From: Sasha Levin Date: Thu, 22 May 2025 20:52:57 +0000 (-0400) Subject: Fixes for 5.15 X-Git-Tag: v6.12.31~95 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=49d2119d8f449f3751c2d8c21d50b0ea0e04fd0e;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/__legitimize_mnt-check-for-mnt_sync_umount-should-be.patch b/queue-5.15/__legitimize_mnt-check-for-mnt_sync_umount-should-be.patch new file mode 100644 index 0000000000..5597fc6639 --- /dev/null +++ b/queue-5.15/__legitimize_mnt-check-for-mnt_sync_umount-should-be.patch @@ -0,0 +1,48 @@ +From da5fab88b93b8cc4f11d0035749fb65fbf71822b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Apr 2025 15:41:51 -0400 +Subject: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under + mount_lock + +From: Al Viro + +[ Upstream commit 250cf3693060a5f803c5f1ddc082bb06b16112a9 ] + +... or we risk stealing final mntput from sync umount - raising mnt_count +after umount(2) has verified that victim is not busy, but before it +has set MNT_SYNC_UMOUNT; in that case __legitimize_mnt() doesn't see +that it's safe to quietly undo mnt_count increment and leaves dropping +the reference to caller, where it'll be a full-blown mntput(). + +Check under mount_lock is needed; leaving the current one done before +taking that makes no sense - it's nowhere near common enough to bother +with. + +Reviewed-by: Christian Brauner +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + fs/namespace.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/fs/namespace.c b/fs/namespace.c +index 27ec6d0a68ff5..a99a060e89316 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -589,12 +589,8 @@ int __legitimize_mnt(struct vfsmount *bastard, unsigned seq) + smp_mb(); // see mntput_no_expire() and do_umount() + if (likely(!read_seqretry(&mount_lock, seq))) + return 0; +- if (bastard->mnt_flags & MNT_SYNC_UMOUNT) { +- mnt_add_count(mnt, -1); +- return 1; +- } + lock_mount_hash(); +- if (unlikely(bastard->mnt_flags & MNT_DOOMED)) { ++ if (unlikely(bastard->mnt_flags & (MNT_SYNC_UMOUNT | MNT_DOOMED))) { + mnt_add_count(mnt, -1); + unlock_mount_hash(); + return 1; +-- +2.39.5 + diff --git a/queue-5.15/acpi-hed-always-initialize-before-evged.patch b/queue-5.15/acpi-hed-always-initialize-before-evged.patch new file mode 100644 index 0000000000..146bc517de --- /dev/null +++ b/queue-5.15/acpi-hed-always-initialize-before-evged.patch @@ -0,0 +1,67 @@ +From 8355641d13812ad67bb1a84e4c58d751542e2722 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Feb 2025 14:34:08 +0800 +Subject: ACPI: HED: Always initialize before evged + +From: Xiaofei Tan + +[ Upstream commit cccf6ee090c8c133072d5d5b52ae25f3bc907a16 ] + +When the HED driver is built-in, it initializes after evged because they +both are at the same initcall level, so the initialization ordering +depends on the Makefile order. However, this prevents RAS records +coming in between the evged driver initialization and the HED driver +initialization from being handled. + +If the number of such RAS records is above the APEI HEST error source +number, the HEST resources may be exhausted, and that may affect +subsequent RAS error reporting. + +To fix this issue, change the initcall level of HED to subsys_initcall +and prevent the driver from being built as a module by changing ACPI_HED +in Kconfig from "tristate" to "bool". + +Signed-off-by: Xiaofei Tan +Link: https://patch.msgid.link/20250212063408.927666-1-tanxiaofei@huawei.com +[ rjw: Changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/Kconfig | 2 +- + drivers/acpi/hed.c | 7 ++++++- + 2 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig +index 1da360c51d662..6a178e38fc4a8 100644 +--- a/drivers/acpi/Kconfig ++++ b/drivers/acpi/Kconfig +@@ -437,7 +437,7 @@ config ACPI_SBS + the modules will be called sbs and sbshc. + + config ACPI_HED +- tristate "Hardware Error Device" ++ bool "Hardware Error Device" + help + This driver supports the Hardware Error Device (PNP0C33), + which is used to report some hardware errors notified via +diff --git a/drivers/acpi/hed.c b/drivers/acpi/hed.c +index 60a2939cde6c5..e8e9b1ac06b88 100644 +--- a/drivers/acpi/hed.c ++++ b/drivers/acpi/hed.c +@@ -72,7 +72,12 @@ static struct acpi_driver acpi_hed_driver = { + .notify = acpi_hed_notify, + }, + }; +-module_acpi_driver(acpi_hed_driver); ++ ++static int __init acpi_hed_driver_init(void) ++{ ++ return acpi_bus_register_driver(&acpi_hed_driver); ++} ++subsys_initcall(acpi_hed_driver_init); + + MODULE_AUTHOR("Huang Ying"); + MODULE_DESCRIPTION("ACPI Hardware Error Device Driver"); +-- +2.39.5 + diff --git a/queue-5.15/alsa-hda-realtek-add-quirk-for-hp-spectre-x360-15-df.patch b/queue-5.15/alsa-hda-realtek-add-quirk-for-hp-spectre-x360-15-df.patch new file mode 100644 index 0000000000..9554d50a4a --- /dev/null +++ b/queue-5.15/alsa-hda-realtek-add-quirk-for-hp-spectre-x360-15-df.patch @@ -0,0 +1,106 @@ +From 7d785986046a0f4e8b4d469c5d241c7e24af314b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Apr 2025 10:10:34 +0200 +Subject: ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx + +From: Takashi Iwai + +[ Upstream commit be0c40da888840fe91b45474cb70779e6cbaf7ca ] + +HP Spectre x360 15-df1xxx with SSID 13c:863e requires similar +workarounds that were applied to another HP Spectre x360 models; +it has a mute LED only, no micmute LEDs, and needs the speaker GPIO +seup. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=220054 +Link: https://patch.msgid.link/20250427081035.11567-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 42 +++++++++++++++++++++++++++++++++++ + 1 file changed, 42 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index e1de24c9f6265..7a8ac8d3d2175 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6758,6 +6758,41 @@ static void alc285_fixup_hp_spectre_x360_eb1(struct hda_codec *codec, + } + } + ++/* GPIO1 = amplifier on/off */ ++static void alc285_fixup_hp_spectre_x360_df1(struct hda_codec *codec, ++ const struct hda_fixup *fix, ++ int action) ++{ ++ struct alc_spec *spec = codec->spec; ++ static const hda_nid_t conn[] = { 0x02 }; ++ static const struct hda_pintbl pincfgs[] = { ++ { 0x14, 0x90170110 }, /* front/high speakers */ ++ { 0x17, 0x90170130 }, /* back/bass speakers */ ++ { } ++ }; ++ ++ // enable mute led ++ alc285_fixup_hp_mute_led_coefbit(codec, fix, action); ++ ++ switch (action) { ++ case HDA_FIXUP_ACT_PRE_PROBE: ++ /* needed for amp of back speakers */ ++ spec->gpio_mask |= 0x01; ++ spec->gpio_dir |= 0x01; ++ snd_hda_apply_pincfgs(codec, pincfgs); ++ /* share DAC to have unified volume control */ ++ snd_hda_override_conn_list(codec, 0x14, ARRAY_SIZE(conn), conn); ++ snd_hda_override_conn_list(codec, 0x17, ARRAY_SIZE(conn), conn); ++ break; ++ case HDA_FIXUP_ACT_INIT: ++ /* need to toggle GPIO to enable the amp of back speakers */ ++ alc_update_gpio_data(codec, 0x01, true); ++ msleep(100); ++ alc_update_gpio_data(codec, 0x01, false); ++ break; ++ } ++} ++ + static void alc285_fixup_hp_spectre_x360(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -7040,6 +7075,7 @@ enum { + ALC280_FIXUP_HP_9480M, + ALC245_FIXUP_HP_X360_AMP, + ALC285_FIXUP_HP_SPECTRE_X360_EB1, ++ ALC285_FIXUP_HP_SPECTRE_X360_DF1, + ALC285_FIXUP_HP_ENVY_X360, + ALC288_FIXUP_DELL_HEADSET_MODE, + ALC288_FIXUP_DELL1_MIC_NO_PRESENCE, +@@ -8881,6 +8917,10 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_hp_spectre_x360_eb1 + }, ++ [ALC285_FIXUP_HP_SPECTRE_X360_DF1] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc285_fixup_hp_spectre_x360_df1 ++ }, + [ALC285_FIXUP_HP_ENVY_X360] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_hp_envy_x360, +@@ -9286,6 +9326,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x86c1, "HP Laptop 15-da3001TU", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2), + SND_PCI_QUIRK(0x103c, 0x86c7, "HP Envy AiO 32", ALC274_FIXUP_HP_ENVY_GPIO), + SND_PCI_QUIRK(0x103c, 0x86e7, "HP Spectre x360 15-eb0xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1), ++ SND_PCI_QUIRK(0x103c, 0x863e, "HP Spectre x360 15-df1xxx", ALC285_FIXUP_HP_SPECTRE_X360_DF1), + SND_PCI_QUIRK(0x103c, 0x86e8, "HP Spectre x360 15-eb0xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1), + SND_PCI_QUIRK(0x103c, 0x86f9, "HP Spectre x360 13-aw0xxx", ALC285_FIXUP_HP_SPECTRE_X360_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x8716, "HP Elite Dragonfly G2 Notebook PC", ALC285_FIXUP_HP_GPIO_AMP_INIT), +@@ -9832,6 +9873,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { + {.id = ALC295_FIXUP_HP_OMEN, .name = "alc295-hp-omen"}, + {.id = ALC285_FIXUP_HP_SPECTRE_X360, .name = "alc285-hp-spectre-x360"}, + {.id = ALC285_FIXUP_HP_SPECTRE_X360_EB1, .name = "alc285-hp-spectre-x360-eb1"}, ++ {.id = ALC285_FIXUP_HP_SPECTRE_X360_DF1, .name = "alc285-hp-spectre-x360-df1"}, + {.id = ALC285_FIXUP_HP_ENVY_X360, .name = "alc285-hp-envy-x360"}, + {.id = ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP, .name = "alc287-ideapad-bass-spk-amp"}, + {.id = ALC623_FIXUP_LENOVO_THINKSTATION_P340, .name = "alc623-lenovo-thinkstation-p340"}, +-- +2.39.5 + diff --git a/queue-5.15/arch-powerpc-perf-check-the-instruction-type-before-.patch b/queue-5.15/arch-powerpc-perf-check-the-instruction-type-before-.patch new file mode 100644 index 0000000000..9f04a13337 --- /dev/null +++ b/queue-5.15/arch-powerpc-perf-check-the-instruction-type-before-.patch @@ -0,0 +1,137 @@ +From d8b1ca54d9f89098ec4dd63abb28c9170bda4e6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jan 2025 18:46:20 +0530 +Subject: arch/powerpc/perf: Check the instruction type before creating sample + with perf_mem_data_src + +From: Athira Rajeev + +[ Upstream commit 2ffb26afa64261139e608bf087a0c1fe24d76d4d ] + +perf mem report aborts as below sometimes (during some corner +case) in powerpc: + + # ./perf mem report 1>out + *** stack smashing detected ***: terminated + Aborted (core dumped) + +The backtrace is as below: + __pthread_kill_implementation () + raise () + abort () + __libc_message + __fortify_fail + __stack_chk_fail + hist_entry.lvl_snprintf + __sort__hpp_entry + __hist_entry__snprintf + hists.fprintf + cmd_report + cmd_mem + +Snippet of code which triggers the issue +from tools/perf/util/sort.c + + static int hist_entry__lvl_snprintf(struct hist_entry *he, char *bf, + size_t size, unsigned int width) + { + char out[64]; + + perf_mem__lvl_scnprintf(out, sizeof(out), he->mem_info); + return repsep_snprintf(bf, size, "%-*s", width, out); + } + +The value of "out" is filled from perf_mem_data_src value. +Debugging this further showed that for some corner cases, the +value of "data_src" was pointing to wrong value. This resulted +in bigger size of string and causing stack check fail. + +The perf mem data source values are captured in the sample via +isa207_get_mem_data_src function. The initial check is to fetch +the type of sampled instruction. If the type of instruction is +not valid (not a load/store instruction), the function returns. + +Since 'commit e16fd7f2cb1a ("perf: Use sample_flags for data_src")', +data_src field is not initialized by the perf_sample_data_init() +function. If the PMU driver doesn't set the data_src value to zero if +type is not valid, this will result in uninitailised value for data_src. +The uninitailised value of data_src resulted in stack check fail +followed by abort for "perf mem report". + +When requesting for data source information in the sample, the +instruction type is expected to be load or store instruction. +In ISA v3.0, due to hardware limitation, there are corner cases +where the instruction type other than load or store is observed. +In ISA v3.0 and before values "0" and "7" are considered reserved. +In ISA v3.1, value "7" has been used to indicate "larx/stcx". +Drop the sample if instruction type has reserved values for this +field with a ISA version check. Initialize data_src to zero in +isa207_get_mem_data_src if the instruction type is not load/store. + +Reported-by: Disha Goel +Signed-off-by: Athira Rajeev +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/20250121131621.39054-1-atrajeev@linux.vnet.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/perf/core-book3s.c | 20 ++++++++++++++++++++ + arch/powerpc/perf/isa207-common.c | 4 +++- + 2 files changed, 23 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c +index c9fc0edf56b1c..c6d083a82d80a 100644 +--- a/arch/powerpc/perf/core-book3s.c ++++ b/arch/powerpc/perf/core-book3s.c +@@ -2183,6 +2183,10 @@ static struct pmu power_pmu = { + #define PERF_SAMPLE_ADDR_TYPE (PERF_SAMPLE_ADDR | \ + PERF_SAMPLE_PHYS_ADDR | \ + PERF_SAMPLE_DATA_PAGE_SIZE) ++ ++#define SIER_TYPE_SHIFT 15 ++#define SIER_TYPE_MASK (0x7ull << SIER_TYPE_SHIFT) ++ + /* + * A counter has overflowed; update its count and record + * things if requested. Note that interrupts are hard-disabled +@@ -2251,6 +2255,22 @@ static void record_and_restart(struct perf_event *event, unsigned long val, + is_kernel_addr(mfspr(SPRN_SIAR))) + record = 0; + ++ /* ++ * SIER[46-48] presents instruction type of the sampled instruction. ++ * In ISA v3.0 and before values "0" and "7" are considered reserved. ++ * In ISA v3.1, value "7" has been used to indicate "larx/stcx". ++ * Drop the sample if "type" has reserved values for this field with a ++ * ISA version check. ++ */ ++ if (event->attr.sample_type & PERF_SAMPLE_DATA_SRC && ++ ppmu->get_mem_data_src) { ++ val = (regs->dar & SIER_TYPE_MASK) >> SIER_TYPE_SHIFT; ++ if (val == 0 || (val == 7 && !cpu_has_feature(CPU_FTR_ARCH_31))) { ++ record = 0; ++ atomic64_inc(&event->lost_samples); ++ } ++ } ++ + /* + * Finally record data if requested. + */ +diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c +index 027a2add780e8..9ffe3106c9b10 100644 +--- a/arch/powerpc/perf/isa207-common.c ++++ b/arch/powerpc/perf/isa207-common.c +@@ -275,8 +275,10 @@ void isa207_get_mem_data_src(union perf_mem_data_src *dsrc, u32 flags, + + sier = mfspr(SPRN_SIER); + val = (sier & ISA207_SIER_TYPE_MASK) >> ISA207_SIER_TYPE_SHIFT; +- if (val != 1 && val != 2 && !(val == 7 && cpu_has_feature(CPU_FTR_ARCH_31))) ++ if (val != 1 && val != 2 && !(val == 7 && cpu_has_feature(CPU_FTR_ARCH_31))) { ++ dsrc->val = 0; + return; ++ } + + idx = (sier & ISA207_SIER_LDST_MASK) >> ISA207_SIER_LDST_SHIFT; + sub_idx = (sier & ISA207_SIER_DATA_SRC_MASK) >> ISA207_SIER_DATA_SRC_SHIFT; +-- +2.39.5 + diff --git a/queue-5.15/arm-at91-pm-fix-at91_suspend_finish-for-zq-calibrati.patch b/queue-5.15/arm-at91-pm-fix-at91_suspend_finish-for-zq-calibrati.patch new file mode 100644 index 0000000000..f92b81c898 --- /dev/null +++ b/queue-5.15/arm-at91-pm-fix-at91_suspend_finish-for-zq-calibrati.patch @@ -0,0 +1,90 @@ +From 48676ca00146b483c509e72d5604f40bb6722599 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Feb 2025 08:51:56 -0700 +Subject: ARM: at91: pm: fix at91_suspend_finish for ZQ calibration + +From: Li Bin + +[ Upstream commit bc4722c3598d0e2c2dbf9609a3d3198993093e2b ] + +For sama7g5 and sama7d65 backup mode, we encountered a "ZQ calibrate error" +during recalibrating the impedance in BootStrap. +We found that the impedance value saved in at91_suspend_finish() before +the DDR entered self-refresh mode did not match the resistor values. The +ZDATA field in the DDR3PHY_ZQ0CR0 register uses a modified gray code to +select the different impedance setting. +But these gray code are incorrect, a workaournd from design team fixed the +bug in the calibration logic. The ZDATA contains four independent impedance +elements, but the algorithm combined the four elements into one. The elements +were fixed using properly shifted offsets. + +Signed-off-by: Li Bin +[nicolas.ferre@microchip.com: fix indentation and combine 2 patches] +Signed-off-by: Nicolas Ferre +Tested-by: Ryan Wanner +Tested-by: Durai Manickam KR +Tested-by: Andrei Simion +Signed-off-by: Ryan Wanner +Link: https://lore.kernel.org/r/28b33f9bcd0ca60ceba032969fe054d38f2b9577.1740671156.git.Ryan.Wanner@microchip.com +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + arch/arm/mach-at91/pm.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c +index 91efc3d4de61d..777a8834b43e2 100644 +--- a/arch/arm/mach-at91/pm.c ++++ b/arch/arm/mach-at91/pm.c +@@ -350,11 +350,12 @@ extern u32 at91_pm_suspend_in_sram_sz; + + static int at91_suspend_finish(unsigned long val) + { +- unsigned char modified_gray_code[] = { +- 0x00, 0x01, 0x02, 0x03, 0x06, 0x07, 0x04, 0x05, 0x0c, 0x0d, +- 0x0e, 0x0f, 0x0a, 0x0b, 0x08, 0x09, 0x18, 0x19, 0x1a, 0x1b, +- 0x1e, 0x1f, 0x1c, 0x1d, 0x14, 0x15, 0x16, 0x17, 0x12, 0x13, +- 0x10, 0x11, ++ /* SYNOPSYS workaround to fix a bug in the calibration logic */ ++ unsigned char modified_fix_code[] = { ++ 0x00, 0x01, 0x01, 0x06, 0x07, 0x0c, 0x06, 0x07, 0x0b, 0x18, ++ 0x0a, 0x0b, 0x0c, 0x0d, 0x0d, 0x0a, 0x13, 0x13, 0x12, 0x13, ++ 0x14, 0x15, 0x15, 0x12, 0x18, 0x19, 0x19, 0x1e, 0x1f, 0x14, ++ 0x1e, 0x1f, + }; + unsigned int tmp, index; + int i; +@@ -365,25 +366,25 @@ static int at91_suspend_finish(unsigned long val) + * restore the ZQ0SR0 with the value saved here. But the + * calibration is buggy and restoring some values from ZQ0SR0 + * is forbidden and risky thus we need to provide processed +- * values for these (modified gray code values). ++ * values for these. + */ + tmp = readl(soc_pm.data.ramc_phy + DDR3PHY_ZQ0SR0); + + /* Store pull-down output impedance select. */ + index = (tmp >> DDR3PHY_ZQ0SR0_PDO_OFF) & 0x1f; +- soc_pm.bu->ddr_phy_calibration[0] = modified_gray_code[index]; ++ soc_pm.bu->ddr_phy_calibration[0] = modified_fix_code[index] << DDR3PHY_ZQ0SR0_PDO_OFF; + + /* Store pull-up output impedance select. */ + index = (tmp >> DDR3PHY_ZQ0SR0_PUO_OFF) & 0x1f; +- soc_pm.bu->ddr_phy_calibration[0] |= modified_gray_code[index]; ++ soc_pm.bu->ddr_phy_calibration[0] |= modified_fix_code[index] << DDR3PHY_ZQ0SR0_PUO_OFF; + + /* Store pull-down on-die termination impedance select. */ + index = (tmp >> DDR3PHY_ZQ0SR0_PDODT_OFF) & 0x1f; +- soc_pm.bu->ddr_phy_calibration[0] |= modified_gray_code[index]; ++ soc_pm.bu->ddr_phy_calibration[0] |= modified_fix_code[index] << DDR3PHY_ZQ0SR0_PDODT_OFF; + + /* Store pull-up on-die termination impedance select. */ + index = (tmp >> DDR3PHY_ZQ0SRO_PUODT_OFF) & 0x1f; +- soc_pm.bu->ddr_phy_calibration[0] |= modified_gray_code[index]; ++ soc_pm.bu->ddr_phy_calibration[0] |= modified_fix_code[index] << DDR3PHY_ZQ0SRO_PUODT_OFF; + + /* + * The 1st 8 words of memory might get corrupted in the process +-- +2.39.5 + diff --git a/queue-5.15/arm-tegra-switch-dsi-b-clock-parent-to-plld-on-tegra.patch b/queue-5.15/arm-tegra-switch-dsi-b-clock-parent-to-plld-on-tegra.patch new file mode 100644 index 0000000000..1b60b07050 --- /dev/null +++ b/queue-5.15/arm-tegra-switch-dsi-b-clock-parent-to-plld-on-tegra.patch @@ -0,0 +1,36 @@ +From 491e3b1be85816ea4f4b238780795a762b3bb483 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Feb 2025 12:56:11 +0200 +Subject: ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114 + +From: Svyatoslav Ryhel + +[ Upstream commit 2b3db788f2f614b875b257cdb079adadedc060f3 ] + +PLLD is usually used as parent clock for internal video devices, like +DSI for example, while PLLD2 is used as parent for HDMI. + +Signed-off-by: Svyatoslav Ryhel +Link: https://lore.kernel.org/r/20250226105615.61087-3-clamor95@gmail.com +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/tegra114.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/tegra114.dtsi b/arch/arm/boot/dts/tegra114.dtsi +index fb99b3e971c3b..c00097794dab1 100644 +--- a/arch/arm/boot/dts/tegra114.dtsi ++++ b/arch/arm/boot/dts/tegra114.dtsi +@@ -126,7 +126,7 @@ dsi@54400000 { + reg = <0x54400000 0x00040000>; + clocks = <&tegra_car TEGRA114_CLK_DSIB>, + <&tegra_car TEGRA114_CLK_DSIBLP>, +- <&tegra_car TEGRA114_CLK_PLL_D2_OUT0>; ++ <&tegra_car TEGRA114_CLK_PLL_D_OUT0>; + clock-names = "dsi", "lp", "parent"; + resets = <&tegra_car 82>; + reset-names = "dsi"; +-- +2.39.5 + diff --git a/queue-5.15/arm64-mm-check-pud_type_table-in-pud_bad.patch b/queue-5.15/arm64-mm-check-pud_type_table-in-pud_bad.patch new file mode 100644 index 0000000000..3ff3ef3ae3 --- /dev/null +++ b/queue-5.15/arm64-mm-check-pud_type_table-in-pud_bad.patch @@ -0,0 +1,49 @@ +From 9887045cc1dccf969dc4afc630601f1606010dbf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Feb 2025 10:12:25 +0530 +Subject: arm64/mm: Check PUD_TYPE_TABLE in pud_bad() + +From: Ryan Roberts + +[ Upstream commit bfb1d2b9021c21891427acc86eb848ccedeb274e ] + +pud_bad() is currently defined in terms of pud_table(). Although for some +configs, pud_table() is hard-coded to true i.e. when using 64K base pages +or when page table levels are less than 3. + +pud_bad() is intended to check that the pud is configured correctly. Hence +let's open-code the same check that the full version of pud_table() uses +into pud_bad(). Then it always performs the check regardless of the config. + +Cc: Will Deacon +Cc: Ard Biesheuvel +Cc: Ryan Roberts +Cc: Mark Rutland +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Ryan Roberts +Signed-off-by: Anshuman Khandual +Link: https://lore.kernel.org/r/20250221044227.1145393-7-anshuman.khandual@arm.com +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/pgtable.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h +index b5e969bc074d3..a0bfa9cd76dab 100644 +--- a/arch/arm64/include/asm/pgtable.h ++++ b/arch/arm64/include/asm/pgtable.h +@@ -623,7 +623,8 @@ static inline unsigned long pmd_page_vaddr(pmd_t pmd) + pr_err("%s:%d: bad pmd %016llx.\n", __FILE__, __LINE__, pmd_val(e)) + + #define pud_none(pud) (!pud_val(pud)) +-#define pud_bad(pud) (!pud_table(pud)) ++#define pud_bad(pud) ((pud_val(pud) & PUD_TYPE_MASK) != \ ++ PUD_TYPE_TABLE) + #define pud_present(pud) pte_present(pud_pte(pud)) + #define pud_leaf(pud) (pud_present(pud) && !pud_table(pud)) + #define pud_valid(pud) pte_valid(pud_pte(pud)) +-- +2.39.5 + diff --git a/queue-5.15/arm64-tegra-p2597-fix-gpio-for-vdd-1v8-dis-regulator.patch b/queue-5.15/arm64-tegra-p2597-fix-gpio-for-vdd-1v8-dis-regulator.patch new file mode 100644 index 0000000000..397a581dde --- /dev/null +++ b/queue-5.15/arm64-tegra-p2597-fix-gpio-for-vdd-1v8-dis-regulator.patch @@ -0,0 +1,37 @@ +From c580d2044ee1ef78f36f4af42753e5f798afd432 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Feb 2025 12:17:36 +0000 +Subject: arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator + +From: Diogo Ivo + +[ Upstream commit f34621f31e3be81456c903287f7e4c0609829e29 ] + +According to the board schematics the enable pin of this regulator is +connected to gpio line #9 of the first instance of the TCA9539 +GPIO expander, so adjust it. + +Signed-off-by: Diogo Ivo +Link: https://lore.kernel.org/r/20250224-diogo-gpio_exp-v1-1-80fb84ac48c6@tecnico.ulisboa.pt +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi +index d8409c1b43800..4abd8b14b8a5c 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi ++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi +@@ -1638,7 +1638,7 @@ vdd_1v8_dis: regulator@7 { + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; + regulator-always-on; +- gpio = <&exp1 14 GPIO_ACTIVE_HIGH>; ++ gpio = <&exp1 9 GPIO_ACTIVE_HIGH>; + enable-active-high; + vin-supply = <&vdd_1v8>; + }; +-- +2.39.5 + diff --git a/queue-5.15/asoc-imx-card-adjust-over-allocation-of-memory-in-im.patch b/queue-5.15/asoc-imx-card-adjust-over-allocation-of-memory-in-im.patch new file mode 100644 index 0000000000..916a01a36d --- /dev/null +++ b/queue-5.15/asoc-imx-card-adjust-over-allocation-of-memory-in-im.patch @@ -0,0 +1,40 @@ +From 0af839aaa0a66835353ebc3316b3125f69641bc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Apr 2025 16:08:54 -0500 +Subject: ASoC: imx-card: Adjust over allocation of memory in + imx_card_parse_of() + +From: Chenyuan Yang + +[ Upstream commit a9a69c3b38c89d7992fb53db4abb19104b531d32 ] + +Incorrect types are used as sizeof() arguments in devm_kcalloc(). +It should be sizeof(dai_link_data) for link_data instead of +sizeof(snd_soc_dai_link). + +This is found by our static analysis tool. + +Signed-off-by: Chenyuan Yang +Link: https://patch.msgid.link/20250406210854.149316-1-chenyuan0y@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/imx-card.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/fsl/imx-card.c b/sound/soc/fsl/imx-card.c +index 2b64c0384b6bb..9b14cda56b068 100644 +--- a/sound/soc/fsl/imx-card.c ++++ b/sound/soc/fsl/imx-card.c +@@ -517,7 +517,7 @@ static int imx_card_parse_of(struct imx_card_data *data) + if (!card->dai_link) + return -ENOMEM; + +- data->link_data = devm_kcalloc(dev, num_links, sizeof(*link), GFP_KERNEL); ++ data->link_data = devm_kcalloc(dev, num_links, sizeof(*link_data), GFP_KERNEL); + if (!data->link_data) + return -ENOMEM; + +-- +2.39.5 + diff --git a/queue-5.15/asoc-intel-bytcr_rt5640-add-dmi-quirk-for-acer-aspir.patch b/queue-5.15/asoc-intel-bytcr_rt5640-add-dmi-quirk-for-acer-aspir.patch new file mode 100644 index 0000000000..dad1460d08 --- /dev/null +++ b/queue-5.15/asoc-intel-bytcr_rt5640-add-dmi-quirk-for-acer-aspir.patch @@ -0,0 +1,48 @@ +From e223ba2618b7436d727d046b10852bedecc108de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Apr 2025 10:56:59 +0200 +Subject: ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013 + +From: Takashi Iwai + +[ Upstream commit a549b927ea3f5e50b1394209b64e6e17e31d4db8 ] + +Acer Aspire SW3-013 requires the very same quirk as other Acer Aspire +model for making it working. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=220011 +Signed-off-by: Takashi Iwai +Link: https://patch.msgid.link/20250420085716.12095-1-tiwai@suse.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 721b9971fd744..4954e8c494c6d 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -573,6 +573,19 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_SSP0_AIF2 | + BYT_RT5640_MCLK_EN), + }, ++ { /* Acer Aspire SW3-013 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire SW3-013"), ++ }, ++ .driver_data = (void *)(BYT_RT5640_DMIC1_MAP | ++ BYT_RT5640_JD_SRC_JD2_IN4N | ++ BYT_RT5640_OVCD_TH_2000UA | ++ BYT_RT5640_OVCD_SF_0P75 | ++ BYT_RT5640_DIFF_MIC | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), ++ }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Acer"), +-- +2.39.5 + diff --git a/queue-5.15/asoc-mediatek-mt6359-add-stub-for-mt6359_accdet_enab.patch b/queue-5.15/asoc-mediatek-mt6359-add-stub-for-mt6359_accdet_enab.patch new file mode 100644 index 0000000000..c7c5bb3e7c --- /dev/null +++ b/queue-5.15/asoc-mediatek-mt6359-add-stub-for-mt6359_accdet_enab.patch @@ -0,0 +1,48 @@ +From a6eb1cccb4a9cb08aa6e24f3bb1aed764b864cab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Mar 2025 16:52:17 -0300 +Subject: ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 0116a7d84b32537a10d9bea1fd1bfc06577ef527 ] + +Add a stub for mt6359_accdet_enable_jack_detect() to prevent linker +failures in the machine sound drivers calling it when +CONFIG_SND_SOC_MT6359_ACCDET is not enabled. + +Suggested-by: AngeloGioacchino Del Regno +Signed-off-by: Nícolas F. R. A. Prado +Link: https://patch.msgid.link/20250306-mt8188-accdet-v3-3-7828e835ff4b@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/mt6359-accdet.h | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/sound/soc/codecs/mt6359-accdet.h b/sound/soc/codecs/mt6359-accdet.h +index c234f2f4276a1..78ada3a5bfae5 100644 +--- a/sound/soc/codecs/mt6359-accdet.h ++++ b/sound/soc/codecs/mt6359-accdet.h +@@ -123,6 +123,15 @@ struct mt6359_accdet { + struct workqueue_struct *jd_workqueue; + }; + ++#if IS_ENABLED(CONFIG_SND_SOC_MT6359_ACCDET) + int mt6359_accdet_enable_jack_detect(struct snd_soc_component *component, + struct snd_soc_jack *jack); ++#else ++static inline int ++mt6359_accdet_enable_jack_detect(struct snd_soc_component *component, ++ struct snd_soc_jack *jack) ++{ ++ return -EOPNOTSUPP; ++} ++#endif + #endif +-- +2.39.5 + diff --git a/queue-5.15/asoc-ops-enforce-platform-maximum-on-initial-value.patch b/queue-5.15/asoc-ops-enforce-platform-maximum-on-initial-value.patch new file mode 100644 index 0000000000..0b520012e4 --- /dev/null +++ b/queue-5.15/asoc-ops-enforce-platform-maximum-on-initial-value.patch @@ -0,0 +1,75 @@ +From 3c3a72487fb98cd655d4fa889642fce6b7c132a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Feb 2025 00:57:22 +0000 +Subject: ASoC: ops: Enforce platform maximum on initial value +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Martin PoviÅ¡er + +[ Upstream commit 783db6851c1821d8b983ffb12b99c279ff64f2ee ] + +Lower the volume if it is violating the platform maximum at its initial +value (i.e. at the time of the 'snd_soc_limit_volume' call). + +Signed-off-by: Martin PoviÅ¡er +[Cherry picked from the Asahi kernel with fixups -- broonie] +Signed-off-by: Mark Brown +Link: https://patch.msgid.link/20250208-asoc-volume-limit-v1-1-b98fcf4cdbad@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-ops.c | 29 ++++++++++++++++++++++++++++- + 1 file changed, 28 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c +index d8d0a26a554de..9eb4181c6697f 100644 +--- a/sound/soc/soc-ops.c ++++ b/sound/soc/soc-ops.c +@@ -621,6 +621,33 @@ int snd_soc_get_volsw_range(struct snd_kcontrol *kcontrol, + } + EXPORT_SYMBOL_GPL(snd_soc_get_volsw_range); + ++static int snd_soc_clip_to_platform_max(struct snd_kcontrol *kctl) ++{ ++ struct soc_mixer_control *mc = (struct soc_mixer_control *)kctl->private_value; ++ struct snd_ctl_elem_value uctl; ++ int ret; ++ ++ if (!mc->platform_max) ++ return 0; ++ ++ ret = kctl->get(kctl, &uctl); ++ if (ret < 0) ++ return ret; ++ ++ if (uctl.value.integer.value[0] > mc->platform_max) ++ uctl.value.integer.value[0] = mc->platform_max; ++ ++ if (snd_soc_volsw_is_stereo(mc) && ++ uctl.value.integer.value[1] > mc->platform_max) ++ uctl.value.integer.value[1] = mc->platform_max; ++ ++ ret = kctl->put(kctl, &uctl); ++ if (ret < 0) ++ return ret; ++ ++ return 0; ++} ++ + /** + * snd_soc_limit_volume - Set new limit to an existing volume control. + * +@@ -645,7 +672,7 @@ int snd_soc_limit_volume(struct snd_soc_card *card, + struct soc_mixer_control *mc = (struct soc_mixer_control *)kctl->private_value; + if (max <= mc->max - mc->min) { + mc->platform_max = max; +- ret = 0; ++ ret = snd_soc_clip_to_platform_max(kctl); + } + } + return ret; +-- +2.39.5 + diff --git a/queue-5.15/asoc-qcom-sm8250-explicitly-set-format-in-sm8250_be_.patch b/queue-5.15/asoc-qcom-sm8250-explicitly-set-format-in-sm8250_be_.patch new file mode 100644 index 0000000000..526e605849 --- /dev/null +++ b/queue-5.15/asoc-qcom-sm8250-explicitly-set-format-in-sm8250_be_.patch @@ -0,0 +1,49 @@ +From 1232af63be5e8b80abdb076237814c8ecbe5a348 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Feb 2025 16:14:30 +0000 +Subject: ASoC: qcom: sm8250: explicitly set format in + sm8250_be_hw_params_fixup() + +From: Alexey Klimov + +[ Upstream commit 89be3c15a58b2ccf31e969223c8ac93ca8932d81 ] + +Setting format to s16le is required for compressed playback on compatible +soundcards. + +Cc: Srinivas Kandagatla +Signed-off-by: Alexey Klimov +Link: https://patch.msgid.link/20250228161430.373961-1-alexey.klimov@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/qcom/sm8250.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/qcom/sm8250.c b/sound/soc/qcom/sm8250.c +index a38a741ace379..34a6349754fb0 100644 +--- a/sound/soc/qcom/sm8250.c ++++ b/sound/soc/qcom/sm8250.c +@@ -7,6 +7,7 @@ + #include + #include + #include ++#include + #include + #include "qdsp6/q6afe.h" + #include "common.h" +@@ -27,9 +28,11 @@ static int sm8250_be_hw_params_fixup(struct snd_soc_pcm_runtime *rtd, + SNDRV_PCM_HW_PARAM_RATE); + struct snd_interval *channels = hw_param_interval(params, + SNDRV_PCM_HW_PARAM_CHANNELS); ++ struct snd_mask *fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT); + + rate->min = rate->max = 48000; + channels->min = channels->max = 2; ++ snd_mask_set_format(fmt, SNDRV_PCM_FORMAT_S16_LE); + + return 0; + } +-- +2.39.5 + diff --git a/queue-5.15/asoc-soc-dai-check-return-value-at-snd_soc_dai_set_t.patch b/queue-5.15/asoc-soc-dai-check-return-value-at-snd_soc_dai_set_t.patch new file mode 100644 index 0000000000..7bd1724325 --- /dev/null +++ b/queue-5.15/asoc-soc-dai-check-return-value-at-snd_soc_dai_set_t.patch @@ -0,0 +1,54 @@ +From 882a9ddd412c39340de23d227b2e9a3d9269a2c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Feb 2025 02:24:38 +0000 +Subject: ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot() + +From: Kuninori Morimoto + +[ Upstream commit 7f1186a8d738661b941b298fd6d1d5725ed71428 ] + +snd_soc_dai_set_tdm_slot() calls .xlate_tdm_slot_mask() or +snd_soc_xlate_tdm_slot_mask(), but didn't check its return value. +Let's check it. + +This patch might break existing driver. In such case, let's makes +each func to void instead of int. + +Signed-off-by: Kuninori Morimoto +Link: https://patch.msgid.link/87o6z7yk61.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-dai.