5
@@ -83,7 +84,8 @@ static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid,
Pablo Greco ceb317
 	*status = efi.get_variable(name, guid, NULL, &lsize, db);
Pablo Greco ceb317
 	if (*status != EFI_SUCCESS) {
Pablo Greco ceb317
 		kfree(db);
Pablo Greco ceb317
-		pr_err("Error reading db var: 0x%lx\n", *status);
Pablo Greco ceb317
+		pr_err("Error reading db var: %s (0x%lx)\n",
Pablo Greco ceb317
+		       efi_status_to_str(*status), *status);
Pablo Greco ceb317
 		return NULL;
Pablo Greco ceb317
 	}
Pablo Greco ceb317
 
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Jeremy Cline <jcline@redhat.com>
Pablo Greco ceb317
Date: Mon, 30 Sep 2019 21:22:47 +0000
Pablo Greco de6db6
Subject: [PATCH 12/33] security: lockdown: expose a hook to lock the kernel
Pablo Greco ceb317
 down
Pablo Greco ceb317
Pablo Greco ceb317
In order to automatically lock down kernels running on UEFI machines
Pablo Greco ceb317
booted in Secure Boot mode, expose the lock_kernel_down() hook.
Pablo Greco ceb317
Pablo Greco ceb317
Upstream Status: RHEL only
Pablo Greco ceb317
Signed-off-by: Jeremy Cline <jcline@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 include/linux/lsm_hook_defs.h | 2 ++
Pablo Greco ceb317
 include/linux/lsm_hooks.h     | 6 ++++++
Pablo Greco ceb317
 include/linux/security.h      | 5 +++++
Pablo Greco ceb317
 security/lockdown/lockdown.c  | 1 +
Pablo Greco ceb317
 security/security.c           | 6 ++++++
Pablo Greco ceb317
 5 files changed, 20 insertions(+)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
Pablo Greco ceb317
index 61590c1f2d33..4c10750865c2 100644
Pablo Greco ceb317
--- a/include/linux/lsm_hook_defs.h
Pablo Greco ceb317
+++ b/include/linux/lsm_hook_defs.h
Pablo Greco ceb317
@@ -394,6 +394,8 @@ LSM_HOOK(void, LSM_RET_VOID, bpf_prog_free_security, struct bpf_prog_aux *aux)
Pablo Greco ceb317
 #endif /* CONFIG_BPF_SYSCALL */
Pablo Greco ceb317
 
Pablo Greco ceb317
 LSM_HOOK(int, 0, locked_down, enum lockdown_reason what)
Pablo Greco ceb317
+LSM_HOOK(int, 0, lock_kernel_down, const char *where, enum lockdown_reason level)
Pablo Greco ceb317
+
Pablo Greco ceb317
 
Pablo Greco ceb317
 #ifdef CONFIG_PERF_EVENTS
Pablo Greco ceb317
 LSM_HOOK(int, 0, perf_event_open, struct perf_event_attr *attr, int type)
Pablo Greco ceb317
diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
Pablo Greco ceb317
index 59024618554e..ab9ca4d393da 100644
Pablo Greco ceb317
--- a/include/linux/lsm_hooks.h
Pablo Greco ceb317
+++ b/include/linux/lsm_hooks.h
Pablo Greco ceb317
@@ -1545,6 +1545,12 @@
Pablo Greco ceb317
  *
Pablo Greco ceb317
  *     @what: kernel feature being accessed
Pablo Greco ceb317
  *
Pablo Greco ceb317
+ * @lock_kernel_down
Pablo Greco ceb317
+ * 	Put the kernel into lock-down mode.
Pablo Greco ceb317
+ *
Pablo Greco ceb317
+ * 	@where: Where the lock-down is originating from (e.g. command line option)
Pablo Greco ceb317
+ * 	@level: The lock-down level (can only increase)
Pablo Greco ceb317
+ *
Pablo Greco ceb317
  * Security hooks for perf events
Pablo Greco ceb317
  *
Pablo Greco ceb317
  * @perf_event_open:
Pablo Greco ceb317
diff --git a/include/linux/security.h b/include/linux/security.h
Pablo Greco de6db6
index da184e7b361f..d38bc78f16b7 100644
Pablo Greco ceb317
--- a/include/linux/security.h
Pablo Greco ceb317
+++ b/include/linux/security.h
Pablo Greco de6db6
@@ -474,6 +474,7 @@ int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen);
Pablo Greco ceb317
 int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen);
Pablo Greco ceb317
 int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen);
Pablo Greco ceb317
 int security_locked_down(enum lockdown_reason what);
Pablo Greco ceb317
+int security_lock_kernel_down(const char *where, enum lockdown_reason level);
Pablo Greco ceb317
 #else /* CONFIG_SECURITY */
Pablo Greco ceb317
 
Pablo Greco ceb317
 static inline int call_blocking_lsm_notifier(enum lsm_event event, void *data)
Pablo Greco de6db6
@@ -1355,6 +1356,10 @@ static inline int security_locked_down(enum lockdown_reason what)
Pablo Greco ceb317
 {
Pablo Greco ceb317
 	return 0;
Pablo Greco ceb317
 }
Pablo Greco ceb317
+static inline int security_lock_kernel_down(const char *where, enum lockdown_reason level)
Pablo Greco ceb317
+{
Pablo Greco ceb317
+	return 0;
Pablo Greco ceb317
+}
Pablo Greco ceb317
 #endif	/* CONFIG_SECURITY */
Pablo Greco ceb317
 
Pablo Greco ceb317
 #if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE)
Pablo Greco ceb317
diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
Pablo Greco ceb317
index 87cbdc64d272..18555cf18da7 100644
Pablo Greco ceb317
--- a/security/lockdown/lockdown.c
Pablo Greco ceb317
+++ b/security/lockdown/lockdown.c
Pablo Greco ceb317
@@ -73,6 +73,7 @@ static int lockdown_is_locked_down(enum lockdown_reason what)
Pablo Greco ceb317
 
Pablo Greco ceb317
 static struct security_hook_list lockdown_hooks[] __lsm_ro_after_init = {
Pablo Greco ceb317
 	LSM_HOOK_INIT(locked_down, lockdown_is_locked_down),
Pablo Greco ceb317
+	LSM_HOOK_INIT(lock_kernel_down, lock_kernel_down),
Pablo Greco ceb317
 };
Pablo Greco ceb317
 
Pablo Greco ceb317
 static int __init lockdown_lsm_init(void)
Pablo Greco ceb317
diff --git a/security/security.c b/security/security.c
Pablo Greco de6db6
index 7b9f9d3fffe5..0251fbe67828 100644
Pablo Greco ceb317
--- a/security/security.c
Pablo Greco ceb317
+++ b/security/security.c
Pablo Greco de6db6
@@ -2614,6 +2614,12 @@ int security_locked_down(enum lockdown_reason what)
Pablo Greco ceb317
 }
Pablo Greco ceb317
 EXPORT_SYMBOL(security_locked_down);
Pablo Greco ceb317
 
Pablo Greco ceb317
+int security_lock_kernel_down(const char *where, enum lockdown_reason level)
Pablo Greco ceb317
+{
Pablo Greco ceb317
+	return call_int_hook(lock_kernel_down, 0, where, level);
Pablo Greco ceb317
+}
Pablo Greco ceb317
+EXPORT_SYMBOL(security_lock_kernel_down);
Pablo Greco ceb317
+
Pablo Greco ceb317
 #ifdef CONFIG_PERF_EVENTS
Pablo Greco ceb317
 int security_perf_event_open(struct perf_event_attr *attr, int type)
Pablo Greco ceb317
 {
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: David Howells <dhowells@redhat.com>
Pablo Greco ceb317
Date: Tue, 27 Feb 2018 10:04:55 +0000
Pablo Greco de6db6
Subject: [PATCH 13/33] efi: Add an EFI_SECURE_BOOT flag to indicate secure
Pablo Greco ceb317
 boot mode
Pablo Greco ceb317
Pablo Greco ceb317
UEFI machines can be booted in Secure Boot mode.  Add an EFI_SECURE_BOOT
Pablo Greco ceb317
flag that can be passed to efi_enabled() to find out whether secure boot is
Pablo Greco ceb317
enabled.
Pablo Greco ceb317
Pablo Greco ceb317
Move the switch-statement in x86's setup_arch() that inteprets the
Pablo Greco ceb317
secure_boot boot parameter to generic code and set the bit there.
Pablo Greco ceb317
Pablo Greco ceb317
Upstream Status: RHEL only
Pablo Greco ceb317
Suggested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Pablo Greco ceb317
Signed-off-by: David Howells <dhowells@redhat.com>
Pablo Greco ceb317
Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Pablo Greco ceb317
cc: linux-efi@vger.kernel.org
Pablo Greco ceb317
[Rebased for context; efi_is_table_address was moved to arch/x86]
Pablo Greco ceb317
Signed-off-by: Jeremy Cline <jcline@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 arch/x86/kernel/setup.c           | 14 +-----------
Pablo Greco ceb317
 drivers/firmware/efi/Makefile     |  1 +
Pablo Greco ceb317
 drivers/firmware/efi/secureboot.c | 38 +++++++++++++++++++++++++++++++
Pablo Greco ceb317
 include/linux/efi.h               | 19 ++++++++++------
Pablo Greco ceb317
 4 files changed, 52 insertions(+), 20 deletions(-)
Pablo Greco ceb317
 create mode 100644 drivers/firmware/efi/secureboot.c
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
Pablo Greco de6db6
index 8e56c4de00b9..5294f24da2a7 100644
Pablo Greco ceb317
--- a/arch/x86/kernel/setup.c
Pablo Greco ceb317
+++ b/arch/x86/kernel/setup.c
Pablo Greco de6db6
@@ -1114,19 +1114,7 @@ void __init setup_arch(char **cmdline_p)
Pablo Greco ceb317
 	/* Allocate bigger log buffer */
Pablo Greco ceb317
 	setup_log_buf(1);
Pablo Greco ceb317
 
Pablo Greco ceb317
-	if (efi_enabled(EFI_BOOT)) {
Pablo Greco ceb317
-		switch (boot_params.secure_boot) {
Pablo Greco ceb317
-		case efi_secureboot_mode_disabled:
Pablo Greco ceb317
-			pr_info("Secure boot disabled\n");
Pablo Greco ceb317
-			break;
Pablo Greco ceb317
-		case efi_secureboot_mode_enabled:
Pablo Greco ceb317
-			pr_info("Secure boot enabled\n");
Pablo Greco ceb317
-			break;
Pablo Greco ceb317
-		default:
Pablo Greco ceb317
-			pr_info("Secure boot could not be determined\n");
Pablo Greco ceb317
-			break;
Pablo Greco ceb317
-		}
Pablo Greco ceb317
-	}
Pablo Greco ceb317
+	efi_set_secure_boot(boot_params.secure_boot);
Pablo Greco ceb317
 
Pablo Greco ceb317
 	reserve_initrd();
Pablo Greco ceb317
 
Pablo Greco ceb317
diff --git a/drivers/firmware/efi/Makefile b/drivers/firmware/efi/Makefile
Pablo Greco ceb317
index c02ff25dd477..d860f8eb9a81 100644
Pablo Greco ceb317
--- a/drivers/firmware/efi/Makefile
Pablo Greco ceb317
+++ b/drivers/firmware/efi/Makefile
Pablo Greco ceb317
@@ -28,6 +28,7 @@ obj-$(CONFIG_EFI_FAKE_MEMMAP)		+= fake_map.o
Pablo Greco ceb317
 obj-$(CONFIG_EFI_BOOTLOADER_CONTROL)	+= efibc.o
Pablo Greco ceb317
 obj-$(CONFIG_EFI_TEST)			+= test/
Pablo Greco ceb317
 obj-$(CONFIG_EFI_DEV_PATH_PARSER)	+= dev-path-parser.o
Pablo Greco ceb317
+obj-$(CONFIG_EFI)			+= secureboot.o
Pablo Greco ceb317
 obj-$(CONFIG_APPLE_PROPERTIES)		+= apple-properties.o
Pablo Greco ceb317
 obj-$(CONFIG_EFI_RCI2_TABLE)		+= rci2-table.o
Pablo Greco ceb317
 obj-$(CONFIG_EFI_EMBEDDED_FIRMWARE)	+= embedded-firmware.o
Pablo Greco ceb317
diff --git a/drivers/firmware/efi/secureboot.c b/drivers/firmware/efi/secureboot.c
Pablo Greco ceb317
new file mode 100644
Pablo Greco ceb317
index 000000000000..de0a3714a5d4
Pablo Greco ceb317
--- /dev/null
Pablo Greco ceb317
+++ b/drivers/firmware/efi/secureboot.c
Pablo Greco ceb317
@@ -0,0 +1,38 @@
Pablo Greco ceb317
+/* Core kernel secure boot support.
Pablo Greco ceb317
+ *
Pablo Greco ceb317
+ * Copyright (C) 2017 Red Hat, Inc. All Rights Reserved.
Pablo Greco ceb317
+ * Written by David Howells (dhowells@redhat.com)
Pablo Greco ceb317
+ *
Pablo Greco ceb317
+ * This program is free software; you can redistribute it and/or
Pablo Greco ceb317
+ * modify it under the terms of the GNU General Public Licence
Pablo Greco ceb317
+ * as published by the Free Software Foundation; either version
Pablo Greco ceb317
+ * 2 of the Licence, or (at your option) any later version.
Pablo Greco ceb317
+ */
Pablo Greco ceb317
+
Pablo Greco ceb317
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
Pablo Greco ceb317
+
Pablo Greco ceb317
+#include <linux/efi.h>
Pablo Greco ceb317
+#include <linux/kernel.h>
Pablo Greco ceb317
+#include <linux/printk.h>
Pablo Greco ceb317
+
Pablo Greco ceb317
+/*
Pablo Greco ceb317
+ * Decide what to do when UEFI secure boot mode is enabled.
Pablo Greco ceb317
+ */
Pablo Greco ceb317
+void __init efi_set_secure_boot(enum efi_secureboot_mode mode)
Pablo Greco ceb317
+{
Pablo Greco ceb317
+	if (efi_enabled(EFI_BOOT)) {
Pablo Greco ceb317
+		switch (mode) {
Pablo Greco ceb317
+		case efi_secureboot_mode_disabled:
Pablo Greco ceb317
+			pr_info("Secure boot disabled\n");
Pablo Greco ceb317
+			break;
Pablo Greco ceb317
+		case efi_secureboot_mode_enabled:
Pablo Greco ceb317
+			set_bit(EFI_SECURE_BOOT, &efi.flags);
Pablo Greco ceb317
+			pr_info("Secure boot enabled\n");
Pablo Greco ceb317
+			break;
Pablo Greco ceb317
+		default:
Pablo Greco ceb317
+			pr_warn("Secure boot could not be determined (mode %u)\n",
Pablo Greco ceb317
+				   mode);
Pablo Greco ceb317
+			break;
Pablo Greco ceb317
+		}
Pablo Greco ceb317
+	}
Pablo Greco ceb317
+}
Pablo Greco ceb317
diff --git a/include/linux/efi.h b/include/linux/efi.h
Pablo Greco 7163c5
index 43c0667259a6..580547464acf 100644
Pablo Greco ceb317
--- a/include/linux/efi.h
Pablo Greco ceb317
+++ b/include/linux/efi.h
Pablo Greco 7163c5
@@ -786,6 +786,14 @@ extern int __init efi_setup_pcdp_console(char *);
Pablo Greco ceb317
 #define EFI_MEM_ATTR		10	/* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */
Pablo Greco ceb317
 #define EFI_MEM_NO_SOFT_RESERVE	11	/* Is the kernel configured to ignore soft reservations? */
Pablo Greco ceb317
 #define EFI_PRESERVE_BS_REGIONS	12	/* Are EFI boot-services memory segments available? */
Pablo Greco ceb317
+#define EFI_SECURE_BOOT		13	/* Are we in Secure Boot mode? */
Pablo Greco ceb317
+
Pablo Greco ceb317
+enum efi_secureboot_mode {
Pablo Greco ceb317
+	efi_secureboot_mode_unset,
Pablo Greco ceb317
+	efi_secureboot_mode_unknown,
Pablo Greco ceb317
+	efi_secureboot_mode_disabled,
Pablo Greco ceb317
+	efi_secureboot_mode_enabled,
Pablo Greco ceb317
+};
Pablo Greco ceb317
 
