]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
Fixes for 6.8
authorSasha Levin <sashal@kernel.org>
Wed, 3 Apr 2024 15:59:47 +0000 (11:59 -0400)
committerSasha Levin <sashal@kernel.org>
Wed, 3 Apr 2024 15:59:47 +0000 (11:59 -0400)
Signed-off-by: Sasha Levin <sashal@kernel.org>
64 files changed:
queue-6.8/acpica-debugger-check-status-of-acpi_evaluate_object.patch [new file with mode: 0644]
queue-6.8/alsa-hda-cs35l56-set-the-init_done-flag-before-compo.patch [new file with mode: 0644]
queue-6.8/arm64-bpf-fix-32bit-unconditional-bswap.patch [new file with mode: 0644]
queue-6.8/bpf-arm64-fix-bug-in-bpf_ldx_memsx.patch [new file with mode: 0644]
queue-6.8/bpf-protect-against-int-overflow-for-stack-access-si.patch [new file with mode: 0644]
queue-6.8/cifs-fix-duplicate-fscache-cookie-warnings.patch [new file with mode: 0644]
queue-6.8/dm-integrity-fix-out-of-range-warning.patch [new file with mode: 0644]
queue-6.8/dma-buf-fix-null-pointer-dereference-in-sanitycheck.patch [new file with mode: 0644]
queue-6.8/dpll-indent-dpll-option-type-by-a-tab.patch [new file with mode: 0644]
queue-6.8/drm-amd-display-send-dtbclk-disable-message-on-first.patch [new file with mode: 0644]
queue-6.8/drm-amd-display-update-p010-scaling-cap.patch [new file with mode: 0644]
queue-6.8/drm-i915-display-disable-auxccs-framebuffers-if-buil.patch [new file with mode: 0644]
queue-6.8/drm-i915-do-not-print-pxp-init-failed-with-0-when-it.patch [new file with mode: 0644]
queue-6.8/drm-i915-mtl-update-workaround-14018575942.patch [new file with mode: 0644]
queue-6.8/drm-i915-stop-doing-double-audio-enable-disable-on-s.patch [new file with mode: 0644]
queue-6.8/drm-i915-xelpg-extend-some-workarounds-tuning-to-gfx.patch [new file with mode: 0644]
queue-6.8/drm-rockchip-vop2-remove-ar30-and-ab30-format-suppor.patch [new file with mode: 0644]
queue-6.8/drm-xe-add-exec_queue.sched_props.job_timeout_ms.patch [new file with mode: 0644]
queue-6.8/drm-xe-device-fix-xe_max_gt_per_tile-check.patch [new file with mode: 0644]
queue-6.8/drm-xe-device-fix-xe_max_tiles_per_device-check.patch [new file with mode: 0644]
queue-6.8/drm-xe-guc_submit-use-jiffies-for-job-timeout.patch [new file with mode: 0644]
queue-6.8/drm-xe-queue-fix-engine_class-bounds-check.patch [new file with mode: 0644]
queue-6.8/drm-xe-remove-unused-xe_bo-props-struct.patch [new file with mode: 0644]
queue-6.8/gpio-protect-the-list-of-gpio-devices-with-srcu.patch [new file with mode: 0644]
queue-6.8/gpiolib-fix-debug-messaging-in-gpiod_find_and_reques.patch [new file with mode: 0644]
queue-6.8/ice-fix-memory-corruption-bug-with-suspend-and-rebui.patch [new file with mode: 0644]
queue-6.8/ice-refactor-fw-data-type-and-fix-bitmap-casting-iss.patch [new file with mode: 0644]
queue-6.8/igc-remove-stale-comment-about-tx-timestamping.patch [new file with mode: 0644]
queue-6.8/inet-inet_defrag-prevent-sk-release-while-still-in-u.patch [new file with mode: 0644]
queue-6.8/iommu-validate-the-pasid-in-iommu_attach_device_pasi.patch [new file with mode: 0644]
queue-6.8/ixgbe-avoid-sleeping-allocation-in-ixgbe_ipsec_vf_ad.patch [new file with mode: 0644]
queue-6.8/kbuild-make-woverride-init-warnings-more-consistent.patch [new file with mode: 0644]
queue-6.8/mlxbf_gige-call-request_irq-after-napi-initialized.patch [new file with mode: 0644]
queue-6.8/mlxbf_gige-stop-phy-during-open-error-paths.patch [new file with mode: 0644]
queue-6.8/mm-treewide-replace-pud_large-with-pud_leaf.patch [new file with mode: 0644]
queue-6.8/modpost-do-not-make-find_tosym-return-null.patch [new file with mode: 0644]
queue-6.8/net-bcmasp-bring-up-unimac-after-phy-link-up.patch [new file with mode: 0644]
queue-6.8/net-hns3-fix-index-limit-to-support-all-queue-stats.patch [new file with mode: 0644]
queue-6.8/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch [new file with mode: 0644]
queue-6.8/net-hns3-mark-unexcuted-loopback-test-result-as-unex.patch [new file with mode: 0644]
queue-6.8/net-hsr-hsr_slave-fix-the-promiscuous-mode-in-offloa.patch [new file with mode: 0644]
queue-6.8/net-lan743x-add-set-rfe-read-fifo-threshold-for-pci1.patch [new file with mode: 0644]
queue-6.8/net-wwan-t7xx-split-64bit-accesses-to-fix-alignment-.patch [new file with mode: 0644]
queue-6.8/netfilter-nf_tables-reject-destroy-command-to-remove.patch [new file with mode: 0644]
queue-6.8/netfilter-nf_tables-reject-table-flag-and-netdev-bas.patch [new file with mode: 0644]
queue-6.8/netfilter-nf_tables-skip-netdev-hook-unregistration-.patch [new file with mode: 0644]
queue-6.8/nfc-nci-fix-uninit-value-in-nci_dev_up-and-nci_ntf_p.patch [new file with mode: 0644]
queue-6.8/nfsd-fix-error-cleanup-path-in-nfsd_rename.patch [new file with mode: 0644]
queue-6.8/octeontx2-af-fix-pause-frame-configuration-in-gmp-mo.patch [new file with mode: 0644]
queue-6.8/revert-x86-mm-ident_map-use-gbpages-only-where-full-.patch [new file with mode: 0644]
queue-6.8/s390-bpf-fix-bpf_plt-pointer-arithmetic.patch [new file with mode: 0644]
queue-6.8/s390-qeth-handle-deferred-cc1.patch [new file with mode: 0644]
queue-6.8/scripts-bpf_doc-use-silent-mode-when-exec-make-cmd.patch [new file with mode: 0644]
queue-6.8/selftests-vxlan_mdb-fix-failures-with-old-libnet.patch [new file with mode: 0644]
queue-6.8/series [new file with mode: 0644]
queue-6.8/tcp-properly-terminate-timers-for-kernel-sockets.patch [new file with mode: 0644]
queue-6.8/tls-adjust-recv-return-with-async-crypto-and-failed-.patch [new file with mode: 0644]
queue-6.8/tls-get-psock-ref-after-taking-rxlock-to-avoid-leak.patch [new file with mode: 0644]
queue-6.8/tls-recv-process_rx_list-shouldn-t-use-an-offset-wit.patch [new file with mode: 0644]
queue-6.8/tools-ynl-fix-setting-presence-bits-in-simple-nests.patch [new file with mode: 0644]
queue-6.8/wifi-iwlwifi-mvm-include-link-id-when-releasing-fram.patch [new file with mode: 0644]
queue-6.8/wifi-iwlwifi-mvm-pick-the-version-of-session_protect.patch [new file with mode: 0644]
queue-6.8/wifi-iwlwifi-mvm-rfi-fix-potential-response-leaks.patch [new file with mode: 0644]
queue-6.8/xsk-don-t-assume-metadata-is-always-requested-in-tx-.patch [new file with mode: 0644]

diff --git a/queue-6.8/acpica-debugger-check-status-of-acpi_evaluate_object.patch b/queue-6.8/acpica-debugger-check-status-of-acpi_evaluate_object.patch
new file mode 100644 (file)
index 0000000..1e320be
--- /dev/null
@@ -0,0 +1,53 @@
+From e63a4248bdfac2f7b3e1ce244a61e132091de479 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2024 21:07:53 +0300
+Subject: ACPICA: debugger: check status of acpi_evaluate_object() in
+ acpi_db_walk_for_fields()
+
+From: Nikita Kiryushin <kiryushin@ancud.ru>
+
+[ Upstream commit 40e2710860e57411ab57a1529c5a2748abbe8a19 ]
+
+ACPICA commit 9061cd9aa131205657c811a52a9f8325a040c6c9
+
+Errors in acpi_evaluate_object() can lead to incorrect state of buffer.
+
+This can lead to access to data in previously ACPI_FREEd buffer and
+secondary ACPI_FREE to the same buffer later.
+
+Handle errors in acpi_evaluate_object the same way it is done earlier
+with acpi_ns_handle_to_pathname.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Link: https://github.com/acpica/acpica/commit/9061cd9a
+Fixes: 5fd033288a86 ("ACPICA: debugger: add command to dump all fields of particular subtype")
+Signed-off-by: Nikita Kiryushin <kiryushin@ancud.ru>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dbnames.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/acpica/dbnames.c b/drivers/acpi/acpica/dbnames.c
+index b91155ea9c343..c9131259f717b 100644
+--- a/drivers/acpi/acpica/dbnames.c
++++ b/drivers/acpi/acpica/dbnames.c
+@@ -550,8 +550,12 @@ acpi_db_walk_for_fields(acpi_handle obj_handle,
+       ACPI_FREE(buffer.pointer);
+       buffer.length = ACPI_ALLOCATE_LOCAL_BUFFER;
+-      acpi_evaluate_object(obj_handle, NULL, NULL, &buffer);
+-
++      status = acpi_evaluate_object(obj_handle, NULL, NULL, &buffer);
++      if (ACPI_FAILURE(status)) {
++              acpi_os_printf("Could Not evaluate object %p\n",
++                             obj_handle);
++              return (AE_OK);
++      }
+       /*
+        * Since this is a field unit, surround the output in braces
+        */
+-- 
+2.43.0
+
diff --git a/queue-6.8/alsa-hda-cs35l56-set-the-init_done-flag-before-compo.patch b/queue-6.8/alsa-hda-cs35l56-set-the-init_done-flag-before-compo.patch
new file mode 100644 (file)
index 0000000..9616329
--- /dev/null
@@ -0,0 +1,47 @@
+From 2beceaac549e22a79b83036f2ae5653418f45ae0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Mar 2024 14:55:10 +0000
+Subject: ALSA: hda: cs35l56: Set the init_done flag before component_add()
+
+From: Simon Trimmer <simont@opensource.cirrus.com>
+
+[ Upstream commit cafe9c6a72cf1ffe96d2561d988a141cb5c093db ]
+
+Initialization is completed before adding the component as that can
+start the process of the device binding and trigger actions that check
+init_done.
+
+Signed-off-by: Simon Trimmer <simont@opensource.cirrus.com>
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Fixes: 73cfbfa9caea ("ALSA: hda/cs35l56: Add driver for Cirrus Logic CS35L56 amplifier")
+Message-ID: <20240325145510.328378-1-rf@opensource.cirrus.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/cs35l56_hda.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/cs35l56_hda.c b/sound/pci/hda/cs35l56_hda.c
+index 75a14ba54fcd1..43a445bd961fb 100644
+--- a/sound/pci/hda/cs35l56_hda.c
++++ b/sound/pci/hda/cs35l56_hda.c
+@@ -1017,14 +1017,14 @@ int cs35l56_hda_common_probe(struct cs35l56_hda *cs35l56, int id)
+       pm_runtime_mark_last_busy(cs35l56->base.dev);
+       pm_runtime_enable(cs35l56->base.dev);
++      cs35l56->base.init_done = true;
++
+       ret = component_add(cs35l56->base.dev, &cs35l56_hda_comp_ops);
+       if (ret) {
+               dev_err(cs35l56->base.dev, "Register component failed: %d\n", ret);
+               goto pm_err;
+       }
+-      cs35l56->base.init_done = true;
+-
+       return 0;
+ pm_err:
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-bpf-fix-32bit-unconditional-bswap.patch b/queue-6.8/arm64-bpf-fix-32bit-unconditional-bswap.patch
new file mode 100644 (file)
index 0000000..72ce96d
--- /dev/null
@@ -0,0 +1,52 @@
+From 4291ddb269a461ff553b8c8432f99edb50334ac0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Mar 2024 09:18:09 +0100
+Subject: arm64: bpf: fix 32bit unconditional bswap
+
+From: Artem Savkov <asavkov@redhat.com>
+
+[ Upstream commit a51cd6bf8e10793103c5870ff9e4db295a843604 ]
+
+In case when is64 == 1 in emit(A64_REV32(is64, dst, dst), ctx) the
+generated insn reverses byte order for both high and low 32-bit words,
+resuling in an incorrect swap as indicated by the jit test:
+
+[ 9757.262607] test_bpf: #312 BSWAP 16: 0x0123456789abcdef -> 0xefcd jited:1 8 PASS
+[ 9757.264435] test_bpf: #313 BSWAP 32: 0x0123456789abcdef -> 0xefcdab89 jited:1 ret 1460850314 != -271733879 (0x5712ce8a != 0xefcdab89)FAIL (1 times)
+[ 9757.266260] test_bpf: #314 BSWAP 64: 0x0123456789abcdef -> 0x67452301 jited:1 8 PASS
+[ 9757.268000] test_bpf: #315 BSWAP 64: 0x0123456789abcdef >> 32 -> 0xefcdab89 jited:1 8 PASS
+[ 9757.269686] test_bpf: #316 BSWAP 16: 0xfedcba9876543210 -> 0x1032 jited:1 8 PASS
+[ 9757.271380] test_bpf: #317 BSWAP 32: 0xfedcba9876543210 -> 0x10325476 jited:1 ret -1460850316 != 271733878 (0xa8ed3174 != 0x10325476)FAIL (1 times)
+[ 9757.273022] test_bpf: #318 BSWAP 64: 0xfedcba9876543210 -> 0x98badcfe jited:1 7 PASS
+[ 9757.274721] test_bpf: #319 BSWAP 64: 0xfedcba9876543210 >> 32 -> 0x10325476 jited:1 9 PASS
+
+Fix this by forcing 32bit variant of rev32.
+
+Fixes: 1104247f3f979 ("bpf, arm64: Support unconditional bswap")
+Signed-off-by: Artem Savkov <asavkov@redhat.com>
+Tested-by: Puranjay Mohan <puranjay12@gmail.com>
+Acked-by: Puranjay Mohan <puranjay12@gmail.com>
+Acked-by: Xu Kuohai <xukuohai@huawei.com>
+Message-ID: <20240321081809.158803-1-asavkov@redhat.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/net/bpf_jit_comp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
+index 582c4c2491edc..00217d8d034b7 100644
+--- a/arch/arm64/net/bpf_jit_comp.c
++++ b/arch/arm64/net/bpf_jit_comp.c
+@@ -876,7 +876,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,
+                       emit(A64_UXTH(is64, dst, dst), ctx);
+                       break;
+               case 32:
+-                      emit(A64_REV32(is64, dst, dst), ctx);
++                      emit(A64_REV32(0, dst, dst), ctx);
+                       /* upper 32 bits already cleared */
+                       break;
+               case 64:
+-- 
+2.43.0
+
diff --git a/queue-6.8/bpf-arm64-fix-bug-in-bpf_ldx_memsx.patch b/queue-6.8/bpf-arm64-fix-bug-in-bpf_ldx_memsx.patch
new file mode 100644 (file)
index 0000000..228f517
--- /dev/null
@@ -0,0 +1,83 @@
+From 7f52e93297963c67cd767f0d0ee48c8c11ccf309 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Mar 2024 23:59:17 +0000
+Subject: bpf, arm64: fix bug in BPF_LDX_MEMSX
+
+From: Puranjay Mohan <puranjay12@gmail.com>
+
+[ Upstream commit 114b5b3b4bde7358624437be2f12cde1b265224e ]
+
+A64_LDRSW() takes three registers: Xt, Xn, Xm as arguments and it loads
+and sign extends the value at address Xn + Xm into register Xt.
+
+Currently, the offset is being directly used in place of the tmp
+register which has the offset already loaded by the last emitted
+instruction.
+
+This will cause JIT failures. The easiest way to reproduce this is to
+test the following code through test_bpf module:
+
+{
+       "BPF_LDX_MEMSX | BPF_W",
+       .u.insns_int = {
+               BPF_LD_IMM64(R1, 0x00000000deadbeefULL),
+               BPF_LD_IMM64(R2, 0xffffffffdeadbeefULL),
+               BPF_STX_MEM(BPF_DW, R10, R1, -7),
+               BPF_LDX_MEMSX(BPF_W, R0, R10, -7),
+               BPF_JMP_REG(BPF_JNE, R0, R2, 1),
+               BPF_ALU64_IMM(BPF_MOV, R0, 0),
+               BPF_EXIT_INSN(),
+       },
+       INTERNAL,
+       { },
+       { { 0, 0 } },
+       .stack_depth = 7,
+},
+
+We need to use the offset as -7 to trigger this code path, there could
+be other valid ways to trigger this from proper BPF programs as well.
+
+This code is rejected by the JIT because -7 is passed to A64_LDRSW() but
+it expects a valid register (0 - 31).
+
+ roott@pjy:~# modprobe test_bpf test_name="BPF_LDX_MEMSX | BPF_W"
+ [11300.490371] test_bpf: test_bpf: set 'test_bpf' as the default test_suite.
+ [11300.491750] test_bpf: #345 BPF_LDX_MEMSX | BPF_W
+ [11300.493179] aarch64_insn_encode_register: unknown register encoding -7
+ [11300.494133] aarch64_insn_encode_register: unknown register encoding -7
+ [11300.495292] FAIL to select_runtime err=-524
+ [11300.496804] test_bpf: Summary: 0 PASSED, 1 FAILED, [0/0 JIT'ed]
+ modprobe: ERROR: could not insert 'test_bpf': Invalid argument
+
+Applying this patch fixes the issue.
+
+ root@pjy:~# modprobe test_bpf test_name="BPF_LDX_MEMSX | BPF_W"
+ [  292.837436] test_bpf: test_bpf: set 'test_bpf' as the default test_suite.
+ [  292.839416] test_bpf: #345 BPF_LDX_MEMSX | BPF_W jited:1 156 PASS
+ [  292.844794] test_bpf: Summary: 1 PASSED, 0 FAILED, [1/1 JIT'ed]
+
+Fixes: cc88f540da52 ("bpf, arm64: Support sign-extension load instructions")
+Signed-off-by: Puranjay Mohan <puranjay12@gmail.com>
+Message-ID: <20240312235917.103626-1-puranjay12@gmail.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/net/bpf_jit_comp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
+index 8955da5c47cf7..582c4c2491edc 100644
+--- a/arch/arm64/net/bpf_jit_comp.c
++++ b/arch/arm64/net/bpf_jit_comp.c
+@@ -1189,7 +1189,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,
+                       } else {
+                               emit_a64_mov_i(1, tmp, off, ctx);
+                               if (sign_extend)
+-                                      emit(A64_LDRSW(dst, src_adj, off_adj), ctx);
++                                      emit(A64_LDRSW(dst, src, tmp), ctx);
+                               else
+                                       emit(A64_LDR32(dst, src, tmp), ctx);
+                       }
+-- 
+2.43.0
+
diff --git a/queue-6.8/bpf-protect-against-int-overflow-for-stack-access-si.patch b/queue-6.8/bpf-protect-against-int-overflow-for-stack-access-si.patch
new file mode 100644 (file)
index 0000000..726540f
--- /dev/null
@@ -0,0 +1,53 @@
+From b062ab106188d2ec924b7f5785d17a096d418f5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2024 22:42:45 -0400
+Subject: bpf: Protect against int overflow for stack access size
+
+From: Andrei Matei <andreimatei1@gmail.com>
+
+[ Upstream commit ecc6a2101840177e57c925c102d2d29f260d37c8 ]
+
+This patch re-introduces protection against the size of access to stack
+memory being negative; the access size can appear negative as a result
+of overflowing its signed int representation. This should not actually
+happen, as there are other protections along the way, but we should
+protect against it anyway. One code path was missing such protections
+(fixed in the previous patch in the series), causing out-of-bounds array
+accesses in check_stack_range_initialized(). This patch causes the
+verification of a program with such a non-sensical access size to fail.
+
+This check used to exist in a more indirect way, but was inadvertendly
+removed in a833a17aeac7.
+
+Fixes: a833a17aeac7 ("bpf: Fix verification of indirect var-off stack access")
+Reported-by: syzbot+33f4297b5f927648741a@syzkaller.appspotmail.com
+Reported-by: syzbot+aafd0513053a1cbf52ef@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/bpf/CAADnVQLORV5PT0iTAhRER+iLBTkByCYNBYyvBSgjN1T31K+gOw@mail.gmail.com/
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Andrei Matei <andreimatei1@gmail.com>
+Link: https://lore.kernel.org/r/20240327024245.318299-3-andreimatei1@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index ddea9567f7559..19e575e6b7fe0 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -6618,6 +6618,11 @@ static int check_stack_access_within_bounds(
+       err = check_stack_slot_within_bounds(env, min_off, state, type);
+       if (!err && max_off > 0)
+               err = -EINVAL; /* out of stack access into non-negative offsets */
++      if (!err && access_size < 0)
++              /* access_size should not be negative (or overflow an int); others checks
++               * along the way should have prevented such an access.
++               */
++              err = -EFAULT; /* invalid negative access size; integer overflow? */
+       if (err) {
+               if (tnum_is_const(reg->var_off)) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/cifs-fix-duplicate-fscache-cookie-warnings.patch b/queue-6.8/cifs-fix-duplicate-fscache-cookie-warnings.patch
new file mode 100644 (file)
index 0000000..2d21f96
--- /dev/null
@@ -0,0 +1,93 @@
+From 8549dbd991285d93f326bd2f6d941716fb8cdb7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Mar 2024 14:13:24 +0000
+Subject: cifs: Fix duplicate fscache cookie warnings
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 8876a37277cb832e1861c35f8c661825179f73f5 ]
+
+fscache emits a lot of duplicate cookie warnings with cifs because the
+index key for the fscache cookies does not include everything that the
+cifs_find_inode() function does.  The latter is used with iget5_locked() to
+distinguish between inodes in the local inode cache.
+
+Fix this by adding the creation time and file type to the fscache cookie
+key.
+
+Additionally, add a couple of comments to note that if one is changed the
+other must be also.
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+Fixes: 70431bfd825d ("cifs: Support fscache indexing rewrite")
+cc: Shyam Prasad N <nspmangalore@gmail.com>
+cc: Rohith Surabattula <rohiths.msft@gmail.com>
+cc: Jeff Layton <jlayton@kernel.org>
+cc: linux-cifs@vger.kernel.org
+cc: netfs@lists.linux.dev
+cc: linux-fsdevel@vger.kernel.org
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/fscache.c | 16 +++++++++++++++-
+ fs/smb/client/inode.c   |  2 ++
+ 2 files changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/fscache.c b/fs/smb/client/fscache.c
+index c4a3cb736881a..340efce8f0529 100644
+--- a/fs/smb/client/fscache.c
++++ b/fs/smb/client/fscache.c
+@@ -12,6 +12,16 @@
+ #include "cifs_fs_sb.h"
+ #include "cifsproto.h"
++/*
++ * Key for fscache inode.  [!] Contents must match comparisons in cifs_find_inode().
++ */
++struct cifs_fscache_inode_key {
++
++      __le64  uniqueid;       /* server inode number */
++      __le64  createtime;     /* creation time on server */
++      u8      type;           /* S_IFMT file type */
++} __packed;
++
+ static void cifs_fscache_fill_volume_coherency(
+       struct cifs_tcon *tcon,
+       struct cifs_fscache_volume_coherency_data *cd)
+@@ -97,15 +107,19 @@ void cifs_fscache_release_super_cookie(struct cifs_tcon *tcon)
+ void cifs_fscache_get_inode_cookie(struct inode *inode)
+ {
+       struct cifs_fscache_inode_coherency_data cd;
++      struct cifs_fscache_inode_key key;
+       struct cifsInodeInfo *cifsi = CIFS_I(inode);
+       struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
+       struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb);
++      key.uniqueid    = cpu_to_le64(cifsi->uniqueid);
++      key.createtime  = cpu_to_le64(cifsi->createtime);
++      key.type        = (inode->i_mode & S_IFMT) >> 12;
+       cifs_fscache_fill_coherency(&cifsi->netfs.inode, &cd);
+       cifsi->netfs.cache =
+               fscache_acquire_cookie(tcon->fscache, 0,
+-                                     &cifsi->uniqueid, sizeof(cifsi->uniqueid),
++                                     &key, sizeof(key),
+                                      &cd, sizeof(cd),
+                                      i_size_read(&cifsi->netfs.inode));
+       if (cifsi->netfs.cache)
+diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c
+index 7f28edf4b20f3..4c3dec384f922 100644
+--- a/fs/smb/client/inode.c
++++ b/fs/smb/client/inode.c
+@@ -1414,6 +1414,8 @@ cifs_find_inode(struct inode *inode, void *opaque)
+ {
+       struct cifs_fattr *fattr = opaque;
++      /* [!] The compared values must be the same in struct cifs_fscache_inode_key. */
++
+       /* don't match inode with different uniqueid */
+       if (CIFS_I(inode)->uniqueid != fattr->cf_uniqueid)
+               return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.8/dm-integrity-fix-out-of-range-warning.patch b/queue-6.8/dm-integrity-fix-out-of-range-warning.patch
new file mode 100644 (file)
index 0000000..12cdffb
--- /dev/null
@@ -0,0 +1,47 @@
+From 6222aedd9bdb454c19ff42bd050c83ea3420d129 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Mar 2024 15:30:39 +0100
+Subject: dm integrity: fix out-of-range warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 8e91c2342351e0f5ef6c0a704384a7f6fc70c3b2 ]
+
+Depending on the value of CONFIG_HZ, clang complains about a pointless
+comparison:
+
+drivers/md/dm-integrity.c:4085:12: error: result of comparison of
+                        constant 42949672950 with expression of type
+                        'unsigned int' is always false
+                        [-Werror,-Wtautological-constant-out-of-range-compare]
+                        if (val >= (uint64_t)UINT_MAX * 1000 / HZ) {
+
+As the check remains useful for other configurations, shut up the
+warning by adding a second type cast to uint64_t.
+
+Fixes: 468dfca38b1a ("dm integrity: add a bitmap mode")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Mikulas Patocka <mpatocka@redhat.com>
+Reviewed-by: Justin Stitt <justinstitt@google.com>
+Signed-off-by: Mike Snitzer <snitzer@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-integrity.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index 47cf1ab34941f..3b4218a2e750d 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -4221,7 +4221,7 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned int argc, char **argv
+               } else if (sscanf(opt_string, "sectors_per_bit:%llu%c", &llval, &dummy) == 1) {
+                       log2_sectors_per_bitmap_bit = !llval ? 0 : __ilog2_u64(llval);
+               } else if (sscanf(opt_string, "bitmap_flush_interval:%u%c", &val, &dummy) == 1) {
+-                      if (val >= (uint64_t)UINT_MAX * 1000 / HZ) {
++                      if ((uint64_t)val >= (uint64_t)UINT_MAX * 1000 / HZ) {
+                               r = -EINVAL;
+                               ti->error = "Invalid bitmap_flush_interval argument";
+                               goto bad;
+-- 
+2.43.0
+
diff --git a/queue-6.8/dma-buf-fix-null-pointer-dereference-in-sanitycheck.patch b/queue-6.8/dma-buf-fix-null-pointer-dereference-in-sanitycheck.patch
new file mode 100644 (file)
index 0000000..0c46e7d
--- /dev/null
@@ -0,0 +1,52 @@
+From 7b1e2551ddaab8cff0996c5150877afa866f9f50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Mar 2024 04:15:23 +0500
+Subject: dma-buf: Fix NULL pointer dereference in sanitycheck()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pavel Sakharov <p.sakharov@ispras.ru>
+
+[ Upstream commit 2295bd846765c766701e666ed2e4b35396be25e6 ]
+
+If due to a memory allocation failure mock_chain() returns NULL, it is
+passed to dma_fence_enable_sw_signaling() resulting in NULL pointer
+dereference there.
+
+Call dma_fence_enable_sw_signaling() only if mock_chain() succeeds.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: d62c43a953ce ("dma-buf: Enable signaling on fence for selftests")
+Signed-off-by: Pavel Sakharov <p.sakharov@ispras.ru>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240319231527.1821372-1-p.sakharov@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma-buf/st-dma-fence-chain.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/dma-buf/st-dma-fence-chain.c b/drivers/dma-buf/st-dma-fence-chain.c
+index 9c2a0c082a768..ed4b323886e43 100644
+--- a/drivers/dma-buf/st-dma-fence-chain.c
++++ b/drivers/dma-buf/st-dma-fence-chain.c
+@@ -84,11 +84,11 @@ static int sanitycheck(void *arg)
+               return -ENOMEM;
+       chain = mock_chain(NULL, f, 1);
+-      if (!chain)
++      if (chain)
++              dma_fence_enable_sw_signaling(chain);
++      else
+               err = -ENOMEM;
+-      dma_fence_enable_sw_signaling(chain);
+-
+       dma_fence_signal(f);
+       dma_fence_put(f);
+-- 
+2.43.0
+
diff --git a/queue-6.8/dpll-indent-dpll-option-type-by-a-tab.patch b/queue-6.8/dpll-indent-dpll-option-type-by-a-tab.patch
new file mode 100644 (file)
index 0000000..dd03e9d
--- /dev/null
@@ -0,0 +1,36 @@
+From 292b4280a7ae7822a0d496b2f1b870215f2eb02c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2024 17:18:19 +0530
+Subject: dpll: indent DPLL option type by a tab
+
+From: Prasad Pandit <pjp@fedoraproject.org>
+
+[ Upstream commit cc2699268152d8e0386a36fe7c9271d7e23668f2 ]
+
+Indent config option type by a tab. It helps Kconfig parsers
+to read file without error.
+
+Fixes: 9431063ad323 ("dpll: core: Add DPLL framework base functions")
+Signed-off-by: Prasad Pandit <pjp@fedoraproject.org>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Link: https://lore.kernel.org/r/20240322114819.1801795-1-ppandit@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dpll/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dpll/Kconfig b/drivers/dpll/Kconfig
+index a4cae73f20d3d..20607ed542435 100644
+--- a/drivers/dpll/Kconfig
++++ b/drivers/dpll/Kconfig
+@@ -4,4 +4,4 @@
+ #
+ config DPLL
+-  bool
++      bool
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-amd-display-send-dtbclk-disable-message-on-first.patch b/queue-6.8/drm-amd-display-send-dtbclk-disable-message-on-first.patch
new file mode 100644 (file)
index 0000000..aaca5a1
--- /dev/null
@@ -0,0 +1,43 @@
+From 3d1629445de53486915343e4bc4b3fda7aa0fb91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jan 2024 18:10:54 -0500
+Subject: drm/amd/display: Send DTBCLK disable message on first commit
+
+From: Taimur Hassan <syed.hassan@amd.com>
+
+[ Upstream commit f341055b10bd8be55c3c995dff5f770b236b8ca9 ]
+
+[Why]
+Previous patch to allow DTBCLK disable didn't address boot case. Driver
+thinks DTBCLK is disabled by default, so we don't send disable message to
+PMFW. DTBCLK is then enabled at idle desktop on boot, burning power.
+
+[How]
+Set dtbclk_en to true on boot so that disable message is sent during first
+commit.
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Acked-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Taimur Hassan <syed.hassan@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
+index 9cbab880c6233..f07629694ec5e 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
+@@ -415,6 +415,7 @@ void dcn35_init_clocks(struct clk_mgr *clk_mgr)
+       memset(&(clk_mgr->clks), 0, sizeof(struct dc_clocks));
+       // Assumption is that boot state always supports pstate
++      clk_mgr->clks.dtbclk_en = true;
+       clk_mgr->clks.ref_dtbclk_khz = ref_dtbclk;      // restore ref_dtbclk
+       clk_mgr->clks.p_state_change_support = true;
+       clk_mgr->clks.prev_p_state_change_support = true;
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-amd-display-update-p010-scaling-cap.patch b/queue-6.8/drm-amd-display-update-p010-scaling-cap.patch
new file mode 100644 (file)
index 0000000..7723f8c
--- /dev/null
@@ -0,0 +1,84 @@
+From e27495ba2487d5286099888aba11f03c2050b65e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jan 2024 17:09:30 -0500
+Subject: drm/amd/display: Update P010 scaling cap
+
+From: Charlene Liu <charlene.liu@amd.com>
+
+[ Upstream commit 038c532346418fb5ab09c8fc6d650283d9a02966 ]
+
+[Why]
+Keep the same as previous APU and also insert clock dump
+
+Reviewed-by: Ovidiu Bunea <ovidiu.bunea@amd.com>
+Acked-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Charlene Liu <charlene.liu@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: f341055b10bd ("drm/amd/display: Send DTBCLK disable message on first commit")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c  | 25 +++++++++----------
+ .../dc/resource/dcn35/dcn35_resource.c        |  2 +-
+ 2 files changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
+index 3db46bdc71a35..9cbab880c6233 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
+@@ -384,19 +384,6 @@ static void dcn35_enable_pme_wa(struct clk_mgr *clk_mgr_base)
+       dcn35_smu_enable_pme_wa(clk_mgr);
+ }
+-void dcn35_init_clocks(struct clk_mgr *clk_mgr)
+-{
+-      uint32_t ref_dtbclk = clk_mgr->clks.ref_dtbclk_khz;
+-
+-      memset(&(clk_mgr->clks), 0, sizeof(struct dc_clocks));
+-
+-      // Assumption is that boot state always supports pstate
+-      clk_mgr->clks.ref_dtbclk_khz = ref_dtbclk;      // restore ref_dtbclk
+-      clk_mgr->clks.p_state_change_support = true;
+-      clk_mgr->clks.prev_p_state_change_support = true;
+-      clk_mgr->clks.pwr_state = DCN_PWR_STATE_UNKNOWN;
+-      clk_mgr->clks.zstate_support = DCN_ZSTATE_SUPPORT_UNKNOWN;
+-}
+ bool dcn35_are_clock_states_equal(struct dc_clocks *a,
+               struct dc_clocks *b)
+@@ -421,7 +408,19 @@ static void dcn35_dump_clk_registers(struct clk_state_registers_and_bypass *regs
+               struct clk_mgr_dcn35 *clk_mgr)
+ {
+ }
++void dcn35_init_clocks(struct clk_mgr *clk_mgr)
++{
++      uint32_t ref_dtbclk = clk_mgr->clks.ref_dtbclk_khz;
++      memset(&(clk_mgr->clks), 0, sizeof(struct dc_clocks));
++
++      // Assumption is that boot state always supports pstate
++      clk_mgr->clks.ref_dtbclk_khz = ref_dtbclk;      // restore ref_dtbclk
++      clk_mgr->clks.p_state_change_support = true;
++      clk_mgr->clks.prev_p_state_change_support = true;
++      clk_mgr->clks.pwr_state = DCN_PWR_STATE_UNKNOWN;
++      clk_mgr->clks.zstate_support = DCN_ZSTATE_SUPPORT_UNKNOWN;
++}
+ static struct clk_bw_params dcn35_bw_params = {
+       .vram_type = Ddr4MemType,
+       .num_channels = 1,
+diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c
+index 5fdcda8f86026..04d230aa8861f 100644
+--- a/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c
+@@ -701,7 +701,7 @@ static const struct dc_plane_cap plane_cap = {
+       // 6:1 downscaling ratio: 1000/6 = 166.666
+       .max_downscale_factor = {
+-                      .argb8888 = 167,
++                      .argb8888 = 250,
+                       .nv12 = 167,
+                       .fp16 = 167
+       },
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-i915-display-disable-auxccs-framebuffers-if-buil.patch b/queue-6.8/drm-i915-display-disable-auxccs-framebuffers-if-buil.patch
new file mode 100644 (file)
index 0000000..0fb21b4
--- /dev/null
@@ -0,0 +1,49 @@
+From 8cddb4c1bca38259402d62b85b5084c661a0874e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Feb 2024 16:02:25 +0200
+Subject: drm/i915/display: Disable AuxCCS framebuffers if built for Xe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Juha-Pekka Heikkila <juhapekka.heikkila@gmail.com>
+
+[ Upstream commit cf48bddd31deefb9ab07de9a4d0150da6610198a ]
+
+AuxCCS framebuffers don't work on Xe driver hence disable them
+from plane capabilities until they are fixed. FlatCCS framebuffers
+work and they are left enabled. CCS is left untouched for i915
+driver.
+
+Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/933
+Signed-off-by: Juha-Pekka Heikkila <juhapekka.heikkila@gmail.com>
+Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
+Tested-by: José Roberto de Souza <jose.souza@intel.com>
+Acked-by: Jani Nikula <jani.nikula@intel.com>
+Fixes: 44e694958b95 ("drm/xe/display: Implement display support")
+Signed-off-by: José Roberto de Souza <jose.souza@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240228140225.858145-1-juhapekka.heikkila@gmail.com
+(cherry picked from commit b7232a730fbf043f54fb46fbf4a6e92936770e79)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/display/skl_universal_plane.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/i915/display/skl_universal_plane.c b/drivers/gpu/drm/i915/display/skl_universal_plane.c
+index 511dc1544854f..8bba6c2e50989 100644
+--- a/drivers/gpu/drm/i915/display/skl_universal_plane.c
++++ b/drivers/gpu/drm/i915/display/skl_universal_plane.c
+@@ -2290,6 +2290,9 @@ static u8 skl_get_plane_caps(struct drm_i915_private *i915,
+       if (HAS_4TILE(i915))
+               caps |= INTEL_PLANE_CAP_TILING_4;
++      if (!IS_ENABLED(I915) && !HAS_FLAT_CCS(i915))
++              return caps;
++
+       if (skl_plane_has_rc_ccs(i915, pipe, plane_id)) {
+               caps |= INTEL_PLANE_CAP_CCS_RC;
+               if (DISPLAY_VER(i915) >= 12)
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-i915-do-not-print-pxp-init-failed-with-0-when-it.patch b/queue-6.8/drm-i915-do-not-print-pxp-init-failed-with-0-when-it.patch
new file mode 100644 (file)
index 0000000..8267a4c
--- /dev/null
@@ -0,0 +1,43 @@
+From 0db7916ef561c4480e87586cda3084fa67293674 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Mar 2024 14:05:47 -0700
+Subject: drm/i915: Do not print 'pxp init failed with 0' when it succeed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: José Roberto de Souza <jose.souza@intel.com>
+
+[ Upstream commit d392e1b9c2e8c60550a2a467732107f0f98b8e97 ]
+
+It is misleading, if the intention was to also print something
+in case it succeed it should have a different string.