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/soc-dai.c b/sound/soc/soc-dai.c +index 3db0fcf24385a..05a9404544de9 100644 +--- a/sound/soc/soc-dai.c ++++ b/sound/soc/soc-dai.c +@@ -271,10 +271,11 @@ int snd_soc_dai_set_tdm_slot(struct snd_soc_dai *dai, + + if (dai->driver->ops && + dai->driver->ops->xlate_tdm_slot_mask) +- dai->driver->ops->xlate_tdm_slot_mask(slots, +- &tx_mask, &rx_mask); ++ ret = dai->driver->ops->xlate_tdm_slot_mask(slots, &tx_mask, &rx_mask); + else +- snd_soc_xlate_tdm_slot_mask(slots, &tx_mask, &rx_mask); ++ ret = snd_soc_xlate_tdm_slot_mask(slots, &tx_mask, &rx_mask); ++ if (ret) ++ goto err; + + dai->tx_mask = tx_mask; + dai->rx_mask = rx_mask; +@@ -283,6 +284,7 @@ int snd_soc_dai_set_tdm_slot(struct snd_soc_dai *dai, + dai->driver->ops->set_tdm_slot) + ret = dai->driver->ops->set_tdm_slot(dai, tx_mask, rx_mask, + slots, slot_width); ++err: + return soc_dai_ret(dai, ret); + } + EXPORT_SYMBOL_GPL(snd_soc_dai_set_tdm_slot); +-- +2.39.5 + diff --git a/queue-5.15/asoc-tas2764-power-up-down-amp-on-mute-ops.patch b/queue-5.15/asoc-tas2764-power-up-down-amp-on-mute-ops.patch new file mode 100644 index 0000000000..e2b407dbb9 --- /dev/null +++ b/queue-5.15/asoc-tas2764-power-up-down-amp-on-mute-ops.patch @@ -0,0 +1,108 @@ +From 07555ecc8c7b0d1b1429614cbee5356886ae8c19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Feb 2025 01:03:24 +0000 +Subject: ASoC: tas2764: Power up/down amp on mute ops + +From: Hector Martin + +[ Upstream commit 1c3b5f37409682184669457a5bdf761268eafbe5 ] + +The ASoC convention is that clocks are removed after codec mute, and +power up/down is more about top level power management. For these chips, +the "mute" state still expects a TDM clock, and yanking the clock in +this state will trigger clock errors. So, do the full +shutdown<->mute<->active transition on the mute operation, so the amp is +in software shutdown by the time the clocks are removed. + +This fixes TDM clock errors when streams are stopped. + +Signed-off-by: Hector Martin +Signed-off-by: Mark Brown +Link: https://patch.msgid.link/20250208-asoc-tas2764-v1-1-dbab892a69b5@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2764.c | 51 ++++++++++++++++---------------------- + 1 file changed, 21 insertions(+), 30 deletions(-) + +diff --git a/sound/soc/codecs/tas2764.c b/sound/soc/codecs/tas2764.c +index 273bf4027a6e5..559a160e1f4d9 100644 +--- a/sound/soc/codecs/tas2764.c ++++ b/sound/soc/codecs/tas2764.c +@@ -130,33 +130,6 @@ static SOC_ENUM_SINGLE_DECL( + static const struct snd_kcontrol_new tas2764_asi1_mux = + SOC_DAPM_ENUM("ASI1 Source", tas2764_ASI1_src_enum); + +-static int tas2764_dac_event(struct snd_soc_dapm_widget *w, +- struct snd_kcontrol *kcontrol, int event) +-{ +- struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm); +- struct tas2764_priv *tas2764 = snd_soc_component_get_drvdata(component); +- int ret; +- +- switch (event) { +- case SND_SOC_DAPM_POST_PMU: +- tas2764->dac_powered = true; +- ret = tas2764_update_pwr_ctrl(tas2764); +- break; +- case SND_SOC_DAPM_PRE_PMD: +- tas2764->dac_powered = false; +- ret = tas2764_update_pwr_ctrl(tas2764); +- break; +- default: +- dev_err(tas2764->dev, "Unsupported event\n"); +- return -EINVAL; +- } +- +- if (ret < 0) +- return ret; +- +- return 0; +-} +- + static const struct snd_kcontrol_new isense_switch = + SOC_DAPM_SINGLE("Switch", TAS2764_PWR_CTRL, TAS2764_ISENSE_POWER_EN, 1, 1); + static const struct snd_kcontrol_new vsense_switch = +@@ -169,8 +142,7 @@ static const struct snd_soc_dapm_widget tas2764_dapm_widgets[] = { + 1, &isense_switch), + SND_SOC_DAPM_SWITCH("VSENSE", TAS2764_PWR_CTRL, TAS2764_VSENSE_POWER_EN, + 1, &vsense_switch), +- SND_SOC_DAPM_DAC_E("DAC", NULL, SND_SOC_NOPM, 0, 0, tas2764_dac_event, +- SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD), ++ SND_SOC_DAPM_DAC("DAC", NULL, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_OUTPUT("OUT"), + SND_SOC_DAPM_SIGGEN("VMON"), + SND_SOC_DAPM_SIGGEN("IMON") +@@ -191,9 +163,28 @@ static int tas2764_mute(struct snd_soc_dai *dai, int mute, int direction) + { + struct tas2764_priv *tas2764 = + snd_soc_component_get_drvdata(dai->component); ++ int ret; ++ ++ if (!mute) { ++ tas2764->dac_powered = true; ++ ret = tas2764_update_pwr_ctrl(tas2764); ++ if (ret) ++ return ret; ++ } + + tas2764->unmuted = !mute; +- return tas2764_update_pwr_ctrl(tas2764); ++ ret = tas2764_update_pwr_ctrl(tas2764); ++ if (ret) ++ return ret; ++ ++ if (mute) { ++ tas2764->dac_powered = false; ++ ret = tas2764_update_pwr_ctrl(tas2764); ++ if (ret) ++ return ret; ++ } ++ ++ return 0; + } + + static int tas2764_set_bitwidth(struct tas2764_priv *tas2764, int bitwidth) +-- +2.39.5 + diff --git a/queue-5.15/auxdisplay-charlcd-partially-revert-move-hwidth-and-.patch b/queue-5.15/auxdisplay-charlcd-partially-revert-move-hwidth-and-.patch new file mode 100644 index 0000000000..454d5fcad1 --- /dev/null +++ b/queue-5.15/auxdisplay-charlcd-partially-revert-move-hwidth-and-.patch @@ -0,0 +1,117 @@ +From 0a6c1f5ee63483953dd0d9c423fae4341c0fa27a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Feb 2025 19:27:38 +0200 +Subject: auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to + struct hd44780_common" + +From: Andy Shevchenko + +[ Upstream commit 09965a142078080fe7807bab0f6f1890cb5987a4 ] + +Commit 2545c1c948a6 ("auxdisplay: Move hwidth and bwidth to struct +hd44780_common") makes charlcd_alloc() argument-less effectively dropping +the single allocation for the struct charlcd_priv object along with +the driver specific one. Restore that behaviour here. + +Signed-off-by: Andy Shevchenko +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/auxdisplay/charlcd.c | 5 +++-- + drivers/auxdisplay/charlcd.h | 5 +++-- + drivers/auxdisplay/hd44780.c | 2 +- + drivers/auxdisplay/lcd2s.c | 2 +- + drivers/auxdisplay/panel.c | 2 +- + 5 files changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/auxdisplay/charlcd.c b/drivers/auxdisplay/charlcd.c +index 6c010d4efa4ae..313bb7ebc2cfa 100644 +--- a/drivers/auxdisplay/charlcd.c ++++ b/drivers/auxdisplay/charlcd.c +@@ -594,18 +594,19 @@ static int charlcd_init(struct charlcd *lcd) + return 0; + } + +-struct charlcd *charlcd_alloc(void) ++struct charlcd *charlcd_alloc(unsigned int drvdata_size) + { + struct charlcd_priv *priv; + struct charlcd *lcd; + +- priv = kzalloc(sizeof(*priv), GFP_KERNEL); ++ priv = kzalloc(sizeof(*priv) + drvdata_size, GFP_KERNEL); + if (!priv) + return NULL; + + priv->esc_seq.len = -1; + + lcd = &priv->lcd; ++ lcd->drvdata = priv->drvdata; + + return lcd; + } +diff --git a/drivers/auxdisplay/charlcd.h b/drivers/auxdisplay/charlcd.h +index eed80063a6d20..4bbf106b2dd8a 100644 +--- a/drivers/auxdisplay/charlcd.h ++++ b/drivers/auxdisplay/charlcd.h +@@ -49,7 +49,7 @@ struct charlcd { + unsigned long y; + } addr; + +- void *drvdata; ++ void *drvdata; /* Set by charlcd_alloc() */ + }; + + /** +@@ -93,7 +93,8 @@ struct charlcd_ops { + }; + + void charlcd_backlight(struct charlcd *lcd, enum charlcd_onoff on); +-struct charlcd *charlcd_alloc(void); ++ ++struct charlcd *charlcd_alloc(unsigned int drvdata_size); + void charlcd_free(struct charlcd *lcd); + + int charlcd_register(struct charlcd *lcd); +diff --git a/drivers/auxdisplay/hd44780.c b/drivers/auxdisplay/hd44780.c +index 8b690f59df27d..ebaf0ff518f4c 100644 +--- a/drivers/auxdisplay/hd44780.c ++++ b/drivers/auxdisplay/hd44780.c +@@ -226,7 +226,7 @@ static int hd44780_probe(struct platform_device *pdev) + if (!hdc) + return -ENOMEM; + +- lcd = charlcd_alloc(); ++ lcd = charlcd_alloc(0); + if (!lcd) + goto fail1; + +diff --git a/drivers/auxdisplay/lcd2s.c b/drivers/auxdisplay/lcd2s.c +index 2578b2d454397..2ee6875044a9c 100644 +--- a/drivers/auxdisplay/lcd2s.c ++++ b/drivers/auxdisplay/lcd2s.c +@@ -307,7 +307,7 @@ static int lcd2s_i2c_probe(struct i2c_client *i2c, + if (err < 0) + return err; + +- lcd = charlcd_alloc(); ++ lcd = charlcd_alloc(0); + if (!lcd) + return -ENOMEM; + +diff --git a/drivers/auxdisplay/panel.c b/drivers/auxdisplay/panel.c +index eba04c0de7eb3..0f3999b665e70 100644 +--- a/drivers/auxdisplay/panel.c ++++ b/drivers/auxdisplay/panel.c +@@ -835,7 +835,7 @@ static void lcd_init(void) + if (!hdc) + return; + +- charlcd = charlcd_alloc(); ++ charlcd = charlcd_alloc(0); + if (!charlcd) { + kfree(hdc); + return; +-- +2.39.5 + diff --git a/queue-5.15/bonding-report-duplicate-mac-address-in-all-situatio.patch b/queue-5.15/bonding-report-duplicate-mac-address-in-all-situatio.patch new file mode 100644 index 0000000000..d0583f9260 --- /dev/null +++ b/queue-5.15/bonding-report-duplicate-mac-address-in-all-situatio.patch @@ -0,0 +1,47 @@ +From 398f7dd5b834fd7457a3152892509519c13baa57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Feb 2025 03:39:14 +0000 +Subject: bonding: report duplicate MAC address in all situations +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hangbin Liu + +[ Upstream commit 28d68d396a1cd21591e8c6d74afbde33a7ea107e ] + +Normally, a bond uses the MAC address of the first added slave as the bond’s +MAC address. And the bond will set active slave’s MAC address to bond’s +address if fail_over_mac is set to none (0) or follow (2). + +When the first slave is removed, the bond will still use the removed slave’s +MAC address, which can lead to a duplicate MAC address and potentially cause +issues with the switch. To avoid confusion, let's warn the user in all +situations, including when fail_over_mac is set to 2 or not in active-backup +mode. + +Signed-off-by: Hangbin Liu +Reviewed-by: Nikolay Aleksandrov +Link: https://patch.msgid.link/20250225033914.18617-1-liuhangbin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 75499e2967e8f..6bdc29d04a580 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -2355,7 +2355,7 @@ static int __bond_release_one(struct net_device *bond_dev, + + RCU_INIT_POINTER(bond->current_arp_slave, NULL); + +- if (!all && (!bond->params.fail_over_mac || ++ if (!all && (bond->params.fail_over_mac != BOND_FOM_ACTIVE || + BOND_MODE(bond) != BOND_MODE_ACTIVEBACKUP)) { + if (ether_addr_equal_64bits(bond_dev->dev_addr, slave->perm_hwaddr) && + bond_has_slaves(bond)) +-- +2.39.5 + diff --git a/queue-5.15/bpf-fix-possible-endless-loop-in-bpf-map-iteration.patch b/queue-5.15/bpf-fix-possible-endless-loop-in-bpf-map-iteration.patch new file mode 100644 index 0000000000..3d15b3503e --- /dev/null +++ b/queue-5.15/bpf-fix-possible-endless-loop-in-bpf-map-iteration.patch @@ -0,0 +1,37 @@ +From 71b5e6cbc14ab415ada262cc6aeea0f9db723c04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Apr 2025 11:32:51 -0400 +Subject: bpf: fix possible endless loop in BPF map iteration + +From: Brandon Kammerdiener + +[ Upstream commit 75673fda0c557ae26078177dd14d4857afbf128d ] + +The _safe variant used here gets the next element before running the callback, +avoiding the endless loop condition. + +Signed-off-by: Brandon Kammerdiener +Link: https://lore.kernel.org/r/20250424153246.141677-2-brandon.kammerdiener@intel.com +Signed-off-by: Alexei Starovoitov +Acked-by: Hou Tao +Signed-off-by: Sasha Levin +--- + kernel/bpf/hashtab.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c +index d08fe64e0e453..24258c54057d4 100644 +--- a/kernel/bpf/hashtab.c ++++ b/kernel/bpf/hashtab.c +@@ -2102,7 +2102,7 @@ static int bpf_for_each_hash_elem(struct bpf_map *map, void *callback_fn, + b = &htab->buckets[i]; + rcu_read_lock(); + head = &b->head; +- hlist_nulls_for_each_entry_rcu(elem, n, head, hash_node) { ++ hlist_nulls_for_each_entry_safe(elem, n, head, hash_node) { + key = elem->key; + if (is_percpu) { + /* current cpu value for percpu map */ +-- +2.39.5 + diff --git a/queue-5.15/bpf-prevent-unsafe-access-to-the-sock-fields-in-the-.patch b/queue-5.15/bpf-prevent-unsafe-access-to-the-sock-fields-in-the-.patch new file mode 100644 index 0000000000..6049187ba7 --- /dev/null +++ b/queue-5.15/bpf-prevent-unsafe-access-to-the-sock-fields-in-the-.patch @@ -0,0 +1,150 @@ +From dccc085c23c9e1f9bd8346496fa77c07c380bfa8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Feb 2025 15:29:31 +0800 +Subject: bpf: Prevent unsafe access to the sock fields in the BPF timestamping + callback + +From: Jason Xing + +[ Upstream commit fd93eaffb3f977b23bc0a48d4c8616e654fcf133 ] + +The subsequent patch will implement BPF TX timestamping. It will +call the sockops BPF program without holding the sock lock. + +This breaks the current assumption that all sock ops programs will +hold the sock lock. The sock's fields of the uapi's bpf_sock_ops +requires this assumption. + +To address this, a new "u8 is_locked_tcp_sock;" field is added. This +patch sets it in the current sock_ops callbacks. The "is_fullsock" +test is then replaced by the "is_locked_tcp_sock" test during +sock_ops_convert_ctx_access(). + +The new TX timestamping callbacks added in the subsequent patch will +not have this set. This will prevent unsafe access from the new +timestamping callbacks. + +Potentially, we could allow read-only access. However, this would +require identifying which callback is read-safe-only and also requires +additional BPF instruction rewrites in the covert_ctx. Since the BPF +program can always read everything from a socket (e.g., by using +bpf_core_cast), this patch keeps it simple and disables all read +and write access to any socket fields through the bpf_sock_ops +UAPI from the new TX timestamping callback. + +Moreover, note that some of the fields in bpf_sock_ops are specific +to tcp_sock, and sock_ops currently only supports tcp_sock. In +the future, UDP timestamping will be added, which will also break +this assumption. The same idea used in this patch will be reused. +Considering that the current sock_ops only supports tcp_sock, the +variable is named is_locked_"tcp"_sock. + +Signed-off-by: Jason Xing +Signed-off-by: Martin KaFai Lau +Link: https://patch.msgid.link/20250220072940.99994-4-kerneljasonxing@gmail.com +Signed-off-by: Sasha Levin +--- + include/linux/filter.h | 1 + + include/net/tcp.h | 1 + + net/core/filter.c | 8 ++++---- + net/ipv4/tcp_input.c | 2 ++ + net/ipv4/tcp_output.c | 2 ++ + 5 files changed, 10 insertions(+), 4 deletions(-) + +diff --git a/include/linux/filter.h b/include/linux/filter.h +index 7d8294d0d7173..e723b930bac14 100644 +--- a/include/linux/filter.h ++++ b/include/linux/filter.h +@@ -1327,6 +1327,7 @@ struct bpf_sock_ops_kern { + void *skb_data_end; + u8 op; + u8 is_fullsock; ++ u8 is_locked_tcp_sock; + u8 remaining_opt_len; + u64 temp; /* temp and everything after is not + * initialized to 0 before calling +diff --git a/include/net/tcp.h b/include/net/tcp.h +index be91d81d66ab3..577e60ec41b8c 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -2322,6 +2322,7 @@ static inline int tcp_call_bpf(struct sock *sk, int op, u32 nargs, u32 *args) + memset(&sock_ops, 0, offsetof(struct bpf_sock_ops_kern, temp)); + if (sk_fullsock(sk)) { + sock_ops.is_fullsock = 1; ++ sock_ops.is_locked_tcp_sock = 1; + sock_owned_by_me(sk); + } + +diff --git a/net/core/filter.c b/net/core/filter.c +index 9d358fb865e28..983aca1bf833f 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -9640,10 +9640,10 @@ static u32 sock_ops_convert_ctx_access(enum bpf_access_type type, + } \ + *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF( \ + struct bpf_sock_ops_kern, \ +- is_fullsock), \ ++ is_locked_tcp_sock), \ + fullsock_reg, si->src_reg, \ + offsetof(struct bpf_sock_ops_kern, \ +- is_fullsock)); \ ++ is_locked_tcp_sock)); \ + *insn++ = BPF_JMP_IMM(BPF_JEQ, fullsock_reg, 0, jmp); \ + if (si->dst_reg == si->src_reg) \ + *insn++ = BPF_LDX_MEM(BPF_DW, reg, si->src_reg, \ +@@ -9728,10 +9728,10 @@ static u32 sock_ops_convert_ctx_access(enum bpf_access_type type, + temp)); \ + *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF( \ + struct bpf_sock_ops_kern, \ +- is_fullsock), \ ++ is_locked_tcp_sock), \ + reg, si->dst_reg, \ + offsetof(struct bpf_sock_ops_kern, \ +- is_fullsock)); \ ++ is_locked_tcp_sock)); \ + *insn++ = BPF_JMP_IMM(BPF_JEQ, reg, 0, 2); \ + *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF( \ + struct bpf_sock_ops_kern, sk),\ +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 8859a38b45d5e..0caf1474b9807 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -168,6 +168,7 @@ static void bpf_skops_parse_hdr(struct sock *sk, struct sk_buff *skb) + memset(&sock_ops, 0, offsetof(struct bpf_sock_ops_kern, temp)); + sock_ops.op = BPF_SOCK_OPS_PARSE_HDR_OPT_CB; + sock_ops.is_fullsock = 1; ++ sock_ops.is_locked_tcp_sock = 1; + sock_ops.sk = sk; + bpf_skops_init_skb(&sock_ops, skb, tcp_hdrlen(skb)); + +@@ -184,6 +185,7 @@ static void bpf_skops_established(struct sock *sk, int bpf_op, + memset(&sock_ops, 0, offsetof(struct bpf_sock_ops_kern, temp)); + sock_ops.op = bpf_op; + sock_ops.is_fullsock = 1; ++ sock_ops.is_locked_tcp_sock = 1; + sock_ops.sk = sk; + /* sk with TCP_REPAIR_ON does not have skb in tcp_finish_connect */ + if (skb) +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 3a66d0c7d015c..3a819413d3968 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -507,6 +507,7 @@ static void bpf_skops_hdr_opt_len(struct sock *sk, struct sk_buff *skb, + sock_owned_by_me(sk); + + sock_ops.is_fullsock = 1; ++ sock_ops.is_locked_tcp_sock = 1; + sock_ops.sk = sk; + } + +@@ -552,6 +553,7 @@ static void bpf_skops_write_hdr_opt(struct sock *sk, struct sk_buff *skb, + sock_owned_by_me(sk); + + sock_ops.is_fullsock = 1; ++ sock_ops.is_locked_tcp_sock = 1; + sock_ops.sk = sk; + } + +-- +2.39.5 + diff --git a/queue-5.15/bpftool-fix-readlink-usage-in-get_fd_type.patch b/queue-5.15/bpftool-fix-readlink-usage-in-get_fd_type.patch new file mode 100644 index 0000000000..4378e68232 --- /dev/null +++ b/queue-5.15/bpftool-fix-readlink-usage-in-get_fd_type.patch @@ -0,0 +1,49 @@ +From 44ca1f0e2db4864a2939b0352abd9830075739a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jan 2025 08:18:57 +0100 +Subject: bpftool: Fix readlink usage in get_fd_type + +From: Viktor Malik + +[ Upstream commit 0053f7d39d491b6138d7c526876d13885cbb65f1 ] + +The `readlink(path, buf, sizeof(buf))` call reads at most sizeof(buf) +bytes and *does not* append null-terminator to buf. With respect to +that, fix two pieces in get_fd_type: + +1. Change the truncation check to contain sizeof(buf) rather than + sizeof(path). +2. Append null-terminator to buf. + +Reported by Coverity. + +Signed-off-by: Viktor Malik +Signed-off-by: Andrii Nakryiko +Reviewed-by: Quentin Monnet +Link: https://lore.kernel.org/bpf/20250129071857.75182-1-vmalik@redhat.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/common.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c +index e4c65d34fe74f..2b4773e00ab68 100644 +--- a/tools/bpf/bpftool/common.c ++++ b/tools/bpf/bpftool/common.c +@@ -318,10 +318,11 @@ int get_fd_type(int fd) + p_err("can't read link type: %s", strerror(errno)); + return -1; + } +- if (n == sizeof(path)) { ++ if (n == sizeof(buf)) { + p_err("can't read link type: path too long!"); + return -1; + } ++ buf[n] = '\0'; + + if (strstr(buf, "bpf-map")) + return BPF_OBJ_MAP; +-- +2.39.5 + diff --git a/queue-5.15/btrfs-avoid-linker-error-in-btrfs_find_create_tree_b.patch b/queue-5.15/btrfs-avoid-linker-error-in-btrfs_find_create_tree_b.patch new file mode 100644 index 0000000000..464101a737 --- /dev/null +++ b/queue-5.15/btrfs-avoid-linker-error-in-btrfs_find_create_tree_b.patch @@ -0,0 +1,61 @@ +From 2c3a500d140b4c5f14f9d7ee113673745641257c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Mar 2025 10:58:46 +0000 +Subject: btrfs: avoid linker error in btrfs_find_create_tree_block() + +From: Mark Harmstone + +[ Upstream commit 7ef3cbf17d2734ca66c4ed8573be45f4e461e7ee ] + +The inline function btrfs_is_testing() is hardcoded to return 0 if +CONFIG_BTRFS_FS_RUN_SANITY_TESTS is not set. Currently we're relying on +the compiler optimizing out the call to alloc_test_extent_buffer() in +btrfs_find_create_tree_block(), as it's not been defined (it's behind an + #ifdef). + +Add a stub version of alloc_test_extent_buffer() to avoid linker errors +on non-standard optimization levels. This problem was seen on GCC 14 +with -O0 and is helps to see symbols that would be otherwise optimized +out. + +Reviewed-by: Qu Wenruo +Signed-off-by: Mark Harmstone +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/extent_io.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index a1946d62911c9..39619fd6d6aae 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -6024,10 +6024,10 @@ struct extent_buffer *find_extent_buffer(struct btrfs_fs_info *fs_info, + return eb; + } + +-#ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS + struct extent_buffer *alloc_test_extent_buffer(struct btrfs_fs_info *fs_info, + u64 start) + { ++#ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS + struct extent_buffer *eb, *exists = NULL; + int ret; + +@@ -6063,8 +6063,11 @@ struct extent_buffer *alloc_test_extent_buffer(struct btrfs_fs_info *fs_info, + free_eb: + btrfs_release_extent_buffer(eb); + return exists; +-} ++#else ++ /* Stub to avoid linker error when compiled with optimizations turned off. */ ++ return NULL; + #endif ++} + + static struct extent_buffer *grab_extent_buffer( + struct btrfs_fs_info *fs_info, struct page *page) +-- +2.39.5 + diff --git a/queue-5.15/btrfs-correct-the-order-of-prelim_ref-arguments-in-b.patch b/queue-5.15/btrfs-correct-the-order-of-prelim_ref-arguments-in-b.patch new file mode 100644 index 0000000000..0197f0bed7 --- /dev/null +++ b/queue-5.15/btrfs-correct-the-order-of-prelim_ref-arguments-in-b.patch @@ -0,0 +1,82 @@ +From edaf01309e9cac17a4aae75d2c1e203ce93a3166 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Apr 2025 09:25:06 -0400 +Subject: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref + +From: Goldwyn Rodrigues + +[ Upstream commit bc7e0975093567f51be8e1bdf4aa5900a3cf0b1e ] + +btrfs_prelim_ref() calls the old and new reference variables in the +incorrect order. This causes a NULL pointer dereference because oldref +is passed as NULL to trace_btrfs_prelim_ref_insert(). + +Note, trace_btrfs_prelim_ref_insert() is being called with newref as +oldref (and oldref as NULL) on purpose in order to print out +the values of newref. + +To reproduce: +echo 1 > /sys/kernel/debug/tracing/events/btrfs/btrfs_prelim_ref_insert/enable + +Perform some writeback operations. + +Backtrace: +BUG: kernel NULL pointer dereference, address: 0000000000000018 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 115949067 P4D 115949067 PUD 11594a067 PMD 0 + Oops: Oops: 0000 [#1] SMP NOPTI + CPU: 1 UID: 0 PID: 1188 Comm: fsstress Not tainted 6.15.0-rc2-tester+ #47 PREEMPT(voluntary) 7ca2cef72d5e9c600f0c7718adb6462de8149622 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014 + RIP: 0010:trace_event_raw_event_btrfs__prelim_ref+0x72/0x130 + Code: e8 43 81 9f ff 48 85 c0 74 78 4d 85 e4 0f 84 8f 00 00 00 49 8b 94 24 c0 06 00 00 48 8b 0a 48 89 48 08 48 8b 52 08 48 89 50 10 <49> 8b 55 18 48 89 50 18 49 8b 55 20 48 89 50 20 41 0f b6 55 28 88 + RSP: 0018:ffffce44820077a0 EFLAGS: 00010286 + RAX: ffff8c6b403f9014 RBX: ffff8c6b55825730 RCX: 304994edf9cf506b + RDX: d8b11eb7f0fdb699 RSI: ffff8c6b403f9010 RDI: ffff8c6b403f9010 + RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000010 + R10: 00000000ffffffff R11: 0000000000000000 R12: ffff8c6b4e8fb000 + R13: 0000000000000000 R14: ffffce44820077a8 R15: ffff8c6b4abd1540 + FS: 00007f4dc6813740(0000) GS:ffff8c6c1d378000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000018 CR3: 000000010eb42000 CR4: 0000000000750ef0 + PKRU: 55555554 + Call Trace: + + prelim_ref_insert+0x1c1/0x270 + find_parent_nodes+0x12a6/0x1ee0 + ? __entry_text_end+0x101f06/0x101f09 + ? srso_alias_return_thunk+0x5/0xfbef5 + ? srso_alias_return_thunk+0x5/0xfbef5 + ? srso_alias_return_thunk+0x5/0xfbef5 + ? srso_alias_return_thunk+0x5/0xfbef5 + btrfs_is_data_extent_shared+0x167/0x640 + ? fiemap_process_hole+0xd0/0x2c0 + extent_fiemap+0xa5c/0xbc0 + ? __entry_text_end+0x101f05/0x101f09 + btrfs_fiemap+0x7e/0xd0 + do_vfs_ioctl+0x425/0x9d0 + __x64_sys_ioctl+0x75/0xc0 + +Signed-off-by: Goldwyn Rodrigues +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + include/trace/events/btrfs.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h +index 9271b5dfae4c4..a5f77b685c55f 100644 +--- a/include/trace/events/btrfs.h ++++ b/include/trace/events/btrfs.h +@@ -1788,7 +1788,7 @@ DECLARE_EVENT_CLASS(btrfs__prelim_ref, + TP_PROTO(const struct btrfs_fs_info *fs_info, + const struct prelim_ref *oldref, + const struct prelim_ref *newref, u64 tree_size), +- TP_ARGS(fs_info, newref, oldref, tree_size), ++ TP_ARGS(fs_info, oldref, newref, tree_size), + + TP_STRUCT__entry_btrfs( + __field( u64, root_id ) +-- +2.39.5 + diff --git a/queue-5.15/btrfs-get-zone-unusable-bytes-while-holding-lock-at-.patch b/queue-5.15/btrfs-get-zone-unusable-bytes-while-holding-lock-at-.patch new file mode 100644 index 0000000000..153798f872 --- /dev/null +++ b/queue-5.15/btrfs-get-zone-unusable-bytes-while-holding-lock-at-.patch @@ -0,0 +1,68 @@ +From 07c88a7a0bd57028cf239d6c2b7976ee3a4c1fc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Feb 2025 16:12:15 +0000 +Subject: btrfs: get zone unusable bytes while holding lock at + btrfs_reclaim_bgs_work() + +From: Filipe Manana + +[ Upstream commit 1283b8c125a83bf7a7dbe90c33d3472b6d7bf612 ] + +At btrfs_reclaim_bgs_work(), we are grabbing a block group's zone unusable +bytes while not under the protection of the block group's spinlock, so +this can trigger race reports from KCSAN (or similar tools) since that +field is typically updated while holding the lock, such as at +__btrfs_add_free_space_zoned() for example. + +Fix this by grabbing the zone unusable bytes while we are still in the +critical section holding the block group's spinlock, which is right above +where we are currently grabbing it. + +Reviewed-by: Johannes Thumshirn +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/block-group.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c +index 2c5bd2ad69f35..614917cac0e7e 100644 +--- a/fs/btrfs/block-group.c ++++ b/fs/btrfs/block-group.c +@@ -1543,6 +1543,17 @@ void btrfs_reclaim_bgs_work(struct work_struct *work) + up_write(&space_info->groups_sem); + goto next; + } ++ ++ /* ++ * Cache the zone_unusable value before turning the block group ++ * to read only. As soon as the block group is read only it's ++ * zone_unusable value gets moved to the block group's read-only ++ * bytes and isn't available for calculations anymore. We also ++ * cache it before unlocking the block group, to prevent races ++ * (reports from KCSAN and such tools) with tasks updating it. ++ */ ++ zone_unusable = bg->zone_unusable; ++ + spin_unlock(&bg->lock); + + /* +@@ -1558,13 +1569,6 @@ void btrfs_reclaim_bgs_work(struct work_struct *work) + goto next; + } + +- /* +- * Cache the zone_unusable value before turning the block group +- * to read only. As soon as the blog group is read only it's +- * zone_unusable value gets moved to the block group's read-only +- * bytes and isn't available for calculations anymore. +- */ +- zone_unusable = bg->zone_unusable; + ret = inc_block_group_ro(bg, 0); + up_write(&space_info->groups_sem); + if (ret < 0) +-- +2.39.5 + diff --git a/queue-5.15/btrfs-make-btrfs_discard_workfn-block_group-ref-expl.patch b/queue-5.15/btrfs-make-btrfs_discard_workfn-block_group-ref-expl.patch new file mode 100644 index 0000000000..3dd21620eb --- /dev/null +++ b/queue-5.15/btrfs-make-btrfs_discard_workfn-block_group-ref-expl.patch @@ -0,0 +1,106 @@ +From 2c4c872c3dd6d3c4d37200f1b3490b1b784d2243 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Mar 2025 15:01:05 -0800 +Subject: btrfs: make btrfs_discard_workfn() block_group ref explicit + +From: Boris Burkov + +[ Upstream commit 895c6721d310c036dcfebb5ab845822229fa35eb ] + +Currently, the async discard machinery owns a ref to the block_group +when the block_group is queued on a discard list. However, to handle +races with discard cancellation and the discard workfn, we have a +specific logic to detect that the block_group is *currently* running in +the workfn, to protect the workfn's usage amidst cancellation. + +As far as I can tell, this doesn't have any overt bugs (though +finish_discard_pass() and remove_from_discard_list() racing can have a +surprising outcome for the caller of remove_from_discard_list() in that +it is again added at the end). + +But it is needlessly complicated to rely on locking and the nullity of +discard_ctl->block_group. Simplify this significantly by just taking a +refcount while we are in the workfn and unconditionally drop it in both +the remove and workfn paths, regardless of if they race. + +Reviewed-by: Filipe Manana +Signed-off-by: Boris Burkov +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/discard.c | 34 ++++++++++++++++------------------ + 1 file changed, 16 insertions(+), 18 deletions(-) + +diff --git a/fs/btrfs/discard.c b/fs/btrfs/discard.c +index 7b2f77a8aa982..a90f3cb83c709 100644 +--- a/fs/btrfs/discard.c ++++ b/fs/btrfs/discard.c +@@ -152,13 +152,7 @@ static bool remove_from_discard_list(struct btrfs_discard_ctl *discard_ctl, + block_group->discard_eligible_time = 0; + queued = !list_empty(&block_group->discard_list); + list_del_init(&block_group->discard_list); +- /* +- * If the block group is currently running in the discard workfn, we +- * don't want to deref it, since it's still being used by the workfn. +- * The workfn will notice this case and deref the block group when it is +- * finished. +- */ +- if (queued && !running) ++ if (queued) + btrfs_put_block_group(block_group); + + spin_unlock(&discard_ctl->lock); +@@ -256,9 +250,10 @@ static struct btrfs_block_group *peek_discard_list( + block_group->discard_cursor = block_group->start; + block_group->discard_state = BTRFS_DISCARD_EXTENTS; + } +- discard_ctl->block_group = block_group; + } + if (block_group) { ++ btrfs_get_block_group(block_group); ++ discard_ctl->block_group = block_group; + *discard_state = block_group->discard_state; + *discard_index = block_group->discard_index; + } +@@ -482,9 +477,20 @@ static void btrfs_discard_workfn(struct work_struct *work) + + block_group = peek_discard_list(discard_ctl, &discard_state, + &discard_index, now); +- if (!block_group || !btrfs_run_discard_work(discard_ctl)) ++ if (!block_group) + return; ++ if (!btrfs_run_discard_work(discard_ctl)) { ++ spin_lock(&discard_ctl->lock); ++ btrfs_put_block_group(block_group); ++ discard_ctl->block_group = NULL; ++ spin_unlock(&discard_ctl->lock); ++ return; ++ } + if (now < block_group->discard_eligible_time) { ++ spin_lock(&discard_ctl->lock); ++ btrfs_put_block_group(block_group); ++ discard_ctl->block_group = NULL; ++ spin_unlock(&discard_ctl->lock); + btrfs_discard_schedule_work(discard_ctl, false); + return; + } +@@ -536,15 +542,7 @@ static void btrfs_discard_workfn(struct work_struct *work) + spin_lock(&discard_ctl->lock); + discard_ctl->prev_discard = trimmed; + discard_ctl->prev_discard_time = now; +- /* +- * If the block group was removed from the discard list while it was +- * running in this workfn, then we didn't deref it, since this function +- * still owned that reference. But we set the discard_ctl->block_group +- * back to NULL, so we can use that condition to know that now we need +- * to deref the block_group. +- */ +- if (discard_ctl->block_group == NULL) +- btrfs_put_block_group(block_group); ++ btrfs_put_block_group(block_group); + discard_ctl->block_group = NULL; + __btrfs_discard_schedule_work(discard_ctl, now, false); + spin_unlock(&discard_ctl->lock); +-- +2.39.5 + diff --git a/queue-5.15/btrfs-send-return-enametoolong-when-attempting-a-pat.patch b/queue-5.15/btrfs-send-return-enametoolong-when-attempting-a-pat.patch new file mode 100644 index 0000000000..fda6b4a1b7 --- /dev/null +++ b/queue-5.15/btrfs-send-return-enametoolong-when-attempting-a-pat.patch @@ -0,0 +1,46 @@ +From 999aec228f09831ec0dbde1e5bd8a1fdbeeedd25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Feb 2025 13:09:25 +0000 +Subject: btrfs: send: return -ENAMETOOLONG when attempting a path that is too + long + +From: Filipe Manana + +[ Upstream commit a77749b3e21813566cea050bbb3414ae74562eba ] + +When attempting to build a too long path we are currently returning +-ENOMEM, which is very odd and misleading. So update fs_path_ensure_buf() +to return -ENAMETOOLONG instead. Also, while at it, move the WARN_ON() +into the if statement's expression, as it makes it clear what is being +tested and also has the effect of adding 'unlikely' to the statement, +which allows the compiler to generate better code as this condition is +never expected to happen. + +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/send.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c +index 577980b33aeb7..a46076788bd7e 100644 +--- a/fs/btrfs/send.c ++++ b/fs/btrfs/send.c +@@ -400,10 +400,8 @@ static int fs_path_ensure_buf(struct fs_path *p, int len) + if (p->buf_len >= len) + return 0; + +- if (len > PATH_MAX) { +- WARN_ON(1); +- return -ENOMEM; +- } ++ if (WARN_ON(len > PATH_MAX)) ++ return -ENAMETOOLONG; + + path_len = p->end - p->start; + old_buf_len = p->buf_len; +-- +2.39.5 + diff --git a/queue-5.15/can-c_can-use-of_property_present-to-test-existence-.patch b/queue-5.15/can-c_can-use-of_property_present-to-test-existence-.patch new file mode 100644 index 0000000000..473ba022b7 --- /dev/null +++ b/queue-5.15/can-c_can-use-of_property_present-to-test-existence-.patch @@ -0,0 +1,38 @@ +From 8a48b7de29fb5ace850bd4359dfa24966e21cdfb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Feb 2025 21:23:14 +0100 +Subject: can: c_can: Use of_property_present() to test existence of DT + property + +From: Krzysztof Kozlowski + +[ Upstream commit ab1bc2290fd8311d49b87c29f1eb123fcb581bee ] + +of_property_read_bool() should be used only on boolean properties. + +Cc: Rob Herring +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Vincent Mailhol +Link: https://patch.msgid.link/20250212-syscon-phandle-args-can-v2-3-ac9a1253396b@linaro.org +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/c_can/c_can_platform.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c +index c5d7093d54133..c29862b3bb1f3 100644 +--- a/drivers/net/can/c_can/c_can_platform.c ++++ b/drivers/net/can/c_can/c_can_platform.c +@@ -334,7 +334,7 @@ static int c_can_plat_probe(struct platform_device *pdev) + /* Check if we need custom RAMINIT via syscon. Mostly for TI + * platforms. Only supported with DT boot. + */ +- if (np && of_property_read_bool(np, "syscon-raminit")) { ++ if (np && of_property_present(np, "syscon-raminit")) { + u32 id; + struct c_can_raminit *raminit = &priv->raminit_sys; + +-- +2.39.5 + diff --git a/queue-5.15/cgroup-fix-compilation-issue-due-to-cgroup_mutex-not.patch b/queue-5.15/cgroup-fix-compilation-issue-due-to-cgroup_mutex-not.patch new file mode 100644 index 0000000000..ac9f06c777 --- /dev/null +++ b/queue-5.15/cgroup-fix-compilation-issue-due-to-cgroup_mutex-not.patch @@ -0,0 +1,48 @@ +From bc7ae5a472f41cf5c75e4375ff92ece10b20ef9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Apr 2025 07:30:00 +0000 +Subject: cgroup: Fix compilation issue due to cgroup_mutex not being exported +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: gaoxu + +[ Upstream commit 87c259a7a359e73e6c52c68fcbec79988999b4e6 ] + +When adding folio_memcg function call in the zram module for +Android16-6.12, the following error occurs during compilation: +ERROR: modpost: "cgroup_mutex" [../soc-repo/zram.ko] undefined! + +This error is caused by the indirect call to lockdep_is_held(&cgroup_mutex) +within folio_memcg. The export setting for cgroup_mutex is controlled by +the CONFIG_PROVE_RCU macro. If CONFIG_LOCKDEP is enabled while +CONFIG_PROVE_RCU is not, this compilation error will occur. + +To resolve this issue, add a parallel macro CONFIG_LOCKDEP control to +ensure cgroup_mutex is properly exported when needed. + +Signed-off-by: gao xu +Acked-by: Michal Koutný +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cgroup.