Pablo Greco ceb317
 #ifdef CONFIG_EFI
Pablo Greco ceb317
 /*
Pablo Greco 7163c5
@@ -797,6 +805,8 @@ static inline bool efi_enabled(int feature)
Pablo Greco ceb317
 }
Pablo Greco ceb317
 extern void efi_reboot(enum reboot_mode reboot_mode, const char *__unused);
Pablo Greco ceb317
 
Pablo Greco ceb317
+extern void __init efi_set_secure_boot(enum efi_secureboot_mode mode);
Pablo Greco ceb317
+
Pablo Greco ceb317
 bool __pure __efi_soft_reserve_enabled(void);
Pablo Greco ceb317
 
Pablo Greco ceb317
 static inline bool __pure efi_soft_reserve_enabled(void)
Pablo Greco 7163c5
@@ -817,6 +827,8 @@ static inline bool efi_enabled(int feature)
Pablo Greco ceb317
 static inline void
Pablo Greco ceb317
 efi_reboot(enum reboot_mode reboot_mode, const char *__unused) {}
Pablo Greco ceb317
 
Pablo Greco ceb317
+static inline void efi_set_secure_boot(enum efi_secureboot_mode mode) {}
Pablo Greco ceb317
+
Pablo Greco ceb317
 static inline bool efi_soft_reserve_enabled(void)
Pablo Greco ceb317
 {
Pablo Greco ceb317
 	return false;
Pablo Greco 7163c5
@@ -1082,13 +1094,6 @@ static inline bool efi_runtime_disabled(void) { return true; }
Pablo Greco ceb317
 extern void efi_call_virt_check_flags(unsigned long flags, const char *call);
Pablo Greco ceb317
 extern unsigned long efi_call_virt_save_flags(void);
Pablo Greco ceb317
 
Pablo Greco ceb317
-enum efi_secureboot_mode {
Pablo Greco ceb317
-	efi_secureboot_mode_unset,
Pablo Greco ceb317
-	efi_secureboot_mode_unknown,
Pablo Greco ceb317
-	efi_secureboot_mode_disabled,
Pablo Greco ceb317
-	efi_secureboot_mode_enabled,
Pablo Greco ceb317
-};
Pablo Greco ceb317
-
Pablo Greco ceb317
 static inline
Pablo Greco ceb317
 enum efi_secureboot_mode efi_get_secureboot_mode(efi_get_variable_t *get_var)
Pablo Greco ceb317
 {
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: David Howells <dhowells@redhat.com>
Pablo Greco ceb317
Date: Mon, 30 Sep 2019 21:28:16 +0000
Pablo Greco de6db6
Subject: [PATCH 14/33] efi: Lock down the kernel if booted in secure boot mode
Pablo Greco ceb317
Pablo Greco ceb317
UEFI Secure Boot provides a mechanism for ensuring that the firmware
Pablo Greco ceb317
will only load signed bootloaders and kernels.  Certain use cases may
Pablo Greco ceb317
also require that all kernel modules also be signed.  Add a
Pablo Greco ceb317
configuration option that to lock down the kernel - which includes
Pablo Greco ceb317
requiring validly signed modules - if the kernel is secure-booted.
Pablo Greco ceb317
Pablo Greco ceb317
Upstream Status: RHEL only
Pablo Greco ceb317
Signed-off-by: David Howells <dhowells@redhat.com>
Pablo Greco ceb317
Signed-off-by: Jeremy Cline <jcline@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 arch/x86/kernel/setup.c   |  8 ++++++++
Pablo Greco ceb317
 security/lockdown/Kconfig | 13 +++++++++++++
Pablo Greco ceb317
 2 files changed, 21 insertions(+)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
Pablo Greco de6db6
index 5294f24da2a7..8ff688720b59 100644
Pablo Greco ceb317
--- a/arch/x86/kernel/setup.c
Pablo Greco ceb317
+++ b/arch/x86/kernel/setup.c
Pablo Greco ceb317
@@ -20,6 +20,7 @@
Pablo Greco ceb317
 #include <linux/root_dev.h>
Pablo Greco ceb317
 #include <linux/hugetlb.h>
Pablo Greco ceb317
 #include <linux/tboot.h>
Pablo Greco ceb317
+#include <linux/security.h>
Pablo Greco ceb317
 #include <linux/usb/xhci-dbgp.h>
Pablo Greco ceb317
 #include <linux/static_call.h>
Pablo Greco ceb317
 #include <linux/swiotlb.h>
Pablo Greco de6db6
@@ -949,6 +950,13 @@ void __init setup_arch(char **cmdline_p)
Pablo Greco ceb317
 	if (efi_enabled(EFI_BOOT))
Pablo Greco ceb317
 		efi_init();
Pablo Greco ceb317
 
Pablo Greco ceb317
+	efi_set_secure_boot(boot_params.secure_boot);
Pablo Greco ceb317
+
Pablo Greco ceb317
+#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT
Pablo Greco ceb317
+	if (efi_enabled(EFI_SECURE_BOOT))
Pablo Greco ceb317
+		security_lock_kernel_down("EFI Secure Boot mode", LOCKDOWN_INTEGRITY_MAX);
Pablo Greco ceb317
+#endif
Pablo Greco ceb317
+
Pablo Greco ceb317
 	dmi_setup();
Pablo Greco ceb317
 
Pablo Greco ceb317
 	/*
Pablo Greco ceb317
diff --git a/security/lockdown/Kconfig b/security/lockdown/Kconfig
Pablo Greco ceb317
index e84ddf484010..d0501353a4b9 100644
Pablo Greco ceb317
--- a/security/lockdown/Kconfig
Pablo Greco ceb317
+++ b/security/lockdown/Kconfig
Pablo Greco ceb317
@@ -16,6 +16,19 @@ config SECURITY_LOCKDOWN_LSM_EARLY
Pablo Greco ceb317
 	  subsystem is fully initialised. If enabled, lockdown will
Pablo Greco ceb317
 	  unconditionally be called before any other LSMs.
Pablo Greco ceb317
 
Pablo Greco ceb317
+config LOCK_DOWN_IN_EFI_SECURE_BOOT
Pablo Greco ceb317
+	bool "Lock down the kernel in EFI Secure Boot mode"
Pablo Greco ceb317
+	default n
Pablo Greco ceb317
+	depends on EFI && SECURITY_LOCKDOWN_LSM_EARLY
Pablo Greco ceb317
+	help
Pablo Greco ceb317
+	  UEFI Secure Boot provides a mechanism for ensuring that the firmware
Pablo Greco ceb317
+	  will only load signed bootloaders and kernels.  Secure boot mode may
Pablo Greco ceb317
+	  be determined from EFI variables provided by the system firmware if
Pablo Greco ceb317
+	  not indicated by the boot parameters.
Pablo Greco ceb317
+
Pablo Greco ceb317
+	  Enabling this option results in kernel lockdown being triggered if
Pablo Greco ceb317
+	  EFI Secure Boot is set.
Pablo Greco ceb317
+
Pablo Greco ceb317
 choice
Pablo Greco ceb317
 	prompt "Kernel default lockdown mode"
Pablo Greco ceb317
 	default LOCK_DOWN_KERNEL_FORCE_NONE
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Jeremy Cline <jcline@redhat.com>
Pablo Greco ceb317
Date: Wed, 30 Oct 2019 14:37:49 +0000
Pablo Greco de6db6
Subject: [PATCH 15/33] s390: Lock down the kernel when the IPL secure flag is
Pablo Greco ceb317
 set
Pablo Greco ceb317
Pablo Greco ceb317
Automatically lock down the kernel to LOCKDOWN_CONFIDENTIALITY_MAX if
Pablo Greco ceb317
the IPL secure flag is set.
Pablo Greco ceb317
Pablo Greco ceb317
Upstream Status: RHEL only
Pablo Greco ceb317
Suggested-by: Philipp Rudo <prudo@redhat.com>
Pablo Greco ceb317
Signed-off-by: Jeremy Cline <jcline@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 arch/s390/include/asm/ipl.h | 1 +
Pablo Greco ceb317
 arch/s390/kernel/ipl.c      | 5 +++++
Pablo Greco ceb317
 arch/s390/kernel/setup.c    | 4 ++++
Pablo Greco ceb317
 3 files changed, 10 insertions(+)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/arch/s390/include/asm/ipl.h b/arch/s390/include/asm/ipl.h
Pablo Greco ceb317
index 3f8ee257f9aa..3ab92feb6241 100644
Pablo Greco ceb317
--- a/arch/s390/include/asm/ipl.h
Pablo Greco ceb317
+++ b/arch/s390/include/asm/ipl.h
Pablo Greco ceb317
@@ -128,6 +128,7 @@ int ipl_report_add_component(struct ipl_report *report, struct kexec_buf *kbuf,
Pablo Greco ceb317
 			     unsigned char flags, unsigned short cert);
Pablo Greco ceb317
 int ipl_report_add_certificate(struct ipl_report *report, void *key,
Pablo Greco ceb317
 			       unsigned long addr, unsigned long len);
Pablo Greco ceb317
+bool ipl_get_secureboot(void);
Pablo Greco ceb317
 
Pablo Greco ceb317
 /*
Pablo Greco ceb317
  * DIAG 308 support
Pablo Greco ceb317
diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
Pablo Greco 422940
index ba2988783d66..443c4a21cad3 100644
Pablo Greco ceb317
--- a/arch/s390/kernel/ipl.c
Pablo Greco ceb317
+++ b/arch/s390/kernel/ipl.c
Pablo Greco ceb317
@@ -2216,3 +2216,8 @@ int ipl_report_free(struct ipl_report *report)
Pablo Greco ceb317
 }
Pablo Greco ceb317
 
Pablo Greco ceb317
 #endif
Pablo Greco ceb317
+
Pablo Greco ceb317
+bool ipl_get_secureboot(void)
Pablo Greco ceb317
+{
Pablo Greco ceb317
+	return !!ipl_secure_flag;
Pablo Greco ceb317
+}
Pablo Greco ceb317
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
Pablo Greco 422940
index 4dfe37b06889..da67876b8b15 100644
Pablo Greco ceb317
--- a/arch/s390/kernel/setup.c
Pablo Greco ceb317
+++ b/arch/s390/kernel/setup.c
Pablo Greco ceb317
@@ -49,6 +49,7 @@
Pablo Greco ceb317
 #include <linux/memory.h>
Pablo Greco ceb317
 #include <linux/compat.h>
Pablo Greco ceb317
 #include <linux/start_kernel.h>
Pablo Greco ceb317
+#include <linux/security.h>
Pablo Greco ceb317
 #include <linux/hugetlb.h>
Pablo Greco ceb317
 #include <linux/kmemleak.h>
Pablo Greco ceb317
 
Pablo Greco 422940
@@ -972,6 +973,9 @@ void __init setup_arch(char **cmdline_p)
Pablo Greco ceb317
 
Pablo Greco ceb317
 	log_component_list();
Pablo Greco ceb317
 
Pablo Greco ceb317
+	if (ipl_get_secureboot())
Pablo Greco ceb317
+		security_lock_kernel_down("Secure IPL mode", LOCKDOWN_INTEGRITY_MAX);
Pablo Greco ceb317
+
Pablo Greco ceb317
 	/* Have one command line that is parsed and saved in /proc/cmdline */
Pablo Greco ceb317
 	/* boot_command_line has been already set up in early.c */
Pablo Greco ceb317
 	*cmdline_p = boot_command_line;
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Peter Robinson <pbrobinson@gmail.com>
Pablo Greco ceb317
Date: Wed, 26 Feb 2020 13:38:40 -0500
Pablo Greco de6db6
Subject: [PATCH 16/33] Add option of 13 for FORCE_MAX_ZONEORDER
Pablo Greco ceb317
Pablo Greco ceb317
This is a hack, but it's what the other distros currently use
Pablo Greco ceb317
for aarch64 with 4K pages so we'll do the same while upstream
Pablo Greco ceb317
decides what the best outcome is (which isn't this).
Pablo Greco ceb317
Pablo Greco ceb317
Upstream Status: RHEL only
Pablo Greco ceb317
Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
Pablo Greco ceb317
[Add a dependency on RHEL_DIFFERENCES]
Pablo Greco ceb317
Signed-off-by: Jeremy Cline <jcline@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 arch/arm64/Kconfig | 1 +
Pablo Greco ceb317
 1 file changed, 1 insertion(+)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
Pablo Greco 422940
index 22caf88c64ca..0e702d154997 100644
Pablo Greco ceb317
--- a/arch/arm64/Kconfig
Pablo Greco ceb317
+++ b/arch/arm64/Kconfig
Pablo Greco 422940
@@ -1183,6 +1183,7 @@ config XEN
Pablo Greco ceb317
 config FORCE_MAX_ZONEORDER
Pablo Greco ceb317
 	int
Pablo Greco ceb317
 	default "14" if ARM64_64K_PAGES
Pablo Greco ceb317
+	default "13" if (ARCH_THUNDER && !ARM64_64K_PAGES && !RHEL_DIFFERENCES)
Pablo Greco ceb317
 	default "12" if ARM64_16K_PAGES
Pablo Greco ceb317
 	default "11"
Pablo Greco ceb317
 	help
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco 89a396
From: Mark Salter <msalter@redhat.com>
Pablo Greco 89a396
Date: Thu, 26 Aug 2021 10:59:23 -0400
Pablo Greco de6db6
Subject: [PATCH 17/33] arm64: use common CONFIG_MAX_ZONEORDER for arm kernel
Pablo Greco 89a396
Pablo Greco 89a396
Now that RHEL9 is using 4K pagesize, MAX_ZONEORDER is defaulting
Pablo Greco 89a396
to 11. Fedora uses an out of tree patch to default to 13 when
Pablo Greco 89a396
building for server class machines. RHEL9 should also be using 13,
Pablo Greco 89a396
so make the MAX_ZONEORDER config and the out of tree patch common
Pablo Greco 89a396
between RHEL9 and Fedora.
Pablo Greco 89a396
Pablo Greco 89a396
Signed-off-by: Mark Salter <msalter@redhat.com>
Pablo Greco 89a396
---
Pablo Greco 89a396
 arch/arm64/Kconfig | 2 +-
Pablo Greco 89a396
 1 file changed, 1 insertion(+), 1 deletion(-)
Pablo Greco 89a396
Pablo Greco 89a396
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
Pablo Greco 422940
index 0e702d154997..abd34d88b9ea 100644
Pablo Greco 89a396
--- a/arch/arm64/Kconfig
Pablo Greco 89a396
+++ b/arch/arm64/Kconfig
Pablo Greco 422940
@@ -1183,7 +1183,7 @@ config XEN
Pablo Greco 89a396
 config FORCE_MAX_ZONEORDER
Pablo Greco 89a396
 	int
Pablo Greco 89a396
 	default "14" if ARM64_64K_PAGES
Pablo Greco 89a396
-	default "13" if (ARCH_THUNDER && !ARM64_64K_PAGES && !RHEL_DIFFERENCES)
Pablo Greco 89a396
+	default "13" if (ARCH_THUNDER && !ARM64_64K_PAGES)
Pablo Greco 89a396
 	default "12" if ARM64_16K_PAGES
Pablo Greco 89a396
 	default "11"
Pablo Greco 89a396
 	help
Pablo Greco 89a396
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco 89a396
Pablo Greco 89a396
Pablo Greco 89a396
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Jon Masters <jcm@redhat.com>
Pablo Greco ceb317
Date: Thu, 18 Jul 2019 15:47:26 -0400
Pablo Greco de6db6
Subject: [PATCH 18/33] arm: make CONFIG_HIGHPTE optional without CONFIG_EXPERT
Pablo Greco ceb317
Pablo Greco ceb317
We will use this to force CONFIG_HIGHPTE off on LPAE for now
Pablo Greco ceb317
Pablo Greco ceb317
Signed-off-by: Jon Masters <jcm@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 arch/arm/Kconfig | 4 ++--
Pablo Greco ceb317
 1 file changed, 2 insertions(+), 2 deletions(-)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
Pablo Greco ceb317
index 4ebd512043be..6743668b7b33 100644
Pablo Greco ceb317
--- a/arch/arm/Kconfig
Pablo Greco ceb317
+++ b/arch/arm/Kconfig
Pablo Greco ceb317
@@ -1471,9 +1471,9 @@ config HIGHMEM
Pablo Greco ceb317
 	  If unsure, say n.
Pablo Greco ceb317
 