+
+Cc: Alan Previn <alan.previn.teres.alexis@intel.com>
+Signed-off-by: José Roberto de Souza <jose.souza@intel.com>
+Fixes: 698e19da2914 ("drm/i915: Skip pxp init if gt is wedged")
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240320210547.71937-1-jose.souza@intel.com
+(cherry picked from commit d437099ab21cd4c6ce5d578b765df642d759c929)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/i915_driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_driver.c b/drivers/gpu/drm/i915/i915_driver.c
+index c7d7c3b7ecc63..9967148aedf15 100644
+--- a/drivers/gpu/drm/i915/i915_driver.c
++++ b/drivers/gpu/drm/i915/i915_driver.c
+@@ -799,7 +799,7 @@ int i915_driver_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+               goto out_cleanup_modeset2;
+       ret = intel_pxp_init(i915);
+-      if (ret != -ENODEV)
++      if (ret && ret != -ENODEV)
+               drm_dbg(&i915->drm, "pxp init failed with %d\n", ret);
+       ret = intel_display_driver_probe(i915);
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-i915-mtl-update-workaround-14018575942.patch b/queue-6.8/drm-i915-mtl-update-workaround-14018575942.patch
new file mode 100644 (file)
index 0000000..17e9eb0
--- /dev/null
@@ -0,0 +1,48 @@
+From 1323f55fd895f32ad05847d2b4e51ad076287acc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Feb 2024 16:07:38 +0530
+Subject: drm/i915/mtl: Update workaround 14018575942
+
+From: Tejas Upadhyay <tejas.upadhyay@intel.com>
+
+[ Upstream commit 186bce682772e7346bf7ced5325b5f4ff050ccfb ]
+
+Applying WA 14018575942 only on Compute engine has impact on
+some apps like chrome. Updating this WA to apply on Render
+engine as well as it is helping with performance on Chrome.
+
+Note: There is no concern from media team thus not applying
+WA on media engines. We will revisit if any issues reported
+from media team.
+
+V2(Matt):
+ - Use correct WA number
+
+Fixes: 668f37e1ee11 ("drm/i915/mtl: Update workaround 14018778641")
+Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
+Signed-off-by: Andi Shyti <andi.shyti@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240228103738.2018458-1-tejas.upadhyay@intel.com
+(cherry picked from commit 71271280175aa0ed6673e40cce7c01296bcd05f6)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/intel_workarounds.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c
+index 72dac27d9332f..c7561d7c55f5e 100644
+--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c
++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c
+@@ -1649,6 +1649,7 @@ static void
+ xelpg_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
+ {
+       /* Wa_14018575942 / Wa_18018781329 */
++      wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB);
+       wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB);
+       /* Wa_22016670082 */
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-i915-stop-doing-double-audio-enable-disable-on-s.patch b/queue-6.8/drm-i915-stop-doing-double-audio-enable-disable-on-s.patch
new file mode 100644 (file)
index 0000000..0cee46b
--- /dev/null
@@ -0,0 +1,75 @@
+From bb94ff860e03e458768bacc94ba2593c0e4c217c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Feb 2024 21:32:50 +0200
+Subject: drm/i915: Stop doing double audio enable/disable on SDVO and g4x+ DP
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+[ Upstream commit f378ab7870046704fb92e64d50a67dda2cae8420 ]
+
+Looks like I misplaced a few hunks when I moved the audio
+enable/disable out from the encoder enable/disable hooks.
+So we are now doing a double audio enable/disable on SDVO
+and g4x+ DP. Probably harmless as doing it twice shouldn't
+really change anything, but let's do it just once, as intended.
+
+Fixes: cff742cc6851 ("drm/i915: Hoist the encoder->audio_{enable,disable}() calls higher up")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240226193251.29619-1-ville.syrjala@linux.intel.com
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit 315bd0a0825776d6c66d474bf572db64fa019ad8)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/display/g4x_dp.c     | 2 --
+ drivers/gpu/drm/i915/display/intel_sdvo.c | 4 ----
+ 2 files changed, 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/display/g4x_dp.c b/drivers/gpu/drm/i915/display/g4x_dp.c
+index dfe0b07a122d1..06ec04e667e32 100644
+--- a/drivers/gpu/drm/i915/display/g4x_dp.c
++++ b/drivers/gpu/drm/i915/display/g4x_dp.c
+@@ -717,7 +717,6 @@ static void g4x_enable_dp(struct intel_atomic_state *state,
+ {
+       intel_enable_dp(state, encoder, pipe_config, conn_state);
+       intel_edp_backlight_on(pipe_config, conn_state);
+-      encoder->audio_enable(encoder, pipe_config, conn_state);
+ }
+ static void vlv_enable_dp(struct intel_atomic_state *state,
+@@ -726,7 +725,6 @@ static void vlv_enable_dp(struct intel_atomic_state *state,
+                         const struct drm_connector_state *conn_state)
+ {
+       intel_edp_backlight_on(pipe_config, conn_state);
+-      encoder->audio_enable(encoder, pipe_config, conn_state);
+ }
+ static void g4x_pre_enable_dp(struct intel_atomic_state *state,
+diff --git a/drivers/gpu/drm/i915/display/intel_sdvo.c b/drivers/gpu/drm/i915/display/intel_sdvo.c
+index 2915d7afe5ccc..cc978ee6d1309 100644
+--- a/drivers/gpu/drm/i915/display/intel_sdvo.c
++++ b/drivers/gpu/drm/i915/display/intel_sdvo.c
+@@ -1830,8 +1830,6 @@ static void intel_disable_sdvo(struct intel_atomic_state *state,
+       struct intel_crtc *crtc = to_intel_crtc(old_crtc_state->uapi.crtc);
+       u32 temp;
+-      encoder->audio_disable(encoder, old_crtc_state, conn_state);
+-
+       intel_sdvo_set_active_outputs(intel_sdvo, 0);
+       if (0)
+               intel_sdvo_set_encoder_power_state(intel_sdvo,
+@@ -1923,8 +1921,6 @@ static void intel_enable_sdvo(struct intel_atomic_state *state,
+               intel_sdvo_set_encoder_power_state(intel_sdvo,
+                                                  DRM_MODE_DPMS_ON);
+       intel_sdvo_set_active_outputs(intel_sdvo, intel_sdvo_connector->output_flag);
+-
+-      encoder->audio_enable(encoder, pipe_config, conn_state);
+ }
+ static enum drm_mode_status
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-i915-xelpg-extend-some-workarounds-tuning-to-gfx.patch b/queue-6.8/drm-i915-xelpg-extend-some-workarounds-tuning-to-gfx.patch
new file mode 100644 (file)
index 0000000..65a66e8
--- /dev/null
@@ -0,0 +1,150 @@
+From 0ad0b2ad69e2069b00410fcaf157cf7444f59d40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jan 2024 17:57:38 +0530
+Subject: drm/i915/xelpg: Extend some workarounds/tuning to gfx version 12.74
+
+From: Matt Roper <matthew.d.roper@intel.com>
+
+[ Upstream commit c44d4ef47fdad0a33966de89f9064e19736bb52f ]
+
+Some of our existing Xe_LPG workarounds and tuning are also applicable
+to the version 12.74 variant.  Extend the condition bounds accordingly.
+Also fix the comment on Wa_14018575942 while we're at it.
+
+v2: Extend some more workarounds (Harish)
+
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Harish Chegondi <harish.chegondi@intel.com>
+Signed-off-by: Haridhar Kalvala <haridhar.kalvala@intel.com>
+Reviewed-by: Matt Atwood <matthew.s.atwood@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240108122738.14399-4-haridhar.kalvala@intel.com
+Stable-dep-of: 186bce682772 ("drm/i915/mtl: Update workaround 14018575942")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/gen8_engine_cs.c    |  4 ++--
+ drivers/gpu/drm/i915/gt/intel_workarounds.c | 24 +++++++++++++--------
+ drivers/gpu/drm/i915/i915_perf.c            |  2 +-
+ 3 files changed, 18 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/gen8_engine_cs.c b/drivers/gpu/drm/i915/gt/gen8_engine_cs.c
+index 86a04afff64b3..e1bf13e3d3070 100644
+--- a/drivers/gpu/drm/i915/gt/gen8_engine_cs.c
++++ b/drivers/gpu/drm/i915/gt/gen8_engine_cs.c
+@@ -226,7 +226,7 @@ u32 *gen12_emit_aux_table_inv(struct intel_engine_cs *engine, u32 *cs)
+ static int mtl_dummy_pipe_control(struct i915_request *rq)
+ {
+       /* Wa_14016712196 */
+-      if (IS_GFX_GT_IP_RANGE(rq->engine->gt, IP_VER(12, 70), IP_VER(12, 71)) ||
++      if (IS_GFX_GT_IP_RANGE(rq->engine->gt, IP_VER(12, 70), IP_VER(12, 74)) ||
+           IS_DG2(rq->i915)) {
+               u32 *cs;
+@@ -822,7 +822,7 @@ u32 *gen12_emit_fini_breadcrumb_rcs(struct i915_request *rq, u32 *cs)
+               flags |= PIPE_CONTROL_FLUSH_L3;
+       /* Wa_14016712196 */
+-      if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 71)) || IS_DG2(i915))
++      if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 74)) || IS_DG2(i915))
+               /* dummy PIPE_CONTROL + depth flush */
+               cs = gen12_emit_pipe_control(cs, 0,
+                                            PIPE_CONTROL_DEPTH_CACHE_FLUSH, 0);
+diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c
+index 3eacbc50caf8d..72dac27d9332f 100644
+--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c
++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c
+@@ -789,8 +789,13 @@ static void xelpg_ctx_gt_tuning_init(struct intel_engine_cs *engine,
+       dg2_ctx_gt_tuning_init(engine, wal);
+-      if (IS_GFX_GT_IP_STEP(gt, IP_VER(12, 70), STEP_B0, STEP_FOREVER) ||
+-          IS_GFX_GT_IP_STEP(gt, IP_VER(12, 71), STEP_B0, STEP_FOREVER))
++      /*
++       * Due to Wa_16014892111, the DRAW_WATERMARK tuning must be done in
++       * gen12_emit_indirect_ctx_rcs() rather than here on some early
++       * steppings.
++       */
++      if (!(IS_GFX_GT_IP_STEP(gt, IP_VER(12, 70), STEP_A0, STEP_B0) ||
++            IS_GFX_GT_IP_STEP(gt, IP_VER(12, 71), STEP_A0, STEP_B0)))
+               wa_add(wal, DRAW_WATERMARK, VERT_WM_VAL, 0x3FF, 0, false);
+ }
+@@ -908,7 +913,7 @@ __intel_engine_init_ctx_wa(struct intel_engine_cs *engine,
+       if (engine->class != RENDER_CLASS)
+               goto done;
+-      if (IS_GFX_GT_IP_RANGE(engine->gt, IP_VER(12, 70), IP_VER(12, 71)))
++      if (IS_GFX_GT_IP_RANGE(engine->gt, IP_VER(12, 70), IP_VER(12, 74)))
+               xelpg_ctx_workarounds_init(engine, wal);
+       else if (IS_PONTEVECCHIO(i915))
+               ; /* noop; none at this time */
+@@ -1643,7 +1648,7 @@ pvc_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
+ static void
+ xelpg_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
+ {
+-      /* Wa_14018778641 / Wa_18018781329 */
++      /* Wa_14018575942 / Wa_18018781329 */
+       wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB);
+       /* Wa_22016670082 */
+@@ -1710,7 +1715,7 @@ xelpmp_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
+  */
+ static void gt_tuning_settings(struct intel_gt *gt, struct i915_wa_list *wal)
+ {
+-      if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 71))) {
++      if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 74))) {
+               wa_mcr_write_or(wal, XEHP_L3SCQREG7, BLEND_FILL_CACHING_OPT_DIS);
+               wa_mcr_write_or(wal, XEHP_SQCM, EN_32B_ACCESS);
+       }
+@@ -1743,7 +1748,7 @@ gt_init_workarounds(struct intel_gt *gt, struct i915_wa_list *wal)
+               return;
+       }
+-      if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 71)))
++      if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 74)))
+               xelpg_gt_workarounds_init(gt, wal);
+       else if (IS_PONTEVECCHIO(i915))
+               pvc_gt_workarounds_init(gt, wal);
+@@ -2216,7 +2221,7 @@ void intel_engine_init_whitelist(struct intel_engine_cs *engine)
+       if (engine->gt->type == GT_MEDIA)
+               ; /* none yet */
+-      else if (IS_GFX_GT_IP_RANGE(engine->gt, IP_VER(12, 70), IP_VER(12, 71)))
++      else if (IS_GFX_GT_IP_RANGE(engine->gt, IP_VER(12, 70), IP_VER(12, 74)))
+               xelpg_whitelist_build(engine);
+       else if (IS_PONTEVECCHIO(i915))
+               pvc_whitelist_build(engine);
+@@ -2828,7 +2833,7 @@ add_render_compute_tuning_settings(struct intel_gt *gt,
+ {
+       struct drm_i915_private *i915 = gt->i915;
+-      if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 71)) || IS_DG2(i915))
++      if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 74)) || IS_DG2(i915))
+               wa_mcr_write_clr_set(wal, RT_CTRL, STACKID_CTRL, STACKID_CTRL_512);
+       /*
+@@ -2881,7 +2886,8 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li
+       }
+       if (IS_GFX_GT_IP_STEP(gt, IP_VER(12, 70), STEP_B0, STEP_FOREVER) ||
+-          IS_GFX_GT_IP_STEP(gt, IP_VER(12, 71), STEP_B0, STEP_FOREVER))
++          IS_GFX_GT_IP_STEP(gt, IP_VER(12, 71), STEP_B0, STEP_FOREVER) ||
++          IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 74), IP_VER(12, 74)))
+               /* Wa_14017856879 */
+               wa_mcr_masked_en(wal, GEN9_ROW_CHICKEN3, MTL_DISABLE_FIX_FOR_EOT_FLUSH);
+diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c
+index 2d695818f0062..bd9d812b1afa7 100644
+--- a/drivers/gpu/drm/i915/i915_perf.c
++++ b/drivers/gpu/drm/i915/i915_perf.c
+@@ -3225,7 +3225,7 @@ u32 i915_perf_oa_timestamp_frequency(struct drm_i915_private *i915)
+       struct intel_gt *gt = to_gt(i915);
+       /* Wa_18013179988 */
+-      if (IS_DG2(i915) || IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 71))) {
++      if (IS_DG2(i915) || IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 74))) {
+               intel_wakeref_t wakeref;
+               u32 reg, shift;
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-rockchip-vop2-remove-ar30-and-ab30-format-suppor.patch b/queue-6.8/drm-rockchip-vop2-remove-ar30-and-ab30-format-suppor.patch
new file mode 100644 (file)
index 0000000..9bcd565
--- /dev/null
@@ -0,0 +1,40 @@
+From b545824122a55d951b60d016197b850ff9dee051 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Mar 2024 18:09:52 +0800
+Subject: drm/rockchip: vop2: Remove AR30 and AB30 format support
+
+From: Andy Yan <andy.yan@rock-chips.com>
+
+[ Upstream commit 905f7d53a1bc105b22d9ffd03dc11b6b42ec6ba6 ]
+
+The Alpha blending for 30 bit RGB/BGR are not
+functioning properly for rk3568/rk3588, so remove
+it from the format list.
+
+Fixes: bfd8a5c228fa ("drm/rockchip: vop2: Add more supported 10bit formats")
+Signed-off-by: Andy Yan <andy.yan@rock-chips.com>
+Acked-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240304100952.3592984-1-andyshrk@163.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_vop2_reg.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_vop2_reg.c b/drivers/gpu/drm/rockchip/rockchip_vop2_reg.c
+index 48170694ac6b8..18efb3fe1c000 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_vop2_reg.c
++++ b/drivers/gpu/drm/rockchip/rockchip_vop2_reg.c
+@@ -17,9 +17,7 @@
+ static const uint32_t formats_cluster[] = {
+       DRM_FORMAT_XRGB2101010,
+-      DRM_FORMAT_ARGB2101010,
+       DRM_FORMAT_XBGR2101010,
+-      DRM_FORMAT_ABGR2101010,
+       DRM_FORMAT_XRGB8888,
+       DRM_FORMAT_ARGB8888,
+       DRM_FORMAT_XBGR8888,
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-xe-add-exec_queue.sched_props.job_timeout_ms.patch b/queue-6.8/drm-xe-add-exec_queue.sched_props.job_timeout_ms.patch
new file mode 100644 (file)
index 0000000..1ef1c5f
--- /dev/null
@@ -0,0 +1,71 @@
+From f7bf7d8afe2edc81ecde6e234ad4d378f045f6fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jan 2024 09:32:50 -0800
+Subject: drm/xe: Add exec_queue.sched_props.job_timeout_ms
+
+From: Brian Welty <brian.welty@intel.com>
+
+[ Upstream commit 6ae24344e2e3e12e06f7b382af4bba2fd417b2ff ]
+
+The purpose here is to allow to optimize exec_queue_set_job_timeout()
+in follow-on patch.  Currently it does q->ops->set_job_timeout(...).
+But we'd like to apply exec_queue_user_extensions much earlier and
+q->ops cannot be called before __xe_exec_queue_init().
+
+It will be much more efficient to instead only have to set
+q->sched_props.job_timeout_ms when applying user extensions. That value
+will then be used during q->ops->init().
+
+Signed-off-by: Brian Welty <brian.welty@intel.com>
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Stable-dep-of: 9c1256369c10 ("drm/xe/guc_submit: use jiffies for job timeout")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_exec_queue.c       | 2 ++
+ drivers/gpu/drm/xe/xe_exec_queue_types.h | 2 ++
+ drivers/gpu/drm/xe/xe_guc_submit.c       | 2 +-
+ 3 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_exec_queue.c b/drivers/gpu/drm/xe/xe_exec_queue.c
+index 49223026c89fd..a176d9ad6d1b8 100644
+--- a/drivers/gpu/drm/xe/xe_exec_queue.c
++++ b/drivers/gpu/drm/xe/xe_exec_queue.c
+@@ -66,6 +66,8 @@ static struct xe_exec_queue *__xe_exec_queue_create(struct xe_device *xe,
+       q->sched_props.timeslice_us = hwe->eclass->sched_props.timeslice_us;
+       q->sched_props.preempt_timeout_us =
+                               hwe->eclass->sched_props.preempt_timeout_us;
++      q->sched_props.job_timeout_ms =
++                              hwe->eclass->sched_props.job_timeout_ms;
+       if (q->flags & EXEC_QUEUE_FLAG_KERNEL &&
+           q->flags & EXEC_QUEUE_FLAG_HIGH_PRIORITY)
+               q->sched_props.priority = XE_EXEC_QUEUE_PRIORITY_KERNEL;
+diff --git a/drivers/gpu/drm/xe/xe_exec_queue_types.h b/drivers/gpu/drm/xe/xe_exec_queue_types.h
+index 36f4901d8d7ee..747106584f752 100644
+--- a/drivers/gpu/drm/xe/xe_exec_queue_types.h
++++ b/drivers/gpu/drm/xe/xe_exec_queue_types.h
+@@ -132,6 +132,8 @@ struct xe_exec_queue {
+               u32 timeslice_us;
+               /** @preempt_timeout_us: preemption timeout in micro-seconds */
+               u32 preempt_timeout_us;
++              /** @job_timeout_ms: job timeout in milliseconds */
++              u32 job_timeout_ms;
+               /** @priority: priority of this exec queue */
+               enum xe_exec_queue_priority priority;
+       } sched_props;
+diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
+index f22ae717b0b2d..9d5e3afef5057 100644
+--- a/drivers/gpu/drm/xe/xe_guc_submit.c
++++ b/drivers/gpu/drm/xe/xe_guc_submit.c
+@@ -1216,7 +1216,7 @@ static int guc_exec_queue_init(struct xe_exec_queue *q)
+       init_waitqueue_head(&ge->suspend_wait);
+       timeout = (q->vm && xe_vm_in_lr_mode(q->vm)) ? MAX_SCHEDULE_TIMEOUT :
+-                q->hwe->eclass->sched_props.job_timeout_ms;
++                q->sched_props.job_timeout_ms;
+       err = xe_sched_init(&ge->sched, &drm_sched_ops, &xe_sched_ops,
+                           get_submit_wq(guc),
+                           q->lrc[0].ring.size / MAX_JOB_SIZE_BYTES, 64,
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-xe-device-fix-xe_max_gt_per_tile-check.patch b/queue-6.8/drm-xe-device-fix-xe_max_gt_per_tile-check.patch
new file mode 100644 (file)
index 0000000..e170c6c
--- /dev/null
@@ -0,0 +1,40 @@
+From 430d33b31c2a4e274f4f4f1e7289124d7ccc66eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Mar 2024 18:05:34 +0000
+Subject: drm/xe/device: fix XE_MAX_GT_PER_TILE check
+
+From: Matthew Auld <matthew.auld@intel.com>
+
+[ Upstream commit 23e1ee3a2317f41f47d4f7255257431c5f8d1c2c ]
+
+Here XE_MAX_GT_PER_TILE is the total, therefore the gt index should
+always be less than.
+
+Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
+Signed-off-by: Matthew Auld <matthew.auld@intel.com>
+Cc: Nirmoy Das <nirmoy.das@intel.com>
+Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240318180532.57522-5-matthew.auld@intel.com
+(cherry picked from commit a5ef563b1d676548a4c5016540833ff970230964)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_device.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_device.h b/drivers/gpu/drm/xe/xe_device.h
+index 08d8b72c77319..ee8be4c6b59b1 100644
+--- a/drivers/gpu/drm/xe/xe_device.h
++++ b/drivers/gpu/drm/xe/xe_device.h
+@@ -58,7 +58,7 @@ static inline struct xe_tile *xe_device_get_root_tile(struct xe_device *xe)
+ static inline struct xe_gt *xe_tile_get_gt(struct xe_tile *tile, u8 gt_id)
+ {
+-      if (drm_WARN_ON(&tile_to_xe(tile)->drm, gt_id > XE_MAX_GT_PER_TILE))
++      if (drm_WARN_ON(&tile_to_xe(tile)->drm, gt_id >= XE_MAX_GT_PER_TILE))
+               gt_id = 0;
+       return gt_id ? tile->media_gt : tile->primary_gt;
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-xe-device-fix-xe_max_tiles_per_device-check.patch b/queue-6.8/drm-xe-device-fix-xe_max_tiles_per_device-check.patch
new file mode 100644 (file)
index 0000000..1f87dbb
--- /dev/null
@@ -0,0 +1,45 @@
+From 9e79a87326146e35411264167ec24a3489b26dc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Mar 2024 18:05:35 +0000
+Subject: drm/xe/device: fix XE_MAX_TILES_PER_DEVICE check
+
+From: Matthew Auld <matthew.auld@intel.com>
+
+[ Upstream commit b45f20fa69cedb6038fdaec31bd600c273c865a5 ]
+
+Here XE_MAX_TILES_PER_DEVICE is the gt array size, therefore the gt
+index should always be less than.
+
+v2 (Lucas):
+  - Add fixes tag.
+
+Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
+Signed-off-by: Matthew Auld <matthew.auld@intel.com>
+Cc: Nirmoy Das <nirmoy.das@intel.com>
+Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
+Acked-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240318180532.57522-6-matthew.auld@intel.com
+(cherry picked from commit a96cd71ec7be0790f9fc4039ad21be8d214b03a4)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_device.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_device.h b/drivers/gpu/drm/xe/xe_device.h
+index ee8be4c6b59b1..bf8efb44edf60 100644
+--- a/drivers/gpu/drm/xe/xe_device.h
++++ b/drivers/gpu/drm/xe/xe_device.h
+@@ -79,7 +79,7 @@ static inline struct xe_gt *xe_device_get_gt(struct xe_device *xe, u8 gt_id)
+       if (MEDIA_VER(xe) >= 13) {
+               gt = xe_tile_get_gt(root_tile, gt_id);
+       } else {
+-              if (drm_WARN_ON(&xe->drm, gt_id > XE_MAX_TILES_PER_DEVICE))
++              if (drm_WARN_ON(&xe->drm, gt_id >= XE_MAX_TILES_PER_DEVICE))
+                       gt_id = 0;
+               gt = xe->tiles[gt_id].primary_gt;
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-xe-guc_submit-use-jiffies-for-job-timeout.patch b/queue-6.8/drm-xe-guc_submit-use-jiffies-for-job-timeout.patch
new file mode 100644 (file)
index 0000000..f065ec8
--- /dev/null
@@ -0,0 +1,42 @@
+From 1e11059d1cad4a6f6634e3f3c91ba49fd3f4b863 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Mar 2024 12:15:55 +0000
+Subject: drm/xe/guc_submit: use jiffies for job timeout
+
+From: Matthew Auld <matthew.auld@intel.com>
+
+[ Upstream commit 9c1256369c10e31b5ce6575e4ea27fe2c375fd94 ]
+
+drm_sched_init() expects jiffies for the timeout, but here we are
+passing the timeout in ms. Convert to jiffies instead.
+
+Fixes: eef55700f302 ("drm/xe: Add sysfs for default engine scheduler properties")
+Signed-off-by: Matthew Auld <matthew.auld@intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240314121554.223229-2-matthew.auld@intel.com
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+(cherry picked from commit 2c5b70f74d61438a071a19370e63c234d2bd8938)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_guc_submit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
+index 9d5e3afef5057..bd1079aa88498 100644
+--- a/drivers/gpu/drm/xe/xe_guc_submit.c
++++ b/drivers/gpu/drm/xe/xe_guc_submit.c
+@@ -1216,7 +1216,7 @@ static int guc_exec_queue_init(struct xe_exec_queue *q)
+       init_waitqueue_head(&ge->suspend_wait);
+       timeout = (q->vm && xe_vm_in_lr_mode(q->vm)) ? MAX_SCHEDULE_TIMEOUT :
+-                q->sched_props.job_timeout_ms;
++                msecs_to_jiffies(q->sched_props.job_timeout_ms);
+       err = xe_sched_init(&ge->sched, &drm_sched_ops, &xe_sched_ops,
+                           get_submit_wq(guc),
+                           q->lrc[0].ring.size / MAX_JOB_SIZE_BYTES, 64,
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-xe-queue-fix-engine_class-bounds-check.patch b/queue-6.8/drm-xe-queue-fix-engine_class-bounds-check.patch
new file mode 100644 (file)
index 0000000..c1b9a92
--- /dev/null
@@ -0,0 +1,40 @@
+From 832753c0d949f9c9ba968eb87da4091408290b51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Mar 2024 18:05:33 +0000
+Subject: drm/xe/queue: fix engine_class bounds check
+
+From: Matthew Auld <matthew.auld@intel.com>
+
+[ Upstream commit b7dce525c4fcc92b373136288309f8c9ca6c375f ]
+
+The engine_class is the index into the user_to_xe_engine_class,
+therefore it needs to be less than.
+
+Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
+Signed-off-by: Matthew Auld <matthew.auld@intel.com>
+Cc: Nirmoy Das <nirmoy.das@intel.com>
+Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240318180532.57522-4-matthew.auld@intel.com
+(cherry picked from commit fe87b7dfcb204a161d1e38b0e787b2f5ab520f32)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_exec_queue.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_exec_queue.c b/drivers/gpu/drm/xe/xe_exec_queue.c
+index a176d9ad6d1b8..5093c56d60ab6 100644
+--- a/drivers/gpu/drm/xe/xe_exec_queue.c
++++ b/drivers/gpu/drm/xe/xe_exec_queue.c
+@@ -405,7 +405,7 @@ find_hw_engine(struct xe_device *xe,
+ {
+       u32 idx;
+-      if (eci.engine_class > ARRAY_SIZE(user_to_xe_engine_class))
++      if (eci.engine_class >= ARRAY_SIZE(user_to_xe_engine_class))
+               return NULL;
+       if (eci.gt_id >= xe->info.gt_count)
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-xe-remove-unused-xe_bo-props-struct.patch b/queue-6.8/drm-xe-remove-unused-xe_bo-props-struct.patch
new file mode 100644 (file)
index 0000000..ea902a4
--- /dev/null
@@ -0,0 +1,178 @@
+From 4a90254a0ea153834e2e61cd8c2e47637201d689 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Mar 2024 16:11:59 +0100
+Subject: drm/xe: Remove unused xe_bo->props struct
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nirmoy Das <nirmoy.das@intel.com>
+
+[ Upstream commit fd00fe8cdbb241644131ece133a2eb1c3951f21e ]
+
+Property struct is not being used so remove it and related dead code.
+
+Fixes: ddfa2d6a846a ("drm/xe/uapi: Kill VM_MADVISE IOCTL")
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Cc: intel-xe@lists.freedesktop.org
+Signed-off-by: Nirmoy Das <nirmoy.das@intel.com>
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240311151159.10036-1-nirmoy.das@intel.com
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+(cherry picked from commit 002d8f0b4f76aabbf8e00c538a124b91625d7260)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_bo.c       | 59 +++++---------------------------
+ drivers/gpu/drm/xe/xe_bo_types.h | 19 ----------
+ 2 files changed, 9 insertions(+), 69 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
+index 4d3b80ec906d0..eb2c44a328278 100644
+--- a/drivers/gpu/drm/xe/xe_bo.c
++++ b/drivers/gpu/drm/xe/xe_bo.c
+@@ -140,9 +140,6 @@ static void try_add_system(struct xe_device *xe, struct xe_bo *bo,
+                       .mem_type = XE_PL_TT,
+               };
+               *c += 1;
+-
+-              if (bo->props.preferred_mem_type == XE_BO_PROPS_INVALID)
+-                      bo->props.preferred_mem_type = XE_PL_TT;
+       }
+ }
+@@ -177,25 +174,15 @@ static void add_vram(struct xe_device *xe, struct xe_bo *bo,
+       }
+       places[*c] = place;
+       *c += 1;
+-
+-      if (bo->props.preferred_mem_type == XE_BO_PROPS_INVALID)
+-              bo->props.preferred_mem_type = mem_type;
+ }
+ static void try_add_vram(struct xe_device *xe, struct xe_bo *bo,
+                        u32 bo_flags, u32 *c)
+ {
+-      if (bo->props.preferred_gt == XE_GT1) {
+-              if (bo_flags & XE_BO_CREATE_VRAM1_BIT)
+-                      add_vram(xe, bo, bo->placements, bo_flags, XE_PL_VRAM1, c);
+-              if (bo_flags & XE_BO_CREATE_VRAM0_BIT)
+-                      add_vram(xe, bo, bo->placements, bo_flags, XE_PL_VRAM0, c);
+-      } else {
+-              if (bo_flags & XE_BO_CREATE_VRAM0_BIT)
+-                      add_vram(xe, bo, bo->placements, bo_flags, XE_PL_VRAM0, c);
+-              if (bo_flags & XE_BO_CREATE_VRAM1_BIT)
+-                      add_vram(xe, bo, bo->placements, bo_flags, XE_PL_VRAM1, c);
+-      }
++      if (bo_flags & XE_BO_CREATE_VRAM0_BIT)
++              add_vram(xe, bo, bo->placements, bo_flags, XE_PL_VRAM0, c);
++      if (bo_flags & XE_BO_CREATE_VRAM1_BIT)
++              add_vram(xe, bo, bo->placements, bo_flags, XE_PL_VRAM1, c);
+ }
+ static void try_add_stolen(struct xe_device *xe, struct xe_bo *bo,
+@@ -219,17 +206,8 @@ static int __xe_bo_placement_for_flags(struct xe_device *xe, struct xe_bo *bo,
+ {
+       u32 c = 0;
+-      bo->props.preferred_mem_type = XE_BO_PROPS_INVALID;
+-
+-      /* The order of placements should indicate preferred location */
+-
+-      if (bo->props.preferred_mem_class == DRM_XE_MEM_REGION_CLASS_SYSMEM) {
+-              try_add_system(xe, bo, bo_flags, &c);
+-              try_add_vram(xe, bo, bo_flags, &c);
+-      } else {
+-              try_add_vram(xe, bo, bo_flags, &c);
+-              try_add_system(xe, bo, bo_flags, &c);
+-      }
++      try_add_vram(xe, bo, bo_flags, &c);
++      try_add_system(xe, bo, bo_flags, &c);
+       try_add_stolen(xe, bo, bo_flags, &c);
+       if (!c)
+@@ -1106,19 +1084,12 @@ static void xe_gem_object_close(struct drm_gem_object *obj,
+       }
+ }
+-static bool should_migrate_to_system(struct xe_bo *bo)
+-{
+-      struct xe_device *xe = xe_bo_device(bo);
+-
+-      return xe_device_in_fault_mode(xe) && bo->props.cpu_atomic;
+-}
+-
+ static vm_fault_t xe_gem_fault(struct vm_fault *vmf)
+ {
+       struct ttm_buffer_object *tbo = vmf->vma->vm_private_data;
+       struct drm_device *ddev = tbo->base.dev;
+       vm_fault_t ret;
+-      int idx, r = 0;
++      int idx;
+       ret = ttm_bo_vm_reserve(tbo, vmf);
+       if (ret)
+@@ -1129,17 +1100,8 @@ static vm_fault_t xe_gem_fault(struct vm_fault *vmf)
+               trace_xe_bo_cpu_fault(bo);
+-              if (should_migrate_to_system(bo)) {
+-                      r = xe_bo_migrate(bo, XE_PL_TT);
+-                      if (r == -EBUSY || r == -ERESTARTSYS || r == -EINTR)
+-                              ret = VM_FAULT_NOPAGE;
+-                      else if (r)
+-                              ret = VM_FAULT_SIGBUS;
+-              }
+-              if (!ret)
+-                      ret = ttm_bo_vm_fault_reserved(vmf,
+-                                                     vmf->vma->vm_page_prot,
+-                                                     TTM_BO_VM_NUM_PREFAULT);
++              ret = ttm_bo_vm_fault_reserved(vmf, vmf->vma->vm_page_prot,
++                                             TTM_BO_VM_NUM_PREFAULT);
+               drm_dev_exit(idx);
+       } else {
+               ret = ttm_bo_vm_dummy_page(vmf, vmf->vma->vm_page_prot);
+@@ -1253,9 +1215,6 @@ struct xe_bo *___xe_bo_create_locked(struct xe_device *xe, struct xe_bo *bo,
+       bo->flags = flags;
+       bo->cpu_caching = cpu_caching;
+       bo->ttm.base.funcs = &xe_gem_object_funcs;
+-      bo->props.preferred_mem_class = XE_BO_PROPS_INVALID;
+-      bo->props.preferred_gt = XE_BO_PROPS_INVALID;
+-      bo->props.preferred_mem_type = XE_BO_PROPS_INVALID;
+       bo->ttm.priority = XE_BO_PRIORITY_NORMAL;
+       INIT_LIST_HEAD(&bo->pinned_link);
+ #ifdef CONFIG_PROC_FS
+diff --git a/drivers/gpu/drm/xe/xe_bo_types.h b/drivers/gpu/drm/xe/xe_bo_types.h
+index 64c2249a4e407..81dca15315d5c 100644
+--- a/drivers/gpu/drm/xe/xe_bo_types.h
++++ b/drivers/gpu/drm/xe/xe_bo_types.h
+@@ -56,25 +56,6 @@ struct xe_bo {
+        */
+       struct list_head client_link;
+ #endif
+-      /** @props: BO user controlled properties */
+-      struct {
+-              /** @preferred_mem: preferred memory class for this BO */
+-              s16 preferred_mem_class;
+-              /** @prefered_gt: preferred GT for this BO */
+-              s16 preferred_gt;
+-              /** @preferred_mem_type: preferred memory type */
+-              s32 preferred_mem_type;
+-              /**
+-               * @cpu_atomic: the CPU expects to do atomics operations to
+-               * this BO
+-               */
+-              bool cpu_atomic;
+-              /**
+-               * @device_atomic: the device expects to do atomics operations
+-               * to this BO
+-               */
+-              bool device_atomic;
+-      } props;
+       /** @freed: List node for delayed put. */
+       struct llist_node freed;
+       /** @created: Whether the bo has passed initial creation */
+-- 
+2.43.0
+
diff --git a/queue-6.8/gpio-protect-the-list-of-gpio-devices-with-srcu.patch b/queue-6.8/gpio-protect-the-list-of-gpio-devices-with-srcu.patch
new file mode 100644 (file)
index 0000000..16a85d4
--- /dev/null
@@ -0,0 +1,489 @@
+From 077106f97c7d113ebacb00725d83b817d0e89288 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jan 2024 16:43:13 +0100
+Subject: gpio: protect the list of GPIO devices with SRCU
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit e348544f7994d252427ed3ae637c7081cbb90f66 ]
+
+We're working towards removing the "multi-function" GPIO spinlock that's
+implemented terribly wrong. We tried using an RW-semaphore to protect
+the list of GPIO devices but it turned out that we still have old code
+using legacy GPIO calls that need to translate the global GPIO number to
+the address of the associated descriptor and - to that end - traverse
+the list while holding the lock. If we change the spinlock to a sleeping
+lock then we'll end up with "scheduling while atomic" bugs.
+
+Let's allow lockless traversal of the list using SRCU and only use the
+mutex when modyfing the list.
+
+While at it: let's protect the period between when we start the lookup
+and when we finally request the descriptor (increasing the reference
+count of the GPIO device) with the SRCU read lock.