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c +index 1e87257fe4692..1a3b2e1436db0 100644 +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -89,7 +89,7 @@ + DEFINE_MUTEX(cgroup_mutex); + DEFINE_SPINLOCK(css_set_lock); + +-#ifdef CONFIG_PROVE_RCU ++#if (defined CONFIG_PROVE_RCU || defined CONFIG_LOCKDEP) + EXPORT_SYMBOL_GPL(cgroup_mutex); + EXPORT_SYMBOL_GPL(css_set_lock); + #endif +-- +2.39.5 + diff --git a/queue-5.15/clk-imx8mp-inform-ccf-of-maximum-frequency-of-clocks.patch b/queue-5.15/clk-imx8mp-inform-ccf-of-maximum-frequency-of-clocks.patch new file mode 100644 index 0000000000..dbe3e0bac9 --- /dev/null +++ b/queue-5.15/clk-imx8mp-inform-ccf-of-maximum-frequency-of-clocks.patch @@ -0,0 +1,214 @@ +From b4250f295e84c1c8053e82a7ca843a60512cd041 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Feb 2025 19:26:46 +0100 +Subject: clk: imx8mp: inform CCF of maximum frequency of clocks + +From: Ahmad Fatoum + +[ Upstream commit 06a61b5cb6a8638fa8823cd09b17233b29696fa2 ] + +The IMX8MPCEC datasheet lists maximum frequencies allowed for different +modules. Some of these limits are universal, but some depend on +whether the SoC is operating in nominal or in overdrive mode. + +The imx8mp.dtsi currently assumes overdrive mode and configures some +clocks in accordance with this. Boards wishing to make use of nominal +mode will need to override some of the clock rates manually. + +As operating the clocks outside of their allowed range can lead to +difficult to debug issues, it makes sense to register the maximum rates +allowed in the driver, so the CCF can take them into account. + +Reviewed-by: Peng Fan +Signed-off-by: Ahmad Fatoum +Link: https://lore.kernel.org/r/20250218-imx8m-clk-v4-6-b7697dc2dcd0@pengutronix.de +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx8mp.c | 151 +++++++++++++++++++++++++++++++++++ + 1 file changed, 151 insertions(+) + +diff --git a/drivers/clk/imx/clk-imx8mp.c b/drivers/clk/imx/clk-imx8mp.c +index 0f9ec5e0f5f81..0541ddfdf1020 100644 +--- a/drivers/clk/imx/clk-imx8mp.c ++++ b/drivers/clk/imx/clk-imx8mp.c +@@ -8,6 +8,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -405,11 +406,151 @@ static const char * const imx8mp_clkout_sels[] = {"audio_pll1_out", "audio_pll2_ + static struct clk_hw **hws; + static struct clk_hw_onecell_data *clk_hw_data; + ++struct imx8mp_clock_constraints { ++ unsigned int clkid; ++ u32 maxrate; ++}; ++ ++/* ++ * Below tables are taken from IMX8MPCEC Rev. 2.1, 07/2023 ++ * Table 13. Maximum frequency of modules. ++ * Probable typos fixed are marked with a comment. ++ */ ++static const struct imx8mp_clock_constraints imx8mp_clock_common_constraints[] = { ++ { IMX8MP_CLK_A53_DIV, 1000 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_ENET_AXI, 266666667 }, /* Datasheet claims 266MHz */ ++ { IMX8MP_CLK_NAND_USDHC_BUS, 266666667 }, /* Datasheet claims 266MHz */ ++ { IMX8MP_CLK_MEDIA_APB, 200 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_HDMI_APB, 133333333 }, /* Datasheet claims 133MHz */ ++ { IMX8MP_CLK_ML_AXI, 800 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_AHB, 133333333 }, ++ { IMX8MP_CLK_IPG_ROOT, 66666667 }, ++ { IMX8MP_CLK_AUDIO_AHB, 400 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_MEDIA_DISP2_PIX, 170 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_DRAM_ALT, 666666667 }, ++ { IMX8MP_CLK_DRAM_APB, 200 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_CAN1, 80 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_CAN2, 80 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_PCIE_AUX, 10 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_I2C5, 66666667 }, /* Datasheet claims 66MHz */ ++ { IMX8MP_CLK_I2C6, 66666667 }, /* Datasheet claims 66MHz */ ++ { IMX8MP_CLK_SAI1, 66666667 }, /* Datasheet claims 66MHz */ ++ { IMX8MP_CLK_SAI2, 66666667 }, /* Datasheet claims 66MHz */ ++ { IMX8MP_CLK_SAI3, 66666667 }, /* Datasheet claims 66MHz */ ++ { IMX8MP_CLK_SAI5, 66666667 }, /* Datasheet claims 66MHz */ ++ { IMX8MP_CLK_SAI6, 66666667 }, /* Datasheet claims 66MHz */ ++ { IMX8MP_CLK_ENET_QOS, 125 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_ENET_QOS_TIMER, 200 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_ENET_REF, 125 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_ENET_TIMER, 125 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_ENET_PHY_REF, 125 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_NAND, 500 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_QSPI, 400 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_USDHC1, 400 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_USDHC2, 400 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_I2C1, 66666667 }, /* Datasheet claims 66MHz */ ++ { IMX8MP_CLK_I2C2, 66666667 }, /* Datasheet claims 66MHz */ ++ { IMX8MP_CLK_I2C3, 66666667 }, /* Datasheet claims 66MHz */ ++ { IMX8MP_CLK_I2C4, 66666667 }, /* Datasheet claims 66MHz */ ++ { IMX8MP_CLK_UART1, 80 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_UART2, 80 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_UART3, 80 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_UART4, 80 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_ECSPI1, 80 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_ECSPI2, 80 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_PWM1, 66666667 }, /* Datasheet claims 66MHz */ ++ { IMX8MP_CLK_PWM2, 66666667 }, /* Datasheet claims 66MHz */ ++ { IMX8MP_CLK_PWM3, 66666667 }, /* Datasheet claims 66MHz */ ++ { IMX8MP_CLK_PWM4, 66666667 }, /* Datasheet claims 66MHz */ ++ { IMX8MP_CLK_GPT1, 100 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_GPT2, 100 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_GPT3, 100 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_GPT4, 100 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_GPT5, 100 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_GPT6, 100 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_WDOG, 66666667 }, /* Datasheet claims 66MHz */ ++ { IMX8MP_CLK_IPP_DO_CLKO1, 200 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_IPP_DO_CLKO2, 200 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_HDMI_REF_266M, 266 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_USDHC3, 400 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_MEDIA_MIPI_PHY1_REF, 300 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_MEDIA_DISP1_PIX, 250 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_MEDIA_CAM2_PIX, 277 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_MEDIA_LDB, 595 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_MEDIA_MIPI_TEST_BYTE, 200 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_ECSPI3, 80 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_PDM, 200 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_SAI7, 66666667 }, /* Datasheet claims 66MHz */ ++ { IMX8MP_CLK_MAIN_AXI, 400 * HZ_PER_MHZ }, ++ { /* Sentinel */ } ++}; ++ ++static const struct imx8mp_clock_constraints imx8mp_clock_nominal_constraints[] = { ++ { IMX8MP_CLK_M7_CORE, 600 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_ML_CORE, 800 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_GPU3D_CORE, 800 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_GPU3D_SHADER_CORE, 800 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_GPU2D_CORE, 800 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_AUDIO_AXI_SRC, 600 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_HSIO_AXI, 400 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_MEDIA_ISP, 400 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_VPU_BUS, 600 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_MEDIA_AXI, 400 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_HDMI_AXI, 400 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_GPU_AXI, 600 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_GPU_AHB, 300 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_NOC, 800 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_NOC_IO, 600 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_ML_AHB, 300 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_VPU_G1, 600 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_VPU_G2, 500 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_MEDIA_CAM1_PIX, 400 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_VPU_VC8000E, 400 * HZ_PER_MHZ }, /* Datasheet claims 500MHz */ ++ { IMX8MP_CLK_DRAM_CORE, 800 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_GIC, 400 * HZ_PER_MHZ }, ++ { /* Sentinel */ } ++}; ++ ++static const struct imx8mp_clock_constraints imx8mp_clock_overdrive_constraints[] = { ++ { IMX8MP_CLK_M7_CORE, 800 * HZ_PER_MHZ}, ++ { IMX8MP_CLK_ML_CORE, 1000 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_GPU3D_CORE, 1000 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_GPU3D_SHADER_CORE, 1000 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_GPU2D_CORE, 1000 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_AUDIO_AXI_SRC, 800 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_HSIO_AXI, 500 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_MEDIA_ISP, 500 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_VPU_BUS, 800 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_MEDIA_AXI, 500 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_HDMI_AXI, 500 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_GPU_AXI, 800 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_GPU_AHB, 400 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_NOC, 1000 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_NOC_IO, 800 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_ML_AHB, 400 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_VPU_G1, 800 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_VPU_G2, 700 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_MEDIA_CAM1_PIX, 500 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_VPU_VC8000E, 500 * HZ_PER_MHZ }, /* Datasheet claims 400MHz */ ++ { IMX8MP_CLK_DRAM_CORE, 1000 * HZ_PER_MHZ }, ++ { IMX8MP_CLK_GIC, 500 * HZ_PER_MHZ }, ++ { /* Sentinel */ } ++}; ++ ++static void imx8mp_clocks_apply_constraints(const struct imx8mp_clock_constraints constraints[]) ++{ ++ const struct imx8mp_clock_constraints *constr; ++ ++ for (constr = constraints; constr->clkid; constr++) ++ clk_hw_set_rate_range(hws[constr->clkid], 0, constr->maxrate); ++} ++ + static int imx8mp_clocks_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; + struct device_node *np; + void __iomem *anatop_base, *ccm_base; ++ const char *opmode; + int err; + + np = of_find_compatible_node(NULL, NULL, "fsl,imx8mp-anatop"); +@@ -720,6 +861,16 @@ static int imx8mp_clocks_probe(struct platform_device *pdev) + + imx_check_clk_hws(hws, IMX8MP_CLK_END); + ++ imx8mp_clocks_apply_constraints(imx8mp_clock_common_constraints); ++ ++ err = of_property_read_string(np, "fsl,operating-mode", &opmode); ++ if (!err) { ++ if (!strcmp(opmode, "nominal")) ++ imx8mp_clocks_apply_constraints(imx8mp_clock_nominal_constraints); ++ else if (!strcmp(opmode, "overdrive")) ++ imx8mp_clocks_apply_constraints(imx8mp_clock_overdrive_constraints); ++ } ++ + err = of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_hw_data); + if (err < 0) { + dev_err(dev, "failed to register hws for i.MX8MP\n"); +-- +2.39.5 + diff --git a/queue-5.15/clk-qcom-camcc-sm8250-use-clk_rcg2_shared_ops-for-so.patch b/queue-5.15/clk-qcom-camcc-sm8250-use-clk_rcg2_shared_ops-for-so.patch new file mode 100644 index 0000000000..3b2cf1eb09 --- /dev/null +++ b/queue-5.15/clk-qcom-camcc-sm8250-use-clk_rcg2_shared_ops-for-so.patch @@ -0,0 +1,285 @@ +From 97fdb977a79e03c58a43240e46a59e239292ad2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jan 2025 22:26:12 +0000 +Subject: clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs + +From: Jordan Crouse + +[ Upstream commit 52b10b591f83dc6d9a1d6c2dc89433470a787ecd ] + +Update some RCGs on the sm8250 camera clock controller to use +clk_rcg2_shared_ops. The shared_ops ensure the RCGs get parked +to the XO during clock disable to prevent the clocks from locking up +when the GDSC is enabled. These mirror similar fixes for other controllers +such as commit e5c359f70e4b ("clk: qcom: camcc: Update the clock ops for +the SC7180"). + +Signed-off-by: Jordan Crouse +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Bryan O'Donoghue +Link: https://lore.kernel.org/r/20250122222612.32351-1-jorcrous@amazon.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/camcc-sm8250.c | 56 ++++++++++++++++----------------- + 1 file changed, 28 insertions(+), 28 deletions(-) + +diff --git a/drivers/clk/qcom/camcc-sm8250.c b/drivers/clk/qcom/camcc-sm8250.c +index 9b32c56a5bc5a..e29706d782870 100644 +--- a/drivers/clk/qcom/camcc-sm8250.c ++++ b/drivers/clk/qcom/camcc-sm8250.c +@@ -411,7 +411,7 @@ static struct clk_rcg2 cam_cc_bps_clk_src = { + .parent_data = cam_cc_parent_data_0, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -433,7 +433,7 @@ static struct clk_rcg2 cam_cc_camnoc_axi_clk_src = { + .parent_data = cam_cc_parent_data_0, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -454,7 +454,7 @@ static struct clk_rcg2 cam_cc_cci_0_clk_src = { + .parent_data = cam_cc_parent_data_0, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -469,7 +469,7 @@ static struct clk_rcg2 cam_cc_cci_1_clk_src = { + .parent_data = cam_cc_parent_data_0, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -490,7 +490,7 @@ static struct clk_rcg2 cam_cc_cphy_rx_clk_src = { + .parent_data = cam_cc_parent_data_0, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -511,7 +511,7 @@ static struct clk_rcg2 cam_cc_csi0phytimer_clk_src = { + .parent_data = cam_cc_parent_data_0, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -526,7 +526,7 @@ static struct clk_rcg2 cam_cc_csi1phytimer_clk_src = { + .parent_data = cam_cc_parent_data_0, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -556,7 +556,7 @@ static struct clk_rcg2 cam_cc_csi3phytimer_clk_src = { + .parent_data = cam_cc_parent_data_0, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -571,7 +571,7 @@ static struct clk_rcg2 cam_cc_csi4phytimer_clk_src = { + .parent_data = cam_cc_parent_data_0, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -586,7 +586,7 @@ static struct clk_rcg2 cam_cc_csi5phytimer_clk_src = { + .parent_data = cam_cc_parent_data_0, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -611,7 +611,7 @@ static struct clk_rcg2 cam_cc_fast_ahb_clk_src = { + .parent_data = cam_cc_parent_data_0, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -634,7 +634,7 @@ static struct clk_rcg2 cam_cc_fd_core_clk_src = { + .parent_data = cam_cc_parent_data_0, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -649,7 +649,7 @@ static struct clk_rcg2 cam_cc_icp_clk_src = { + .parent_data = cam_cc_parent_data_0, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -673,7 +673,7 @@ static struct clk_rcg2 cam_cc_ife_0_clk_src = { + .parent_data = cam_cc_parent_data_2, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_2), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -710,7 +710,7 @@ static struct clk_rcg2 cam_cc_ife_0_csid_clk_src = { + .parent_data = cam_cc_parent_data_0, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -734,7 +734,7 @@ static struct clk_rcg2 cam_cc_ife_1_clk_src = { + .parent_data = cam_cc_parent_data_3, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_3), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -749,7 +749,7 @@ static struct clk_rcg2 cam_cc_ife_1_csid_clk_src = { + .parent_data = cam_cc_parent_data_0, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -771,7 +771,7 @@ static struct clk_rcg2 cam_cc_ife_lite_clk_src = { + .parent_data = cam_cc_parent_data_0, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -786,7 +786,7 @@ static struct clk_rcg2 cam_cc_ife_lite_csid_clk_src = { + .parent_data = cam_cc_parent_data_0, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -810,7 +810,7 @@ static struct clk_rcg2 cam_cc_ipe_0_clk_src = { + .parent_data = cam_cc_parent_data_4, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_4), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -825,7 +825,7 @@ static struct clk_rcg2 cam_cc_jpeg_clk_src = { + .parent_data = cam_cc_parent_data_0, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -847,7 +847,7 @@ static struct clk_rcg2 cam_cc_mclk0_clk_src = { + .parent_data = cam_cc_parent_data_1, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_1), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -862,7 +862,7 @@ static struct clk_rcg2 cam_cc_mclk1_clk_src = { + .parent_data = cam_cc_parent_data_1, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_1), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -877,7 +877,7 @@ static struct clk_rcg2 cam_cc_mclk2_clk_src = { + .parent_data = cam_cc_parent_data_1, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_1), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -892,7 +892,7 @@ static struct clk_rcg2 cam_cc_mclk3_clk_src = { + .parent_data = cam_cc_parent_data_1, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_1), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -907,7 +907,7 @@ static struct clk_rcg2 cam_cc_mclk4_clk_src = { + .parent_data = cam_cc_parent_data_1, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_1), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -922,7 +922,7 @@ static struct clk_rcg2 cam_cc_mclk5_clk_src = { + .parent_data = cam_cc_parent_data_1, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_1), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -993,7 +993,7 @@ static struct clk_rcg2 cam_cc_slow_ahb_clk_src = { + .parent_data = cam_cc_parent_data_0, + .num_parents = ARRAY_SIZE(cam_cc_parent_data_0), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +-- +2.39.5 + diff --git a/queue-5.15/clocksource-drivers-timer-riscv-stop-stimecmp-when-c.patch b/queue-5.15/clocksource-drivers-timer-riscv-stop-stimecmp-when-c.patch new file mode 100644 index 0000000000..3260c7f9b2 --- /dev/null +++ b/queue-5.15/clocksource-drivers-timer-riscv-stop-stimecmp-when-c.patch @@ -0,0 +1,45 @@ +From d469d244ff224a69d98fe50b33ea259a662f6d9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Feb 2025 19:41:35 +0800 +Subject: clocksource/drivers/timer-riscv: Stop stimecmp when cpu hotplug + +From: Nick Hu + +[ Upstream commit 70c93b026ed07078e933583591aa9ca6701cd9da ] + +Stop the timer when the cpu is going to be offline otherwise the +timer interrupt may be pending while performing power-down. + +Suggested-by: Anup Patel +Link: https://lore.kernel.org/lkml/20240829033904.477200-3-nick.hu@sifive.com/T/#u +Signed-off-by: Nick Hu +Reviewed-by: Anup Patel +Acked-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20250219114135.27764-3-nick.hu@sifive.com +Signed-off-by: Alexandre Ghiti +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-riscv.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/clocksource/timer-riscv.c b/drivers/clocksource/timer-riscv.c +index c51c5ed15aa75..427c92dd048c4 100644 +--- a/drivers/clocksource/timer-riscv.c ++++ b/drivers/clocksource/timer-riscv.c +@@ -75,7 +75,13 @@ static int riscv_timer_starting_cpu(unsigned int cpu) + + static int riscv_timer_dying_cpu(unsigned int cpu) + { ++ /* ++ * Stop the timer when the cpu is going to be offline otherwise ++ * the timer interrupt may be pending while performing power-down. ++ */ ++ riscv_clock_event_stop(); + disable_percpu_irq(riscv_clock_event_irq); ++ + return 0; + } + +-- +2.39.5 + diff --git a/queue-5.15/clocksource-mips-gic-timer-enable-counter-when-cpus-.patch b/queue-5.15/clocksource-mips-gic-timer-enable-counter-when-cpus-.patch new file mode 100644 index 0000000000..fa4919f1cd --- /dev/null +++ b/queue-5.15/clocksource-mips-gic-timer-enable-counter-when-cpus-.patch @@ -0,0 +1,68 @@ +From b432c28c5fe0cd7cfede93526e446df3d6e79489 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jan 2025 13:32:47 +0100 +Subject: clocksource: mips-gic-timer: Enable counter when CPUs start +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Paul Burton + +[ Upstream commit 3128b0a2e0cf6e07aa78e5f8cf7dd9cd59dc8174 ] + +In multi-cluster MIPS I6500 systems there is a GIC in each cluster, +each with its own counter. When a cluster powers up the counter will +be stopped, with the COUNTSTOP bit set in the GIC_CONFIG register. + +In single cluster systems, it has been fine to clear COUNTSTOP once +in gic_clocksource_of_init() to start the counter. In multi-cluster +systems, this will only have started the counter in the boot cluster, +and any CPUs in other clusters will find their counter stopped which +will break the GIC clock_event_device. + +Resolve this by having CPUs clear the COUNTSTOP bit when they come +online, using the existing gic_starting_cpu() CPU hotplug callback. This +will allow CPUs in secondary clusters to ensure that the cluster's GIC +counter is running as expected. + +Signed-off-by: Paul Burton +Signed-off-by: Chao-ying Fu +Signed-off-by: Dragan Mladjenovic +Signed-off-by: Aleksandar Rikalo +Reviewed-by: Philippe Mathieu-Daudé +Tested-by: Serge Semin +Tested-by: Gregory CLEMENT +Acked-by: Daniel Lezcano +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + drivers/clocksource/mips-gic-timer.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/clocksource/mips-gic-timer.c b/drivers/clocksource/mips-gic-timer.c +index be4175f415ba5..1946691f6b322 100644 +--- a/drivers/clocksource/mips-gic-timer.c ++++ b/drivers/clocksource/mips-gic-timer.c +@@ -119,6 +119,9 @@ static void gic_update_frequency(void *data) + + static int gic_starting_cpu(unsigned int cpu) + { ++ /* Ensure the GIC counter is running */ ++ clear_gic_config(GIC_CONFIG_COUNTSTOP); ++ + gic_clockevent_cpu_init(cpu, this_cpu_ptr(&gic_clockevent_device)); + return 0; + } +@@ -253,9 +256,6 @@ static int __init gic_clocksource_of_init(struct device_node *node) + pr_warn("Unable to register clock notifier\n"); + } + +- /* And finally start the counter */ +- clear_gic_config(GIC_CONFIG_COUNTSTOP); +- + /* + * It's safe to use the MIPS GIC timer as a sched clock source only if + * its ticks are stable, which is true on either the platforms with +-- +2.39.5 + diff --git a/queue-5.15/cpufreq-tegra186-share-policy-per-cluster.patch b/queue-5.15/cpufreq-tegra186-share-policy-per-cluster.patch new file mode 100644 index 0000000000..c52d7883bf --- /dev/null +++ b/queue-5.15/cpufreq-tegra186-share-policy-per-cluster.patch @@ -0,0 +1,47 @@ +From 47cca9e222efd69a53edb52b23a23e3c748af22f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Mar 2025 00:28:48 -0500 +Subject: cpufreq: tegra186: Share policy per cluster + +From: Aaron Kling + +[ Upstream commit be4ae8c19492cd6d5de61ccb34ffb3f5ede5eec8 ] + +This functionally brings tegra186 in line with tegra210 and tegra194, +sharing a cpufreq policy between all cores in a cluster. + +Reviewed-by: Sumit Gupta +Acked-by: Thierry Reding +Signed-off-by: Aaron Kling +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/tegra186-cpufreq.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c +index 5d1943e787b0c..19597246f9ccb 100644 +--- a/drivers/cpufreq/tegra186-cpufreq.c ++++ b/drivers/cpufreq/tegra186-cpufreq.c +@@ -73,11 +73,18 @@ static int tegra186_cpufreq_init(struct cpufreq_policy *policy) + { + struct tegra186_cpufreq_data *data = cpufreq_get_driver_data(); + unsigned int cluster = data->cpus[policy->cpu].bpmp_cluster_id; ++ u32 cpu; + + policy->freq_table = data->clusters[cluster].table; + policy->cpuinfo.transition_latency = 300 * 1000; + policy->driver_data = NULL; + ++ /* set same policy for all cpus in a cluster */ ++ for (cpu = 0; cpu < ARRAY_SIZE(tegra186_cpus); cpu++) { ++ if (data->cpus[cpu].bpmp_cluster_id == cluster) ++ cpumask_set_cpu(cpu, policy->cpus); ++ } ++ + return 0; + } + +-- +2.39.5 + diff --git a/queue-5.15/cpuidle-menu-avoid-discarding-useful-information.patch b/queue-5.15/cpuidle-menu-avoid-discarding-useful-information.patch new file mode 100644 index 0000000000..e9a2e44c19 --- /dev/null +++ b/queue-5.15/cpuidle-menu-avoid-discarding-useful-information.patch @@ -0,0 +1,65 @@ +From 1eb15468619bbd5fa90e65f23bb93829bff7aaab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Feb 2025 15:29:05 +0100 +Subject: cpuidle: menu: Avoid discarding useful information + +From: Rafael J. Wysocki + +[ Upstream commit 85975daeaa4d6ec560bfcd354fc9c08ad7f38888 ] + +When giving up on making a high-confidence prediction, +get_typical_interval() always returns UINT_MAX which means that the +next idle interval prediction will be based entirely on the time till +the next timer. However, the information represented by the most +recent intervals may not be completely useless in those cases. + +Namely, the largest recent idle interval is an upper bound on the +recently observed idle duration, so it is reasonable to assume that +the next idle duration is unlikely to exceed it. Moreover, this is +still true after eliminating the suspected outliers if the sample +set still under consideration is at least as large as 50% of the +maximum sample set size. + +Accordingly, make get_typical_interval() return the current maximum +recent interval value in that case instead of UINT_MAX. + +Signed-off-by: Rafael J. Wysocki +Reported-by: Artem Bityutskiy +Tested-by: Artem Bityutskiy +Reviewed-by: Christian Loehle +Tested-by: Christian Loehle +Tested-by: Aboorva Devarajan +Link: https://patch.msgid.link/7770672.EvYhyI6sBW@rjwysocki.net +Signed-off-by: Sasha Levin +--- + drivers/cpuidle/governors/menu.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c +index 2e5670446991f..e1e2721beb75b 100644 +--- a/drivers/cpuidle/governors/menu.c ++++ b/drivers/cpuidle/governors/menu.c +@@ -249,8 +249,19 @@ static unsigned int get_typical_interval(struct menu_device *data, + * This can deal with workloads that have long pauses interspersed + * with sporadic activity with a bunch of short pauses. + */ +- if ((divisor * 4) <= INTERVALS * 3) ++ if (divisor * 4 <= INTERVALS * 3) { ++ /* ++ * If there are sufficiently many data points still under ++ * consideration after the outliers have been eliminated, ++ * returning without a prediction would be a mistake because it ++ * is likely that the next interval will not exceed the current ++ * maximum, so return the latter in that case. ++ */ ++ if (divisor >= INTERVALS / 2) ++ return max; ++ + return UINT_MAX; ++ } + + thresh = max - 1; + goto again; +-- +2.39.5 + diff --git a/queue-5.15/crypto-lzo-fix-compression-buffer-overrun.patch b/queue-5.15/crypto-lzo-fix-compression-buffer-overrun.patch new file mode 100644 index 0000000000..a05c31f7b7 --- /dev/null +++ b/queue-5.15/crypto-lzo-fix-compression-buffer-overrun.patch @@ -0,0 +1,374 @@ +From a3c31bd12e8eab70b80c32b91fd01531767dd9d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Feb 2025 17:04:46 +0800 +Subject: crypto: lzo - Fix compression buffer overrun + +From: Herbert Xu + +[ Upstream commit cc47f07234f72cbd8e2c973cdbf2a6730660a463 ] + +Unlike the decompression code, the compression code in LZO never +checked for output overruns. It instead assumes that the caller +always provides enough buffer space, disregarding the buffer length +provided by the caller. + +Add a safe compression interface that checks for the end of buffer +before each write. Use the safe interface in crypto/lzo. + +Signed-off-by: Herbert Xu +Reviewed-by: David Sterba +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/lzo-rle.c | 2 +- + crypto/lzo.c | 2 +- + include/linux/lzo.h | 8 +++ + lib/lzo/Makefile | 2 +- + lib/lzo/lzo1x_compress.c | 102 +++++++++++++++++++++++++--------- + lib/lzo/lzo1x_compress_safe.c | 18 ++++++ + 6 files changed, 106 insertions(+), 28 deletions(-) + create mode 100644 lib/lzo/lzo1x_compress_safe.c + +diff --git a/crypto/lzo-rle.c b/crypto/lzo-rle.c +index 0631d975bfac1..0abc2d87f0420 100644 +--- a/crypto/lzo-rle.c ++++ b/crypto/lzo-rle.c +@@ -55,7 +55,7 @@ static int __lzorle_compress(const u8 *src, unsigned int slen, + size_t tmp_len = *dlen; /* size_t(ulong) <-> uint on 64 bit */ + int err; + +- err = lzorle1x_1_compress(src, slen, dst, &tmp_len, ctx); ++ err = lzorle1x_1_compress_safe(src, slen, dst, &tmp_len, ctx); + + if (err != LZO_E_OK) + return -EINVAL; +diff --git a/crypto/lzo.c b/crypto/lzo.c +index ebda132dd22bf..8338851c7406a 100644 +--- a/crypto/lzo.c ++++ b/crypto/lzo.c +@@ -55,7 +55,7 @@ static int __lzo_compress(const u8 *src, unsigned int slen, + size_t tmp_len = *dlen; /* size_t(ulong) <-> uint on 64 bit */ + int err; + +- err = lzo1x_1_compress(src, slen, dst, &tmp_len, ctx); ++ err = lzo1x_1_compress_safe(src, slen, dst, &tmp_len, ctx); + + if (err != LZO_E_OK) + return -EINVAL; +diff --git a/include/linux/lzo.h b/include/linux/lzo.h +index e95c7d1092b28..4d30e3624acd2 100644 +--- a/include/linux/lzo.h ++++ b/include/linux/lzo.h +@@ -24,10 +24,18 @@ + int lzo1x_1_compress(const unsigned char *src, size_t src_len, + unsigned char *dst, size_t *dst_len, void *wrkmem); + ++/* Same as above but does not write more than dst_len to dst. */ ++int lzo1x_1_compress_safe(const unsigned char *src, size_t src_len, ++ unsigned char *dst, size_t *dst_len, void *wrkmem); ++ + /* This requires 'wrkmem' of size LZO1X_1_MEM_COMPRESS */ + int lzorle1x_1_compress(const unsigned char *src, size_t src_len, + unsigned char *dst, size_t *dst_len, void *wrkmem); + ++/* Same as above but does not write more than dst_len to dst. */ ++int lzorle1x_1_compress_safe(const unsigned char *src, size_t src_len, ++ unsigned char *dst, size_t *dst_len, void *wrkmem); ++ + /* safe decompression with overrun testing */ + int lzo1x_decompress_safe(const unsigned char *src, size_t src_len, + unsigned char *dst, size_t *dst_len); +diff --git a/lib/lzo/Makefile b/lib/lzo/Makefile +index 2f58fafbbdddc..fc7b2b7ef4b20 100644 +--- a/lib/lzo/Makefile ++++ b/lib/lzo/Makefile +@@ -1,5 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0-only +-lzo_compress-objs := lzo1x_compress.o ++lzo_compress-objs := lzo1x_compress.o lzo1x_compress_safe.o + lzo_decompress-objs := lzo1x_decompress_safe.o + + obj-$(CONFIG_LZO_COMPRESS) += lzo_compress.o +diff --git a/lib/lzo/lzo1x_compress.c b/lib/lzo/lzo1x_compress.c +index 76758e9296ba6..469c143f75852 100644 +--- a/lib/lzo/lzo1x_compress.c ++++ b/lib/lzo/lzo1x_compress.c +@@ -18,11 +18,22 @@ + #include + #include "lzodefs.h" + +-static noinline size_t +-lzo1x_1_do_compress(const unsigned char *in, size_t in_len, +- unsigned char *out, size_t *out_len, +- size_t ti, void *wrkmem, signed char *state_offset, +- const unsigned char bitstream_version) ++#undef LZO_UNSAFE ++ ++#ifndef LZO_SAFE ++#define LZO_UNSAFE 1 ++#define LZO_SAFE(name) name ++#define HAVE_OP(x) 1 ++#endif ++ ++#define NEED_OP(x) if (!HAVE_OP(x)) goto output_overrun ++ ++static noinline int ++LZO_SAFE(lzo1x_1_do_compress)(const unsigned char *in, size_t in_len, ++ unsigned char **out, unsigned char *op_end, ++ size_t *tp, void *wrkmem, ++ signed char *state_offset, ++ const unsigned char bitstream_version) + { + const unsigned char *ip; + unsigned char *op; +@@ -30,8 +41,9 @@ lzo1x_1_do_compress(const unsigned char *in, size_t in_len, + const unsigned char * const ip_end = in + in_len - 20; + const unsigned char *ii; + lzo_dict_t * const dict = (lzo_dict_t *) wrkmem; ++ size_t ti = *tp; + +- op = out; ++ op = *out; + ip = in; + ii = ip; + ip += ti < 4 ? 4 - ti : 0; +@@ -118,25 +130,32 @@ lzo1x_1_do_compress(const unsigned char *in, size_t in_len, + if (t != 0) { + if (t <= 3) { + op[*state_offset] |= t; ++ NEED_OP(4); + COPY4(op, ii); + op += t; + } else if (t <= 16) { ++ NEED_OP(17); + *op++ = (t - 3); + COPY8(op, ii); + COPY8(op + 8, ii + 8); + op += t; + } else { + if (t <= 18) { ++ NEED_OP(1); + *op++ = (t - 3); + } else { + size_t tt = t - 18; ++ NEED_OP(1); + *op++ = 0; + while (unlikely(tt > 255)) { + tt -= 255; ++ NEED_OP(1); + *op++ = 0; + } ++ NEED_OP(1); + *op++ = tt; + } ++ NEED_OP(t); + do { + COPY8(op, ii); + COPY8(op + 8, ii + 8); +@@ -153,6 +172,7 @@ lzo1x_1_do_compress(const unsigned char *in, size_t in_len, + if (unlikely(run_length)) { + ip += run_length; + run_length -= MIN_ZERO_RUN_LENGTH; ++ NEED_OP(4); + put_unaligned_le32((run_length << 21) | 0xfffc18 + | (run_length & 0x7), op); + op += 4; +@@ -245,10 +265,12 @@ lzo1x_1_do_compress(const unsigned char *in, size_t in_len, + ip += m_len; + if (m_len <= M2_MAX_LEN && m_off <= M2_MAX_OFFSET) { + m_off -= 1; ++ NEED_OP(2); + *op++ = (((m_len - 1) << 5) | ((m_off & 7) << 2)); + *op++ = (m_off >> 3); + } else if (m_off <= M3_MAX_OFFSET) { + m_off -= 1; ++ NEED_OP(1); + if (m_len <= M3_MAX_LEN) + *op++ = (M3_MARKER | (m_len - 2)); + else { +@@ -256,14 +278,18 @@ lzo1x_1_do_compress(const unsigned char *in, size_t in_len, + *op++ = M3_MARKER | 0; + while (unlikely(m_len > 255)) { + m_len -= 255; ++ NEED_OP(1); + *op++ = 0; + } ++ NEED_OP(1); + *op++ = (m_len); + } ++ NEED_OP(2); + *op++ = (m_off << 2); + *op++ = (m_off >> 6); + } else { + m_off -= 0x4000; ++ NEED_OP(1); + if (m_len <= M4_MAX_LEN) + *op++ = (M4_MARKER | ((m_off >> 11) & 8) + | (m_len - 2)); +@@ -284,11 +310,14 @@ lzo1x_1_do_compress(const unsigned char *in, size_t in_len, + m_len -= M4_MAX_LEN; + *op++ = (M4_MARKER | ((m_off >> 11) & 8)); + while (unlikely(m_len > 255)) { ++ NEED_OP(1); + m_len -= 255; + *op++ = 0; + } ++ NEED_OP(1); + *op++ = (m_len); + } ++ NEED_OP(2); + *op++ = (m_off << 2); + *op++ = (m_off >> 6); + } +@@ -297,14 +326,20 @@ lzo1x_1_do_compress(const unsigned char *in, size_t in_len, + ii = ip; + goto next; + } +- *out_len = op - out; +- return in_end - (ii - ti); ++ *out = op; ++ *tp = in_end - (ii - ti); ++ return LZO_E_OK; ++ ++output_overrun: ++ return LZO_E_OUTPUT_OVERRUN; + } + +-static int lzogeneric1x_1_compress(const unsigned char *in, size_t in_len, +- unsigned char *out, size_t *out_len, +- void *wrkmem, const unsigned char bitstream_version) ++static int LZO_SAFE(lzogeneric1x_1_compress)( ++ const unsigned char *in, size_t in_len, ++ unsigned char *out, size_t *out_len, ++ void *wrkmem, const unsigned char bitstream_version) + { ++ unsigned char * const op_end = out + *out_len; + const unsigned char *ip = in; + unsigned char *op = out; + unsigned char *data_start; +@@ -328,14 +363,18 @@ static int lzogeneric1x_1_compress(const unsigned char *in, size_t in_len, + while (l > 20) { + size_t ll = l <= (m4_max_offset + 1) ? l : (m4_max_offset + 1); + uintptr_t ll_end = (uintptr_t) ip + ll; ++ int err; ++ + if ((ll_end + ((t + ll) >> 5)) <= ll_end) + break; + BUILD_BUG_ON(D_SIZE * sizeof(lzo_dict_t) > LZO1X_1_MEM_COMPRESS); + memset(wrkmem, 0, D_SIZE * sizeof(lzo_dict_t)); +- t = lzo1x_1_do_compress(ip, ll, op, out_len, t, wrkmem, +- &state_offset, bitstream_version); ++ err = LZO_SAFE(lzo1x_1_do_compress)( ++ ip, ll, &op, op_end, &t, wrkmem, ++ &state_offset, bitstream_version); ++ if (err != LZO_E_OK) ++ return err; + ip += ll; +- op += *out_len; + l -= ll; + } + t += l; +@@ -344,20 +383,26 @@ static int lzogeneric1x_1_compress(const unsigned char *in, size_t in_len, + const unsigned char *ii = in + in_len - t; + + if (op == data_start && t <= 238) { ++ NEED_OP(1); + *op++ = (17 + t); + } else if (t <= 3) { + op[state_offset] |= t; + } else if (t <= 18) { ++ NEED_OP(1); + *op++ = (t - 3); + } else { + size_t tt = t - 18; ++ NEED_OP(1); + *op++ = 0; + while (tt > 255) { + tt -= 255; ++ NEED_OP(1); + *op++ = 0; + } ++ NEED_OP(1); + *op++ = tt; + } ++ NEED_OP(t); + if (t >= 16) do { + COPY8(op, ii); + COPY8(op + 8, ii + 8); +@@ -370,31 +415,38 @@ static int lzogeneric1x_1_compress(const unsigned char *in, size_t in_len, + } while (--t > 0); + } + ++ NEED_OP(3); + *op++ = M4_MARKER | 1; + *op++ = 0; + *op++ = 0; + + *out_len = op - out; + return LZO_E_OK; ++ ++output_overrun: ++ return LZO_E_OUTPUT_OVERRUN; + } + +-int lzo1x_1_compress(const unsigned char *in, size_t in_len, +- unsigned char *out, size_t *out_len, +- void *wrkmem) ++int LZO_SAFE(lzo1x_1_compress)(const unsigned char *in, size_t in_len, ++ unsigned char *out, size_t *out_len, ++ void *wrkmem) + { +- return lzogeneric1x_1_compress(in, in_len, out, out_len, wrkmem, 0); ++ return LZO_SAFE(lzogeneric1x_1_compress)( ++ in, in_len, out, out_len, wrkmem, 0); + } + +-int lzorle1x_1_compress(const unsigned char *in, size_t in_len, +- unsigned char *out, size_t *out_len, +- void *wrkmem) ++int LZO_SAFE(lzorle1x_1_compress)(const unsigned char *in, size_t in_len, ++ unsigned char *out, size_t *out_len, ++ void *wrkmem) + { +- return lzogeneric1x_1_compress(in, in_len, out, out_len, +- wrkmem, LZO_VERSION); ++ return LZO_SAFE(lzogeneric1x_1_compress)( ++ in, in_len, out, out_len, wrkmem, LZO_VERSION); + } + +-EXPORT_SYMBOL_GPL(lzo1x_1_compress); +-EXPORT_SYMBOL_GPL(lzorle1x_1_compress); ++EXPORT_SYMBOL_GPL(LZO_SAFE(lzo1x_1_compress)); ++EXPORT_SYMBOL_GPL(LZO_SAFE(lzorle1x_1_compress)); + ++#ifndef LZO_UNSAFE + MODULE_LICENSE("GPL"); + MODULE_DESCRIPTION("LZO1X-1 Compressor"); ++#endif +diff --git a/lib/lzo/lzo1x_compress_safe.c b/lib/lzo/lzo1x_compress_safe.c +new file mode 100644 +index 0000000000000..371c9f8494928 +--- /dev/null ++++ b/lib/lzo/lzo1x_compress_safe.c +@@ -0,0 +1,18 @@ ++// SPDX-License-Identifier: GPL-2.0-only ++/* ++ * LZO1X Compressor from LZO ++ * ++ * Copyright (C) 1996-2012 Markus F.X.J. Oberhumer ++ * ++ * The full LZO package can be found at: ++ * http://www.oberhumer.com/opensource/lzo/ ++ * ++ * Changed for Linux kernel use by: ++ * Nitin Gupta ++ * Richard Purdie ++ */ ++ ++#define LZO_SAFE(name) name##_safe ++#define HAVE_OP(x) ((size_t)(op_end - op) >= (size_t)(x)) ++ ++#include "lzo1x_compress.c" +-- +2.39.5 + diff --git a/queue-5.15/crypto-octeontx2-suppress-auth-failure-screaming-due.patch b/queue-5.15/crypto-octeontx2-suppress-auth-failure-screaming-due.patch new file mode 100644 index 0000000000..ce569e15cc --- /dev/null +++ b/queue-5.15/crypto-octeontx2-suppress-auth-failure-screaming-due.patch @@ -0,0 +1,43 @@ +From db3b3e9095ec8a69077ea630e63a4e982ebfcdcd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Mar 2025 13:27:05 +0530 +Subject: crypto: octeontx2 - suppress auth failure screaming due to negative + tests + +From: Shashank Gupta + +[ Upstream commit 64b7871522a4cba99d092e1c849d6f9092868aaa ] + +This patch addresses an issue where authentication failures were being +erroneously reported due to negative test failures in the "ccm(aes)" +selftest. +pr_debug suppress unnecessary screaming of these tests. + +Signed-off-by: Shashank Gupta +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/marvell/octeontx2/otx2_cptvf_reqmgr.