Pablo Greco ceb317
 config HIGHPTE
Pablo Greco ceb317
-	bool "Allocate 2nd-level pagetables from highmem" if EXPERT
Pablo Greco ceb317
+	bool "Allocate 2nd-level pagetables from highmem"
Pablo Greco ceb317
 	depends on HIGHMEM
Pablo Greco ceb317
-	default y
Pablo Greco ceb317
+	default n
Pablo Greco ceb317
 	help
Pablo Greco ceb317
 	  The VM uses one page of physical memory for each page table.
Pablo Greco ceb317
 	  For systems with a lot of processes, this can use a lot of
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Peter Robinson <pbrobinson@gmail.com>
Pablo Greco ceb317
Date: Thu, 3 May 2012 20:27:11 +0100
Pablo Greco de6db6
Subject: [PATCH 19/33] ARM: tegra: usb no reset
Pablo Greco ceb317
Pablo Greco ceb317
Patch for disconnect issues with storage attached to a
Pablo Greco ceb317
 tegra-ehci controller
Pablo Greco ceb317
---
Pablo Greco ceb317
 drivers/usb/core/hub.c | 7 +++++++
Pablo Greco ceb317
 1 file changed, 7 insertions(+)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
Pablo Greco 422940
index 98bdae4ac314..2ff2777a827a 100644
Pablo Greco ceb317
--- a/drivers/usb/core/hub.c
Pablo Greco ceb317
+++ b/drivers/usb/core/hub.c
Pablo Greco 08fca0
@@ -5669,6 +5669,13 @@ static void hub_event(struct work_struct *work)
Pablo Greco ceb317
 			(u16) hub->change_bits[0],
Pablo Greco ceb317
 			(u16) hub->event_bits[0]);
Pablo Greco ceb317
 
Pablo Greco ceb317
+	/* Don't disconnect USB-SATA on TrimSlice */
Pablo Greco ceb317
+	if (strcmp(dev_name(hdev->bus->controller), "tegra-ehci.0") == 0) {
Pablo Greco ceb317
+		if ((hdev->state == 7) && (hub->change_bits[0] == 0) &&
Pablo Greco ceb317
+				(hub->event_bits[0] == 0x2))
Pablo Greco ceb317
+			hub->event_bits[0] = 0;
Pablo Greco ceb317
+	}
Pablo Greco ceb317
+
Pablo Greco ceb317
 	/* Lock the device, then check to see if we were
Pablo Greco ceb317
 	 * disconnected while waiting for the lock to succeed. */
Pablo Greco ceb317
 	usb_lock_device(hdev);
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Pablo Greco ceb317
Date: Mon, 3 Apr 2017 18:18:21 +0200
Pablo Greco de6db6
Subject: [PATCH 20/33] Input: rmi4 - remove the need for artificial IRQ in
Pablo Greco ceb317
 case of HID
Pablo Greco ceb317
Pablo Greco ceb317
The IRQ from rmi4 may interfere with the one we currently use on i2c-hid.
Pablo Greco ceb317
Given that there is already a need for an external API from rmi4 to
Pablo Greco ceb317
forward the attention data, we can, in this particular case rely on a
Pablo Greco ceb317
separate workqueue to prevent cursor jumps.
Pablo Greco ceb317
Pablo Greco ceb317
Reported-by: Cameron Gutman <aicommander@gmail.com>
Pablo Greco ceb317
Reported-by: Thorsten Leemhuis <linux@leemhuis.info>
Pablo Greco ceb317
Reported-by: Jason Ekstrand <jason@jlekstrand.net>
Pablo Greco ceb317
Tested-by: Andrew Duggan <aduggan@synaptics.com>
Pablo Greco ceb317
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Pablo Greco ceb317
Signed-off-by: Lyude <lyude@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 drivers/hid/hid-rmi.c           |  64 -----------------
Pablo Greco ceb317
 drivers/input/rmi4/rmi_driver.c | 124 +++++++++++++++++++-------------
Pablo Greco ceb317
 include/linux/rmi.h             |   1 +
Pablo Greco ceb317
 3 files changed, 75 insertions(+), 114 deletions(-)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
Pablo Greco ceb317
index 311eee599ce9..2460c6bd46f8 100644
Pablo Greco ceb317
--- a/drivers/hid/hid-rmi.c
Pablo Greco ceb317
+++ b/drivers/hid/hid-rmi.c
Pablo Greco ceb317
@@ -322,19 +322,12 @@ static int rmi_input_event(struct hid_device *hdev, u8 *data, int size)
Pablo Greco ceb317
 {
Pablo Greco ceb317
 	struct rmi_data *hdata = hid_get_drvdata(hdev);
Pablo Greco ceb317
 	struct rmi_device *rmi_dev = hdata->xport.rmi_dev;
Pablo Greco ceb317
-	unsigned long flags;
Pablo Greco ceb317
 
Pablo Greco ceb317
 	if (!(test_bit(RMI_STARTED, &hdata->flags)))
Pablo Greco ceb317
 		return 0;
Pablo Greco ceb317
 
Pablo Greco ceb317
-	local_irq_save(flags);
Pablo Greco ceb317
-
Pablo Greco ceb317
 	rmi_set_attn_data(rmi_dev, data[1], &data[2], size - 2);
Pablo Greco ceb317
 
Pablo Greco ceb317
-	generic_handle_irq(hdata->rmi_irq);
Pablo Greco ceb317
-
Pablo Greco ceb317
-	local_irq_restore(flags);
Pablo Greco ceb317
-
Pablo Greco ceb317
 	return 1;
Pablo Greco ceb317
 }
Pablo Greco ceb317
 
Pablo Greco ceb317
@@ -591,56 +584,6 @@ static const struct rmi_transport_ops hid_rmi_ops = {
Pablo Greco ceb317
 	.reset		= rmi_hid_reset,
Pablo Greco ceb317
 };
Pablo Greco ceb317
 
Pablo Greco ceb317
-static void rmi_irq_teardown(void *data)
Pablo Greco ceb317
-{
Pablo Greco ceb317
-	struct rmi_data *hdata = data;
Pablo Greco ceb317
-	struct irq_domain *domain = hdata->domain;
Pablo Greco ceb317
-
Pablo Greco ceb317
-	if (!domain)
Pablo Greco ceb317
-		return;
Pablo Greco ceb317
-
Pablo Greco ceb317
-	irq_dispose_mapping(irq_find_mapping(domain, 0));
Pablo Greco ceb317
-
Pablo Greco ceb317
-	irq_domain_remove(domain);
Pablo Greco ceb317
-	hdata->domain = NULL;
Pablo Greco ceb317
-	hdata->rmi_irq = 0;
Pablo Greco ceb317
-}
Pablo Greco ceb317
-
Pablo Greco ceb317
-static int rmi_irq_map(struct irq_domain *h, unsigned int virq,
Pablo Greco ceb317
-		       irq_hw_number_t hw_irq_num)
Pablo Greco ceb317
-{
Pablo Greco ceb317
-	irq_set_chip_and_handler(virq, &dummy_irq_chip, handle_simple_irq);
Pablo Greco ceb317
-
Pablo Greco ceb317
-	return 0;
Pablo Greco ceb317
-}
Pablo Greco ceb317
-
Pablo Greco ceb317
-static const struct irq_domain_ops rmi_irq_ops = {
Pablo Greco ceb317
-	.map = rmi_irq_map,
Pablo Greco ceb317
-};
Pablo Greco ceb317
-
Pablo Greco ceb317
-static int rmi_setup_irq_domain(struct hid_device *hdev)
Pablo Greco ceb317
-{
Pablo Greco ceb317
-	struct rmi_data *hdata = hid_get_drvdata(hdev);
Pablo Greco ceb317
-	int ret;
Pablo Greco ceb317
-
Pablo Greco ceb317
-	hdata->domain = irq_domain_create_linear(hdev->dev.fwnode, 1,
Pablo Greco ceb317
-						 &rmi_irq_ops, hdata);
Pablo Greco ceb317
-	if (!hdata->domain)
Pablo Greco ceb317
-		return -ENOMEM;
Pablo Greco ceb317
-
Pablo Greco ceb317
-	ret = devm_add_action_or_reset(&hdev->dev, &rmi_irq_teardown, hdata);
Pablo Greco ceb317
-	if (ret)
Pablo Greco ceb317
-		return ret;
Pablo Greco ceb317
-
Pablo Greco ceb317
-	hdata->rmi_irq = irq_create_mapping(hdata->domain, 0);
Pablo Greco ceb317
-	if (hdata->rmi_irq <= 0) {
Pablo Greco ceb317
-		hid_err(hdev, "Can't allocate an IRQ\n");
Pablo Greco ceb317
-		return hdata->rmi_irq < 0 ? hdata->rmi_irq : -ENXIO;
Pablo Greco ceb317
-	}
Pablo Greco ceb317
-
Pablo Greco ceb317
-	return 0;
Pablo Greco ceb317
-}
Pablo Greco ceb317
-
Pablo Greco ceb317
 static int rmi_probe(struct hid_device *hdev, const struct hid_device_id *id)
Pablo Greco ceb317
 {
Pablo Greco ceb317
 	struct rmi_data *data = NULL;
Pablo Greco ceb317
@@ -713,18 +656,11 @@ static int rmi_probe(struct hid_device *hdev, const struct hid_device_id *id)
Pablo Greco ceb317
 
Pablo Greco ceb317
 	mutex_init(&data->page_mutex);
Pablo Greco ceb317
 
Pablo Greco ceb317
-	ret = rmi_setup_irq_domain(hdev);
Pablo Greco ceb317
-	if (ret) {
Pablo Greco ceb317
-		hid_err(hdev, "failed to allocate IRQ domain\n");
Pablo Greco ceb317
-		return ret;
Pablo Greco ceb317
-	}
Pablo Greco ceb317
-
Pablo Greco ceb317
 	if (data->device_flags & RMI_DEVICE_HAS_PHYS_BUTTONS)
Pablo Greco ceb317
 		rmi_hid_pdata.gpio_data.disable = true;
Pablo Greco ceb317
 
Pablo Greco ceb317
 	data->xport.dev = hdev->dev.parent;
Pablo Greco ceb317
 	data->xport.pdata = rmi_hid_pdata;
Pablo Greco ceb317
-	data->xport.pdata.irq = data->rmi_irq;
Pablo Greco ceb317
 	data->xport.proto_name = "hid";
Pablo Greco ceb317
 	data->xport.ops = &hid_rmi_ops;
Pablo Greco ceb317
 
Pablo Greco ceb317
diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
Pablo Greco ceb317
index 258d5fe3d395..f7298e3dc8f3 100644
Pablo Greco ceb317
--- a/drivers/input/rmi4/rmi_driver.c
Pablo Greco ceb317
+++ b/drivers/input/rmi4/rmi_driver.c
Pablo Greco ceb317
@@ -182,34 +182,47 @@ void rmi_set_attn_data(struct rmi_device *rmi_dev, unsigned long irq_status,
Pablo Greco ceb317
 	attn_data.data = fifo_data;
Pablo Greco ceb317
 
Pablo Greco ceb317
 	kfifo_put(&drvdata->attn_fifo, attn_data);
Pablo Greco ceb317
+
Pablo Greco ceb317
+	schedule_work(&drvdata->attn_work);
Pablo Greco ceb317
 }
Pablo Greco ceb317
 EXPORT_SYMBOL_GPL(rmi_set_attn_data);
Pablo Greco ceb317
 
Pablo Greco ceb317
-static irqreturn_t rmi_irq_fn(int irq, void *dev_id)
Pablo Greco ceb317
+static void attn_callback(struct work_struct *work)
Pablo Greco ceb317
 {
Pablo Greco ceb317
-	struct rmi_device *rmi_dev = dev_id;
Pablo Greco ceb317
-	struct rmi_driver_data *drvdata = dev_get_drvdata(&rmi_dev->dev);
Pablo Greco ceb317
+	struct rmi_driver_data *drvdata = container_of(work,
Pablo Greco ceb317
+							struct rmi_driver_data,
Pablo Greco ceb317
+							attn_work);
Pablo Greco ceb317
 	struct rmi4_attn_data attn_data = {0};
Pablo Greco ceb317
 	int ret, count;
Pablo Greco ceb317
 
Pablo Greco ceb317
 	count = kfifo_get(&drvdata->attn_fifo, &attn_data);
Pablo Greco ceb317
-	if (count) {
Pablo Greco ceb317
-		*(drvdata->irq_status) = attn_data.irq_status;
Pablo Greco ceb317
-		drvdata->attn_data = attn_data;
Pablo Greco ceb317
-	}
Pablo Greco ceb317
+	if (!count)
Pablo Greco ceb317
+		return;
Pablo Greco ceb317
 
Pablo Greco ceb317
-	ret = rmi_process_interrupt_requests(rmi_dev);
Pablo Greco ceb317
+	*(drvdata->irq_status) = attn_data.irq_status;
Pablo Greco ceb317
+	drvdata->attn_data = attn_data;
Pablo Greco ceb317
+
Pablo Greco ceb317
+	ret = rmi_process_interrupt_requests(drvdata->rmi_dev);
Pablo Greco ceb317
 	if (ret)
Pablo Greco ceb317
-		rmi_dbg(RMI_DEBUG_CORE, &rmi_dev->dev,
Pablo Greco ceb317
+		rmi_dbg(RMI_DEBUG_CORE, &drvdata->rmi_dev->dev,
Pablo Greco ceb317
 			"Failed to process interrupt request: %d\n", ret);
Pablo Greco ceb317
 
Pablo Greco ceb317
-	if (count) {
Pablo Greco ceb317
-		kfree(attn_data.data);
Pablo Greco ceb317
-		drvdata->attn_data.data = NULL;
Pablo Greco ceb317
-	}
Pablo Greco ceb317
+	kfree(attn_data.data);
Pablo Greco ceb317
+	drvdata->attn_data.data = NULL;
Pablo Greco ceb317
 
Pablo Greco ceb317
 	if (!kfifo_is_empty(&drvdata->attn_fifo))
Pablo Greco ceb317
-		return rmi_irq_fn(irq, dev_id);
Pablo Greco ceb317
+		schedule_work(&drvdata->attn_work);
Pablo Greco ceb317
+}
Pablo Greco ceb317
+
Pablo Greco ceb317
+static irqreturn_t rmi_irq_fn(int irq, void *dev_id)
Pablo Greco ceb317
+{
Pablo Greco ceb317
+	struct rmi_device *rmi_dev = dev_id;
Pablo Greco ceb317
+	int ret;
Pablo Greco ceb317
+
Pablo Greco ceb317
+	ret = rmi_process_interrupt_requests(rmi_dev);
Pablo Greco ceb317
+	if (ret)
Pablo Greco ceb317
+		rmi_dbg(RMI_DEBUG_CORE, &rmi_dev->dev,
Pablo Greco ceb317
+			"Failed to process interrupt request: %d\n", ret);
Pablo Greco ceb317
 
Pablo Greco ceb317
 	return IRQ_HANDLED;
Pablo Greco ceb317
 }
Pablo Greco ceb317
@@ -217,7 +230,6 @@ static irqreturn_t rmi_irq_fn(int irq, void *dev_id)
Pablo Greco ceb317
 static int rmi_irq_init(struct rmi_device *rmi_dev)
Pablo Greco ceb317
 {
Pablo Greco ceb317
 	struct rmi_device_platform_data *pdata = rmi_get_platform_data(rmi_dev);
Pablo Greco ceb317
-	struct rmi_driver_data *data = dev_get_drvdata(&rmi_dev->dev);
Pablo Greco ceb317
 	int irq_flags = irq_get_trigger_type(pdata->irq);
Pablo Greco ceb317
 	int ret;
Pablo Greco ceb317
 
Pablo Greco ceb317
@@ -235,8 +247,6 @@ static int rmi_irq_init(struct rmi_device *rmi_dev)
Pablo Greco ceb317
 		return ret;
Pablo Greco ceb317
 	}
Pablo Greco ceb317
 