+
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Stable-dep-of: 5c887b65bbd1 ("gpiolib: Fix debug messaging in gpiod_find_and_request()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib.c | 247 ++++++++++++++++++++++-------------------
+ 1 file changed, 135 insertions(+), 112 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 3ad09d2193330..a6f1a4e2e3a4e 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -2,6 +2,7 @@
+ #include <linux/acpi.h>
+ #include <linux/bitmap.h>
++#include <linux/cleanup.h>
+ #include <linux/compat.h>
+ #include <linux/debugfs.h>
+ #include <linux/device.h>
+@@ -14,12 +15,14 @@
+ #include <linux/irq.h>
+ #include <linux/kernel.h>
+ #include <linux/list.h>
++#include <linux/lockdep.h>
+ #include <linux/module.h>
+ #include <linux/of.h>
+ #include <linux/pinctrl/consumer.h>
+ #include <linux/seq_file.h>
+ #include <linux/slab.h>
+ #include <linux/spinlock.h>
++#include <linux/srcu.h>
+ #include <linux/string.h>
+ #include <linux/gpio.h>
+@@ -81,7 +84,12 @@ DEFINE_SPINLOCK(gpio_lock);
+ static DEFINE_MUTEX(gpio_lookup_lock);
+ static LIST_HEAD(gpio_lookup_list);
++
+ LIST_HEAD(gpio_devices);
++/* Protects the GPIO device list against concurrent modifications. */
++static DEFINE_MUTEX(gpio_devices_lock);
++/* Ensures coherence during read-only accesses to the list of GPIO devices. */
++DEFINE_STATIC_SRCU(gpio_devices_srcu);
+ static DEFINE_MUTEX(gpio_machine_hogs_mutex);
+ static LIST_HEAD(gpio_machine_hogs);
+@@ -113,20 +121,16 @@ static inline void desc_set_label(struct gpio_desc *d, const char *label)
+ struct gpio_desc *gpio_to_desc(unsigned gpio)
+ {
+       struct gpio_device *gdev;
+-      unsigned long flags;
+-
+-      spin_lock_irqsave(&gpio_lock, flags);
+-      list_for_each_entry(gdev, &gpio_devices, list) {
+-              if (gdev->base <= gpio &&
+-                  gdev->base + gdev->ngpio > gpio) {
+-                      spin_unlock_irqrestore(&gpio_lock, flags);
+-                      return &gdev->descs[gpio - gdev->base];
++      scoped_guard(srcu, &gpio_devices_srcu) {
++              list_for_each_entry_srcu(gdev, &gpio_devices, list,
++                              srcu_read_lock_held(&gpio_devices_srcu)) {
++                      if (gdev->base <= gpio &&
++                          gdev->base + gdev->ngpio > gpio)
++                              return &gdev->descs[gpio - gdev->base];
+               }
+       }
+-      spin_unlock_irqrestore(&gpio_lock, flags);
+-
+       if (!gpio_is_valid(gpio))
+               pr_warn("invalid GPIO %d\n", gpio);
+@@ -282,7 +286,8 @@ static int gpiochip_find_base_unlocked(int ngpio)
+       struct gpio_device *gdev;
+       int base = GPIO_DYNAMIC_BASE;
+-      list_for_each_entry(gdev, &gpio_devices, list) {
++      list_for_each_entry_srcu(gdev, &gpio_devices, list,
++                               lockdep_is_held(&gpio_devices_lock)) {
+               /* found a free space? */
+               if (gdev->base >= base + ngpio)
+                       break;
+@@ -354,23 +359,25 @@ static int gpiodev_add_to_list_unlocked(struct gpio_device *gdev)
+ {
+       struct gpio_device *prev, *next;
++      lockdep_assert_held(&gpio_devices_lock);
++
+       if (list_empty(&gpio_devices)) {
+               /* initial entry in list */
+-              list_add_tail(&gdev->list, &gpio_devices);
++              list_add_tail_rcu(&gdev->list, &gpio_devices);
+               return 0;
+       }
+       next = list_first_entry(&gpio_devices, struct gpio_device, list);
+       if (gdev->base + gdev->ngpio <= next->base) {
+               /* add before first entry */
+-              list_add(&gdev->list, &gpio_devices);
++              list_add_rcu(&gdev->list, &gpio_devices);
+               return 0;
+       }
+       prev = list_last_entry(&gpio_devices, struct gpio_device, list);
+       if (prev->base + prev->ngpio <= gdev->base) {
+               /* add behind last entry */
+-              list_add_tail(&gdev->list, &gpio_devices);
++              list_add_tail_rcu(&gdev->list, &gpio_devices);
+               return 0;
+       }
+@@ -382,11 +389,13 @@ static int gpiodev_add_to_list_unlocked(struct gpio_device *gdev)
+               /* add between prev and next */
+               if (prev->base + prev->ngpio <= gdev->base
+                               && gdev->base + gdev->ngpio <= next->base) {
+-                      list_add(&gdev->list, &prev->list);
++                      list_add_rcu(&gdev->list, &prev->list);
+                       return 0;
+               }
+       }
++      synchronize_srcu(&gpio_devices_srcu);
++
+       return -EBUSY;
+ }
+@@ -399,26 +408,21 @@ static int gpiodev_add_to_list_unlocked(struct gpio_device *gdev)
+ static struct gpio_desc *gpio_name_to_desc(const char * const name)
+ {
+       struct gpio_device *gdev;
+-      unsigned long flags;
++      struct gpio_desc *desc;
+       if (!name)
+               return NULL;
+-      spin_lock_irqsave(&gpio_lock, flags);
+-
+-      list_for_each_entry(gdev, &gpio_devices, list) {
+-              struct gpio_desc *desc;
++      guard(srcu)(&gpio_devices_srcu);
++      list_for_each_entry_srcu(gdev, &gpio_devices, list,
++                               srcu_read_lock_held(&gpio_devices_srcu)) {
+               for_each_gpio_desc(gdev->chip, desc) {
+-                      if (desc->name && !strcmp(desc->name, name)) {
+-                              spin_unlock_irqrestore(&gpio_lock, flags);
++                      if (desc->name && !strcmp(desc->name, name))
+                               return desc;
+-                      }
+               }
+       }
+-      spin_unlock_irqrestore(&gpio_lock, flags);
+-
+       return NULL;
+ }
+@@ -748,7 +752,10 @@ static void gpiochip_setup_devs(void)
+       struct gpio_device *gdev;
+       int ret;
+-      list_for_each_entry(gdev, &gpio_devices, list) {
++      guard(srcu)(&gpio_devices_srcu);
++
++      list_for_each_entry_srcu(gdev, &gpio_devices, list,
++                               srcu_read_lock_held(&gpio_devices_srcu)) {
+               ret = gpiochip_setup_dev(gdev);
+               if (ret)
+                       dev_err(&gdev->dev,
+@@ -813,7 +820,6 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data,
+                              struct lock_class_key *request_key)
+ {
+       struct gpio_device *gdev;
+-      unsigned long flags;
+       unsigned int i;
+       int base = 0;
+       int ret = 0;
+@@ -878,49 +884,47 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data,
+       gdev->ngpio = gc->ngpio;
+-      spin_lock_irqsave(&gpio_lock, flags);
+-
+-      /*
+-       * TODO: this allocates a Linux GPIO number base in the global
+-       * GPIO numberspace for this chip. In the long run we want to
+-       * get *rid* of this numberspace and use only descriptors, but
+-       * it may be a pipe dream. It will not happen before we get rid
+-       * of the sysfs interface anyways.
+-       */
+-      base = gc->base;
+-      if (base < 0) {
+-              base = gpiochip_find_base_unlocked(gc->ngpio);
+-              if (base < 0) {
+-                      spin_unlock_irqrestore(&gpio_lock, flags);
+-                      ret = base;
+-                      base = 0;
+-                      goto err_free_label;
+-              }
++      scoped_guard(mutex, &gpio_devices_lock) {
+               /*
+-               * TODO: it should not be necessary to reflect the assigned
+-               * base outside of the GPIO subsystem. Go over drivers and
+-               * see if anyone makes use of this, else drop this and assign
+-               * a poison instead.
++               * TODO: this allocates a Linux GPIO number base in the global
++               * GPIO numberspace for this chip. In the long run we want to
++               * get *rid* of this numberspace and use only descriptors, but
++               * it may be a pipe dream. It will not happen before we get rid
++               * of the sysfs interface anyways.
+                */
+-              gc->base = base;
+-      } else {
+-              dev_warn(&gdev->dev,
+-                       "Static allocation of GPIO base is deprecated, use dynamic allocation.\n");
+-      }
+-      gdev->base = base;
++              base = gc->base;
++              if (base < 0) {
++                      base = gpiochip_find_base_unlocked(gc->ngpio);
++                      if (base < 0) {
++                              ret = base;
++                              base = 0;
++                              goto err_free_label;
++                      }
+-      ret = gpiodev_add_to_list_unlocked(gdev);
+-      if (ret) {
+-              spin_unlock_irqrestore(&gpio_lock, flags);
+-              chip_err(gc, "GPIO integer space overlap, cannot add chip\n");
+-              goto err_free_label;
++                      /*
++                       * TODO: it should not be necessary to reflect the
++                       * assigned base outside of the GPIO subsystem. Go over
++                       * drivers and see if anyone makes use of this, else
++                       * drop this and assign a poison instead.
++                       */
++                      gc->base = base;
++              } else {
++                      dev_warn(&gdev->dev,
++                               "Static allocation of GPIO base is deprecated, use dynamic allocation.\n");
++              }
++
++              gdev->base = base;
++
++              ret = gpiodev_add_to_list_unlocked(gdev);
++              if (ret) {
++                      chip_err(gc, "GPIO integer space overlap, cannot add chip\n");
++                      goto err_free_label;
++              }
+       }
+       for (i = 0; i < gc->ngpio; i++)
+               gdev->descs[i].gdev = gdev;
+-      spin_unlock_irqrestore(&gpio_lock, flags);
+-
+       BLOCKING_INIT_NOTIFIER_HEAD(&gdev->line_state_notifier);
+       BLOCKING_INIT_NOTIFIER_HEAD(&gdev->device_notifier);
+       init_rwsem(&gdev->sem);
+@@ -1006,9 +1010,9 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data,
+ err_free_gpiochip_mask:
+       gpiochip_free_valid_mask(gc);
+ err_remove_from_list:
+-      spin_lock_irqsave(&gpio_lock, flags);
+-      list_del(&gdev->list);
+-      spin_unlock_irqrestore(&gpio_lock, flags);
++      scoped_guard(mutex, &gpio_devices_lock)
++              list_del_rcu(&gdev->list);
++      synchronize_srcu(&gpio_devices_srcu);
+       if (gdev->dev.release) {
+               /* release() has been registered by gpiochip_setup_dev() */
+               gpio_device_put(gdev);
+@@ -1052,6 +1056,11 @@ void gpiochip_remove(struct gpio_chip *gc)
+       /* FIXME: should the legacy sysfs handling be moved to gpio_device? */
+       gpiochip_sysfs_unregister(gdev);
+       gpiochip_free_hogs(gc);
++
++      scoped_guard(mutex, &gpio_devices_lock)
++              list_del_rcu(&gdev->list);
++      synchronize_srcu(&gpio_devices_srcu);
++
+       /* Numb the device, cancelling all outstanding operations */
+       gdev->chip = NULL;
+       gpiochip_irqchip_remove(gc);
+@@ -1076,9 +1085,6 @@ void gpiochip_remove(struct gpio_chip *gc)
+               dev_crit(&gdev->dev,
+                        "REMOVING GPIOCHIP WITH GPIOS STILL REQUESTED\n");
+-      scoped_guard(spinlock_irqsave, &gpio_lock)
+-              list_del(&gdev->list);
+-
+       /*
+        * The gpiochip side puts its use of the device to rest here:
+        * if there are no userspace clients, the chardev and device will
+@@ -1125,7 +1131,7 @@ struct gpio_device *gpio_device_find(void *data,
+        */
+       might_sleep();
+-      guard(spinlock_irqsave)(&gpio_lock);
++      guard(srcu)(&gpio_devices_srcu);
+       list_for_each_entry(gdev, &gpio_devices, list) {
+               if (gdev->chip && match(gdev->chip, data))
+@@ -4147,30 +4153,39 @@ struct gpio_desc *gpiod_find_and_request(struct device *consumer,
+                                        bool platform_lookup_allowed)
+ {
+       unsigned long lookupflags = GPIO_LOOKUP_FLAGS_DEFAULT;
+-      struct gpio_desc *desc;
+-      int ret;
++      /*
++       * scoped_guard() is implemented as a for loop, meaning static
++       * analyzers will complain about these two not being initialized.
++       */
++      struct gpio_desc *desc = NULL;
++      int ret = 0;
++
++      scoped_guard(srcu, &gpio_devices_srcu) {
++              desc = gpiod_find_by_fwnode(fwnode, consumer, con_id, idx,
++                                          &flags, &lookupflags);
++              if (gpiod_not_found(desc) && platform_lookup_allowed) {
++                      /*
++                       * Either we are not using DT or ACPI, or their lookup
++                       * did not return a result. In that case, use platform
++                       * lookup as a fallback.
++                       */
++                      dev_dbg(consumer,
++                              "using lookup tables for GPIO lookup\n");
++                      desc = gpiod_find(consumer, con_id, idx, &lookupflags);
++              }
++
++              if (IS_ERR(desc)) {
++                      dev_dbg(consumer, "No GPIO consumer %s found\n",
++                              con_id);
++                      return desc;
++              }
+-      desc = gpiod_find_by_fwnode(fwnode, consumer, con_id, idx, &flags, &lookupflags);
+-      if (gpiod_not_found(desc) && platform_lookup_allowed) {
+               /*
+-               * Either we are not using DT or ACPI, or their lookup did not
+-               * return a result. In that case, use platform lookup as a
+-               * fallback.
++               * If a connection label was passed use that, else attempt to use
++               * the device name as label
+                */
+-              dev_dbg(consumer, "using lookup tables for GPIO lookup\n");
+-              desc = gpiod_find(consumer, con_id, idx, &lookupflags);
+-      }
+-
+-      if (IS_ERR(desc)) {
+-              dev_dbg(consumer, "No GPIO consumer %s found\n", con_id);
+-              return desc;
++              ret = gpiod_request(desc, label);
+       }
+-
+-      /*
+-       * If a connection label was passed use that, else attempt to use
+-       * the device name as label
+-       */
+-      ret = gpiod_request(desc, label);
+       if (ret) {
+               if (!(ret == -EBUSY && flags & GPIOD_FLAGS_BIT_NONEXCLUSIVE))
+                       return ERR_PTR(ret);
+@@ -4739,61 +4754,69 @@ static void gpiolib_dbg_show(struct seq_file *s, struct gpio_device *gdev)
+       }
+ }
++struct gpiolib_seq_priv {
++      bool newline;
++      int idx;
++};
++
+ static void *gpiolib_seq_start(struct seq_file *s, loff_t *pos)
+ {
+-      unsigned long flags;
+-      struct gpio_device *gdev = NULL;
++      struct gpiolib_seq_priv *priv;
++      struct gpio_device *gdev;
+       loff_t index = *pos;
+-      s->private = "";
++      priv = kzalloc(sizeof(*priv), GFP_KERNEL);
++      if (!priv)
++              return NULL;
++
++      s->private = priv;
++      priv->idx = srcu_read_lock(&gpio_devices_srcu);
+-      spin_lock_irqsave(&gpio_lock, flags);
+-      list_for_each_entry(gdev, &gpio_devices, list)
+-              if (index-- == 0) {
+-                      spin_unlock_irqrestore(&gpio_lock, flags);
++      list_for_each_entry_srcu(gdev, &gpio_devices, list,
++                               srcu_read_lock_held(&gpio_devices_srcu)) {
++              if (index-- == 0)
+                       return gdev;
+-              }
+-      spin_unlock_irqrestore(&gpio_lock, flags);
++      }
+       return NULL;
+ }
+ static void *gpiolib_seq_next(struct seq_file *s, void *v, loff_t *pos)
+ {
+-      unsigned long flags;
+-      struct gpio_device *gdev = v;
+-      void *ret = NULL;
++      struct gpiolib_seq_priv *priv = s->private;
++      struct gpio_device *gdev = v, *next;
+-      spin_lock_irqsave(&gpio_lock, flags);
+-      if (list_is_last(&gdev->list, &gpio_devices))
+-              ret = NULL;
+-      else
+-              ret = list_first_entry(&gdev->list, struct gpio_device, list);
+-      spin_unlock_irqrestore(&gpio_lock, flags);
+-
+-      s->private = "\n";
++      next = list_entry_rcu(gdev->list.next, struct gpio_device, list);
++      gdev = &next->list == &gpio_devices ? NULL : next;
++      priv->newline = true;
+       ++*pos;
+-      return ret;
++      return gdev;
+ }
+ static void gpiolib_seq_stop(struct seq_file *s, void *v)
+ {
++      struct gpiolib_seq_priv *priv = s->private;
++
++      srcu_read_unlock(&gpio_devices_srcu, priv->idx);
++      kfree(priv);
+ }
+ static int gpiolib_seq_show(struct seq_file *s, void *v)
+ {
++      struct gpiolib_seq_priv *priv = s->private;
+       struct gpio_device *gdev = v;
+       struct gpio_chip *gc = gdev->chip;
+       struct device *parent;
+       if (!gc) {
+-              seq_printf(s, "%s%s: (dangling chip)", (char *)s->private,
++              seq_printf(s, "%s%s: (dangling chip)",
++                         priv->newline ? "\n" : "",
+                          dev_name(&gdev->dev));
+               return 0;
+       }
+-      seq_printf(s, "%s%s: GPIOs %d-%d", (char *)s->private,
++      seq_printf(s, "%s%s: GPIOs %d-%d", priv->newline ? "\n" : "",
+                  dev_name(&gdev->dev),
+                  gdev->base, gdev->base + gdev->ngpio - 1);
+       parent = gc->parent;
+-- 
+2.43.0
+
diff --git a/queue-6.8/gpiolib-fix-debug-messaging-in-gpiod_find_and_reques.patch b/queue-6.8/gpiolib-fix-debug-messaging-in-gpiod_find_and_reques.patch
new file mode 100644 (file)
index 0000000..fb21d32
--- /dev/null
@@ -0,0 +1,157 @@
+From 789fa62fccea267b377ba9e49b591510504d9163 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Mar 2024 19:16:25 +0200
+Subject: gpiolib: Fix debug messaging in gpiod_find_and_request()
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 5c887b65bbd1a3fc28e2e20399acede0baa83edb ]
+
+When consolidating GPIO lookups in ACPI code, the debug messaging
+had been reworked that the user may see
+
+  [   13.401147] (NULL device *): using ACPI '\_SB.LEDS.led-0' for '(null)' GPIO lookup
+  [   13.401378] gpio gpiochip0: Persistence not supported for GPIO 40
+  [   13.401402] gpio-40 (?): no flags found for (null)
+
+instead of
+
+  [   14.182962] gpio gpiochip0: Persistence not supported for GPIO 40
+  [   14.182994] gpio-40 (?): no flags found for gpios
+
+The '(null)' parts are less informative and likely scare the users.
+Replace them by '(default)' which can point out to the default connection
+IDs, such as 'gpios'.
+
+While at it, amend other places where con_id is used in the messages.
+
+Reported-by: Ferry Toth <ftoth@exalondelft.nl>
+Fixes: 8eb1f71e7acc ("gpiolib: consolidate GPIO lookups")
+Suggested-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Tested-by: Ferry Toth <ftoth@exalondelft.nl>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib.c | 32 ++++++++++++++++++--------------
+ 1 file changed, 18 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index a6f1a4e2e3a4e..3bd2b3a986be5 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -2408,6 +2408,11 @@ char *gpiochip_dup_line_label(struct gpio_chip *gc, unsigned int offset)
+ }
+ EXPORT_SYMBOL_GPL(gpiochip_dup_line_label);
++static inline const char *function_name_or_default(const char *con_id)
++{
++      return con_id ?: "(default)";
++}
++
+ /**
+  * gpiochip_request_own_desc - Allow GPIO chip to request its own descriptor
+  * @gc: GPIO chip
+@@ -2436,10 +2441,11 @@ struct gpio_desc *gpiochip_request_own_desc(struct gpio_chip *gc,
+                                           enum gpiod_flags dflags)
+ {
+       struct gpio_desc *desc = gpiochip_get_desc(gc, hwnum);
++      const char *name = function_name_or_default(label);
+       int ret;
+       if (IS_ERR(desc)) {
+-              chip_err(gc, "failed to get GPIO descriptor\n");
++              chip_err(gc, "failed to get GPIO %s descriptor\n", name);
+               return desc;
+       }
+@@ -2449,8 +2455,8 @@ struct gpio_desc *gpiochip_request_own_desc(struct gpio_chip *gc,
+       ret = gpiod_configure_flags(desc, label, lflags, dflags);
+       if (ret) {
+-              chip_err(gc, "setup of own GPIO %s failed\n", label);
+               gpiod_free_commit(desc);
++              chip_err(gc, "setup of own GPIO %s failed\n", name);
+               return ERR_PTR(ret);
+       }
+@@ -4125,19 +4131,17 @@ static struct gpio_desc *gpiod_find_by_fwnode(struct fwnode_handle *fwnode,
+                                             enum gpiod_flags *flags,
+                                             unsigned long *lookupflags)
+ {
++      const char *name = function_name_or_default(con_id);
+       struct gpio_desc *desc = ERR_PTR(-ENOENT);
+       if (is_of_node(fwnode)) {
+-              dev_dbg(consumer, "using DT '%pfw' for '%s' GPIO lookup\n",
+-                      fwnode, con_id);
++              dev_dbg(consumer, "using DT '%pfw' for '%s' GPIO lookup\n", fwnode, name);
+               desc = of_find_gpio(to_of_node(fwnode), con_id, idx, lookupflags);
+       } else if (is_acpi_node(fwnode)) {
+-              dev_dbg(consumer, "using ACPI '%pfw' for '%s' GPIO lookup\n",
+-                      fwnode, con_id);
++              dev_dbg(consumer, "using ACPI '%pfw' for '%s' GPIO lookup\n", fwnode, name);
+               desc = acpi_find_gpio(fwnode, con_id, idx, flags, lookupflags);
+       } else if (is_software_node(fwnode)) {
+-              dev_dbg(consumer, "using swnode '%pfw' for '%s' GPIO lookup\n",
+-                      fwnode, con_id);
++              dev_dbg(consumer, "using swnode '%pfw' for '%s' GPIO lookup\n", fwnode, name);
+               desc = swnode_find_gpio(fwnode, con_id, idx, lookupflags);
+       }
+@@ -4153,6 +4157,7 @@ struct gpio_desc *gpiod_find_and_request(struct device *consumer,
+                                        bool platform_lookup_allowed)
+ {
+       unsigned long lookupflags = GPIO_LOOKUP_FLAGS_DEFAULT;
++      const char *name = function_name_or_default(con_id);
+       /*
+        * scoped_guard() is implemented as a for loop, meaning static
+        * analyzers will complain about these two not being initialized.
+@@ -4175,8 +4180,7 @@ struct gpio_desc *gpiod_find_and_request(struct device *consumer,
+               }
+               if (IS_ERR(desc)) {
+-                      dev_dbg(consumer, "No GPIO consumer %s found\n",
+-                              con_id);
++                      dev_dbg(consumer, "No GPIO consumer %s found\n", name);
+                       return desc;
+               }
+@@ -4198,15 +4202,14 @@ struct gpio_desc *gpiod_find_and_request(struct device *consumer,
+                *
+                * FIXME: Make this more sane and safe.
+                */
+-              dev_info(consumer,
+-                       "nonexclusive access to GPIO for %s\n", con_id);
++              dev_info(consumer, "nonexclusive access to GPIO for %s\n", name);
+               return desc;
+       }
+       ret = gpiod_configure_flags(desc, con_id, lookupflags, flags);
+       if (ret < 0) {
+-              dev_dbg(consumer, "setup of GPIO %s failed\n", con_id);
+               gpiod_put(desc);
++              dev_dbg(consumer, "setup of GPIO %s failed\n", name);
+               return ERR_PTR(ret);
+       }
+@@ -4322,6 +4325,7 @@ EXPORT_SYMBOL_GPL(gpiod_get_optional);
+ int gpiod_configure_flags(struct gpio_desc *desc, const char *con_id,
+               unsigned long lflags, enum gpiod_flags dflags)
+ {
++      const char *name = function_name_or_default(con_id);
+       int ret;
+       if (lflags & GPIO_ACTIVE_LOW)
+@@ -4365,7 +4369,7 @@ int gpiod_configure_flags(struct gpio_desc *desc, const char *con_id,
+       /* No particular flag request, return here... */
+       if (!(dflags & GPIOD_FLAGS_BIT_DIR_SET)) {
+-              gpiod_dbg(desc, "no flags found for %s\n", con_id);
++              gpiod_dbg(desc, "no flags found for GPIO %s\n", name);
+               return 0;
+       }
+-- 
+2.43.0
+
diff --git a/queue-6.8/ice-fix-memory-corruption-bug-with-suspend-and-rebui.patch b/queue-6.8/ice-fix-memory-corruption-bug-with-suspend-and-rebui.patch
new file mode 100644 (file)
index 0000000..fce8f07
--- /dev/null
@@ -0,0 +1,155 @@
+From b31f3f6076a1a22ff27dcdb6772afdf997d4c3a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Mar 2024 15:02:03 -0800
+Subject: ice: fix memory corruption bug with suspend and rebuild
+
+From: Jesse Brandeburg <jesse.brandeburg@intel.com>
+
+[ Upstream commit 1cb7fdb1dfde1aab66780b4ba44dba6402172111 ]
+
+The ice driver would previously panic after suspend. This is caused
+from the driver *only* calling the ice_vsi_free_q_vectors() function by
+itself, when it is suspending. Since commit b3e7b3a6ee92 ("ice: prevent
+NULL pointer deref during reload") the driver has zeroed out
+num_q_vectors, and only restored it in ice_vsi_cfg_def().
+
+This further causes the ice_rebuild() function to allocate a zero length
+buffer, after which num_q_vectors is updated, and then the new value of
+num_q_vectors is used to index into the zero length buffer, which
+corrupts memory.
+
+The fix entails making sure all the code referencing num_q_vectors only
+does so after it has been reset via ice_vsi_cfg_def().
+
+I didn't perform a full bisect, but I was able to test against 6.1.77
+kernel and that ice driver works fine for suspend/resume with no panic,
+so sometime since then, this problem was introduced.
+
+Also clean up an un-needed init of a local variable in the function
+being modified.
+
+PANIC from 6.8.0-rc1:
+
+[1026674.915596] PM: suspend exit
+[1026675.664697] ice 0000:17:00.1: PTP reset successful
+[1026675.664707] ice 0000:17:00.1: 2755 msecs passed between update to cached PHC time
+[1026675.667660] ice 0000:b1:00.0: PTP reset successful
+[1026675.675944] ice 0000:b1:00.0: 2832 msecs passed between update to cached PHC time
+[1026677.137733] ixgbe 0000:31:00.0 ens787: NIC Link is Up 1 Gbps, Flow Control: None
+[1026677.190201] BUG: kernel NULL pointer dereference, address: 0000000000000010
+[1026677.192753] ice 0000:17:00.0: PTP reset successful
+[1026677.192764] ice 0000:17:00.0: 4548 msecs passed between update to cached PHC time
+[1026677.197928] #PF: supervisor read access in kernel mode
+[1026677.197933] #PF: error_code(0x0000) - not-present page
+[1026677.197937] PGD 1557a7067 P4D 0
+[1026677.212133] ice 0000:b1:00.1: PTP reset successful
+[1026677.212143] ice 0000:b1:00.1: 4344 msecs passed between update to cached PHC time
+[1026677.212575]
+[1026677.243142] Oops: 0000 [#1] PREEMPT SMP NOPTI
+[1026677.247918] CPU: 23 PID: 42790 Comm: kworker/23:0 Kdump: loaded Tainted: G        W          6.8.0-rc1+ #1
+[1026677.257989] Hardware name: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0005.2202160810 02/16/2022
+[1026677.269367] Workqueue: ice ice_service_task [ice]
+[1026677.274592] RIP: 0010:ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice]
+[1026677.281421] Code: 0f 84 3a ff ff ff 41 0f b7 74 ec 02 66 89 b0 22 02 00 00 81 e6 ff 1f 00 00 e8 ec fd ff ff e9 35 ff ff ff 48 8b 43 30 49 63 ed <41> 0f b7 34 24 41 83 c5 01 48 8b 3c e8 66 89 b7 aa 02 00 00 81 e6
+[1026677.300877] RSP: 0018:ff3be62a6399bcc0 EFLAGS: 00010202
+[1026677.306556] RAX: ff28691e28980828 RBX: ff28691e41099828 RCX: 0000000000188000
+[1026677.314148] RDX: 0000000000000000 RSI: 0000000000000010 RDI: ff28691e41099828
+[1026677.321730] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
+[1026677.329311] R10: 0000000000000007 R11: ffffffffffffffc0 R12: 0000000000000010
+[1026677.336896] R13: 0000000000000000 R14: 0000000000000000 R15: ff28691e0eaa81a0
+[1026677.344472] FS:  0000000000000000(0000) GS:ff28693cbffc0000(0000) knlGS:0000000000000000
+[1026677.353000] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[1026677.359195] CR2: 0000000000000010 CR3: 0000000128df4001 CR4: 0000000000771ef0
+[1026677.366779] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[1026677.374369] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[1026677.381952] PKRU: 55555554
+[1026677.385116] Call Trace:
+[1026677.388023]  <TASK>
+[1026677.390589]  ? __die+0x20/0x70
+[1026677.394105]  ? page_fault_oops+0x82/0x160
+[1026677.398576]  ? do_user_addr_fault+0x65/0x6a0
+[1026677.403307]  ? exc_page_fault+0x6a/0x150
+[1026677.407694]  ? asm_exc_page_fault+0x22/0x30
+[1026677.412349]  ? ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice]
+[1026677.418614]  ice_vsi_rebuild+0x34b/0x3c0 [ice]
+[1026677.423583]  ice_vsi_rebuild_by_type+0x76/0x180 [ice]
+[1026677.429147]  ice_rebuild+0x18b/0x520 [ice]
+[1026677.433746]  ? delay_tsc+0x8f/0xc0
+[1026677.437630]  ice_do_reset+0xa3/0x190 [ice]
+[1026677.442231]  ice_service_task+0x26/0x440 [ice]
+[1026677.447180]  process_one_work+0x174/0x340
+[1026677.451669]  worker_thread+0x27e/0x390
+[1026677.455890]  ? __pfx_worker_thread+0x10/0x10
+[1026677.460627]  kthread+0xee/0x120
+[1026677.464235]  ? __pfx_kthread+0x10/0x10
+[1026677.468445]  ret_from_fork+0x2d/0x50
+[1026677.472476]  ? __pfx_kthread+0x10/0x10
+[1026677.476671]  ret_from_fork_asm+0x1b/0x30
+[1026677.481050]  </TASK>
+
+Fixes: b3e7b3a6ee92 ("ice: prevent NULL pointer deref during reload")
+Reported-by: Robert Elliott <elliott@hpe.com>
+Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_lib.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c
+index fc23dbe302b46..cfc20684f25ab 100644
+--- a/drivers/net/ethernet/intel/ice/ice_lib.c
++++ b/drivers/net/ethernet/intel/ice/ice_lib.c
+@@ -3238,7 +3238,7 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags)
+ {
+       struct ice_vsi_cfg_params params = {};
+       struct ice_coalesce_stored *coalesce;
+-      int prev_num_q_vectors = 0;
++      int prev_num_q_vectors;
+       struct ice_pf *pf;
+       int ret;
+@@ -3252,13 +3252,6 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags)
+       if (WARN_ON(vsi->type == ICE_VSI_VF && !vsi->vf))
+               return -EINVAL;
+-      coalesce = kcalloc(vsi->num_q_vectors,
+-                         sizeof(struct ice_coalesce_stored), GFP_KERNEL);
+-      if (!coalesce)
+-              return -ENOMEM;
+-
+-      prev_num_q_vectors = ice_vsi_rebuild_get_coalesce(vsi, coalesce);
+-
+       ret = ice_vsi_realloc_stat_arrays(vsi);
+       if (ret)
+               goto err_vsi_cfg;
+@@ -3268,6 +3261,13 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags)
+       if (ret)
+               goto err_vsi_cfg;
++      coalesce = kcalloc(vsi->num_q_vectors,
++                         sizeof(struct ice_coalesce_stored), GFP_KERNEL);
++      if (!coalesce)
++              return -ENOMEM;
++
++      prev_num_q_vectors = ice_vsi_rebuild_get_coalesce(vsi, coalesce);
++
+       ret = ice_vsi_cfg_tc_lan(pf, vsi);
+       if (ret) {
+               if (vsi_flags & ICE_VSI_FLAG_INIT) {
+@@ -3286,8 +3286,8 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags)
+ err_vsi_cfg_tc_lan:
+       ice_vsi_decfg(vsi);
+-err_vsi_cfg:
+       kfree(coalesce);
++err_vsi_cfg:
+       return ret;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/ice-refactor-fw-data-type-and-fix-bitmap-casting-iss.patch b/queue-6.8/ice-refactor-fw-data-type-and-fix-bitmap-casting-iss.patch
new file mode 100644 (file)
index 0000000..ab8fa39
--- /dev/null
@@ -0,0 +1,188 @@
+From 4702be88b3b30ebde4999ca7260fc4ed4502c666 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Feb 2024 09:49:59 +0800
+Subject: ice: Refactor FW data type and fix bitmap casting issue
+
+From: Steven Zou <steven.zou@intel.com>
+
+[ Upstream commit 817b18965b58a6e5fb6ce97abf01b03a205a6aea ]
+
+According to the datasheet, the recipe association data is an 8-byte
+little-endian value. It is described as 'Bitmap of the recipe indexes
+associated with this profile', it is from 24 to 31 byte area in FW.
+Therefore, it is defined to '__le64 recipe_assoc' in struct
+ice_aqc_recipe_to_profile. And then fix the bitmap casting issue, as we
+must never ever use castings for bitmap type.
+
+Fixes: 1e0f9881ef79 ("ice: Flesh out implementation of support for SRIOV on bonded interface")
+Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Reviewed-by: Andrii Staikov <andrii.staikov@intel.com>
+Reviewed-by: Jan Sokolowski <jan.sokolowski@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: Steven Zou <steven.zou@intel.com>
+Tested-by: Sujai Buvaneswaran <sujai.buvaneswaran@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/intel/ice/ice_adminq_cmd.h   |  3 ++-
+ drivers/net/ethernet/intel/ice/ice_lag.c      |  4 ++--
+ drivers/net/ethernet/intel/ice/ice_switch.c   | 24 +++++++++++--------
+ drivers/net/ethernet/intel/ice/ice_switch.h   |  4 ++--
+ 4 files changed, 20 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
+index 8040317c95617..1f3e7a6903e56 100644
+--- a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
++++ b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
+@@ -593,8 +593,9 @@ struct ice_aqc_recipe_data_elem {
+ struct ice_aqc_recipe_to_profile {
+       __le16 profile_id;
+       u8 rsvd[6];
+-      DECLARE_BITMAP(recipe_assoc, ICE_MAX_NUM_RECIPES);
++      __le64 recipe_assoc;
+ };
++static_assert(sizeof(struct ice_aqc_recipe_to_profile) == 16);
+ /* Add/Update/Remove/Get switch rules (indirect 0x02A0, 0x02A1, 0x02A2, 0x02A3)
+  */
+diff --git a/drivers/net/ethernet/intel/ice/ice_lag.c b/drivers/net/ethernet/intel/ice/ice_lag.c
+index 467372d541d21..a7a342809935f 100644
+--- a/drivers/net/ethernet/intel/ice/ice_lag.c
++++ b/drivers/net/ethernet/intel/ice/ice_lag.c
+@@ -2041,7 +2041,7 @@ int ice_init_lag(struct ice_pf *pf)
+       /* associate recipes to profiles */
+       for (n = 0; n < ICE_PROFID_IPV6_GTPU_IPV6_TCP_INNER; n++) {
+               err = ice_aq_get_recipe_to_profile(&pf->hw, n,
+-                                                 (u8 *)&recipe_bits, NULL);
++                                                 &recipe_bits, NULL);
+               if (err)
+                       continue;
+@@ -2049,7 +2049,7 @@ int ice_init_lag(struct ice_pf *pf)
+                       recipe_bits |= BIT(lag->pf_recipe) |
+                                      BIT(lag->lport_recipe);
+                       ice_aq_map_recipe_to_profile(&pf->hw, n,
+-                                                   (u8 *)&recipe_bits, NULL);
++                                                   recipe_bits, NULL);
+               }
+       }
+diff --git a/drivers/net/ethernet/intel/ice/ice_switch.c b/drivers/net/ethernet/intel/ice/ice_switch.c
+index f84bab80ca423..ba0ef91e4c19c 100644
+--- a/drivers/net/ethernet/intel/ice/ice_switch.c
++++ b/drivers/net/ethernet/intel/ice/ice_switch.c
+@@ -2025,12 +2025,12 @@ ice_update_recipe_lkup_idx(struct ice_hw *hw,
+  * ice_aq_map_recipe_to_profile - Map recipe to packet profile
+  * @hw: pointer to the HW struct
+  * @profile_id: package profile ID to associate the recipe with
+- * @r_bitmap: Recipe bitmap filled in and need to be returned as response
++ * @r_assoc: Recipe bitmap filled in and need to be returned as response
+  * @cd: pointer to command details structure or NULL
+  * Recipe to profile association (0x0291)
+  */
+ int
+-ice_aq_map_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap,
++ice_aq_map_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u64 r_assoc,
+                            struct ice_sq_cd *cd)
+ {
+       struct ice_aqc_recipe_to_profile *cmd;
+@@ -2042,7 +2042,7 @@ ice_aq_map_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap,
+       /* Set the recipe ID bit in the bitmask to let the device know which
+        * profile we are associating the recipe to
+        */
+-      memcpy(cmd->recipe_assoc, r_bitmap, sizeof(cmd->recipe_assoc));
++      cmd->recipe_assoc = cpu_to_le64(r_assoc);
+       return ice_aq_send_cmd(hw, &desc, NULL, 0, cd);
+ }
+@@ -2051,12 +2051,12 @@ ice_aq_map_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap,
+  * ice_aq_get_recipe_to_profile - Map recipe to packet profile
+  * @hw: pointer to the HW struct
+  * @profile_id: package profile ID to associate the recipe with
+- * @r_bitmap: Recipe bitmap filled in and need to be returned as response
++ * @r_assoc: Recipe bitmap filled in and need to be returned as response
+  * @cd: pointer to command details structure or NULL
+  * Associate profile ID with given recipe (0x0293)
+  */
+ int
+-ice_aq_get_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap,
++ice_aq_get_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u64 *r_assoc,
+                            struct ice_sq_cd *cd)
+ {
+       struct ice_aqc_recipe_to_profile *cmd;
+@@ -2069,7 +2069,7 @@ ice_aq_get_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap,
+       status = ice_aq_send_cmd(hw, &desc, NULL, 0, cd);
+       if (!status)
+-              memcpy(r_bitmap, cmd->recipe_assoc, sizeof(cmd->recipe_assoc));
++              *r_assoc = le64_to_cpu(cmd->recipe_assoc);
+       return status;
+ }
+@@ -2108,6 +2108,7 @@ int ice_alloc_recipe(struct ice_hw *hw, u16 *rid)
+ static void ice_get_recp_to_prof_map(struct ice_hw *hw)
+ {
+       DECLARE_BITMAP(r_bitmap, ICE_MAX_NUM_RECIPES);
++      u64 recp_assoc;
+       u16 i;
+       for (i = 0; i < hw->switch_info->max_used_prof_index + 1; i++) {
+@@ -2115,8 +2116,9 @@ static void ice_get_recp_to_prof_map(struct ice_hw *hw)
+               bitmap_zero(profile_to_recipe[i], ICE_MAX_NUM_RECIPES);
+               bitmap_zero(r_bitmap, ICE_MAX_NUM_RECIPES);
+-              if (ice_aq_get_recipe_to_profile(hw, i, (u8 *)r_bitmap, NULL))
++              if (ice_aq_get_recipe_to_profile(hw, i, &recp_assoc, NULL))
+                       continue;
++              bitmap_from_arr64(r_bitmap, &recp_assoc, ICE_MAX_NUM_RECIPES);
+               bitmap_copy(profile_to_recipe[i], r_bitmap,
+                           ICE_MAX_NUM_RECIPES);
+               for_each_set_bit(j, r_bitmap, ICE_MAX_NUM_RECIPES)
+@@ -5390,22 +5392,24 @@ ice_add_adv_recipe(struct ice_hw *hw, struct ice_adv_lkup_elem *lkups,
+        */
+       list_for_each_entry(fvit, &rm->fv_list, list_entry) {
+               DECLARE_BITMAP(r_bitmap, ICE_MAX_NUM_RECIPES);
++              u64 recp_assoc;
+               u16 j;
+               status = ice_aq_get_recipe_to_profile(hw, fvit->profile_id,
+-                                                    (u8 *)r_bitmap, NULL);
++                                                    &recp_assoc, NULL);
+               if (status)
+                       goto err_unroll;
++              bitmap_from_arr64(r_bitmap, &recp_assoc, ICE_MAX_NUM_RECIPES);
+               bitmap_or(r_bitmap, r_bitmap, rm->r_bitmap,
+                         ICE_MAX_NUM_RECIPES);
+               status = ice_acquire_change_lock(hw, ICE_RES_WRITE);
+               if (status)
+                       goto err_unroll;
++              bitmap_to_arr64(&recp_assoc, r_bitmap, ICE_MAX_NUM_RECIPES);
+               status = ice_aq_map_recipe_to_profile(hw, fvit->profile_id,
+-                                                    (u8 *)r_bitmap,
+-                                                    NULL);
++                                                    recp_assoc, NULL);
+               ice_release_change_lock(hw);
+               if (status)
+diff --git a/drivers/net/ethernet/intel/ice/ice_switch.h b/drivers/net/ethernet/intel/ice/ice_switch.h
+index db7e501b7e0a4..89ffa1b51b5ad 100644
+--- a/drivers/net/ethernet/intel/ice/ice_switch.h
++++ b/drivers/net/ethernet/intel/ice/ice_switch.h
+@@ -424,10 +424,10 @@ int ice_aq_add_recipe(struct ice_hw *hw,
+                     struct ice_aqc_recipe_data_elem *s_recipe_list,
+                     u16 num_recipes, struct ice_sq_cd *cd);
+ int
+-ice_aq_get_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap,
++ice_aq_get_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u64 *r_assoc,
+                            struct ice_sq_cd *cd);
+ int
+-ice_aq_map_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap,
++ice_aq_map_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u64 r_assoc,
+                            struct ice_sq_cd *cd);
+ #endif /* _ICE_SWITCH_H_ */
+-- 
+2.43.0
+
diff --git a/queue-6.8/igc-remove-stale-comment-about-tx-timestamping.patch b/queue-6.8/igc-remove-stale-comment-about-tx-timestamping.patch
new file mode 100644 (file)
index 0000000..d3c0b21
--- /dev/null
@@ -0,0 +1,43 @@
+From 277559ef5ae6d57322b178d1949287acbac1d46d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Mar 2024 14:03:10 +0100
+Subject: igc: Remove stale comment about Tx timestamping
+
+From: Kurt Kanzenbach <kurt@linutronix.de>
+
+[ Upstream commit 47ce2956c7a61ff354723e28235205fa2012265b ]
+
+The initial igc Tx timestamping implementation used only one register for
+retrieving Tx timestamps. Commit 3ed247e78911 ("igc: Add support for
+multiple in-flight TX timestamps") added support for utilizing all four of
+them e.g., for multiple domain support. Remove the stale comment/FIXME.