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptvf_reqmgr.c b/drivers/crypto/marvell/octeontx2/otx2_cptvf_reqmgr.c +index 811ded72ce5fb..798bb40fed68d 100644 +--- a/drivers/crypto/marvell/octeontx2/otx2_cptvf_reqmgr.c ++++ b/drivers/crypto/marvell/octeontx2/otx2_cptvf_reqmgr.c +@@ -410,9 +410,10 @@ static int cpt_process_ccode(struct otx2_cptlfs_info *lfs, + break; + } + +- dev_err(&pdev->dev, +- "Request failed with software error code 0x%x\n", +- cpt_status->s.uc_compcode); ++ pr_debug("Request failed with software error code 0x%x: algo = %s driver = %s\n", ++ cpt_status->s.uc_compcode, ++ info->req->areq->tfm->__crt_alg->cra_name, ++ info->req->areq->tfm->__crt_alg->cra_driver_name); + otx2_cpt_dump_sg_list(pdev, info->req); + break; + } +-- +2.39.5 + diff --git a/queue-5.15/dlm-make-tcp-still-work-in-multi-link-env.patch b/queue-5.15/dlm-make-tcp-still-work-in-multi-link-env.patch new file mode 100644 index 0000000000..15d7241f06 --- /dev/null +++ b/queue-5.15/dlm-make-tcp-still-work-in-multi-link-env.patch @@ -0,0 +1,37 @@ +From 97de25c6d9b3fd52ca8c9c2d08196c5874bce59b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Mar 2025 15:36:21 +0800 +Subject: dlm: make tcp still work in multi-link env + +From: Heming Zhao + +[ Upstream commit 03d2b62208a336a3bb984b9465ef6d89a046ea22 ] + +This patch bypasses multi-link errors in TCP mode, allowing dlm +to operate on the first tcp link. + +Signed-off-by: Heming Zhao +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/lowcomms.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c +index 1eb95ba7e7772..5b53425554077 100644 +--- a/fs/dlm/lowcomms.c ++++ b/fs/dlm/lowcomms.c +@@ -1852,8 +1852,8 @@ static int dlm_tcp_listen_validate(void) + { + /* We don't support multi-homed hosts */ + if (dlm_local_count > 1) { +- log_print("TCP protocol can't handle multi-homed hosts, try SCTP"); +- return -EINVAL; ++ log_print("Detect multi-homed hosts but use only the first IP address."); ++ log_print("Try SCTP, if you want to enable multi-link."); + } + + return 0; +-- +2.39.5 + diff --git a/queue-5.15/dm-cache-prevent-bug_on-by-blocking-retries-on-faile.patch b/queue-5.15/dm-cache-prevent-bug_on-by-blocking-retries-on-faile.patch new file mode 100644 index 0000000000..b08bf0a1e0 --- /dev/null +++ b/queue-5.15/dm-cache-prevent-bug_on-by-blocking-retries-on-faile.patch @@ -0,0 +1,121 @@ +From b6acf797f2cce56a238c8cb8b67c3ff19de225af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Mar 2025 16:41:50 +0800 +Subject: dm cache: prevent BUG_ON by blocking retries on failed device resumes + +From: Ming-Hung Tsai + +[ Upstream commit 5da692e2262b8f81993baa9592f57d12c2703dea ] + +A cache device failing to resume due to mapping errors should not be +retried, as the failure leaves a partially initialized policy object. +Repeating the resume operation risks triggering BUG_ON when reloading +cache mappings into the incomplete policy object. + +Reproduce steps: + +1. create a cache metadata consisting of 512 or more cache blocks, + with some mappings stored in the first array block of the mapping + array. Here we use cache_restore v1.0 to build the metadata. + +cat <> cmeta.xml + + + + + +EOF +dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" +cache_restore -i cmeta.xml -o /dev/mapper/cmeta --metadata-version=2 +dmsetup remove cmeta + +2. wipe the second array block of the mapping array to simulate + data degradations. + +mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \ +2>/dev/null | hexdump -e '1/8 "%u\n"') +ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \ +2>/dev/null | hexdump -e '1/8 "%u\n"') +dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock + +3. try bringing up the cache device. The resume is expected to fail + due to the broken array block. + +dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" +dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" +dmsetup create corig --table "0 524288 linear /dev/sdc 262144" +dmsetup create cache --notable +dmsetup load cache --table "0 524288 cache /dev/mapper/cmeta \ +/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" +dmsetup resume cache + +4. try resuming the cache again. An unexpected BUG_ON is triggered + while loading cache mappings. + +dmsetup resume cache + +Kernel logs: + +(snip) +------------[ cut here ]------------ +kernel BUG at drivers/md/dm-cache-policy-smq.c:752! +Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI +CPU: 0 UID: 0 PID: 332 Comm: dmsetup Not tainted 6.13.4 #3 +RIP: 0010:smq_load_mapping+0x3e5/0x570 + +Fix by disallowing resume operations for devices that failed the +initial attempt. + +Signed-off-by: Ming-Hung Tsai +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-cache-target.c | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c +index 1864e8180be89..1660d4fec7511 100644 +--- a/drivers/md/dm-cache-target.c ++++ b/drivers/md/dm-cache-target.c +@@ -2883,6 +2883,27 @@ static dm_cblock_t get_cache_dev_size(struct cache *cache) + return to_cblock(size); + } + ++static bool can_resume(struct cache *cache) ++{ ++ /* ++ * Disallow retrying the resume operation for devices that failed the ++ * first resume attempt, as the failure leaves the policy object partially ++ * initialized. Retrying could trigger BUG_ON when loading cache mappings ++ * into the incomplete policy object. ++ */ ++ if (cache->sized && !cache->loaded_mappings) { ++ if (get_cache_mode(cache) != CM_WRITE) ++ DMERR("%s: unable to resume a failed-loaded cache, please check metadata.", ++ cache_device_name(cache)); ++ else ++ DMERR("%s: unable to resume cache due to missing proper cache table reload", ++ cache_device_name(cache)); ++ return false; ++ } ++ ++ return true; ++} ++ + static bool can_resize(struct cache *cache, dm_cblock_t new_size) + { + if (from_cblock(new_size) > from_cblock(cache->cache_size)) { +@@ -2931,6 +2952,9 @@ static int cache_preresume(struct dm_target *ti) + struct cache *cache = ti->private; + dm_cblock_t csize = get_cache_dev_size(cache); + ++ if (!can_resume(cache)) ++ return -EINVAL; ++ + /* + * Check to see if the cache has resized. + */ +-- +2.39.5 + diff --git a/queue-5.15/dm-restrict-dm-device-size-to-2-63-512-bytes.patch b/queue-5.15/dm-restrict-dm-device-size-to-2-63-512-bytes.patch new file mode 100644 index 0000000000..30f8efbc3a --- /dev/null +++ b/queue-5.15/dm-restrict-dm-device-size-to-2-63-512-bytes.patch @@ -0,0 +1,39 @@ +From a5707dc33e932ac300b423dbaed95b711d5ca527 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Mar 2025 13:51:32 +0100 +Subject: dm: restrict dm device size to 2^63-512 bytes + +From: Mikulas Patocka + +[ Upstream commit 45fc728515c14f53f6205789de5bfd72a95af3b8 ] + +The devices with size >= 2^63 bytes can't be used reliably by userspace +because the type off_t is a signed 64-bit integer. + +Therefore, we limit the maximum size of a device mapper device to +2^63-512 bytes. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-table.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c +index 5a66be3b2a63f..0f815bcf751f1 100644 +--- a/drivers/md/dm-table.c ++++ b/drivers/md/dm-table.c +@@ -661,6 +661,10 @@ int dm_table_add_target(struct dm_table *t, const char *type, + DMERR("%s: zero-length target", dm_device_name(t->md)); + return -EINVAL; + } ++ if (start + len < start || start + len > LLONG_MAX >> SECTOR_SHIFT) { ++ DMERR("%s: too large device", dm_device_name(t->md)); ++ return -EINVAL; ++ } + + tgt->type = dm_get_target_type(type); + if (!tgt->type) { +-- +2.39.5 + diff --git a/queue-5.15/dma-mapping-avoid-potential-unused-data-compilation-.patch b/queue-5.15/dma-mapping-avoid-potential-unused-data-compilation-.patch new file mode 100644 index 0000000000..90f085a534 --- /dev/null +++ b/queue-5.15/dma-mapping-avoid-potential-unused-data-compilation-.patch @@ -0,0 +1,50 @@ +From 4595ab839a598877269bc694206b1661f0904aab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Apr 2025 09:56:59 +0200 +Subject: dma-mapping: avoid potential unused data compilation warning + +From: Marek Szyprowski + +[ Upstream commit c9b19ea63036fc537a69265acea1b18dabd1cbd3 ] + +When CONFIG_NEED_DMA_MAP_STATE is not defined, dma-mapping clients might +report unused data compilation warnings for dma_unmap_*() calls +arguments. Redefine macros for those calls to let compiler to notice that +it is okay when the provided arguments are not used. + +Reported-by: Andy Shevchenko +Suggested-by: Jakub Kicinski +Signed-off-by: Marek Szyprowski +Tested-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20250415075659.428549-1-m.szyprowski@samsung.com +Signed-off-by: Sasha Levin +--- + include/linux/dma-mapping.h | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h +index fe3849434b2a2..d7b91f82b0dce 100644 +--- a/include/linux/dma-mapping.h ++++ b/include/linux/dma-mapping.h +@@ -595,10 +595,14 @@ static inline int dma_mmap_wc(struct device *dev, + #else + #define DEFINE_DMA_UNMAP_ADDR(ADDR_NAME) + #define DEFINE_DMA_UNMAP_LEN(LEN_NAME) +-#define dma_unmap_addr(PTR, ADDR_NAME) (0) +-#define dma_unmap_addr_set(PTR, ADDR_NAME, VAL) do { } while (0) +-#define dma_unmap_len(PTR, LEN_NAME) (0) +-#define dma_unmap_len_set(PTR, LEN_NAME, VAL) do { } while (0) ++#define dma_unmap_addr(PTR, ADDR_NAME) \ ++ ({ typeof(PTR) __p __maybe_unused = PTR; 0; }) ++#define dma_unmap_addr_set(PTR, ADDR_NAME, VAL) \ ++ do { typeof(PTR) __p __maybe_unused = PTR; } while (0) ++#define dma_unmap_len(PTR, LEN_NAME) \ ++ ({ typeof(PTR) __p __maybe_unused = PTR; 0; }) ++#define dma_unmap_len_set(PTR, LEN_NAME, VAL) \ ++ do { typeof(PTR) __p __maybe_unused = PTR; } while (0) + #endif + + #endif /* _LINUX_DMA_MAPPING_H */ +-- +2.39.5 + diff --git a/queue-5.15/dql-fix-dql-limit-value-when-reset.patch b/queue-5.15/dql-fix-dql-limit-value-when-reset.patch new file mode 100644 index 0000000000..c5703421bf --- /dev/null +++ b/queue-5.15/dql-fix-dql-limit-value-when-reset.patch @@ -0,0 +1,46 @@ +From a3de51229028788ecb5b398be6ab7ce1ba3662dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Mar 2025 16:57:51 +0800 +Subject: dql: Fix dql->limit value when reset. + +From: Jing Su + +[ Upstream commit 3a17f23f7c36bac3a3584aaf97d3e3e0b2790396 ] + +Executing dql_reset after setting a non-zero value for limit_min can +lead to an unreasonable situation where dql->limit is less than +dql->limit_min. + +For instance, after setting +/sys/class/net/eth*/queues/tx-0/byte_queue_limits/limit_min, +an ifconfig down/up operation might cause the ethernet driver to call +netdev_tx_reset_queue, which in turn invokes dql_reset. + +In this case, dql->limit is reset to 0 while dql->limit_min remains +non-zero value, which is unexpected. The limit should always be +greater than or equal to limit_min. + +Signed-off-by: Jing Su +Link: https://patch.msgid.link/Z9qHD1s/NEuQBdgH@pilot-ThinkCentre-M930t-N000 +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + lib/dynamic_queue_limits.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/dynamic_queue_limits.c b/lib/dynamic_queue_limits.c +index fde0aa2441480..a75a9ca46b594 100644 +--- a/lib/dynamic_queue_limits.c ++++ b/lib/dynamic_queue_limits.c +@@ -116,7 +116,7 @@ EXPORT_SYMBOL(dql_completed); + void dql_reset(struct dql *dql) + { + /* Reset all dynamic values */ +- dql->limit = 0; ++ dql->limit = dql->min_limit; + dql->num_queued = 0; + dql->num_completed = 0; + dql->last_obj_cnt = 0; +-- +2.39.5 + diff --git a/queue-5.15/drm-add-valid-clones-check.patch b/queue-5.15/drm-add-valid-clones-check.patch new file mode 100644 index 0000000000..dd7edc6ea8 --- /dev/null +++ b/queue-5.15/drm-add-valid-clones-check.patch @@ -0,0 +1,70 @@ +From eefe782c7382651dec454485286847ecd8913ac4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Dec 2024 16:43:14 -0800 +Subject: drm: Add valid clones check + +From: Jessica Zhang + +[ Upstream commit 41b4b11da02157c7474caf41d56baae0e941d01a ] + +Check that all encoders attached to a given CRTC are valid +possible_clones of each other. + +Signed-off-by: Jessica Zhang +Reviewed-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20241216-concurrent-wb-v4-3-fe220297a7f0@quicinc.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_atomic_helper.c | 28 ++++++++++++++++++++++++++++ + 1 file changed, 28 insertions(+) + +diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c +index bd01d925769db..db3c58013c00d 100644 +--- a/drivers/gpu/drm/drm_atomic_helper.c ++++ b/drivers/gpu/drm/drm_atomic_helper.c +@@ -563,6 +563,30 @@ mode_valid(struct drm_atomic_state *state) + return 0; + } + ++static int drm_atomic_check_valid_clones(struct drm_atomic_state *state, ++ struct drm_crtc *crtc) ++{ ++ struct drm_encoder *drm_enc; ++ struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state, ++ crtc); ++ ++ drm_for_each_encoder_mask(drm_enc, crtc->dev, crtc_state->encoder_mask) { ++ if (!drm_enc->possible_clones) { ++ DRM_DEBUG("enc%d possible_clones is 0\n", drm_enc->base.id); ++ continue; ++ } ++ ++ if ((crtc_state->encoder_mask & drm_enc->possible_clones) != ++ crtc_state->encoder_mask) { ++ DRM_DEBUG("crtc%d failed valid clone check for mask 0x%x\n", ++ crtc->base.id, crtc_state->encoder_mask); ++ return -EINVAL; ++ } ++ } ++ ++ return 0; ++} ++ + /** + * drm_atomic_helper_check_modeset - validate state object for modeset changes + * @dev: DRM device +@@ -729,6 +753,10 @@ drm_atomic_helper_check_modeset(struct drm_device *dev, + ret = drm_atomic_add_affected_planes(state, crtc); + if (ret != 0) + return ret; ++ ++ ret = drm_atomic_check_valid_clones(state, crtc); ++ if (ret != 0) ++ return ret; + } + + /* +-- +2.39.5 + diff --git a/queue-5.15/drm-amd-display-handle-max_downscale_src_width-fail-.patch b/queue-5.15/drm-amd-display-handle-max_downscale_src_width-fail-.patch new file mode 100644 index 0000000000..8ca0efda8b --- /dev/null +++ b/queue-5.15/drm-amd-display-handle-max_downscale_src_width-fail-.patch @@ -0,0 +1,59 @@ +From d40434b82fa84f065d5732a65adf48a3180d81d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Feb 2025 15:17:56 -0500 +Subject: drm/amd/display: handle max_downscale_src_width fail check + +From: Yihan Zhu + +[ Upstream commit 02a940da2ccc0cc0299811379580852b405a0ea2 ] + +[WHY] +If max_downscale_src_width check fails, we exit early from TAP calculation and left a NULL +value to the scaling data structure to cause the zero divide in the DML validation. + +[HOW] +Call set default TAP calculation before early exit in get_optimal_number_of_taps due to +max downscale limit exceed. + +Reviewed-by: Samson Tam +Signed-off-by: Yihan Zhu +Signed-off-by: Zaeem Mohamed +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c +index 0601c17426af2..27932a32057e3 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c +@@ -386,11 +386,6 @@ bool dpp3_get_optimal_number_of_taps( + int min_taps_y, min_taps_c; + enum lb_memory_config lb_config; + +- if (scl_data->viewport.width > scl_data->h_active && +- dpp->ctx->dc->debug.max_downscale_src_width != 0 && +- scl_data->viewport.width > dpp->ctx->dc->debug.max_downscale_src_width) +- return false; +- + /* + * Set default taps if none are provided + * From programming guide: taps = min{ ceil(2*H_RATIO,1), 8} for downscaling +@@ -428,6 +423,12 @@ bool dpp3_get_optimal_number_of_taps( + else + scl_data->taps.h_taps_c = in_taps->h_taps_c; + ++ // Avoid null data in the scl data with this early return, proceed non-adaptive calcualtion first ++ if (scl_data->viewport.width > scl_data->h_active && ++ dpp->ctx->dc->debug.max_downscale_src_width != 0 && ++ scl_data->viewport.width > dpp->ctx->dc->debug.max_downscale_src_width) ++ return false; ++ + /*Ensure we can support the requested number of vtaps*/ + min_taps_y = dc_fixpt_ceil(scl_data->ratios.vert); + min_taps_c = dc_fixpt_ceil(scl_data->ratios.vert_c); +-- +2.39.5 + diff --git a/queue-5.15/drm-amd-display-initial-psr_version-with-correct-set.patch b/queue-5.15/drm-amd-display-initial-psr_version-with-correct-set.patch new file mode 100644 index 0000000000..e2139b163a --- /dev/null +++ b/queue-5.15/drm-amd-display-initial-psr_version-with-correct-set.patch @@ -0,0 +1,40 @@ +From 838ba476ccb9b8797600fa15b74b0de6019cce64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 14:22:31 +0800 +Subject: drm/amd/display: Initial psr_version with correct setting + +From: Tom Chung + +[ Upstream commit d8c782cac5007e68e7484d420168f12d3490def6 ] + +[Why & How] +The initial setting for psr_version is not correct while +create a virtual link. + +The default psr_version should be DC_PSR_VERSION_UNSUPPORTED. + +Reviewed-by: Roman Li +Signed-off-by: Tom Chung +Signed-off-by: Zaeem Mohamed +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c +index d3d638252e2b9..e1085c316b78e 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -248,6 +248,7 @@ static bool create_links( + link->link_id.type = OBJECT_TYPE_CONNECTOR; + link->link_id.id = CONNECTOR_ID_VIRTUAL; + link->link_id.enum_id = ENUM_ID_1; ++ link->psr_settings.psr_version = DC_PSR_VERSION_UNSUPPORTED; + link->link_enc = kzalloc(sizeof(*link->link_enc), GFP_KERNEL); + + if (!link->link_enc) { +-- +2.39.5 + diff --git a/queue-5.15/drm-amdgpu-do-not-program-agp-bar-regs-under-sriov-i.patch b/queue-5.15/drm-amdgpu-do-not-program-agp-bar-regs-under-sriov-i.patch new file mode 100644 index 0000000000..afa69d5e53 --- /dev/null +++ b/queue-5.15/drm-amdgpu-do-not-program-agp-bar-regs-under-sriov-i.patch @@ -0,0 +1,45 @@ +From 051bc4b45b37541ecdff584c4a59a579cd62ce54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2025 18:38:28 -0500 +Subject: drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c + +From: Victor Lu + +[ Upstream commit 057fef20b8401110a7bc1c2fe9d804a8a0bf0d24 ] + +SRIOV VF does not have write access to AGP BAR regs. +Skip the writes to avoid a dmesg warning. + +Signed-off-by: Victor Lu +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c b/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c +index f51fd0688eca7..9b881d8413b14 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c +@@ -92,12 +92,12 @@ static void gfxhub_v1_0_init_system_aperture_regs(struct amdgpu_device *adev) + { + uint64_t value; + +- /* Program the AGP BAR */ +- WREG32_SOC15_RLC(GC, 0, mmMC_VM_AGP_BASE, 0); +- WREG32_SOC15_RLC(GC, 0, mmMC_VM_AGP_BOT, adev->gmc.agp_start >> 24); +- WREG32_SOC15_RLC(GC, 0, mmMC_VM_AGP_TOP, adev->gmc.agp_end >> 24); +- + if (!amdgpu_sriov_vf(adev) || adev->asic_type <= CHIP_VEGA10) { ++ /* Program the AGP BAR */ ++ WREG32_SOC15_RLC(GC, 0, mmMC_VM_AGP_BASE, 0); ++ WREG32_SOC15_RLC(GC, 0, mmMC_VM_AGP_BOT, adev->gmc.agp_start >> 24); ++ WREG32_SOC15_RLC(GC, 0, mmMC_VM_AGP_TOP, adev->gmc.agp_end >> 24); ++ + /* Program the system aperture low logical page number. */ + WREG32_SOC15_RLC(GC, 0, mmMC_VM_SYSTEM_APERTURE_LOW_ADDR, + min(adev->gmc.fb_start, adev->gmc.agp_start) >> 18); +-- +2.39.5 + diff --git a/queue-5.15/drm-amdgpu-reset-psp-cmd-to-null-after-releasing-the.patch b/queue-5.15/drm-amdgpu-reset-psp-cmd-to-null-after-releasing-the.patch new file mode 100644 index 0000000000..a41208d7fa --- /dev/null +++ b/queue-5.15/drm-amdgpu-reset-psp-cmd-to-null-after-releasing-the.patch @@ -0,0 +1,45 @@ +From d36b5edd6a8c8864e1350f892dcc773914139a47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Feb 2025 14:28:49 +0800 +Subject: drm/amdgpu: reset psp->cmd to NULL after releasing the buffer + +From: Jiang Liu + +[ Upstream commit e92f3f94cad24154fd3baae30c6dfb918492278d ] + +Reset psp->cmd to NULL after releasing the buffer in function psp_sw_fini(). + +Reviewed-by: Lijo Lazar +Signed-off-by: Jiang Liu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index a8b7f0aeacf83..64bf24b64446b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -353,7 +353,6 @@ static int psp_sw_fini(void *handle) + { + struct amdgpu_device *adev = (struct amdgpu_device *)handle; + struct psp_context *psp = &adev->psp; +- struct psp_gfx_cmd_resp *cmd = psp->cmd; + + psp_memory_training_fini(psp); + if (psp->sos_fw) { +@@ -373,8 +372,8 @@ static int psp_sw_fini(void *handle) + adev->asic_type == CHIP_SIENNA_CICHLID) + psp_sysfs_fini(adev); + +- kfree(cmd); +- cmd = NULL; ++ kfree(psp->cmd); ++ psp->cmd = NULL; + + amdgpu_bo_free_kernel(&psp->fw_pri_bo, + &psp->fw_pri_mc_addr, &psp->fw_pri_buf); +-- +2.39.5 + diff --git a/queue-5.15/drm-amdkfd-kfd-release_work-possible-circular-lockin.patch b/queue-5.15/drm-amdkfd-kfd-release_work-possible-circular-lockin.patch new file mode 100644 index 0000000000..348b1be0a0 --- /dev/null +++ b/queue-5.15/drm-amdkfd-kfd-release_work-possible-circular-lockin.patch @@ -0,0 +1,80 @@ +From d0a36bcdbbf50adcac50787bb716c5c827d30cc1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Feb 2025 20:08:29 -0500 +Subject: drm/amdkfd: KFD release_work possible circular locking + +From: Philip Yang + +[ Upstream commit 1b9366c601039d60546794c63fbb83ce8e53b978 ] + +If waiting for gpu reset done in KFD release_work, thers is WARNING: +possible circular locking dependency detected + + #2 kfd_create_process + kfd_process_mutex + flush kfd release work + + #1 kfd release work + wait for amdgpu reset work + + #0 amdgpu_device_gpu_reset + kgd2kfd_pre_reset + kfd_process_mutex + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock((work_completion)(&p->release_work)); + lock((wq_completion)kfd_process_wq); + lock((work_completion)(&p->release_work)); + lock((wq_completion)amdgpu-reset-dev); + +To fix this, KFD create process move flush release work outside +kfd_process_mutex. + +Signed-off-by: Philip Yang +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_process.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +index 49810642bc2b8..7ef6e61aa0431 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +@@ -807,6 +807,14 @@ struct kfd_process *kfd_create_process(struct file *filep) + if (thread->group_leader->mm != thread->mm) + return ERR_PTR(-EINVAL); + ++ /* If the process just called exec(3), it is possible that the ++ * cleanup of the kfd_process (following the release of the mm ++ * of the old process image) is still in the cleanup work queue. ++ * Make sure to drain any job before trying to recreate any ++ * resource for this process. ++ */ ++ flush_workqueue(kfd_process_wq); ++ + /* + * take kfd processes mutex before starting of process creation + * so there won't be a case where two threads of the same process +@@ -819,14 +827,6 @@ struct kfd_process *kfd_create_process(struct file *filep) + if (process) { + pr_debug("Process already found\n"); + } else { +- /* If the process just called exec(3), it is possible that the +- * cleanup of the kfd_process (following the release of the mm +- * of the old process image) is still in the cleanup work queue. +- * Make sure to drain any job before trying to recreate any +- * resource for this process. +- */ +- flush_workqueue(kfd_process_wq); +- + process = create_process(thread); + if (IS_ERR(process)) + goto out; +-- +2.39.5 + diff --git a/queue-5.15/drm-ast-find-vbios-mode-from-regular-display-size.patch b/queue-5.15/drm-ast-find-vbios-mode-from-regular-display-size.patch new file mode 100644 index 0000000000..fd957f5cd3 --- /dev/null +++ b/queue-5.15/drm-ast-find-vbios-mode-from-regular-display-size.patch @@ -0,0 +1,89 @@ +From eb243e76edd3b5c7e8fb7172ff6d56c73d359933 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Jan 2025 10:21:08 +0100 +Subject: drm/ast: Find VBIOS mode from regular display size + +From: Thomas Zimmermann + +[ Upstream commit c81202906b5cd56db403e95db3d29c9dfc8c74c1 ] + +The ast driver looks up supplied display modes from an internal list of +display modes supported by the VBIOS. + +Do not use the crtc_-prefixed display values from struct drm_display_mode +for looking up the VBIOS mode. The fields contain raw values that the +driver programs to hardware. They are affected by display settings like +double-scan or interlace. + +Instead use the regular vdisplay and hdisplay fields for lookup. As the +programmed values can now differ from the values used for lookup, set +struct drm_display_mode.crtc_vdisplay and .crtc_hdisplay from the VBIOS +mode. + +Signed-off-by: Thomas Zimmermann +Reviewed-by: Jocelyn Falempe +Link: https://patchwork.freedesktop.org/patch/msgid/20250131092257.115596-9-tzimmermann@suse.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ast/ast_mode.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c +index 08ed0d08d03b8..87d31d3b0e357 100644 +--- a/drivers/gpu/drm/ast/ast_mode.c ++++ b/drivers/gpu/drm/ast/ast_mode.c +@@ -105,7 +105,7 @@ static bool ast_get_vbios_mode_info(const struct drm_format_info *format, + return false; + } + +- switch (mode->crtc_hdisplay) { ++ switch (mode->hdisplay) { + case 640: + vbios_mode->enh_table = &res_640x480[refresh_rate_index]; + break; +@@ -116,7 +116,7 @@ static bool ast_get_vbios_mode_info(const struct drm_format_info *format, + vbios_mode->enh_table = &res_1024x768[refresh_rate_index]; + break; + case 1280: +- if (mode->crtc_vdisplay == 800) ++ if (mode->vdisplay == 800) + vbios_mode->enh_table = &res_1280x800[refresh_rate_index]; + else + vbios_mode->enh_table = &res_1280x1024[refresh_rate_index]; +@@ -128,7 +128,7 @@ static bool ast_get_vbios_mode_info(const struct drm_format_info *format, + vbios_mode->enh_table = &res_1440x900[refresh_rate_index]; + break; + case 1600: +- if (mode->crtc_vdisplay == 900) ++ if (mode->vdisplay == 900) + vbios_mode->enh_table = &res_1600x900[refresh_rate_index]; + else + vbios_mode->enh_table = &res_1600x1200[refresh_rate_index]; +@@ -137,7 +137,7 @@ static bool ast_get_vbios_mode_info(const struct drm_format_info *format, + vbios_mode->enh_table = &res_1680x1050[refresh_rate_index]; + break; + case 1920: +- if (mode->crtc_vdisplay == 1080) ++ if (mode->vdisplay == 1080) + vbios_mode->enh_table = &res_1920x1080[refresh_rate_index]; + else + vbios_mode->enh_table = &res_1920x1200[refresh_rate_index]; +@@ -181,6 +181,7 @@ static bool ast_get_vbios_mode_info(const struct drm_format_info *format, + hborder = (vbios_mode->enh_table->flags & HBorder) ? 8 : 0; + vborder = (vbios_mode->enh_table->flags & VBorder) ? 8 : 0; + ++ adjusted_mode->crtc_hdisplay = vbios_mode->enh_table->hde; + adjusted_mode->crtc_htotal = vbios_mode->enh_table->ht; + adjusted_mode->crtc_hblank_start = vbios_mode->enh_table->hde + hborder; + adjusted_mode->crtc_hblank_end = vbios_mode->enh_table->ht - hborder; +@@ -190,6 +191,7 @@ static bool ast_get_vbios_mode_info(const struct drm_format_info *format, + vbios_mode->enh_table->hfp + + vbios_mode->enh_table->hsync); + ++ adjusted_mode->crtc_vdisplay = vbios_mode->enh_table->vde; + adjusted_mode->crtc_vtotal = vbios_mode->enh_table->vt; + adjusted_mode->crtc_vblank_start = vbios_mode->enh_table->vde + vborder; + adjusted_mode->crtc_vblank_end = vbios_mode->enh_table->vt - vborder; +-- +2.39.5 + diff --git a/queue-5.15/drm-atomic-clarify-the-rules-around-drm_atomic_state.patch b/queue-5.15/drm-atomic-clarify-the-rules-around-drm_atomic_state.patch new file mode 100644 index 0000000000..e0ff75c5f7 --- /dev/null +++ b/queue-5.15/drm-atomic-clarify-the-rules-around-drm_atomic_state.patch @@ -0,0 +1,90 @@ +From 3f766542b1015025b1de94fd142a3ccafc858fc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 18:24:16 +0100 +Subject: drm/atomic: clarify the rules around drm_atomic_state->allow_modeset +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Simona Vetter + +[ Upstream commit c5e3306a424b52e38ad2c28c7f3399fcd03e383d ] + +msm is automagically upgrading normal commits to full modesets, and +that's a big no-no: + +- for one this results in full on->off->on transitions on all these + crtc, at least if you're using the usual helpers. Which seems to be + the case, and is breaking uapi + +- further even if the ctm change itself would not result in flicker, + this can hide modesets for other reasons. Which again breaks the + uapi + +v2: I forgot the case of adding unrelated crtc state. Add that case +and link to the existing kerneldoc explainers. This has come up in an +irc discussion with Manasi and Ville about intel's bigjoiner mode. +Also cc everyone involved in the msm irc discussion, more people +joined after I sent out v1. + +v3: Wording polish from Pekka and Thomas + +Acked-by: Pekka Paalanen +Acked-by: Dmitry Baryshkov +Cc: Maarten Lankhorst +Cc: Maxime Ripard +Cc: Thomas Zimmermann +Cc: David Airlie +Cc: Daniel Vetter +Cc: Pekka Paalanen +Cc: Rob Clark +Cc: Simon Ser +Cc: Manasi Navare +Cc: Ville Syrjälä +Cc: Abhinav Kumar +Cc: Dmitry Baryshkov +Signed-off-by: Simona Vetter +Signed-off-by: Simona Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20250108172417.160831-1-simona.vetter@ffwll.ch +Signed-off-by: Sasha Levin +--- + include/drm/drm_atomic.h | 23 +++++++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +diff --git a/include/drm/drm_atomic.h b/include/drm/drm_atomic.h +index 1701c2128a5cb..1b8dd160c51f9 100644 +--- a/include/drm/drm_atomic.h ++++ b/include/drm/drm_atomic.h +@@ -353,8 +353,27 @@ struct drm_atomic_state { + * + * Allow full modeset. This is used by the ATOMIC IOCTL handler to + * implement the DRM_MODE_ATOMIC_ALLOW_MODESET flag. Drivers should +- * never consult this flag, instead looking at the output of +- * drm_atomic_crtc_needs_modeset(). ++ * generally not consult this flag, but instead look at the output of ++ * drm_atomic_crtc_needs_modeset(). The detailed rules are: ++ * ++ * - Drivers must not consult @allow_modeset in the atomic commit path. ++ * Use drm_atomic_crtc_needs_modeset() instead. ++ * ++ * - Drivers must consult @allow_modeset before adding unrelated struct ++ * drm_crtc_state to this commit by calling ++ * drm_atomic_get_crtc_state(). See also the warning in the ++ * documentation for that function. ++ * ++ * - Drivers must never change this flag, it is under the exclusive ++ * control of userspace. ++ * ++ * - Drivers may consult @allow_modeset in the atomic check path, if ++ * they have the choice between an optimal hardware configuration ++ * which requires a modeset, and a less optimal configuration which ++ * can be committed without a modeset. An example would be suboptimal ++ * scanout FIFO allocation resulting in increased idle power ++ * consumption. This allows userspace to avoid flickering and delays ++ * for the normal composition loop at reasonable cost. + */ + bool allow_modeset : 1; + /** +-- +2.39.5 + diff --git a/queue-5.15/drm-mediatek-mtk_dpi-add-checks-for-reg_h_fre_con-ex.patch b/queue-5.15/drm-mediatek-mtk_dpi-add-checks-for-reg_h_fre_con-ex.patch new file mode 100644 index 0000000000..3146bf7439 --- /dev/null +++ b/queue-5.15/drm-mediatek-mtk_dpi-add-checks-for-reg_h_fre_con-ex.patch @@ -0,0 +1,51 @@ +From 90250c1555812310ae26d9207440104ff25ed234 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Feb 2025 16:47:58 +0100 +Subject: drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence + +From: AngeloGioacchino Del Regno + +[ Upstream commit 8c9da7cd0bbcc90ab444454fecf535320456a312 ] + +In preparation for adding support for newer DPI instances which +do support direct-pin but do not have any H_FRE_CON register, +like the one found in MT8195 and MT8188, add a branch to check +if the reg_h_fre_con variable was declared in the mtk_dpi_conf +structure for the probed SoC DPI version. + +As a note, this is useful specifically only for cases in which +the support_direct_pin variable is true, so mt8195-dpintf is +not affected by any issue. + +Reviewed-by: CK Hu +Signed-off-by: AngeloGioacchino Del Regno +Link: https://patchwork.kernel.org/project/dri-devel/patch/20250217154836.108895-6-angelogioacchino.delregno@collabora.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_dpi.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_dpi.c b/drivers/gpu/drm/mediatek/mtk_dpi.c +index 9518672dc21b3..3f39109b69154 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dpi.c ++++ b/drivers/gpu/drm/mediatek/mtk_dpi.c +@@ -346,12 +346,13 @@ static void mtk_dpi_config_swap_input(struct mtk_dpi *dpi, bool enable) + + static void mtk_dpi_config_2n_h_fre(struct mtk_dpi *dpi) + { +- mtk_dpi_mask(dpi, dpi->conf->reg_h_fre_con, H_FRE_2N, H_FRE_2N); ++ if (dpi->conf->reg_h_fre_con) ++ mtk_dpi_mask(dpi, dpi->conf->reg_h_fre_con, H_FRE_2N, H_FRE_2N); + } + + static void mtk_dpi_config_disable_edge(struct mtk_dpi *dpi) + { +- if (dpi->conf->edge_sel_en) ++ if (dpi->conf->edge_sel_en && dpi->conf->reg_h_fre_con) + mtk_dpi_mask(dpi, dpi->conf->reg_h_fre_con, 0, EDGE_SEL_EN); + } + +-- +2.39.5 + diff --git a/queue-5.15/edac-ie31200-work-around-false-positive-build-warnin.patch b/queue-5.15/edac-ie31200-work-around-false-positive-build-warnin.patch new file mode 100644 index 0000000000..50f6951b47 --- /dev/null +++ b/queue-5.15/edac-ie31200-work-around-false-positive-build-warnin.patch @@ -0,0 +1,105 @@ +From a06320579232cb28e8ad05b446541c4f32697561 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jan 2025 07:50:26 +0100 +Subject: EDAC/ie31200: work around false positive build warning + +From: Arnd Bergmann + +[ Upstream commit c29dfd661fe2f8d1b48c7f00590929c04b25bf40 ] + +gcc-14 produces a bogus warning in some configurations: + +drivers/edac/ie31200_edac.c: In function 'ie31200_probe1.isra': +drivers/edac/ie31200_edac.c:412:26: error: 'dimm_info' is used uninitialized [-Werror=uninitialized] + 412 | struct dimm_data dimm_info[IE31200_CHANNELS][IE31200_DIMMS_PER_CHANNEL]; + | ^~~~~~~~~ +drivers/edac/ie31200_edac.c:412:26: note: 'dimm_info' declared here + 412 | struct dimm_data dimm_info[IE31200_CHANNELS][IE31200_DIMMS_PER_CHANNEL]; + | ^~~~~~~~~ + +I don't see any way the unintialized access could really happen here, +but I can see why the compiler gets confused by the two loops. + +Instead, rework the two nested loops to only read the addr_decode +registers and then keep only one instance of the dimm info structure. + +[Tony: Qiuxu pointed out that the "populate DIMM info" comment was left +behind in the refactor and suggested moving it. I deleted the comment +as unnecessry in front os a call to populate_dimm_info(). That seems +pretty self-describing.] + +Signed-off-by: Arnd Bergmann +Acked-by: Jason Baron +Signed-off-by: Tony Luck +Link: https://lore.kernel.org/all/20250122065031.1321015-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/edac/ie31200_edac.c | 28 +++++++++++++--------------- + 1 file changed, 13 insertions(+), 15 deletions(-) + +diff --git a/drivers/edac/ie31200_edac.c b/drivers/edac/ie31200_edac.c +index acb011cfd8c4f..5e61ca1b72e00 100644 +--- a/drivers/edac/ie31200_edac.c ++++ b/drivers/edac/ie31200_edac.c +@@ -397,10 +397,9 @@ static int ie31200_probe1(struct pci_dev *pdev, int dev_idx) + int i, j, ret; + struct mem_ctl_info *mci = NULL; + struct edac_mc_layer layers[2]; +- struct dimm_data dimm_info[IE31200_CHANNELS][IE31200_DIMMS_PER_CHANNEL]; + void __iomem *window; + struct ie31200_priv *priv; +- u32 addr_decode, mad_offset; ++ u32 addr_decode[IE31200_CHANNELS], mad_offset; + + /* + * Kaby Lake, Coffee Lake seem to work like Skylake. Please re-visit +@@ -458,19 +457,10 @@ static int ie31200_probe1(struct pci_dev *pdev, int dev_idx) + mad_offset = IE31200_MAD_DIMM_0_OFFSET; + } + +- /* populate DIMM info */ + for (i = 0; i < IE31200_CHANNELS; i++) { +- addr_decode = readl(window + mad_offset + ++ addr_decode[i] = readl(window + mad_offset + + (i * 4)); +- edac_dbg(0, "addr_decode: 0x%x\n", addr_decode); +- for (j = 0; j < IE31200_DIMMS_PER_CHANNEL; j++) { +- populate_dimm_info(&dimm_info[i][j], addr_decode, j, +- skl); +- edac_dbg(0, "size: 0x%x, rank: %d, width: %d\n", +- dimm_info[i][j].size, +- dimm_info[i][j].dual_rank, +- dimm_info[i][j].x16_width); +- } ++ edac_dbg(0, "addr_decode: 0x%x\n", addr_decode[i]); + } + + /* +@@ -481,14 +471,22 @@ static int ie31200_probe1(struct pci_dev *pdev, int dev_idx) + */ + for (i = 0; i < IE31200_DIMMS_PER_CHANNEL; i++) { + for (j = 0; j < IE31200_CHANNELS; j++) { ++ struct dimm_data dimm_info; + struct dimm_info *dimm; + unsigned long nr_pages; + +- nr_pages = IE31200_PAGES(dimm_info[j][i].size, skl); ++ populate_dimm_info(&dimm_info, addr_decode[j], i, ++ skl); ++ edac_dbg(0, "size: 0x%x, rank: %d, width: %d\n", ++ dimm_info.size, ++ dimm_info.dual_rank, ++ dimm_info.x16_width); ++ ++ nr_pages = IE31200_PAGES(dimm_info.size, skl); + if (nr_pages == 0) + continue; + +- if (dimm_info[j][i].dual_rank) { ++ if (dimm_info.dual_rank) { + nr_pages = nr_pages / 2; + dimm = edac_get_dimm(mci, (i * 2) + 1, j, 0); + dimm->nr_pages = nr_pages; +-- +2.39.5 + diff --git a/queue-5.15/eth-mlx4-don-t-try-to-complete-xdp-frames-in-netpoll.patch b/queue-5.15/eth-mlx4-don-t-try-to-complete-xdp-frames-in-netpoll.patch new file mode 100644 index 0000000000..9dcc625c95 --- /dev/null +++ b/queue-5.15/eth-mlx4-don-t-try-to-complete-xdp-frames-in-netpoll.patch @@ -0,0 +1,39 @@ +From 378214377c8d4360070f1c813f98f7a07f318b64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Feb 2025 17:06:33 -0800 +Subject: eth: mlx4: don't try to complete XDP frames in netpoll + +From: Jakub Kicinski + +[ Upstream commit 8fdeafd66edaf420ea0063a1f13442fe3470fe70 ] + +mlx4 doesn't support ndo_xdp_xmit / XDP_REDIRECT and wasn't +using page pool until now, so it could run XDP completions +in netpoll (NAPI budget == 0) just fine. Page pool has calling +context requirements, make sure we don't try to call it from +what is potentially HW IRQ context. + +Reviewed-by: Tariq Toukan +Link: https://patch.msgid.link/20250213010635.1354034-3-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/en_tx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c +index c56b9dba4c718..ed695f7443a83 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c +@@ -445,6 +445,8 @@ int mlx4_en_process_tx_cq(struct net_device *dev, + + if (unlikely(!priv->port_up)) + return 0; ++ if (unlikely(!napi_budget) && cq->type == TX_XDP) ++ return 0; + + netdev_txq_bql_complete_prefetchw(ring->tx_queue); + +-- +2.39.5 + diff --git a/queue-5.15/exit-fix-the-usage-of-delay_group_leader-exit_code-i.patch b/queue-5.15/exit-fix-the-usage-of-delay_group_leader-exit_code-i.patch new file mode 100644 index 0000000000..9dafba2806 --- /dev/null +++ b/queue-5.15/exit-fix-the-usage-of-delay_group_leader-exit_code-i.patch @@ -0,0 +1,52 @@ +From f74f25150b68253a59dcab73d960028fc6992f34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Mar 2025 18:19:41 +0100 +Subject: exit: fix the usage of delay_group_leader->exit_code in + do_notify_parent() and pidfs_exit() + +From: Oleg Nesterov + +[ Upstream commit 9133607de37a4887c6f89ed937176a0a0c1ebb17 ] + +Consider a process with a group leader L and a sub-thread T. +L does sys_exit(1), then T does sys_exit_group(2). + +In this case wait_task_zombie(L) will notice SIGNAL_GROUP_EXIT and use +L->signal->group_exit_code, this is correct. + +But, before that, do_notify_parent(L) called by release_task(T) will use +L->exit_code != L->signal->group_exit_code, and this is not consistent. +We don't really care, I think that nobody relies on the info which comes +with SIGCHLD, if nothing else SIGCHLD < SIGRTMIN can be queued only once. + +But pidfs_exit() is more problematic, I think pidfs_exit_info->exit_code +should report ->group_exit_code in this case, just like wait_task_zombie(). + +TODO: with this change we can hopefully cleanup (or may be even kill) the +similar SIGNAL_GROUP_EXIT checks, at least in wait_task_zombie(). + +Signed-off-by: Oleg Nesterov +Link: https://lore.kernel.org/r/20250324171941.GA13114@redhat.