Pablo Greco ceb317
-	data->enabled = true;
Pablo Greco ceb317
-
Pablo Greco ceb317
 	return 0;
Pablo Greco ceb317
 }
Pablo Greco ceb317
 
Pablo Greco ceb317
@@ -886,23 +896,27 @@ void rmi_enable_irq(struct rmi_device *rmi_dev, bool clear_wake)
Pablo Greco ceb317
 	if (data->enabled)
Pablo Greco ceb317
 		goto out;
Pablo Greco ceb317
 
Pablo Greco ceb317
-	enable_irq(irq);
Pablo Greco ceb317
-	data->enabled = true;
Pablo Greco ceb317
-	if (clear_wake && device_may_wakeup(rmi_dev->xport->dev)) {
Pablo Greco ceb317
-		retval = disable_irq_wake(irq);
Pablo Greco ceb317
-		if (retval)
Pablo Greco ceb317
-			dev_warn(&rmi_dev->dev,
Pablo Greco ceb317
-				 "Failed to disable irq for wake: %d\n",
Pablo Greco ceb317
-				 retval);
Pablo Greco ceb317
-	}
Pablo Greco ceb317
+	if (irq) {
Pablo Greco ceb317
+		enable_irq(irq);
Pablo Greco ceb317
+		data->enabled = true;
Pablo Greco ceb317
+		if (clear_wake && device_may_wakeup(rmi_dev->xport->dev)) {
Pablo Greco ceb317
+			retval = disable_irq_wake(irq);
Pablo Greco ceb317
+			if (retval)
Pablo Greco ceb317
+				dev_warn(&rmi_dev->dev,
Pablo Greco ceb317
+					 "Failed to disable irq for wake: %d\n",
Pablo Greco ceb317
+					 retval);
Pablo Greco ceb317
+		}
Pablo Greco ceb317
 
Pablo Greco ceb317
-	/*
Pablo Greco ceb317
-	 * Call rmi_process_interrupt_requests() after enabling irq,
Pablo Greco ceb317
-	 * otherwise we may lose interrupt on edge-triggered systems.
Pablo Greco ceb317
-	 */
Pablo Greco ceb317
-	irq_flags = irq_get_trigger_type(pdata->irq);
Pablo Greco ceb317
-	if (irq_flags & IRQ_TYPE_EDGE_BOTH)
Pablo Greco ceb317
-		rmi_process_interrupt_requests(rmi_dev);
Pablo Greco ceb317
+		/*
Pablo Greco ceb317
+		 * Call rmi_process_interrupt_requests() after enabling irq,
Pablo Greco ceb317
+		 * otherwise we may lose interrupt on edge-triggered systems.
Pablo Greco ceb317
+		 */
Pablo Greco ceb317
+		irq_flags = irq_get_trigger_type(pdata->irq);
Pablo Greco ceb317
+		if (irq_flags & IRQ_TYPE_EDGE_BOTH)
Pablo Greco ceb317
+			rmi_process_interrupt_requests(rmi_dev);
Pablo Greco ceb317
+	} else {
Pablo Greco ceb317
+		data->enabled = true;
Pablo Greco ceb317
+	}
Pablo Greco ceb317
 
Pablo Greco ceb317
 out:
Pablo Greco ceb317
 	mutex_unlock(&data->enabled_mutex);
Pablo Greco ceb317
@@ -922,20 +936,22 @@ void rmi_disable_irq(struct rmi_device *rmi_dev, bool enable_wake)
Pablo Greco ceb317
 		goto out;
Pablo Greco ceb317
 
Pablo Greco ceb317
 	data->enabled = false;
Pablo Greco ceb317
-	disable_irq(irq);
Pablo Greco ceb317
-	if (enable_wake && device_may_wakeup(rmi_dev->xport->dev)) {
Pablo Greco ceb317
-		retval = enable_irq_wake(irq);
Pablo Greco ceb317
-		if (retval)
Pablo Greco ceb317
-			dev_warn(&rmi_dev->dev,
Pablo Greco ceb317
-				 "Failed to enable irq for wake: %d\n",
Pablo Greco ceb317
-				 retval);
Pablo Greco ceb317
-	}
Pablo Greco ceb317
-
Pablo Greco ceb317
-	/* make sure the fifo is clean */
Pablo Greco ceb317
-	while (!kfifo_is_empty(&data->attn_fifo)) {
Pablo Greco ceb317
-		count = kfifo_get(&data->attn_fifo, &attn_data);
Pablo Greco ceb317
-		if (count)
Pablo Greco ceb317
-			kfree(attn_data.data);
Pablo Greco ceb317
+	if (irq) {
Pablo Greco ceb317
+		disable_irq(irq);
Pablo Greco ceb317
+		if (enable_wake && device_may_wakeup(rmi_dev->xport->dev)) {
Pablo Greco ceb317
+			retval = enable_irq_wake(irq);
Pablo Greco ceb317
+			if (retval)
Pablo Greco ceb317
+				dev_warn(&rmi_dev->dev,
Pablo Greco ceb317
+					 "Failed to enable irq for wake: %d\n",
Pablo Greco ceb317
+					 retval);
Pablo Greco ceb317
+		}
Pablo Greco ceb317
+	} else {
Pablo Greco ceb317
+		/* make sure the fifo is clean */
Pablo Greco ceb317
+		while (!kfifo_is_empty(&data->attn_fifo)) {
Pablo Greco ceb317
+			count = kfifo_get(&data->attn_fifo, &attn_data);
Pablo Greco ceb317
+			if (count)
Pablo Greco ceb317
+				kfree(attn_data.data);
Pablo Greco ceb317
+		}
Pablo Greco ceb317
 	}
Pablo Greco ceb317
 
Pablo Greco ceb317
 out:
Pablo Greco ceb317
@@ -981,6 +997,8 @@ static int rmi_driver_remove(struct device *dev)
Pablo Greco ceb317
 	irq_domain_remove(data->irqdomain);
Pablo Greco ceb317
 	data->irqdomain = NULL;
Pablo Greco ceb317
 
Pablo Greco ceb317
+	cancel_work_sync(&data->attn_work);
Pablo Greco ceb317
+
Pablo Greco ceb317
 	rmi_f34_remove_sysfs(rmi_dev);
Pablo Greco ceb317
 	rmi_free_function_list(rmi_dev);
Pablo Greco ceb317
 
Pablo Greco ceb317
@@ -1219,9 +1237,15 @@ static int rmi_driver_probe(struct device *dev)
Pablo Greco ceb317
 		}
Pablo Greco ceb317
 	}
Pablo Greco ceb317
 
Pablo Greco ceb317
-	retval = rmi_irq_init(rmi_dev);
Pablo Greco ceb317
-	if (retval < 0)
Pablo Greco ceb317
-		goto err_destroy_functions;
Pablo Greco ceb317
+	if (pdata->irq) {
Pablo Greco ceb317
+		retval = rmi_irq_init(rmi_dev);
Pablo Greco ceb317
+		if (retval < 0)
Pablo Greco ceb317
+			goto err_destroy_functions;
Pablo Greco ceb317
+	}
Pablo Greco ceb317
+
Pablo Greco ceb317
+	data->enabled = true;
Pablo Greco ceb317
+
Pablo Greco ceb317
+	INIT_WORK(&data->attn_work, attn_callback);
Pablo Greco ceb317
 
Pablo Greco ceb317
 	if (data->f01_container->dev.driver) {
Pablo Greco ceb317
 		/* Driver already bound, so enable ATTN now. */
Pablo Greco ceb317
diff --git a/include/linux/rmi.h b/include/linux/rmi.h
Pablo Greco ceb317
index ab7eea01ab42..fff7c5f737fc 100644
Pablo Greco ceb317
--- a/include/linux/rmi.h
Pablo Greco ceb317
+++ b/include/linux/rmi.h
Pablo Greco ceb317
@@ -364,6 +364,7 @@ struct rmi_driver_data {
Pablo Greco ceb317
 
Pablo Greco ceb317
 	struct rmi4_attn_data attn_data;
Pablo Greco ceb317
 	DECLARE_KFIFO(attn_fifo, struct rmi4_attn_data, 16);
Pablo Greco ceb317
+	struct work_struct attn_work;
Pablo Greco ceb317
 };
Pablo Greco ceb317
 
Pablo Greco ceb317
 int rmi_register_transport_device(struct rmi_transport_dev *xport);
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Robert Holmes <robeholmes@gmail.com>
Pablo Greco ceb317
Date: Tue, 23 Apr 2019 07:39:29 +0000
Pablo Greco de6db6
Subject: [PATCH 21/33] KEYS: Make use of platform keyring for module signature
Pablo Greco ceb317
 verify
Pablo Greco ceb317
Pablo Greco ceb317
This patch completes commit 278311e417be ("kexec, KEYS: Make use of
Pablo Greco ceb317
platform keyring for signature verify") which, while adding the
Pablo Greco ceb317
platform keyring for bzImage verification, neglected to also add
Pablo Greco ceb317
this keyring for module verification.
Pablo Greco ceb317
Pablo Greco ceb317
As such, kernel modules signed with keys from the MokList variable
Pablo Greco ceb317
were not successfully verified.
Pablo Greco ceb317
Pablo Greco ceb317
Signed-off-by: Robert Holmes <robeholmes@gmail.com>
Pablo Greco ceb317
Signed-off-by: Jeremy Cline <jcline@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 kernel/module_signing.c | 9 ++++++++-
Pablo Greco ceb317
 1 file changed, 8 insertions(+), 1 deletion(-)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/kernel/module_signing.c b/kernel/module_signing.c
Pablo Greco ceb317
index 8723ae70ea1f..fb2d773498c2 100644
Pablo Greco ceb317
--- a/kernel/module_signing.c
Pablo Greco ceb317
+++ b/kernel/module_signing.c
Pablo Greco ceb317
@@ -38,8 +38,15 @@ int mod_verify_sig(const void *mod, struct load_info *info)
Pablo Greco ceb317
 	modlen -= sig_len + sizeof(ms);
Pablo Greco ceb317
 	info->len = modlen;
Pablo Greco ceb317
 
Pablo Greco ceb317
-	return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
Pablo Greco ceb317
+	ret = verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
Pablo Greco ceb317
 				      VERIFY_USE_SECONDARY_KEYRING,
Pablo Greco ceb317
 				      VERIFYING_MODULE_SIGNATURE,
Pablo Greco ceb317
 				      NULL, NULL);
Pablo Greco ceb317
+	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
Pablo Greco ceb317
+		ret = verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
Pablo Greco ceb317
+				VERIFY_USE_PLATFORM_KEYRING,
Pablo Greco ceb317
+				VERIFYING_MODULE_SIGNATURE,
Pablo Greco ceb317
+				NULL, NULL);
Pablo Greco ceb317
+	}
Pablo Greco ceb317
+	return ret;
Pablo Greco ceb317
 }
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Jeremy Linton <jeremy.linton@arm.com>
Pablo Greco ceb317
Date: Thu, 11 Mar 2021 22:15:13 -0600
Pablo Greco de6db6
Subject: [PATCH 22/33] REDHAT: coresight: etm4x: Disable coresight on HPE
Pablo Greco ceb317
 Apollo 70
Pablo Greco ceb317
Pablo Greco ceb317
bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1918888
Pablo Greco ceb317
Pablo Greco ceb317
The coresight tables on the latest Apollo 70, appear to be
Pablo Greco ceb317
damaged sufficiently to throw a few hundred lines of back-traces
Pablo Greco ceb317
during boot, lets disable it until we can get a firmware fix.
Pablo Greco ceb317
Pablo Greco ceb317
Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
Pablo Greco ceb317
cc: Peter Robinson <pbrobinson@redhat.com>
Pablo Greco ceb317
cc: Justin M. Forbes <jforbes@fedoraproject.org>
Pablo Greco ceb317
cc: Al Stone <ahs3@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 .../coresight/coresight-etm4x-core.c          | 19 +++++++++++++++++++
Pablo Greco ceb317
 1 file changed, 19 insertions(+)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
Pablo Greco ceb317
index e24252eaf8e4..368d64adeee8 100644
Pablo Greco ceb317
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
Pablo Greco ceb317
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
Pablo Greco ceb317
@@ -9,6 +9,7 @@
Pablo Greco ceb317
 #include <linux/init.h>
Pablo Greco ceb317
 #include <linux/types.h>
Pablo Greco ceb317
 #include <linux/device.h>
Pablo Greco ceb317
+#include <linux/dmi.h>
Pablo Greco ceb317
 #include <linux/io.h>
Pablo Greco ceb317
 #include <linux/err.h>
Pablo Greco ceb317
 #include <linux/fs.h>
Pablo Greco ceb317
@@ -2105,6 +2106,16 @@ static const struct amba_id etm4_ids[] = {
Pablo Greco ceb317
 	{},
Pablo Greco ceb317
 };
Pablo Greco ceb317
 
Pablo Greco ceb317
+static const struct dmi_system_id broken_coresight[] = {
Pablo Greco ceb317
+	{
Pablo Greco ceb317
+		.matches = {
Pablo Greco ceb317
+			DMI_MATCH(DMI_SYS_VENDOR, "HPE"),
Pablo Greco ceb317
+			DMI_MATCH(DMI_PRODUCT_NAME, "Apollo 70"),
Pablo Greco ceb317
+		},
Pablo Greco ceb317
+	},
Pablo Greco ceb317
+	{ }	/* terminating entry */
Pablo Greco ceb317
+};
Pablo Greco ceb317
+
Pablo Greco ceb317
 MODULE_DEVICE_TABLE(amba, etm4_ids);
Pablo Greco ceb317
 
Pablo Greco ceb317
 static struct amba_driver etm4x_amba_driver = {
Pablo Greco ceb317
@@ -2138,6 +2149,11 @@ static int __init etm4x_init(void)
Pablo Greco ceb317
 {
Pablo Greco ceb317
 	int ret;
Pablo Greco ceb317
 
Pablo Greco ceb317
+	if (dmi_check_system(broken_coresight)) {
Pablo Greco ceb317
+		pr_info("ETM4 disabled due to firmware bug\n");
Pablo Greco ceb317
+		return 0;
Pablo Greco ceb317
+	}
Pablo Greco ceb317
+
Pablo Greco ceb317
 	ret = etm4_pm_setup();
Pablo Greco ceb317
 
Pablo Greco ceb317
 	/* etm4_pm_setup() does its own cleanup - exit on error */
Pablo Greco ceb317
@@ -2164,6 +2180,9 @@ static int __init etm4x_init(void)
Pablo Greco ceb317
 