+
+Fixes: 3ed247e78911 ("igc: Add support for multiple in-flight TX timestamps")
+Signed-off-by: Kurt Kanzenbach <kurt@linutronix.de>
+Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Tested-by: Naama Meir <naamax.meir@linux.intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igc/igc_main.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
+index e447ba0370568..23bed58a9d825 100644
+--- a/drivers/net/ethernet/intel/igc/igc_main.c
++++ b/drivers/net/ethernet/intel/igc/igc_main.c
+@@ -1642,10 +1642,6 @@ static netdev_tx_t igc_xmit_frame_ring(struct sk_buff *skb,
+       if (unlikely(test_bit(IGC_RING_FLAG_TX_HWTSTAMP, &tx_ring->flags) &&
+                    skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP)) {
+-              /* FIXME: add support for retrieving timestamps from
+-               * the other timer registers before skipping the
+-               * timestamping request.
+-               */
+               unsigned long flags;
+               u32 tstamp_flags;
+-- 
+2.43.0
+
diff --git a/queue-6.8/inet-inet_defrag-prevent-sk-release-while-still-in-u.patch b/queue-6.8/inet-inet_defrag-prevent-sk-release-while-still-in-u.patch
new file mode 100644 (file)
index 0000000..e3d7568
--- /dev/null
@@ -0,0 +1,315 @@
+From 23446a96cb154edae892363223913bf2132dec8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2024 11:18:41 +0100
+Subject: inet: inet_defrag: prevent sk release while still in use
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 18685451fc4e546fc0e718580d32df3c0e5c8272 ]
+
+ip_local_out() and other functions can pass skb->sk as function argument.
+
+If the skb is a fragment and reassembly happens before such function call
+returns, the sk must not be released.
+
+This affects skb fragments reassembled via netfilter or similar
+modules, e.g. openvswitch or ct_act.c, when run as part of tx pipeline.
+
+Eric Dumazet made an initial analysis of this bug.  Quoting Eric:
+  Calling ip_defrag() in output path is also implying skb_orphan(),
+  which is buggy because output path relies on sk not disappearing.
+
+  A relevant old patch about the issue was :
+  8282f27449bf ("inet: frag: Always orphan skbs inside ip_defrag()")
+
+  [..]
+
+  net/ipv4/ip_output.c depends on skb->sk being set, and probably to an
+  inet socket, not an arbitrary one.
+
+  If we orphan the packet in ipvlan, then downstream things like FQ
+  packet scheduler will not work properly.
+
+  We need to change ip_defrag() to only use skb_orphan() when really
+  needed, ie whenever frag_list is going to be used.
+
+Eric suggested to stash sk in fragment queue and made an initial patch.
+However there is a problem with this:
+
+If skb is refragmented again right after, ip_do_fragment() will copy
+head->sk to the new fragments, and sets up destructor to sock_wfree.
+IOW, we have no choice but to fix up sk_wmem accouting to reflect the
+fully reassembled skb, else wmem will underflow.
+
+This change moves the orphan down into the core, to last possible moment.
+As ip_defrag_offset is aliased with sk_buff->sk member, we must move the
+offset into the FRAG_CB, else skb->sk gets clobbered.
+
+This allows to delay the orphaning long enough to learn if the skb has
+to be queued or if the skb is completing the reasm queue.
+
+In the former case, things work as before, skb is orphaned.  This is
+safe because skb gets queued/stolen and won't continue past reasm engine.
+
+In the latter case, we will steal the skb->sk reference, reattach it to
+the head skb, and fix up wmem accouting when inet_frag inflates truesize.
+
+Fixes: 7026b1ddb6b8 ("netfilter: Pass socket pointer down through okfn().")
+Diagnosed-by: Eric Dumazet <edumazet@google.com>
+Reported-by: xingwei lee <xrivendell7@gmail.com>
+Reported-by: yue sun <samsun1006219@gmail.com>
+Reported-by: syzbot+e5167d7144a62715044c@syzkaller.appspotmail.com
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://lore.kernel.org/r/20240326101845.30836-1-fw@strlen.de
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/skbuff.h                  |  7 +--
+ net/ipv4/inet_fragment.c                | 70 ++++++++++++++++++++-----
+ net/ipv4/ip_fragment.c                  |  2 +-
+ net/ipv6/netfilter/nf_conntrack_reasm.c |  2 +-
+ 4 files changed, 60 insertions(+), 21 deletions(-)
+
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index d9a1ccfb57080..227f4514476b1 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -748,8 +748,6 @@ typedef unsigned char *sk_buff_data_t;
+  *    @list: queue head
+  *    @ll_node: anchor in an llist (eg socket defer_list)
+  *    @sk: Socket we are owned by
+- *    @ip_defrag_offset: (aka @sk) alternate use of @sk, used in
+- *            fragmentation management
+  *    @dev: Device we arrived on/are leaving by
+  *    @dev_scratch: (aka @dev) alternate use of @dev when @dev would be %NULL
+  *    @cb: Control buffer. Free for use by every layer. Put private vars here
+@@ -870,10 +868,7 @@ struct sk_buff {
+               struct llist_node       ll_node;
+       };
+-      union {
+-              struct sock             *sk;
+-              int                     ip_defrag_offset;
+-      };
++      struct sock             *sk;
+       union {
+               ktime_t         tstamp;
+diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
+index 7072fc0783ef5..c88c9034d6300 100644
+--- a/net/ipv4/inet_fragment.c
++++ b/net/ipv4/inet_fragment.c
+@@ -24,6 +24,8 @@
+ #include <net/ip.h>
+ #include <net/ipv6.h>
++#include "../core/sock_destructor.h"
++
+ /* Use skb->cb to track consecutive/adjacent fragments coming at
+  * the end of the queue. Nodes in the rb-tree queue will
+  * contain "runs" of one or more adjacent fragments.
+@@ -39,6 +41,7 @@ struct ipfrag_skb_cb {
+       };
+       struct sk_buff          *next_frag;
+       int                     frag_run_len;
++      int                     ip_defrag_offset;
+ };
+ #define FRAG_CB(skb)          ((struct ipfrag_skb_cb *)((skb)->cb))
+@@ -396,12 +399,12 @@ int inet_frag_queue_insert(struct inet_frag_queue *q, struct sk_buff *skb,
+        */
+       if (!last)
+               fragrun_create(q, skb);  /* First fragment. */
+-      else if (last->ip_defrag_offset + last->len < end) {
++      else if (FRAG_CB(last)->ip_defrag_offset + last->len < end) {
+               /* This is the common case: skb goes to the end. */
+               /* Detect and discard overlaps. */
+-              if (offset < last->ip_defrag_offset + last->len)
++              if (offset < FRAG_CB(last)->ip_defrag_offset + last->len)
+                       return IPFRAG_OVERLAP;
+-              if (offset == last->ip_defrag_offset + last->len)
++              if (offset == FRAG_CB(last)->ip_defrag_offset + last->len)
+                       fragrun_append_to_last(q, skb);
+               else
+                       fragrun_create(q, skb);
+@@ -418,13 +421,13 @@ int inet_frag_queue_insert(struct inet_frag_queue *q, struct sk_buff *skb,
+                       parent = *rbn;
+                       curr = rb_to_skb(parent);
+-                      curr_run_end = curr->ip_defrag_offset +
++                      curr_run_end = FRAG_CB(curr)->ip_defrag_offset +
+                                       FRAG_CB(curr)->frag_run_len;
+-                      if (end <= curr->ip_defrag_offset)
++                      if (end <= FRAG_CB(curr)->ip_defrag_offset)
+                               rbn = &parent->rb_left;
+                       else if (offset >= curr_run_end)
+                               rbn = &parent->rb_right;
+-                      else if (offset >= curr->ip_defrag_offset &&
++                      else if (offset >= FRAG_CB(curr)->ip_defrag_offset &&
+                                end <= curr_run_end)
+                               return IPFRAG_DUP;
+                       else
+@@ -438,7 +441,7 @@ int inet_frag_queue_insert(struct inet_frag_queue *q, struct sk_buff *skb,
+               rb_insert_color(&skb->rbnode, &q->rb_fragments);
+       }
+-      skb->ip_defrag_offset = offset;
++      FRAG_CB(skb)->ip_defrag_offset = offset;
+       return IPFRAG_OK;
+ }
+@@ -448,13 +451,28 @@ void *inet_frag_reasm_prepare(struct inet_frag_queue *q, struct sk_buff *skb,
+                             struct sk_buff *parent)
+ {
+       struct sk_buff *fp, *head = skb_rb_first(&q->rb_fragments);
+-      struct sk_buff **nextp;
++      void (*destructor)(struct sk_buff *);
++      unsigned int orig_truesize = 0;
++      struct sk_buff **nextp = NULL;
++      struct sock *sk = skb->sk;
+       int delta;
++      if (sk && is_skb_wmem(skb)) {
++              /* TX: skb->sk might have been passed as argument to
++               * dst->output and must remain valid until tx completes.
++               *
++               * Move sk to reassembled skb and fix up wmem accounting.
++               */
++              orig_truesize = skb->truesize;
++              destructor = skb->destructor;
++      }
++
+       if (head != skb) {
+               fp = skb_clone(skb, GFP_ATOMIC);
+-              if (!fp)
+-                      return NULL;
++              if (!fp) {
++                      head = skb;
++                      goto out_restore_sk;
++              }
+               FRAG_CB(fp)->next_frag = FRAG_CB(skb)->next_frag;
+               if (RB_EMPTY_NODE(&skb->rbnode))
+                       FRAG_CB(parent)->next_frag = fp;
+@@ -463,6 +481,12 @@ void *inet_frag_reasm_prepare(struct inet_frag_queue *q, struct sk_buff *skb,
+                                       &q->rb_fragments);
+               if (q->fragments_tail == skb)
+                       q->fragments_tail = fp;
++
++              if (orig_truesize) {
++                      /* prevent skb_morph from releasing sk */
++                      skb->sk = NULL;
++                      skb->destructor = NULL;
++              }
+               skb_morph(skb, head);
+               FRAG_CB(skb)->next_frag = FRAG_CB(head)->next_frag;
+               rb_replace_node(&head->rbnode, &skb->rbnode,
+@@ -470,13 +494,13 @@ void *inet_frag_reasm_prepare(struct inet_frag_queue *q, struct sk_buff *skb,
+               consume_skb(head);
+               head = skb;
+       }
+-      WARN_ON(head->ip_defrag_offset != 0);
++      WARN_ON(FRAG_CB(head)->ip_defrag_offset != 0);
+       delta = -head->truesize;
+       /* Head of list must not be cloned. */
+       if (skb_unclone(head, GFP_ATOMIC))
+-              return NULL;
++              goto out_restore_sk;
+       delta += head->truesize;
+       if (delta)
+@@ -492,7 +516,7 @@ void *inet_frag_reasm_prepare(struct inet_frag_queue *q, struct sk_buff *skb,
+               clone = alloc_skb(0, GFP_ATOMIC);
+               if (!clone)
+-                      return NULL;
++                      goto out_restore_sk;
+               skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
+               skb_frag_list_init(head);
+               for (i = 0; i < skb_shinfo(head)->nr_frags; i++)
+@@ -509,6 +533,21 @@ void *inet_frag_reasm_prepare(struct inet_frag_queue *q, struct sk_buff *skb,
+               nextp = &skb_shinfo(head)->frag_list;
+       }
++out_restore_sk:
++      if (orig_truesize) {
++              int ts_delta = head->truesize - orig_truesize;
++
++              /* if this reassembled skb is fragmented later,
++               * fraglist skbs will get skb->sk assigned from head->sk,
++               * and each frag skb will be released via sock_wfree.
++               *
++               * Update sk_wmem_alloc.
++               */
++              head->sk = sk;
++              head->destructor = destructor;
++              refcount_add(ts_delta, &sk->sk_wmem_alloc);
++      }
++
+       return nextp;
+ }
+ EXPORT_SYMBOL(inet_frag_reasm_prepare);
+@@ -516,6 +555,8 @@ EXPORT_SYMBOL(inet_frag_reasm_prepare);
+ void inet_frag_reasm_finish(struct inet_frag_queue *q, struct sk_buff *head,
+                           void *reasm_data, bool try_coalesce)
+ {
++      struct sock *sk = is_skb_wmem(head) ? head->sk : NULL;
++      const unsigned int head_truesize = head->truesize;
+       struct sk_buff **nextp = reasm_data;
+       struct rb_node *rbn;
+       struct sk_buff *fp;
+@@ -579,6 +620,9 @@ void inet_frag_reasm_finish(struct inet_frag_queue *q, struct sk_buff *head,
+       head->prev = NULL;
+       head->tstamp = q->stamp;
+       head->mono_delivery_time = q->mono_delivery_time;
++
++      if (sk)
++              refcount_add(sum_truesize - head_truesize, &sk->sk_wmem_alloc);
+ }
+ EXPORT_SYMBOL(inet_frag_reasm_finish);
+diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
+index a4941f53b5237..fb947d1613fe2 100644
+--- a/net/ipv4/ip_fragment.c
++++ b/net/ipv4/ip_fragment.c
+@@ -384,6 +384,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
+       }
+       skb_dst_drop(skb);
++      skb_orphan(skb);
+       return -EINPROGRESS;
+ insert_error:
+@@ -487,7 +488,6 @@ int ip_defrag(struct net *net, struct sk_buff *skb, u32 user)
+       struct ipq *qp;
+       __IP_INC_STATS(net, IPSTATS_MIB_REASMREQDS);
+-      skb_orphan(skb);
+       /* Lookup (or create) queue header */
+       qp = ip_find(net, ip_hdr(skb), user, vif);
+diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
+index b2dd48911c8d6..efbec7ee27d0a 100644
+--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
+@@ -294,6 +294,7 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb,
+       }
+       skb_dst_drop(skb);
++      skb_orphan(skb);
+       return -EINPROGRESS;
+ insert_error:
+@@ -469,7 +470,6 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
+       hdr = ipv6_hdr(skb);
+       fhdr = (struct frag_hdr *)skb_transport_header(skb);
+-      skb_orphan(skb);
+       fq = fq_find(net, fhdr->identification, user, hdr,
+                    skb->dev ? skb->dev->ifindex : 0);
+       if (fq == NULL) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/iommu-validate-the-pasid-in-iommu_attach_device_pasi.patch b/queue-6.8/iommu-validate-the-pasid-in-iommu_attach_device_pasi.patch
new file mode 100644 (file)
index 0000000..721ed70
--- /dev/null
@@ -0,0 +1,62 @@
+From a6a2017f3d361984fd2d39fade2be5d417dddf6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Mar 2024 10:41:39 -0300
+Subject: iommu: Validate the PASID in iommu_attach_device_pasid()
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit c404f55c26fc23c70a9f2262f3f36a69fc46289b ]
+
+The SVA code checks that the PASID is valid for the device when assigning
+the PASID to the MM, but the normal PAGING related path does not check it.
+
+Devices that don't support PASID or PASID values too large for the device
+should not invoke the driver callback. The drivers should rely on the
+core code for this enforcement.
+
+Fixes: 16603704559c7a68 ("iommu: Add attach/detach_dev_pasid iommu interfaces")
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Reviewed-by: Yi Liu <yi.l.liu@intel.com>
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Link: https://lore.kernel.org/r/0-v1-460705442b30+659-iommu_check_pasid_jgg@nvidia.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommu.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index cd1210026ac53..ad33161f2374b 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -3547,6 +3547,7 @@ int iommu_attach_device_pasid(struct iommu_domain *domain,
+ {
+       /* Caller must be a probed driver on dev */
+       struct iommu_group *group = dev->iommu_group;
++      struct group_device *device;
+       void *curr;
+       int ret;
+@@ -3556,10 +3557,18 @@ int iommu_attach_device_pasid(struct iommu_domain *domain,
+       if (!group)
+               return -ENODEV;
+-      if (!dev_has_iommu(dev) || dev_iommu_ops(dev) != domain->owner)
++      if (!dev_has_iommu(dev) || dev_iommu_ops(dev) != domain->owner ||
++          pasid == IOMMU_NO_PASID)
+               return -EINVAL;
+       mutex_lock(&group->mutex);
++      for_each_group_device(group, device) {
++              if (pasid >= device->dev->iommu->max_pasids) {
++                      ret = -EINVAL;
++                      goto out_unlock;
++              }
++      }
++
+       curr = xa_cmpxchg(&group->pasid_array, pasid, NULL, domain, GFP_KERNEL);
+       if (curr) {
+               ret = xa_err(curr) ? : -EBUSY;
+-- 
+2.43.0
+
diff --git a/queue-6.8/ixgbe-avoid-sleeping-allocation-in-ixgbe_ipsec_vf_ad.patch b/queue-6.8/ixgbe-avoid-sleeping-allocation-in-ixgbe_ipsec_vf_ad.patch
new file mode 100644 (file)
index 0000000..c98e2e9
--- /dev/null
@@ -0,0 +1,75 @@
+From 2d0c7ce9a19aa6c8001a1cc6a1be61b96cfc796a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Mar 2024 17:02:02 +0100
+Subject: ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa()
+
+From: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+
+[ Upstream commit aec806fb4afba5fe80b09e29351379a4292baa43 ]
+
+Change kzalloc() flags used in ixgbe_ipsec_vf_add_sa() to GFP_ATOMIC, to
+avoid sleeping in IRQ context.
+
+Dan Carpenter, with the help of Smatch, has found following issue:
+The patch eda0333ac293: "ixgbe: add VF IPsec management" from Aug 13,
+2018 (linux-next), leads to the following Smatch static checker
+warning: drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c:917 ixgbe_ipsec_vf_add_sa()
+       warn: sleeping in IRQ context
+
+The call tree that Smatch is worried about is:
+ixgbe_msix_other() <- IRQ handler
+-> ixgbe_msg_task()
+   -> ixgbe_rcv_msg_from_vf()
+      -> ixgbe_ipsec_vf_add_sa()
+
+Fixes: eda0333ac293 ("ixgbe: add VF IPsec management")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/intel-wired-lan/db31a0b0-4d9f-4e6b-aed8-88266eb5665c@moroto.mountain
+Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
+Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Reviewed-by: Shannon Nelson <shannon.nelson@amd.com>
+Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+index 13a6fca31004a..866024f2b9eeb 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+@@ -914,7 +914,13 @@ int ixgbe_ipsec_vf_add_sa(struct ixgbe_adapter *adapter, u32 *msgbuf, u32 vf)
+               goto err_out;
+       }
+-      xs = kzalloc(sizeof(*xs), GFP_KERNEL);
++      algo = xfrm_aead_get_byname(aes_gcm_name, IXGBE_IPSEC_AUTH_BITS, 1);
++      if (unlikely(!algo)) {
++              err = -ENOENT;
++              goto err_out;
++      }
++
++      xs = kzalloc(sizeof(*xs), GFP_ATOMIC);
+       if (unlikely(!xs)) {
+               err = -ENOMEM;
+               goto err_out;
+@@ -930,14 +936,8 @@ int ixgbe_ipsec_vf_add_sa(struct ixgbe_adapter *adapter, u32 *msgbuf, u32 vf)
+               memcpy(&xs->id.daddr.a4, sam->addr, sizeof(xs->id.daddr.a4));
+       xs->xso.dev = adapter->netdev;
+-      algo = xfrm_aead_get_byname(aes_gcm_name, IXGBE_IPSEC_AUTH_BITS, 1);
+-      if (unlikely(!algo)) {
+-              err = -ENOENT;
+-              goto err_xs;
+-      }
+-
+       aead_len = sizeof(*xs->aead) + IXGBE_IPSEC_KEY_BITS / 8;
+-      xs->aead = kzalloc(aead_len, GFP_KERNEL);
++      xs->aead = kzalloc(aead_len, GFP_ATOMIC);
+       if (unlikely(!xs->aead)) {
+               err = -ENOMEM;
+               goto err_xs;
+-- 
+2.43.0
+
diff --git a/queue-6.8/kbuild-make-woverride-init-warnings-more-consistent.patch b/queue-6.8/kbuild-make-woverride-init-warnings-more-consistent.patch
new file mode 100644 (file)
index 0000000..52bb1f1
--- /dev/null
@@ -0,0 +1,256 @@
+From 2d65d6764176574b705a07883dfea48c56cb133d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2024 15:47:16 +0100
+Subject: kbuild: make -Woverride-init warnings more consistent
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit c40845e3195d074b34f8f8e400e28c9403a06588 ]
+
+The -Woverride-init warn about code that may be intentional or not,
+but the inintentional ones tend to be real bugs, so there is a bit of
+disagreement on whether this warning option should be enabled by default
+and we have multiple settings in scripts/Makefile.extrawarn as well as
+individual subsystems.
+
+Older versions of clang only supported -Wno-initializer-overrides with
+the same meaning as gcc's -Woverride-init, though all supported versions
+now work with both. Because of this difference, an earlier cleanup of
+mine accidentally turned the clang warning off for W=1 builds and only
+left it on for W=2, while it's still enabled for gcc with W=1.
+
+There is also one driver that only turns the warning off for newer
+versions of gcc but not other compilers, and some but not all the
+Makefiles still use a cc-disable-warning conditional that is no
+longer needed with supported compilers here.
+
+Address all of the above by removing the special cases for clang
+and always turning the warning off unconditionally where it got
+in the way, using the syntax that is supported by both compilers.
+
+Fixes: 2cd3271b7a31 ("kbuild: avoid duplicate warning options")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
+Acked-by: Jani Nikula <jani.nikula@intel.com>
+Acked-by: Andrew Jeffery <andrew@codeconstruct.com.au>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce110/Makefile |  2 +-
+ drivers/gpu/drm/amd/display/dc/dce112/Makefile |  2 +-
+ drivers/gpu/drm/amd/display/dc/dce120/Makefile |  2 +-
+ drivers/gpu/drm/amd/display/dc/dce60/Makefile  |  2 +-
+ drivers/gpu/drm/amd/display/dc/dce80/Makefile  |  2 +-
+ drivers/gpu/drm/i915/Makefile                  |  6 +++---
+ drivers/gpu/drm/xe/Makefile                    |  4 ++--
+ drivers/net/ethernet/renesas/sh_eth.c          |  2 +-
+ drivers/pinctrl/aspeed/Makefile                |  2 +-
+ fs/proc/Makefile                               |  2 +-
+ kernel/bpf/Makefile                            |  2 +-
+ mm/Makefile                                    |  3 +--
+ scripts/Makefile.extrawarn                     | 10 +++-------
+ 13 files changed, 18 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce110/Makefile b/drivers/gpu/drm/amd/display/dc/dce110/Makefile
+index f0777d61c2cbb..c307f040e48fc 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce110/Makefile
++++ b/drivers/gpu/drm/amd/display/dc/dce110/Makefile
+@@ -23,7 +23,7 @@
+ # Makefile for the 'controller' sub-component of DAL.
+ # It provides the control and status of HW CRTC block.
+-CFLAGS_$(AMDDALPATH)/dc/dce110/dce110_resource.o = $(call cc-disable-warning, override-init)
++CFLAGS_$(AMDDALPATH)/dc/dce110/dce110_resource.o = -Wno-override-init
+ DCE110 = dce110_timing_generator.o \
+ dce110_compressor.o dce110_opp_regamma_v.o \
+diff --git a/drivers/gpu/drm/amd/display/dc/dce112/Makefile b/drivers/gpu/drm/amd/display/dc/dce112/Makefile
+index 7e92effec8944..683866797709b 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce112/Makefile
++++ b/drivers/gpu/drm/amd/display/dc/dce112/Makefile
+@@ -23,7 +23,7 @@
+ # Makefile for the 'controller' sub-component of DAL.
+ # It provides the control and status of HW CRTC block.
+-CFLAGS_$(AMDDALPATH)/dc/dce112/dce112_resource.o = $(call cc-disable-warning, override-init)
++CFLAGS_$(AMDDALPATH)/dc/dce112/dce112_resource.o = -Wno-override-init
+ DCE112 = dce112_compressor.o
+diff --git a/drivers/gpu/drm/amd/display/dc/dce120/Makefile b/drivers/gpu/drm/amd/display/dc/dce120/Makefile
+index 1e3ef68a452a5..8f508e6627480 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce120/Makefile
++++ b/drivers/gpu/drm/amd/display/dc/dce120/Makefile
+@@ -24,7 +24,7 @@
+ # It provides the control and status of HW CRTC block.
+-CFLAGS_$(AMDDALPATH)/dc/dce120/dce120_resource.o = $(call cc-disable-warning, override-init)
++CFLAGS_$(AMDDALPATH)/dc/dce120/dce120_resource.o = -Wno-override-init
+ DCE120 = dce120_timing_generator.o
+diff --git a/drivers/gpu/drm/amd/display/dc/dce60/Makefile b/drivers/gpu/drm/amd/display/dc/dce60/Makefile
+index fee331accc0e7..eede83ad91fa0 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce60/Makefile
++++ b/drivers/gpu/drm/amd/display/dc/dce60/Makefile
+@@ -23,7 +23,7 @@
+ # Makefile for the 'controller' sub-component of DAL.
+ # It provides the control and status of HW CRTC block.
+-CFLAGS_$(AMDDALPATH)/dc/dce60/dce60_resource.o = $(call cc-disable-warning, override-init)
++CFLAGS_$(AMDDALPATH)/dc/dce60/dce60_resource.o = -Wno-override-init
+ DCE60 = dce60_timing_generator.o dce60_hw_sequencer.o \
+       dce60_resource.o
+diff --git a/drivers/gpu/drm/amd/display/dc/dce80/Makefile b/drivers/gpu/drm/amd/display/dc/dce80/Makefile
+index 7eefffbdc9253..fba189d26652d 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce80/Makefile
++++ b/drivers/gpu/drm/amd/display/dc/dce80/Makefile
+@@ -23,7 +23,7 @@
+ # Makefile for the 'controller' sub-component of DAL.
+ # It provides the control and status of HW CRTC block.
+-CFLAGS_$(AMDDALPATH)/dc/dce80/dce80_resource.o = $(call cc-disable-warning, override-init)
++CFLAGS_$(AMDDALPATH)/dc/dce80/dce80_resource.o = -Wno-override-init
+ DCE80 = dce80_timing_generator.o
+diff --git a/drivers/gpu/drm/i915/Makefile b/drivers/gpu/drm/i915/Makefile
+index c13f14edb5088..7b20c2bcc641d 100644
+--- a/drivers/gpu/drm/i915/Makefile
++++ b/drivers/gpu/drm/i915/Makefile
+@@ -33,9 +33,9 @@ endif
+ subdir-ccflags-$(CONFIG_DRM_I915_WERROR) += -Werror
+ # Fine grained warnings disable
+-CFLAGS_i915_pci.o = $(call cc-disable-warning, override-init)
+-CFLAGS_display/intel_display_device.o = $(call cc-disable-warning, override-init)
+-CFLAGS_display/intel_fbdev.o = $(call cc-disable-warning, override-init)
++CFLAGS_i915_pci.o = -Wno-override-init
++CFLAGS_display/intel_display_device.o = -Wno-override-init
++CFLAGS_display/intel_fbdev.o = -Wno-override-init
+ # Support compiling the display code separately for both i915 and xe
+ # drivers. Define I915 when building i915.
+diff --git a/drivers/gpu/drm/xe/Makefile b/drivers/gpu/drm/xe/Makefile
+index 802c807c782cc..1c9e6906b06a2 100644
+--- a/drivers/gpu/drm/xe/Makefile
++++ b/drivers/gpu/drm/xe/Makefile
+@@ -162,8 +162,8 @@ subdir-ccflags-$(CONFIG_DRM_XE_DISPLAY) += \
+       -Ddrm_i915_gem_object=xe_bo \
+       -Ddrm_i915_private=xe_device
+-CFLAGS_i915-display/intel_fbdev.o = $(call cc-disable-warning, override-init)
+-CFLAGS_i915-display/intel_display_device.o = $(call cc-disable-warning, override-init)
++CFLAGS_i915-display/intel_fbdev.o = -Wno-override-init
++CFLAGS_i915-display/intel_display_device.o = -Wno-override-init
+ # Rule to build SOC code shared with i915
+ $(obj)/i915-soc/%.o: $(srctree)/drivers/gpu/drm/i915/soc/%.c FORCE
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 475e1e8c1d35f..0786eb0da3914 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -50,7 +50,7 @@
+  * the macros available to do this only define GCC 8.
+  */
+ __diag_push();
+-__diag_ignore(GCC, 8, "-Woverride-init",
++__diag_ignore_all("-Woverride-init",
+             "logic to initialize all and then override some is OK");
+ static const u16 sh_eth_offset_gigabit[SH_ETH_MAX_REGISTER_OFFSET] = {
+       SH_ETH_OFFSET_DEFAULTS,
+diff --git a/drivers/pinctrl/aspeed/Makefile b/drivers/pinctrl/aspeed/Makefile
+index 489ea1778353f..db2a7600ae2bd 100644
+--- a/drivers/pinctrl/aspeed/Makefile
++++ b/drivers/pinctrl/aspeed/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ # Aspeed pinctrl support
+-ccflags-y += $(call cc-option,-Woverride-init)
++ccflags-y += -Woverride-init
+ obj-$(CONFIG_PINCTRL_ASPEED)  += pinctrl-aspeed.o pinmux-aspeed.o
+ obj-$(CONFIG_PINCTRL_ASPEED_G4)       += pinctrl-aspeed-g4.o
+ obj-$(CONFIG_PINCTRL_ASPEED_G5)       += pinctrl-aspeed-g5.o
+diff --git a/fs/proc/Makefile b/fs/proc/Makefile
+index bd08616ed8bad..7b4db9c56e6a7 100644
+--- a/fs/proc/Makefile
++++ b/fs/proc/Makefile
+@@ -5,7 +5,7 @@
+ obj-y   += proc.o
+-CFLAGS_task_mmu.o     += $(call cc-option,-Wno-override-init,)
++CFLAGS_task_mmu.o     += -Wno-override-init
+ proc-y                        := nommu.o task_nommu.o
+ proc-$(CONFIG_MMU)    := task_mmu.o
+diff --git a/kernel/bpf/Makefile b/kernel/bpf/Makefile
+index f526b7573e97c..418a8188a8e84 100644
+--- a/kernel/bpf/Makefile
++++ b/kernel/bpf/Makefile
+@@ -4,7 +4,7 @@ ifneq ($(CONFIG_BPF_JIT_ALWAYS_ON),y)
+ # ___bpf_prog_run() needs GCSE disabled on x86; see 3193c0836f203 for details
+ cflags-nogcse-$(CONFIG_X86)$(CONFIG_CC_IS_GCC) := -fno-gcse
+ endif
+-CFLAGS_core.o += $(call cc-disable-warning, override-init) $(cflags-nogcse-yy)
++CFLAGS_core.o += -Wno-override-init $(cflags-nogcse-yy)
+ obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o inode.o helpers.o tnum.o log.o
+ obj-$(CONFIG_BPF_SYSCALL) += bpf_iter.o map_iter.o task_iter.o prog_iter.o link_iter.o
+diff --git a/mm/Makefile b/mm/Makefile
+index e4b5b75aaec9c..4abb40b911ec4 100644
+--- a/mm/Makefile
++++ b/mm/Makefile
+@@ -29,8 +29,7 @@ KCOV_INSTRUMENT_mmzone.o := n
+ KCOV_INSTRUMENT_vmstat.o := n
+ KCOV_INSTRUMENT_failslab.o := n
+-CFLAGS_init-mm.o += $(call cc-disable-warning, override-init)
+-CFLAGS_init-mm.o += $(call cc-disable-warning, initializer-overrides)
++CFLAGS_init-mm.o += -Wno-override-init
+ mmu-y                 := nommu.o
+ mmu-$(CONFIG_MMU)     := highmem.o memory.o mincore.o \
+diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn
+index 2f25a1de129d1..5660b96213e4b 100644
+--- a/scripts/Makefile.extrawarn
++++ b/scripts/Makefile.extrawarn
+@@ -114,6 +114,8 @@ KBUILD_CFLAGS += $(call cc-disable-warning, format-overflow)
+ KBUILD_CFLAGS += $(call cc-disable-warning, format-truncation)
+ KBUILD_CFLAGS += $(call cc-disable-warning, stringop-truncation)
++KBUILD_CFLAGS += -Wno-override-init # alias for -Wno-initializer-overrides in clang
++
+ ifdef CONFIG_CC_IS_CLANG
+ # Clang before clang-16 would warn on default argument promotions.
+ ifneq ($(call clang-min-version, 160000),y)
+@@ -151,10 +153,6 @@ KBUILD_CFLAGS += -Wtype-limits
+ KBUILD_CFLAGS += $(call cc-option, -Wmaybe-uninitialized)
+ KBUILD_CFLAGS += $(call cc-option, -Wunused-macros)
+-ifdef CONFIG_CC_IS_CLANG
+-KBUILD_CFLAGS += -Winitializer-overrides
+-endif
+-
+ KBUILD_CPPFLAGS += -DKBUILD_EXTRA_WARN2
+ else
+@@ -164,9 +162,7 @@ KBUILD_CFLAGS += -Wno-missing-field-initializers
+ KBUILD_CFLAGS += -Wno-type-limits
+ KBUILD_CFLAGS += -Wno-shift-negative-value
+-ifdef CONFIG_CC_IS_CLANG
+-KBUILD_CFLAGS += -Wno-initializer-overrides
+-else
++ifdef CONFIG_CC_IS_GCC
+ KBUILD_CFLAGS += -Wno-maybe-uninitialized
+ endif
+-- 
+2.43.0
+
diff --git a/queue-6.8/mlxbf_gige-call-request_irq-after-napi-initialized.patch b/queue-6.8/mlxbf_gige-call-request_irq-after-napi-initialized.patch
new file mode 100644 (file)
index 0000000..55d4ef3
--- /dev/null
@@ -0,0 +1,168 @@
+From 91d5fd0c1b25eee5a3b97699781a37550f155e65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Mar 2024 14:36:27 -0400
+Subject: mlxbf_gige: call request_irq() after NAPI initialized
+
+From: David Thompson <davthompson@nvidia.com>
+
+[ Upstream commit f7442a634ac06b953fc1f7418f307b25acd4cfbc ]
+
+The mlxbf_gige driver encounters a NULL pointer exception in
+mlxbf_gige_open() when kdump is enabled.  The sequence to reproduce
+the exception is as follows:
+a) enable kdump
+b) trigger kdump via "echo c > /proc/sysrq-trigger"
+c) kdump kernel executes
+d) kdump kernel loads mlxbf_gige module
+e) the mlxbf_gige module runs its open() as the
+   the "oob_net0" interface is brought up
+f) mlxbf_gige module will experience an exception
+   during its open(), something like:
+
+     Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
+     Mem abort info:
+       ESR = 0x0000000086000004
+       EC = 0x21: IABT (current EL), IL = 32 bits
+       SET = 0, FnV = 0
+       EA = 0, S1PTW = 0
+       FSC = 0x04: level 0 translation fault
+     user pgtable: 4k pages, 48-bit VAs, pgdp=00000000e29a4000
+     [0000000000000000] pgd=0000000000000000, p4d=0000000000000000
+     Internal error: Oops: 0000000086000004 [#1] SMP
+     CPU: 0 PID: 812 Comm: NetworkManager Tainted: G           OE     5.15.0-1035-bluefield #37-Ubuntu
+     Hardware name: https://www.mellanox.com BlueField-3 SmartNIC Main Card/BlueField-3 SmartNIC Main Card, BIOS 4.6.0.13024 Jan 19 2024
+     pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+     pc : 0x0
+     lr : __napi_poll+0x40/0x230
+     sp : ffff800008003e00
+     x29: ffff800008003e00 x28: 0000000000000000 x27: 00000000ffffffff
+     x26: ffff000066027238 x25: ffff00007cedec00 x24: ffff800008003ec8
+     x23: 000000000000012c x22: ffff800008003eb7 x21: 0000000000000000
+     x20: 0000000000000001 x19: ffff000066027238 x18: 0000000000000000
+     x17: ffff578fcb450000 x16: ffffa870b083c7c0 x15: 0000aaab010441d0
+     x14: 0000000000000001 x13: 00726f7272655f65 x12: 6769675f6662786c
+     x11: 0000000000000000 x10: 0000000000000000 x9 : ffffa870b0842398
+     x8 : 0000000000000004 x7 : fe5a48b9069706ea x6 : 17fdb11fc84ae0d2
+     x5 : d94a82549d594f35 x4 : 0000000000000000 x3 : 0000000000400100
+     x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000066027238
+     Call trace:
+      0x0
+      net_rx_action+0x178/0x360
+      __do_softirq+0x15c/0x428
+      __irq_exit_rcu+0xac/0xec
+      irq_exit+0x18/0x2c
+      handle_domain_irq+0x6c/0xa0
+      gic_handle_irq+0xec/0x1b0
+      call_on_irq_stack+0x20/0x2c
+      do_interrupt_handler+0x5c/0x70
+      el1_interrupt+0x30/0x50
+      el1h_64_irq_handler+0x18/0x2c
+      el1h_64_irq+0x7c/0x80
+      __setup_irq+0x4c0/0x950
+      request_threaded_irq+0xf4/0x1bc
+      mlxbf_gige_request_irqs+0x68/0x110 [mlxbf_gige]
+      mlxbf_gige_open+0x5c/0x170 [mlxbf_gige]
+      __dev_open+0x100/0x220
+      __dev_change_flags+0x16c/0x1f0
+      dev_change_flags+0x2c/0x70
+      do_setlink+0x220/0xa40
+      __rtnl_newlink+0x56c/0x8a0
+      rtnl_newlink+0x58/0x84
+      rtnetlink_rcv_msg+0x138/0x3c4
+      netlink_rcv_skb+0x64/0x130
+      rtnetlink_rcv+0x20/0x30
+      netlink_unicast+0x2ec/0x360
+      netlink_sendmsg+0x278/0x490
+      __sock_sendmsg+0x5c/0x6c
+      ____sys_sendmsg+0x290/0x2d4
+      ___sys_sendmsg+0x84/0xd0
+      __sys_sendmsg+0x70/0xd0
+      __arm64_sys_sendmsg+0x2c/0x40
+      invoke_syscall+0x78/0x100
+      el0_svc_common.constprop.0+0x54/0x184
+      do_el0_svc+0x30/0xac
+      el0_svc+0x48/0x160
+      el0t_64_sync_handler+0xa4/0x12c
+      el0t_64_sync+0x1a4/0x1a8
+     Code: bad PC value
+     ---[ end trace 7d1c3f3bf9d81885 ]---
+     Kernel panic - not syncing: Oops: Fatal exception in interrupt
+     Kernel Offset: 0x2870a7a00000 from 0xffff800008000000
+     PHYS_OFFSET: 0x80000000
+     CPU features: 0x0,000005c1,a3332a5a
+     Memory Limit: none
+     ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---
+
+The exception happens because there is a pending RX interrupt before the
+call to request_irq(RX IRQ) executes.  Then, the RX IRQ handler fires
+immediately after this request_irq() completes. The RX IRQ handler runs
+"napi_schedule()" before NAPI is fully initialized via "netif_napi_add()"
+and "napi_enable()", both which happen later in the open() logic.