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + kernel/exit.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/kernel/exit.c b/kernel/exit.c +index 890e5cb6799b0..04fc65f2b690d 100644 +--- a/kernel/exit.c ++++ b/kernel/exit.c +@@ -254,6 +254,9 @@ void release_task(struct task_struct *p) + leader = p->group_leader; + if (leader != p && thread_group_empty(leader) + && leader->exit_state == EXIT_ZOMBIE) { ++ /* for pidfs_exit() and do_notify_parent() */ ++ if (leader->signal->flags & SIGNAL_GROUP_EXIT) ++ leader->exit_code = leader->signal->group_exit_code; + /* + * If we were the last child thread and the leader has + * exited already, and the leader's parent ignores SIGCHLD, +-- +2.39.5 + diff --git a/queue-5.15/ext4-reorder-capability-check-last.patch b/queue-5.15/ext4-reorder-capability-check-last.patch new file mode 100644 index 0000000000..571b964899 --- /dev/null +++ b/queue-5.15/ext4-reorder-capability-check-last.patch @@ -0,0 +1,55 @@ +From a5a1cbf56ceaf8339a047fd18e2e1fa6a3a12c21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Mar 2025 17:06:39 +0100 +Subject: ext4: reorder capability check last +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian Göttsche + +[ Upstream commit 1b419c889c0767a5b66d0a6c566cae491f1cb0f7 ] + +capable() calls refer to enabled LSMs whether to permit or deny the +request. This is relevant in connection with SELinux, where a +capability check results in a policy decision and by default a denial +message on insufficient permission is issued. +It can lead to three undesired cases: + 1. A denial message is generated, even in case the operation was an + unprivileged one and thus the syscall succeeded, creating noise. + 2. To avoid the noise from 1. the policy writer adds a rule to ignore + those denial messages, hiding future syscalls, where the task + performs an actual privileged operation, leading to hidden limited + functionality of that task. + 3. To avoid the noise from 1. the policy writer adds a rule to permit + the task the requested capability, while it does not need it, + violating the principle of least privilege. + +Signed-off-by: Christian Göttsche +Reviewed-by: Serge Hallyn +Reviewed-by: Jan Kara +Link: https://patch.msgid.link/20250302160657.127253-2-cgoettsche@seltendoof.de +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/balloc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c +index c23ac149601e5..d6872b71657b6 100644 +--- a/fs/ext4/balloc.c ++++ b/fs/ext4/balloc.c +@@ -637,8 +637,8 @@ static int ext4_has_free_clusters(struct ext4_sb_info *sbi, + /* Hm, nope. Are (enough) root reserved clusters available? */ + if (uid_eq(sbi->s_resuid, current_fsuid()) || + (!gid_eq(sbi->s_resgid, GLOBAL_ROOT_GID) && in_group_p(sbi->s_resgid)) || +- capable(CAP_SYS_RESOURCE) || +- (flags & EXT4_MB_USE_ROOT_BLOCKS)) { ++ (flags & EXT4_MB_USE_ROOT_BLOCKS) || ++ capable(CAP_SYS_RESOURCE)) { + + if (free_clusters >= (nclusters + dirty_clusters + + resv_clusters)) +-- +2.39.5 + diff --git a/queue-5.15/f2fs-defer-readonly-check-vs-norecovery.patch b/queue-5.15/f2fs-defer-readonly-check-vs-norecovery.patch new file mode 100644 index 0000000000..877b391e13 --- /dev/null +++ b/queue-5.15/f2fs-defer-readonly-check-vs-norecovery.patch @@ -0,0 +1,56 @@ +From 7afa5336b9d9b72466e00848fbbfc8ede4a66e58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Mar 2025 11:12:17 -0600 +Subject: f2fs: defer readonly check vs norecovery + +From: Eric Sandeen + +[ Upstream commit 9cca49875997a1a7e92800a828a62bacb0f577b9 ] + +Defer the readonly-vs-norecovery check until after option parsing is done +so that option parsing does not require an active superblock for the test. +Add a helpful message, while we're at it. + +(I think could be moved back into parsing after we switch to the new mount +API if desired, as the fs context will have RO state available.) + +Signed-off-by: Eric Sandeen +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/super.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 0cf564ded140a..77a7b789e32ad 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -729,10 +729,8 @@ static int parse_options(struct super_block *sb, char *options, bool is_remount) + set_opt(sbi, DISABLE_ROLL_FORWARD); + break; + case Opt_norecovery: +- /* this option mounts f2fs with ro */ ++ /* requires ro mount, checked in f2fs_default_check */ + set_opt(sbi, NORECOVERY); +- if (!f2fs_readonly(sb)) +- return -EINVAL; + break; + case Opt_discard: + if (!f2fs_hw_support_discard(sbi)) { +@@ -1386,6 +1384,12 @@ static int parse_options(struct super_block *sb, char *options, bool is_remount) + f2fs_err(sbi, "Allow to mount readonly mode only"); + return -EROFS; + } ++ ++ if (test_opt(sbi, NORECOVERY) && !f2fs_readonly(sbi->sb)) { ++ f2fs_err(sbi, "norecovery requires readonly mount"); ++ return -EINVAL; ++ } ++ + return 0; + } + +-- +2.39.5 + diff --git a/queue-5.15/fbcon-use-correct-erase-colour-for-clearing-in-fbcon.patch b/queue-5.15/fbcon-use-correct-erase-colour-for-clearing-in-fbcon.patch new file mode 100644 index 0000000000..c8cdd7bc95 --- /dev/null +++ b/queue-5.15/fbcon-use-correct-erase-colour-for-clearing-in-fbcon.patch @@ -0,0 +1,242 @@ +From e2a4c68b37cc4ac9fcecea5242e29b411dd805ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Feb 2025 21:33:46 +0100 +Subject: fbcon: Use correct erase colour for clearing in fbcon + +From: Zsolt Kajtar + +[ Upstream commit 892c788d73fe4a94337ed092cb998c49fa8ecaf4 ] + +The erase colour calculation for fbcon clearing should use get_color instead +of attr_col_ec, like everything else. The latter is similar but is not correct. +For example it's missing the depth dependent remapping and doesn't care about +blanking. + +The problem can be reproduced by setting up the background colour to grey +(vt.color=0x70) and having an fbcon console set to 2bpp (4 shades of gray). +Now the background attribute should be 1 (dark gray) on the console. + +If the screen is scrolled when pressing enter in a shell prompt at the bottom +line then the new line is cleared using colour 7 instead of 1. That's not +something fillrect likes (at 2bbp it expect 0-3) so the result is interesting. + +This patch switches to get_color with vc_video_erase_char to determine the +erase colour from attr_col_ec. That makes the latter function redundant as +no other users were left. + +Use correct erase colour for clearing in fbcon + +Signed-off-by: Zsolt Kajtar +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/core/bitblit.c | 5 ++-- + drivers/video/fbdev/core/fbcon.c | 10 +++++--- + drivers/video/fbdev/core/fbcon.h | 38 +--------------------------- + drivers/video/fbdev/core/fbcon_ccw.c | 5 ++-- + drivers/video/fbdev/core/fbcon_cw.c | 5 ++-- + drivers/video/fbdev/core/fbcon_ud.c | 5 ++-- + drivers/video/fbdev/core/tileblit.c | 8 +++--- + 7 files changed, 18 insertions(+), 58 deletions(-) + +diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c +index 8587c9da06700..42e681a78136a 100644 +--- a/drivers/video/fbdev/core/bitblit.c ++++ b/drivers/video/fbdev/core/bitblit.c +@@ -59,12 +59,11 @@ static void bit_bmove(struct vc_data *vc, struct fb_info *info, int sy, + } + + static void bit_clear(struct vc_data *vc, struct fb_info *info, int sy, +- int sx, int height, int width) ++ int sx, int height, int width, int fg, int bg) + { +- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; + struct fb_fillrect region; + +- region.color = attr_bgcol_ec(bgshift, vc, info); ++ region.color = bg; + region.dx = sx * vc->vc_font.width; + region.dy = sy * vc->vc_font.height; + region.width = width * vc->vc_font.width; +diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c +index b163b54b868e6..805a4745abd86 100644 +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -1249,7 +1249,7 @@ static void fbcon_clear(struct vc_data *vc, int sy, int sx, int height, + { + struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]]; + struct fbcon_ops *ops = info->fbcon_par; +- ++ int fg, bg; + struct fbcon_display *p = &fb_display[vc->vc_num]; + u_int y_break; + +@@ -1270,16 +1270,18 @@ static void fbcon_clear(struct vc_data *vc, int sy, int sx, int height, + fbcon_clear_margins(vc, 0); + } + ++ fg = get_color(vc, info, vc->vc_video_erase_char, 1); ++ bg = get_color(vc, info, vc->vc_video_erase_char, 0); + /* Split blits that cross physical y_wrap boundary */ + + y_break = p->vrows - p->yscroll; + if (sy < y_break && sy + height - 1 >= y_break) { + u_int b = y_break - sy; +- ops->clear(vc, info, real_y(p, sy), sx, b, width); ++ ops->clear(vc, info, real_y(p, sy), sx, b, width, fg, bg); + ops->clear(vc, info, real_y(p, sy + b), sx, height - b, +- width); ++ width, fg, bg); + } else +- ops->clear(vc, info, real_y(p, sy), sx, height, width); ++ ops->clear(vc, info, real_y(p, sy), sx, height, width, fg, bg); + } + + static void fbcon_putcs(struct vc_data *vc, const unsigned short *s, +diff --git a/drivers/video/fbdev/core/fbcon.h b/drivers/video/fbdev/core/fbcon.h +index 0f16cbc99e6a4..3e1ec454b8aa3 100644 +--- a/drivers/video/fbdev/core/fbcon.h ++++ b/drivers/video/fbdev/core/fbcon.h +@@ -57,7 +57,7 @@ struct fbcon_ops { + void (*bmove)(struct vc_data *vc, struct fb_info *info, int sy, + int sx, int dy, int dx, int height, int width); + void (*clear)(struct vc_data *vc, struct fb_info *info, int sy, +- int sx, int height, int width); ++ int sx, int height, int width, int fb, int bg); + void (*putcs)(struct vc_data *vc, struct fb_info *info, + const unsigned short *s, int count, int yy, int xx, + int fg, int bg); +@@ -118,42 +118,6 @@ static inline int mono_col(const struct fb_info *info) + return (~(0xfff << max_len)) & 0xff; + } + +-static inline int attr_col_ec(int shift, struct vc_data *vc, +- struct fb_info *info, int is_fg) +-{ +- int is_mono01; +- int col; +- int fg; +- int bg; +- +- if (!vc) +- return 0; +- +- if (vc->vc_can_do_color) +- return is_fg ? attr_fgcol(shift,vc->vc_video_erase_char) +- : attr_bgcol(shift,vc->vc_video_erase_char); +- +- if (!info) +- return 0; +- +- col = mono_col(info); +- is_mono01 = info->fix.visual == FB_VISUAL_MONO01; +- +- if (attr_reverse(vc->vc_video_erase_char)) { +- fg = is_mono01 ? col : 0; +- bg = is_mono01 ? 0 : col; +- } +- else { +- fg = is_mono01 ? 0 : col; +- bg = is_mono01 ? col : 0; +- } +- +- return is_fg ? fg : bg; +-} +- +-#define attr_bgcol_ec(bgshift, vc, info) attr_col_ec(bgshift, vc, info, 0) +-#define attr_fgcol_ec(fgshift, vc, info) attr_col_ec(fgshift, vc, info, 1) +- + /* + * Scroll Method + */ +diff --git a/drivers/video/fbdev/core/fbcon_ccw.c b/drivers/video/fbdev/core/fbcon_ccw.c +index 2789ace796342..9f4d65478554a 100644 +--- a/drivers/video/fbdev/core/fbcon_ccw.c ++++ b/drivers/video/fbdev/core/fbcon_ccw.c +@@ -78,14 +78,13 @@ static void ccw_bmove(struct vc_data *vc, struct fb_info *info, int sy, + } + + static void ccw_clear(struct vc_data *vc, struct fb_info *info, int sy, +- int sx, int height, int width) ++ int sx, int height, int width, int fg, int bg) + { + struct fbcon_ops *ops = info->fbcon_par; + struct fb_fillrect region; +- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; + u32 vyres = GETVYRES(ops->p, info); + +- region.color = attr_bgcol_ec(bgshift,vc,info); ++ region.color = bg; + region.dx = sy * vc->vc_font.height; + region.dy = vyres - ((sx + width) * vc->vc_font.width); + region.height = width * vc->vc_font.width; +diff --git a/drivers/video/fbdev/core/fbcon_cw.c b/drivers/video/fbdev/core/fbcon_cw.c +index 86a254c1b2b7b..b18e31886da10 100644 +--- a/drivers/video/fbdev/core/fbcon_cw.c ++++ b/drivers/video/fbdev/core/fbcon_cw.c +@@ -63,14 +63,13 @@ static void cw_bmove(struct vc_data *vc, struct fb_info *info, int sy, + } + + static void cw_clear(struct vc_data *vc, struct fb_info *info, int sy, +- int sx, int height, int width) ++ int sx, int height, int width, int fg, int bg) + { + struct fbcon_ops *ops = info->fbcon_par; + struct fb_fillrect region; +- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; + u32 vxres = GETVXRES(ops->p, info); + +- region.color = attr_bgcol_ec(bgshift,vc,info); ++ region.color = bg; + region.dx = vxres - ((sy + height) * vc->vc_font.height); + region.dy = sx * vc->vc_font.width; + region.height = width * vc->vc_font.width; +diff --git a/drivers/video/fbdev/core/fbcon_ud.c b/drivers/video/fbdev/core/fbcon_ud.c +index 23bc045769d08..b6b074cfd9dc0 100644 +--- a/drivers/video/fbdev/core/fbcon_ud.c ++++ b/drivers/video/fbdev/core/fbcon_ud.c +@@ -64,15 +64,14 @@ static void ud_bmove(struct vc_data *vc, struct fb_info *info, int sy, + } + + static void ud_clear(struct vc_data *vc, struct fb_info *info, int sy, +- int sx, int height, int width) ++ int sx, int height, int width, int fg, int bg) + { + struct fbcon_ops *ops = info->fbcon_par; + struct fb_fillrect region; +- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; + u32 vyres = GETVYRES(ops->p, info); + u32 vxres = GETVXRES(ops->p, info); + +- region.color = attr_bgcol_ec(bgshift,vc,info); ++ region.color = bg; + region.dy = vyres - ((sy + height) * vc->vc_font.height); + region.dx = vxres - ((sx + width) * vc->vc_font.width); + region.width = width * vc->vc_font.width; +diff --git a/drivers/video/fbdev/core/tileblit.c b/drivers/video/fbdev/core/tileblit.c +index 2768eff247ba4..674ca6a410ec8 100644 +--- a/drivers/video/fbdev/core/tileblit.c ++++ b/drivers/video/fbdev/core/tileblit.c +@@ -32,16 +32,14 @@ static void tile_bmove(struct vc_data *vc, struct fb_info *info, int sy, + } + + static void tile_clear(struct vc_data *vc, struct fb_info *info, int sy, +- int sx, int height, int width) ++ int sx, int height, int width, int fg, int bg) + { + struct fb_tilerect rect; +- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; +- int fgshift = (vc->vc_hi_font_mask) ? 9 : 8; + + rect.index = vc->vc_video_erase_char & + ((vc->vc_hi_font_mask) ? 0x1ff : 0xff); +- rect.fg = attr_fgcol_ec(fgshift, vc, info); +- rect.bg = attr_bgcol_ec(bgshift, vc, info); ++ rect.fg = fg; ++ rect.bg = bg; + rect.sx = sx; + rect.sy = sy; + rect.width = width; +-- +2.39.5 + diff --git a/queue-5.15/fbdev-core-tileblit-implement-missing-margin-clearin.patch b/queue-5.15/fbdev-core-tileblit-implement-missing-margin-clearin.patch new file mode 100644 index 0000000000..5fdd4f9869 --- /dev/null +++ b/queue-5.15/fbdev-core-tileblit-implement-missing-margin-clearin.patch @@ -0,0 +1,95 @@ +From 854817280254cf144ffa7b5d4f1adbd477c7c9fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Feb 2025 09:18:09 +0100 +Subject: fbdev: core: tileblit: Implement missing margin clearing for tileblit + +From: Zsolt Kajtar + +[ Upstream commit 76d3ca89981354e1f85a3e0ad9ac4217d351cc72 ] + +I was wondering why there's garbage at the bottom of the screen when +tile blitting is used with an odd mode like 1080, 600 or 200. Sure there's +only space for half a tile but the same area is clean when the buffer +is bitmap. + +Then later I found that it's supposed to be cleaned but that's not +implemented. So I took what's in bitblit and adapted it for tileblit. + +This implementation was tested for both the horizontal and vertical case, +and now does the same as what's done for bitmap buffers. + +If anyone is interested to reproduce the problem then I could bet that'd +be on a S3 or Ark. Just set up a mode with an odd line count and make +sure that the virtual size covers the complete tile at the bottom. E.g. +for 600 lines that's 608 virtual lines for a 16 tall tile. Then the +bottom area should be cleaned. + +For the right side it's more difficult as there the drivers won't let an +odd size happen, unless the code is modified. But once it reports back a +few pixel columns short then fbcon won't use the last column. With the +patch that column is now clean. + +Btw. the virtual size should be rounded up by the driver for both axes +(not only the horizontal) so that it's dividable by the tile size. +That's a driver bug but correcting it is not in scope for this patch. + +Implement missing margin clearing for tileblit + +Signed-off-by: Zsolt Kajtar +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/core/tileblit.c | 37 ++++++++++++++++++++++++++++- + 1 file changed, 36 insertions(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/core/tileblit.c b/drivers/video/fbdev/core/tileblit.c +index 674ca6a410ec8..b3aa0c6620c7d 100644 +--- a/drivers/video/fbdev/core/tileblit.c ++++ b/drivers/video/fbdev/core/tileblit.c +@@ -74,7 +74,42 @@ static void tile_putcs(struct vc_data *vc, struct fb_info *info, + static void tile_clear_margins(struct vc_data *vc, struct fb_info *info, + int color, int bottom_only) + { +- return; ++ unsigned int cw = vc->vc_font.width; ++ unsigned int ch = vc->vc_font.height; ++ unsigned int rw = info->var.xres - (vc->vc_cols*cw); ++ unsigned int bh = info->var.yres - (vc->vc_rows*ch); ++ unsigned int rs = info->var.xres - rw; ++ unsigned int bs = info->var.yres - bh; ++ unsigned int vwt = info->var.xres_virtual / cw; ++ unsigned int vht = info->var.yres_virtual / ch; ++ struct fb_tilerect rect; ++ ++ rect.index = vc->vc_video_erase_char & ++ ((vc->vc_hi_font_mask) ? 0x1ff : 0xff); ++ rect.fg = color; ++ rect.bg = color; ++ ++ if ((int) rw > 0 && !bottom_only) { ++ rect.sx = (info->var.xoffset + rs + cw - 1) / cw; ++ rect.sy = 0; ++ rect.width = (rw + cw - 1) / cw; ++ rect.height = vht; ++ if (rect.width + rect.sx > vwt) ++ rect.width = vwt - rect.sx; ++ if (rect.sx < vwt) ++ info->tileops->fb_tilefill(info, &rect); ++ } ++ ++ if ((int) bh > 0) { ++ rect.sx = info->var.xoffset / cw; ++ rect.sy = (info->var.yoffset + bs) / ch; ++ rect.width = rs / cw; ++ rect.height = (bh + ch - 1) / ch; ++ if (rect.height + rect.sy > vht) ++ rect.height = vht - rect.sy; ++ if (rect.sy < vht) ++ info->tileops->fb_tilefill(info, &rect); ++ } + } + + static void tile_cursor(struct vc_data *vc, struct fb_info *info, int mode, +-- +2.39.5 + diff --git a/queue-5.15/fbdev-fsl-diu-fb-add-missing-device_remove_file.patch b/queue-5.15/fbdev-fsl-diu-fb-add-missing-device_remove_file.patch new file mode 100644 index 0000000000..62fef77537 --- /dev/null +++ b/queue-5.15/fbdev-fsl-diu-fb-add-missing-device_remove_file.patch @@ -0,0 +1,33 @@ +From 633eeffc83bce09489dd24f16cc65d7e01f87629 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Mar 2025 09:54:31 +0800 +Subject: fbdev: fsl-diu-fb: add missing device_remove_file() + +From: Shixiong Ou + +[ Upstream commit 86d16cd12efa547ed43d16ba7a782c1251c80ea8 ] + +Call device_remove_file() when driver remove. + +Signed-off-by: Shixiong Ou +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/fsl-diu-fb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/video/fbdev/fsl-diu-fb.c b/drivers/video/fbdev/fsl-diu-fb.c +index ce3c5b0b8f4ef..53be4ab374cc3 100644 +--- a/drivers/video/fbdev/fsl-diu-fb.c ++++ b/drivers/video/fbdev/fsl-diu-fb.c +@@ -1829,6 +1829,7 @@ static int fsl_diu_remove(struct platform_device *pdev) + int i; + + data = dev_get_drvdata(&pdev->dev); ++ device_remove_file(&pdev->dev, &data->dev_attr); + disable_lcdc(&data->fsl_diu_info[0]); + + free_irq(data->irq, data->diu_reg); +-- +2.39.5 + diff --git a/queue-5.15/firmware-arm_ffa-set-dma_mask-for-ffa-devices.patch b/queue-5.15/firmware-arm_ffa-set-dma_mask-for-ffa-devices.patch new file mode 100644 index 0000000000..8fd7be5f93 --- /dev/null +++ b/queue-5.15/firmware-arm_ffa-set-dma_mask-for-ffa-devices.patch @@ -0,0 +1,37 @@ +From f8091033f52e5e434b83f8a1a22fe46480214bdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jan 2025 15:35:52 +0530 +Subject: firmware: arm_ffa: Set dma_mask for ffa devices + +From: Viresh Kumar + +[ Upstream commit cc0aac7ca17e0ea3ca84b552fc79f3e86fd07f53 ] + +Set dma_mask for FFA devices, otherwise DMA allocation using the device pointer +lead to following warning: + +WARNING: CPU: 1 PID: 1 at kernel/dma/mapping.c:597 dma_alloc_attrs+0xe0/0x124 + +Signed-off-by: Viresh Kumar +Message-Id: +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_ffa/bus.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/firmware/arm_ffa/bus.c b/drivers/firmware/arm_ffa/bus.c +index f79ba6f733ba4..27820a59ce25e 100644 +--- a/drivers/firmware/arm_ffa/bus.c ++++ b/drivers/firmware/arm_ffa/bus.c +@@ -190,6 +190,7 @@ struct ffa_device *ffa_device_register(const uuid_t *uuid, int vm_id) + dev = &ffa_dev->dev; + dev->bus = &ffa_bus_type; + dev->release = ffa_release_device; ++ dev->dma_mask = &dev->coherent_dma_mask; + dev_set_name(&ffa_dev->dev, "arm-ffa-%d", id); + + ffa_dev->id = id; +-- +2.39.5 + diff --git a/queue-5.15/fpga-altera-cvp-increase-credit-timeout.patch b/queue-5.15/fpga-altera-cvp-increase-credit-timeout.patch new file mode 100644 index 0000000000..4bfc9feb41 --- /dev/null +++ b/queue-5.15/fpga-altera-cvp-increase-credit-timeout.patch @@ -0,0 +1,43 @@ +From 84515953e97f33487748291fc13eec762d473bc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2025 06:12:49 +0800 +Subject: fpga: altera-cvp: Increase credit timeout + +From: Kuhanh Murugasen Krishnan + +[ Upstream commit 0f05886a40fdc55016ba4d9ae0a9c41f8312f15b ] + +Increase the timeout for SDM (Secure device manager) data credits from +20ms to 40ms. Internal stress tests running at 500 loops failed with the +current timeout of 20ms. At the start of a FPGA configuration, the CVP +host driver reads the transmit credits from SDM. It then sends bitstream +FPGA data to SDM based on the total credits. Each credit allows the +CVP host driver to send 4kBytes of data. There are situations whereby, +the SDM did not respond in time during testing. + +Signed-off-by: Ang Tien Sung +Signed-off-by: Kuhanh Murugasen Krishnan +Acked-by: Xu Yilun +Link: https://lore.kernel.org/r/20250212221249.2715929-1-tien.sung.ang@intel.com +Signed-off-by: Xu Yilun +Signed-off-by: Sasha Levin +--- + drivers/fpga/altera-cvp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/fpga/altera-cvp.c b/drivers/fpga/altera-cvp.c +index ccf4546eff297..34254911c01b1 100644 +--- a/drivers/fpga/altera-cvp.c ++++ b/drivers/fpga/altera-cvp.c +@@ -52,7 +52,7 @@ + /* V2 Defines */ + #define VSE_CVP_TX_CREDITS 0x49 /* 8bit */ + +-#define V2_CREDIT_TIMEOUT_US 20000 ++#define V2_CREDIT_TIMEOUT_US 40000 + #define V2_CHECK_CREDIT_US 10 + #define V2_POLL_TIMEOUT_US 1000000 + #define V2_USER_TIMEOUT_US 500000 +-- +2.39.5 + diff --git a/queue-5.15/hid-usbkbd-fix-the-bit-shift-number-for-led_kana.patch b/queue-5.15/hid-usbkbd-fix-the-bit-shift-number-for-led_kana.patch new file mode 100644 index 0000000000..98091817ba --- /dev/null +++ b/queue-5.15/hid-usbkbd-fix-the-bit-shift-number-for-led_kana.patch @@ -0,0 +1,34 @@ +From 050bf328e9b65279a3f2533201136e4651f2601c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Nov 2024 10:35:18 +0800 +Subject: HID: usbkbd: Fix the bit shift number for LED_KANA + +From: junan + +[ Upstream commit d73a4bfa2881a6859b384b75a414c33d4898b055 ] + +Since "LED_KANA" was defined as "0x04", the shift number should be "4". + +Signed-off-by: junan +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/usbhid/usbkbd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hid/usbhid/usbkbd.c b/drivers/hid/usbhid/usbkbd.c +index df02002066cef..1d94d246f8162 100644 +--- a/drivers/hid/usbhid/usbkbd.c ++++ b/drivers/hid/usbhid/usbkbd.c +@@ -160,7 +160,7 @@ static int usb_kbd_event(struct input_dev *dev, unsigned int type, + return -1; + + spin_lock_irqsave(&kbd->leds_lock, flags); +- kbd->newleds = (!!test_bit(LED_KANA, dev->led) << 3) | (!!test_bit(LED_COMPOSE, dev->led) << 3) | ++ kbd->newleds = (!!test_bit(LED_KANA, dev->led) << 4) | (!!test_bit(LED_COMPOSE, dev->led) << 3) | + (!!test_bit(LED_SCROLLL, dev->led) << 2) | (!!test_bit(LED_CAPSL, dev->led) << 1) | + (!!test_bit(LED_NUML, dev->led)); + +-- +2.39.5 + diff --git a/queue-5.15/hwmon-gpio-fan-add-missing-mutex-locks.patch b/queue-5.15/hwmon-gpio-fan-add-missing-mutex-locks.patch new file mode 100644 index 0000000000..5b52387838 --- /dev/null +++ b/queue-5.15/hwmon-gpio-fan-add-missing-mutex-locks.patch @@ -0,0 +1,75 @@ +From c33073eb03e0864f0011fc6cf9ef9425384590fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Feb 2025 15:59:30 +0100 +Subject: hwmon: (gpio-fan) Add missing mutex locks + +From: Alexander Stein + +[ Upstream commit 9fee7d19bab635f89223cc40dfd2c8797fdc4988 ] + +set_fan_speed() is expected to be called with fan_data->lock being locked. +Add locking for proper synchronization. + +Signed-off-by: Alexander Stein +Link: https://lore.kernel.org/r/20250210145934.761280-3-alexander.stein@ew.tq-group.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/gpio-fan.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwmon/gpio-fan.c b/drivers/hwmon/gpio-fan.c +index fbf3f5a4ecb67..6d518c10723a0 100644 +--- a/drivers/hwmon/gpio-fan.c ++++ b/drivers/hwmon/gpio-fan.c +@@ -394,7 +394,12 @@ static int gpio_fan_set_cur_state(struct thermal_cooling_device *cdev, + if (state >= fan_data->num_speed) + return -EINVAL; + ++ mutex_lock(&fan_data->lock); ++ + set_fan_speed(fan_data, state); ++ ++ mutex_unlock(&fan_data->lock); ++ + return 0; + } + +@@ -490,7 +495,11 @@ MODULE_DEVICE_TABLE(of, of_gpio_fan_match); + + static void gpio_fan_stop(void *data) + { ++ struct gpio_fan_data *fan_data = data; ++ ++ mutex_lock(&fan_data->lock); + set_fan_speed(data, 0); ++ mutex_unlock(&fan_data->lock); + } + + static int gpio_fan_probe(struct platform_device *pdev) +@@ -564,7 +573,9 @@ static int gpio_fan_suspend(struct device *dev) + + if (fan_data->gpios) { + fan_data->resume_speed = fan_data->speed_index; ++ mutex_lock(&fan_data->lock); + set_fan_speed(fan_data, 0); ++ mutex_unlock(&fan_data->lock); + } + + return 0; +@@ -574,8 +585,11 @@ static int gpio_fan_resume(struct device *dev) + { + struct gpio_fan_data *fan_data = dev_get_drvdata(dev); + +- if (fan_data->gpios) ++ if (fan_data->gpios) { ++ mutex_lock(&fan_data->lock); + set_fan_speed(fan_data, fan_data->resume_speed); ++ mutex_unlock(&fan_data->lock); ++ } + + return 0; + } +-- +2.39.5 + diff --git a/queue-5.15/hwmon-xgene-hwmon-use-appropriate-type-for-the-laten.patch b/queue-5.15/hwmon-xgene-hwmon-use-appropriate-type-for-the-laten.patch new file mode 100644 index 0000000000..fb21919e57 --- /dev/null +++ b/queue-5.15/hwmon-xgene-hwmon-use-appropriate-type-for-the-laten.patch @@ -0,0 +1,45 @@ +From 47dc4c4491df8a43e163ef5e5bcaf5432437e237 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Feb 2025 09:54:08 +0000 +Subject: hwmon: (xgene-hwmon) use appropriate type for the latency value + +From: Andrey Vatoropin + +[ Upstream commit 8df0f002827e18632dcd986f7546c1abf1953a6f ] + +The expression PCC_NUM_RETRIES * pcc_chan->latency is currently being +evaluated using 32-bit arithmetic. + +Since a value of type 'u64' is used to store the eventual result, +and this result is later sent to the function usecs_to_jiffies with +input parameter unsigned int, the current data type is too wide to +store the value of ctx->usecs_lat. + +Change the data type of "usecs_lat" to a more suitable (narrower) type. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Andrey Vatoropin +Link: https://lore.kernel.org/r/20250204095400.95013-1-a.vatoropin@crpt.ru +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/xgene-hwmon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/xgene-hwmon.c b/drivers/hwmon/xgene-hwmon.c +index 60a8ff56c38e9..9e82ba43f5cd2 100644 +--- a/drivers/hwmon/xgene-hwmon.c ++++ b/drivers/hwmon/xgene-hwmon.c +@@ -110,7 +110,7 @@ struct xgene_hwmon_dev { + + phys_addr_t comm_base_addr; + void *pcc_comm_addr; +- u64 usecs_lat; ++ unsigned int usecs_lat; + }; + + /* +-- +2.39.5 + diff --git a/queue-5.15/i2c-pxa-fix-call-balance-of-i2c-clk-handling-routine.patch b/queue-5.15/i2c-pxa-fix-call-balance-of-i2c-clk-handling-routine.patch new file mode 100644 index 0000000000..9db547aeb4 --- /dev/null +++ b/queue-5.15/i2c-pxa-fix-call-balance-of-i2c-clk-handling-routine.patch @@ -0,0 +1,41 @@ +From 56972dc1629c97af4ea89cd17e1e0fe906466637 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Feb 2025 20:28:03 +0300 +Subject: i2c: pxa: fix call balance of i2c->clk handling routines + +From: Vitalii Mordan + +[ Upstream commit be7113d2e2a6f20cbee99c98d261a1fd6fd7b549 ] + +If the clock i2c->clk was not enabled in i2c_pxa_probe(), it should not be +disabled in any path. + +Found by Linux Verification Center (linuxtesting.org) with Klever. + +Signed-off-by: Vitalii Mordan +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20250212172803.1422136-1-mordan@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-pxa.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c +index 35ca2c02c9b9b..7fdc7f213b114 100644 +--- a/drivers/i2c/busses/i2c-pxa.c ++++ b/drivers/i2c/busses/i2c-pxa.c +@@ -1508,7 +1508,10 @@ static int i2c_pxa_probe(struct platform_device *dev) + i2c->adap.name); + } + +- clk_prepare_enable(i2c->clk); ++ ret = clk_prepare_enable(i2c->clk); ++ if (ret) ++ return dev_err_probe(&dev->dev, ret, ++ "failed to enable clock\n"); + + if (i2c->use_pio) { + i2c->adap.algo = &i2c_pxa_pio_algorithm; +-- +2.39.5 + diff --git a/queue-5.15/i2c-qup-vote-for-interconnect-bandwidth-to-dram.patch b/queue-5.15/i2c-qup-vote-for-interconnect-bandwidth-to-dram.patch new file mode 100644 index 0000000000..feaf27d4af --- /dev/null +++ b/queue-5.15/i2c-qup-vote-for-interconnect-bandwidth-to-dram.patch @@ -0,0 +1,139 @@ +From 6ea00ca12b4c421944ecb568ca3e654eab33449a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 10:48:37 +0100 +Subject: i2c: qup: Vote for interconnect bandwidth to DRAM + +From: Stephan Gerhold + +[ Upstream commit d4f35233a6345f62637463ef6e0708f44ffaa583 ] + +When the I2C QUP controller is used together with a DMA engine it needs +to vote for the interconnect path to the DRAM. Otherwise it may be +unable to access the memory quickly enough. + +The requested peak bandwidth is dependent on the I2C core clock. + +To avoid sending votes too often the bandwidth is always requested when +a DMA transfer starts, but dropped only on runtime suspend. Runtime +suspend should only happen if no transfer is active. After resumption we +can defer the next vote until the first DMA transfer actually happens. + +The implementation is largely identical to the one introduced for +spi-qup in commit ecdaa9473019 ("spi: qup: Vote for interconnect +bandwidth to DRAM") since both drivers represent the same hardware +block. + +Signed-off-by: Stephan Gerhold +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20231128-i2c-qup-dvfs-v1-3-59a0e3039111@kernkonzept.com +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-qup.c | 36 ++++++++++++++++++++++++++++++++++++ + 1 file changed, 36 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-qup.c b/drivers/i2c/busses/i2c-qup.c +index b89eca2398d90..a2fb9dd58c95d 100644 +--- a/drivers/i2c/busses/i2c-qup.c ++++ b/drivers/i2c/busses/i2c-qup.