Pablo Greco ceb317
 static void __exit etm4x_exit(void)
Pablo Greco ceb317
 {
Pablo Greco ceb317
+	if (dmi_check_system(broken_coresight))
Pablo Greco ceb317
+		return;
Pablo Greco ceb317
+
Pablo Greco ceb317
 	amba_driver_unregister(&etm4x_amba_driver);
Pablo Greco ceb317
 	platform_driver_unregister(&etm4_platform_driver);
Pablo Greco ceb317
 	etm4_pm_clear();
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Mike Snitzer <snitzer@redhat.com>
Pablo Greco ceb317
Date: Tue, 13 Apr 2021 13:09:36 -0400
Pablo Greco de6db6
Subject: [PATCH 23/33] nvme: Return BLK_STS_TARGET if the DNR bit is set
Pablo Greco ceb317
Pablo Greco ceb317
BZ: 1948690
Pablo Greco ceb317
Upstream Status: RHEL-only
Pablo Greco ceb317
Pablo Greco ceb317
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Pablo Greco ceb317
Pablo Greco ceb317
rhel-8.git commit ef4ab90c12db5e0e50800ec323736b95be7a6ff5
Pablo Greco ceb317
Author: Mike Snitzer <snitzer@redhat.com>
Pablo Greco ceb317
Date:   Tue Aug 25 21:52:45 2020 -0400
Pablo Greco ceb317
Pablo Greco ceb317
    [nvme] nvme: Return BLK_STS_TARGET if the DNR bit is set
Pablo Greco ceb317
Pablo Greco ceb317
    Message-id: <20200825215248.2291-8-snitzer@redhat.com>
Pablo Greco ceb317
    Patchwork-id: 325178
Pablo Greco ceb317
    Patchwork-instance: patchwork
Pablo Greco ceb317
    O-Subject: [RHEL8.3 PATCH 07/10] nvme: Return BLK_STS_TARGET if the DNR bit is set
Pablo Greco ceb317
    Bugzilla: 1843515
Pablo Greco ceb317
    RH-Acked-by: David Milburn <dmilburn@redhat.com>
Pablo Greco ceb317
    RH-Acked-by: Gopal Tiwari <gtiwari@redhat.com>
Pablo Greco ceb317
    RH-Acked-by: Ewan Milne <emilne@redhat.com>
Pablo Greco ceb317
Pablo Greco ceb317
    BZ: 1843515
Pablo Greco ceb317
    Upstream Status: RHEL-only
Pablo Greco ceb317
Pablo Greco ceb317
    If the DNR bit is set we should not retry the command, even if
Pablo Greco ceb317
    the standard status evaluation indicates so.
Pablo Greco ceb317
Pablo Greco ceb317
    SUSE is carrying this patch in their kernel:
Pablo Greco ceb317
    https://lwn.net/Articles/800370/
Pablo Greco ceb317
Pablo Greco ceb317
    Based on patch posted for upstream inclusion but rejected:
Pablo Greco ceb317
    v1: https://lore.kernel.org/linux-nvme/20190806111036.113233-1-hare@suse.de/
Pablo Greco ceb317
    v2: https://lore.kernel.org/linux-nvme/20190807071208.101882-1-hare@suse.de/
Pablo Greco ceb317
    v2-keith: https://lore.kernel.org/linux-nvme/20190807144725.GB25621@localhost.localdomain/
Pablo Greco ceb317
    v3: https://lore.kernel.org/linux-nvme/20190812075147.79598-1-hare@suse.de/
Pablo Greco ceb317
    v3-keith: https://lore.kernel.org/linux-nvme/20190813141510.GB32686@localhost.localdomain/
Pablo Greco ceb317
Pablo Greco ceb317
    This commit's change is basically "v3-keith".
Pablo Greco ceb317
Pablo Greco ceb317
    Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Pablo Greco ceb317
    Signed-off-by: Frantisek Hrbata <fhrbata@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 drivers/nvme/host/core.c | 3 +++
Pablo Greco ceb317
 1 file changed, 3 insertions(+)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
Pablo Greco 422940
index 76d8a72f52e2..5444b41bff3e 100644
Pablo Greco ceb317
--- a/drivers/nvme/host/core.c
Pablo Greco ceb317
+++ b/drivers/nvme/host/core.c
Pablo Greco ceb317
@@ -262,6 +262,9 @@ static void nvme_delete_ctrl_sync(struct nvme_ctrl *ctrl)
Pablo Greco ceb317
 
Pablo Greco ceb317
 static blk_status_t nvme_error_status(u16 status)
Pablo Greco ceb317
 {
Pablo Greco ceb317
+	if (unlikely(status & NVME_SC_DNR))
Pablo Greco ceb317
+		return BLK_STS_TARGET;
Pablo Greco ceb317
+
Pablo Greco ceb317
 	switch (status & 0x7ff) {
Pablo Greco ceb317
 	case NVME_SC_SUCCESS:
Pablo Greco ceb317
 		return BLK_STS_OK;
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Mike Snitzer <snitzer@redhat.com>
Pablo Greco ceb317
Date: Tue, 13 Apr 2021 13:09:36 -0400
Pablo Greco de6db6
Subject: [PATCH 24/33] nvme: allow local retry and proper failover for
Pablo Greco ceb317
 REQ_FAILFAST_TRANSPORT
Pablo Greco ceb317
Pablo Greco ceb317
BZ: 1948690
Pablo Greco ceb317
Upstream Status: RHEL-only
Pablo Greco ceb317
Pablo Greco ceb317
This commit offers a more minimalist version of these 2 rhel-8.git commits:
Pablo Greco ceb317
f8fb6ea1226e2 [nvme] nvme: update failover handling to work with REQ_FAILFAST_TRANSPORT
Pablo Greco ceb317
7dadadb072515 [nvme] nvme: allow retry for requests with REQ_FAILFAST_TRANSPORT set
Pablo Greco ceb317
Pablo Greco ceb317
REQ_FAILFAST_TRANSPORT is set by upper layer software that handles
Pablo Greco ceb317
multipathing. Unlike SCSI, NVMe's error handling was specifically
Pablo Greco ceb317
designed to handle local retry for non-path errors. As such, allow
Pablo Greco ceb317
NVMe's local retry mechanism to be used for requests marked with
Pablo Greco ceb317
REQ_FAILFAST_TRANSPORT.
Pablo Greco ceb317
Pablo Greco ceb317
In this way, the mechanism of NVMe multipath or other multipath are
Pablo Greco ceb317
now equivalent. The mechanism is: non path related error will be
Pablo Greco ceb317
retried locally, path related error is handled by multipath.
Pablo Greco ceb317
Pablo Greco ceb317
Also, introduce FAILUP handling for REQ_FAILFAST_TRANSPORT. Update
Pablo Greco ceb317
NVMe to allow failover of requests marked with either REQ_NVME_MPATH
Pablo Greco ceb317
or REQ_FAILFAST_TRANSPORT. This allows such requests to be given a
Pablo Greco ceb317
disposition of either FAILOVER or FAILUP respectively.
Pablo Greco ceb317
Pablo Greco ceb317
nvme_complete_rq() is updated to call nvme_failup_req() if
Pablo Greco ceb317
nvme_decide_disposition() returns FAILUP. nvme_failup_req() ensures
Pablo Greco ceb317
the request is completed with a retryable path error.
Pablo Greco ceb317
Pablo Greco ceb317
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 drivers/nvme/host/core.c | 17 ++++++++++++++---
Pablo Greco ceb317
 1 file changed, 14 insertions(+), 3 deletions(-)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
Pablo Greco 422940
index 5444b41bff3e..529484e333f3 100644
Pablo Greco ceb317
--- a/drivers/nvme/host/core.c
Pablo Greco ceb317
+++ b/drivers/nvme/host/core.c
Pablo Greco ceb317
@@ -324,6 +324,7 @@ enum nvme_disposition {
Pablo Greco ceb317
 	COMPLETE,
Pablo Greco ceb317
 	RETRY,
Pablo Greco ceb317
 	FAILOVER,
Pablo Greco ceb317
+	FAILUP,
Pablo Greco ceb317
 };
Pablo Greco ceb317
 
Pablo Greco ceb317
 static inline enum nvme_disposition nvme_decide_disposition(struct request *req)
Pablo Greco ceb317
@@ -331,15 +332,16 @@ static inline enum nvme_disposition nvme_decide_disposition(struct request *req)
Pablo Greco ceb317
 	if (likely(nvme_req(req)->status == 0))
Pablo Greco ceb317
 		return COMPLETE;
Pablo Greco ceb317
 
Pablo Greco ceb317
-	if (blk_noretry_request(req) ||
Pablo Greco ceb317
+	if ((req->cmd_flags & (REQ_FAILFAST_DEV | REQ_FAILFAST_DRIVER)) ||
Pablo Greco ceb317
 	    (nvme_req(req)->status & NVME_SC_DNR) ||
Pablo Greco ceb317
 	    nvme_req(req)->retries >= nvme_max_retries)
Pablo Greco ceb317
 		return COMPLETE;
Pablo Greco ceb317
 
Pablo Greco ceb317
-	if (req->cmd_flags & REQ_NVME_MPATH) {
Pablo Greco ceb317
+	if (req->cmd_flags & (REQ_NVME_MPATH | REQ_FAILFAST_TRANSPORT)) {
Pablo Greco ceb317
 		if (nvme_is_path_error(nvme_req(req)->status) ||
Pablo Greco ceb317
 		    blk_queue_dying(req->q))
Pablo Greco ceb317
-			return FAILOVER;
Pablo Greco ceb317
+			return (req->cmd_flags & REQ_NVME_MPATH) ?
Pablo Greco ceb317
+				FAILOVER : FAILUP;
Pablo Greco ceb317
 	} else {
Pablo Greco ceb317
 		if (blk_queue_dying(req->q))
Pablo Greco ceb317
 			return COMPLETE;
Pablo Greco ceb317
@@ -361,6 +363,12 @@ static inline void nvme_end_req(struct request *req)
Pablo Greco ceb317
 	blk_mq_end_request(req, status);
Pablo Greco ceb317
 }
Pablo Greco ceb317
 
Pablo Greco ceb317
+static inline void nvme_failup_req(struct request *req)
Pablo Greco ceb317
+{
Pablo Greco ceb317
+	nvme_req(req)->status = NVME_SC_HOST_PATH_ERROR;
Pablo Greco ceb317
+	nvme_end_req(req);
Pablo Greco ceb317
+}
Pablo Greco ceb317
+
Pablo Greco ceb317
 void nvme_complete_rq(struct request *req)
Pablo Greco ceb317
 {
Pablo Greco ceb317
 	trace_nvme_complete_rq(req);
Pablo Greco ceb317
@@ -379,6 +387,9 @@ void nvme_complete_rq(struct request *req)
Pablo Greco ceb317
 	case FAILOVER:
Pablo Greco ceb317
 		nvme_failover_req(req);
Pablo Greco ceb317
 		return;
Pablo Greco ceb317
+	case FAILUP:
Pablo Greco ceb317
+		nvme_failup_req(req);
Pablo Greco ceb317
+		return;
Pablo Greco ceb317
 	}
Pablo Greco ceb317
 }
Pablo Greco ceb317
 EXPORT_SYMBOL_GPL(nvme_complete_rq);
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Mike Snitzer <snitzer@redhat.com>
Pablo Greco ceb317
Date: Tue, 13 Apr 2021 13:09:37 -0400
Pablo Greco de6db6
Subject: [PATCH 25/33] nvme: decouple basic ANA log page re-read support from
Pablo Greco ceb317
 native multipathing
Pablo Greco ceb317
Pablo Greco ceb317
BZ: 1948690
Pablo Greco ceb317
Upstream Status: RHEL-only
Pablo Greco ceb317
Pablo Greco ceb317
This commit offers a more refined version of this rhel-8.git commit:
Pablo Greco ceb317
b904f4b8e0f90 [nvme] nvme: decouple basic ANA log page re-read support from native multipathing
Pablo Greco ceb317
Pablo Greco ceb317
Whether or not ANA is present is a choice of the target implementation;
Pablo Greco ceb317
the host (and whether it supports multipathing) has _zero_ influence on
Pablo Greco ceb317
this. If the target declares a path as 'inaccessible' the path _is_
Pablo Greco ceb317
inaccessible to the host. As such, ANA support should be functional
Pablo Greco ceb317
even if native multipathing is not.
Pablo Greco ceb317
Pablo Greco ceb317
Introduce ability to always re-read ANA log page as required due to ANA
Pablo Greco ceb317
error and make current ANA state available via sysfs -- even if native
Pablo Greco ceb317
multipathing is disabled on the host (e.g. nvme_core.multipath=N).
Pablo Greco ceb317
This is achieved by factoring out nvme_update_ana() and calling it in
Pablo Greco ceb317
nvme_complete_rq() for all FAILOVER requests.
Pablo Greco ceb317
Pablo Greco ceb317
This affords userspace access to the current ANA state independent of
Pablo Greco ceb317
which layer might be doing multipathing. This makes 'nvme list-subsys'
Pablo Greco ceb317
show ANA state for all NVMe subsystems with multiple controllers. It
Pablo Greco ceb317
also allows userspace multipath-tools to rely on the NVMe driver for
Pablo Greco ceb317
ANA support while dm-multipath takes care of multipathing.
Pablo Greco ceb317
Pablo Greco ceb317
And as always, if embedded NVMe users do not want any performance
Pablo Greco ceb317
overhead associated with ANA or native NVMe multipathing they can
Pablo Greco ceb317
disable CONFIG_NVME_MULTIPATH.
Pablo Greco ceb317
Pablo Greco ceb317
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 drivers/nvme/host/core.c      |  2 ++
Pablo Greco ceb317
 drivers/nvme/host/multipath.c | 16 +++++++++++-----
Pablo Greco ceb317
 drivers/nvme/host/nvme.h      |  4 ++++
Pablo Greco ceb317
 3 files changed, 17 insertions(+), 5 deletions(-)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
Pablo Greco 422940
index 529484e333f3..034e724255e1 100644
Pablo Greco ceb317
--- a/drivers/nvme/host/core.c
Pablo Greco ceb317
+++ b/drivers/nvme/host/core.c
Pablo Greco ceb317
@@ -365,6 +365,8 @@ static inline void nvme_end_req(struct request *req)
Pablo Greco ceb317
 
Pablo Greco ceb317
 static inline void nvme_failup_req(struct request *req)
Pablo Greco ceb317
 {
Pablo Greco ceb317
+	nvme_update_ana(req);
Pablo Greco ceb317
+
Pablo Greco ceb317
 	nvme_req(req)->status = NVME_SC_HOST_PATH_ERROR;
Pablo Greco ceb317
 	nvme_end_req(req);
Pablo Greco ceb317
 }
Pablo Greco ceb317
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
Pablo Greco 422940
index 04fa276701d1..8c2f4261d85f 100644
Pablo Greco ceb317
--- a/drivers/nvme/host/multipath.c
Pablo Greco ceb317
+++ b/drivers/nvme/host/multipath.c
Pablo Greco ceb317
@@ -65,14 +65,10 @@ bool nvme_mpath_set_disk_name(struct nvme_ns *ns, char *disk_name, int *flags)
Pablo Greco ceb317
 	return true;
Pablo Greco ceb317
 }
Pablo Greco ceb317
 
Pablo Greco ceb317
-void nvme_failover_req(struct request *req)
Pablo Greco ceb317
+void nvme_update_ana(struct request *req)
Pablo Greco ceb317
 {
Pablo Greco ceb317
 	struct nvme_ns *ns = req->q->queuedata;
Pablo Greco ceb317
 	u16 status = nvme_req(req)->status & 0x7ff;
Pablo Greco ceb317
-	unsigned long flags;
Pablo Greco ceb317
-	struct bio *bio;
Pablo Greco ceb317
-
Pablo Greco ceb317
-	nvme_mpath_clear_current_path(ns);
Pablo Greco ceb317
 
Pablo Greco ceb317
 	/*
Pablo Greco ceb317
 	 * If we got back an ANA error, we know the controller is alive but not
Pablo Greco ceb317
@@ -83,6 +79,16 @@ void nvme_failover_req(struct request *req)
Pablo Greco ceb317
 		set_bit(NVME_NS_ANA_PENDING, &ns->flags);
Pablo Greco ceb317
 		queue_work(nvme_wq, &ns->ctrl->ana_work);
Pablo Greco ceb317
 	}
Pablo Greco ceb317
+}
Pablo Greco ceb317
+
Pablo Greco ceb317
+void nvme_failover_req(struct request *req)
Pablo Greco ceb317
+{
Pablo Greco ceb317
+	struct nvme_ns *ns = req->q->queuedata;
Pablo Greco ceb317
+	unsigned long flags;
Pablo Greco ceb317
+	struct bio *bio;
Pablo Greco ceb317
+
Pablo Greco ceb317
+	nvme_mpath_clear_current_path(ns);
Pablo Greco ceb317
+	nvme_update_ana(req);
Pablo Greco ceb317
 