+
+The logic in mlxbf_gige_open() must fully initialize NAPI before any calls
+to request_irq() execute.
+
+Fixes: f92e1869d74e ("Add Mellanox BlueField Gigabit Ethernet driver")
+Signed-off-by: David Thompson <davthompson@nvidia.com>
+Reviewed-by: Asmaa Mnebhi <asmaa@nvidia.com>
+Link: https://lore.kernel.org/r/20240325183627.7641-1-davthompson@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mellanox/mlxbf_gige/mlxbf_gige_main.c      | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
+index cef0e2d3f1a7b..77134ca929382 100644
+--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
+@@ -139,13 +139,10 @@ static int mlxbf_gige_open(struct net_device *netdev)
+       control |= MLXBF_GIGE_CONTROL_PORT_EN;
+       writeq(control, priv->base + MLXBF_GIGE_CONTROL);
+-      err = mlxbf_gige_request_irqs(priv);
+-      if (err)
+-              return err;
+       mlxbf_gige_cache_stats(priv);
+       err = mlxbf_gige_clean_port(priv);
+       if (err)
+-              goto free_irqs;
++              return err;
+       /* Clear driver's valid_polarity to match hardware,
+        * since the above call to clean_port() resets the
+@@ -166,6 +163,10 @@ static int mlxbf_gige_open(struct net_device *netdev)
+       napi_enable(&priv->napi);
+       netif_start_queue(netdev);
++      err = mlxbf_gige_request_irqs(priv);
++      if (err)
++              goto napi_deinit;
++
+       /* Set bits in INT_EN that we care about */
+       int_en = MLXBF_GIGE_INT_EN_HW_ACCESS_ERROR |
+                MLXBF_GIGE_INT_EN_TX_CHECKSUM_INPUTS |
+@@ -182,14 +183,17 @@ static int mlxbf_gige_open(struct net_device *netdev)
+       return 0;
++napi_deinit:
++      netif_stop_queue(netdev);
++      napi_disable(&priv->napi);
++      netif_napi_del(&priv->napi);
++      mlxbf_gige_rx_deinit(priv);
++
+ tx_deinit:
+       mlxbf_gige_tx_deinit(priv);
+ phy_deinit:
+       phy_stop(phydev);
+-
+-free_irqs:
+-      mlxbf_gige_free_irqs(priv);
+       return err;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/mlxbf_gige-stop-phy-during-open-error-paths.patch b/queue-6.8/mlxbf_gige-stop-phy-during-open-error-paths.patch
new file mode 100644 (file)
index 0000000..1942449
--- /dev/null
@@ -0,0 +1,50 @@
+From 2aaf004aa92ac925670749b45e46f69e5629ad19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Mar 2024 15:31:17 -0400
+Subject: mlxbf_gige: stop PHY during open() error paths
+
+From: David Thompson <davthompson@nvidia.com>
+
+[ Upstream commit d6c30c5a168f8586b8bcc0d8e42e2456eb05209b ]
+
+The mlxbf_gige_open() routine starts the PHY as part of normal
+initialization.  The mlxbf_gige_open() routine must stop the
+PHY during its error paths.
+
+Fixes: f92e1869d74e ("Add Mellanox BlueField Gigabit Ethernet driver")
+Signed-off-by: David Thompson <davthompson@nvidia.com>
+Reviewed-by: Asmaa Mnebhi <asmaa@nvidia.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
+index 3d09fa54598f1..cef0e2d3f1a7b 100644
+--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
+@@ -157,7 +157,7 @@ static int mlxbf_gige_open(struct net_device *netdev)
+       err = mlxbf_gige_tx_init(priv);
+       if (err)
+-              goto free_irqs;
++              goto phy_deinit;
+       err = mlxbf_gige_rx_init(priv);
+       if (err)
+               goto tx_deinit;
+@@ -185,6 +185,9 @@ static int mlxbf_gige_open(struct net_device *netdev)
+ tx_deinit:
+       mlxbf_gige_tx_deinit(priv);
++phy_deinit:
++      phy_stop(phydev);
++
+ free_irqs:
+       mlxbf_gige_free_irqs(priv);
+       return err;
+-- 
+2.43.0
+
diff --git a/queue-6.8/mm-treewide-replace-pud_large-with-pud_leaf.patch b/queue-6.8/mm-treewide-replace-pud_large-with-pud_leaf.patch
new file mode 100644 (file)
index 0000000..cda0aff
--- /dev/null
@@ -0,0 +1,402 @@
+From e45e809bd3b45fa491cc233a5e9ed5d23249e89a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Mar 2024 12:37:48 +0800
+Subject: mm/treewide: replace pud_large() with pud_leaf()
+
+From: Peter Xu <peterx@redhat.com>
+
+[ Upstream commit 0a845e0f6348ccfa2dcc8c450ffd1c9ffe8c4add ]
+
+pud_large() is always defined as pud_leaf().  Merge their usages.  Chose
+pud_leaf() because pud_leaf() is a global API, while pud_large() is not.
+
+Link: https://lkml.kernel.org/r/20240305043750.93762-9-peterx@redhat.com
+Signed-off-by: Peter Xu <peterx@redhat.com>
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Cc: Alexander Potapenko <glider@google.com>
+Cc: Andrey Konovalov <andreyknvl@gmail.com>
+Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
+Cc: "Aneesh Kumar K.V" <aneesh.kumar@kernel.org>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Kirill A. Shutemov <kirill@shutemov.name>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Muchun Song <muchun.song@linux.dev>
+Cc: "Naveen N. Rao" <naveen.n.rao@linux.ibm.com>
+Cc: Nicholas Piggin <npiggin@gmail.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
+Cc: Yang Shi <shy828301@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Stable-dep-of: c567f2948f57 ("Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped."")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/book3s64/pgtable.c | 2 +-
+ arch/s390/boot/vmem.c              | 2 +-
+ arch/s390/include/asm/pgtable.h    | 4 ++--
+ arch/s390/mm/gmap.c                | 2 +-
+ arch/s390/mm/hugetlbpage.c         | 4 ++--
+ arch/s390/mm/pageattr.c            | 2 +-
+ arch/s390/mm/pgtable.c             | 2 +-
+ arch/s390/mm/vmem.c                | 6 +++---
+ arch/sparc/mm/init_64.c            | 2 +-
+ arch/x86/kvm/mmu/mmu.c             | 2 +-
+ arch/x86/mm/fault.c                | 4 ++--
+ arch/x86/mm/ident_map.c            | 2 +-
+ arch/x86/mm/init_64.c              | 4 ++--
+ arch/x86/mm/kasan_init_64.c        | 2 +-
+ arch/x86/mm/mem_encrypt_identity.c | 2 +-
+ arch/x86/mm/pat/set_memory.c       | 6 +++---
+ arch/x86/mm/pgtable.c              | 2 +-
+ arch/x86/mm/pti.c                  | 2 +-
+ arch/x86/power/hibernate.c         | 2 +-
+ arch/x86/xen/mmu_pv.c              | 4 ++--
+ 20 files changed, 29 insertions(+), 29 deletions(-)
+
+diff --git a/arch/powerpc/mm/book3s64/pgtable.c b/arch/powerpc/mm/book3s64/pgtable.c
+index 3438ab72c346b..d975fb5d7cbe4 100644
+--- a/arch/powerpc/mm/book3s64/pgtable.c
++++ b/arch/powerpc/mm/book3s64/pgtable.c
+@@ -130,7 +130,7 @@ void set_pud_at(struct mm_struct *mm, unsigned long addr,
+       WARN_ON(pte_hw_valid(pud_pte(*pudp)));
+       assert_spin_locked(pud_lockptr(mm, pudp));
+-      WARN_ON(!(pud_large(pud)));
++      WARN_ON(!(pud_leaf(pud)));
+ #endif
+       trace_hugepage_set_pud(addr, pud_val(pud));
+       return set_pte_at(mm, addr, pudp_ptep(pudp), pud_pte(pud));
+diff --git a/arch/s390/boot/vmem.c b/arch/s390/boot/vmem.c
+index e3a4500a5a757..47e1f54c587ae 100644
+--- a/arch/s390/boot/vmem.c
++++ b/arch/s390/boot/vmem.c
+@@ -366,7 +366,7 @@ static void pgtable_pud_populate(p4d_t *p4d, unsigned long addr, unsigned long e
+                       }
+                       pmd = boot_crst_alloc(_SEGMENT_ENTRY_EMPTY);
+                       pud_populate(&init_mm, pud, pmd);
+-              } else if (pud_large(*pud)) {
++              } else if (pud_leaf(*pud)) {
+                       continue;
+               }
+               pgtable_pmd_populate(pud, addr, next, mode);
+diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
+index 1299b56e43f6f..12a7b86789259 100644
+--- a/arch/s390/include/asm/pgtable.h
++++ b/arch/s390/include/asm/pgtable.h
+@@ -730,7 +730,7 @@ static inline int pud_bad(pud_t pud)
+ {
+       unsigned long type = pud_val(pud) & _REGION_ENTRY_TYPE_MASK;
+-      if (type > _REGION_ENTRY_TYPE_R3 || pud_large(pud))
++      if (type > _REGION_ENTRY_TYPE_R3 || pud_leaf(pud))
+               return 1;
+       if (type < _REGION_ENTRY_TYPE_R3)
+               return 0;
+@@ -1398,7 +1398,7 @@ static inline unsigned long pud_deref(pud_t pud)
+       unsigned long origin_mask;
+       origin_mask = _REGION_ENTRY_ORIGIN;
+-      if (pud_large(pud))
++      if (pud_leaf(pud))
+               origin_mask = _REGION3_ENTRY_ORIGIN_LARGE;
+       return (unsigned long)__va(pud_val(pud) & origin_mask);
+ }
+diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
+index 8da39deb56ca4..08a7eca03daf7 100644
+--- a/arch/s390/mm/gmap.c
++++ b/arch/s390/mm/gmap.c
+@@ -596,7 +596,7 @@ int __gmap_link(struct gmap *gmap, unsigned long gaddr, unsigned long vmaddr)
+       pud = pud_offset(p4d, vmaddr);
+       VM_BUG_ON(pud_none(*pud));
+       /* large puds cannot yet be handled */
+-      if (pud_large(*pud))
++      if (pud_leaf(*pud))
+               return -EFAULT;
+       pmd = pmd_offset(pud, vmaddr);
+       VM_BUG_ON(pmd_none(*pmd));
+diff --git a/arch/s390/mm/hugetlbpage.c b/arch/s390/mm/hugetlbpage.c
+index 297a6d897d5a0..5f64f3d0fafbb 100644
+--- a/arch/s390/mm/hugetlbpage.c
++++ b/arch/s390/mm/hugetlbpage.c
+@@ -224,7 +224,7 @@ pte_t *huge_pte_offset(struct mm_struct *mm,
+               if (p4d_present(*p4dp)) {
+                       pudp = pud_offset(p4dp, addr);
+                       if (pud_present(*pudp)) {
+-                              if (pud_large(*pudp))
++                              if (pud_leaf(*pudp))
+                                       return (pte_t *) pudp;
+                               pmdp = pmd_offset(pudp, addr);
+                       }
+@@ -240,7 +240,7 @@ int pmd_huge(pmd_t pmd)
+ int pud_huge(pud_t pud)
+ {
+-      return pud_large(pud);
++      return pud_leaf(pud);
+ }
+ bool __init arch_hugetlb_valid_size(unsigned long size)
+diff --git a/arch/s390/mm/pageattr.c b/arch/s390/mm/pageattr.c
+index 631e3a4ee2de8..739185fc39ead 100644
+--- a/arch/s390/mm/pageattr.c
++++ b/arch/s390/mm/pageattr.c
+@@ -274,7 +274,7 @@ static int walk_pud_level(p4d_t *p4d, unsigned long addr, unsigned long end,
+               if (pud_none(*pudp))
+                       return -EINVAL;
+               next = pud_addr_end(addr, end);
+-              if (pud_large(*pudp)) {
++              if (pud_leaf(*pudp)) {
+                       need_split  = !!(flags & SET_MEMORY_4K);
+                       need_split |= !!(addr & ~PUD_MASK);
+                       need_split |= !!(addr + PUD_SIZE > next);
+diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
+index 99422926efe1b..3ff07b6bcd65a 100644
+--- a/arch/s390/mm/pgtable.c
++++ b/arch/s390/mm/pgtable.c
+@@ -470,7 +470,7 @@ static int pmd_lookup(struct mm_struct *mm, unsigned long addr, pmd_t **pmdp)
+               return -ENOENT;
+       /* Large PUDs are not supported yet. */
+-      if (pud_large(*pud))
++      if (pud_leaf(*pud))
+               return -EFAULT;
+       *pmdp = pmd_offset(pud, addr);
+diff --git a/arch/s390/mm/vmem.c b/arch/s390/mm/vmem.c
+index 186a020857cf6..84e173c02ab91 100644
+--- a/arch/s390/mm/vmem.c
++++ b/arch/s390/mm/vmem.c
+@@ -323,7 +323,7 @@ static int modify_pud_table(p4d_t *p4d, unsigned long addr, unsigned long end,
+               if (!add) {
+                       if (pud_none(*pud))
+                               continue;
+-                      if (pud_large(*pud)) {
++                      if (pud_leaf(*pud)) {
+                               if (IS_ALIGNED(addr, PUD_SIZE) &&
+                                   IS_ALIGNED(next, PUD_SIZE)) {
+                                       pud_clear(pud);
+@@ -344,7 +344,7 @@ static int modify_pud_table(p4d_t *p4d, unsigned long addr, unsigned long end,
+                       if (!pmd)
+                               goto out;
+                       pud_populate(&init_mm, pud, pmd);
+-              } else if (pud_large(*pud)) {
++              } else if (pud_leaf(*pud)) {
+                       continue;
+               }
+               ret = modify_pmd_table(pud, addr, next, add, direct);
+@@ -591,7 +591,7 @@ pte_t *vmem_get_alloc_pte(unsigned long addr, bool alloc)
+               if (!pmd)
+                       goto out;
+               pud_populate(&init_mm, pud, pmd);
+-      } else if (WARN_ON_ONCE(pud_large(*pud))) {
++      } else if (WARN_ON_ONCE(pud_leaf(*pud))) {
+               goto out;
+       }
+       pmd = pmd_offset(pud, addr);
+diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
+index f83017992eaae..d7db4e737218c 100644
+--- a/arch/sparc/mm/init_64.c
++++ b/arch/sparc/mm/init_64.c
+@@ -1665,7 +1665,7 @@ bool kern_addr_valid(unsigned long addr)
+       if (pud_none(*pud))
+               return false;
+-      if (pud_large(*pud))
++      if (pud_leaf(*pud))
+               return pfn_valid(pud_pfn(*pud));
+       pmd = pmd_offset(pud, addr);
+diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
+index 0544700ca50b8..e2c3573f53e43 100644
+--- a/arch/x86/kvm/mmu/mmu.c
++++ b/arch/x86/kvm/mmu/mmu.c
+@@ -3126,7 +3126,7 @@ static int host_pfn_mapping_level(struct kvm *kvm, gfn_t gfn,
+       if (pud_none(pud) || !pud_present(pud))
+               goto out;
+-      if (pud_large(pud)) {
++      if (pud_leaf(pud)) {
+               level = PG_LEVEL_1G;
+               goto out;
+       }
+diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
+index d6375b3c633bc..b01df023de04c 100644
+--- a/arch/x86/mm/fault.c
++++ b/arch/x86/mm/fault.c
+@@ -376,7 +376,7 @@ static void dump_pagetable(unsigned long address)
+               goto bad;
+       pr_cont("PUD %lx ", pud_val(*pud));
+-      if (!pud_present(*pud) || pud_large(*pud))
++      if (!pud_present(*pud) || pud_leaf(*pud))
+               goto out;
+       pmd = pmd_offset(pud, address);
+@@ -1037,7 +1037,7 @@ spurious_kernel_fault(unsigned long error_code, unsigned long address)
+       if (!pud_present(*pud))
+               return 0;
+-      if (pud_large(*pud))
++      if (pud_leaf(*pud))
+               return spurious_kernel_fault_check(error_code, (pte_t *) pud);
+       pmd = pmd_offset(pud, address);
+diff --git a/arch/x86/mm/ident_map.c b/arch/x86/mm/ident_map.c
+index f50cc210a9818..a204a332c71fc 100644
+--- a/arch/x86/mm/ident_map.c
++++ b/arch/x86/mm/ident_map.c
+@@ -33,7 +33,7 @@ static int ident_pud_init(struct x86_mapping_info *info, pud_t *pud_page,
+                       next = end;
+               /* if this is already a gbpage, this portion is already mapped */
+-              if (pud_large(*pud))
++              if (pud_leaf(*pud))
+                       continue;
+               /* Is using a gbpage allowed? */
+diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
+index a0dffaca6d2bf..534436c9d3997 100644
+--- a/arch/x86/mm/init_64.c
++++ b/arch/x86/mm/init_64.c
+@@ -617,7 +617,7 @@ phys_pud_init(pud_t *pud_page, unsigned long paddr, unsigned long paddr_end,
+               }
+               if (!pud_none(*pud)) {
+-                      if (!pud_large(*pud)) {
++                      if (!pud_leaf(*pud)) {
+                               pmd = pmd_offset(pud, 0);
+                               paddr_last = phys_pmd_init(pmd, paddr,
+                                                          paddr_end,
+@@ -1163,7 +1163,7 @@ remove_pud_table(pud_t *pud_start, unsigned long addr, unsigned long end,
+               if (!pud_present(*pud))
+                       continue;
+-              if (pud_large(*pud) &&
++              if (pud_leaf(*pud) &&
+                   IS_ALIGNED(addr, PUD_SIZE) &&
+                   IS_ALIGNED(next, PUD_SIZE)) {
+                       spin_lock(&init_mm.page_table_lock);
+diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c
+index 0302491d799d1..fcf508c52bdc5 100644
+--- a/arch/x86/mm/kasan_init_64.c
++++ b/arch/x86/mm/kasan_init_64.c
+@@ -115,7 +115,7 @@ static void __init kasan_populate_p4d(p4d_t *p4d, unsigned long addr,
+       pud = pud_offset(p4d, addr);
+       do {
+               next = pud_addr_end(addr, end);
+-              if (!pud_large(*pud))
++              if (!pud_leaf(*pud))
+                       kasan_populate_pud(pud, addr, next, nid);
+       } while (pud++, addr = next, addr != end);
+ }
+diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c
+index 0166ab1780ccb..ead3561359242 100644
+--- a/arch/x86/mm/mem_encrypt_identity.c
++++ b/arch/x86/mm/mem_encrypt_identity.c
+@@ -144,7 +144,7 @@ static pud_t __init *sme_prepare_pgd(struct sme_populate_pgd_data *ppd)
+               set_pud(pud, __pud(PUD_FLAGS | __pa(pmd)));
+       }
+-      if (pud_large(*pud))
++      if (pud_leaf(*pud))
+               return NULL;
+       return pud;
+diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
+index 1028804040463..135bb594df8b7 100644
+--- a/arch/x86/mm/pat/set_memory.c
++++ b/arch/x86/mm/pat/set_memory.c
+@@ -684,7 +684,7 @@ pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address,
+               return NULL;
+       *level = PG_LEVEL_1G;
+-      if (pud_large(*pud) || !pud_present(*pud))
++      if (pud_leaf(*pud) || !pud_present(*pud))
+               return (pte_t *)pud;
+       pmd = pmd_offset(pud, address);
+@@ -743,7 +743,7 @@ pmd_t *lookup_pmd_address(unsigned long address)
+               return NULL;
+       pud = pud_offset(p4d, address);
+-      if (pud_none(*pud) || pud_large(*pud) || !pud_present(*pud))
++      if (pud_none(*pud) || pud_leaf(*pud) || !pud_present(*pud))
+               return NULL;
+       return pmd_offset(pud, address);
+@@ -1278,7 +1278,7 @@ static void unmap_pud_range(p4d_t *p4d, unsigned long start, unsigned long end)
+        */
+       while (end - start >= PUD_SIZE) {
+-              if (pud_large(*pud))
++              if (pud_leaf(*pud))
+                       pud_clear(pud);
+               else
+                       unmap_pmd_range(pud, start, start + PUD_SIZE);
+diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
+index 0cbc1b8e8e3d1..a67bb8f982bd5 100644
+--- a/arch/x86/mm/pgtable.c
++++ b/arch/x86/mm/pgtable.c
+@@ -777,7 +777,7 @@ int pmd_set_huge(pmd_t *pmd, phys_addr_t addr, pgprot_t prot)
+  */
+ int pud_clear_huge(pud_t *pud)
+ {
+-      if (pud_large(*pud)) {
++      if (pud_leaf(*pud)) {
+               pud_clear(pud);
+               return 1;
+       }
+diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
+index 669ba1c345b38..912b1da7ed80c 100644
+--- a/arch/x86/mm/pti.c
++++ b/arch/x86/mm/pti.c
+@@ -217,7 +217,7 @@ static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address)
+       pud = pud_offset(p4d, address);
+       /* The user page tables do not use large mappings: */
+-      if (pud_large(*pud)) {
++      if (pud_leaf(*pud)) {
+               WARN_ON(1);
+               return NULL;
+       }
+diff --git a/arch/x86/power/hibernate.c b/arch/x86/power/hibernate.c
+index 6f955eb1e1631..d8af46e677503 100644
+--- a/arch/x86/power/hibernate.c
++++ b/arch/x86/power/hibernate.c
+@@ -170,7 +170,7 @@ int relocate_restore_code(void)
+               goto out;
+       }
+       pud = pud_offset(p4d, relocated_restore_code);
+-      if (pud_large(*pud)) {
++      if (pud_leaf(*pud)) {
+               set_pud(pud, __pud(pud_val(*pud) & ~_PAGE_NX));
+               goto out;
+       }
+diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
+index 72af496a160c8..994aef4473a65 100644
+--- a/arch/x86/xen/mmu_pv.c
++++ b/arch/x86/xen/mmu_pv.c
+@@ -1082,7 +1082,7 @@ static void __init xen_cleanmfnmap_pud(pud_t *pud, bool unpin)
+       pmd_t *pmd_tbl;
+       int i;
+-      if (pud_large(*pud)) {
++      if (pud_leaf(*pud)) {
+               pa = pud_val(*pud) & PHYSICAL_PAGE_MASK;
+               xen_free_ro_pages(pa, PUD_SIZE);
+               return;
+@@ -1863,7 +1863,7 @@ static phys_addr_t __init xen_early_virt_to_phys(unsigned long vaddr)
+       if (!pud_present(pud))
+               return 0;
+       pa = pud_val(pud) & PTE_PFN_MASK;
+-      if (pud_large(pud))
++      if (pud_leaf(pud))
+               return pa + (vaddr & ~PUD_MASK);
+       pmd = native_make_pmd(xen_read_phys_ulong(pa + pmd_index(vaddr) *
+-- 
+2.43.0
+
diff --git a/queue-6.8/modpost-do-not-make-find_tosym-return-null.patch b/queue-6.8/modpost-do-not-make-find_tosym-return-null.patch
new file mode 100644 (file)
index 0000000..d6d70a5
--- /dev/null
@@ -0,0 +1,54 @@
+From 5ede8130b2ce0d7e24650e47456e6d1d880b3f10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Mar 2024 20:45:11 +0900
+Subject: modpost: do not make find_tosym() return NULL
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 1102f9f85bf66b1a7bd6a40afb40efbbe05dfc05 ]
+
+As mentioned in commit 397586506c3d ("modpost: Add '.ltext' and
+'.ltext.*' to TEXT_SECTIONS"), modpost can result in a segmentation
+fault due to a NULL pointer dereference in default_mismatch_handler().
+
+find_tosym() can return the original symbol pointer instead of NULL
+if a better one is not found.
+
+This fixes the reported segmentation fault.
+
+Fixes: a23e7584ecf3 ("modpost: unify 'sym' and 'to' in default_mismatch_handler()")
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/mod/modpost.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 267b9a0a3abcd..6568f8177e392 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -1007,6 +1007,8 @@ static Elf_Sym *find_fromsym(struct elf_info *elf, Elf_Addr addr,
+ static Elf_Sym *find_tosym(struct elf_info *elf, Elf_Addr addr, Elf_Sym *sym)
+ {
++      Elf_Sym *new_sym;
++
+       /* If the supplied symbol has a valid name, return it */
+       if (is_valid_name(elf, sym))
+               return sym;
+@@ -1015,8 +1017,9 @@ static Elf_Sym *find_tosym(struct elf_info *elf, Elf_Addr addr, Elf_Sym *sym)
+        * Strive to find a better symbol name, but the resulting name may not
+        * match the symbol referenced in the original code.
+        */
+-      return symsearch_find_nearest(elf, addr, get_secindex(elf, sym),
+-                                    true, 20);
++      new_sym = symsearch_find_nearest(elf, addr, get_secindex(elf, sym),
++                                       true, 20);
++      return new_sym ? new_sym : sym;
+ }
+ static bool is_executable_section(struct elf_info *elf, unsigned int secndx)
+-- 
+2.43.0
+
diff --git a/queue-6.8/net-bcmasp-bring-up-unimac-after-phy-link-up.patch b/queue-6.8/net-bcmasp-bring-up-unimac-after-phy-link-up.patch
new file mode 100644 (file)
index 0000000..fcf5a92
--- /dev/null
@@ -0,0 +1,105 @@
+From 852dd25681292e8ee431ef28f61b0e041f242429 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Mar 2024 12:30:24 -0700
+Subject: net: bcmasp: Bring up unimac after PHY link up
+
+From: Justin Chen <justin.chen@broadcom.com>
+
+[ Upstream commit dfd222e2aef68818320a57b13a1c52a44c22bc80 ]
+
+The unimac requires the PHY RX clk during reset or it may be put
+into a bad state. Bring up the unimac after link up to ensure the
+PHY RX clk exists.
+
+Fixes: 490cb412007d ("net: bcmasp: Add support for ASP2.0 Ethernet controller")
+Signed-off-by: Justin Chen <justin.chen@broadcom.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/broadcom/asp2/bcmasp_intf.c  | 28 +++++++++++++------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c b/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c
+index 6ad1366270f79..78901e2e73032 100644
+--- a/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c
++++ b/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c
+@@ -391,7 +391,9 @@ static void umac_reset(struct bcmasp_intf *intf)
+       umac_wl(intf, 0x0, UMC_CMD);
+       umac_wl(intf, UMC_CMD_SW_RESET, UMC_CMD);
+       usleep_range(10, 100);
+-      umac_wl(intf, 0x0, UMC_CMD);
++      /* We hold the umac in reset and bring it out of
++       * reset when phy link is up.
++       */
+ }
+ static void umac_set_hw_addr(struct bcmasp_intf *intf,
+@@ -411,6 +413,8 @@ static void umac_enable_set(struct bcmasp_intf *intf, u32 mask,
+       u32 reg;
+       reg = umac_rl(intf, UMC_CMD);
++      if (reg & UMC_CMD_SW_RESET)
++              return;
+       if (enable)
+               reg |= mask;
+       else
+@@ -429,7 +433,6 @@ static void umac_init(struct bcmasp_intf *intf)
+       umac_wl(intf, 0x800, UMC_FRM_LEN);
+       umac_wl(intf, 0xffff, UMC_PAUSE_CNTRL);
+       umac_wl(intf, 0x800, UMC_RX_MAX_PKT_SZ);
+-      umac_enable_set(intf, UMC_CMD_PROMISC, 1);
+ }
+ static int bcmasp_tx_poll(struct napi_struct *napi, int budget)
+@@ -656,6 +659,12 @@ static void bcmasp_adj_link(struct net_device *dev)
+                       UMC_CMD_HD_EN | UMC_CMD_RX_PAUSE_IGNORE |
+                       UMC_CMD_TX_PAUSE_IGNORE);
+               reg |= cmd_bits;
++              if (reg & UMC_CMD_SW_RESET) {
++                      reg &= ~UMC_CMD_SW_RESET;
++                      umac_wl(intf, reg, UMC_CMD);
++                      udelay(2);
++                      reg |= UMC_CMD_TX_EN | UMC_CMD_RX_EN | UMC_CMD_PROMISC;
++              }
+               umac_wl(intf, reg, UMC_CMD);
+               intf->eee.eee_active = phy_init_eee(phydev, 0) >= 0;
+@@ -1063,9 +1072,6 @@ static int bcmasp_netif_init(struct net_device *dev, bool phy_connect)
+       umac_init(intf);
+-      /* Disable the UniMAC RX/TX */
+-      umac_enable_set(intf, (UMC_CMD_RX_EN | UMC_CMD_TX_EN), 0);
+-
+       umac_set_hw_addr(intf, dev->dev_addr);
+       intf->old_duplex = -1;
+@@ -1085,9 +1091,6 @@ static int bcmasp_netif_init(struct net_device *dev, bool phy_connect)
+       bcmasp_enable_rx(intf, 1);
+-      /* Turn on UniMAC TX/RX */
+-      umac_enable_set(intf, (UMC_CMD_RX_EN | UMC_CMD_TX_EN), 1);
+-
+       intf->crc_fwd = !!(umac_rl(intf, UMC_CMD) & UMC_CMD_CRC_FWD);
+       bcmasp_netif_start(dev);
+@@ -1324,7 +1327,14 @@ static void bcmasp_suspend_to_wol(struct bcmasp_intf *intf)
+       if (intf->wolopts & WAKE_FILTER)
+               bcmasp_netfilt_suspend(intf);
+-      /* UniMAC receive needs to be turned on */
++      /* Bring UniMAC out of reset if needed and enable RX */
++      reg = umac_rl(intf, UMC_CMD);
++      if (reg & UMC_CMD_SW_RESET)
++              reg &= ~UMC_CMD_SW_RESET;
++
++      reg |= UMC_CMD_RX_EN | UMC_CMD_PROMISC;
++      umac_wl(intf, reg, UMC_CMD);
++
+       umac_enable_set(intf, UMC_CMD_RX_EN, 1);
+       if (intf->parent->wol_irq > 0) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/net-hns3-fix-index-limit-to-support-all-queue-stats.patch b/queue-6.8/net-hns3-fix-index-limit-to-support-all-queue-stats.patch
new file mode 100644 (file)
index 0000000..1cb93ed
--- /dev/null
@@ -0,0 +1,40 @@
+From 5aa0a91a6858a446a5719b5d31ed7398c2bc9d53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Mar 2024 20:43:09 +0800
+Subject: net: hns3: fix index limit to support all queue stats
+
+From: Jie Wang <wangjie125@huawei.com>
+
+[ Upstream commit 47e39d213e09c6cae0d6b4d95e454ea404013312 ]
+
+Currently, hns hardware supports more than 512 queues and the index limit
+in hclge_comm_tqps_update_stats is wrong. So this patch removes it.
+
+Fixes: 287db5c40d15 ("net: hns3: create new set of common tqp stats APIs for PF and VF reuse")
+Signed-off-by: Jie Wang <wangjie125@huawei.com>
+Signed-off-by: Jijie Shao <shaojijie@huawei.com>
+Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
+Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c  | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c
+index f3c9395d8351c..618f66d9586b3 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c
+@@ -85,7 +85,7 @@ int hclge_comm_tqps_update_stats(struct hnae3_handle *handle,
+               hclge_comm_cmd_setup_basic_desc(&desc, HCLGE_OPC_QUERY_TX_STATS,
+                                               true);
+-              desc.data[0] = cpu_to_le32(tqp->index & 0x1ff);
++              desc.data[0] = cpu_to_le32(tqp->index);
+               ret = hclge_comm_cmd_send(hw, &desc, 1);
+               if (ret) {
+                       dev_err(&hw->cmq.csq.pdev->dev,
+-- 
+2.43.0
+
diff --git a/queue-6.8/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch b/queue-6.8/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
new file mode 100644 (file)
index 0000000..a350c56
--- /dev/null
@@ -0,0 +1,57 @@
+From 997f0fd61e67ef4785fd27db6fcb32cd7a393fd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Mar 2024 20:43:10 +0800
+Subject: net: hns3: fix kernel crash when devlink reload during pf
+ initialization
+
+From: Yonglong Liu <liuyonglong@huawei.com>
+
+[ Upstream commit 93305b77ffcb042f1538ecc383505e87d95aa05a ]
+
+The devlink reload process will access the hardware resources,
+but the register operation is done before the hardware is initialized.
+So, processing the devlink reload during initialization may lead to kernel
+crash. This patch fixes this by taking devl_lock during initialization.
+
+Fixes: b741269b2759 ("net: hns3: add support for registering devlink for PF")
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Jijie Shao <shaojijie@huawei.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 609d3799d7738..a3b7723a97bb1 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -11613,6 +11613,8 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)
+       if (ret)
+               goto err_pci_uninit;
++      devl_lock(hdev->devlink);
++
+       /* Firmware command queue initialize */
+       ret = hclge_comm_cmd_queue_init(hdev->pdev, &hdev->hw.hw);
+       if (ret)
+@@ -11792,6 +11794,7 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)
+       hclge_task_schedule(hdev, round_jiffies_relative(HZ));
++      devl_unlock(hdev->devlink);
+       return 0;
+ err_mdiobus_unreg:
+@@ -11804,6 +11807,7 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)
+ err_cmd_uninit:
+       hclge_comm_cmd_uninit(hdev->ae_dev, &hdev->hw.hw);
+ err_devlink_uninit:
++      devl_unlock(hdev->devlink);
+       hclge_devlink_uninit(hdev);
+ err_pci_uninit:
+       pcim_iounmap(pdev, hdev->hw.hw.io_base);
+-- 
+2.43.0
+
diff --git a/queue-6.8/net-hns3-mark-unexcuted-loopback-test-result-as-unex.patch b/queue-6.8/net-hns3-mark-unexcuted-loopback-test-result-as-unex.patch
new file mode 100644 (file)
index 0000000..5e5fc0b
--- /dev/null
@@ -0,0 +1,82 @@
+From b8bab6f905a69dbb669703d2e86f63758776df1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Mar 2024 20:43:11 +0800
+Subject: net: hns3: mark unexcuted loopback test result as UNEXECUTED
+
+From: Jian Shen <shenjian15@huawei.com>
+
+[ Upstream commit 5bd088d6c21a45ee70e6116879310e54174d75eb ]
+
+Currently, loopback test may be skipped when resetting, but the test
+result will still show as 'PASS', because the driver doesn't set
+ETH_TEST_FL_FAILED flag. Fix it by setting the flag and
+initializating the value to UNEXECUTED.
+
+Fixes: 4c8dab1c709c ("net: hns3: reconstruct function hns3_self_test")
+Signed-off-by: Jian Shen <shenjian15@huawei.com>
+Signed-off-by: Jijie Shao <shaojijie@huawei.com>
+Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/hisilicon/hns3/hns3_ethtool.c    | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+index 999a0ee162a64..941cb529d671f 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+@@ -78,6 +78,9 @@ static const struct hns3_stats hns3_rxq_stats[] = {
+ #define HNS3_NIC_LB_TEST_NO_MEM_ERR   1
+ #define HNS3_NIC_LB_TEST_TX_CNT_ERR   2
+ #define HNS3_NIC_LB_TEST_RX_CNT_ERR   3
++#define HNS3_NIC_LB_TEST_UNEXECUTED   4
++
++static int hns3_get_sset_count(struct net_device *netdev, int stringset);
+ static int hns3_lp_setup(struct net_device *ndev, enum hnae3_loop loop, bool en)
+ {
+@@ -418,18 +421,26 @@ static void hns3_do_external_lb(struct net_device *ndev,
+ static void hns3_self_test(struct net_device *ndev,
+                          struct ethtool_test *eth_test, u64 *data)
+ {
++      int cnt = hns3_get_sset_count(ndev, ETH_SS_TEST);
+       struct hns3_nic_priv *priv = netdev_priv(ndev);
+       struct hnae3_handle *h = priv->ae_handle;
+       int st_param[HNAE3_LOOP_NONE][2];
+       bool if_running = netif_running(ndev);
++      int i;
++
++      /* initialize the loopback test result, avoid marking an unexcuted
++       * loopback test as PASS.