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -150,6 +151,8 @@ + /* TAG length for DATA READ in RX FIFO */ + #define READ_RX_TAGS_LEN 2 + ++#define QUP_BUS_WIDTH 8 ++ + static unsigned int scl_freq; + module_param_named(scl_freq, scl_freq, uint, 0444); + MODULE_PARM_DESC(scl_freq, "SCL frequency override"); +@@ -227,6 +230,7 @@ struct qup_i2c_dev { + int irq; + struct clk *clk; + struct clk *pclk; ++ struct icc_path *icc_path; + struct i2c_adapter adap; + + int clk_ctl; +@@ -255,6 +259,10 @@ struct qup_i2c_dev { + /* To configure when bus is in run state */ + u32 config_run; + ++ /* bandwidth votes */ ++ u32 src_clk_freq; ++ u32 cur_bw_clk_freq; ++ + /* dma parameters */ + bool is_dma; + /* To check if the current transfer is using DMA */ +@@ -453,6 +461,23 @@ static int qup_i2c_bus_active(struct qup_i2c_dev *qup, int len) + return ret; + } + ++static int qup_i2c_vote_bw(struct qup_i2c_dev *qup, u32 clk_freq) ++{ ++ u32 needed_peak_bw; ++ int ret; ++ ++ if (qup->cur_bw_clk_freq == clk_freq) ++ return 0; ++ ++ needed_peak_bw = Bps_to_icc(clk_freq * QUP_BUS_WIDTH); ++ ret = icc_set_bw(qup->icc_path, 0, needed_peak_bw); ++ if (ret) ++ return ret; ++ ++ qup->cur_bw_clk_freq = clk_freq; ++ return 0; ++} ++ + static void qup_i2c_write_tx_fifo_v1(struct qup_i2c_dev *qup) + { + struct qup_i2c_block *blk = &qup->blk; +@@ -840,6 +865,10 @@ static int qup_i2c_bam_xfer(struct i2c_adapter *adap, struct i2c_msg *msg, + int ret = 0; + int idx = 0; + ++ ret = qup_i2c_vote_bw(qup, qup->src_clk_freq); ++ if (ret) ++ return ret; ++ + enable_irq(qup->irq); + ret = qup_i2c_req_dma(qup); + +@@ -1645,6 +1674,7 @@ static void qup_i2c_disable_clocks(struct qup_i2c_dev *qup) + config = readl(qup->base + QUP_CONFIG); + config |= QUP_CLOCK_AUTO_GATE; + writel(config, qup->base + QUP_CONFIG); ++ qup_i2c_vote_bw(qup, 0); + clk_disable_unprepare(qup->pclk); + } + +@@ -1745,6 +1775,11 @@ static int qup_i2c_probe(struct platform_device *pdev) + goto fail_dma; + } + qup->is_dma = true; ++ ++ qup->icc_path = devm_of_icc_get(&pdev->dev, NULL); ++ if (IS_ERR(qup->icc_path)) ++ return dev_err_probe(&pdev->dev, PTR_ERR(qup->icc_path), ++ "failed to get interconnect path\n"); + } + + nodma: +@@ -1793,6 +1828,7 @@ static int qup_i2c_probe(struct platform_device *pdev) + qup_i2c_enable_clocks(qup); + src_clk_freq = clk_get_rate(qup->clk); + } ++ qup->src_clk_freq = src_clk_freq; + + /* + * Bootloaders might leave a pending interrupt on certain QUP's, +-- +2.39.5 + diff --git a/queue-5.15/i3c-master-svc-fix-missing-stop-for-master-request.patch b/queue-5.15/i3c-master-svc-fix-missing-stop-for-master-request.patch new file mode 100644 index 0000000000..02bec85f13 --- /dev/null +++ b/queue-5.15/i3c-master-svc-fix-missing-stop-for-master-request.patch @@ -0,0 +1,37 @@ +From 47c99f03e36ca4f68c9ac20fc014f37936642d5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Mar 2025 13:36:06 +0800 +Subject: i3c: master: svc: Fix missing STOP for master request + +From: Stanley Chu + +[ Upstream commit 0430bf9bc1ac068c8b8c540eb93e5751872efc51 ] + +The controller driver nacked the master request but didn't emit a +STOP to end the transaction. The driver shall refuse the unsupported +requests and return the controller state to IDLE by emitting a STOP. + +Signed-off-by: Stanley Chu +Reviewed-by: Frank Li +Link: https://lore.kernel.org/r/20250318053606.3087121-4-yschu@nuvoton.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/svc-i3c-master.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c +index 368429a34d600..92488ba5b5f2a 100644 +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -437,6 +437,7 @@ static void svc_i3c_master_ibi_work(struct work_struct *work) + queue_work(master->base.wq, &master->hj_work); + break; + case SVC_I3C_MSTATUS_IBITYPE_MASTER_REQUEST: ++ svc_i3c_master_emit_stop(master); + default: + break; + } +-- +2.39.5 + diff --git a/queue-5.15/ieee802154-ca8210-use-proper-setters-and-getters-for.patch b/queue-5.15/ieee802154-ca8210-use-proper-setters-and-getters-for.patch new file mode 100644 index 0000000000..2c02dabe75 --- /dev/null +++ b/queue-5.15/ieee802154-ca8210-use-proper-setters-and-getters-for.patch @@ -0,0 +1,77 @@ +From 934152706a956df754ea99d932edb7a71ae2246c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Mar 2025 12:55:34 +0200 +Subject: ieee802154: ca8210: Use proper setters and getters for bitwise types + +From: Andy Shevchenko + +[ Upstream commit 169b2262205836a5d1213ff44dca2962276bece1 ] + +Sparse complains that the driver doesn't respect the bitwise types: + +drivers/net/ieee802154/ca8210.c:1796:27: warning: incorrect type in assignment (different base types) +drivers/net/ieee802154/ca8210.c:1796:27: expected restricted __le16 [addressable] [assigned] [usertype] pan_id +drivers/net/ieee802154/ca8210.c:1796:27: got unsigned short [usertype] +drivers/net/ieee802154/ca8210.c:1801:25: warning: incorrect type in assignment (different base types) +drivers/net/ieee802154/ca8210.c:1801:25: expected restricted __le16 [addressable] [assigned] [usertype] pan_id +drivers/net/ieee802154/ca8210.c:1801:25: got unsigned short [usertype] +drivers/net/ieee802154/ca8210.c:1928:28: warning: incorrect type in argument 3 (different base types) +drivers/net/ieee802154/ca8210.c:1928:28: expected unsigned short [usertype] dst_pan_id +drivers/net/ieee802154/ca8210.c:1928:28: got restricted __le16 [addressable] [usertype] pan_id + +Use proper setters and getters for bitwise types. + +Note, in accordance with [1] the protocol is little endian. + +Link: https://www.cascoda.com/wp-content/uploads/2018/11/CA-8210_datasheet_0418.pdf [1] +Reviewed-by: Miquel Raynal +Reviewed-by: Linus Walleij +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/20250305105656.2133487-2-andriy.shevchenko@linux.intel.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +--- + drivers/net/ieee802154/ca8210.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c +index d6dafd9876d24..ef8904a0530b5 100644 +--- a/drivers/net/ieee802154/ca8210.c ++++ b/drivers/net/ieee802154/ca8210.c +@@ -1488,8 +1488,7 @@ static u8 mcps_data_request( + command.pdata.data_req.src_addr_mode = src_addr_mode; + command.pdata.data_req.dst.mode = dst_address_mode; + if (dst_address_mode != MAC_MODE_NO_ADDR) { +- command.pdata.data_req.dst.pan_id[0] = LS_BYTE(dst_pan_id); +- command.pdata.data_req.dst.pan_id[1] = MS_BYTE(dst_pan_id); ++ put_unaligned_le16(dst_pan_id, command.pdata.data_req.dst.pan_id); + if (dst_address_mode == MAC_MODE_SHORT_ADDR) { + command.pdata.data_req.dst.address[0] = LS_BYTE( + dst_addr->short_address +@@ -1838,12 +1837,12 @@ static int ca8210_skb_rx( + } + hdr.source.mode = data_ind[0]; + dev_dbg(&priv->spi->dev, "srcAddrMode: %#03x\n", hdr.source.mode); +- hdr.source.pan_id = *(u16 *)&data_ind[1]; ++ hdr.source.pan_id = cpu_to_le16(get_unaligned_le16(&data_ind[1])); + dev_dbg(&priv->spi->dev, "srcPanId: %#06x\n", hdr.source.pan_id); + memcpy(&hdr.source.extended_addr, &data_ind[3], 8); + hdr.dest.mode = data_ind[11]; + dev_dbg(&priv->spi->dev, "dstAddrMode: %#03x\n", hdr.dest.mode); +- hdr.dest.pan_id = *(u16 *)&data_ind[12]; ++ hdr.dest.pan_id = cpu_to_le16(get_unaligned_le16(&data_ind[12])); + dev_dbg(&priv->spi->dev, "dstPanId: %#06x\n", hdr.dest.pan_id); + memcpy(&hdr.dest.extended_addr, &data_ind[14], 8); + +@@ -1970,7 +1969,7 @@ static int ca8210_skb_tx( + status = mcps_data_request( + header.source.mode, + header.dest.mode, +- header.dest.pan_id, ++ le16_to_cpu(header.dest.pan_id), + (union macaddr *)&header.dest.extended_addr, + skb->len - mac_len, + &skb->data[mac_len], +-- +2.39.5 + diff --git a/queue-5.15/ip-fib_rules-fetch-net-from-fib_rule-in-fib-46-_rule.patch b/queue-5.15/ip-fib_rules-fetch-net-from-fib_rule-in-fib-46-_rule.patch new file mode 100644 index 0000000000..9534d81ef3 --- /dev/null +++ b/queue-5.15/ip-fib_rules-fetch-net-from-fib_rule-in-fib-46-_rule.patch @@ -0,0 +1,61 @@ +From e0da55fd51b849956dc4ade1d206c26794741008 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Feb 2025 16:24:58 +0900 +Subject: ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). + +From: Kuniyuki Iwashima + +[ Upstream commit 5a1ccffd30a08f5a2428cd5fbb3ab03e8eb6c66d ] + +The following patch will not set skb->sk from VRF path. + +Let's fetch net from fib_rule->fr_net instead of sock_net(skb->sk) +in fib[46]_rule_configure(). + +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Reviewed-by: Ido Schimmel +Tested-by: Ido Schimmel +Link: https://patch.msgid.link/20250207072502.87775-5-kuniyu@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/fib_rules.c | 4 ++-- + net/ipv6/fib6_rules.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c +index d279cb8ac1584..a270951386e19 100644 +--- a/net/ipv4/fib_rules.c ++++ b/net/ipv4/fib_rules.c +@@ -226,9 +226,9 @@ static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb, + struct nlattr **tb, + struct netlink_ext_ack *extack) + { +- struct net *net = sock_net(skb->sk); ++ struct fib4_rule *rule4 = (struct fib4_rule *)rule; ++ struct net *net = rule->fr_net; + int err = -EINVAL; +- struct fib4_rule *rule4 = (struct fib4_rule *) rule; + + if (frh->tos & ~IPTOS_TOS_MASK) { + NL_SET_ERR_MSG(extack, "Invalid tos"); +diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c +index a4caaead74c1d..a20ef3ab059ca 100644 +--- a/net/ipv6/fib6_rules.c ++++ b/net/ipv6/fib6_rules.c +@@ -353,9 +353,9 @@ static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb, + struct nlattr **tb, + struct netlink_ext_ack *extack) + { ++ struct fib6_rule *rule6 = (struct fib6_rule *)rule; ++ struct net *net = rule->fr_net; + int err = -EINVAL; +- struct net *net = sock_net(skb->sk); +- struct fib6_rule *rule6 = (struct fib6_rule *) rule; + + if (rule->action == FR_ACT_TO_TBL && !rule->l3mdev) { + if (rule->table == RT6_TABLE_UNSPEC) { +-- +2.39.5 + diff --git a/queue-5.15/ipv4-fib-move-fib_valid_key_len-to-rtm_to_fib_config.patch b/queue-5.15/ipv4-fib-move-fib_valid_key_len-to-rtm_to_fib_config.patch new file mode 100644 index 0000000000..5f43ffa461 --- /dev/null +++ b/queue-5.15/ipv4-fib-move-fib_valid_key_len-to-rtm_to_fib_config.patch @@ -0,0 +1,128 @@ +From b2ee5cfc1a41e941516fbcdeba7e64ef86acc0e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Feb 2025 20:23:27 -0800 +Subject: ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config(). + +From: Kuniyuki Iwashima + +[ Upstream commit 254ba7e6032d3fc738050d500b0c1d8197af90ca ] + +fib_valid_key_len() is called in the beginning of fib_table_insert() +or fib_table_delete() to check if the prefix length is valid. + +fib_table_insert() and fib_table_delete() are called from 3 paths + + - ip_rt_ioctl() + - inet_rtm_newroute() / inet_rtm_delroute() + - fib_magic() + +In the first ioctl() path, rtentry_to_fib_config() checks the prefix +length with bad_mask(). Also, fib_magic() always passes the correct +prefix: 32 or ifa->ifa_prefixlen, which is already validated. + +Let's move fib_valid_key_len() to the rtnetlink path, rtm_to_fib_config(). + +While at it, 2 direct returns in rtm_to_fib_config() are changed to +goto to match other places in the same function + +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Reviewed-by: David Ahern +Link: https://patch.msgid.link/20250228042328.96624-12-kuniyu@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/fib_frontend.c | 18 ++++++++++++++++-- + net/ipv4/fib_trie.c | 22 ---------------------- + 2 files changed, 16 insertions(+), 24 deletions(-) + +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index 545dd994f0609..ced6bd48bb416 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -817,19 +817,33 @@ static int rtm_to_fib_config(struct net *net, struct sk_buff *skb, + } + } + ++ if (cfg->fc_dst_len > 32) { ++ NL_SET_ERR_MSG(extack, "Invalid prefix length"); ++ err = -EINVAL; ++ goto errout; ++ } ++ ++ if (cfg->fc_dst_len < 32 && (ntohl(cfg->fc_dst) << cfg->fc_dst_len)) { ++ NL_SET_ERR_MSG(extack, "Invalid prefix for given prefix length"); ++ err = -EINVAL; ++ goto errout; ++ } ++ + if (cfg->fc_nh_id) { + if (cfg->fc_oif || cfg->fc_gw_family || + cfg->fc_encap || cfg->fc_mp) { + NL_SET_ERR_MSG(extack, + "Nexthop specification and nexthop id are mutually exclusive"); +- return -EINVAL; ++ err = -EINVAL; ++ goto errout; + } + } + + if (has_gw && has_via) { + NL_SET_ERR_MSG(extack, + "Nexthop configuration can not contain both GATEWAY and VIA"); +- return -EINVAL; ++ err = -EINVAL; ++ goto errout; + } + + if (!cfg->fc_table) +diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c +index ec0113ecf3949..8ab6ad65d0b86 100644 +--- a/net/ipv4/fib_trie.c ++++ b/net/ipv4/fib_trie.c +@@ -1187,22 +1187,6 @@ static int fib_insert_alias(struct trie *t, struct key_vector *tp, + return 0; + } + +-static bool fib_valid_key_len(u32 key, u8 plen, struct netlink_ext_ack *extack) +-{ +- if (plen > KEYLENGTH) { +- NL_SET_ERR_MSG(extack, "Invalid prefix length"); +- return false; +- } +- +- if ((plen < KEYLENGTH) && (key << plen)) { +- NL_SET_ERR_MSG(extack, +- "Invalid prefix for given prefix length"); +- return false; +- } +- +- return true; +-} +- + static void fib_remove_alias(struct trie *t, struct key_vector *tp, + struct key_vector *l, struct fib_alias *old); + +@@ -1223,9 +1207,6 @@ int fib_table_insert(struct net *net, struct fib_table *tb, + + key = ntohl(cfg->fc_dst); + +- if (!fib_valid_key_len(key, plen, extack)) +- return -EINVAL; +- + pr_debug("Insert table=%u %08x/%d\n", tb->tb_id, key, plen); + + fi = fib_create_info(cfg, extack); +@@ -1715,9 +1696,6 @@ int fib_table_delete(struct net *net, struct fib_table *tb, + + key = ntohl(cfg->fc_dst); + +- if (!fib_valid_key_len(key, plen, extack)) +- return -EINVAL; +- + l = fib_find_node(t, &tp, key); + if (!l) + return -ESRCH; +-- +2.39.5 + diff --git a/queue-5.15/ipv6-save-dontfrag-in-cork.patch b/queue-5.15/ipv6-save-dontfrag-in-cork.patch new file mode 100644 index 0000000000..7f141088ff --- /dev/null +++ b/queue-5.15/ipv6-save-dontfrag-in-cork.patch @@ -0,0 +1,103 @@ +From b6cd4b709c1bdc805e0aa145975f1992d1ecf925 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Mar 2025 22:34:09 -0500 +Subject: ipv6: save dontfrag in cork + +From: Willem de Bruijn + +[ Upstream commit a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a ] + +When spanning datagram construction over multiple send calls using +MSG_MORE, per datagram settings are configured on the first send. + +That is when ip(6)_setup_cork stores these settings for subsequent use +in __ip(6)_append_data and others. + +The only flag that escaped this was dontfrag. As a result, a datagram +could be constructed with df=0 on the first sendmsg, but df=1 on a +next. Which is what cmsg_ip.sh does in an upcoming MSG_MORE test in +the "diff" scenario. + +Changing datagram conditions in the middle of constructing an skb +makes this already complex code path even more convoluted. It is here +unintentional. Bring this flag in line with expected sockopt/cmsg +behavior. + +And stop passing ipc6 to __ip6_append_data, to avoid such issues +in the future. This is already the case for __ip_append_data. + +inet6_cork had a 6 byte hole, so the 1B flag has no impact. + +Signed-off-by: Willem de Bruijn +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20250307033620.411611-3-willemdebruijn.kernel@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/linux/ipv6.h | 1 + + net/ipv6/ip6_output.c | 9 +++++---- + 2 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h +index b6fb76568b01a..5dfd663b70a26 100644 +--- a/include/linux/ipv6.h ++++ b/include/linux/ipv6.h +@@ -195,6 +195,7 @@ struct inet6_cork { + struct ipv6_txoptions *opt; + u8 hop_limit; + u8 tclass; ++ u8 dontfrag:1; + }; + + /** +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 4fcff4fe5a98f..a71b7a1069958 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -1428,6 +1428,7 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork, + cork->fl.u.ip6 = *fl6; + v6_cork->hop_limit = ipc6->hlimit; + v6_cork->tclass = ipc6->tclass; ++ v6_cork->dontfrag = ipc6->dontfrag; + if (rt->dst.flags & DST_XFRM_TUNNEL) + mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ? + READ_ONCE(rt->dst.dev->mtu) : dst_mtu(&rt->dst); +@@ -1462,7 +1463,7 @@ static int __ip6_append_data(struct sock *sk, + int getfrag(void *from, char *to, int offset, + int len, int odd, struct sk_buff *skb), + void *from, size_t length, int transhdrlen, +- unsigned int flags, struct ipcm6_cookie *ipc6) ++ unsigned int flags) + { + struct sk_buff *skb, *skb_prev = NULL; + unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu, pmtu; +@@ -1519,7 +1520,7 @@ static int __ip6_append_data(struct sock *sk, + if (headersize + transhdrlen > mtu) + goto emsgsize; + +- if (cork->length + length > mtu - headersize && ipc6->dontfrag && ++ if (cork->length + length > mtu - headersize && v6_cork->dontfrag && + (sk->sk_protocol == IPPROTO_UDP || + sk->sk_protocol == IPPROTO_RAW)) { + ipv6_local_rxpmtu(sk, fl6, mtu - headersize + +@@ -1836,7 +1837,7 @@ int ip6_append_data(struct sock *sk, + + return __ip6_append_data(sk, fl6, &sk->sk_write_queue, &inet->cork.base, + &np->cork, sk_page_frag(sk), getfrag, +- from, length, transhdrlen, flags, ipc6); ++ from, length, transhdrlen, flags); + } + EXPORT_SYMBOL_GPL(ip6_append_data); + +@@ -2031,7 +2032,7 @@ struct sk_buff *ip6_make_skb(struct sock *sk, + err = __ip6_append_data(sk, fl6, &queue, &cork->base, &v6_cork, + ¤t->task_frag, getfrag, from, + length + exthdrlen, transhdrlen + exthdrlen, +- flags, ipc6); ++ flags); + if (err) { + __ip6_flush_pending_frames(sk, &queue, cork, &v6_cork); + return ERR_PTR(err); +-- +2.39.5 + diff --git a/queue-5.15/kbuild-fix-argument-parsing-in-scripts-config.patch b/queue-5.15/kbuild-fix-argument-parsing-in-scripts-config.patch new file mode 100644 index 0000000000..c8149fa68d --- /dev/null +++ b/queue-5.15/kbuild-fix-argument-parsing-in-scripts-config.patch @@ -0,0 +1,82 @@ +From dd26d08f99f87aa40e541ed5ffdc06bc3bd131da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Mar 2025 17:21:37 -0500 +Subject: kbuild: fix argument parsing in scripts/config + +From: Seyediman Seyedarab + +[ Upstream commit f757f6011c92b5a01db742c39149bed9e526478f ] + +The script previously assumed --file was always the first argument, +which caused issues when it appeared later. This patch updates the +parsing logic to scan all arguments to find --file, sets the config +file correctly, and resets the argument list with the remaining +commands. + +It also fixes --refresh to respect --file by passing KCONFIG_CONFIG=$FN +to make oldconfig. + +Signed-off-by: Seyediman Seyedarab +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/config | 26 ++++++++++++++++---------- + 1 file changed, 16 insertions(+), 10 deletions(-) + +diff --git a/scripts/config b/scripts/config +index ff88e2faefd35..ea475c07de283 100755 +--- a/scripts/config ++++ b/scripts/config +@@ -32,6 +32,7 @@ commands: + Disable option directly after other option + --module-after|-M beforeopt option + Turn option into module directly after other option ++ --refresh Refresh the config using old settings + + commands can be repeated multiple times + +@@ -124,16 +125,22 @@ undef_var() { + txt_delete "^# $name is not set" "$FN" + } + +-if [ "$1" = "--file" ]; then +- FN="$2" +- if [ "$FN" = "" ] ; then +- usage ++FN=.config ++CMDS=() ++while [[ $# -gt 0 ]]; do ++ if [ "$1" = "--file" ]; then ++ if [ "$2" = "" ]; then ++ usage ++ fi ++ FN="$2" ++ shift 2 ++ else ++ CMDS+=("$1") ++ shift + fi +- shift 2 +-else +- FN=.config +-fi ++done + ++set -- "${CMDS[@]}" + if [ "$1" = "" ] ; then + usage + fi +@@ -217,9 +224,8 @@ while [ "$1" != "" ] ; do + set_var "${CONFIG_}$B" "${CONFIG_}$B=m" "${CONFIG_}$A" + ;; + +- # undocumented because it ignores --file (fixme) + --refresh) +- yes "" | make oldconfig ++ yes "" | make oldconfig KCONFIG_CONFIG=$FN + ;; + + *) +-- +2.39.5 + diff --git a/queue-5.15/kconfig-merge_config-use-an-empty-file-as-initfile.patch b/queue-5.15/kconfig-merge_config-use-an-empty-file-as-initfile.patch new file mode 100644 index 0000000000..528375a67a --- /dev/null +++ b/queue-5.15/kconfig-merge_config-use-an-empty-file-as-initfile.patch @@ -0,0 +1,48 @@ +From 466c678012178d3512b1d0b7f3c4edc993bc04b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Mar 2025 14:28:37 +0000 +Subject: kconfig: merge_config: use an empty file as initfile + +From: Daniel Gomez + +[ Upstream commit a26fe287eed112b4e21e854f173c8918a6a8596d ] + +The scripts/kconfig/merge_config.sh script requires an existing +$INITFILE (or the $1 argument) as a base file for merging Kconfig +fragments. However, an empty $INITFILE can serve as an initial starting +point, later referenced by the KCONFIG_ALLCONFIG Makefile variable +if -m is not used. This variable can point to any configuration file +containing preset config symbols (the merged output) as stated in +Documentation/kbuild/kconfig.rst. When -m is used $INITFILE will +contain just the merge output requiring the user to run make (i.e. +KCONFIG_ALLCONFIG=<$INITFILE> make or make +olddefconfig). + +Instead of failing when `$INITFILE` is missing, create an empty file and +use it as the starting point for merges. + +Signed-off-by: Daniel Gomez +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/kconfig/merge_config.sh | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/scripts/kconfig/merge_config.sh b/scripts/kconfig/merge_config.sh +index 72da3b8d6f307..151f9938abaa7 100755 +--- a/scripts/kconfig/merge_config.sh ++++ b/scripts/kconfig/merge_config.sh +@@ -105,8 +105,8 @@ INITFILE=$1 + shift; + + if [ ! -r "$INITFILE" ]; then +- echo "The base file '$INITFILE' does not exist. Exit." >&2 +- exit 1 ++ echo "The base file '$INITFILE' does not exist. Creating one..." >&2 ++ touch "$INITFILE" + fi + + MERGE_LIST=$* +-- +2.39.5 + diff --git a/queue-5.15/libbpf-fix-ldx-stx-st-co-re-relocation-size-adjustme.patch b/queue-5.15/libbpf-fix-ldx-stx-st-co-re-relocation-size-adjustme.patch new file mode 100644 index 0000000000..ba9e99bff6 --- /dev/null +++ b/queue-5.15/libbpf-fix-ldx-stx-st-co-re-relocation-size-adjustme.patch @@ -0,0 +1,92 @@ +From d9f5a2f2b181f4c4c10ebdb485919eb918f6adf9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Feb 2025 17:48:08 -0800 +Subject: libbpf: fix LDX/STX/ST CO-RE relocation size adjustment logic + +From: Andrii Nakryiko + +[ Upstream commit 06096d19ee3897a7e70922580159607fe315da7a ] + +Libbpf has a somewhat obscure feature of automatically adjusting the +"size" of LDX/STX/ST instruction (memory store and load instructions), +based on originally recorded access size (u8, u16, u32, or u64) and the +actual size of the field on target kernel. This is meant to facilitate +using BPF CO-RE on 32-bit architectures (pointers are always 64-bit in +BPF, but host kernel's BTF will have it as 32-bit type), as well as +generally supporting safe type changes (unsigned integer type changes +can be transparently "relocated"). + +One issue that surfaced only now, 5 years after this logic was +implemented, is how this all works when dealing with fields that are +arrays. This isn't all that easy and straightforward to hit (see +selftests that reproduce this condition), but one of sched_ext BPF +programs did hit it with innocent looking loop. + +Long story short, libbpf used to calculate entire array size, instead of +making sure to only calculate array's element size. But it's the element +that is loaded by LDX/STX/ST instructions (1, 2, 4, or 8 bytes), so +that's what libbpf should check. This patch adjusts the logic for +arrays and fixed the issue. + +Reported-by: Emil Tsalapatis +Signed-off-by: Andrii Nakryiko +Acked-by: Eduard Zingerman +Link: https://lore.kernel.org/r/20250207014809.1573841-1-andrii@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/relo_core.c | 24 ++++++++++++++++++++---- + 1 file changed, 20 insertions(+), 4 deletions(-) + +diff --git a/tools/lib/bpf/relo_core.c b/tools/lib/bpf/relo_core.c +index 4016ed492d0c2..72eb47bf7f1ca 100644 +--- a/tools/lib/bpf/relo_core.c ++++ b/tools/lib/bpf/relo_core.c +@@ -563,7 +563,7 @@ static int bpf_core_calc_field_relo(const char *prog_name, + { + const struct bpf_core_accessor *acc; + const struct btf_type *t; +- __u32 byte_off, byte_sz, bit_off, bit_sz, field_type_id; ++ __u32 byte_off, byte_sz, bit_off, bit_sz, field_type_id, elem_id; + const struct btf_member *m; + const struct btf_type *mt; + bool bitfield; +@@ -586,8 +586,14 @@ static int bpf_core_calc_field_relo(const char *prog_name, + if (!acc->name) { + if (relo->kind == BPF_FIELD_BYTE_OFFSET) { + *val = spec->bit_offset / 8; +- /* remember field size for load/store mem size */ +- sz = btf__resolve_size(spec->btf, acc->type_id); ++ /* remember field size for load/store mem size; ++ * note, for arrays we care about individual element ++ * sizes, not the overall array size ++ */ ++ t = skip_mods_and_typedefs(spec->btf, acc->type_id, &elem_id); ++ while (btf_is_array(t)) ++ t = skip_mods_and_typedefs(spec->btf, btf_array(t)->type, &elem_id); ++ sz = btf__resolve_size(spec->btf, elem_id); + if (sz < 0) + return -EINVAL; + *field_sz = sz; +@@ -647,7 +653,17 @@ static int bpf_core_calc_field_relo(const char *prog_name, + case BPF_FIELD_BYTE_OFFSET: + *val = byte_off; + if (!bitfield) { +- *field_sz = byte_sz; ++ /* remember field size for load/store mem size; ++ * note, for arrays we care about individual element ++ * sizes, not the overall array size ++ */ ++ t = skip_mods_and_typedefs(spec->btf, field_type_id, &elem_id); ++ while (btf_is_array(t)) ++ t = skip_mods_and_typedefs(spec->btf, btf_array(t)->type, &elem_id); ++ sz = btf__resolve_size(spec->btf, elem_id); ++ if (sz < 0) ++ return -EINVAL; ++ *field_sz = sz; + *type_id = field_type_id; + } + break; +-- +2.39.5 + diff --git a/queue-5.15/libbpf-fix-out-of-bound-read.patch b/queue-5.15/libbpf-fix-out-of-bound-read.patch new file mode 100644 index 0000000000..30b11df653 --- /dev/null +++ b/queue-5.15/libbpf-fix-out-of-bound-read.patch @@ -0,0 +1,43 @@ +From 606310f6756a512a9ede2b324d2bc5d1bd367912 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Feb 2025 02:31:11 +0530 +Subject: libbpf: Fix out-of-bound read + +From: Nandakumar Edamana + +[ Upstream commit 236d3910117e9f97ebf75e511d8bcc950f1a4e5f ] + +In `set_kcfg_value_str`, an untrusted string is accessed with the assumption +that it will be at least two characters long due to the presence of checks for +opening and closing quotes. But the check for the closing quote +(value[len - 1] != '"') misses the fact that it could be checking the opening +quote itself in case of an invalid input that consists of just the opening +quote. + +This commit adds an explicit check to make sure the string is at least two +characters long. + +Signed-off-by: Nandakumar Edamana +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250221210110.3182084-1-nandakumar@nandakumar.co.in +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index 294fdba9c76f7..40e0d84e3d8ed 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -1567,7 +1567,7 @@ static int set_kcfg_value_str(struct extern_desc *ext, char *ext_val, + } + + len = strlen(value); +- if (value[len - 1] != '"') { ++ if (len < 2 || value[len - 1] != '"') { + pr_warn("extern (kcfg) '%s': invalid string config '%s'\n", + ext->name, value); + return -EINVAL; +-- +2.39.5 + diff --git a/queue-5.15/libnvdimm-labels-fix-divide-error-in-nd_label_data_i.patch b/queue-5.15/libnvdimm-labels-fix-divide-error-in-nd_label_data_i.patch new file mode 100644 index 0000000000..ae3ede5875 --- /dev/null +++ b/queue-5.15/libnvdimm-labels-fix-divide-error-in-nd_label_data_i.patch @@ -0,0 +1,64 @@ +From 32fc7a03bae482980c1c34be7995b1afb27ade31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Mar 2025 12:22:22 +0100 +Subject: libnvdimm/labels: Fix divide error in nd_label_data_init() + +From: Robert Richter + +[ Upstream commit ef1d3455bbc1922f94a91ed58d3d7db440652959 ] + +If a faulty CXL memory device returns a broken zero LSA size in its +memory device information (Identify Memory Device (Opcode 4000h), CXL +spec. 3.1, 8.2.9.9.1.1), a divide error occurs in the libnvdimm +driver: + + Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI + RIP: 0010:nd_label_data_init+0x10e/0x800 [libnvdimm] + +Code and flow: + +1) CXL Command 4000h returns LSA size = 0 +2) config_size is assigned to zero LSA size (CXL pmem driver): + +drivers/cxl/pmem.c: .config_size = mds->lsa_size, + +3) max_xfer is set to zero (nvdimm driver): + +drivers/nvdimm/label.c: max_xfer = min_t(size_t, ndd->nsarea.max_xfer, config_size); + +4) A subsequent DIV_ROUND_UP() causes a division by zero: + +drivers/nvdimm/label.c: /* Make our initial read size a multiple of max_xfer size */ +drivers/nvdimm/label.c: read_size = min(DIV_ROUND_UP(read_size, max_xfer) * max_xfer, +drivers/nvdimm/label.c- config_size); + +Fix this by checking the config size parameter by extending an +existing check. + +Signed-off-by: Robert Richter +Reviewed-by: Pankaj Gupta +Reviewed-by: Ira Weiny +Link: https://patch.msgid.link/20250320112223.608320-1-rrichter@amd.com +Signed-off-by: Ira Weiny +Signed-off-by: Sasha Levin +--- + drivers/nvdimm/label.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c +index 7f473f9db300d..e1b511d09295f 100644 +--- a/drivers/nvdimm/label.c ++++ b/drivers/nvdimm/label.c +@@ -437,7 +437,8 @@ int nd_label_data_init(struct nvdimm_drvdata *ndd) + if (ndd->data) + return 0; + +- if (ndd->nsarea.status || ndd->nsarea.max_xfer == 0) { ++ if (ndd->nsarea.status || ndd->nsarea.max_xfer == 0 || ++ ndd->nsarea.config_size == 0) { + dev_dbg(ndd->dev, "failed to init config data area: (%u:%u)\n", + ndd->nsarea.max_xfer, ndd->nsarea.config_size); + return -ENXIO; +-- +2.39.5 + diff --git a/queue-5.15/lockdep-fix-wait-context-check-on-softirq-for-preemp.patch b/queue-5.15/lockdep-fix-wait-context-check-on-softirq-for-preemp.patch new file mode 100644 index 0000000000..ec3c53fe05 --- /dev/null +++ b/queue-5.15/lockdep-fix-wait-context-check-on-softirq-for-preemp.patch @@ -0,0 +1,99 @@ +From 09a49dc6ec346ecf2cfe045e776f030fd4bb03ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Mar 2025 07:33:22 -0700 +Subject: lockdep: Fix wait context check on softirq for PREEMPT_RT + +From: Ryo Takakura + +[ Upstream commit 61c39d8c83e2077f33e0a2c8980a76a7f323f0ce ] + +Since: + + 0c1d7a2c2d32 ("lockdep: Remove softirq accounting on PREEMPT_RT.") + +the wait context test for mutex usage within "in softirq context" fails +as it references @softirq_context: + + | wait context tests | + -------------------------------------------------------------------------- + | rcu | raw | spin |mutex | + -------------------------------------------------------------------------- + in hardirq context: ok | ok | ok | ok | + in hardirq context (not threaded): ok | ok | ok | ok | + in softirq context: ok | ok | ok |FAILED| + +As a fix, add lockdep map for BH disabled section. This fixes the +issue by letting us catch cases when local_bh_disable() gets called +with preemption disabled where local_lock doesn't get acquired. +In the case of "in softirq context" selftest, local_bh_disable() was +being called with preemption disable as it's early in the boot. + +[ boqun: Move the lockdep annotations into __local_bh_*() to avoid false + positives because of unpaired local_bh_disable() reported by + Borislav Petkov and Peter Zijlstra, and make bh_lock_map + only exist for PREEMPT_RT. ] + +[ mingo: Restored authorship and improved the bh_lock_map definition. ] + +Signed-off-by: Ryo Takakura +Signed-off-by: Boqun Feng +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20250321143322.79651-1-boqun.feng@gmail.com +Signed-off-by: Sasha Levin +--- + kernel/softirq.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/kernel/softirq.c b/kernel/softirq.c +index dc60f0c66a25f..d63d827da2d6a 100644 +--- a/kernel/softirq.c ++++ b/kernel/softirq.c +@@ -140,6 +140,18 @@ static DEFINE_PER_CPU(struct softirq_ctrl, softirq_ctrl) = { + .lock = INIT_LOCAL_LOCK(softirq_ctrl.lock), + }; + ++#ifdef CONFIG_DEBUG_LOCK_ALLOC ++static struct lock_class_key bh_lock_key; ++struct lockdep_map bh_lock_map = { ++ .name = "local_bh", ++ .key = &bh_lock_key, ++ .wait_type_outer = LD_WAIT_FREE, ++ .wait_type_inner = LD_WAIT_CONFIG, /* PREEMPT_RT makes BH preemptible. */ ++ .lock_type = LD_LOCK_PERCPU, ++}; ++EXPORT_SYMBOL_GPL(bh_lock_map); ++#endif ++ + /** + * local_bh_blocked() - Check for idle whether BH processing is blocked + * +@@ -162,6 +174,8 @@ void __local_bh_disable_ip(unsigned long ip, unsigned int cnt) + + WARN_ON_ONCE(in_hardirq()); + ++ lock_map_acquire_read(&bh_lock_map); ++ + /* First entry of a task into a BH disabled section? */ + if (!current->softirq_disable_cnt) { + if (preemptible()) { +@@ -225,6 +239,8 @@ void __local_bh_enable_ip(unsigned long ip, unsigned int cnt) + WARN_ON_ONCE(in_irq()); + lockdep_assert_irqs_enabled(); + ++ lock_map_release(&bh_lock_map); ++ + local_irq_save(flags); + curcnt = __this_cpu_read(softirq_ctrl.cnt); + +@@ -275,6 +291,8 @@ static inline void ksoftirqd_run_begin(void) + /* Counterpart to ksoftirqd_run_begin() */ + static inline void ksoftirqd_run_end(void) + { ++ /* pairs with the lock_map_acquire_read() in ksoftirqd_run_begin() */ ++ lock_map_release(&bh_lock_map); + __local_bh_enable(SOFTIRQ_OFFSET, true); + WARN_ON_ONCE(in_interrupt()); + local_irq_enable(); +-- +2.39.5 + diff --git a/queue-5.15/mailbox-use-error-ret-code-of-of_parse_phandle_with_.patch b/queue-5.15/mailbox-use-error-ret-code-of-of_parse_phandle_with_.patch new file mode 100644 index 0000000000..43b9e5e6ab --- /dev/null +++ b/queue-5.15/mailbox-use-error-ret-code-of-of_parse_phandle_with_.patch @@ -0,0 +1,45 @@ +From 719f027c9be4a1485e32b9b1c6c70889fefc5fab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Feb 2025 08:27:13 +0000 +Subject: mailbox: use error ret code of of_parse_phandle_with_args() + +From: Tudor Ambarus + +[ Upstream commit 24fdd5074b205cfb0ef4cd0751a2d03031455929 ] + +In case of error, of_parse_phandle_with_args() returns -EINVAL when the +passed index is negative, or -ENOENT when the index is for an empty +phandle. The mailbox core overwrote the error return code with a less +precise -ENODEV. Use the error returned code from +of_parse_phandle_with_args(). + +Signed-off-by: Tudor Ambarus +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/mailbox.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c +index 4229b9b5da98f..6f54501dc7762 100644 +--- a/drivers/mailbox/mailbox.c ++++ b/drivers/mailbox/mailbox.c +@@ -350,11 +350,12 @@ struct mbox_chan *mbox_request_channel(struct mbox_client *cl, int index) + + mutex_lock(&con_mutex); + +- if (of_parse_phandle_with_args(dev->of_node, "mboxes", +- "#mbox-cells", index, &spec)) { ++ ret = of_parse_phandle_with_args(dev->of_node, "mboxes", "#mbox-cells", ++ index, &spec); ++ if (ret) { + dev_dbg(dev, "%s: can't parse \"mboxes\" property\n", __func__); + mutex_unlock(&con_mutex); +- return ERR_PTR(-ENODEV); ++ return ERR_PTR(ret); + } + + chan = ERR_PTR(-EPROBE_DEFER); +-- +2.39.5 + diff --git a/queue-5.15/media-c8sectpfe-call-of_node_put-i2c_bus-only-once-i.patch b/queue-5.15/media-c8sectpfe-call-of_node_put-i2c_bus-only-once-i.patch new file mode 100644 index 0000000000..741427a24d --- /dev/null +++ b/queue-5.15/media-c8sectpfe-call-of_node_put-i2c_bus-only-once-i.patch @@ -0,0 +1,45 @@ +From e4862ada55f381ec6700648b67c5514bcb925cd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Oct 2024 15:50:15 +0200 +Subject: media: c8sectpfe: Call of_node_put(i2c_bus) only once in + c8sectpfe_probe() + +From: Markus Elfring + +[ Upstream commit b773530a34df0687020520015057075f8b7b4ac4 ] + +An of_node_put(i2c_bus) call was immediately used after a pointer check +for an of_find_i2c_adapter_by_node() call in this function implementation. +Thus call such a function only once instead directly before the check. + +This issue was transformed by using the Coccinelle software. + +Signed-off-by: Markus Elfring +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c +index 88d0188397e7b..28aab5a8336e0 100644 +--- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c ++++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c +@@ -811,13 +811,12 @@ static int c8sectpfe_probe(struct platform_device *pdev) + } + tsin->i2c_adapter = + of_find_i2c_adapter_by_node(i2c_bus); ++ of_node_put(i2c_bus); + if (!tsin->i2c_adapter) { + dev_err(&pdev->dev, "No i2c adapter found\n"); +- of_node_put(i2c_bus); + ret = -ENODEV; + goto err_node_put; + } +- of_node_put(i2c_bus); + + tsin->rst_gpio = of_get_named_gpio(child, "reset-gpios", 0); + +-- +2.39.5 + diff --git a/queue-5.15/media-cx231xx-set-device_caps-for-417.patch b/queue-5.15/media-cx231xx-set-device_caps-for-417.patch new file mode 100644 index 0000000000..38e7bcdd81 --- /dev/null +++ b/queue-5.15/media-cx231xx-set-device_caps-for-417.patch @@ -0,0 +1,40 @@ +From 63f475082e744a17447955335e25afebe8888bd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Feb 2025 14:13:24 +0100 +Subject: media: cx231xx: set device_caps for 417 + +From: Hans Verkuil + +[ Upstream commit a79efc44b51432490538a55b9753a721f7d3ea42 ] + +The video_device for the MPEG encoder did not set device_caps. + +Add this, otherwise the video device can't be registered (you get a +WARN_ON instead). + +Not seen before since currently 417 support is disabled, but I found +this while experimenting with it. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/cx231xx/cx231xx-417.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/usb/cx231xx/cx231xx-417.c b/drivers/media/usb/cx231xx/cx231xx-417.c +index c5e21785fafe2..02343e88cc618 100644 +--- a/drivers/media/usb/cx231xx/cx231xx-417.c ++++ b/drivers/media/usb/cx231xx/cx231xx-417.c +@@ -1722,6 +1722,8 @@ static void cx231xx_video_dev_init( + vfd->lock = &dev->lock; + vfd->release = video_device_release_empty; + vfd->ctrl_handler = &dev->mpeg_ctrl_handler.hdl; ++ vfd->device_caps = V4L2_CAP_READWRITE | V4L2_CAP_STREAMING | ++ V4L2_CAP_VIDEO_CAPTURE; + video_set_drvdata(vfd, dev); + if (dev->tuner_type == TUNER_ABSENT) { + v4l2_disable_ioctl(vfd, VIDIOC_G_FREQUENCY); +-- +2.39.5 + diff --git a/queue-5.15/media-qcom-camss-csid-only-add-tpg-v4l2-ctrl-if-tpg-.patch b/queue-5.15/media-qcom-camss-csid-only-add-tpg-v4l2-ctrl-if-tpg-.patch new file mode 100644 index 0000000000..86af6c4881 --- /dev/null +++ b/queue-5.15/media-qcom-camss-csid-only-add-tpg-v4l2-ctrl-if-tpg-.patch @@ -0,0 +1,139 @@ +From bcbb42063ddaeeb3d16aa0a28cde7091ef4bc599 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 10:01:28 +0530 +Subject: media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is + available + +From: Depeng Shao + +[ Upstream commit 2f1361f862a68063f37362f1beb400e78e289581 ] + +There is no CSID TPG on some SoCs, so the v4l2 ctrl in CSID driver +shouldn't be registered. Checking the supported TPG modes to indicate +if the TPG hardware exists or not and only registering v4l2 ctrl for +CSID only when the TPG hardware is present. + +Signed-off-by: Depeng Shao +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../media/platform/qcom/camss/camss-csid.c | 60 +++++++++++-------- + 1 file changed, 35 insertions(+), 25 deletions(-) + +diff --git a/drivers/media/platform/qcom/camss/camss-csid.c b/drivers/media/platform/qcom/camss/camss-csid.c +index 2a294587ec9d9..5583cbea12f3f 100644 +--- a/drivers/media/platform/qcom/camss/camss-csid.c ++++ b/drivers/media/platform/qcom/camss/camss-csid.c +@@ -219,11 +219,13 @@ static int csid_set_stream(struct v4l2_subdev *sd, int enable) + int ret; + + if (enable) { +- ret = v4l2_ctrl_handler_setup(&csid->ctrls); +- if (ret < 0) { +- dev_err(csid->camss->dev, +- "could not sync v4l2 controls: %d\n", ret); +- return ret; ++ if (csid->testgen.nmodes != CSID_PAYLOAD_MODE_DISABLED) { ++ ret = v4l2_ctrl_handler_setup(&csid->ctrls); ++ if (ret < 0) { ++ dev_err(csid->camss->dev, ++ "could not sync v4l2 controls: %d\n", ret); ++ return ret; ++ } + } + + if (!csid->testgen.enabled && +@@ -298,7 +300,8 @@ static void csid_try_format(struct csid_device *csid, + break; + + case MSM_CSID_PAD_SRC: +- if (csid->testgen_mode->cur.val == 0) { ++ if (csid->testgen.nmodes == CSID_PAYLOAD_MODE_DISABLED || ++ csid->testgen_mode->cur.val == 0) { + /* Test generator is disabled, */ + /* keep pad formats in sync */ + u32 code = fmt->code; +@@ -348,7 +351,8 @@ static int csid_enum_mbus_code(struct v4l2_subdev *sd, + + code->code = csid->formats[code->index].code; + } else { +- if (csid->testgen_mode->cur.val == 0) { ++ if (csid->testgen.nmodes == CSID_PAYLOAD_MODE_DISABLED || ++ csid->testgen_mode->cur.val == 0) { + struct v4l2_mbus_framefmt *sink_fmt; + + sink_fmt = __csid_get_format(csid, sd_state, +@@ -707,7 +711,8 @@ static int csid_link_setup(struct media_entity *entity, + + /* If test generator is enabled */ + /* do not allow a link from CSIPHY to CSID */ +- if (csid->testgen_mode->cur.val != 0) ++ if (csid->testgen.nmodes != CSID_PAYLOAD_MODE_DISABLED && ++ csid->testgen_mode->cur.val != 0) + return -EBUSY; + + sd = media_entity_to_v4l2_subdev(remote->entity); +@@ -800,24 +805,27 @@ int msm_csid_register_entity(struct csid_device *csid, + MSM_CSID_NAME, csid->id); + v4l2_set_subdevdata(sd, csid); + +- ret = v4l2_ctrl_handler_init(&csid->ctrls, 1); +- if (ret < 0) { +- dev_err(dev, "Failed to init ctrl handler: %d\n", ret); +- return ret; +- } ++ if (csid->testgen.nmodes != CSID_PAYLOAD_MODE_DISABLED) { ++ ret = v4l2_ctrl_handler_init(&csid->ctrls, 1); ++ if (ret < 0) { ++ dev_err(dev, "Failed to init ctrl handler: %d\n", ret); ++ return ret; ++ } + +- csid->testgen_mode = v4l2_ctrl_new_std_menu_items(&csid->ctrls, +- &csid_ctrl_ops, V4L2_CID_TEST_PATTERN, +- csid->testgen.nmodes, 0, 0, +- csid->testgen.modes); ++ csid->testgen_mode = ++ v4l2_ctrl_new_std_menu_items(&csid->ctrls, ++ &csid_ctrl_ops, V4L2_CID_TEST_PATTERN, ++ csid->testgen.nmodes, 0, 0, ++ csid->testgen.modes); + +- if (csid->ctrls.error) { +- dev_err(dev, "Failed to init ctrl: %d\n", csid->ctrls.error); +- ret = csid->ctrls.error; +- goto free_ctrl; +- } ++ if (csid->ctrls.error) { ++ dev_err(dev, "Failed to init ctrl: %d\n", csid->ctrls.error); ++ ret = csid->ctrls.error; ++ goto free_ctrl; ++ } + +- csid->subdev.ctrl_handler = &csid->ctrls; ++ csid->subdev.ctrl_handler = &csid->ctrls; ++ } + + ret = csid_init_formats(sd, NULL); + if (ret < 0) { +@@ -848,7 +856,8 @@ int msm_csid_register_entity(struct csid_device *csid, + media_cleanup: + media_entity_cleanup(&sd->entity); + free_ctrl: +- v4l2_ctrl_handler_free(&csid->ctrls); ++ if (csid->testgen.nmodes != CSID_PAYLOAD_MODE_DISABLED) ++ v4l2_ctrl_handler_free(&csid->ctrls); + + return ret; + } +@@ -861,5 +870,6 @@ void msm_csid_unregister_entity(struct csid_device *csid) + { + v4l2_device_unregister_subdev(&csid->subdev); + media_entity_cleanup(&csid->subdev.entity); +- v4l2_ctrl_handler_free(&csid->ctrls); ++ if (csid->testgen.nmodes != CSID_PAYLOAD_MODE_DISABLED) ++ v4l2_ctrl_handler_free(&csid->ctrls); + } +-- +2.39.5 + diff --git a/queue-5.15/media-uvcvideo-add-sanity-check-to-uvc_ioctl_xu_ctrl.patch b/queue-5.15/media-uvcvideo-add-sanity-check-to-uvc_ioctl_xu_ctrl.patch new file mode 100644 index 0000000000..38839d0a5d --- /dev/null +++ b/queue-5.15/media-uvcvideo-add-sanity-check-to-uvc_ioctl_xu_ctrl.patch @@ -0,0 +1,42 @@ +From 840b5244f5fe1c5c909aaf950f0445375a7de2ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Feb 2025 11:55:51 +0000 +Subject: media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map + +From: Ricardo Ribalda + +[ Upstream commit 990262fdfce24d6055df9711424343d94d829e6a ] + +Do not process unknown data types. + +Tested-by: Yunke Cao +Reviewed-by: Hans de Goede +Signed-off-by: Ricardo Ribalda +Link: https://lore.kernel.org/r/20250203-uvc-roi-v17-15-5900a9fed613@chromium.org +Signed-off-by: Hans de Goede +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_v4l2.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c +index a86d470a9f98f..2f8b485ddde04 100644 +--- a/drivers/media/usb/uvc/uvc_v4l2.c ++++ b/drivers/media/usb/uvc/uvc_v4l2.c +@@ -35,6 +35,12 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain, + unsigned int size; + int ret; + ++ if (xmap->data_type > UVC_CTRL_DATA_TYPE_BITMASK) { ++ uvc_dbg(chain->dev, CONTROL, ++ "Unsupported UVC data type %u\n", xmap->data_type); ++ return -EINVAL; ++ } ++ + map = kzalloc(sizeof(*map), GFP_KERNEL); + if (map == NULL) + return -ENOMEM; +-- +2.39.5 + diff --git a/queue-5.15/media-v4l-memset-argument-to-0-before-calling-get_mb.patch b/queue-5.15/media-v4l-memset-argument-to-0-before-calling-get_mb.patch new file mode 100644 index 0000000000..7c2f2e395d --- /dev/null +++ b/queue-5.15/media-v4l-memset-argument-to-0-before-calling-get_mb.patch @@ -0,0 +1,55 @@ +From a0ee5c2e8eff59f725492420059207b0d31c40d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Dec 2024 10:48:49 +0200 +Subject: media: v4l: Memset argument to 0 before calling get_mbus_config pad + op + +From: Sakari Ailus + +[ Upstream commit 91d6a99acfa5ce9f95ede775074b80f7193bd717 ] + +Memset the config argument to get_mbus_config V4L2 sub-device pad +operation to zero before calling the operation. This ensures the callers +don't need to bother with it nor the implementations need to set all +fields that may not be relevant to them. + +Signed-off-by: Sakari Ailus +Reviewed-by: Tomi Valkeinen +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-subdev.c | 2 ++ + include/media/v4l2-subdev.h | 4 +++- + 2 files changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c +index 5d27a27cc2f24..6f2267625c7ea 100644 +--- a/drivers/media/v4l2-core/v4l2-subdev.c ++++ b/drivers/media/v4l2-core/v4l2-subdev.c +@@ -314,6 +314,8 @@ static int call_enum_dv_timings(struct v4l2_subdev *sd, + static int call_get_mbus_config(struct v4l2_subdev *sd, unsigned int pad, + struct v4l2_mbus_config *config) + { ++ memset(config, 0, sizeof(*config)); ++ + return check_pad(sd, pad) ? : + sd->ops->pad->get_mbus_config(sd, pad, config); + } +diff --git a/include/media/v4l2-subdev.h b/include/media/v4l2-subdev.h +index 9a476f902c425..262b5e5cebc4c 100644 +--- a/include/media/v4l2-subdev.h ++++ b/include/media/v4l2-subdev.h +@@ -714,7 +714,9 @@ struct v4l2_subdev_state { + * possible configuration from the remote end, likely calling + * this operation as close as possible to stream on time. The + * operation shall fail if the pad index it has been called on +- * is not valid or in case of unrecoverable failures. ++ * is not valid or in case of unrecoverable failures. The ++ * config argument has been memset to 0 just before calling ++ * the op. + * + * @set_mbus_config: set the media bus configuration of a remote sub-device. + * This operations is intended to allow, in combination with +-- +2.39.5 + diff --git a/queue-5.15/mips-pm-cps-use-per-cpu-variables-as-per-cpu-not-per.patch b/queue-5.15/mips-pm-cps-use-per-cpu-variables-as-per-cpu-not-per.patch new file mode 100644 index 0000000000..fe28d419c3 --- /dev/null +++ b/queue-5.15/mips-pm-cps-use-per-cpu-variables-as-per-cpu-not-per.patch @@ -0,0 +1,128 @@ +From 0abd239b6c2a9c9c556dd2e41c546566a23a439c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jan 2025 13:32:48 +0100 +Subject: MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core + +From: Paul Burton + +[ Upstream commit 00a134fc2bb4a5f8fada58cf7ff4259149691d64 ] + +The pm-cps code has up until now used per-CPU variables indexed by core, +rather than CPU number, in order to share data amongst sibling CPUs (ie. +VPs/threads in a core). This works fine for single cluster systems, but +with multi-cluster systems a core number is no longer unique in the +system, leading to sharing between CPUs that are not actually siblings. + +Avoid this issue by using per-CPU variables as they are more generally +used - ie. access them using CPU numbers rather than core numbers. +Sharing between siblings is then accomplished by: + - Assigning the same pointer to entries for each sibling CPU for the + nc_asm_enter & ready_count variables, which allow this by virtue of + being per-CPU pointers. + + - Indexing by the first CPU set in a CPUs cpu_sibling_map in the case + of pm_barrier, for which we can't use the previous approach because + the per-CPU variable is not a pointer. + +Signed-off-by: Paul Burton +Signed-off-by: Dragan Mladjenovic +Signed-off-by: Aleksandar Rikalo +Tested-by: Serge Semin +Tested-by: Gregory CLEMENT +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/pm-cps.c | 30 +++++++++++++++++------------- + 1 file changed, 17 insertions(+), 13 deletions(-) + +diff --git a/arch/mips/kernel/pm-cps.c b/arch/mips/kernel/pm-cps.c +index 9bf60d7d44d36..a7bcf2b814c86 100644 +--- a/arch/mips/kernel/pm-cps.c ++++ b/arch/mips/kernel/pm-cps.c +@@ -56,10 +56,7 @@ static DEFINE_PER_CPU_ALIGNED(u32*, ready_count); + /* Indicates online CPUs coupled with the current CPU */ + static DEFINE_PER_CPU_ALIGNED(cpumask_t, online_coupled); + +-/* +- * Used to synchronize entry to deep idle states. Actually per-core rather +- * than per-CPU. +- */ ++/* Used to synchronize entry to deep idle states */ + static DEFINE_PER_CPU_ALIGNED(atomic_t, pm_barrier); + + /* Saved CPU state across the CPS_PM_POWER_GATED state */ +@@ -118,9 +115,10 @@ int cps_pm_enter_state(enum cps_pm_state state) + cps_nc_entry_fn entry; + struct core_boot_config *core_cfg; + struct vpe_boot_config *vpe_cfg; ++ atomic_t *barrier; + + /* Check that there is an entry function for this state */ +- entry = per_cpu(nc_asm_enter, core)[state]; ++ entry = per_cpu(nc_asm_enter, cpu)[state]; + if (!entry) + return -EINVAL; + +@@ -156,7 +154,7 @@ int cps_pm_enter_state(enum cps_pm_state state) + smp_mb__after_atomic(); + + /* Create a non-coherent mapping of the core ready_count */ +- core_ready_count = per_cpu(ready_count, core); ++ core_ready_count = per_cpu(ready_count, cpu); + nc_addr = kmap_noncoherent(virt_to_page(core_ready_count), + (unsigned long)core_ready_count); + nc_addr += ((unsigned long)core_ready_count & ~PAGE_MASK); +@@ -164,7 +162,8 @@ int cps_pm_enter_state(enum cps_pm_state state) + + /* Ensure ready_count is zero-initialised before the assembly runs */ + WRITE_ONCE(*nc_core_ready_count, 0); +- coupled_barrier(&per_cpu(pm_barrier, core), online); ++ barrier = &per_cpu(pm_barrier, cpumask_first(&cpu_sibling_map[cpu])); ++ coupled_barrier(barrier, online); + + /* Run the generated entry code */ + left = entry(online, nc_core_ready_count); +@@ -635,12 +634,14 @@ static void *cps_gen_entry_code(unsigned cpu, enum cps_pm_state state) + + static int cps_pm_online_cpu(unsigned int cpu) + { +- enum cps_pm_state state; +- unsigned core = cpu_core(&cpu_data[cpu]); ++ unsigned int sibling, core; + void *entry_fn, *core_rc; ++ enum cps_pm_state state; ++ ++ core = cpu_core(&cpu_data[cpu]); + + for (state = CPS_PM_NC_WAIT; state < CPS_PM_STATE_COUNT; state++) { +- if (per_cpu(nc_asm_enter, core)[state]) ++ if (per_cpu(nc_asm_enter, cpu)[state]) + continue; + if (!test_bit(state, state_support)) + continue; +@@ -652,16 +653,19 @@ static int cps_pm_online_cpu(unsigned int cpu) + clear_bit(state, state_support); + } + +- per_cpu(nc_asm_enter, core)[state] = entry_fn; ++ for_each_cpu(sibling, &cpu_sibling_map[cpu]) ++ per_cpu(nc_asm_enter, sibling)[state] = entry_fn; + } + +- if (!per_cpu(ready_count, core)) { ++ if (!per_cpu(ready_count, cpu)) { + core_rc = kmalloc(sizeof(u32), GFP_KERNEL); + if (!core_rc) { + pr_err("Failed allocate core %u ready_count\n", core); + return -ENOMEM; + } +- per_cpu(ready_count, core) = core_rc; ++ ++ for_each_cpu(sibling, &cpu_sibling_map[cpu]) ++ per_cpu(ready_count, sibling) = core_rc; + } + + return 0; +-- +2.39.5 + diff --git a/queue-5.15/mips-use-arch-specific-syscall-name-match-function.patch b/queue-5.15/mips-use-arch-specific-syscall-name-match-function.patch new file mode 100644 index 0000000000..6ec2d8632a --- /dev/null +++ b/queue-5.15/mips-use-arch-specific-syscall-name-match-function.patch @@ -0,0 +1,55 @@ +From 556dcd0a490ef9c47d17a71a1701df9152c85826 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jun 2020 10:54:35 +0800 +Subject: MIPS: Use arch specific syscall name match function + +From: Bibo Mao + +[ Upstream commit 756276ce78d5624dc814f9d99f7d16c8fd51076e ] + +On MIPS system, most of the syscall function name begin with prefix +sys_. Some syscalls are special such as clone/fork, function name of +these begin with __sys_. Since scratch registers need be saved in +stack when these system calls happens. + +With ftrace system call method, system call functions are declared with +SYSCALL_DEFINEx, metadata of the system call symbol name begins with +sys_. Here mips specific function arch_syscall_match_sym_name is used to +compare function name between sys_call_table[] and metadata of syscall +symbol. + +Signed-off-by: Bibo Mao +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/ftrace.h | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/arch/mips/include/asm/ftrace.h b/arch/mips/include/asm/ftrace.h +index db497a8167da2..e3212f44446fa 100644 +--- a/arch/mips/include/asm/ftrace.h ++++ b/arch/mips/include/asm/ftrace.h +@@ -87,4 +87,20 @@ struct dyn_arch_ftrace { + #endif /* CONFIG_DYNAMIC_FTRACE */ + #endif /* __ASSEMBLY__ */ + #endif /* CONFIG_FUNCTION_TRACER */ ++ ++#ifdef CONFIG_FTRACE_SYSCALLS ++#ifndef __ASSEMBLY__ ++/* ++ * Some syscall entry functions on mips start with "__sys_" (fork and clone, ++ * for instance). We should also match the sys_ variant with those. ++ */ ++#define ARCH_HAS_SYSCALL_MATCH_SYM_NAME ++static inline bool arch_syscall_match_sym_name(const char *sym, ++ const char *name) ++{ ++ return !strcmp(sym, name) || ++ (!strncmp(sym, "__sys_", 6) && !strcmp(sym + 6, name + 4)); ++} ++#endif /* __ASSEMBLY__ */ ++#endif /* CONFIG_FTRACE_SYSCALLS */ + #endif /* _ASM_MIPS_FTRACE_H */ +-- +2.39.5 + diff --git a/queue-5.15/mmc-host-wait-for-vdd-to-settle-on-card-power-off.patch b/queue-5.15/mmc-host-wait-for-vdd-to-settle-on-card-power-off.patch new file mode 100644 index 0000000000..1afd8fb6f3 --- /dev/null +++ b/queue-5.15/mmc-host-wait-for-vdd-to-settle-on-card-power-off.patch @@ -0,0 +1,46 @@ +From f9c08972af3b16fd46132c29cb77a1b363df2be3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Mar 2025 14:50:21 -0500 +Subject: mmc: host: Wait for Vdd to settle on card power off + +From: Erick Shepherd + +[ Upstream commit 31e75ed964582257f59156ce6a42860e1ae4cc39 ] + +The SD spec version 6.0 section 6.4.1.5 requires that Vdd must be +lowered to less than 0.5V for a minimum of 1 ms when powering off a +card. Increase wait to 15 ms so that voltage has time to drain down +to 0.5V and cards can power off correctly. Issues with voltage drain +time were only observed on Apollo Lake and Bay Trail host controllers +so this fix is limited to those devices. + +Signed-off-by: Erick Shepherd +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20250314195021.1588090-1-erick.shepherd@ni.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-pci-core.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c +index bdb82c1265edc..b4226ba1a1b33 100644 +--- a/drivers/mmc/host/sdhci-pci-core.c ++++ b/drivers/mmc/host/sdhci-pci-core.c +@@ -677,8 +677,12 @@ static void sdhci_intel_set_power(struct sdhci_host *host, unsigned char mode, + + sdhci_set_power(host, mode, vdd); + +- if (mode == MMC_POWER_OFF) ++ if (mode == MMC_POWER_OFF) { ++ if (slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_APL_SD || ++ slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_BYT_SD) ++ usleep_range(15000, 17500); + return; ++ } + + /* + * Bus power might not enable after D3 -> D0 transition due to the +-- +2.39.5 + diff --git a/queue-5.15/mmc-sdhci-disable-sd-card-clock-before-changing-para.patch b/queue-5.15/mmc-sdhci-disable-sd-card-clock-before-changing-para.patch new file mode 100644 index 0000000000..b8fd600226 --- /dev/null +++ b/queue-5.15/mmc-sdhci-disable-sd-card-clock-before-changing-para.patch @@ -0,0 +1,54 @@ +From a3cf906e7a072047ad0a4db7755239a11fb2a20c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Feb 2025 15:46:45 -0600 +Subject: mmc: sdhci: Disable SD card clock before changing parameters +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Erick Shepherd + +[ Upstream commit fb3bbc46c94f261b6156ee863c1b06c84cf157dc ] + +Per the SD Host Controller Simplified Specification v4.20 §3.2.3, change +the SD card clock parameters only after first disabling the external card +clock. Doing this fixes a spurious clock pulse on Baytrail and Apollo Lake +SD controllers which otherwise breaks voltage switching with a specific +Swissbit SD card. + +Signed-off-by: Kyle Roeschley +Signed-off-by: Brad Mouring +Signed-off-by: Erick Shepherd +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20250211214645.469279-1-erick.shepherd@ni.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index c0900b2f7b5c8..97eeb0c61baec 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -2009,10 +2009,15 @@ void sdhci_set_clock(struct sdhci_host *host, unsigned int clock) + + host->mmc->actual_clock = 0; + +- sdhci_writew(host, 0, SDHCI_CLOCK_CONTROL); ++ clk = sdhci_readw(host, SDHCI_CLOCK_CONTROL); ++ if (clk & SDHCI_CLOCK_CARD_EN) ++ sdhci_writew(host, clk & ~SDHCI_CLOCK_CARD_EN, ++ SDHCI_CLOCK_CONTROL); + +- if (clock == 0) ++ if (clock == 0) { ++ sdhci_writew(host, 0, SDHCI_CLOCK_CONTROL); + return; ++ } + + clk = sdhci_calc_clk(host, clock, &host->mmc->actual_clock); + sdhci_enable_clk(host, clk); +-- +2.39.5 + diff --git a/queue-5.15/net-enetc-refactor-bulk-flipping-of-rx-buffers-to-se.patch b/queue-5.15/net-enetc-refactor-bulk-flipping-of-rx-buffers-to-se.patch new file mode 100644 index 0000000000..45cb1a1ab3 --- /dev/null +++ b/queue-5.15/net-enetc-refactor-bulk-flipping-of-rx-buffers-to-se.patch @@ -0,0 +1,66 @@ +From 820fd8c2b2c437ef01e34bd8b9f6dc78abcb66d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Apr 2025 15:00:04 +0300 +Subject: net: enetc: refactor bulk flipping of RX buffers to separate function + +From: Vladimir Oltean + +[ Upstream commit 1d587faa5be7e9785b682cc5f58ba8f4100c13ea ] + +This small snippet of code ensures that we do something with the array +of RX software buffer descriptor elements after passing the skb to the +stack. In this case, we see if the other half of the page is reusable, +and if so, we "turn around" the buffers, making them directly usable by +enetc_refill_rx_ring() without going to enetc_new_page(). + +We will need to perform this kind of buffer flipping from a new code +path, i.e. from XDP_PASS. Currently, enetc_build_skb() does it there +buffer by buffer, but in a subsequent change we will stop using +enetc_build_skb() for XDP_PASS. + +Signed-off-by: Vladimir Oltean +Reviewed-by: Wei Fang +Link: https://patch.msgid.link/20250417120005.3288549-3-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/enetc/enetc.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c +index 612872c8c8e3c..1068a5ea17b7a 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc.c +@@ -1264,6 +1264,16 @@ static void enetc_xdp_drop(struct enetc_bdr *rx_ring, int rx_ring_first, + } + } + ++static void enetc_bulk_flip_buff(struct enetc_bdr *rx_ring, int rx_ring_first, ++ int rx_ring_last) ++{ ++ while (rx_ring_first != rx_ring_last) { ++ enetc_flip_rx_buff(rx_ring, ++ &rx_ring->rx_swbd[rx_ring_first]); ++ enetc_bdr_idx_inc(rx_ring, &rx_ring_first); ++ } ++} ++ + static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring, + struct napi_struct *napi, int work_limit, + struct bpf_prog *prog) +@@ -1379,11 +1389,7 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring, + enetc_xdp_drop(rx_ring, orig_i, i); + rx_ring->stats.xdp_redirect_failures++; + } else { +- while (orig_i != i) { +- enetc_flip_rx_buff(rx_ring, +- &rx_ring->rx_swbd[orig_i]); +- enetc_bdr_idx_inc(rx_ring, &orig_i); +- } ++ enetc_bulk_flip_buff(rx_ring, orig_i, i); + xdp_redirect_frm_cnt++; + rx_ring->stats.xdp_redirect++; + } +-- +2.39.5 + diff --git a/queue-5.15/net-ethernet-ti-cpsw_new-populate-netdev-of_node.patch b/queue-5.15/net-ethernet-ti-cpsw_new-populate-netdev-of_node.patch new file mode 100644 index 0000000000..dad4803c76 --- /dev/null +++ b/queue-5.15/net-ethernet-ti-cpsw_new-populate-netdev-of_node.patch @@ -0,0 +1,37 @@ +From a2cc81dc2438d4ea9db216ff3854862ad7f343c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Mar 2025 08:46:57 +0100 +Subject: net: ethernet: ti: cpsw_new: populate netdev of_node + +From: Alexander Sverdlin + +[ Upstream commit 7ff1c88fc89688c27f773ba956f65f0c11367269 ] + +So that of_find_net_device_by_node() can find CPSW ports and other DSA +switches can be stacked downstream. Tested in conjunction with KSZ8873. + +Reviewed-by: Siddharth Vadapalli +Reviewed-by: Andrew Lunn +Signed-off-by: Alexander Sverdlin +Link: https://patch.msgid.link/20250303074703.1758297-1-alexander.sverdlin@siemens.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/cpsw_new.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/ti/cpsw_new.c b/drivers/net/ethernet/ti/cpsw_new.c +index 13e34ad72f265..923746ba87a61 100644 +--- a/drivers/net/ethernet/ti/cpsw_new.c ++++ b/drivers/net/ethernet/ti/cpsw_new.c +@@ -1418,6 +1418,7 @@ static int cpsw_create_ports(struct cpsw_common *cpsw) + ndev->netdev_ops = &cpsw_netdev_ops; + ndev->ethtool_ops = &cpsw_ethtool_ops; + SET_NETDEV_DEV(ndev, dev); ++ ndev->dev.of_node = slave_data->slave_node; + + if (!napi_ndev) { + /* CPSW Host port CPDMA interface is shared between +-- +2.39.5 + diff --git a/queue-5.15/net-mana-fix-warning-in-the-writer-of-client-oob.patch b/queue-5.15/net-mana-fix-warning-in-the-writer-of-client-oob.patch new file mode 100644 index 0000000000..195818232b --- /dev/null +++ b/queue-5.15/net-mana-fix-warning-in-the-writer-of-client-oob.patch @@ -0,0 +1,37 @@ +From 3de7cc02271a9a73cd8b1b5e87f196c57af1e81c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jan 2025 09:27:14 -0800 +Subject: net/mana: fix warning in the writer of client oob + +From: Konstantin Taranov + +[ Upstream commit 5ec7e1c86c441c46a374577bccd9488abea30037 ] + +Do not warn on missing pad_data when oob is in sgl. + +Signed-off-by: Konstantin Taranov +Link: https://patch.msgid.link/1737394039-28772-9-git-send-email-kotaranov@linux.microsoft.com +Reviewed-by: Shiraz Saleem +Reviewed-by: Long Li +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/microsoft/mana/gdma_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c b/drivers/net/ethernet/microsoft/mana/gdma_main.c +index 0fb42193643dc..7864611f55a77 100644 +--- a/drivers/net/ethernet/microsoft/mana/gdma_main.c ++++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c +@@ -957,7 +957,7 @@ static u32 mana_gd_write_client_oob(const struct gdma_wqe_request *wqe_req, + header->inline_oob_size_div4 = client_oob_size / sizeof(u32); + + if (oob_in_sgl) { +- WARN_ON_ONCE(!pad_data || wqe_req->num_sge < 2); ++ WARN_ON_ONCE(wqe_req->num_sge < 2); + + header->client_oob_in_sgl = 1; + +-- +2.39.5 + diff --git a/queue-5.15/net-mlx4_core-avoid-impossible-mlx4_db_alloc-order-v.patch b/queue-5.15/net-mlx4_core-avoid-impossible-mlx4_db_alloc-order-v.patch new file mode 100644 index 0000000000..e0d26025ae --- /dev/null +++ b/queue-5.15/net-mlx4_core-avoid-impossible-mlx4_db_alloc-order-v.patch @@ -0,0 +1,78 @@ +From 524c5b23b03d5edb5d179ef21f4545791bb478b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Feb 2025 09:45:05 -0800 +Subject: net/mlx4_core: Avoid impossible mlx4_db_alloc() order value + +From: Kees Cook + +[ Upstream commit 4a6f18f28627e121bd1f74b5fcc9f945d6dbeb1e ] + +GCC can see that the value range for "order" is capped, but this leads +it to consider that it might be negative, leading to a false positive +warning (with GCC 15 with -Warray-bounds -fdiagnostics-details): + +../drivers/net/ethernet/mellanox/mlx4/alloc.c:691:47: error: array subscript -1 is below array bounds of 'long unsigned int *[2]' [-Werror=array-bounds=] + 691 | i = find_first_bit(pgdir->bits[o], MLX4_DB_PER_PAGE >> o); + | ~~~~~~~~~~~^~~ + 'mlx4_alloc_db_from_pgdir': events 1-2 + 691 | i = find_first_bit(pgdir->bits[o], MLX4_DB_PER_PAGE >> o); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + | | | | | (2) out of array bounds here + | (1) when the condition is evaluated to true In file included from ../drivers/net/ethernet/mellanox/mlx4/mlx4.h:53, + from ../drivers/net/ethernet/mellanox/mlx4/alloc.c:42: +../include/linux/mlx4/device.h:664:33: note: while referencing 'bits' + 664 | unsigned long *bits[2]; + | ^~~~ + +Switch the argument to unsigned int, which removes the compiler needing +to consider negative values. + +Signed-off-by: Kees Cook +Link: https://patch.msgid.link/20250210174504.work.075-kees@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/alloc.c | 6 +++--- + include/linux/mlx4/device.h | 2 +- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/alloc.c b/drivers/net/ethernet/mellanox/mlx4/alloc.c +index b330020dc0d67..f2bded847e61d 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/alloc.c ++++ b/drivers/net/ethernet/mellanox/mlx4/alloc.c +@@ -682,9 +682,9 @@ static struct mlx4_db_pgdir *mlx4_alloc_db_pgdir(struct device *dma_device) + } + + static int mlx4_alloc_db_from_pgdir(struct mlx4_db_pgdir *pgdir, +- struct mlx4_db *db, int order) ++ struct mlx4_db *db, unsigned int order) + { +- int o; ++ unsigned int o; + int i; + + for (o = order; o <= 1; ++o) { +@@ -712,7 +712,7 @@ static int mlx4_alloc_db_from_pgdir(struct mlx4_db_pgdir *pgdir, + return 0; + } + +-int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, int order) ++int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, unsigned int order) + { + struct mlx4_priv *priv = mlx4_priv(dev); + struct mlx4_db_pgdir *pgdir; +diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h +index 30bb59fe970cb..40ebf0502f427 100644 +--- a/include/linux/mlx4/device.h ++++ b/include/linux/mlx4/device.h +@@ -1115,7 +1115,7 @@ int mlx4_write_mtt(struct mlx4_dev *dev, struct mlx4_mtt *mtt, + int mlx4_buf_write_mtt(struct mlx4_dev *dev, struct mlx4_mtt *mtt, + struct mlx4_buf *buf); + +-int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, int order); ++int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, unsigned int order); + void mlx4_db_free(struct mlx4_dev *dev, struct mlx4_db *db); + + int mlx4_alloc_hwq_res(struct mlx4_dev *dev, struct mlx4_hwq_resources *wqres, +-- +2.39.5 + diff --git a/queue-5.15/net-mlx5-apply-rate-limiting-to-high-temperature-war.patch b/queue-5.15/net-mlx5-apply-rate-limiting-to-high-temperature-war.patch new file mode 100644 index 0000000000..c45653acf3 --- /dev/null +++ b/queue-5.15/net-mlx5-apply-rate-limiting-to-high-temperature-war.patch @@ -0,0 +1,45 @@ +From 2811659745a9d9745637d9a773102421eaf4d29d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2025 11:46:38 +0200 +Subject: net/mlx5: Apply rate-limiting to high temperature warning + +From: Shahar Shitrit + +[ Upstream commit 9dd3d5d258aceb37bdf09c8b91fa448f58ea81f0 ] + +Wrap the high temperature warning in a temperature event with +a call to net_ratelimit() to prevent flooding the kernel log +with repeated warning messages when temperature exceeds the +threshold multiple times within a short duration. + +Signed-off-by: Shahar Shitrit +Signed-off-by: Tariq Toukan +Reviewed-by: Mateusz Polchlopek +Link: https://patch.msgid.link/20250213094641.226501-2-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/events.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/events.c b/drivers/net/ethernet/mellanox/mlx5/core/events.c +index 080aee3e3f9bb..15d90d68b1ffd 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/events.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/events.c +@@ -166,9 +166,10 @@ static int temp_warn(struct notifier_block *nb, unsigned long type, void *data) + value_lsb &= 0x1; + value_msb = be64_to_cpu(eqe->data.temp_warning.sensor_warning_msb); + +- mlx5_core_warn(events->dev, +- "High temperature on sensors with bit set %llx %llx", +- value_msb, value_lsb); ++ if (net_ratelimit()) ++ mlx5_core_warn(events->dev, ++ "High temperature on sensors with bit set %llx %llx", ++ value_msb, value_lsb); + + return NOTIFY_OK; + } +-- +2.39.5 + diff --git a/queue-5.15/net-mlx5-avoid-report-two-health-errors-on-same-synd.patch b/queue-5.15/net-mlx5-avoid-report-two-health-errors-on-same-synd.patch new file mode 100644 index 0000000000..657b5d1a14 --- /dev/null +++ b/queue-5.15/net-mlx5-avoid-report-two-health-errors-on-same-synd.patch @@ -0,0 +1,42 @@ +From 47df2d70b7b1ffe1ffde8f1db87889a3c30dd1c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Feb 2025 14:25:40 +0200 +Subject: net/mlx5: Avoid report two health errors on same syndrome + +From: Moshe Shemesh + +[ Upstream commit b5d7b2f04ebcff740f44ef4d295b3401aeb029f4 ] + +In case health counter has not increased for few polling intervals, miss +counter will reach max misses threshold and health report will be +triggered for FW health reporter. In case syndrome found on same health +poll another health report will be triggered. + +Avoid two health reports on same syndrome by marking this syndrome as +already known. + +Signed-off-by: Moshe Shemesh +Reviewed-by: Shahar Shitrit +Signed-off-by: Tariq Toukan +Reviewed-by: Kalesh AP +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/health.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c +index 1504856fafde4..2a0b111fbcd3c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c +@@ -737,6 +737,7 @@ static void poll_health(struct timer_list *t) + health->prev = count; + if (health->miss_counter == MAX_MISSES) { + mlx5_core_err(dev, "device's health compromised - reached miss count\n"); ++ health->synd = ioread8(&h->synd); + print_health_info(dev); + queue_work(health->wq, &health->report_work); + } +-- +2.39.5 + diff --git a/queue-5.15/net-mlx5-extend-ethtool-loopback-selftest-to-support.patch b/queue-5.15/net-mlx5-extend-ethtool-loopback-selftest-to-support.patch new file mode 100644 index 0000000000..cea17b0831 --- /dev/null +++ b/queue-5.15/net-mlx5-extend-ethtool-loopback-selftest-to-support.patch @@ -0,0 +1,41 @@ +From 392b84cc5d2466238271b02f5c4f37ba42f37088 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Feb 2025 12:17:15 +0200 +Subject: net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB + +From: Alexei Lazar + +[ Upstream commit 95b9606b15bb3ce1198d28d2393dd0e1f0a5f3e9 ] + +Current loopback test validation ignores non-linear SKB case in +the SKB access, which can lead to failures in scenarios such as +when HW GRO is enabled. +Linearize the SKB so both cases will be handled. + +Signed-off-by: Alexei Lazar +Reviewed-by: Dragos Tatulea +Signed-off-by: Tariq Toukan +Link: https://patch.msgid.link/20250209101716.112774-15-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c +index ce8ab1f018769..c380340b81665 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c +@@ -188,6 +188,9 @@ mlx5e_test_loopback_validate(struct sk_buff *skb, + struct udphdr *udph; + struct iphdr *iph; + ++ if (skb_linearize(skb)) ++ goto out; ++ + /* We are only going to peek, no need to clone the SKB */ + if (MLX5E_TEST_PKT_SIZE - ETH_HLEN > skb_headlen(skb)) + goto out; +-- +2.39.5 + diff --git a/queue-5.15/net-mlx5-modify-lsb-bitmask-in-temperature-event-to-.patch b/queue-5.15/net-mlx5-modify-lsb-bitmask-in-temperature-event-to-.patch new file mode 100644 index 0000000000..6aba9891fe --- /dev/null +++ b/queue-5.15/net-mlx5-modify-lsb-bitmask-in-temperature-event-to-.patch @@ -0,0 +1,46 @@ +From c07a542f09add71624f6397c14c126b91909f8b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2025 11:46:40 +0200 +Subject: net/mlx5: Modify LSB bitmask in temperature event to include only the + first bit + +From: Shahar Shitrit + +[ Upstream commit 633f16d7e07c129a36b882c05379e01ce5bdb542 ] + +In the sensor_count field of the MTEWE register, bits 1-62 are +supported only for unmanaged switches, not for NICs, and bit 63 +is reserved for internal use. + +To prevent confusing output that may include set bits that are +not relevant to NIC sensors, we update the bitmask to retain only +the first bit, which corresponds to the sensor ASIC. + +Signed-off-by: Shahar Shitrit +Signed-off-by: Tariq Toukan +Reviewed-by: Mateusz Polchlopek +Link: https://patch.msgid.link/20250213094641.226501-4-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/events.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/events.c b/drivers/net/ethernet/mellanox/mlx5/core/events.c +index a1ac3a654962e..080aee3e3f9bb 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/events.