Pablo Greco ceb317
 	spin_lock_irqsave(&ns->head->requeue_lock, flags);
Pablo Greco ceb317
 	for (bio = req->bio; bio; bio = bio->bi_next)
Pablo Greco ceb317
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
Pablo Greco 4cf391
index 75a7e7baa1fc..4f93a37d5e9b 100644
Pablo Greco ceb317
--- a/drivers/nvme/host/nvme.h
Pablo Greco ceb317
+++ b/drivers/nvme/host/nvme.h
Pablo Greco 4cf391
@@ -771,6 +771,7 @@ void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys);
Pablo Greco ceb317
 void nvme_mpath_start_freeze(struct nvme_subsystem *subsys);
Pablo Greco ceb317
 bool nvme_mpath_set_disk_name(struct nvme_ns *ns, char *disk_name, int *flags);
Pablo Greco ceb317
 void nvme_failover_req(struct request *req);
Pablo Greco ceb317
+void nvme_update_ana(struct request *req);
Pablo Greco ceb317
 void nvme_kick_requeue_lists(struct nvme_ctrl *ctrl);
Pablo Greco ceb317
 int nvme_mpath_alloc_disk(struct nvme_ctrl *ctrl,struct nvme_ns_head *head);
Pablo Greco ceb317
 void nvme_mpath_add_disk(struct nvme_ns *ns, struct nvme_id_ns *id);
Pablo Greco 4cf391
@@ -810,6 +811,9 @@ static inline bool nvme_mpath_set_disk_name(struct nvme_ns *ns, char *disk_name,
Pablo Greco ceb317
 static inline void nvme_failover_req(struct request *req)
Pablo Greco ceb317
 {
Pablo Greco ceb317
 }
Pablo Greco ceb317
+static inline void nvme_update_ana(struct request *req)
Pablo Greco ceb317
+{
Pablo Greco ceb317
+}
Pablo Greco ceb317
 static inline void nvme_kick_requeue_lists(struct nvme_ctrl *ctrl)
Pablo Greco ceb317
 {
Pablo Greco ceb317
 }
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Mike Snitzer <snitzer@redhat.com>
Pablo Greco ceb317
Date: Tue, 25 May 2021 12:36:06 -0400
Pablo Greco de6db6
Subject: [PATCH 26/33] nvme: nvme_mpath_init remove multipath check
Pablo Greco ceb317
Pablo Greco ceb317
BZ: 1948690
Pablo Greco ceb317
Upstream Status: RHEL-only
Pablo Greco ceb317
Pablo Greco ceb317
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Pablo Greco ceb317
Pablo Greco ceb317
rhel-8.git commit f027c2e4045d02d103c7a545181b6df0b6162ee7
Pablo Greco ceb317
Author: David Milburn <dmilburn@redhat.com>
Pablo Greco ceb317
Date:   Wed Jan 29 15:29:37 2020 -0500
Pablo Greco ceb317
Pablo Greco ceb317
    [nvme] nvme: nvme_mpath_init remove multipath check
Pablo Greco ceb317
Pablo Greco ceb317
    Message-id: <1580311777-9193-1-git-send-email-dmilburn@redhat.com>
Pablo Greco ceb317
    Patchwork-id: 294254
Pablo Greco ceb317
    Patchwork-instance: patchwork
Pablo Greco ceb317
    O-Subject: [RHEL8.2 PATCH] nvme: nvme_mpath_init remove multipath check
Pablo Greco ceb317
    Bugzilla: 1790958
Pablo Greco ceb317
    RH-Acked-by: Gopal Tiwari <gtiwari@redhat.com>
Pablo Greco ceb317
    RH-Acked-by: Ewan Milne <emilne@redhat.com>
Pablo Greco ceb317
Pablo Greco ceb317
    Marco Patalano found missing NVMe optimized/inaccessible paths when
Pablo Greco ceb317
    executing "nvme list-subsys" command with native multipathing disabled.
Pablo Greco ceb317
    He was able to git bisect this back to 6d0f426e ("nvme: fix multipath
Pablo Greco ceb317
    crash when ANA is deactivated"). The problem is the check for multipath,
Pablo Greco ceb317
    removing this is similar to RHEL commit 158eef2e ("nvme: allow ANA support
Pablo Greco ceb317
    to be independent of native multipathing"), I did leave the existing
Pablo Greco ceb317
    comment in place for future back ports and as a reminder to watch for
Pablo Greco ceb317
    these changes in the future.
Pablo Greco ceb317
Pablo Greco ceb317
    Bugzilla: 1790958
Pablo Greco ceb317
    Build info: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=26061480
Pablo Greco ceb317
    Upstream: RHEL only
Pablo Greco ceb317
    Test: QE verified "nvme list-subsys" command and did sanity check with native
Pablo Greco ceb317
    multipathing disabled.
Pablo Greco ceb317
Pablo Greco ceb317
    Fixes: 6d0f426e ("nvme: fix multipath crash when ANA is deactivated")
Pablo Greco ceb317
    Signed-off-by: David Milburn <dmilburn@redhat.com>
Pablo Greco ceb317
    Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 drivers/nvme/host/multipath.c | 3 +--
Pablo Greco ceb317
 1 file changed, 1 insertion(+), 2 deletions(-)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
Pablo Greco 422940
index 8c2f4261d85f..609fe97148f1 100644
Pablo Greco ceb317
--- a/drivers/nvme/host/multipath.c
Pablo Greco ceb317
+++ b/drivers/nvme/host/multipath.c
Pablo Greco 422940
@@ -842,8 +842,7 @@ int nvme_mpath_init_identify(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
Pablo Greco ceb317
 	int error = 0;
Pablo Greco ceb317
 
Pablo Greco ceb317
 	/* check if multipath is enabled and we have the capability */
Pablo Greco ceb317
-	if (!multipath || !ctrl->subsys ||
Pablo Greco ceb317
-	    !(ctrl->subsys->cmic & NVME_CTRL_CMIC_ANA))
Pablo Greco ceb317
+	if (!ctrl->subsys || !(ctrl->subsys->cmic & NVME_CTRL_CMIC_ANA))
Pablo Greco ceb317
 		return 0;
Pablo Greco ceb317
 
Pablo Greco ceb317
 	if (!ctrl->max_namespaces ||
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Dan Johansen <strit@manjaro.org>
Pablo Greco ceb317
Date: Fri, 6 Aug 2021 00:04:27 +0200
Pablo Greco de6db6
Subject: [PATCH 27/33] arm64: dts: rockchip: Setup USB typec port as datarole
Pablo Greco ceb317
 on
Pablo Greco ceb317
Pablo Greco ceb317
Some chargers try to put the charged device into device data
Pablo Greco ceb317
role. Before this commit this condition caused the tcpm state machine to
Pablo Greco ceb317
issue a hard reset due to a capability missmatch.
Pablo Greco ceb317
Pablo Greco ceb317
Signed-off-by: Dan Johansen <strit@manjaro.org>
Pablo Greco ceb317
---
Pablo Greco ceb317
 arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts | 2 +-
Pablo Greco ceb317
 1 file changed, 1 insertion(+), 1 deletion(-)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts
Pablo Greco ceb317
index 9e5d07f5712e..dae8c252bc2b 100644
Pablo Greco ceb317
--- a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts
Pablo Greco ceb317
+++ b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts
Pablo Greco c57d7b
@@ -707,7 +707,7 @@ fusb0: fusb30x@22 {
Pablo Greco ceb317
 
Pablo Greco ceb317
 		connector {
Pablo Greco ceb317
 			compatible = "usb-c-connector";
Pablo Greco ceb317
-			data-role = "host";
Pablo Greco ceb317
+			data-role = "dual";
Pablo Greco ceb317
 			label = "USB-C";
Pablo Greco ceb317
 			op-sink-microwatt = <1000000>;
Pablo Greco ceb317
 			power-role = "dual";
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Hans de Goede <hdegoede@redhat.com>
Pablo Greco ceb317
Date: Thu, 14 Oct 2021 20:39:42 +0200
Pablo Greco de6db6
Subject: [PATCH 28/33] x86/PCI: Ignore E820 reservations for bridge windows on
Pablo Greco ceb317
 newer systems
Pablo Greco ceb317
MIME-Version: 1.0
Pablo Greco ceb317
Content-Type: text/plain; charset=UTF-8
Pablo Greco ceb317
Content-Transfer-Encoding: 8bit
Pablo Greco ceb317
Pablo Greco ceb317
Some BIOS-es contain a bug where they add addresses which map to system
Pablo Greco ceb317
RAM in the PCI host bridge window returned by the ACPI _CRS method, see
Pablo Greco ceb317
commit 4dc2287c1805 ("x86: avoid E820 regions when allocating address
Pablo Greco ceb317
space").
Pablo Greco ceb317
Pablo Greco ceb317
To work around this bug Linux excludes E820 reserved addresses when
Pablo Greco ceb317
allocating addresses from the PCI host bridge window since 2010.
Pablo Greco ceb317
Pablo Greco ceb317
Recently (2020) some systems have shown-up with E820 reservations which
Pablo Greco ceb317
cover the entire _CRS returned PCI bridge memory window, causing all
Pablo Greco ceb317
attempts to assign memory to PCI BARs which have not been setup by the
Pablo Greco ceb317
BIOS to fail. For example here are the relevant dmesg bits from a
Pablo Greco ceb317
Lenovo IdeaPad 3 15IIL 81WE:
Pablo Greco ceb317
Pablo Greco ceb317
 [mem 0x000000004bc50000-0x00000000cfffffff] reserved
Pablo Greco ceb317
 pci_bus 0000:00: root bus resource [mem 0x65400000-0xbfffffff window]
Pablo Greco ceb317
Pablo Greco ceb317
The ACPI specifications appear to allow this new behavior:
Pablo Greco ceb317
Pablo Greco ceb317
The relationship between E820 and ACPI _CRS is not really very clear.
Pablo Greco ceb317
ACPI v6.3, sec 15, table 15-374, says AddressRangeReserved means:
Pablo Greco ceb317
Pablo Greco ceb317
  This range of addresses is in use or reserved by the system and is
Pablo Greco ceb317
  not to be included in the allocatable memory pool of the operating
Pablo Greco ceb317
  system's memory manager.
Pablo Greco ceb317
Pablo Greco ceb317
and it may be used when:
Pablo Greco ceb317
Pablo Greco ceb317
  The address range is in use by a memory-mapped system device.
Pablo Greco ceb317
Pablo Greco ceb317
Furthermore, sec 15.2 says:
Pablo Greco ceb317
Pablo Greco ceb317
  Address ranges defined for baseboard memory-mapped I/O devices, such
Pablo Greco ceb317
  as APICs, are returned as reserved.
Pablo Greco ceb317
Pablo Greco ceb317
A PCI host bridge qualifies as a baseboard memory-mapped I/O device,
Pablo Greco ceb317
and its apertures are in use and certainly should not be included in
Pablo Greco ceb317
the general allocatable pool, so the fact that some BIOS-es reports
Pablo Greco ceb317
the PCI aperture as "reserved" in E820 doesn't seem like a BIOS bug.
Pablo Greco ceb317
Pablo Greco ceb317
So it seems that the excluding of E820 reserved addresses is a mistake.
Pablo Greco ceb317
Pablo Greco ceb317
Ideally Linux would fully stop excluding E820 reserved addresses,
Pablo Greco ceb317
but then the old systems this was added for will regress.
Pablo Greco ceb317
Instead keep the old behavior for old systems, while ignoring
Pablo Greco ceb317
the E820 reservations for any systems from now on.
Pablo Greco ceb317
Pablo Greco ceb317
Old systems are defined here as BIOS year < 2018, this was chosen to
Pablo Greco ceb317
make sure that pci_use_e820 will not be set on the currently affected
Pablo Greco ceb317
systems, while at the same time also taking into account that the
Pablo Greco ceb317
systems for which the E820 checking was originally added may have
Pablo Greco ceb317
received BIOS updates for quite a while (esp. CVE related ones),
Pablo Greco ceb317
giving them a more recent BIOS year then 2010.
Pablo Greco ceb317
Pablo Greco ceb317
Also add pci=no_e820 and pci=use_e820 options to allow overriding
Pablo Greco ceb317
the BIOS year heuristic.
Pablo Greco ceb317
Pablo Greco ceb317
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206459
Pablo Greco ceb317
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1868899
Pablo Greco ceb317
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1871793
Pablo Greco ceb317
BugLink: https://bugs.launchpad.net/bugs/1878279
Pablo Greco ceb317
BugLink: https://bugs.launchpad.net/bugs/1931715
Pablo Greco ceb317
BugLink: https://bugs.launchpad.net/bugs/1932069
Pablo Greco ceb317
BugLink: https://bugs.launchpad.net/bugs/1921649
Pablo Greco ceb317
Cc: Benoit Grégoire <benoitg@coeus.ca>
Pablo Greco ceb317
Cc: Hui Wang <hui.wang@canonical.com>
Pablo Greco ceb317
Cc: stable@vger.kernel.org
Pablo Greco ceb317
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Pablo Greco ceb317
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Pablo Greco ceb317
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Pablo Greco ceb317
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 .../admin-guide/kernel-parameters.txt         |  9 ++++++
Pablo Greco ceb317
 arch/x86/include/asm/pci_x86.h                | 10 +++++++
Pablo Greco ceb317
 arch/x86/kernel/resource.c                    |  4 +++
Pablo Greco ceb317
 arch/x86/pci/acpi.c                           | 28 +++++++++++++++++++
Pablo Greco ceb317
 arch/x86/pci/common.c                         |  6 ++++
Pablo Greco ceb317
 5 files changed, 57 insertions(+)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
Pablo Greco 422940
index bcb102c91b19..55b36b51244c 100644
Pablo Greco ceb317
--- a/Documentation/admin-guide/kernel-parameters.txt
Pablo Greco ceb317
+++ b/Documentation/admin-guide/kernel-parameters.txt
Pablo Greco 4cf391
@@ -3992,6 +3992,15 @@
Pablo Greco ceb317
 				please report a bug.
Pablo Greco ceb317
 		nocrs		[X86] Ignore PCI host bridge windows from ACPI.
Pablo Greco ceb317
 				If you need to use this, please report a bug.
Pablo Greco ceb317
+		use_e820	[X86] Use E820 reservations to exclude parts of
Pablo Greco ceb317
+				PCI host bridge windows. This is a workaround
Pablo Greco ceb317
+				for BIOS defects in host bridge _CRS methods.
Pablo Greco ceb317
+				If you need to use this, please report a bug to
Pablo Greco ceb317
+				<linux-pci@vger.kernel.org>.
Pablo Greco ceb317
+		no_e820		[X86] Ignore E820 reservations for PCI host
Pablo Greco ceb317
+				bridge windows. This is the default on modern
Pablo Greco ceb317
+				hardware. If you need to use this, please report
Pablo Greco ceb317
+				a bug to <linux-pci@vger.kernel.org>.
Pablo Greco ceb317
 		routeirq	Do IRQ routing for all PCI devices.
Pablo Greco ceb317
 				This is normally done in pci_enable_device(),
Pablo Greco ceb317
 				so this option is a temporary workaround
Pablo Greco ceb317
diff --git a/arch/x86/include/asm/pci_x86.h b/arch/x86/include/asm/pci_x86.h
Pablo Greco ceb317
index 490411dba438..0bb4e7dd0ffc 100644
Pablo Greco ceb317
--- a/arch/x86/include/asm/pci_x86.h
Pablo Greco ceb317
+++ b/arch/x86/include/asm/pci_x86.h
Pablo Greco ceb317
@@ -39,6 +39,8 @@ do {						\
Pablo Greco ceb317
 #define PCI_ROOT_NO_CRS		0x100000
Pablo Greco ceb317
 #define PCI_NOASSIGN_BARS	0x200000
Pablo Greco ceb317
 #define PCI_BIG_ROOT_WINDOW	0x400000
Pablo Greco ceb317
+#define PCI_USE_E820		0x800000
Pablo Greco ceb317
+#define PCI_NO_E820		0x1000000
Pablo Greco ceb317
 
Pablo Greco ceb317
 extern unsigned int pci_probe;
Pablo Greco ceb317
 extern unsigned long pirq_table_addr;
Pablo Greco ceb317
@@ -64,6 +66,8 @@ void pcibios_scan_specific_bus(int busn);
Pablo Greco ceb317
 