++       */
++      for (i = 0; i < cnt; i++)
++              data[i] = HNS3_NIC_LB_TEST_UNEXECUTED;
+       if (hns3_nic_resetting(ndev)) {
+               netdev_err(ndev, "dev resetting!");
+-              return;
++              goto failure;
+       }
+       if (!(eth_test->flags & ETH_TEST_FL_OFFLINE))
+-              return;
++              goto failure;
+       if (netif_msg_ifdown(h))
+               netdev_info(ndev, "self test start\n");
+@@ -451,6 +462,10 @@ static void hns3_self_test(struct net_device *ndev,
+       if (netif_msg_ifdown(h))
+               netdev_info(ndev, "self test end\n");
++      return;
++
++failure:
++      eth_test->flags |= ETH_TEST_FL_FAILED;
+ }
+ static void hns3_update_limit_promisc_mode(struct net_device *netdev,
+-- 
+2.43.0
+
diff --git a/queue-6.8/net-hsr-hsr_slave-fix-the-promiscuous-mode-in-offloa.patch b/queue-6.8/net-hsr-hsr_slave-fix-the-promiscuous-mode-in-offloa.patch
new file mode 100644 (file)
index 0000000..f0c9703
--- /dev/null
@@ -0,0 +1,46 @@
+From 36c4d335f28911b3f2c9fbe503ad8f679b21f31e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2024 15:34:47 +0530
+Subject: net: hsr: hsr_slave: Fix the promiscuous mode in offload mode
+
+From: Ravi Gunasekaran <r-gunasekaran@ti.com>
+
+[ Upstream commit b11c81731c810efe592e510bb0110e0db6877419 ]
+
+commit e748d0fd66ab ("net: hsr: Disable promiscuous mode in
+offload mode") disables promiscuous mode of slave devices
+while creating an HSR interface. But while deleting the
+HSR interface, it does not take care of it. It decreases the
+promiscuous mode count, which eventually enables promiscuous
+mode on the slave devices when creating HSR interface again.
+
+Fix this by not decrementing the promiscuous mode count while
+deleting the HSR interface when offload is enabled.
+
+Fixes: e748d0fd66ab ("net: hsr: Disable promiscuous mode in offload mode")
+Signed-off-by: Ravi Gunasekaran <r-gunasekaran@ti.com>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Link: https://lore.kernel.org/r/20240322100447.27615-1-r-gunasekaran@ti.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/hsr/hsr_slave.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/hsr/hsr_slave.c b/net/hsr/hsr_slave.c
+index e5742f2a2d522..1b6457f357bdb 100644
+--- a/net/hsr/hsr_slave.c
++++ b/net/hsr/hsr_slave.c
+@@ -220,7 +220,8 @@ void hsr_del_port(struct hsr_port *port)
+               netdev_update_features(master->dev);
+               dev_set_mtu(master->dev, hsr_get_max_mtu(hsr));
+               netdev_rx_handler_unregister(port->dev);
+-              dev_set_promiscuity(port->dev, -1);
++              if (!port->hsr->fwd_offloaded)
++                      dev_set_promiscuity(port->dev, -1);
+               netdev_upper_dev_unlink(port->dev, master->dev);
+       }
+-- 
+2.43.0
+
diff --git a/queue-6.8/net-lan743x-add-set-rfe-read-fifo-threshold-for-pci1.patch b/queue-6.8/net-lan743x-add-set-rfe-read-fifo-threshold-for-pci1.patch
new file mode 100644 (file)
index 0000000..39caabd
--- /dev/null
@@ -0,0 +1,93 @@
+From bdde1f5e545bf1eed08d5f0c5a97a1b8e19221f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2024 12:28:05 +0530
+Subject: net: lan743x: Add set RFE read fifo threshold for PCI1x1x chips
+
+From: Raju Lakkaraju <Raju.Lakkaraju@microchip.com>
+
+[ Upstream commit e4a58989f5c839316ac63675e8800b9eed7dbe96 ]
+
+PCI11x1x Rev B0 devices might drop packets when receiving back to back frames
+at 2.5G link speed. Change the B0 Rev device's Receive filtering Engine FIFO
+threshold parameter from its hardware default of 4 to 3 dwords to prevent the
+problem. Rev C0 and later hardware already defaults to 3 dwords.
+
+Fixes: bb4f6bffe33c ("net: lan743x: Add PCI11010 / PCI11414 device IDs")
+Signed-off-by: Raju Lakkaraju <Raju.Lakkaraju@microchip.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://lore.kernel.org/r/20240326065805.686128-1-Raju.Lakkaraju@microchip.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microchip/lan743x_main.c | 18 ++++++++++++++++++
+ drivers/net/ethernet/microchip/lan743x_main.h |  4 ++++
+ 2 files changed, 22 insertions(+)
+
+diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
+index 45e209a7d0831..6bf3367404eba 100644
+--- a/drivers/net/ethernet/microchip/lan743x_main.c
++++ b/drivers/net/ethernet/microchip/lan743x_main.c
+@@ -25,6 +25,8 @@
+ #define PCS_POWER_STATE_DOWN  0x6
+ #define PCS_POWER_STATE_UP    0x4
++#define RFE_RD_FIFO_TH_3_DWORDS       0x3
++
+ static void pci11x1x_strap_get_status(struct lan743x_adapter *adapter)
+ {
+       u32 chip_rev;
+@@ -3272,6 +3274,21 @@ static void lan743x_full_cleanup(struct lan743x_adapter *adapter)
+       lan743x_pci_cleanup(adapter);
+ }
++static void pci11x1x_set_rfe_rd_fifo_threshold(struct lan743x_adapter *adapter)
++{
++      u16 rev = adapter->csr.id_rev & ID_REV_CHIP_REV_MASK_;
++
++      if (rev == ID_REV_CHIP_REV_PCI11X1X_B0_) {
++              u32 misc_ctl;
++
++              misc_ctl = lan743x_csr_read(adapter, MISC_CTL_0);
++              misc_ctl &= ~MISC_CTL_0_RFE_READ_FIFO_MASK_;
++              misc_ctl |= FIELD_PREP(MISC_CTL_0_RFE_READ_FIFO_MASK_,
++                                     RFE_RD_FIFO_TH_3_DWORDS);
++              lan743x_csr_write(adapter, MISC_CTL_0, misc_ctl);
++      }
++}
++
+ static int lan743x_hardware_init(struct lan743x_adapter *adapter,
+                                struct pci_dev *pdev)
+ {
+@@ -3287,6 +3304,7 @@ static int lan743x_hardware_init(struct lan743x_adapter *adapter,
+               pci11x1x_strap_get_status(adapter);
+               spin_lock_init(&adapter->eth_syslock_spinlock);
+               mutex_init(&adapter->sgmii_rw_lock);
++              pci11x1x_set_rfe_rd_fifo_threshold(adapter);
+       } else {
+               adapter->max_tx_channels = LAN743X_MAX_TX_CHANNELS;
+               adapter->used_tx_channels = LAN743X_USED_TX_CHANNELS;
+diff --git a/drivers/net/ethernet/microchip/lan743x_main.h b/drivers/net/ethernet/microchip/lan743x_main.h
+index be79cb0ae5af3..645bc048e52ef 100644
+--- a/drivers/net/ethernet/microchip/lan743x_main.h
++++ b/drivers/net/ethernet/microchip/lan743x_main.h
+@@ -26,6 +26,7 @@
+ #define ID_REV_CHIP_REV_MASK_         (0x0000FFFF)
+ #define ID_REV_CHIP_REV_A0_           (0x00000000)
+ #define ID_REV_CHIP_REV_B0_           (0x00000010)
++#define ID_REV_CHIP_REV_PCI11X1X_B0_  (0x000000B0)
+ #define FPGA_REV                      (0x04)
+ #define FPGA_REV_GET_MINOR_(fpga_rev) (((fpga_rev) >> 8) & 0x000000FF)
+@@ -311,6 +312,9 @@
+ #define SGMII_CTL_LINK_STATUS_SOURCE_ BIT(8)
+ #define SGMII_CTL_SGMII_POWER_DN_     BIT(1)
++#define MISC_CTL_0                    (0x920)
++#define MISC_CTL_0_RFE_READ_FIFO_MASK_        GENMASK(6, 4)
++
+ /* Vendor Specific SGMII MMD details */
+ #define SR_VSMMD_PCS_ID1              0x0004
+ #define SR_VSMMD_PCS_ID2              0x0005
+-- 
+2.43.0
+
diff --git a/queue-6.8/net-wwan-t7xx-split-64bit-accesses-to-fix-alignment-.patch b/queue-6.8/net-wwan-t7xx-split-64bit-accesses-to-fix-alignment-.patch
new file mode 100644 (file)
index 0000000..b3708e8
--- /dev/null
@@ -0,0 +1,162 @@
+From 4e819ceba75a7fd5b66d1fe05bceb456bb8ca358 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2024 15:40:00 +0100
+Subject: net: wwan: t7xx: Split 64bit accesses to fix alignment issues
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bjørn Mork <bjorn@mork.no>
+
+[ Upstream commit 7d5a7dd5a35876f0ecc286f3602a88887a788217 ]
+
+Some of the registers are aligned on a 32bit boundary, causing
+alignment faults on 64bit platforms.
+
+ Unable to handle kernel paging request at virtual address ffffffc084a1d004
+ Mem abort info:
+ ESR = 0x0000000096000061
+ EC = 0x25: DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+ FSC = 0x21: alignment fault
+ Data abort info:
+ ISV = 0, ISS = 0x00000061, ISS2 = 0x00000000
+ CM = 0, WnR = 1, TnD = 0, TagAccess = 0
+ GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
+ swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000046ad6000
+ [ffffffc084a1d004] pgd=100000013ffff003, p4d=100000013ffff003, pud=100000013ffff003, pmd=0068000020a00711
+ Internal error: Oops: 0000000096000061 [#1] SMP
+ Modules linked in: mtk_t7xx(+) qcserial pppoe ppp_async option nft_fib_inet nf_flow_table_inet mt7921u(O) mt7921s(O) mt7921e(O) mt7921_common(O) iwlmvm(O) iwldvm(O) usb_wwan rndis_host qmi_wwan pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mt7996e(O) mt792x_usb(O) mt792x_lib(O) mt7915e(O) mt76_usb(O) mt76_sdio(O) mt76_connac_lib(O) mt76(O) mac80211(O) iwlwifi(O) huawei_cdc_ncm cfg80211(O) cdc_ncm cdc_ether wwan usbserial usbnet slhc sfp rtc_pcf8563 nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 mt6577_auxadc mdio_i2c libcrc32c compat(O) cdc_wdm cdc_acm at24 crypto_safexcel pwm_fan i2c_gpio i2c_smbus industrialio i2c_algo_bit i2c_mux_reg i2c_mux_pca954x i2c_mux_pca9541 i2c_mux_gpio i2c_mux dummy oid_registry tun sha512_arm64 sha1_ce sha1_generic seqiv
+ md5 geniv des_generic libdes cbc authencesn authenc leds_gpio xhci_plat_hcd xhci_pci xhci_mtk_hcd xhci_hcd nvme nvme_core gpio_button_hotplug(O) dm_mirror dm_region_hash dm_log dm_crypt dm_mod dax usbcore usb_common ptp aquantia pps_core mii tpm encrypted_keys trusted
+ CPU: 3 PID: 5266 Comm: kworker/u9:1 Tainted: G O 6.6.22 #0
+ Hardware name: Bananapi BPI-R4 (DT)
+ Workqueue: md_hk_wq t7xx_fsm_uninit [mtk_t7xx]
+ pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+ pc : t7xx_cldma_hw_set_start_addr+0x1c/0x3c [mtk_t7xx]
+ lr : t7xx_cldma_start+0xac/0x13c [mtk_t7xx]
+ sp : ffffffc085d63d30
+ x29: ffffffc085d63d30 x28: 0000000000000000 x27: 0000000000000000
+ x26: 0000000000000000 x25: ffffff80c804f2c0 x24: ffffff80ca196c05
+ x23: 0000000000000000 x22: ffffff80c814b9b8 x21: ffffff80c814b128
+ x20: 0000000000000001 x19: ffffff80c814b080 x18: 0000000000000014
+ x17: 0000000055c9806b x16: 000000007c5296d0 x15: 000000000f6bca68
+ x14: 00000000dbdbdce4 x13: 000000001aeaf72a x12: 0000000000000001
+ x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
+ x8 : ffffff80ca1ef6b4 x7 : ffffff80c814b818 x6 : 0000000000000018
+ x5 : 0000000000000870 x4 : 0000000000000000 x3 : 0000000000000000
+ x2 : 000000010a947000 x1 : ffffffc084a1d004 x0 : ffffffc084a1d004
+ Call trace:
+ t7xx_cldma_hw_set_start_addr+0x1c/0x3c [mtk_t7xx]
+ t7xx_fsm_uninit+0x578/0x5ec [mtk_t7xx]
+ process_one_work+0x154/0x2a0
+ worker_thread+0x2ac/0x488
+ kthread+0xe0/0xec
+ ret_from_fork+0x10/0x20
+ Code: f9400800 91001000 8b214001 d50332bf (f9000022)
+ ---[ end trace 0000000000000000 ]---
+
+The inclusion of io-64-nonatomic-lo-hi.h indicates that all 64bit
+accesses can be replaced by pairs of nonatomic 32bit access.  Fix
+alignment by forcing all accesses to be 32bit on 64bit platforms.
+
+Link: https://forum.openwrt.org/t/fibocom-fm350-gl-support/142682/72
+Fixes: 39d439047f1d ("net: wwan: t7xx: Add control DMA interface")
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Reviewed-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
+Tested-by: Liviu Dudau <liviu@dudau.co.uk>
+Link: https://lore.kernel.org/r/20240322144000.1683822-1-bjorn@mork.no
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wwan/t7xx/t7xx_cldma.c     | 4 ++--
+ drivers/net/wwan/t7xx/t7xx_hif_cldma.c | 9 +++++----
+ drivers/net/wwan/t7xx/t7xx_pcie_mac.c  | 8 ++++----
+ 3 files changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/wwan/t7xx/t7xx_cldma.c b/drivers/net/wwan/t7xx/t7xx_cldma.c
+index 9f43f256db1d0..f0a4783baf1f3 100644
+--- a/drivers/net/wwan/t7xx/t7xx_cldma.c
++++ b/drivers/net/wwan/t7xx/t7xx_cldma.c
+@@ -106,7 +106,7 @@ bool t7xx_cldma_tx_addr_is_set(struct t7xx_cldma_hw *hw_info, unsigned int qno)
+ {
+       u32 offset = REG_CLDMA_UL_START_ADDRL_0 + qno * ADDR_SIZE;
+-      return ioread64(hw_info->ap_pdn_base + offset);
++      return ioread64_lo_hi(hw_info->ap_pdn_base + offset);
+ }
+ void t7xx_cldma_hw_set_start_addr(struct t7xx_cldma_hw *hw_info, unsigned int qno, u64 address,
+@@ -117,7 +117,7 @@ void t7xx_cldma_hw_set_start_addr(struct t7xx_cldma_hw *hw_info, unsigned int qn
+       reg = tx_rx == MTK_RX ? hw_info->ap_ao_base + REG_CLDMA_DL_START_ADDRL_0 :
+                               hw_info->ap_pdn_base + REG_CLDMA_UL_START_ADDRL_0;
+-      iowrite64(address, reg + offset);
++      iowrite64_lo_hi(address, reg + offset);
+ }
+ void t7xx_cldma_hw_resume_queue(struct t7xx_cldma_hw *hw_info, unsigned int qno,
+diff --git a/drivers/net/wwan/t7xx/t7xx_hif_cldma.c b/drivers/net/wwan/t7xx/t7xx_hif_cldma.c
+index cc70360364b7d..554ba4669cc8d 100644
+--- a/drivers/net/wwan/t7xx/t7xx_hif_cldma.c
++++ b/drivers/net/wwan/t7xx/t7xx_hif_cldma.c
+@@ -139,8 +139,9 @@ static int t7xx_cldma_gpd_rx_from_q(struct cldma_queue *queue, int budget, bool
+                               return -ENODEV;
+                       }
+-                      gpd_addr = ioread64(hw_info->ap_pdn_base + REG_CLDMA_DL_CURRENT_ADDRL_0 +
+-                                          queue->index * sizeof(u64));
++                      gpd_addr = ioread64_lo_hi(hw_info->ap_pdn_base +
++                                                REG_CLDMA_DL_CURRENT_ADDRL_0 +
++                                                queue->index * sizeof(u64));
+                       if (req->gpd_addr == gpd_addr || hwo_polling_count++ >= 100)
+                               return 0;
+@@ -318,8 +319,8 @@ static void t7xx_cldma_txq_empty_hndl(struct cldma_queue *queue)
+               struct t7xx_cldma_hw *hw_info = &md_ctrl->hw_info;
+               /* Check current processing TGPD, 64-bit address is in a table by Q index */
+-              ul_curr_addr = ioread64(hw_info->ap_pdn_base + REG_CLDMA_UL_CURRENT_ADDRL_0 +
+-                                      queue->index * sizeof(u64));
++              ul_curr_addr = ioread64_lo_hi(hw_info->ap_pdn_base + REG_CLDMA_UL_CURRENT_ADDRL_0 +
++                                            queue->index * sizeof(u64));
+               if (req->gpd_addr != ul_curr_addr) {
+                       spin_unlock_irqrestore(&md_ctrl->cldma_lock, flags);
+                       dev_err(md_ctrl->dev, "CLDMA%d queue %d is not empty\n",
+diff --git a/drivers/net/wwan/t7xx/t7xx_pcie_mac.c b/drivers/net/wwan/t7xx/t7xx_pcie_mac.c
+index 76da4c15e3de1..f071ec7ff23d5 100644
+--- a/drivers/net/wwan/t7xx/t7xx_pcie_mac.c
++++ b/drivers/net/wwan/t7xx/t7xx_pcie_mac.c
+@@ -75,7 +75,7 @@ static void t7xx_pcie_mac_atr_tables_dis(void __iomem *pbase, enum t7xx_atr_src_
+       for (i = 0; i < ATR_TABLE_NUM_PER_ATR; i++) {
+               offset = ATR_PORT_OFFSET * port + ATR_TABLE_OFFSET * i;
+               reg = pbase + ATR_PCIE_WIN0_T0_ATR_PARAM_SRC_ADDR + offset;
+-              iowrite64(0, reg);
++              iowrite64_lo_hi(0, reg);
+       }
+ }
+@@ -112,17 +112,17 @@ static int t7xx_pcie_mac_atr_cfg(struct t7xx_pci_dev *t7xx_dev, struct t7xx_atr_
+       reg = pbase + ATR_PCIE_WIN0_T0_TRSL_ADDR + offset;
+       value = cfg->trsl_addr & ATR_PCIE_WIN0_ADDR_ALGMT;
+-      iowrite64(value, reg);
++      iowrite64_lo_hi(value, reg);
+       reg = pbase + ATR_PCIE_WIN0_T0_TRSL_PARAM + offset;
+       iowrite32(cfg->trsl_id, reg);
+       reg = pbase + ATR_PCIE_WIN0_T0_ATR_PARAM_SRC_ADDR + offset;
+       value = (cfg->src_addr & ATR_PCIE_WIN0_ADDR_ALGMT) | (atr_size << 1) | BIT(0);
+-      iowrite64(value, reg);
++      iowrite64_lo_hi(value, reg);
+       /* Ensure ATR is set */
+-      ioread64(reg);
++      ioread64_lo_hi(reg);
+       return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/netfilter-nf_tables-reject-destroy-command-to-remove.patch b/queue-6.8/netfilter-nf_tables-reject-destroy-command-to-remove.patch
new file mode 100644 (file)
index 0000000..daa3b57
--- /dev/null
@@ -0,0 +1,37 @@
+From 215fac04bcb5388ec6f4b30dc214d6c484af1106 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Mar 2024 01:27:50 +0100
+Subject: netfilter: nf_tables: reject destroy command to remove basechain
+ hooks
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit b32ca27fa238ff83427d23bef2a5b741e2a88a1e ]
+
+Report EOPNOTSUPP if NFT_MSG_DESTROYCHAIN is used to delete hooks in an
+existing netdev basechain, thus, only NFT_MSG_DELCHAIN is allowed.
+
+Fixes: 7d937b107108f ("netfilter: nf_tables: support for deleting devices in an existing netdev chain")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index ec6266c1972c0..00288b31f734c 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -2932,7 +2932,8 @@ static int nf_tables_delchain(struct sk_buff *skb, const struct nfnl_info *info,
+       nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla);
+       if (nla[NFTA_CHAIN_HOOK]) {
+-              if (chain->flags & NFT_CHAIN_HW_OFFLOAD)
++              if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYCHAIN ||
++                  chain->flags & NFT_CHAIN_HW_OFFLOAD)
+                       return -EOPNOTSUPP;
+               if (nft_is_base_chain(chain)) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/netfilter-nf_tables-reject-table-flag-and-netdev-bas.patch b/queue-6.8/netfilter-nf_tables-reject-table-flag-and-netdev-bas.patch
new file mode 100644 (file)
index 0000000..996c159
--- /dev/null
@@ -0,0 +1,99 @@
+From 24c3a7d923529a5cb7754cedc7c94e8ab519bf09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Mar 2024 01:27:59 +0100
+Subject: netfilter: nf_tables: reject table flag and netdev basechain updates
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 1e1fb6f00f52812277963365d9bd835b9b0ea4e0 ]
+
+netdev basechain updates are stored in the transaction object hook list.
+When setting on the table dormant flag, it iterates over the existing
+hooks in the basechain. Thus, skipping the hooks that are being
+added/deleted in this transaction, which leaves hook registration in
+inconsistent state.
+
+Reject table flag updates in combination with netdev basechain updates
+in the same batch:
+
+- Update table flags and add/delete basechain: Check from basechain update
+  path if there are pending flag updates for this table.
+- add/delete basechain and update table flags: Iterate over the transaction
+  list to search for basechain updates from the table update path.
+
+In both cases, the batch is rejected. Based on suggestion from Florian Westphal.
+
+Fixes: b9703ed44ffb ("netfilter: nf_tables: support for adding new devices to an existing netdev chain")
+Fixes: 7d937b107108f ("netfilter: nf_tables: support for deleting devices in an existing netdev chain")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 31 ++++++++++++++++++++++++++++++-
+ 1 file changed, 30 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 00288b31f734c..db233965631bb 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -1198,6 +1198,25 @@ static void nf_tables_table_disable(struct net *net, struct nft_table *table)
+ #define __NFT_TABLE_F_UPDATE          (__NFT_TABLE_F_WAS_DORMANT | \
+                                        __NFT_TABLE_F_WAS_AWAKEN)
++static bool nft_table_pending_update(const struct nft_ctx *ctx)
++{
++      struct nftables_pernet *nft_net = nft_pernet(ctx->net);
++      struct nft_trans *trans;
++
++      if (ctx->table->flags & __NFT_TABLE_F_UPDATE)
++              return true;
++
++      list_for_each_entry(trans, &nft_net->commit_list, list) {
++              if ((trans->msg_type == NFT_MSG_NEWCHAIN ||
++                   trans->msg_type == NFT_MSG_DELCHAIN) &&
++                  trans->ctx.table == ctx->table &&
++                  nft_trans_chain_update(trans))
++                      return true;
++      }
++
++      return false;
++}
++
+ static int nf_tables_updtable(struct nft_ctx *ctx)
+ {
+       struct nft_trans *trans;
+@@ -1221,7 +1240,7 @@ static int nf_tables_updtable(struct nft_ctx *ctx)
+               return -EOPNOTSUPP;
+       /* No dormant off/on/off/on games in single transaction */
+-      if (ctx->table->flags & __NFT_TABLE_F_UPDATE)
++      if (nft_table_pending_update(ctx))
+               return -EINVAL;
+       trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
+@@ -2619,6 +2638,13 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
+               }
+       }
++      if (table->flags & __NFT_TABLE_F_UPDATE &&
++          !list_empty(&hook.list)) {
++              NL_SET_BAD_ATTR(extack, attr);
++              err = -EOPNOTSUPP;
++              goto err_hooks;
++      }
++
+       if (!(table->flags & NFT_TABLE_F_DORMANT) &&
+           nft_is_base_chain(chain) &&
+           !list_empty(&hook.list)) {
+@@ -2848,6 +2874,9 @@ static int nft_delchain_hook(struct nft_ctx *ctx,
+       struct nft_trans *trans;
+       int err;
++      if (ctx->table->flags & __NFT_TABLE_F_UPDATE)
++              return -EOPNOTSUPP;
++
+       err = nft_chain_parse_hook(ctx->net, basechain, nla, &chain_hook,
+                                  ctx->family, chain->flags, extack);
+       if (err < 0)
+-- 
+2.43.0
+
diff --git a/queue-6.8/netfilter-nf_tables-skip-netdev-hook-unregistration-.patch b/queue-6.8/netfilter-nf_tables-skip-netdev-hook-unregistration-.patch
new file mode 100644 (file)
index 0000000..279bd74
--- /dev/null
@@ -0,0 +1,59 @@
+From cde5c117c02c65dcbf8178532de396e9eb8d00a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Mar 2024 01:28:07 +0100
+Subject: netfilter: nf_tables: skip netdev hook unregistration if table is
+ dormant
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 216e7bf7402caf73f4939a8e0248392e96d7c0da ]
+
+Skip hook unregistration when adding or deleting devices from an
+existing netdev basechain. Otherwise, commit/abort path try to
+unregister hooks which not enabled.
+
+Fixes: b9703ed44ffb ("netfilter: nf_tables: support for adding new devices to an existing netdev chain")
+Fixes: 7d937b107108 ("netfilter: nf_tables: support for deleting devices in an existing netdev chain")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index db233965631bb..8ccda4af3f80d 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -10208,9 +10208,11 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
+                       if (nft_trans_chain_update(trans)) {
+                               nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN,
+                                                      &nft_trans_chain_hooks(trans));
+-                              nft_netdev_unregister_hooks(net,
+-                                                          &nft_trans_chain_hooks(trans),
+-                                                          true);
++                              if (!(trans->ctx.table->flags & NFT_TABLE_F_DORMANT)) {
++                                      nft_netdev_unregister_hooks(net,
++                                                                  &nft_trans_chain_hooks(trans),
++                                                                  true);
++                              }
+                       } else {
+                               nft_chain_del(trans->ctx.chain);
+                               nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN,
+@@ -10482,9 +10484,11 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
+                       break;
+               case NFT_MSG_NEWCHAIN:
+                       if (nft_trans_chain_update(trans)) {
+-                              nft_netdev_unregister_hooks(net,
+-                                                          &nft_trans_chain_hooks(trans),
+-                                                          true);
++                              if (!(trans->ctx.table->flags & NFT_TABLE_F_DORMANT)) {
++                                      nft_netdev_unregister_hooks(net,
++                                                                  &nft_trans_chain_hooks(trans),
++                                                                  true);
++                              }
+                               free_percpu(nft_trans_chain_stats(trans));
+                               kfree(nft_trans_chain_name(trans));
+                               nft_trans_destroy(trans);
+-- 
+2.43.0
+
diff --git a/queue-6.8/nfc-nci-fix-uninit-value-in-nci_dev_up-and-nci_ntf_p.patch b/queue-6.8/nfc-nci-fix-uninit-value-in-nci_dev_up-and-nci_ntf_p.patch
new file mode 100644 (file)
index 0000000..a7f2562
--- /dev/null
@@ -0,0 +1,53 @@
+From 5dee6c3d953de0bf14841fdfc896f92eaab31548 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Mar 2024 09:54:10 +0900
+Subject: nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
+
+From: Ryosuke Yasuoka <ryasuoka@redhat.com>
+
+[ Upstream commit d24b03535e5eb82e025219c2f632b485409c898f ]
+
+syzbot reported the following uninit-value access issue [1][2]:
+
+nci_rx_work() parses and processes received packet. When the payload
+length is zero, each message type handler reads uninitialized payload
+and KMSAN detects this issue. The receipt of a packet with a zero-size
+payload is considered unexpected, and therefore, such packets should be
+silently discarded.
+
+This patch resolved this issue by checking payload size before calling
+each message type handler codes.
+
+Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation")
+Reported-and-tested-by: syzbot+7ea9413ea6749baf5574@syzkaller.appspotmail.com
+Reported-and-tested-by: syzbot+29b5ca705d2e0f4a44d2@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=7ea9413ea6749baf5574 [1]
+Closes: https://syzkaller.appspot.com/bug?extid=29b5ca705d2e0f4a44d2 [2]
+Signed-off-by: Ryosuke Yasuoka <ryasuoka@redhat.com>
+Reviewed-by: Jeremy Cline <jeremy@jcline.org>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/nfc/nci/core.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
+index cdad47b140fa4..0d26c8ec9993e 100644
+--- a/net/nfc/nci/core.c
++++ b/net/nfc/nci/core.c
+@@ -1516,6 +1516,11 @@ static void nci_rx_work(struct work_struct *work)
+               nfc_send_to_raw_sock(ndev->nfc_dev, skb,
+                                    RAW_PAYLOAD_NCI, NFC_DIRECTION_RX);
++              if (!nci_plen(skb->data)) {
++                      kfree_skb(skb);
++                      break;
++              }
++
+               /* Process frame */
+               switch (nci_mt(skb->data)) {
+               case NCI_MT_RSP_PKT:
+-- 
+2.43.0
+
diff --git a/queue-6.8/nfsd-fix-error-cleanup-path-in-nfsd_rename.patch b/queue-6.8/nfsd-fix-error-cleanup-path-in-nfsd_rename.patch
new file mode 100644 (file)
index 0000000..ab8db0f
--- /dev/null
@@ -0,0 +1,48 @@
+From cb45d2959913f0f89a9cceaeb7789b340645d014 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Mar 2024 17:32:09 +0100
+Subject: nfsd: Fix error cleanup path in nfsd_rename()
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit 9fe6e9e7b58944037714442384075c17cfde1c56 ]
+
+Commit a8b0026847b8 ("rename(): avoid a deadlock in the case of parents
+having no common ancestor") added an error bail out path. However this
+path does not drop the remount protection that has been acquired. Fix
+the cleanup path to properly drop the remount protection.
+
+Fixes: a8b0026847b8 ("rename(): avoid a deadlock in the case of parents having no common ancestor")
+Signed-off-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Acked-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/vfs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index b7c7a9273ea01..4ed1e83defa23 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -1833,7 +1833,7 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen,
+       trap = lock_rename(tdentry, fdentry);
+       if (IS_ERR(trap)) {
+               err = (rqstp->rq_vers == 2) ? nfserr_acces : nfserr_xdev;
+-              goto out;
++              goto out_want_write;
+       }
+       err = fh_fill_pre_attrs(ffhp);
+       if (err != nfs_ok)
+@@ -1903,6 +1903,7 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen,
+       }
+ out_unlock:
+       unlock_rename(tdentry, fdentry);
++out_want_write:
+       fh_drop_write(ffhp);
+       /*
+-- 
+2.43.0
+
diff --git a/queue-6.8/octeontx2-af-fix-pause-frame-configuration-in-gmp-mo.patch b/queue-6.8/octeontx2-af-fix-pause-frame-configuration-in-gmp-mo.patch
new file mode 100644 (file)
index 0000000..ad4b742
--- /dev/null
@@ -0,0 +1,46 @@
+From 23abf4b0b8c4796b77d0a0e03cde859448955f68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2024 10:57:20 +0530
+Subject: Octeontx2-af: fix pause frame configuration in GMP mode
+
+From: Hariprasad Kelam <hkelam@marvell.com>
+
+[ Upstream commit 40d4b4807cadd83fb3f46cc8cd67a945b5b25461 ]
+
+The Octeontx2 MAC block (CGX) has separate data paths (SMU and GMP) for
+different speeds, allowing for efficient data transfer.
+
+The previous patch which added pause frame configuration has a bug due
+to which pause frame feature is not working in GMP mode.
+
+This patch fixes the issue by configurating appropriate registers.
+
+Fixes: f7e086e754fe ("octeontx2-af: Pause frame configuration at cgx")
+Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://lore.kernel.org/r/20240326052720.4441-1-hkelam@marvell.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+index 3c0f55b3e48ea..b86f3224f0b78 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+@@ -808,6 +808,11 @@ static int cgx_lmac_enadis_pause_frm(void *cgxd, int lmac_id,
+       if (!is_lmac_valid(cgx, lmac_id))
+               return -ENODEV;
++      cfg = cgx_read(cgx, lmac_id, CGXX_GMP_GMI_RXX_FRM_CTL);
++      cfg &= ~CGX_GMP_GMI_RXX_FRM_CTL_CTL_BCK;
++      cfg |= rx_pause ? CGX_GMP_GMI_RXX_FRM_CTL_CTL_BCK : 0x0;
++      cgx_write(cgx, lmac_id, CGXX_GMP_GMI_RXX_FRM_CTL, cfg);
++
+       cfg = cgx_read(cgx, lmac_id, CGXX_SMUX_RX_FRM_CTL);
+       cfg &= ~CGX_SMUX_RX_FRM_CTL_CTL_BCK;
+       cfg |= rx_pause ? CGX_SMUX_RX_FRM_CTL_CTL_BCK : 0x0;
+-- 
+2.43.0
+
diff --git a/queue-6.8/revert-x86-mm-ident_map-use-gbpages-only-where-full-.patch b/queue-6.8/revert-x86-mm-ident_map-use-gbpages-only-where-full-.patch
new file mode 100644 (file)
index 0000000..efa2a5a
--- /dev/null
@@ -0,0 +1,80 @@
+From ca7d59f8b0da69525bd6288eee3f2786773eb5db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Mar 2024 11:47:51 +0100
+Subject: Revert "x86/mm/ident_map: Use gbpages only where full GB page should
+ be mapped."
+
+From: Ingo Molnar <mingo@kernel.org>
+
+[ Upstream commit c567f2948f57bdc03ed03403ae0234085f376b7d ]
+
+This reverts commit d794734c9bbfe22f86686dc2909c25f5ffe1a572.
+
+While the original change tries to fix a bug, it also unintentionally broke
+existing systems, see the regressions reported at:
+
+  https://lore.kernel.org/all/3a1b9909-45ac-4f97-ad68-d16ef1ce99db@pavinjoseph.com/
+
+Since d794734c9bbf was also marked for -stable, let's back it out before
+causing more damage.
+
+Note that due to another upstream change the revert was not 100% automatic:
+
+  0a845e0f6348 mm/treewide: replace pud_large() with pud_leaf()
+
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: <stable@vger.kernel.org>
+Cc: Russ Anderson <rja@hpe.com>
+Cc: Steve Wahl <steve.wahl@hpe.com>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Link: https://lore.kernel.org/all/3a1b9909-45ac-4f97-ad68-d16ef1ce99db@pavinjoseph.com/
+Fixes: d794734c9bbf ("x86/mm/ident_map: Use gbpages only where full GB page should be mapped.")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/mm/ident_map.c | 23 +++++------------------
+ 1 file changed, 5 insertions(+), 18 deletions(-)
+
+diff --git a/arch/x86/mm/ident_map.c b/arch/x86/mm/ident_map.c
+index a204a332c71fc..968d7005f4a72 100644
+--- a/arch/x86/mm/ident_map.c
++++ b/arch/x86/mm/ident_map.c
+@@ -26,31 +26,18 @@ static int ident_pud_init(struct x86_mapping_info *info, pud_t *pud_page,
+       for (; addr < end; addr = next) {
+               pud_t *pud = pud_page + pud_index(addr);
+               pmd_t *pmd;
+-              bool use_gbpage;
+               next = (addr & PUD_MASK) + PUD_SIZE;
+               if (next > end)
+                       next = end;
+-              /* if this is already a gbpage, this portion is already mapped */
+-              if (pud_leaf(*pud))
+-                      continue;
+-
+-              /* Is using a gbpage allowed? */
+-              use_gbpage = info->direct_gbpages;
+-
+-              /* Don't use gbpage if it maps more than the requested region. */
+-              /* at the begining: */
+-              use_gbpage &= ((addr & ~PUD_MASK) == 0);
+-              /* ... or at the end: */
+-              use_gbpage &= ((next & ~PUD_MASK) == 0);
+-
+-              /* Never overwrite existing mappings */
+-              use_gbpage &= !pud_present(*pud);
+-
+-              if (use_gbpage) {
++              if (info->direct_gbpages) {
+                       pud_t pudval;
++                      if (pud_present(*pud))
++                              continue;
++
++                      addr &= PUD_MASK;
+                       pudval = __pud((addr - info->offset) | info->page_flag);
+                       set_pud(pud, pudval);
+                       continue;
+-- 
+2.43.0
+
diff --git a/queue-6.8/s390-bpf-fix-bpf_plt-pointer-arithmetic.patch b/queue-6.8/s390-bpf-fix-bpf_plt-pointer-arithmetic.patch
new file mode 100644 (file)
index 0000000..64f748f
--- /dev/null
@@ -0,0 +1,163 @@
+From 1a12c6969579b7f5124906a1c927afb91caf391c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Mar 2024 02:54:12 +0100
+Subject: s390/bpf: Fix bpf_plt pointer arithmetic
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit 7ded842b356d151ece8ac4985940438e6d3998bb ]
+
+Kui-Feng Lee reported a crash on s390x triggered by the
+dummy_st_ops/dummy_init_ptr_arg test [1]:
+
+  [<0000000000000002>] 0x2
+  [<00000000009d5cde>] bpf_struct_ops_test_run+0x156/0x250
+  [<000000000033145a>] __sys_bpf+0xa1a/0xd00
+  [<00000000003319dc>] __s390x_sys_bpf+0x44/0x50
+  [<0000000000c4382c>] __do_syscall+0x244/0x300
+  [<0000000000c59a40>] system_call+0x70/0x98
+
+This is caused by GCC moving memcpy() after assignments in
+bpf_jit_plt(), resulting in NULL pointers being written instead of
+the return and the target addresses.
+
+Looking at the GCC internals, the reordering is allowed because the
+alias analysis thinks that the memcpy() destination and the assignments'
+left-hand-sides are based on different objects: new_plt and
+bpf_plt_ret/bpf_plt_target respectively, and therefore they cannot
+alias.
+
+This is in turn due to a violation of the C standard:
+
+  When two pointers are subtracted, both shall point to elements of the
+  same array object, or one past the last element of the array object
+  ...
+
+From the C's perspective, bpf_plt_ret and bpf_plt are distinct objects
+and cannot be subtracted. In the practical terms, doing so confuses the
+GCC's alias analysis.
+
+The code was written this way in order to let the C side know a few
+offsets defined in the assembly. While nice, this is by no means
+necessary. Fix the noncompliance by hardcoding these offsets.
+
+[1] https://lore.kernel.org/bpf/c9923c1d-971d-4022-8dc8-1364e929d34c@gmail.com/
+
+Fixes: f1d5df84cd8c ("s390/bpf: Implement bpf_arch_text_poke()")
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Message-ID: <20240320015515.11883-1-iii@linux.ibm.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/net/bpf_jit_comp.c | 46 ++++++++++++++++--------------------
+ 1 file changed, 20 insertions(+), 26 deletions(-)
+
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index b418333bb0863..5af0402e94b88 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -516,11 +516,12 @@ static void bpf_skip(struct bpf_jit *jit, int size)
+  * PLT for hotpatchable calls. The calling convention is the same as for the
+  * ftrace hotpatch trampolines: %r0 is return address, %r1 is clobbered.
+  */
+-extern const char bpf_plt[];
+-extern const char bpf_plt_ret[];
+-extern const char bpf_plt_target[];
+-extern const char bpf_plt_end[];
+-#define BPF_PLT_SIZE 32
++struct bpf_plt {
++      char code[16];
++      void *ret;
++      void *target;
++} __packed;
++extern const struct bpf_plt bpf_plt;
+ asm(
+       ".pushsection .rodata\n"
+       "       .balign 8\n"
+@@ -531,15 +532,14 @@ asm(
+       "       .balign 8\n"
+       "bpf_plt_ret: .quad 0\n"
+       "bpf_plt_target: .quad 0\n"
+-      "bpf_plt_end:\n"
+       "       .popsection\n"
+ );
+-static void bpf_jit_plt(void *plt, void *ret, void *target)
++static void bpf_jit_plt(struct bpf_plt *plt, void *ret, void *target)
+ {
+-      memcpy(plt, bpf_plt, BPF_PLT_SIZE);
+-      *(void **)((char *)plt + (bpf_plt_ret - bpf_plt)) = ret;
+-      *(void **)((char *)plt + (bpf_plt_target - bpf_plt)) = target ?: ret;
++      memcpy(plt, &bpf_plt, sizeof(*plt));
++      plt->ret = ret;
++      plt->target = target;
+ }
+ /*
+@@ -662,9 +662,9 @@ static void bpf_jit_epilogue(struct bpf_jit *jit, u32 stack_depth)
+       jit->prg = ALIGN(jit->prg, 8);
+       jit->prologue_plt = jit->prg;
+       if (jit->prg_buf)
+-              bpf_jit_plt(jit->prg_buf + jit->prg,
++              bpf_jit_plt((struct bpf_plt *)(jit->prg_buf + jit->prg),
+                           jit->prg_buf + jit->prologue_plt_ret, NULL);
+-      jit->prg += BPF_PLT_SIZE;
++      jit->prg += sizeof(struct bpf_plt);
+ }
+ static int get_probe_mem_regno(const u8 *insn)
+@@ -2040,9 +2040,6 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)
+       struct bpf_jit jit;
+       int pass;
+-      if (WARN_ON_ONCE(bpf_plt_end - bpf_plt != BPF_PLT_SIZE))
+-              return orig_fp;
+-
+       if (!fp->jit_requested)
+               return orig_fp;
+@@ -2148,14 +2145,11 @@ bool bpf_jit_supports_far_kfunc_call(void)
+ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type t,
+                      void *old_addr, void *new_addr)
+ {
++      struct bpf_plt expected_plt, current_plt, new_plt, *plt;
+       struct {
+               u16 opc;
+               s32 disp;
+       } __packed insn;
+-      char expected_plt[BPF_PLT_SIZE];
+-      char current_plt[BPF_PLT_SIZE];
+-      char new_plt[BPF_PLT_SIZE];
+-      char *plt;
+       char *ret;
+       int err;
+@@ -2174,18 +2168,18 @@ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type t,
+                */
+       } else {
+               /* Verify the PLT. */
+-              plt = (char *)ip + (insn.disp << 1);
+-              err = copy_from_kernel_nofault(current_plt, plt, BPF_PLT_SIZE);
++              plt = ip + (insn.disp << 1);
++              err = copy_from_kernel_nofault(&current_plt, plt,
++                                             sizeof(current_plt));
+               if (err < 0)
+                       return err;
+               ret = (char *)ip + 6;
+-              bpf_jit_plt(expected_plt, ret, old_addr);
+-              if (memcmp(current_plt, expected_plt, BPF_PLT_SIZE))
++              bpf_jit_plt(&expected_plt, ret, old_addr);
++              if (memcmp(&current_plt, &expected_plt, sizeof(current_plt)))
+                       return -EINVAL;
+               /* Adjust the call address. */
+-              bpf_jit_plt(new_plt, ret, new_addr);
+-              s390_kernel_write(plt + (bpf_plt_target - bpf_plt),
+-                                new_plt + (bpf_plt_target - bpf_plt),
++              bpf_jit_plt(&new_plt, ret, new_addr);
++              s390_kernel_write(&plt->target, &new_plt.target,
+                                 sizeof(void *));
+       }
+-- 
+2.43.0
+
diff --git a/queue-6.8/s390-qeth-handle-deferred-cc1.patch b/queue-6.8/s390-qeth-handle-deferred-cc1.patch
new file mode 100644 (file)
index 0000000..951792f
--- /dev/null
@@ -0,0 +1,116 @@
+From 0d8ef5e478f8129b4ff37f4d82a55f48165a5157 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Mar 2024 12:53:37 +0100
+Subject: s390/qeth: handle deferred cc1
+
+From: Alexandra Winter <wintera@linux.ibm.com>
+
+[ Upstream commit afb373ff3f54c9d909efc7f810dc80a9742807b2 ]
+
+The IO subsystem expects a driver to retry a ccw_device_start, when the
+subsequent interrupt response block (irb) contains a deferred
+condition code 1.
+
+Symptoms before this commit:
+On the read channel we always trigger the next read anyhow, so no
+different behaviour here.
+On the write channel we may experience timeout errors, because the
+expected reply will never be received without the retry.
+Other callers of qeth_send_control_data() may wrongly assume that the ccw
+was successful, which may cause problems later.
+
+Note that since
+commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")
+and
+commit 5ef1dc40ffa6 ("s390/cio: fix invalid -EBUSY on ccw_device_start")
+deferred CC1s are much more likely to occur. See the commit message of the
+latter for more background information.
+
+Fixes: 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")
+Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
+Co-developed-by: Thorsten Winkler <twinkler@linux.ibm.com>
+Signed-off-by: Thorsten Winkler <twinkler@linux.ibm.com>
+Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Link: https://lore.kernel.org/r/20240321115337.3564694-1-wintera@linux.ibm.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_core_main.c | 38 +++++++++++++++++++++++++++++--
+ 1 file changed, 36 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index cf8506d0f185c..601d00e09de4a 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -1179,6 +1179,20 @@ static int qeth_check_irb_error(struct qeth_card *card, struct ccw_device *cdev,
+       }
+ }
++/**
++ * qeth_irq() - qeth interrupt handler
++ * @cdev: ccw device
++ * @intparm: expect pointer to iob
++ * @irb: Interruption Response Block
++ *
++ * In the good path:
++ * corresponding qeth channel is locked with last used iob as active_cmd.
++ * But this function is also called for error interrupts.
++ *
++ * Caller ensures that:
++ * Interrupts are disabled; ccw device lock is held;
++ *
++ */
+ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
+               struct irb *irb)
+ {
+@@ -1220,11 +1234,10 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
+               iob = (struct qeth_cmd_buffer *) (addr_t)intparm;
+       }
+-      qeth_unlock_channel(card, channel);
+-
+       rc = qeth_check_irb_error(card, cdev, irb);
+       if (rc) {
+               /* IO was terminated, free its resources. */
++              qeth_unlock_channel(card, channel);
+               if (iob)
+                       qeth_cancel_cmd(iob, rc);
+               return;
+@@ -1268,6 +1281,7 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
+               rc = qeth_get_problem(card, cdev, irb);
+               if (rc) {
+                       card->read_or_write_problem = 1;
++                      qeth_unlock_channel(card, channel);
+                       if (iob)
+                               qeth_cancel_cmd(iob, rc);
+                       qeth_clear_ipacmd_list(card);
+@@ -1276,6 +1290,26 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
+               }
+       }
++      if (scsw_cmd_is_valid_cc(&irb->scsw) && irb->scsw.cmd.cc == 1 && iob) {
++              /* channel command hasn't started: retry.
++               * active_cmd is still set to last iob
++               */
++              QETH_CARD_TEXT(card, 2, "irqcc1");
++              rc = ccw_device_start_timeout(cdev, __ccw_from_cmd(iob),
++                                            (addr_t)iob, 0, 0, iob->timeout);
++              if (rc) {
++                      QETH_DBF_MESSAGE(2,
++                                       "ccw retry on %x failed, rc = %i\n",
++                                       CARD_DEVID(card), rc);
++                      QETH_CARD_TEXT_(card, 2, " err%d", rc);
++                      qeth_unlock_channel(card, channel);
++                      qeth_cancel_cmd(iob, rc);
++              }
++              return;
++      }
++
++      qeth_unlock_channel(card, channel);
++
+       if (iob) {
+               /* sanity check: */
+               if (irb->scsw.cmd.count > iob->length) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/scripts-bpf_doc-use-silent-mode-when-exec-make-cmd.patch b/queue-6.8/scripts-bpf_doc-use-silent-mode-when-exec-make-cmd.patch
new file mode 100644 (file)
index 0000000..be23e9e
--- /dev/null
@@ -0,0 +1,60 @@
+From 062e2e468c5eda2d055ffee6ab5dc87b11c7ca21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Mar 2024 10:34:43 +0800
+Subject: scripts/bpf_doc: Use silent mode when exec make cmd
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit 5384cc0d1a88c27448a6a4e65b8abe6486de8012 ]
+
+When getting kernel version via make, the result may be polluted by other
+output, like directory change info. e.g.
+
+  $ export MAKEFLAGS="-w"
+  $ make kernelversion
+  make: Entering directory '/home/net'
+  6.8.0
+  make: Leaving directory '/home/net'
+
+This will distort the reStructuredText output and make latter rst2man
+failed like:
+
+  [...]
+  bpf-helpers.rst:20: (WARNING/2) Field list ends without a blank line; unexpected unindent.
+  [...]
+
+Using silent mode would help. e.g.
+
+  $ make -s --no-print-directory kernelversion
+  6.8.0
+
+Fixes: fd0a38f9c37d ("scripts/bpf: Set version attribute for bpf-helpers(7) man page")
+Signed-off-by: Michael Hofmann <mhofmann@redhat.com>
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Quentin Monnet <qmo@kernel.org>
+Acked-by: Alejandro Colomar <alx@kernel.org>
+Link: https://lore.kernel.org/bpf/20240315023443.2364442-1-liuhangbin@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/bpf_doc.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/scripts/bpf_doc.py b/scripts/bpf_doc.py
+index 0669bac5e900e..3f899cc7e99a9 100755
+--- a/scripts/bpf_doc.py
++++ b/scripts/bpf_doc.py
+@@ -414,8 +414,8 @@ class PrinterRST(Printer):
+             version = version.stdout.decode().rstrip()
+         except:
+             try:
+-                version = subprocess.run(['make', 'kernelversion'], cwd=linuxRoot,
+-                                         capture_output=True, check=True)
++                version = subprocess.run(['make', '-s', '--no-print-directory', 'kernelversion'],
++                                         cwd=linuxRoot, capture_output=True, check=True)
+                 version = version.stdout.decode().rstrip()
+             except:
+                 return 'Linux'
+-- 
+2.43.0
+
diff --git a/queue-6.8/selftests-vxlan_mdb-fix-failures-with-old-libnet.patch b/queue-6.8/selftests-vxlan_mdb-fix-failures-with-old-libnet.patch
new file mode 100644 (file)
index 0000000..ce5e019
--- /dev/null
@@ -0,0 +1,978 @@
+From e6e0f0a4ddaeb8b42c9ae445b297fb57b060aa4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Mar 2024 09:50:30 +0200
+Subject: selftests: vxlan_mdb: Fix failures with old libnet
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit f1425529c33def8b46faae4400dd9e2bbaf16a05 ]
+
+Locally generated IP multicast packets (such as the ones used in the
+test) do not perform routing and simply egress the bound device.
+
+However, as explained in commit 8bcfb4ae4d97 ("selftests: forwarding:
+Fix failing tests with old libnet"), old versions of libnet (used by
+mausezahn) do not use the "SO_BINDTODEVICE" socket option. Specifically,
+the library started using the option for IPv6 sockets in version 1.1.6
+and for IPv4 sockets in version 1.2. This explains why on Ubuntu - which
+uses version 1.1.6 - the IPv4 overlay tests are failing whereas the IPv6
+ones are passing.
+
+Fix by specifying the source and destination MAC of the packets which
+will cause mausezahn to use a packet socket instead of an IP socket.
+
+Fixes: 62199e3f1658 ("selftests: net: Add VXLAN MDB test")
+Reported-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
+Closes: https://lore.kernel.org/netdev/5bb50349-196d-4892-8ed2-f37543aa863f@alu.unizg.hr/
+Tested-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://lore.kernel.org/r/20240325075030.2379513-1-idosch@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/test_vxlan_mdb.sh | 205 +++++++++++-------
+ 1 file changed, 128 insertions(+), 77 deletions(-)
+
+diff --git a/tools/testing/selftests/net/test_vxlan_mdb.sh b/tools/testing/selftests/net/test_vxlan_mdb.sh
+index 84a05a9e46d86..04fb17a92e993 100755
+--- a/tools/testing/selftests/net/test_vxlan_mdb.sh
++++ b/tools/testing/selftests/net/test_vxlan_mdb.sh
+@@ -1177,6 +1177,7 @@ encap_params_common()
+       local plen=$1; shift
+       local enc_ethtype=$1; shift
+       local grp=$1; shift
++      local grp_dmac=$1; shift
+       local src=$1; shift
+       local mz=$1; shift
+@@ -1195,11 +1196,11 @@ encap_params_common()
+       run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent dst $vtep2_ip src_vni 10020"
+       run_cmd "tc -n $ns2 filter replace dev vx0 ingress pref 1 handle 101 proto all flower enc_dst_ip $vtep1_ip action pass"
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 1
+       log_test $? 0 "Destination IP - match"
+-      run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 1
+       log_test $? 0 "Destination IP - no match"
+@@ -1212,20 +1213,20 @@ encap_params_common()
+       run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent dst $vtep1_ip dst_port 1111 src_vni 10020"
+       run_cmd "tc -n $ns2 filter replace dev veth0 ingress pref 1 handle 101 proto $enc_ethtype flower ip_proto udp dst_port 4789 action pass"
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev veth0 ingress" 101 1
+       log_test $? 0 "Default destination port - match"
+-      run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev veth0 ingress" 101 1
+       log_test $? 0 "Default destination port - no match"
+       run_cmd "tc -n $ns2 filter replace dev veth0 ingress pref 1 handle 101 proto $enc_ethtype flower ip_proto udp dst_port 1111 action pass"
+-      run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev veth0 ingress" 101 1
+       log_test $? 0 "Non-default destination port - match"
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev veth0 ingress" 101 1
+       log_test $? 0 "Non-default destination port - no match"
+@@ -1238,11 +1239,11 @@ encap_params_common()
+       run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent dst $vtep1_ip src_vni 10020"
+       run_cmd "tc -n $ns2 filter replace dev vx0 ingress pref 1 handle 101 proto all flower enc_key_id 10010 action pass"
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 1
+       log_test $? 0 "Default destination VNI - match"
+-      run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 1
+       log_test $? 0 "Default destination VNI - no match"
+@@ -1250,11 +1251,11 @@ encap_params_common()
+       run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent dst $vtep1_ip vni 10010 src_vni 10020"
+       run_cmd "tc -n $ns2 filter replace dev vx0 ingress pref 1 handle 101 proto all flower enc_key_id 10020 action pass"
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 1
+       log_test $? 0 "Non-default destination VNI - match"
+-      run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 1
+       log_test $? 0 "Non-default destination VNI - no match"
+@@ -1272,6 +1273,7 @@ encap_params_ipv4_ipv4()
+       local plen=32
+       local enc_ethtype="ip"
+       local grp=239.1.1.1
++      local grp_dmac=01:00:5e:01:01:01
+       local src=192.0.2.129
+       echo
+@@ -1279,7 +1281,7 @@ encap_params_ipv4_ipv4()
+       echo "------------------------------------------------------------------"
+       encap_params_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $enc_ethtype \
+-              $grp $src "mausezahn"
++              $grp $grp_dmac $src "mausezahn"
+ }
+ encap_params_ipv6_ipv4()
+@@ -1291,6 +1293,7 @@ encap_params_ipv6_ipv4()
+       local plen=32
+       local enc_ethtype="ip"
+       local grp=ff0e::1
++      local grp_dmac=33:33:00:00:00:01
+       local src=2001:db8:100::1
+       echo
+@@ -1298,7 +1301,7 @@ encap_params_ipv6_ipv4()
+       echo "------------------------------------------------------------------"
+       encap_params_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $enc_ethtype \
+-              $grp $src "mausezahn -6"
++              $grp $grp_dmac $src "mausezahn -6"
+ }
+ encap_params_ipv4_ipv6()
+@@ -1310,6 +1313,7 @@ encap_params_ipv4_ipv6()
+       local plen=128
+       local enc_ethtype="ipv6"
+       local grp=239.1.1.1
++      local grp_dmac=01:00:5e:01:01:01
+       local src=192.0.2.129
+       echo
+@@ -1317,7 +1321,7 @@ encap_params_ipv4_ipv6()
+       echo "------------------------------------------------------------------"
+       encap_params_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $enc_ethtype \
+-              $grp $src "mausezahn"
++              $grp $grp_dmac $src "mausezahn"
+ }
+ encap_params_ipv6_ipv6()
+@@ -1329,6 +1333,7 @@ encap_params_ipv6_ipv6()
+       local plen=128
+       local enc_ethtype="ipv6"
+       local grp=ff0e::1
++      local grp_dmac=33:33:00:00:00:01
+       local src=2001:db8:100::1
+       echo
+@@ -1336,7 +1341,7 @@ encap_params_ipv6_ipv6()
+       echo "------------------------------------------------------------------"
+       encap_params_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $enc_ethtype \
+-              $grp $src "mausezahn -6"
++              $grp $grp_dmac $src "mausezahn -6"
+ }
+ starg_exclude_ir_common()
+@@ -1347,6 +1352,7 @@ starg_exclude_ir_common()
+       local vtep2_ip=$1; shift
+       local plen=$1; shift
+       local grp=$1; shift
++      local grp_dmac=$1; shift
+       local valid_src=$1; shift
+       local invalid_src=$1; shift
+       local mz=$1; shift
+@@ -1368,14 +1374,14 @@ starg_exclude_ir_common()
+       run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent filter_mode exclude source_list $invalid_src dst $vtep2_ip src_vni 10010"
+       # Check that invalid source is not forwarded to any VTEP.
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 0
+       log_test $? 0 "Block excluded source - first VTEP"
+       tc_check_packets "$ns2" "dev vx0 ingress" 102 0
+       log_test $? 0 "Block excluded source - second VTEP"
+       # Check that valid source is forwarded to both VTEPs.
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 1
+       log_test $? 0 "Forward valid source - first VTEP"
+       tc_check_packets "$ns2" "dev vx0 ingress" 102 1
+@@ -1385,14 +1391,14 @@ starg_exclude_ir_common()
+       run_cmd "bridge -n $ns1 mdb del dev vx0 port vx0 grp $grp dst $vtep2_ip src_vni 10010"
+       # Check that invalid source is not forwarded to any VTEP.
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 1
+       log_test $? 0 "Block excluded source after removal - first VTEP"
+       tc_check_packets "$ns2" "dev vx0 ingress" 102 1
+       log_test $? 0 "Block excluded source after removal - second VTEP"
+       # Check that valid source is forwarded to the remaining VTEP.
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 2
+       log_test $? 0 "Forward valid source after removal - first VTEP"
+       tc_check_packets "$ns2" "dev vx0 ingress" 102 1
+@@ -1407,6 +1413,7 @@ starg_exclude_ir_ipv4_ipv4()
+       local vtep2_ip=198.51.100.200
+       local plen=32
+       local grp=239.1.1.1
++      local grp_dmac=01:00:5e:01:01:01
+       local valid_src=192.0.2.129
+       local invalid_src=192.0.2.145
+@@ -1415,7 +1422,7 @@ starg_exclude_ir_ipv4_ipv4()
+       echo "-------------------------------------------------------------"
+       starg_exclude_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \
+-              $valid_src $invalid_src "mausezahn"
++              $grp_dmac $valid_src $invalid_src "mausezahn"
+ }
+ starg_exclude_ir_ipv6_ipv4()
+@@ -1426,6 +1433,7 @@ starg_exclude_ir_ipv6_ipv4()
+       local vtep2_ip=198.51.100.200
+       local plen=32
+       local grp=ff0e::1
++      local grp_dmac=33:33:00:00:00:01
+       local valid_src=2001:db8:100::1
+       local invalid_src=2001:db8:200::1
+@@ -1434,7 +1442,7 @@ starg_exclude_ir_ipv6_ipv4()
+       echo "-------------------------------------------------------------"
+       starg_exclude_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \
+-              $valid_src $invalid_src "mausezahn -6"
++              $grp_dmac $valid_src $invalid_src "mausezahn -6"
+ }
+ starg_exclude_ir_ipv4_ipv6()
+@@ -1445,6 +1453,7 @@ starg_exclude_ir_ipv4_ipv6()
+       local vtep2_ip=2001:db8:2000::1
+       local plen=128
+       local grp=239.1.1.1
++      local grp_dmac=01:00:5e:01:01:01
+       local valid_src=192.0.2.129
+       local invalid_src=192.0.2.145
+@@ -1453,7 +1462,7 @@ starg_exclude_ir_ipv4_ipv6()
+       echo "-------------------------------------------------------------"
+       starg_exclude_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \
+-              $valid_src $invalid_src "mausezahn"
++              $grp_dmac $valid_src $invalid_src "mausezahn"
+ }
+ starg_exclude_ir_ipv6_ipv6()
+@@ -1464,6 +1473,7 @@ starg_exclude_ir_ipv6_ipv6()
+       local vtep2_ip=2001:db8:2000::1
+       local plen=128
+       local grp=ff0e::1
++      local grp_dmac=33:33:00:00:00:01
+       local valid_src=2001:db8:100::1
+       local invalid_src=2001:db8:200::1
+@@ -1472,7 +1482,7 @@ starg_exclude_ir_ipv6_ipv6()
+       echo "-------------------------------------------------------------"
+       starg_exclude_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \
+-              $valid_src $invalid_src "mausezahn -6"
++              $grp_dmac $valid_src $invalid_src "mausezahn -6"
+ }
+ starg_include_ir_common()
+@@ -1483,6 +1493,7 @@ starg_include_ir_common()
+       local vtep2_ip=$1; shift
+       local plen=$1; shift
+       local grp=$1; shift
++      local grp_dmac=$1; shift
+       local valid_src=$1; shift
+       local invalid_src=$1; shift
+       local mz=$1; shift
+@@ -1504,14 +1515,14 @@ starg_include_ir_common()
+       run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent filter_mode include source_list $valid_src dst $vtep2_ip src_vni 10010"
+       # Check that invalid source is not forwarded to any VTEP.
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 0
+       log_test $? 0 "Block excluded source - first VTEP"
+       tc_check_packets "$ns2" "dev vx0 ingress" 102 0
+       log_test $? 0 "Block excluded source - second VTEP"
+       # Check that valid source is forwarded to both VTEPs.
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 1
+       log_test $? 0 "Forward valid source - first VTEP"
+       tc_check_packets "$ns2" "dev vx0 ingress" 102 1
+@@ -1521,14 +1532,14 @@ starg_include_ir_common()
+       run_cmd "bridge -n $ns1 mdb del dev vx0 port vx0 grp $grp dst $vtep2_ip src_vni 10010"
+       # Check that invalid source is not forwarded to any VTEP.
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 1
+       log_test $? 0 "Block excluded source after removal - first VTEP"
+       tc_check_packets "$ns2" "dev vx0 ingress" 102 1
+       log_test $? 0 "Block excluded source after removal - second VTEP"
+       # Check that valid source is forwarded to the remaining VTEP.
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 2
+       log_test $? 0 "Forward valid source after removal - first VTEP"
+       tc_check_packets "$ns2" "dev vx0 ingress" 102 1
+@@ -1543,6 +1554,7 @@ starg_include_ir_ipv4_ipv4()
+       local vtep2_ip=198.51.100.200
+       local plen=32
+       local grp=239.1.1.1
++      local grp_dmac=01:00:5e:01:01:01
+       local valid_src=192.0.2.129
+       local invalid_src=192.0.2.145
+@@ -1551,7 +1563,7 @@ starg_include_ir_ipv4_ipv4()
+       echo "-------------------------------------------------------------"
+       starg_include_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \
+-              $valid_src $invalid_src "mausezahn"
++              $grp_dmac $valid_src $invalid_src "mausezahn"
+ }
+ starg_include_ir_ipv6_ipv4()
+@@ -1562,6 +1574,7 @@ starg_include_ir_ipv6_ipv4()
+       local vtep2_ip=198.51.100.200
+       local plen=32
+       local grp=ff0e::1
++      local grp_dmac=33:33:00:00:00:01
+       local valid_src=2001:db8:100::1
+       local invalid_src=2001:db8:200::1
+@@ -1570,7 +1583,7 @@ starg_include_ir_ipv6_ipv4()
+       echo "-------------------------------------------------------------"
+       starg_include_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \
+-              $valid_src $invalid_src "mausezahn -6"
++              $grp_dmac $valid_src $invalid_src "mausezahn -6"
+ }
+ starg_include_ir_ipv4_ipv6()
+@@ -1581,6 +1594,7 @@ starg_include_ir_ipv4_ipv6()
+       local vtep2_ip=2001:db8:2000::1
+       local plen=128
+       local grp=239.1.1.1
++      local grp_dmac=01:00:5e:01:01:01
+       local valid_src=192.0.2.129
+       local invalid_src=192.0.2.145
+@@ -1589,7 +1603,7 @@ starg_include_ir_ipv4_ipv6()
+       echo "-------------------------------------------------------------"
+       starg_include_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \
+-              $valid_src $invalid_src "mausezahn"
++              $grp_dmac $valid_src $invalid_src "mausezahn"
+ }
+ starg_include_ir_ipv6_ipv6()
+@@ -1600,6 +1614,7 @@ starg_include_ir_ipv6_ipv6()
+       local vtep2_ip=2001:db8:2000::1
+       local plen=128
+       local grp=ff0e::1
++      local grp_dmac=33:33:00:00:00:01
+       local valid_src=2001:db8:100::1
+       local invalid_src=2001:db8:200::1
+@@ -1608,7 +1623,7 @@ starg_include_ir_ipv6_ipv6()
+       echo "-------------------------------------------------------------"
+       starg_include_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \
+-              $valid_src $invalid_src "mausezahn -6"
++              $grp_dmac $valid_src $invalid_src "mausezahn -6"
+ }
+ starg_exclude_p2mp_common()
+@@ -1618,6 +1633,7 @@ starg_exclude_p2mp_common()
+       local mcast_grp=$1; shift
+       local plen=$1; shift
+       local grp=$1; shift
++      local grp_dmac=$1; shift
+       local valid_src=$1; shift
+       local invalid_src=$1; shift
+       local mz=$1; shift
+@@ -1635,12 +1651,12 @@ starg_exclude_p2mp_common()
+       run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent filter_mode exclude source_list $invalid_src dst $mcast_grp src_vni 10010 via veth0"
+       # Check that invalid source is not forwarded.
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 0
+       log_test $? 0 "Block excluded source"
+       # Check that valid source is forwarded.
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 1
+       log_test $? 0 "Forward valid source"
+@@ -1648,7 +1664,7 @@ starg_exclude_p2mp_common()
+       run_cmd "ip -n $ns2 address del $mcast_grp/$plen dev veth0"
+       # Check that valid source is not received anymore.
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 1
+       log_test $? 0 "Receive of valid source after removal from group"
+ }
+@@ -1660,6 +1676,7 @@ starg_exclude_p2mp_ipv4_ipv4()
+       local mcast_grp=238.1.1.1
+       local plen=32
+       local grp=239.1.1.1
++      local grp_dmac=01:00:5e:01:01:01
+       local valid_src=192.0.2.129
+       local invalid_src=192.0.2.145
+@@ -1667,7 +1684,7 @@ starg_exclude_p2mp_ipv4_ipv4()
+       echo "Data path: (*, G) EXCLUDE - P2MP - IPv4 overlay / IPv4 underlay"
+       echo "---------------------------------------------------------------"
+-      starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \
++      starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \
+               $valid_src $invalid_src "mausezahn"
+ }
+@@ -1678,6 +1695,7 @@ starg_exclude_p2mp_ipv6_ipv4()
+       local mcast_grp=238.1.1.1
+       local plen=32
+       local grp=ff0e::1
++      local grp_dmac=33:33:00:00:00:01
+       local valid_src=2001:db8:100::1
+       local invalid_src=2001:db8:200::1
+@@ -1685,7 +1703,7 @@ starg_exclude_p2mp_ipv6_ipv4()
+       echo "Data path: (*, G) EXCLUDE - P2MP - IPv6 overlay / IPv4 underlay"
+       echo "---------------------------------------------------------------"
+-      starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \
++      starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \
+               $valid_src $invalid_src "mausezahn -6"
+ }
+@@ -1696,6 +1714,7 @@ starg_exclude_p2mp_ipv4_ipv6()
+       local mcast_grp=ff0e::2
+       local plen=128
+       local grp=239.1.1.1
++      local grp_dmac=01:00:5e:01:01:01
+       local valid_src=192.0.2.129
+       local invalid_src=192.0.2.145
+@@ -1703,7 +1722,7 @@ starg_exclude_p2mp_ipv4_ipv6()
+       echo "Data path: (*, G) EXCLUDE - P2MP - IPv4 overlay / IPv6 underlay"
+       echo "---------------------------------------------------------------"
+-      starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \
++      starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \
+               $valid_src $invalid_src "mausezahn"
+ }
+@@ -1714,6 +1733,7 @@ starg_exclude_p2mp_ipv6_ipv6()
+       local mcast_grp=ff0e::2
+       local plen=128
+       local grp=ff0e::1
++      local grp_dmac=33:33:00:00:00:01
+       local valid_src=2001:db8:100::1
+       local invalid_src=2001:db8:200::1
+@@ -1721,7 +1741,7 @@ starg_exclude_p2mp_ipv6_ipv6()
+       echo "Data path: (*, G) EXCLUDE - P2MP - IPv6 overlay / IPv6 underlay"
+       echo "---------------------------------------------------------------"
+-      starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \
++      starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \
+               $valid_src $invalid_src "mausezahn -6"
+ }
+@@ -1732,6 +1752,7 @@ starg_include_p2mp_common()
+       local mcast_grp=$1; shift
+       local plen=$1; shift
+       local grp=$1; shift
++      local grp_dmac=$1; shift
+       local valid_src=$1; shift
+       local invalid_src=$1; shift
+       local mz=$1; shift
+@@ -1749,12 +1770,12 @@ starg_include_p2mp_common()
+       run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent filter_mode include source_list $valid_src dst $mcast_grp src_vni 10010 via veth0"
+       # Check that invalid source is not forwarded.
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 0
+       log_test $? 0 "Block excluded source"
+       # Check that valid source is forwarded.
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 1
+       log_test $? 0 "Forward valid source"
+@@ -1762,7 +1783,7 @@ starg_include_p2mp_common()
+       run_cmd "ip -n $ns2 address del $mcast_grp/$plen dev veth0"
+       # Check that valid source is not received anymore.
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 1
+       log_test $? 0 "Receive of valid source after removal from group"
+ }
+@@ -1774,6 +1795,7 @@ starg_include_p2mp_ipv4_ipv4()
+       local mcast_grp=238.1.1.1
+       local plen=32
+       local grp=239.1.1.1
++      local grp_dmac=01:00:5e:01:01:01
+       local valid_src=192.0.2.129
+       local invalid_src=192.0.2.145
+@@ -1781,7 +1803,7 @@ starg_include_p2mp_ipv4_ipv4()
+       echo "Data path: (*, G) INCLUDE - P2MP - IPv4 overlay / IPv4 underlay"
+       echo "---------------------------------------------------------------"
+-      starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \
++      starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \
+               $valid_src $invalid_src "mausezahn"
+ }
+@@ -1792,6 +1814,7 @@ starg_include_p2mp_ipv6_ipv4()
+       local mcast_grp=238.1.1.1
+       local plen=32
+       local grp=ff0e::1
++      local grp_dmac=33:33:00:00:00:01
+       local valid_src=2001:db8:100::1
+       local invalid_src=2001:db8:200::1
+@@ -1799,7 +1822,7 @@ starg_include_p2mp_ipv6_ipv4()
+       echo "Data path: (*, G) INCLUDE - P2MP - IPv6 overlay / IPv4 underlay"
+       echo "---------------------------------------------------------------"
+-      starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \
++      starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \
+               $valid_src $invalid_src "mausezahn -6"
+ }
+@@ -1810,6 +1833,7 @@ starg_include_p2mp_ipv4_ipv6()
+       local mcast_grp=ff0e::2
+       local plen=128
+       local grp=239.1.1.1
++      local grp_dmac=01:00:5e:01:01:01
+       local valid_src=192.0.2.129
+       local invalid_src=192.0.2.145
+@@ -1817,7 +1841,7 @@ starg_include_p2mp_ipv4_ipv6()
+       echo "Data path: (*, G) INCLUDE - P2MP - IPv4 overlay / IPv6 underlay"
+       echo "---------------------------------------------------------------"
+-      starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \
++      starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \
+               $valid_src $invalid_src "mausezahn"
+ }
+@@ -1828,6 +1852,7 @@ starg_include_p2mp_ipv6_ipv6()
+       local mcast_grp=ff0e::2
+       local plen=128
+       local grp=ff0e::1
++      local grp_dmac=33:33:00:00:00:01
+       local valid_src=2001:db8:100::1
+       local invalid_src=2001:db8:200::1
+@@ -1835,7 +1860,7 @@ starg_include_p2mp_ipv6_ipv6()
+       echo "Data path: (*, G) INCLUDE - P2MP - IPv6 overlay / IPv6 underlay"
+       echo "---------------------------------------------------------------"
+-      starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \
++      starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \
+               $valid_src $invalid_src "mausezahn -6"
+ }
+@@ -1847,6 +1872,7 @@ egress_vni_translation_common()
+       local plen=$1; shift
+       local proto=$1; shift
+       local grp=$1; shift
++      local grp_dmac=$1; shift
+       local src=$1; shift
+       local mz=$1; shift
+@@ -1882,20 +1908,20 @@ egress_vni_translation_common()
+       # Make sure that packets sent from the first VTEP over VLAN 10 are
+       # received by the SVI corresponding to the L3VNI (14000 / VLAN 4000) on
+       # the second VTEP, since it is configured as PVID.
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev br0.4000 ingress" 101 1
+       log_test $? 0 "Egress VNI translation - PVID configured"
+       # Remove PVID flag from VLAN 4000 on the second VTEP and make sure
+       # packets are no longer received by the SVI interface.
+       run_cmd "bridge -n $ns2 vlan add vid 4000 dev vx0"
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev br0.4000 ingress" 101 1
+       log_test $? 0 "Egress VNI translation - no PVID configured"
+       # Reconfigure the PVID and make sure packets are received again.
+       run_cmd "bridge -n $ns2 vlan add vid 4000 dev vx0 pvid"
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev br0.4000 ingress" 101 2
+       log_test $? 0 "Egress VNI translation - PVID reconfigured"
+ }
+@@ -1908,6 +1934,7 @@ egress_vni_translation_ipv4_ipv4()
+       local plen=32
+       local proto="ipv4"
+       local grp=239.1.1.1
++      local grp_dmac=01:00:5e:01:01:01
+       local src=192.0.2.129
+       echo
+@@ -1915,7 +1942,7 @@ egress_vni_translation_ipv4_ipv4()
+       echo "----------------------------------------------------------------"
+       egress_vni_translation_common $ns1 $ns2 $mcast_grp $plen $proto $grp \
+-              $src "mausezahn"
++              $grp_dmac $src "mausezahn"
+ }
+ egress_vni_translation_ipv6_ipv4()
+@@ -1926,6 +1953,7 @@ egress_vni_translation_ipv6_ipv4()
+       local plen=32
+       local proto="ipv6"
+       local grp=ff0e::1
++      local grp_dmac=33:33:00:00:00:01
+       local src=2001:db8:100::1
+       echo
+@@ -1933,7 +1961,7 @@ egress_vni_translation_ipv6_ipv4()
+       echo "----------------------------------------------------------------"
+       egress_vni_translation_common $ns1 $ns2 $mcast_grp $plen $proto $grp \
+-              $src "mausezahn -6"
++              $grp_dmac $src "mausezahn -6"
+ }
+ egress_vni_translation_ipv4_ipv6()
+@@ -1944,6 +1972,7 @@ egress_vni_translation_ipv4_ipv6()
+       local plen=128
+       local proto="ipv4"
+       local grp=239.1.1.1
++      local grp_dmac=01:00:5e:01:01:01
+       local src=192.0.2.129
+       echo
+@@ -1951,7 +1980,7 @@ egress_vni_translation_ipv4_ipv6()
+       echo "----------------------------------------------------------------"
+       egress_vni_translation_common $ns1 $ns2 $mcast_grp $plen $proto $grp \
+-              $src "mausezahn"
++              $grp_dmac $src "mausezahn"
+ }
+ egress_vni_translation_ipv6_ipv6()
+@@ -1962,6 +1991,7 @@ egress_vni_translation_ipv6_ipv6()
+       local plen=128
+       local proto="ipv6"
+       local grp=ff0e::1
++      local grp_dmac=33:33:00:00:00:01
+       local src=2001:db8:100::1
+       echo
+@@ -1969,7 +1999,7 @@ egress_vni_translation_ipv6_ipv6()
+       echo "----------------------------------------------------------------"
+       egress_vni_translation_common $ns1 $ns2 $mcast_grp $plen $proto $grp \
+-              $src "mausezahn -6"
++              $grp_dmac $src "mausezahn -6"
+ }
+ all_zeros_mdb_common()
+@@ -1982,12 +2012,18 @@ all_zeros_mdb_common()
+       local vtep4_ip=$1; shift
+       local plen=$1; shift
+       local ipv4_grp=239.1.1.1
++      local ipv4_grp_dmac=01:00:5e:01:01:01
+       local ipv4_unreg_grp=239.2.2.2
++      local ipv4_unreg_grp_dmac=01:00:5e:02:02:02
+       local ipv4_ll_grp=224.0.0.100
++      local ipv4_ll_grp_dmac=01:00:5e:00:00:64
+       local ipv4_src=192.0.2.129
+       local ipv6_grp=ff0e::1
++      local ipv6_grp_dmac=33:33:00:00:00:01
+       local ipv6_unreg_grp=ff0e::2
++      local ipv6_unreg_grp_dmac=33:33:00:00:00:02
+       local ipv6_ll_grp=ff02::1
++      local ipv6_ll_grp_dmac=33:33:00:00:00:01
+       local ipv6_src=2001:db8:100::1
+       # Install all-zeros (catchall) MDB entries for IPv4 and IPv6 traffic
+@@ -2023,7 +2059,7 @@ all_zeros_mdb_common()
+       # Send registered IPv4 multicast and make sure it only arrives to the
+       # first VTEP.
+-      run_cmd "ip netns exec $ns1 mausezahn br0.10 -A $ipv4_src -B $ipv4_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 mausezahn br0.10 -a own -b $ipv4_grp_dmac -A $ipv4_src -B $ipv4_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 1
+       log_test $? 0 "Registered IPv4 multicast - first VTEP"
+       tc_check_packets "$ns2" "dev vx0 ingress" 102 0
+@@ -2031,7 +2067,7 @@ all_zeros_mdb_common()
+       # Send unregistered IPv4 multicast that is not link-local and make sure
+       # it arrives to the first and second VTEPs.