Pablo Greco ceb317
 /* pci-irq.c */
Pablo Greco ceb317
 
Pablo Greco ceb317
+struct pci_dev;
Pablo Greco ceb317
+
Pablo Greco ceb317
 struct irq_info {
Pablo Greco ceb317
 	u8 bus, devfn;			/* Bus, device and function */
Pablo Greco ceb317
 	struct {
Pablo Greco ceb317
@@ -232,3 +236,9 @@ static inline void mmio_config_writel(void __iomem *pos, u32 val)
Pablo Greco ceb317
 # define x86_default_pci_init_irq	NULL
Pablo Greco ceb317
 # define x86_default_pci_fixup_irqs	NULL
Pablo Greco ceb317
 #endif
Pablo Greco ceb317
+
Pablo Greco ceb317
+#if defined(CONFIG_PCI) && defined(CONFIG_ACPI)
Pablo Greco ceb317
+extern bool pci_use_e820;
Pablo Greco ceb317
+#else
Pablo Greco ceb317
+#define pci_use_e820 false
Pablo Greco ceb317
+#endif
Pablo Greco ceb317
diff --git a/arch/x86/kernel/resource.c b/arch/x86/kernel/resource.c
Pablo Greco ceb317
index 9b9fb7882c20..e8dc9bc327bd 100644
Pablo Greco ceb317
--- a/arch/x86/kernel/resource.c
Pablo Greco ceb317
+++ b/arch/x86/kernel/resource.c
Pablo Greco ceb317
@@ -1,6 +1,7 @@
Pablo Greco ceb317
 // SPDX-License-Identifier: GPL-2.0
Pablo Greco ceb317
 #include <linux/ioport.h>
Pablo Greco ceb317
 #include <asm/e820/api.h>
Pablo Greco ceb317
+#include <asm/pci_x86.h>
Pablo Greco ceb317
 
Pablo Greco ceb317
 static void resource_clip(struct resource *res, resource_size_t start,
Pablo Greco ceb317
 			  resource_size_t end)
Pablo Greco ceb317
@@ -28,6 +29,9 @@ static void remove_e820_regions(struct resource *avail)
Pablo Greco ceb317
 	int i;
Pablo Greco ceb317
 	struct e820_entry *entry;
Pablo Greco ceb317
 
Pablo Greco ceb317
+	if (!pci_use_e820)
Pablo Greco ceb317
+		return;
Pablo Greco ceb317
+
Pablo Greco ceb317
 	for (i = 0; i < e820_table->nr_entries; i++) {
Pablo Greco ceb317
 		entry = &e820_table->entries[i];
Pablo Greco ceb317
 
Pablo Greco ceb317
diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
Pablo Greco ceb317
index 948656069cdd..72d473054262 100644
Pablo Greco ceb317
--- a/arch/x86/pci/acpi.c
Pablo Greco ceb317
+++ b/arch/x86/pci/acpi.c
Pablo Greco ceb317
@@ -21,6 +21,8 @@ struct pci_root_info {
Pablo Greco ceb317
 
Pablo Greco ceb317
 static bool pci_use_crs = true;
Pablo Greco ceb317
 static bool pci_ignore_seg = false;
Pablo Greco ceb317
+/* Consumed in arch/x86/kernel/resource.c */
Pablo Greco ceb317
+bool pci_use_e820 = false;
Pablo Greco ceb317
 
Pablo Greco ceb317
 static int __init set_use_crs(const struct dmi_system_id *id)
Pablo Greco ceb317
 {
Pablo Greco ceb317
@@ -160,6 +162,32 @@ void __init pci_acpi_crs_quirks(void)
Pablo Greco ceb317
 	       "if necessary, use \"pci=%s\" and report a bug\n",
Pablo Greco ceb317
 	       pci_use_crs ? "Using" : "Ignoring",
Pablo Greco ceb317
 	       pci_use_crs ? "nocrs" : "use_crs");
Pablo Greco ceb317
+
Pablo Greco ceb317
+	/*
Pablo Greco ceb317
+	 * Some BIOS-es contain a bug where they add addresses which map to
Pablo Greco ceb317
+	 * system RAM in the PCI host bridge window returned by the ACPI _CRS
Pablo Greco ceb317
+	 * method, see commit 4dc2287c1805 ("x86: avoid E820 regions when
Pablo Greco ceb317
+	 * allocating address space"). To avoid this Linux by default excludes
Pablo Greco ceb317
+	 * E820 reservations when allocating addresses since 2010.
Pablo Greco ceb317
+	 * In 2020 some systems have shown-up with E820 reservations which cover
Pablo Greco ceb317
+	 * the entire _CRS returned PCI host bridge window, causing all attempts
Pablo Greco ceb317
+	 * to assign memory to PCI BARs to fail if Linux uses E820 reservations.
Pablo Greco ceb317
+	 *
Pablo Greco ceb317
+	 * Ideally Linux would fully stop using E820 reservations, but then
Pablo Greco ceb317
+	 * the old systems this was added for will regress.
Pablo Greco ceb317
+	 * Instead keep the old behavior for old systems, while ignoring the
Pablo Greco ceb317
+	 * E820 reservations for any systems from now on.
Pablo Greco ceb317
+	 */
Pablo Greco ceb317
+	if (year >= 0 && year < 2018)
Pablo Greco ceb317
+		pci_use_e820 = true;
Pablo Greco ceb317
+
Pablo Greco ceb317
+	if (pci_probe & PCI_NO_E820)
Pablo Greco ceb317
+		pci_use_e820 = false;
Pablo Greco ceb317
+	else if (pci_probe & PCI_USE_E820)
Pablo Greco ceb317
+		pci_use_e820 = true;
Pablo Greco ceb317
+
Pablo Greco ceb317
+	printk(KERN_INFO "PCI: %s E820 reservations for host bridge windows\n",
Pablo Greco ceb317
+	       pci_use_e820 ? "Using" : "Ignoring");
Pablo Greco ceb317
 }
Pablo Greco ceb317
 
Pablo Greco ceb317
 #ifdef	CONFIG_PCI_MMCONFIG
Pablo Greco ceb317
diff --git a/arch/x86/pci/common.c b/arch/x86/pci/common.c
Pablo Greco ceb317
index 3507f456fcd0..091ec7e94fcb 100644
Pablo Greco ceb317
--- a/arch/x86/pci/common.c
Pablo Greco ceb317
+++ b/arch/x86/pci/common.c
Pablo Greco ceb317
@@ -595,6 +595,12 @@ char *__init pcibios_setup(char *str)
Pablo Greco ceb317
 	} else if (!strcmp(str, "nocrs")) {
Pablo Greco ceb317
 		pci_probe |= PCI_ROOT_NO_CRS;
Pablo Greco ceb317
 		return NULL;
Pablo Greco ceb317
+	} else if (!strcmp(str, "use_e820")) {
Pablo Greco ceb317
+		pci_probe |= PCI_USE_E820;
Pablo Greco ceb317
+		return NULL;
Pablo Greco ceb317
+	} else if (!strcmp(str, "no_e820")) {
Pablo Greco ceb317
+		pci_probe |= PCI_NO_E820;
Pablo Greco ceb317
+		return NULL;
Pablo Greco ceb317
 #ifdef CONFIG_PHYS_ADDR_T_64BIT
Pablo Greco ceb317
 	} else if (!strcmp(str, "big_root_window")) {
Pablo Greco ceb317
 		pci_probe |= PCI_BIG_ROOT_WINDOW;
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco ceb317
From: Hans de Goede <hdegoede@redhat.com>
Pablo Greco ceb317
Date: Thu, 14 Oct 2021 20:39:43 +0200
Pablo Greco de6db6
Subject: [PATCH 29/33] x86/PCI/ACPI: Replace printk calls with pr_info/pr_warn
Pablo Greco ceb317
 calls
Pablo Greco ceb317
Pablo Greco ceb317
The direct use of printk is deprecated, replace the printk calls
Pablo Greco ceb317
in arch/x86/pci/acpi.c with pr_info/pr_warn calls.
Pablo Greco ceb317
Pablo Greco ceb317
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Pablo Greco ceb317
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Pablo Greco ceb317
---
Pablo Greco ceb317
 arch/x86/pci/acpi.c | 25 +++++++++++++------------
Pablo Greco ceb317
 1 file changed, 13 insertions(+), 12 deletions(-)
Pablo Greco ceb317
Pablo Greco ceb317
diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
Pablo Greco ceb317
index 72d473054262..f357dac92610 100644
Pablo Greco ceb317
--- a/arch/x86/pci/acpi.c
Pablo Greco ceb317
+++ b/arch/x86/pci/acpi.c
Pablo Greco ceb317
@@ -1,4 +1,7 @@
Pablo Greco ceb317
 // SPDX-License-Identifier: GPL-2.0
Pablo Greco ceb317
+
Pablo Greco ceb317
+#define pr_fmt(fmt) "PCI: " fmt
Pablo Greco ceb317
+
Pablo Greco ceb317
 #include <linux/pci.h>
Pablo Greco ceb317
 #include <linux/acpi.h>
Pablo Greco ceb317
 #include <linux/init.h>
Pablo Greco ceb317
@@ -38,7 +41,7 @@ static int __init set_nouse_crs(const struct dmi_system_id *id)
Pablo Greco ceb317
 
Pablo Greco ceb317
 static int __init set_ignore_seg(const struct dmi_system_id *id)
Pablo Greco ceb317
 {
Pablo Greco ceb317
-	printk(KERN_INFO "PCI: %s detected: ignoring ACPI _SEG\n", id->ident);
Pablo Greco ceb317
+	pr_info("%s detected: ignoring ACPI _SEG\n", id->ident);
Pablo Greco ceb317
 	pci_ignore_seg = true;
Pablo Greco ceb317
 	return 0;
Pablo Greco ceb317
 }
Pablo Greco ceb317
@@ -158,10 +161,9 @@ void __init pci_acpi_crs_quirks(void)
Pablo Greco ceb317
 	else if (pci_probe & PCI_USE__CRS)
Pablo Greco ceb317
 		pci_use_crs = true;
Pablo Greco ceb317
 
Pablo Greco ceb317
-	printk(KERN_INFO "PCI: %s host bridge windows from ACPI; "
Pablo Greco ceb317
-	       "if necessary, use \"pci=%s\" and report a bug\n",
Pablo Greco ceb317
-	       pci_use_crs ? "Using" : "Ignoring",
Pablo Greco ceb317
-	       pci_use_crs ? "nocrs" : "use_crs");
Pablo Greco ceb317
+	pr_info("%s host bridge windows from ACPI; if necessary, use \"pci=%s\" and report a bug\n",
Pablo Greco ceb317
+		pci_use_crs ? "Using" : "Ignoring",
Pablo Greco ceb317
+		pci_use_crs ? "nocrs" : "use_crs");
Pablo Greco ceb317
 
Pablo Greco ceb317
 	/*
Pablo Greco ceb317
 	 * Some BIOS-es contain a bug where they add addresses which map to
Pablo Greco ceb317
@@ -186,8 +188,8 @@ void __init pci_acpi_crs_quirks(void)
Pablo Greco ceb317
 	else if (pci_probe & PCI_USE_E820)
Pablo Greco ceb317
 		pci_use_e820 = true;
Pablo Greco ceb317
 
Pablo Greco ceb317
-	printk(KERN_INFO "PCI: %s E820 reservations for host bridge windows\n",
Pablo Greco ceb317
-	       pci_use_e820 ? "Using" : "Ignoring");
Pablo Greco ceb317
+	pr_info("%s E820 reservations for host bridge windows\n",
Pablo Greco ceb317
+		pci_use_e820 ? "Using" : "Ignoring");
Pablo Greco ceb317
 }
Pablo Greco ceb317
 
Pablo Greco ceb317
 #ifdef	CONFIG_PCI_MMCONFIG
Pablo Greco ceb317
@@ -362,9 +364,8 @@ struct pci_bus *pci_acpi_scan_root(struct acpi_pci_root *root)
Pablo Greco ceb317
 		root->segment = domain = 0;
Pablo Greco ceb317
 
Pablo Greco ceb317
 	if (domain && !pci_domains_supported) {
Pablo Greco ceb317
-		printk(KERN_WARNING "pci_bus %04x:%02x: "
Pablo Greco ceb317
-		       "ignored (multiple domains not supported)\n",
Pablo Greco ceb317
-		       domain, busnum);
Pablo Greco ceb317
+		pr_warn("pci_bus %04x:%02x: ignored (multiple domains not supported)\n",
Pablo Greco ceb317
+			domain, busnum);
Pablo Greco ceb317
 		return NULL;
Pablo Greco ceb317
 	}
Pablo Greco ceb317
 
Pablo Greco ceb317
@@ -432,7 +433,7 @@ int __init pci_acpi_init(void)
Pablo Greco ceb317
 	if (acpi_noirq)
Pablo Greco ceb317
 		return -ENODEV;
Pablo Greco ceb317
 
Pablo Greco ceb317
-	printk(KERN_INFO "PCI: Using ACPI for IRQ routing\n");
Pablo Greco ceb317
+	pr_info("Using ACPI for IRQ routing\n");
Pablo Greco ceb317
 	acpi_irq_penalty_init();
Pablo Greco ceb317
 	pcibios_enable_irq = acpi_pci_irq_enable;
Pablo Greco ceb317
 	pcibios_disable_irq = acpi_pci_irq_disable;
Pablo Greco ceb317
@@ -444,7 +445,7 @@ int __init pci_acpi_init(void)
Pablo Greco ceb317
 		 * also do it here in case there are still broken drivers that
Pablo Greco ceb317
 		 * don't use pci_enable_device().
Pablo Greco ceb317
 		 */
Pablo Greco ceb317
-		printk(KERN_INFO "PCI: Routing PCI interrupts for all devices because \"pci=routeirq\" specified\n");
Pablo Greco ceb317
+		pr_info("Routing PCI interrupts for all devices because \"pci=routeirq\" specified\n");
Pablo Greco ceb317
 		for_each_pci_dev(dev)
Pablo Greco ceb317
 			acpi_pci_irq_enable(dev);
Pablo Greco ceb317
 	}
Pablo Greco ceb317
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco ceb317
Pablo Greco ceb317
Pablo Greco ceb317
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco 89a396
From: Hans de Goede <hdegoede@redhat.com>
Pablo Greco 89a396
Date: Tue, 23 Nov 2021 22:05:24 +0100
Pablo Greco de6db6
Subject: [PATCH 30/33] platform/x86: thinkpad_acpi: Add lid_logo_dot to the
Pablo Greco 89a396
 list of safe LEDs
Pablo Greco 89a396
Pablo Greco 89a396
There have been various bugs / forum threads about allowing control of
Pablo Greco 89a396
the LED in the ThinkPad logo on the lid of various models.
Pablo Greco 89a396
Pablo Greco 89a396
This seems to be something which users want to control and there really
Pablo Greco 89a396
is no reason to require setting CONFIG_THINKPAD_ACPI_UNSAFE_LEDS for this.
Pablo Greco 89a396
Pablo Greco 89a396
The lid-logo-dot is LED number 10, so change the name of the 10th led
Pablo Greco 89a396
from unknown_led2 to lid_logo_dot and add it to the TPACPI_SAFE_LEDS mask.
Pablo Greco 89a396
Pablo Greco 89a396
Link: https://www.reddit.com/r/thinkpad/comments/7n8eyu/thinkpad_led_control_under_gnulinux/
Pablo Greco 89a396
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1943318
Pablo Greco 89a396
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Pablo Greco 89a396
Link: https://lore.kernel.org/r/20211123210524.266705-2-hdegoede@redhat.com
Pablo Greco 89a396
---
Pablo Greco 89a396
 drivers/platform/x86/thinkpad_acpi.c | 4 ++--
Pablo Greco 89a396
 1 file changed, 2 insertions(+), 2 deletions(-)
Pablo Greco 89a396
Pablo Greco 89a396
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
Pablo Greco 89a396
index 3dc055ce6e61..bb56640eb31f 100644
Pablo Greco 89a396
--- a/drivers/platform/x86/thinkpad_acpi.c
Pablo Greco 89a396
+++ b/drivers/platform/x86/thinkpad_acpi.c
Pablo Greco 89a396
@@ -5813,11 +5813,11 @@ static const char * const tpacpi_led_names[TPACPI_LED_NUMLEDS] = {
Pablo Greco 89a396
 	"tpacpi::standby",
Pablo Greco 89a396
 	"tpacpi::dock_status1",
Pablo Greco 89a396
 	"tpacpi::dock_status2",
Pablo Greco 89a396
-	"tpacpi::unknown_led2",
Pablo Greco 89a396
+	"tpacpi::lid_logo_dot",
Pablo Greco 89a396
 	"tpacpi::unknown_led3",
Pablo Greco 89a396
 	"tpacpi::thinkvantage",
Pablo Greco 89a396
 };
Pablo Greco 89a396
-#define TPACPI_SAFE_LEDS	0x1081U
Pablo Greco 89a396
+#define TPACPI_SAFE_LEDS	0x1481U
Pablo Greco 89a396
 
Pablo Greco 89a396
 static inline bool tpacpi_is_led_restricted(const unsigned int led)
Pablo Greco 89a396
 {
Pablo Greco 89a396
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco 89a396
Pablo Greco 08fca0
Pablo Greco 08fca0
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco 08fca0
From: Florian Westphal <fw@strlen.de>
Pablo Greco 08fca0
Date: Fri, 17 Dec 2021 11:29:56 +0100
Pablo Greco de6db6
Subject: [PATCH 31/33] netfilter: conntrack: tag conntracks picked up in local
Pablo Greco 08fca0
 out hook
Pablo Greco 08fca0
Pablo Greco 08fca0
This allows to identify flows that originate from local machine
Pablo Greco 08fca0
in a followup patch.
Pablo Greco 08fca0
Pablo Greco 08fca0
It would be possible to make this a ->status bit instead.
Pablo Greco 08fca0
For now I did not do that yet because I don't have a use-case for
Pablo Greco 08fca0
exposing this info to userspace.
Pablo Greco 08fca0
Pablo Greco 08fca0
If one comes up the toggle can be replaced with a status bit.
Pablo Greco 08fca0
Pablo Greco 08fca0
Signed-off-by: Florian Westphal <fw@strlen.de>
Pablo Greco 08fca0
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Pablo Greco 08fca0
---
Pablo Greco 08fca0
 include/net/netfilter/nf_conntrack.h | 1 +
Pablo Greco 08fca0
 net/netfilter/nf_conntrack_core.c    | 3 +++
Pablo Greco 08fca0
 2 files changed, 4 insertions(+)
Pablo Greco 08fca0
Pablo Greco 08fca0
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
Pablo Greco de6db6
index 34c266502a50..dae1a7e4732f 100644
Pablo Greco 08fca0
--- a/include/net/netfilter/nf_conntrack.h
Pablo Greco 08fca0
+++ b/include/net/netfilter/nf_conntrack.h
Pablo Greco de6db6
@@ -97,6 +97,7 @@ struct nf_conn {
Pablo Greco 08fca0
 	unsigned long status;
Pablo Greco 08fca0
 
Pablo Greco 08fca0
 	u16		cpu;
Pablo Greco 08fca0
+	u16		local_origin:1;
Pablo Greco 08fca0
 	possible_net_t ct_net;
Pablo Greco 08fca0
 
Pablo Greco 08fca0
 #if IS_ENABLED(CONFIG_NF_NAT)
Pablo Greco 08fca0
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
Pablo Greco de6db6
index 31399c53dfb1..e304f038656d 100644
Pablo Greco 08fca0
--- a/net/netfilter/nf_conntrack_core.c
Pablo Greco 08fca0
+++ b/net/netfilter/nf_conntrack_core.c
Pablo Greco de6db6
@@ -1800,6 +1800,9 @@ resolve_normal_ct(struct nf_conn *tmpl,
Pablo Greco 08fca0
 			return 0;
Pablo Greco 08fca0
 		if (IS_ERR(h))
Pablo Greco 08fca0
 			return PTR_ERR(h);
Pablo Greco 08fca0
+
Pablo Greco 08fca0
+		ct = nf_ct_tuplehash_to_ctrack(h);
Pablo Greco 08fca0
+		ct->local_origin = state->hook == NF_INET_LOCAL_OUT;
Pablo Greco 08fca0
 	}
Pablo Greco 08fca0
 	ct = nf_ct_tuplehash_to_ctrack(h);
Pablo Greco 08fca0
 
Pablo Greco 08fca0
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco 08fca0
Pablo Greco 08fca0
Pablo Greco 08fca0
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco 08fca0
From: Florian Westphal <fw@strlen.de>
Pablo Greco 08fca0
Date: Fri, 17 Dec 2021 11:29:57 +0100
Pablo Greco de6db6
Subject: [PATCH 32/33] netfilter: nat: force port remap to prevent shadowing
Pablo Greco 08fca0
 well-known ports
Pablo Greco 08fca0
Pablo Greco 08fca0
If destination port is above 32k and source port below 16k
Pablo Greco 08fca0
assume this might cause 'port shadowing' where a 'new' inbound
Pablo Greco 08fca0
connection matches an existing one, e.g.
Pablo Greco 08fca0
Pablo Greco 08fca0
inbound X:41234 -> Y:53 matches existing conntrack entry
Pablo Greco 08fca0
        Z:53 -> X:4123, where Z got natted to X.
Pablo Greco 08fca0
Pablo Greco 08fca0
In this case, new packet is natted to Z:53 which is likely
Pablo Greco 08fca0
unwanted.
Pablo Greco 08fca0
Pablo Greco 08fca0
We avoid the rewrite for connections that originate from local host:
Pablo Greco 08fca0
port-shadowing is only possible with forwarded connections.
Pablo Greco 08fca0
Pablo Greco 08fca0
Also adjust test case.
Pablo Greco 08fca0
Pablo Greco 08fca0
v3: no need to call tuple_force_port_remap if already in random mode (Phil)
Pablo Greco 08fca0
Pablo Greco 08fca0
Signed-off-by: Florian Westphal <fw@strlen.de>
Pablo Greco 08fca0
Acked-by: Phil Sutter <phil@nwl.cc>
Pablo Greco 08fca0
Acked-by: Eric Garver <eric@garver.life>
Pablo Greco 08fca0
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Pablo Greco 08fca0
---
Pablo Greco 08fca0
 net/netfilter/nf_nat_core.c                  | 43 ++++++++++++++++++--
Pablo Greco 08fca0
 tools/testing/selftests/netfilter/nft_nat.sh |  5 ++-
Pablo Greco 08fca0
 2 files changed, 43 insertions(+), 5 deletions(-)
Pablo Greco 08fca0
Pablo Greco 08fca0
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
Pablo Greco 08fca0
index 273117683922..21ec0c3d1d47 100644
Pablo Greco 08fca0
--- a/net/netfilter/nf_nat_core.c
Pablo Greco 08fca0
+++ b/net/netfilter/nf_nat_core.c
Pablo Greco 08fca0
@@ -494,6 +494,38 @@ static void nf_nat_l4proto_unique_tuple(struct nf_conntrack_tuple *tuple,
Pablo Greco 08fca0
 	goto another_round;
Pablo Greco 08fca0
 }
Pablo Greco 08fca0
 
Pablo Greco 08fca0
+static bool tuple_force_port_remap(const struct nf_conntrack_tuple *tuple)
Pablo Greco 08fca0
+{
Pablo Greco 08fca0
+	u16 sp, dp;
Pablo Greco 08fca0
+
Pablo Greco 08fca0
+	switch (tuple->dst.protonum) {
Pablo Greco 08fca0
+	case IPPROTO_TCP:
Pablo Greco 08fca0
+		sp = ntohs(tuple->src.u.tcp.port);
Pablo Greco 08fca0
+		dp = ntohs(tuple->dst.u.tcp.port);
Pablo Greco 08fca0
+		break;
Pablo Greco 08fca0
+	case IPPROTO_UDP:
Pablo Greco 08fca0
+	case IPPROTO_UDPLITE:
Pablo Greco 08fca0
+		sp = ntohs(tuple->src.u.udp.port);
Pablo Greco 08fca0
+		dp = ntohs(tuple->dst.u.udp.port);
Pablo Greco 08fca0
+		break;
Pablo Greco 08fca0
+	default:
Pablo Greco 08fca0
+		return false;
Pablo Greco 08fca0
+	}
Pablo Greco 08fca0
+
Pablo Greco 08fca0
+	/* IANA: System port range: 1-1023,
Pablo Greco 08fca0
+	 *         user port range: 1024-49151,
Pablo Greco 08fca0
+	 *      private port range: 49152-65535.
Pablo Greco 08fca0
+	 *
Pablo Greco 08fca0
+	 * Linux default ephemeral port range is 32768-60999.
Pablo Greco 08fca0
+	 *
Pablo Greco 08fca0
+	 * Enforce port remapping if sport is significantly lower
Pablo Greco 08fca0
+	 * than dport to prevent NAT port shadowing, i.e.
Pablo Greco 08fca0
+	 * accidental match of 'new' inbound connection vs.
Pablo Greco 08fca0
+	 * existing outbound one.
Pablo Greco 08fca0
+	 */
Pablo Greco 08fca0
+	return sp < 16384 && dp >= 32768;
Pablo Greco 08fca0
+}
Pablo Greco 08fca0
+
Pablo Greco 08fca0
 /* Manipulate the tuple into the range given. For NF_INET_POST_ROUTING,
Pablo Greco 08fca0
  * we change the source to map into the range. For NF_INET_PRE_ROUTING
Pablo Greco 08fca0
  * and NF_INET_LOCAL_OUT, we change the destination to map into the
Pablo Greco 08fca0
@@ -507,11 +539,17 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple,
Pablo Greco 08fca0
 		 struct nf_conn *ct,
Pablo Greco 08fca0
 		 enum nf_nat_manip_type maniptype)
Pablo Greco 08fca0
 {
Pablo Greco 08fca0
+	bool random_port = range->flags & NF_NAT_RANGE_PROTO_RANDOM_ALL;
Pablo Greco 08fca0
 	const struct nf_conntrack_zone *zone;
Pablo Greco 08fca0
 	struct net *net = nf_ct_net(ct);
Pablo Greco 08fca0
 
Pablo Greco 08fca0
 	zone = nf_ct_zone(ct);
Pablo Greco 08fca0
 
Pablo Greco 08fca0
+	if (maniptype == NF_NAT_MANIP_SRC &&
Pablo Greco 08fca0
+	    !random_port &&
Pablo Greco 08fca0
+	    !ct->local_origin)
Pablo Greco 08fca0
+		random_port = tuple_force_port_remap(orig_tuple);
Pablo Greco 08fca0
+
Pablo Greco 08fca0
 	/* 1) If this srcip/proto/src-proto-part is currently mapped,
Pablo Greco 08fca0
 	 * and that same mapping gives a unique tuple within the given
Pablo Greco 08fca0
 	 * range, use that.
Pablo Greco 08fca0
@@ -520,8 +558,7 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple,
Pablo Greco 08fca0
 	 * So far, we don't do local source mappings, so multiple
Pablo Greco 08fca0
 	 * manips not an issue.
Pablo Greco 08fca0
 	 */
Pablo Greco 08fca0
-	if (maniptype == NF_NAT_MANIP_SRC &&
Pablo Greco 08fca0
-	    !(range->flags & NF_NAT_RANGE_PROTO_RANDOM_ALL)) {
Pablo Greco 08fca0
+	if (maniptype == NF_NAT_MANIP_SRC && !random_port) {
Pablo Greco 08fca0
 		/* try the original tuple first */
Pablo Greco 08fca0
 		if (in_range(orig_tuple, range)) {
Pablo Greco 08fca0
 			if (!nf_nat_used_tuple(orig_tuple, ct)) {
Pablo Greco 08fca0
@@ -545,7 +582,7 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple,
Pablo Greco 08fca0
 	 */
Pablo Greco 08fca0
 
Pablo Greco 08fca0
 	/* Only bother mapping if it's not already in range and unique */
Pablo Greco 08fca0
-	if (!(range->flags & NF_NAT_RANGE_PROTO_RANDOM_ALL)) {
Pablo Greco 08fca0
+	if (!random_port) {
Pablo Greco 08fca0
 		if (range->flags & NF_NAT_RANGE_PROTO_SPECIFIED) {
Pablo Greco 08fca0
 			if (!(range->flags & NF_NAT_RANGE_PROTO_OFFSET) &&
Pablo Greco 08fca0
 			    l4proto_in_range(tuple, maniptype,
Pablo Greco 08fca0
diff --git a/tools/testing/selftests/netfilter/nft_nat.sh b/tools/testing/selftests/netfilter/nft_nat.sh
Pablo Greco 7163c5
index 032f2de6e14e..1ba2cba7d580 100755
Pablo Greco 08fca0
--- a/tools/testing/selftests/netfilter/nft_nat.sh
Pablo Greco 08fca0
+++ b/tools/testing/selftests/netfilter/nft_nat.sh
Pablo Greco 7163c5
@@ -906,8 +906,9 @@ EOF
Pablo Greco 08fca0
 		return $ksft_skip
Pablo Greco 08fca0
 	fi
Pablo Greco 08fca0
 
Pablo Greco 08fca0
-	# test default behaviour. Packet from ns1 to ns0 is redirected to ns2.
Pablo Greco 08fca0
-	test_port_shadow "default" "CLIENT"
Pablo Greco 08fca0
+	# test default behaviour. Packet from ns1 to ns0 is not redirected
Pablo Greco 08fca0
+	# due to automatic port translation.
Pablo Greco 08fca0
+	test_port_shadow "default" "ROUTER"
Pablo Greco 08fca0
 
Pablo Greco 08fca0
 	# test packet filter based mitigation: prevent forwarding of
Pablo Greco 08fca0
 	# packets claiming to come from the service port.
Pablo Greco 08fca0
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco 08fca0
Pablo Greco 08fca0
Pablo Greco 08fca0
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Pablo Greco 08fca0
From: "Justin M. Forbes" <jforbes@fedoraproject.org>
Pablo Greco 08fca0
Date: Tue, 25 Jan 2022 09:08:34 -0600
Pablo Greco de6db6
Subject: [PATCH 33/33] Revert "PCI/MSI: Mask MSI-X vectors only on success"
Pablo Greco 08fca0
Pablo Greco 08fca0
This reverts commit d8888cdabedf353ab9b5a6af75f70bf341a3e7df.
Pablo Greco 08fca0
Pablo Greco 08fca0
Signed-off-by: Justin M. Forbes <jforbes@fedoraproject.org>
Pablo Greco 08fca0
---
Pablo Greco 08fca0
 drivers/pci/msi.c | 13 +++----------
Pablo Greco 08fca0
 1 file changed, 3 insertions(+), 10 deletions(-)
Pablo Greco 08fca0
Pablo Greco 08fca0
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
Pablo Greco 08fca0
index cc4c2b8a5efd..96132d68be1e 100644
Pablo Greco 08fca0
--- a/drivers/pci/msi.c
Pablo Greco 08fca0
+++ b/drivers/pci/msi.c
Pablo Greco 08fca0
@@ -721,6 +721,9 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
Pablo Greco 08fca0
 		goto out_disable;
Pablo Greco 08fca0
 	}
Pablo Greco 08fca0
 
Pablo Greco 08fca0
+	/* Ensure that all table entries are masked. */
Pablo Greco 08fca0
+	msix_mask_all(base, tsize);
Pablo Greco 08fca0
+
Pablo Greco 08fca0
 	ret = msix_setup_entries(dev, base, entries, nvec, affd);
Pablo Greco 08fca0
 	if (ret)
Pablo Greco 08fca0
 		goto out_disable;
Pablo Greco 08fca0
@@ -747,16 +750,6 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
Pablo Greco 08fca0
 	/* Set MSI-X enabled bits and unmask the function */
Pablo Greco 08fca0
 	pci_intx_for_msi(dev, 0);
Pablo Greco 08fca0
 	dev->msix_enabled = 1;
Pablo Greco 08fca0
-
Pablo Greco 08fca0
-	/*
Pablo Greco 08fca0
-	 * Ensure that all table entries are masked to prevent
Pablo Greco 08fca0
-	 * stale entries from firing in a crash kernel.
Pablo Greco 08fca0
-	 *
Pablo Greco 08fca0
-	 * Done late to deal with a broken Marvell NVME device
Pablo Greco 08fca0
-	 * which takes the MSI-X mask bits into account even
Pablo Greco 08fca0
-	 * when MSI-X is disabled, which prevents MSI delivery.
Pablo Greco 08fca0
-	 */
Pablo Greco 08fca0
-	msix_mask_all(base, tsize);
Pablo Greco 08fca0
 	pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL, 0);
Pablo Greco 08fca0
 
Pablo Greco 08fca0
 	pcibios_free_irq(dev);
Pablo Greco 08fca0
-- 
Pablo Greco de6db6
2.18.4
Pablo Greco 08fca0