+-      run_cmd "ip netns exec $ns1 mausezahn br0.10 -A $ipv4_src -B $ipv4_unreg_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 mausezahn br0.10 -a own -b $ipv4_unreg_grp_dmac -A $ipv4_src -B $ipv4_unreg_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 2
+       log_test $? 0 "Unregistered IPv4 multicast - first VTEP"
+       tc_check_packets "$ns2" "dev vx0 ingress" 102 1
+@@ -2039,7 +2075,7 @@ all_zeros_mdb_common()
+       # Send IPv4 link-local multicast traffic and make sure it does not
+       # arrive to any VTEP.
+-      run_cmd "ip netns exec $ns1 mausezahn br0.10 -A $ipv4_src -B $ipv4_ll_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 mausezahn br0.10 -a own -b $ipv4_ll_grp_dmac -A $ipv4_src -B $ipv4_ll_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 2
+       log_test $? 0 "Link-local IPv4 multicast - first VTEP"
+       tc_check_packets "$ns2" "dev vx0 ingress" 102 1
+@@ -2074,7 +2110,7 @@ all_zeros_mdb_common()
+       # Send registered IPv6 multicast and make sure it only arrives to the
+       # third VTEP.
+-      run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -A $ipv6_src -B $ipv6_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -a own -b $ipv6_grp_dmac -A $ipv6_src -B $ipv6_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 103 1
+       log_test $? 0 "Registered IPv6 multicast - third VTEP"
+       tc_check_packets "$ns2" "dev vx0 ingress" 104 0
+@@ -2082,7 +2118,7 @@ all_zeros_mdb_common()
+       # Send unregistered IPv6 multicast that is not link-local and make sure
+       # it arrives to the third and fourth VTEPs.
+-      run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -A $ipv6_src -B $ipv6_unreg_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -a own -b $ipv6_unreg_grp_dmac -A $ipv6_src -B $ipv6_unreg_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 103 2
+       log_test $? 0 "Unregistered IPv6 multicast - third VTEP"
+       tc_check_packets "$ns2" "dev vx0 ingress" 104 1
+@@ -2090,7 +2126,7 @@ all_zeros_mdb_common()
+       # Send IPv6 link-local multicast traffic and make sure it does not
+       # arrive to any VTEP.
+-      run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -A $ipv6_src -B $ipv6_ll_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -a own -b $ipv6_ll_grp_dmac -A $ipv6_src -B $ipv6_ll_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 103 2
+       log_test $? 0 "Link-local IPv6 multicast - third VTEP"
+       tc_check_packets "$ns2" "dev vx0 ingress" 104 1
+@@ -2165,6 +2201,7 @@ mdb_fdb_common()
+       local plen=$1; shift
+       local proto=$1; shift
+       local grp=$1; shift
++      local grp_dmac=$1; shift
+       local src=$1; shift
+       local mz=$1; shift
+@@ -2188,7 +2225,7 @@ mdb_fdb_common()
+       # Send IP multicast traffic and make sure it is forwarded by the MDB
+       # and only arrives to the first VTEP.
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 1
+       log_test $? 0 "IP multicast - first VTEP"
+       tc_check_packets "$ns2" "dev vx0 ingress" 102 0
+@@ -2205,7 +2242,7 @@ mdb_fdb_common()
+       # Remove the MDB entry and make sure that IP multicast is now forwarded
+       # by the FDB to the second VTEP.
+       run_cmd "bridge -n $ns1 mdb del dev vx0 port vx0 grp $grp dst $vtep1_ip src_vni 10010"
+-      run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
++      run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q"
+       tc_check_packets "$ns2" "dev vx0 ingress" 101 1
+       log_test $? 0 "IP multicast after removal - first VTEP"
+       tc_check_packets "$ns2" "dev vx0 ingress" 102 2
+@@ -2221,14 +2258,15 @@ mdb_fdb_ipv4_ipv4()
+       local plen=32
+       local proto="ipv4"
+       local grp=239.1.1.1
++      local grp_dmac=01:00:5e:01:01:01
+       local src=192.0.2.129
+       echo
+       echo "Data path: MDB with FDB - IPv4 overlay / IPv4 underlay"
+       echo "------------------------------------------------------"
+-      mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp $src \
+-              "mausezahn"
++      mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp \
++              $grp_dmac $src "mausezahn"
+ }
+ mdb_fdb_ipv6_ipv4()
+@@ -2240,14 +2278,15 @@ mdb_fdb_ipv6_ipv4()
+       local plen=32
+       local proto="ipv6"
+       local grp=ff0e::1
++      local grp_dmac=33:33:00:00:00:01
+       local src=2001:db8:100::1
+       echo
+       echo "Data path: MDB with FDB - IPv6 overlay / IPv4 underlay"
+       echo "------------------------------------------------------"
+-      mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp $src \
+-              "mausezahn -6"
++      mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp \
++              $grp_dmac $src "mausezahn -6"
+ }
+ mdb_fdb_ipv4_ipv6()
+@@ -2259,14 +2298,15 @@ mdb_fdb_ipv4_ipv6()
+       local plen=128
+       local proto="ipv4"
+       local grp=239.1.1.1
++      local grp_dmac=01:00:5e:01:01:01
+       local src=192.0.2.129
+       echo
+       echo "Data path: MDB with FDB - IPv4 overlay / IPv6 underlay"
+       echo "------------------------------------------------------"
+-      mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp $src \
+-              "mausezahn"
++      mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp \
++              $grp_dmac $src "mausezahn"
+ }
+ mdb_fdb_ipv6_ipv6()
+@@ -2278,14 +2318,15 @@ mdb_fdb_ipv6_ipv6()
+       local plen=128
+       local proto="ipv6"
+       local grp=ff0e::1
++      local grp_dmac=33:33:00:00:00:01
+       local src=2001:db8:100::1
+       echo
+       echo "Data path: MDB with FDB - IPv6 overlay / IPv6 underlay"
+       echo "------------------------------------------------------"
+-      mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp $src \
+-              "mausezahn -6"
++      mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp \
++              $grp_dmac $src "mausezahn -6"
+ }
+ mdb_grp1_loop()
+@@ -2320,7 +2361,9 @@ mdb_torture_common()
+       local vtep1_ip=$1; shift
+       local vtep2_ip=$1; shift
+       local grp1=$1; shift
++      local grp1_dmac=$1; shift
+       local grp2=$1; shift
++      local grp2_dmac=$1; shift
+       local src=$1; shift
+       local mz=$1; shift
+       local pid1
+@@ -2345,9 +2388,9 @@ mdb_torture_common()
+       pid1=$!
+       mdb_grp2_loop $ns1 $vtep1_ip $vtep2_ip $grp2 &
+       pid2=$!
+-      ip netns exec $ns1 $mz br0.10 -A $src -B $grp1 -t udp sp=12345,dp=54321 -p 100 -c 0 -q &
++      ip netns exec $ns1 $mz br0.10 -a own -b $grp1_dmac -A $src -B $grp1 -t udp sp=12345,dp=54321 -p 100 -c 0 -q &
+       pid3=$!
+-      ip netns exec $ns1 $mz br0.10 -A $src -B $grp2 -t udp sp=12345,dp=54321 -p 100 -c 0 -q &
++      ip netns exec $ns1 $mz br0.10 -a own -b $grp2_dmac -A $src -B $grp2 -t udp sp=12345,dp=54321 -p 100 -c 0 -q &
+       pid4=$!
+       sleep 30
+@@ -2363,15 +2406,17 @@ mdb_torture_ipv4_ipv4()
+       local vtep1_ip=198.51.100.100
+       local vtep2_ip=198.51.100.200
+       local grp1=239.1.1.1
++      local grp1_dmac=01:00:5e:01:01:01
+       local grp2=239.2.2.2
++      local grp2_dmac=01:00:5e:02:02:02
+       local src=192.0.2.129
+       echo
+       echo "Data path: MDB torture test - IPv4 overlay / IPv4 underlay"
+       echo "----------------------------------------------------------"
+-      mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp2 $src \
+-              "mausezahn"
++      mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp1_dmac $grp2 \
++              $grp2_dmac $src "mausezahn"
+ }
+ mdb_torture_ipv6_ipv4()
+@@ -2380,15 +2425,17 @@ mdb_torture_ipv6_ipv4()
+       local vtep1_ip=198.51.100.100
+       local vtep2_ip=198.51.100.200
+       local grp1=ff0e::1
++      local grp1_dmac=33:33:00:00:00:01
+       local grp2=ff0e::2
++      local grp2_dmac=33:33:00:00:00:02
+       local src=2001:db8:100::1
+       echo
+       echo "Data path: MDB torture test - IPv6 overlay / IPv4 underlay"
+       echo "----------------------------------------------------------"
+-      mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp2 $src \
+-              "mausezahn -6"
++      mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp1_dmac $grp2 \
++              $grp2_dmac $src "mausezahn -6"
+ }
+ mdb_torture_ipv4_ipv6()
+@@ -2397,15 +2444,17 @@ mdb_torture_ipv4_ipv6()
+       local vtep1_ip=2001:db8:1000::1
+       local vtep2_ip=2001:db8:2000::1
+       local grp1=239.1.1.1
++      local grp1_dmac=01:00:5e:01:01:01
+       local grp2=239.2.2.2
++      local grp2_dmac=01:00:5e:02:02:02
+       local src=192.0.2.129
+       echo
+       echo "Data path: MDB torture test - IPv4 overlay / IPv6 underlay"
+       echo "----------------------------------------------------------"
+-      mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp2 $src \
+-              "mausezahn"
++      mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp1_dmac $grp2 \
++              $grp2_dmac $src "mausezahn"
+ }
+ mdb_torture_ipv6_ipv6()
+@@ -2414,15 +2463,17 @@ mdb_torture_ipv6_ipv6()
+       local vtep1_ip=2001:db8:1000::1
+       local vtep2_ip=2001:db8:2000::1
+       local grp1=ff0e::1
++      local grp1_dmac=33:33:00:00:00:01
+       local grp2=ff0e::2
++      local grp2_dmac=33:33:00:00:00:02
+       local src=2001:db8:100::1
+       echo
+       echo "Data path: MDB torture test - IPv6 overlay / IPv6 underlay"
+       echo "----------------------------------------------------------"
+-      mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp2 $src \
+-              "mausezahn -6"
++      mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp1_dmac $grp2 \
++              $grp2_dmac $src "mausezahn -6"
+ }
+ ################################################################################
+-- 
+2.43.0
+
diff --git a/queue-6.8/series b/queue-6.8/series
new file mode 100644 (file)
index 0000000..827e3c3
--- /dev/null
@@ -0,0 +1,63 @@
+scripts-bpf_doc-use-silent-mode-when-exec-make-cmd.patch
+xsk-don-t-assume-metadata-is-always-requested-in-tx-.patch
+s390-bpf-fix-bpf_plt-pointer-arithmetic.patch
+bpf-arm64-fix-bug-in-bpf_ldx_memsx.patch
+dma-buf-fix-null-pointer-dereference-in-sanitycheck.patch
+arm64-bpf-fix-32bit-unconditional-bswap.patch
+nfc-nci-fix-uninit-value-in-nci_dev_up-and-nci_ntf_p.patch
+nfsd-fix-error-cleanup-path-in-nfsd_rename.patch
+tools-ynl-fix-setting-presence-bits-in-simple-nests.patch
+mlxbf_gige-stop-phy-during-open-error-paths.patch
+wifi-iwlwifi-mvm-pick-the-version-of-session_protect.patch
+wifi-iwlwifi-mvm-rfi-fix-potential-response-leaks.patch
+wifi-iwlwifi-mvm-include-link-id-when-releasing-fram.patch
+alsa-hda-cs35l56-set-the-init_done-flag-before-compo.patch
+ice-refactor-fw-data-type-and-fix-bitmap-casting-iss.patch
+ice-fix-memory-corruption-bug-with-suspend-and-rebui.patch
+ixgbe-avoid-sleeping-allocation-in-ixgbe_ipsec_vf_ad.patch
+igc-remove-stale-comment-about-tx-timestamping.patch
+drm-xe-remove-unused-xe_bo-props-struct.patch
+drm-xe-add-exec_queue.sched_props.job_timeout_ms.patch
+drm-xe-guc_submit-use-jiffies-for-job-timeout.patch
+drm-xe-queue-fix-engine_class-bounds-check.patch
+drm-xe-device-fix-xe_max_gt_per_tile-check.patch
+drm-xe-device-fix-xe_max_tiles_per_device-check.patch
+dpll-indent-dpll-option-type-by-a-tab.patch
+s390-qeth-handle-deferred-cc1.patch
+net-hsr-hsr_slave-fix-the-promiscuous-mode-in-offloa.patch
+tcp-properly-terminate-timers-for-kernel-sockets.patch
+net-wwan-t7xx-split-64bit-accesses-to-fix-alignment-.patch
+drm-rockchip-vop2-remove-ar30-and-ab30-format-suppor.patch
+selftests-vxlan_mdb-fix-failures-with-old-libnet.patch
+gpio-protect-the-list-of-gpio-devices-with-srcu.patch
+gpiolib-fix-debug-messaging-in-gpiod_find_and_reques.patch
+acpica-debugger-check-status-of-acpi_evaluate_object.patch
+net-hns3-fix-index-limit-to-support-all-queue-stats.patch
+net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
+net-hns3-mark-unexcuted-loopback-test-result-as-unex.patch
+tls-recv-process_rx_list-shouldn-t-use-an-offset-wit.patch
+tls-adjust-recv-return-with-async-crypto-and-failed-.patch
+tls-get-psock-ref-after-taking-rxlock-to-avoid-leak.patch
+mlxbf_gige-call-request_irq-after-napi-initialized.patch
+drm-amd-display-update-p010-scaling-cap.patch
+drm-amd-display-send-dtbclk-disable-message-on-first.patch
+bpf-protect-against-int-overflow-for-stack-access-si.patch
+cifs-fix-duplicate-fscache-cookie-warnings.patch
+netfilter-nf_tables-reject-destroy-command-to-remove.patch
+netfilter-nf_tables-reject-table-flag-and-netdev-bas.patch
+netfilter-nf_tables-skip-netdev-hook-unregistration-.patch
+iommu-validate-the-pasid-in-iommu_attach_device_pasi.patch
+net-bcmasp-bring-up-unimac-after-phy-link-up.patch
+net-lan743x-add-set-rfe-read-fifo-threshold-for-pci1.patch
+octeontx2-af-fix-pause-frame-configuration-in-gmp-mo.patch
+inet-inet_defrag-prevent-sk-release-while-still-in-u.patch
+drm-i915-stop-doing-double-audio-enable-disable-on-s.patch
+drm-i915-display-disable-auxccs-framebuffers-if-buil.patch
+drm-i915-xelpg-extend-some-workarounds-tuning-to-gfx.patch
+drm-i915-mtl-update-workaround-14018575942.patch
+drm-i915-do-not-print-pxp-init-failed-with-0-when-it.patch
+dm-integrity-fix-out-of-range-warning.patch
+modpost-do-not-make-find_tosym-return-null.patch
+kbuild-make-woverride-init-warnings-more-consistent.patch
+mm-treewide-replace-pud_large-with-pud_leaf.patch
+revert-x86-mm-ident_map-use-gbpages-only-where-full-.patch
diff --git a/queue-6.8/tcp-properly-terminate-timers-for-kernel-sockets.patch b/queue-6.8/tcp-properly-terminate-timers-for-kernel-sockets.patch
new file mode 100644 (file)
index 0000000..046dec4
--- /dev/null
@@ -0,0 +1,138 @@
+From f49d36d1ccfaa6e3bd0e3f1124a2a32b81d3aa44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2024 13:57:32 +0000
+Subject: tcp: properly terminate timers for kernel sockets
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 151c9c724d05d5b0dd8acd3e11cb69ef1f2dbada ]
+
+We had various syzbot reports about tcp timers firing after
+the corresponding netns has been dismantled.
+
+Fortunately Josef Bacik could trigger the issue more often,
+and could test a patch I wrote two years ago.
+
+When TCP sockets are closed, we call inet_csk_clear_xmit_timers()
+to 'stop' the timers.
+
+inet_csk_clear_xmit_timers() can be called from any context,
+including when socket lock is held.
+This is the reason it uses sk_stop_timer(), aka del_timer().
+This means that ongoing timers might finish much later.
+
+For user sockets, this is fine because each running timer
+holds a reference on the socket, and the user socket holds
+a reference on the netns.
+
+For kernel sockets, we risk that the netns is freed before
+timer can complete, because kernel sockets do not hold
+reference on the netns.
+
+This patch adds inet_csk_clear_xmit_timers_sync() function
+that using sk_stop_timer_sync() to make sure all timers
+are terminated before the kernel socket is released.
+Modules using kernel sockets close them in their netns exit()
+handler.
+
+Also add sock_not_owned_by_me() helper to get LOCKDEP
+support : inet_csk_clear_xmit_timers_sync() must not be called
+while socket lock is held.
+
+It is very possible we can revert in the future commit
+3a58f13a881e ("net: rds: acquire refcount on TCP sockets")
+which attempted to solve the issue in rds only.
+(net/smc/af_smc.c and net/mptcp/subflow.c have similar code)
+
+We probably can remove the check_net() tests from
+tcp_out_of_resources() and __tcp_close() in the future.
+
+Reported-by: Josef Bacik <josef@toxicpanda.com>
+Closes: https://lore.kernel.org/netdev/20240314210740.GA2823176@perftesting/
+Fixes: 26abe14379f8 ("net: Modify sk_alloc to not reference count the netns of kernel sockets.")
+Fixes: 8a68173691f0 ("net: sk_clone_lock() should only do get_net() if the parent is not a kernel socket")
+Link: https://lore.kernel.org/bpf/CANn89i+484ffqb93aQm1N-tjxxvb3WDKX0EbD7318RwRgsatjw@mail.gmail.com/
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Tested-by: Josef Bacik <josef@toxicpanda.com>
+Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Link: https://lore.kernel.org/r/20240322135732.1535772-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/inet_connection_sock.h |  1 +
+ include/net/sock.h                 |  7 +++++++
+ net/ipv4/inet_connection_sock.c    | 14 ++++++++++++++
+ net/ipv4/tcp.c                     |  2 ++
+ 4 files changed, 24 insertions(+)
+
+diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
+index 9ab4bf704e864..ccf171f7eb60d 100644
+--- a/include/net/inet_connection_sock.h
++++ b/include/net/inet_connection_sock.h
+@@ -175,6 +175,7 @@ void inet_csk_init_xmit_timers(struct sock *sk,
+                              void (*delack_handler)(struct timer_list *),
+                              void (*keepalive_handler)(struct timer_list *));
+ void inet_csk_clear_xmit_timers(struct sock *sk);
++void inet_csk_clear_xmit_timers_sync(struct sock *sk);
+ static inline void inet_csk_schedule_ack(struct sock *sk)
+ {
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 54ca8dcbfb433..4afb4376c97e8 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1779,6 +1779,13 @@ static inline void sock_owned_by_me(const struct sock *sk)
+ #endif
+ }
++static inline void sock_not_owned_by_me(const struct sock *sk)
++{
++#ifdef CONFIG_LOCKDEP
++      WARN_ON_ONCE(lockdep_sock_is_held(sk) && debug_locks);
++#endif
++}
++
+ static inline bool sock_owned_by_user(const struct sock *sk)
+ {
+       sock_owned_by_me(sk);
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index 459af1f897395..17eb9ae912239 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -771,6 +771,20 @@ void inet_csk_clear_xmit_timers(struct sock *sk)
+ }
+ EXPORT_SYMBOL(inet_csk_clear_xmit_timers);
++void inet_csk_clear_xmit_timers_sync(struct sock *sk)
++{
++      struct inet_connection_sock *icsk = inet_csk(sk);
++
++      /* ongoing timer handlers need to acquire socket lock. */
++      sock_not_owned_by_me(sk);
++
++      icsk->icsk_pending = icsk->icsk_ack.pending = 0;
++
++      sk_stop_timer_sync(sk, &icsk->icsk_retransmit_timer);
++      sk_stop_timer_sync(sk, &icsk->icsk_delack_timer);
++      sk_stop_timer_sync(sk, &sk->sk_timer);
++}
++
+ void inet_csk_delete_keepalive_timer(struct sock *sk)
+ {
+       sk_stop_timer(sk, &sk->sk_timer);
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index a4f4185923144..5887eac87bd28 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2930,6 +2930,8 @@ void tcp_close(struct sock *sk, long timeout)
+       lock_sock(sk);
+       __tcp_close(sk, timeout);
+       release_sock(sk);
++      if (!sk->sk_net_refcnt)
++              inet_csk_clear_xmit_timers_sync(sk);
+       sock_put(sk);
+ }
+ EXPORT_SYMBOL(tcp_close);
+-- 
+2.43.0
+
diff --git a/queue-6.8/tls-adjust-recv-return-with-async-crypto-and-failed-.patch b/queue-6.8/tls-adjust-recv-return-with-async-crypto-and-failed-.patch
new file mode 100644 (file)
index 0000000..cca82ea
--- /dev/null
@@ -0,0 +1,50 @@
+From 51d65a1266d8399a6c1b603707b947cdbbe8e3cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Mar 2024 16:56:46 +0100
+Subject: tls: adjust recv return with async crypto and failed copy to
+ userspace
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit 85eef9a41d019b59be7bc91793f26251909c0710 ]
+
+process_rx_list may not copy as many bytes as we want to the userspace
+buffer, for example in case we hit an EFAULT during the copy. If this
+happens, we should only count the bytes that were actually copied,
+which may be 0.
+
+Subtracting async_copy_bytes is correct in both peek and !peek cases,
+because decrypted == async_copy_bytes + peeked for the peek case: peek
+is always !ZC, and we can go through either the sync or async path. In
+the async case, we add chunk to both decrypted and
+async_copy_bytes. In the sync case, we add chunk to both decrypted and
+peeked. I missed that in commit 6caaf104423d ("tls: fix peeking with
+sync+async decryption").
+
+Fixes: 4d42cd6bc2ac ("tls: rx: fix return value for async crypto")
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://lore.kernel.org/r/1b5a1eaab3c088a9dd5d9f1059ceecd7afe888d1.1711120964.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index 3cdc6bc9fba69..14faf6189eb14 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -2158,6 +2158,9 @@ int tls_sw_recvmsg(struct sock *sk,
+               else
+                       err = process_rx_list(ctx, msg, &control, 0,
+                                             async_copy_bytes, is_peek, NULL);
++
++              /* we could have copied less than we wanted, and possibly nothing */
++              decrypted += max(err, 0) - async_copy_bytes;
+       }
+       copied += decrypted;
+-- 
+2.43.0
+
diff --git a/queue-6.8/tls-get-psock-ref-after-taking-rxlock-to-avoid-leak.patch b/queue-6.8/tls-get-psock-ref-after-taking-rxlock-to-avoid-leak.patch
new file mode 100644 (file)
index 0000000..f07f192
--- /dev/null
@@ -0,0 +1,45 @@
+From 1fce83d0b6de5a7217fdde308d1d48c666a26d9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Mar 2024 16:56:48 +0100
+Subject: tls: get psock ref after taking rxlock to avoid leak
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit 417e91e856099e9b8a42a2520e2255e6afe024be ]
+
+At the start of tls_sw_recvmsg, we take a reference on the psock, and
+then call tls_rx_reader_lock. If that fails, we return directly
+without releasing the reference.
+
+Instead of adding a new label, just take the reference after locking
+has succeeded, since we don't need it before.
+
+Fixes: 4cbc325ed6b4 ("tls: rx: allow only one reader at a time")
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://lore.kernel.org/r/fe2ade22d030051ce4c3638704ed58b67d0df643.1711120964.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index 14faf6189eb14..b783231668c65 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1976,10 +1976,10 @@ int tls_sw_recvmsg(struct sock *sk,
+       if (unlikely(flags & MSG_ERRQUEUE))
+               return sock_recv_errqueue(sk, msg, len, SOL_IP, IP_RECVERR);
+-      psock = sk_psock_get(sk);
+       err = tls_rx_reader_lock(sk, ctx, flags & MSG_DONTWAIT);
+       if (err < 0)
+               return err;
++      psock = sk_psock_get(sk);
+       bpf_strp_enabled = sk_psock_strp_enabled(psock);
+       /* If crypto failed the connection is broken */
+-- 
+2.43.0
+
diff --git a/queue-6.8/tls-recv-process_rx_list-shouldn-t-use-an-offset-wit.patch b/queue-6.8/tls-recv-process_rx_list-shouldn-t-use-an-offset-wit.patch
new file mode 100644 (file)
index 0000000..0449316
--- /dev/null
@@ -0,0 +1,41 @@
+From 5b173d50bc75465bf53e408e72cd12e99ef70077 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Mar 2024 16:56:45 +0100
+Subject: tls: recv: process_rx_list shouldn't use an offset with kvec
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit 7608a971fdeb4c3eefa522d1bfe8d4bc6b2481cc ]
+
+Only MSG_PEEK needs to copy from an offset during the final
+process_rx_list call, because the bytes we copied at the beginning of
+tls_sw_recvmsg were left on the rx_list. In the KVEC case, we removed
+data from the rx_list as we were copying it, so there's no need to use
+an offset, just like in the normal case.
+
+Fixes: 692d7b5d1f91 ("tls: Fix recvmsg() to be able to peek across multiple records")
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://lore.kernel.org/r/e5487514f828e0347d2b92ca40002c62b58af73d.1711120964.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index 211f57164cb61..3cdc6bc9fba69 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -2152,7 +2152,7 @@ int tls_sw_recvmsg(struct sock *sk,
+               }
+               /* Drain records from the rx_list & copy if required */
+-              if (is_peek || is_kvec)
++              if (is_peek)
+                       err = process_rx_list(ctx, msg, &control, copied + peeked,
+                                             decrypted - peeked, is_peek, NULL);
+               else
+-- 
+2.43.0
+
diff --git a/queue-6.8/tools-ynl-fix-setting-presence-bits-in-simple-nests.patch b/queue-6.8/tools-ynl-fix-setting-presence-bits-in-simple-nests.patch
new file mode 100644 (file)
index 0000000..5e71247
--- /dev/null
@@ -0,0 +1,44 @@
+From 378918a750596101703bc4a990141c06ebb9a589 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Mar 2024 19:02:14 -0700
+Subject: tools: ynl: fix setting presence bits in simple nests
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit f6c8f5e8694c7a78c94e408b628afa6255cc428a ]
+
+When we set members of simple nested structures in requests
+we need to set "presence" bits for all the nesting layers
+below. This has nothing to do with the presence type of
+the last layer.
+
+Fixes: be5bea1cc0bf ("net: add basic C code generators for Netlink")
+Reviewed-by: Breno Leitao <leitao@debian.org>
+Link: https://lore.kernel.org/r/20240321020214.1250202-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/net/ynl/ynl-gen-c.py | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/tools/net/ynl/ynl-gen-c.py b/tools/net/ynl/ynl-gen-c.py
+index 7fc1aa788f6f5..c19dec2394915 100755
+--- a/tools/net/ynl/ynl-gen-c.py
++++ b/tools/net/ynl/ynl-gen-c.py
+@@ -243,8 +243,11 @@ class Type(SpecAttr):
+         presence = ''
+         for i in range(0, len(ref)):
+             presence = f"{var}->{'.'.join(ref[:i] + [''])}_present.{ref[i]}"
+-            if self.presence_type() == 'bit':
+-                code.append(presence + ' = 1;')
++            # Every layer below last is a nest, so we know it uses bit presence
++            # last layer is "self" and may be a complex type
++            if i == len(ref) - 1 and self.presence_type() != 'bit':
++                continue
++            code.append(presence + ' = 1;')
+         code += self._setter_lines(ri, member, presence)
+         func_name = f"{op_prefix(ri, direction, deref=deref)}_set_{'_'.join(ref)}"
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-iwlwifi-mvm-include-link-id-when-releasing-fram.patch b/queue-6.8/wifi-iwlwifi-mvm-include-link-id-when-releasing-fram.patch
new file mode 100644 (file)
index 0000000..84b1ba2
--- /dev/null
@@ -0,0 +1,88 @@
+From 396ee86c3c23612e8ee97379b060a368a462129e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Mar 2024 23:26:22 +0200
+Subject: wifi: iwlwifi: mvm: include link ID when releasing frames
+
+From: Benjamin Berg <benjamin.berg@intel.com>
+
+[ Upstream commit e78d7877308989ef91b64a3c746ae31324c07caa ]
+
+When releasing frames from the reorder buffer, the link ID was not
+included in the RX status information. This subsequently led mac80211 to
+drop the frame. Change it so that the link information is set
+immediately when possible so that it doesn't not need to be filled in
+anymore when submitting the frame to mac80211.
+
+Fixes: b8a85a1d42d7 ("wifi: iwlwifi: mvm: rxmq: report link ID to mac80211")
+Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
+Tested-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240320232419.bbbd5e9bfe80.Iec1bf5c884e371f7bc5ea2534ed9ea8d3f2c0bf6@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 20 ++++++++-----------
+ 1 file changed, 8 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+index 7bf2a5947e5e9..481dfbbe46162 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+@@ -236,21 +236,13 @@ static void iwl_mvm_add_rtap_sniffer_config(struct iwl_mvm *mvm,
+ static void iwl_mvm_pass_packet_to_mac80211(struct iwl_mvm *mvm,
+                                           struct napi_struct *napi,
+                                           struct sk_buff *skb, int queue,
+-                                          struct ieee80211_sta *sta,
+-                                          struct ieee80211_link_sta *link_sta)
++                                          struct ieee80211_sta *sta)
+ {
+       if (unlikely(iwl_mvm_check_pn(mvm, skb, queue, sta))) {
+               kfree_skb(skb);
+               return;
+       }
+-      if (sta && sta->valid_links && link_sta) {
+-              struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
+-
+-              rx_status->link_valid = 1;
+-              rx_status->link_id = link_sta->link_id;
+-      }
+-
+       ieee80211_rx_napi(mvm->hw, sta, skb, napi);
+ }
+@@ -587,7 +579,7 @@ static void iwl_mvm_release_frames(struct iwl_mvm *mvm,
+               while ((skb = __skb_dequeue(skb_list))) {
+                       iwl_mvm_pass_packet_to_mac80211(mvm, napi, skb,
+                                                       reorder_buf->queue,
+-                                                      sta, NULL /* FIXME */);
++                                                      sta);
+                       reorder_buf->num_stored--;
+               }
+       }
+@@ -2214,6 +2206,11 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
+                       if (IS_ERR(sta))
+                               sta = NULL;
+                       link_sta = rcu_dereference(mvm->fw_id_to_link_sta[id]);
++
++                      if (sta && sta->valid_links && link_sta) {
++                              rx_status->link_valid = 1;
++                              rx_status->link_id = link_sta->link_id;
++                      }
+               }
+       } else if (!is_multicast_ether_addr(hdr->addr2)) {
+               /*
+@@ -2357,8 +2354,7 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
+                   !(desc->amsdu_info & IWL_RX_MPDU_AMSDU_LAST_SUBFRAME))
+                       rx_status->flag |= RX_FLAG_AMSDU_MORE;
+-              iwl_mvm_pass_packet_to_mac80211(mvm, napi, skb, queue, sta,
+-                                              link_sta);
++              iwl_mvm_pass_packet_to_mac80211(mvm, napi, skb, queue, sta);
+       }
+ out:
+       rcu_read_unlock();
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-iwlwifi-mvm-pick-the-version-of-session_protect.patch b/queue-6.8/wifi-iwlwifi-mvm-pick-the-version-of-session_protect.patch
new file mode 100644 (file)
index 0000000..21aeea7
--- /dev/null
@@ -0,0 +1,72 @@
+From c29e867999a75d8621caba8090f89a6943455331 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Mar 2024 08:28:01 +0200
+Subject: wifi: iwlwifi: mvm: pick the version of SESSION_PROTECTION_NOTIF
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+[ Upstream commit bbe806c294c9c4cd1221140d96e5f367673e393a ]
+
+When we want to know whether we should look for the mac_id or the
+link_id in struct iwl_mvm_session_prot_notif, we should look at the
+version of SESSION_PROTECTION_NOTIF.
+
+This causes WARNINGs:
+
+WARNING: CPU: 0 PID: 11403 at drivers/net/wireless/intel/iwlwifi/mvm/time-event.c:959 iwl_mvm_rx_session_protect_notif+0x333/0x340 [iwlmvm]
+RIP: 0010:iwl_mvm_rx_session_protect_notif+0x333/0x340 [iwlmvm]
+Code: 00 49 c7 84 24 48 07 00 00 00 00 00 00 41 c6 84 24 78 07 00 00 ff 4c 89 f7 e8 e9 71 54 d9 e9 7d fd ff ff 0f 0b e9 23 fe ff ff <0f> 0b e9 1c fe ff ff 66 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90
+RSP: 0018:ffffb4bb00003d40 EFLAGS: 00010202
+RAX: 0000000000000000 RBX: ffff9ae63a361000 RCX: ffff9ae4a98b60d4
+RDX: ffff9ae4588499c0 RSI: 0000000000000305 RDI: ffff9ae4a98b6358
+RBP: ffffb4bb00003d68 R08: 0000000000000003 R09: 0000000000000010
+R10: ffffb4bb00003d00 R11: 000000000000000f R12: ffff9ae441399050
+R13: ffff9ae4761329e8 R14: 0000000000000001 R15: 0000000000000000
+FS:  0000000000000000(0000) GS:ffff9ae7af400000(0000) knlGS:0000000000000000
+CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 000055fb75680018 CR3: 00000003dae32006 CR4: 0000000000f70ef0
+PKRU: 55555554
+Call Trace:
+ <IRQ>
+ ? show_regs+0x69/0x80
+ ? __warn+0x8d/0x150
+ ? iwl_mvm_rx_session_protect_notif+0x333/0x340 [iwlmvm]
+ ? report_bug+0x196/0x1c0
+ ? handle_bug+0x45/0x80
+ ? exc_invalid_op+0x1c/0xb0
+ ? asm_exc_invalid_op+0x1f/0x30
+ ? iwl_mvm_rx_session_protect_notif+0x333/0x340 [iwlmvm]
+ iwl_mvm_rx_common+0x115/0x340 [iwlmvm]
+ iwl_mvm_rx_mq+0xa6/0x100 [iwlmvm]
+ iwl_pcie_rx_handle+0x263/0xa10 [iwlwifi]
+ iwl_pcie_napi_poll_msix+0x32/0xd0 [iwlwifi]
+
+Fixes: 085d33c53012 ("wifi: iwlwifi: support link id in SESSION_PROTECTION_NOTIF")
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240311081938.39d5618f7b9d.I564d863e53c6cbcb49141467932ecb6a9840b320@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/time-event.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+index da00ef6e4fbcf..3d96a824dbd65 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+@@ -898,9 +898,8 @@ void iwl_mvm_rx_session_protect_notif(struct iwl_mvm *mvm,
+       struct iwl_rx_packet *pkt = rxb_addr(rxb);
+       struct iwl_mvm_session_prot_notif *notif = (void *)pkt->data;
+       unsigned int ver =
+-              iwl_fw_lookup_cmd_ver(mvm->fw,
+-                                    WIDE_ID(MAC_CONF_GROUP,
+-                                            SESSION_PROTECTION_CMD), 2);
++              iwl_fw_lookup_notif_ver(mvm->fw, MAC_CONF_GROUP,
++                                      SESSION_PROTECTION_NOTIF, 2);
+       int id = le32_to_cpu(notif->mac_link_id);
+       struct ieee80211_vif *vif;
+       struct iwl_mvm_vif *mvmvif;
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-iwlwifi-mvm-rfi-fix-potential-response-leaks.patch b/queue-6.8/wifi-iwlwifi-mvm-rfi-fix-potential-response-leaks.patch
new file mode 100644 (file)
index 0000000..cec766a
--- /dev/null
@@ -0,0 +1,51 @@
+From aa8fa0243888abb0a7897c00a324ad020d07afcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Mar 2024 10:10:17 +0200
+Subject: wifi: iwlwifi: mvm: rfi: fix potential response leaks
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 06a093807eb7b5c5b29b6cff49f8174a4e702341 ]
+
+If the rx payload length check fails, or if kmemdup() fails,
+we still need to free the command response. Fix that.
+
+Fixes: 21254908cbe9 ("iwlwifi: mvm: add RFI-M support")
+Co-authored-by: Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240319100755.db2fa0196aa7.I116293b132502ac68a65527330fa37799694b79c@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/rfi.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rfi.c b/drivers/net/wireless/intel/iwlwifi/mvm/rfi.c
+index 2ecd32bed752f..045c862a8fc4f 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rfi.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rfi.c
+@@ -132,14 +132,18 @@ struct iwl_rfi_freq_table_resp_cmd *iwl_rfi_get_freq_table(struct iwl_mvm *mvm)
+       if (ret)
+               return ERR_PTR(ret);
+-      if (WARN_ON_ONCE(iwl_rx_packet_payload_len(cmd.resp_pkt) != resp_size))
++      if (WARN_ON_ONCE(iwl_rx_packet_payload_len(cmd.resp_pkt) !=
++                       resp_size)) {
++              iwl_free_resp(&cmd);
+               return ERR_PTR(-EIO);
++      }
+       resp = kmemdup(cmd.resp_pkt->data, resp_size, GFP_KERNEL);
++      iwl_free_resp(&cmd);
++
+       if (!resp)
+               return ERR_PTR(-ENOMEM);
+-      iwl_free_resp(&cmd);
+       return resp;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/xsk-don-t-assume-metadata-is-always-requested-in-tx-.patch b/queue-6.8/xsk-don-t-assume-metadata-is-always-requested-in-tx-.patch
new file mode 100644 (file)
index 0000000..6fb1249
--- /dev/null
@@ -0,0 +1,39 @@
+From 73e1de4dcd5fc4f3ef1646515ab3172b0c875c14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Mar 2024 09:54:27 -0700
+Subject: xsk: Don't assume metadata is always requested in TX completion
+
+From: Stanislav Fomichev <sdf@google.com>
+
+[ Upstream commit f6e922365faf4cd576bd1cf3e64b58c8a32e1856 ]
+
+`compl->tx_timestam != NULL` means that the user has explicitly
+requested the metadata via XDP_TX_METADATA+XDP_TX_METADATA_TIMESTAMP.
+
+Fixes: 48eb03dd2630 ("xsk: Add TX timestamp and TX checksum offload support")
+Reported-by: Daniele Salvatore Albano <d.albano@gmail.com>
+Signed-off-by: Stanislav Fomichev <sdf@google.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Tested-by: Daniele Salvatore Albano <d.albano@gmail.com>
+Link: https://lore.kernel.org/bpf/20240318165427.1403313-1-sdf@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/xdp_sock.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/include/net/xdp_sock.h b/include/net/xdp_sock.h
+index 3cb4dc9bd70e4..3d54de168a6d9 100644
+--- a/include/net/xdp_sock.h
++++ b/include/net/xdp_sock.h
+@@ -188,6 +188,8 @@ static inline void xsk_tx_metadata_complete(struct xsk_tx_metadata_compl *compl,
+ {
+       if (!compl)
+               return;
++      if (!compl->tx_timestamp)
++              return;
+       *compl->tx_timestamp = ops->tmo_fill_timestamp(priv);
+ }
+-- 
+2.43.0
+