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/events.c +@@ -160,6 +160,10 @@ static int temp_warn(struct notifier_block *nb, unsigned long type, void *data) + u64 value_msb; + + value_lsb = be64_to_cpu(eqe->data.temp_warning.sensor_warning_lsb); ++ /* bit 1-63 are not supported for NICs, ++ * hence read only bit 0 (asic) from lsb. ++ */ ++ value_lsb &= 0x1; + value_msb = be64_to_cpu(eqe->data.temp_warning.sensor_warning_msb); + + mlx5_core_warn(events->dev, +-- +2.39.5 + diff --git a/queue-5.15/net-mlx5e-reduce-rep-rxq-depth-to-256-for-ecpf.patch b/queue-5.15/net-mlx5e-reduce-rep-rxq-depth-to-256-for-ecpf.patch new file mode 100644 index 0000000000..d6e997c3ac --- /dev/null +++ b/queue-5.15/net-mlx5e-reduce-rep-rxq-depth-to-256-for-ecpf.patch @@ -0,0 +1,75 @@ +From 909e6606b1ef5aaa6e431b474d6dce46c0d60694 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Feb 2025 12:17:08 +0200 +Subject: net/mlx5e: reduce rep rxq depth to 256 for ECPF + +From: William Tu + +[ Upstream commit b9cc8f9d700867aaa77aedddfea85e53d5e5d584 ] + +By experiments, a single queue representor netdev consumes kernel +memory around 2.8MB, and 1.8MB out of the 2.8MB is due to page +pool for the RXQ. Scaling to a thousand representors consumes 2.8GB, +which becomes a memory pressure issue for embedded devices such as +BlueField-2 16GB / BlueField-3 32GB memory. + +Since representor netdevs mostly handles miss traffic, and ideally, +most of the traffic will be offloaded, reduce the default non-uplink +rep netdev's RXQ default depth from 1024 to 256 if mdev is ecpf eswitch +manager. This saves around 1MB of memory per regular RQ, +(1024 - 256) * 2KB, allocated from page pool. + +With rxq depth of 256, the netlink page pool tool reports +$./tools/net/ynl/cli.py --spec Documentation/netlink/specs/netdev.yaml \ + --dump page-pool-get + {'id': 277, + 'ifindex': 9, + 'inflight': 128, + 'inflight-mem': 786432, + 'napi-id': 775}] + +This is due to mtu 1500 + headroom consumes half pages, so 256 rxq +entries consumes around 128 pages (thus create a page pool with +size 128), shown above at inflight. + +Note that each netdev has multiple types of RQs, including +Regular RQ, XSK, PTP, Drop, Trap RQ. Since non-uplink representor +only supports regular rq, this patch only changes the regular RQ's +default depth. + +Signed-off-by: William Tu +Reviewed-by: Bodong Wang +Reviewed-by: Saeed Mahameed +Signed-off-by: Tariq Toukan +Reviewed-by: Michal Swiatkowski +Link: https://patch.msgid.link/20250209101716.112774-8-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +index 3c8bfedeafffd..8e44fa0d3f371 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +@@ -58,6 +58,7 @@ + #define MLX5E_REP_PARAMS_DEF_LOG_SQ_SIZE \ + max(0x7, MLX5E_PARAMS_MINIMUM_LOG_SQ_SIZE) + #define MLX5E_REP_PARAMS_DEF_NUM_CHANNELS 1 ++#define MLX5E_REP_PARAMS_DEF_LOG_RQ_SIZE 0x8 + + static const char mlx5e_rep_driver_name[] = "mlx5e_rep"; + +@@ -615,6 +616,8 @@ static void mlx5e_build_rep_params(struct net_device *netdev) + + /* RQ */ + mlx5e_build_rq_params(mdev, params); ++ if (!mlx5e_is_uplink_rep(priv) && mlx5_core_is_ecpf(mdev)) ++ params->log_rq_mtu_frames = MLX5E_REP_PARAMS_DEF_LOG_RQ_SIZE; + + /* CQ moderation params */ + params->rx_dim_enabled = MLX5_CAP_GEN(mdev, cq_moderation); +-- +2.39.5 + diff --git a/queue-5.15/net-mlx5e-set-the-tx_queue_len-for-pfifo_fast.patch b/queue-5.15/net-mlx5e-set-the-tx_queue_len-for-pfifo_fast.patch new file mode 100644 index 0000000000..192a9d53af --- /dev/null +++ b/queue-5.15/net-mlx5e-set-the-tx_queue_len-for-pfifo_fast.patch @@ -0,0 +1,44 @@ +From fcf39b74e953b0e15cffd610010f857786ff1d59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Feb 2025 12:17:09 +0200 +Subject: net/mlx5e: set the tx_queue_len for pfifo_fast + +From: William Tu + +[ Upstream commit a38cc5706fb9f7dc4ee3a443f61de13ce1e410ed ] + +By default, the mq netdev creates a pfifo_fast qdisc. On a +system with 16 core, the pfifo_fast with 3 bands consumes +16 * 3 * 8 (size of pointer) * 1024 (default tx queue len) += 393KB. The patch sets the tx qlen to representor default +value, 128 (1< +Reviewed-by: Daniel Jurgens +Signed-off-by: Tariq Toukan +Reviewed-by: Michal Swiatkowski +Link: https://patch.msgid.link/20250209101716.112774-9-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +index de168d8cf33f7..3c8bfedeafffd 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +@@ -642,6 +642,8 @@ static void mlx5e_build_rep_netdev(struct net_device *netdev, + netdev->ethtool_ops = &mlx5e_rep_ethtool_ops; + + netdev->watchdog_timeo = 15 * HZ; ++ if (mlx5_core_is_ecpf(mdev)) ++ netdev->tx_queue_len = 1 << MLX5E_REP_PARAMS_DEF_LOG_SQ_SIZE; + + #if IS_ENABLED(CONFIG_MLX5_CLS_ACT) + netdev->hw_features |= NETIF_F_HW_TC; +-- +2.39.5 + diff --git a/queue-5.15/net-pktgen-fix-access-outside-of-user-given-buffer-i.patch b/queue-5.15/net-pktgen-fix-access-outside-of-user-given-buffer-i.patch new file mode 100644 index 0000000000..4032098ade --- /dev/null +++ b/queue-5.15/net-pktgen-fix-access-outside-of-user-given-buffer-i.patch @@ -0,0 +1,50 @@ +From 073edbafc90057177ab20825bb9a567302f8390f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Feb 2025 09:45:27 +0100 +Subject: net: pktgen: fix access outside of user given buffer in + pktgen_thread_write() + +From: Peter Seiderer + +[ Upstream commit 425e64440ad0a2f03bdaf04be0ae53dededbaa77 ] + +Honour the user given buffer size for the strn_len() calls (otherwise +strn_len() will access memory outside of the user given buffer). + +Signed-off-by: Peter Seiderer +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250219084527.20488-8-ps.report@gmx.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/pktgen.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/net/core/pktgen.c b/net/core/pktgen.c +index 28417fe2a7a2a..2b7b1de70cf47 100644 +--- a/net/core/pktgen.c ++++ b/net/core/pktgen.c +@@ -1876,8 +1876,8 @@ static ssize_t pktgen_thread_write(struct file *file, + i = len; + + /* Read variable name */ +- +- len = strn_len(&user_buffer[i], sizeof(name) - 1); ++ max = min(sizeof(name) - 1, count - i); ++ len = strn_len(&user_buffer[i], max); + if (len < 0) + return len; + +@@ -1907,7 +1907,8 @@ static ssize_t pktgen_thread_write(struct file *file, + if (!strcmp(name, "add_device")) { + char f[32]; + memset(f, 0, 32); +- len = strn_len(&user_buffer[i], sizeof(f) - 1); ++ max = min(sizeof(f) - 1, count - i); ++ len = strn_len(&user_buffer[i], max); + if (len < 0) { + ret = len; + goto out; +-- +2.39.5 + diff --git a/queue-5.15/net-pktgen-fix-mpls-maximum-labels-list-parsing.patch b/queue-5.15/net-pktgen-fix-mpls-maximum-labels-list-parsing.patch new file mode 100644 index 0000000000..42d5e09a9e --- /dev/null +++ b/queue-5.15/net-pktgen-fix-mpls-maximum-labels-list-parsing.patch @@ -0,0 +1,52 @@ +From 7e023c81c851162ba6c7bb2c96d26e4a9d5748a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Feb 2025 14:56:00 +0100 +Subject: net: pktgen: fix mpls maximum labels list parsing + +From: Peter Seiderer + +[ Upstream commit 2b15a0693f70d1e8119743ee89edbfb1271b3ea8 ] + +Fix mpls maximum labels list parsing up to MAX_MPLS_LABELS entries (instead +of up to MAX_MPLS_LABELS - 1). + +Addresses the following: + + $ echo "mpls 00000f00,00000f01,00000f02,00000f03,00000f04,00000f05,00000f06,00000f07,00000f08,00000f09,00000f0a,00000f0b,00000f0c,00000f0d,00000f0e,00000f0f" > /proc/net/pktgen/lo\@0 + -bash: echo: write error: Argument list too long + +Signed-off-by: Peter Seiderer +Reviewed-by: Simon Horman +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/core/pktgen.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/core/pktgen.c b/net/core/pktgen.c +index 5d5f03471eb0c..28417fe2a7a2a 100644 +--- a/net/core/pktgen.c ++++ b/net/core/pktgen.c +@@ -896,6 +896,10 @@ static ssize_t get_labels(const char __user *buffer, struct pktgen_dev *pkt_dev) + pkt_dev->nr_labels = 0; + do { + __u32 tmp; ++ ++ if (n >= MAX_MPLS_LABELS) ++ return -E2BIG; ++ + len = hex32_arg(&buffer[i], 8, &tmp); + if (len <= 0) + return len; +@@ -907,8 +911,6 @@ static ssize_t get_labels(const char __user *buffer, struct pktgen_dev *pkt_dev) + return -EFAULT; + i++; + n++; +- if (n >= MAX_MPLS_LABELS) +- return -E2BIG; + } while (c == ','); + + pkt_dev->nr_labels = n; +-- +2.39.5 + diff --git a/queue-5.15/net-xgene-v2-remove-incorrect-acpi_ptr-annotation.patch b/queue-5.15/net-xgene-v2-remove-incorrect-acpi_ptr-annotation.patch new file mode 100644 index 0000000000..ea57871124 --- /dev/null +++ b/queue-5.15/net-xgene-v2-remove-incorrect-acpi_ptr-annotation.patch @@ -0,0 +1,47 @@ +From 0990c20086830467c9607e156ea4985fb46e563a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Feb 2025 17:33:33 +0100 +Subject: net: xgene-v2: remove incorrect ACPI_PTR annotation + +From: Arnd Bergmann + +[ Upstream commit 01358e8fe922f716c05d7864ac2213b2440026e7 ] + +Building with W=1 shows a warning about xge_acpi_match being unused when +CONFIG_ACPI is disabled: + +drivers/net/ethernet/apm/xgene-v2/main.c:723:36: error: unused variable 'xge_acpi_match' [-Werror,-Wunused-const-variable] + +Signed-off-by: Arnd Bergmann +Link: https://patch.msgid.link/20250225163341.4168238-2-arnd@kernel.org +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/apm/xgene-v2/main.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/apm/xgene-v2/main.c b/drivers/net/ethernet/apm/xgene-v2/main.c +index 80399c8980bd3..627f860141002 100644 +--- a/drivers/net/ethernet/apm/xgene-v2/main.c ++++ b/drivers/net/ethernet/apm/xgene-v2/main.c +@@ -9,8 +9,6 @@ + + #include "main.h" + +-static const struct acpi_device_id xge_acpi_match[]; +- + static int xge_get_resources(struct xge_pdata *pdata) + { + struct platform_device *pdev; +@@ -733,7 +731,7 @@ MODULE_DEVICE_TABLE(acpi, xge_acpi_match); + static struct platform_driver xge_driver = { + .driver = { + .name = "xgene-enet-v2", +- .acpi_match_table = ACPI_PTR(xge_acpi_match), ++ .acpi_match_table = xge_acpi_match, + }, + .probe = xge_probe, + .remove = xge_remove, +-- +2.39.5 + diff --git a/queue-5.15/netfilter-conntrack-bound-nf_conntrack-sysctl-writes.patch b/queue-5.15/netfilter-conntrack-bound-nf_conntrack-sysctl-writes.patch new file mode 100644 index 0000000000..8fbf156709 --- /dev/null +++ b/queue-5.15/netfilter-conntrack-bound-nf_conntrack-sysctl-writes.patch @@ -0,0 +1,85 @@ +From 430fedd7f5b32c48755515003f903f4062f2f32c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jan 2025 18:06:30 +0100 +Subject: netfilter: conntrack: Bound nf_conntrack sysctl writes + +From: Nicolas Bouchinet + +[ Upstream commit 8b6861390ffee6b8ed78b9395e3776c16fec6579 ] + +nf_conntrack_max and nf_conntrack_expect_max sysctls were authorized to +be written any negative value, which would then be stored in the +unsigned int variables nf_conntrack_max and nf_ct_expect_max variables. + +While the do_proc_dointvec_conv function is supposed to limit writing +handled by proc_dointvec proc_handler to INT_MAX. Such a negative value +being written in an unsigned int leads to a very high value, exceeding +this limit. + +Moreover, the nf_conntrack_expect_max sysctl documentation specifies the +minimum value is 1. + +The proc_handlers have thus been updated to proc_dointvec_minmax in +order to specify the following write bounds : + +* Bound nf_conntrack_max sysctl writings between SYSCTL_ZERO + and SYSCTL_INT_MAX. + +* Bound nf_conntrack_expect_max sysctl writings between SYSCTL_ONE + and SYSCTL_INT_MAX as defined in the sysctl documentation. + +With this patch applied, sysctl writes outside the defined in the bound +will thus lead to a write error : + +``` +sysctl -w net.netfilter.nf_conntrack_expect_max=-1 +sysctl: setting key "net.netfilter.nf_conntrack_expect_max": Invalid argument +``` + +Signed-off-by: Nicolas Bouchinet +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_standalone.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c +index 7515705583bcf..770590041c549 100644 +--- a/net/netfilter/nf_conntrack_standalone.c ++++ b/net/netfilter/nf_conntrack_standalone.c +@@ -629,7 +629,9 @@ static struct ctl_table nf_ct_sysctl_table[] = { + .data = &nf_conntrack_max, + .maxlen = sizeof(int), + .mode = 0644, +- .proc_handler = proc_dointvec, ++ .proc_handler = proc_dointvec_minmax, ++ .extra1 = SYSCTL_ZERO, ++ .extra2 = SYSCTL_INT_MAX, + }, + [NF_SYSCTL_CT_COUNT] = { + .procname = "nf_conntrack_count", +@@ -665,7 +667,9 @@ static struct ctl_table nf_ct_sysctl_table[] = { + .data = &nf_ct_expect_max, + .maxlen = sizeof(int), + .mode = 0644, +- .proc_handler = proc_dointvec, ++ .proc_handler = proc_dointvec_minmax, ++ .extra1 = SYSCTL_ONE, ++ .extra2 = SYSCTL_INT_MAX, + }, + [NF_SYSCTL_CT_ACCT] = { + .procname = "nf_conntrack_acct", +@@ -976,7 +980,9 @@ static struct ctl_table nf_ct_netfilter_table[] = { + .data = &nf_conntrack_max, + .maxlen = sizeof(int), + .mode = 0644, +- .proc_handler = proc_dointvec, ++ .proc_handler = proc_dointvec_minmax, ++ .extra1 = SYSCTL_ZERO, ++ .extra2 = SYSCTL_INT_MAX, + }, + { } + }; +-- +2.39.5 + diff --git a/queue-5.15/nfsv4-check-for-delegation-validity-in-nfs_start_del.patch b/queue-5.15/nfsv4-check-for-delegation-validity-in-nfs_start_del.patch new file mode 100644 index 0000000000..f388b69f34 --- /dev/null +++ b/queue-5.15/nfsv4-check-for-delegation-validity-in-nfs_start_del.patch @@ -0,0 +1,36 @@ +From 3e286b70a1916ad82ee552ebaf7def68b36832d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Mar 2025 19:20:53 -0400 +Subject: NFSv4: Check for delegation validity in + nfs_start_delegation_return_locked() + +From: Trond Myklebust + +[ Upstream commit 9e8f324bd44c1fe026b582b75213de4eccfa1163 ] + +Check that the delegation is still attached after taking the spin lock +in nfs_start_delegation_return_locked(). + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/delegation.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c +index 0c14ff09cfbe3..45ef1b6f868bf 100644 +--- a/fs/nfs/delegation.c ++++ b/fs/nfs/delegation.c +@@ -297,7 +297,8 @@ nfs_start_delegation_return_locked(struct nfs_inode *nfsi) + if (delegation == NULL) + goto out; + spin_lock(&delegation->lock); +- if (!test_and_set_bit(NFS_DELEGATION_RETURNING, &delegation->flags)) { ++ if (delegation->inode && ++ !test_and_set_bit(NFS_DELEGATION_RETURNING, &delegation->flags)) { + clear_bit(NFS_DELEGATION_RETURN_DELAYED, &delegation->flags); + /* Refcount matched in nfs_end_delegation_return() */ + ret = nfs_get_delegation(delegation); +-- +2.39.5 + diff --git a/queue-5.15/nfsv4-treat-enetunreach-errors-as-fatal-for-state-re.patch b/queue-5.15/nfsv4-treat-enetunreach-errors-as-fatal-for-state-re.patch new file mode 100644 index 0000000000..70a1cdacc3 --- /dev/null +++ b/queue-5.15/nfsv4-treat-enetunreach-errors-as-fatal-for-state-re.patch @@ -0,0 +1,46 @@ +From 316cd151bbf52b28dd4f678f05395be62bf40faa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Mar 2025 20:35:33 -0400 +Subject: NFSv4: Treat ENETUNREACH errors as fatal for state recovery + +From: Trond Myklebust + +[ Upstream commit 0af5fb5ed3d2fd9e110c6112271f022b744a849a ] + +If a containerised process is killed and causes an ENETUNREACH or +ENETDOWN error to be propagated to the state manager, then mark the +nfs_client as being dead so that we don't loop in functions that are +expecting recovery to succeed. + +Reviewed-by: Jeff Layton +Reviewed-by: Benjamin Coddington +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4state.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index 76e2cdddf95c1..b1dec7a9bd723 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -2726,7 +2726,15 @@ static void nfs4_state_manager(struct nfs_client *clp) + pr_warn_ratelimited("NFS: state manager%s%s failed on NFSv4 server %s" + " with error %d\n", section_sep, section, + clp->cl_hostname, -status); +- ssleep(1); ++ switch (status) { ++ case -ENETDOWN: ++ case -ENETUNREACH: ++ nfs_mark_client_ready(clp, -EIO); ++ break; ++ default: ++ ssleep(1); ++ break; ++ } + out_drain: + memalloc_nofs_restore(memflags); + nfs4_end_drain_session(clp); +-- +2.39.5 + diff --git a/queue-5.15/nvmet-tcp-don-t-restore-null-sk_state_change.patch b/queue-5.15/nvmet-tcp-don-t-restore-null-sk_state_change.patch new file mode 100644 index 0000000000..8d3fdf28e8 --- /dev/null +++ b/queue-5.15/nvmet-tcp-don-t-restore-null-sk_state_change.patch @@ -0,0 +1,227 @@ +From 0939e97a4eb83a479dd36ca2bc6faac2deb13f2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Apr 2025 16:06:21 +1000 +Subject: nvmet-tcp: don't restore null sk_state_change + +From: Alistair Francis + +[ Upstream commit 46d22b47df2741996af277a2838b95f130436c13 ] + +queue->state_change is set as part of nvmet_tcp_set_queue_sock(), but if +the TCP connection isn't established when nvmet_tcp_set_queue_sock() is +called then queue->state_change isn't set and sock->sk->sk_state_change +isn't replaced. + +As such we don't need to restore sock->sk->sk_state_change if +queue->state_change is NULL. + +This avoids NULL pointer dereferences such as this: + +[ 286.462026][ C0] BUG: kernel NULL pointer dereference, address: 0000000000000000 +[ 286.462814][ C0] #PF: supervisor instruction fetch in kernel mode +[ 286.463796][ C0] #PF: error_code(0x0010) - not-present page +[ 286.464392][ C0] PGD 8000000140620067 P4D 8000000140620067 PUD 114201067 PMD 0 +[ 286.465086][ C0] Oops: Oops: 0010 [#1] SMP KASAN PTI +[ 286.465559][ C0] CPU: 0 UID: 0 PID: 1628 Comm: nvme Not tainted 6.15.0-rc2+ #11 PREEMPT(voluntary) +[ 286.466393][ C0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 +[ 286.467147][ C0] RIP: 0010:0x0 +[ 286.467420][ C0] Code: Unable to access opcode bytes at 0xffffffffffffffd6. +[ 286.467977][ C0] RSP: 0018:ffff8883ae008580 EFLAGS: 00010246 +[ 286.468425][ C0] RAX: 0000000000000000 RBX: ffff88813fd34100 RCX: ffffffffa386cc43 +[ 286.469019][ C0] RDX: 1ffff11027fa68b6 RSI: 0000000000000008 RDI: ffff88813fd34100 +[ 286.469545][ C0] RBP: ffff88813fd34160 R08: 0000000000000000 R09: ffffed1027fa682c +[ 286.470072][ C0] R10: ffff88813fd34167 R11: 0000000000000000 R12: ffff88813fd344c3 +[ 286.470585][ C0] R13: ffff88813fd34112 R14: ffff88813fd34aec R15: ffff888132cdd268 +[ 286.471070][ C0] FS: 00007fe3c04c7d80(0000) GS:ffff88840743f000(0000) knlGS:0000000000000000 +[ 286.471644][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 286.472543][ C0] CR2: ffffffffffffffd6 CR3: 000000012daca000 CR4: 00000000000006f0 +[ 286.473500][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 286.474467][ C0] DR3: 0000000000000000 DR6: 00000000ffff07f0 DR7: 0000000000000400 +[ 286.475453][ C0] Call Trace: +[ 286.476102][ C0] +[ 286.476719][ C0] tcp_fin+0x2bb/0x440 +[ 286.477429][ C0] tcp_data_queue+0x190f/0x4e60 +[ 286.478174][ C0] ? __build_skb_around+0x234/0x330 +[ 286.478940][ C0] ? rcu_is_watching+0x11/0xb0 +[ 286.479659][ C0] ? __pfx_tcp_data_queue+0x10/0x10 +[ 286.480431][ C0] ? tcp_try_undo_loss+0x640/0x6c0 +[ 286.481196][ C0] ? seqcount_lockdep_reader_access.constprop.0+0x82/0x90 +[ 286.482046][ C0] ? kvm_clock_get_cycles+0x14/0x30 +[ 286.482769][ C0] ? ktime_get+0x66/0x150 +[ 286.483433][ C0] ? rcu_is_watching+0x11/0xb0 +[ 286.484146][ C0] tcp_rcv_established+0x6e4/0x2050 +[ 286.484857][ C0] ? rcu_is_watching+0x11/0xb0 +[ 286.485523][ C0] ? ipv4_dst_check+0x160/0x2b0 +[ 286.486203][ C0] ? __pfx_tcp_rcv_established+0x10/0x10 +[ 286.486917][ C0] ? lock_release+0x217/0x2c0 +[ 286.487595][ C0] tcp_v4_do_rcv+0x4d6/0x9b0 +[ 286.488279][ C0] tcp_v4_rcv+0x2af8/0x3e30 +[ 286.488904][ C0] ? raw_local_deliver+0x51b/0xad0 +[ 286.489551][ C0] ? rcu_is_watching+0x11/0xb0 +[ 286.490198][ C0] ? __pfx_tcp_v4_rcv+0x10/0x10 +[ 286.490813][ C0] ? __pfx_raw_local_deliver+0x10/0x10 +[ 286.491487][ C0] ? __pfx_nf_confirm+0x10/0x10 [nf_conntrack] +[ 286.492275][ C0] ? rcu_is_watching+0x11/0xb0 +[ 286.492900][ C0] ip_protocol_deliver_rcu+0x8f/0x370 +[ 286.493579][ C0] ip_local_deliver_finish+0x297/0x420 +[ 286.494268][ C0] ip_local_deliver+0x168/0x430 +[ 286.494867][ C0] ? __pfx_ip_local_deliver+0x10/0x10 +[ 286.495498][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 +[ 286.496204][ C0] ? ip_rcv_finish_core+0x19a/0x1f20 +[ 286.496806][ C0] ? lock_release+0x217/0x2c0 +[ 286.497414][ C0] ip_rcv+0x455/0x6e0 +[ 286.497945][ C0] ? __pfx_ip_rcv+0x10/0x10 +[ 286.498550][ C0] ? rcu_is_watching+0x11/0xb0 +[ 286.499137][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 +[ 286.499763][ C0] ? lock_release+0x217/0x2c0 +[ 286.500327][ C0] ? dl_scaled_delta_exec+0xd1/0x2c0 +[ 286.500922][ C0] ? __pfx_ip_rcv+0x10/0x10 +[ 286.501480][ C0] __netif_receive_skb_one_core+0x166/0x1b0 +[ 286.502173][ C0] ? __pfx___netif_receive_skb_one_core+0x10/0x10 +[ 286.502903][ C0] ? lock_acquire+0x2b2/0x310 +[ 286.503487][ C0] ? process_backlog+0x372/0x1350 +[ 286.504087][ C0] ? lock_release+0x217/0x2c0 +[ 286.504642][ C0] process_backlog+0x3b9/0x1350 +[ 286.505214][ C0] ? process_backlog+0x372/0x1350 +[ 286.505779][ C0] __napi_poll.constprop.0+0xa6/0x490 +[ 286.506363][ C0] net_rx_action+0x92e/0xe10 +[ 286.506889][ C0] ? __pfx_net_rx_action+0x10/0x10 +[ 286.507437][ C0] ? timerqueue_add+0x1f0/0x320 +[ 286.507977][ C0] ? sched_clock_cpu+0x68/0x540 +[ 286.508492][ C0] ? lock_acquire+0x2b2/0x310 +[ 286.509043][ C0] ? kvm_sched_clock_read+0xd/0x20 +[ 286.509607][ C0] ? handle_softirqs+0x1aa/0x7d0 +[ 286.510187][ C0] handle_softirqs+0x1f2/0x7d0 +[ 286.510754][ C0] ? __pfx_handle_softirqs+0x10/0x10 +[ 286.511348][ C0] ? irqtime_account_irq+0x181/0x290 +[ 286.511937][ C0] ? __dev_queue_xmit+0x85d/0x3450 +[ 286.512510][ C0] do_softirq.part.0+0x89/0xc0 +[ 286.513100][ C0] +[ 286.513548][ C0] +[ 286.513953][ C0] __local_bh_enable_ip+0x112/0x140 +[ 286.514522][ C0] ? __dev_queue_xmit+0x85d/0x3450 +[ 286.515072][ C0] __dev_queue_xmit+0x872/0x3450 +[ 286.515619][ C0] ? nft_do_chain+0xe16/0x15b0 [nf_tables] +[ 286.516252][ C0] ? __pfx___dev_queue_xmit+0x10/0x10 +[ 286.516817][ C0] ? selinux_ip_postroute+0x43c/0xc50 +[ 286.517433][ C0] ? __pfx_selinux_ip_postroute+0x10/0x10 +[ 286.518061][ C0] ? rcu_is_watching+0x11/0xb0 +[ 286.518606][ C0] ? ip_output+0x164/0x4a0 +[ 286.519149][ C0] ? rcu_is_watching+0x11/0xb0 +[ 286.519671][ C0] ? ip_finish_output2+0x17d5/0x1fb0 +[ 286.520258][ C0] ip_finish_output2+0xb4b/0x1fb0 +[ 286.520787][ C0] ? __pfx_ip_finish_output2+0x10/0x10 +[ 286.521355][ C0] ? __ip_finish_output+0x15d/0x750 +[ 286.521890][ C0] ip_output+0x164/0x4a0 +[ 286.522372][ C0] ? __pfx_ip_output+0x10/0x10 +[ 286.522872][ C0] ? rcu_is_watching+0x11/0xb0 +[ 286.523402][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x60 +[ 286.524031][ C0] ? __pfx_ip_finish_output+0x10/0x10 +[ 286.524605][ C0] ? __ip_queue_xmit+0x999/0x2260 +[ 286.525200][ C0] ? rcu_is_watching+0x11/0xb0 +[ 286.525744][ C0] ? ipv4_dst_check+0x16a/0x2b0 +[ 286.526279][ C0] ? lock_release+0x217/0x2c0 +[ 286.526793][ C0] __ip_queue_xmit+0x1883/0x2260 +[ 286.527324][ C0] ? __skb_clone+0x54c/0x730 +[ 286.527827][ C0] __tcp_transmit_skb+0x209b/0x37a0 +[ 286.528374][ C0] ? __pfx___tcp_transmit_skb+0x10/0x10 +[ 286.528952][ C0] ? rcu_is_watching+0x11/0xb0 +[ 286.529472][ C0] ? seqcount_lockdep_reader_access.constprop.0+0x82/0x90 +[ 286.530152][ C0] ? trace_hardirqs_on+0x12/0x120 +[ 286.530691][ C0] tcp_write_xmit+0xb81/0x88b0 +[ 286.531224][ C0] ? mod_memcg_state+0x4d/0x60 +[ 286.531736][ C0] ? rcu_is_watching+0x11/0xb0 +[ 286.532253][ C0] __tcp_push_pending_frames+0x90/0x320 +[ 286.532826][ C0] tcp_send_fin+0x141/0xb50 +[ 286.533352][ C0] ? __pfx_tcp_send_fin+0x10/0x10 +[ 286.533908][ C0] ? __local_bh_enable_ip+0xab/0x140 +[ 286.534495][ C0] inet_shutdown+0x243/0x320 +[ 286.535077][ C0] nvme_tcp_alloc_queue+0xb3b/0x2590 [nvme_tcp] +[ 286.535709][ C0] ? do_raw_spin_lock+0x129/0x260 +[ 286.536314][ C0] ? __pfx_nvme_tcp_alloc_queue+0x10/0x10 [nvme_tcp] +[ 286.536996][ C0] ? do_raw_spin_unlock+0x54/0x1e0 +[ 286.537550][ C0] ? _raw_spin_unlock+0x29/0x50 +[ 286.538127][ C0] ? do_raw_spin_lock+0x129/0x260 +[ 286.538664][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 +[ 286.539249][ C0] ? nvme_tcp_alloc_admin_queue+0xd5/0x340 [nvme_tcp] +[ 286.539892][ C0] ? __wake_up+0x40/0x60 +[ 286.540392][ C0] nvme_tcp_alloc_admin_queue+0xd5/0x340 [nvme_tcp] +[ 286.541047][ C0] ? rcu_is_watching+0x11/0xb0 +[ 286.541589][ C0] nvme_tcp_setup_ctrl+0x8b/0x7a0 [nvme_tcp] +[ 286.542254][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x60 +[ 286.542887][ C0] ? __pfx_nvme_tcp_setup_ctrl+0x10/0x10 [nvme_tcp] +[ 286.543568][ C0] ? trace_hardirqs_on+0x12/0x120 +[ 286.544166][ C0] ? _raw_spin_unlock_irqrestore+0x35/0x60 +[ 286.544792][ C0] ? nvme_change_ctrl_state+0x196/0x2e0 [nvme_core] +[ 286.545477][ C0] nvme_tcp_create_ctrl+0x839/0xb90 [nvme_tcp] +[ 286.546126][ C0] nvmf_dev_write+0x3db/0x7e0 [nvme_fabrics] +[ 286.546775][ C0] ? rw_verify_area+0x69/0x520 +[ 286.547334][ C0] vfs_write+0x218/0xe90 +[ 286.547854][ C0] ? do_syscall_64+0x9f/0x190 +[ 286.548408][ C0] ? trace_hardirqs_on_prepare+0xdb/0x120 +[ 286.549037][ C0] ? syscall_exit_to_user_mode+0x93/0x280 +[ 286.549659][ C0] ? __pfx_vfs_write+0x10/0x10 +[ 286.550259][ C0] ? do_syscall_64+0x9f/0x190 +[ 286.550840][ C0] ? syscall_exit_to_user_mode+0x8e/0x280 +[ 286.551516][ C0] ? trace_hardirqs_on_prepare+0xdb/0x120 +[ 286.552180][ C0] ? syscall_exit_to_user_mode+0x93/0x280 +[ 286.552834][ C0] ? ksys_read+0xf5/0x1c0 +[ 286.553386][ C0] ? __pfx_ksys_read+0x10/0x10 +[ 286.553964][ C0] ksys_write+0xf5/0x1c0 +[ 286.554499][ C0] ? __pfx_ksys_write+0x10/0x10 +[ 286.555072][ C0] ? trace_hardirqs_on_prepare+0xdb/0x120 +[ 286.555698][ C0] ? syscall_exit_to_user_mode+0x93/0x280 +[ 286.556319][ C0] ? do_syscall_64+0x54/0x190 +[ 286.556866][ C0] do_syscall_64+0x93/0x190 +[ 286.557420][ C0] ? rcu_read_unlock+0x17/0x60 +[ 286.557986][ C0] ? rcu_is_watching+0x11/0xb0 +[ 286.558526][ C0] ? lock_release+0x217/0x2c0 +[ 286.559087][ C0] ? rcu_is_watching+0x11/0xb0 +[ 286.559659][ C0] ? count_memcg_events.constprop.0+0x4a/0x60 +[ 286.560476][ C0] ? exc_page_fault+0x7a/0x110 +[ 286.561064][ C0] ? rcu_is_watching+0x11/0xb0 +[ 286.561647][ C0] ? lock_release+0x217/0x2c0 +[ 286.562257][ C0] ? do_user_addr_fault+0x171/0xa00 +[ 286.562839][ C0] ? do_user_addr_fault+0x4a2/0xa00 +[ 286.563453][ C0] ? irqentry_exit_to_user_mode+0x84/0x270 +[ 286.564112][ C0] ? rcu_is_watching+0x11/0xb0 +[ 286.564677][ C0] ? irqentry_exit_to_user_mode+0x84/0x270 +[ 286.565317][ C0] ? trace_hardirqs_on_prepare+0xdb/0x120 +[ 286.565922][ C0] entry_SYSCALL_64_after_hwframe+0x76/0x7e +[ 286.566542][ C0] RIP: 0033:0x7fe3c05e6504 +[ 286.567102][ C0] Code: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 80 3d c5 8b 10 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89 +[ 286.568931][ C0] RSP: 002b:00007fff76444f58 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 +[ 286.569807][ C0] RAX: ffffffffffffffda RBX: 000000003b40d930 RCX: 00007fe3c05e6504 +[ 286.570621][ C0] RDX: 00000000000000cf RSI: 000000003b40d930 RDI: 0000000000000003 +[ 286.571443][ C0] RBP: 0000000000000003 R08: 00000000000000cf R09: 000000003b40d930 +[ 286.572246][ C0] R10: 0000000000000000 R11: 0000000000000202 R12: 000000003b40cd60 +[ 286.573069][ C0] R13: 00000000000000cf R14: 00007fe3c07417f8 R15: 00007fe3c073502e +[ 286.573886][ C0] + +Closes: https://lore.kernel.org/linux-nvme/5hdonndzoqa265oq3bj6iarwtfk5dewxxjtbjvn5uqnwclpwt6@a2n6w3taxxex/ +Signed-off-by: Alistair Francis +Reviewed-by: Sagi Grimberg +Tested-by: Shin'ichiro Kawasaki +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/tcp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index 2bf2c775f7451..18127bbc64230 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -1425,6 +1425,9 @@ static void nvmet_tcp_restore_socket_callbacks(struct nvmet_tcp_queue *queue) + { + struct socket *sock = queue->sock; + ++ if (!queue->state_change) ++ return; ++ + write_lock_bh(&sock->sk->sk_callback_lock); + sock->sk->sk_data_ready = queue->data_ready; + sock->sk->sk_state_change = queue->state_change; +-- +2.39.5 + diff --git a/queue-5.15/orangefs-do-not-truncate-file-size.patch b/queue-5.15/orangefs-do-not-truncate-file-size.patch new file mode 100644 index 0000000000..0d3be17e49 --- /dev/null +++ b/queue-5.15/orangefs-do-not-truncate-file-size.patch @@ -0,0 +1,50 @@ +From 7a58d283704bdc6e863c7af112ae2dbfb994308d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Mar 2025 20:47:25 +0000 +Subject: orangefs: Do not truncate file size + +From: Matthew Wilcox (Oracle) + +[ Upstream commit 062e8093592fb866b8e016641a8b27feb6ac509d ] + +'len' is used to store the result of i_size_read(), so making 'len' +a size_t results in truncation to 4GiB on 32-bit systems. + +Signed-off-by: "Matthew Wilcox (Oracle)" +Link: https://lore.kernel.org/r/20250305204734.1475264-2-willy@infradead.org +Tested-by: Mike Marshall +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/orangefs/inode.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/fs/orangefs/inode.c b/fs/orangefs/inode.c +index c1bb4c4b5d672..0cf3dcb76d2f4 100644 +--- a/fs/orangefs/inode.c ++++ b/fs/orangefs/inode.c +@@ -23,9 +23,9 @@ static int orangefs_writepage_locked(struct page *page, + struct orangefs_write_range *wr = NULL; + struct iov_iter iter; + struct bio_vec bv; +- size_t len, wlen; ++ size_t wlen; + ssize_t ret; +- loff_t off; ++ loff_t len, off; + + set_page_writeback(page); + +@@ -94,8 +94,7 @@ static int orangefs_writepages_work(struct orangefs_writepages *ow, + struct orangefs_write_range *wrp, wr; + struct iov_iter iter; + ssize_t ret; +- size_t len; +- loff_t off; ++ loff_t len, off; + int i; + + len = i_size_read(inode); +-- +2.39.5 + diff --git a/queue-5.15/pci-brcmstb-add-a-softdep-to-mip-msi-x-driver.patch b/queue-5.15/pci-brcmstb-add-a-softdep-to-mip-msi-x-driver.patch new file mode 100644 index 0000000000..eb1c80ba1f --- /dev/null +++ b/queue-5.15/pci-brcmstb-add-a-softdep-to-mip-msi-x-driver.patch @@ -0,0 +1,41 @@ +From e95d50c68e84f095f74e4530252b0452bbbf0d11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Feb 2025 10:35:56 +0200 +Subject: PCI: brcmstb: Add a softdep to MIP MSI-X driver +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stanimir Varbanov + +[ Upstream commit 2294059118c550464dd8906286324d90c33b152b ] + +Then the brcmstb PCIe driver and MIP MSI-X interrupt controller +drivers are built as modules there could be a race in probing. + +To avoid this, add a softdep to MIP driver to guarantee that +MIP driver will be load first. + +Signed-off-by: Stanimir Varbanov +Reviewed-by: Florian Fainelli +Tested-by: Ivan T. Ivanov +Link: https://lore.kernel.org/r/20250224083559.47645-5-svarbanov@suse.de +[kwilczynski: commit log] +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pcie-brcmstb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c +index 7121270787899..e984b57dd0d89 100644 +--- a/drivers/pci/controller/pcie-brcmstb.c ++++ b/drivers/pci/controller/pcie-brcmstb.c +@@ -1352,3 +1352,4 @@ module_platform_driver(brcm_pcie_driver); + MODULE_LICENSE("GPL"); + MODULE_DESCRIPTION("Broadcom STB PCIe RC driver"); + MODULE_AUTHOR("Broadcom"); ++MODULE_SOFTDEP("pre: irq_bcm2712_mip"); +-- +2.39.5 + diff --git a/queue-5.15/pci-brcmstb-expand-inbound-window-size-up-to-64gb.patch b/queue-5.15/pci-brcmstb-expand-inbound-window-size-up-to-64gb.patch new file mode 100644 index 0000000000..43853cc439 --- /dev/null +++ b/queue-5.15/pci-brcmstb-expand-inbound-window-size-up-to-64gb.patch @@ -0,0 +1,48 @@ +From 3be8d70c23664e02580fef5c15bae3978982223b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Feb 2025 10:35:58 +0200 +Subject: PCI: brcmstb: Expand inbound window size up to 64GB +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stanimir Varbanov + +[ Upstream commit 25a98c727015638baffcfa236e3f37b70cedcf87 ] + +The BCM2712 memory map can support up to 64GB of system memory, thus +expand the inbound window size in calculation helper function. + +The change is safe for the currently supported SoCs that have smaller +inbound window sizes. + +Signed-off-by: Stanimir Varbanov +Reviewed-by: Florian Fainelli +Reviewed-by: Jim Quinlan +Tested-by: Ivan T. Ivanov +Link: https://lore.kernel.org/r/20250224083559.47645-7-svarbanov@suse.de +[kwilczynski: commit log] +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pcie-brcmstb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c +index 6a676bde5e2c6..7121270787899 100644 +--- a/drivers/pci/controller/pcie-brcmstb.c ++++ b/drivers/pci/controller/pcie-brcmstb.c +@@ -308,8 +308,8 @@ static int brcm_pcie_encode_ibar_size(u64 size) + if (log2_in >= 12 && log2_in <= 15) + /* Covers 4KB to 32KB (inclusive) */ + return (log2_in - 12) + 0x1c; +- else if (log2_in >= 16 && log2_in <= 35) +- /* Covers 64KB to 32GB, (inclusive) */ ++ else if (log2_in >= 16 && log2_in <= 36) ++ /* Covers 64KB to 64GB, (inclusive) */ + return log2_in - 15; + /* Something is awry so disable */ + return 0; +-- +2.39.5 + diff --git a/queue-5.15/pci-dwc-ep-ensure-proper-iteration-over-outbound-map.patch b/queue-5.15/pci-dwc-ep-ensure-proper-iteration-over-outbound-map.patch new file mode 100644 index 0000000000..249a8a5722 --- /dev/null +++ b/queue-5.15/pci-dwc-ep-ensure-proper-iteration-over-outbound-map.patch @@ -0,0 +1,45 @@ +From c00412b8e9327b63745bc4c8660264ecb8b84d59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Mar 2025 15:15:46 -0500 +Subject: PCI: dwc: ep: Ensure proper iteration over outbound map windows + +From: Frank Li + +[ Upstream commit f3e1dccba0a0833fc9a05fb838ebeb6ea4ca0e1a ] + +Most systems' PCIe outbound map windows have non-zero physical addresses, +but the possibility of encountering zero increased after following commit +("PCI: dwc: Use parent_bus_offset"). + +'ep->outbound_addr[n]', representing 'parent_bus_address', might be 0 on +some hardware, which trims high address bits through bus fabric before +sending to the PCIe controller. + +Replace the iteration logic with 'for_each_set_bit()' to ensure only +allocated map windows are iterated when determining the ATU index from a +given address. + +Link: https://lore.kernel.org/r/20250315201548.858189-12-helgaas@kernel.org +Signed-off-by: Frank Li +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-designware-ep.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c +index fc92d30a0ad99..5502751334cc6 100644 +--- a/drivers/pci/controller/dwc/pcie-designware-ep.c ++++ b/drivers/pci/controller/dwc/pcie-designware-ep.c +@@ -267,7 +267,7 @@ static int dw_pcie_find_index(struct dw_pcie_ep *ep, phys_addr_t addr, + u32 index; + struct dw_pcie *pci = to_dw_pcie_from_ep(ep); + +- for (index = 0; index < pci->num_ob_windows; index++) { ++ for_each_set_bit(index, ep->ob_window_map, pci->num_ob_windows) { + if (ep->outbound_addr[index] != addr) + continue; + *atu_index = index; +-- +2.39.5 + diff --git a/queue-5.15/pci-fix-old_size-lower-bound-in-calculate_iosize-too.patch b/queue-5.15/pci-fix-old_size-lower-bound-in-calculate_iosize-too.patch new file mode 100644 index 0000000000..96cf855a5f --- /dev/null +++ b/queue-5.15/pci-fix-old_size-lower-bound-in-calculate_iosize-too.patch @@ -0,0 +1,48 @@ +From 740703d913ee7e98e0e9651fee8fbaed70136a11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Dec 2024 19:56:12 +0200 +Subject: PCI: Fix old_size lower bound in calculate_iosize() too +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit ff61f380de5652e723168341480cc7adf1dd6213 ] + +Commit 903534fa7d30 ("PCI: Fix resource double counting on remove & +rescan") fixed double counting of mem resources because of old_size being +applied too early. + +Fix a similar counting bug on the io resource side. + +Link: https://lore.kernel.org/r/20241216175632.4175-6-ilpo.jarvinen@linux.intel.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Tested-by: Xiaochun Lee +Signed-off-by: Sasha Levin +--- + drivers/pci/setup-bus.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c +index a159bfdfa2512..04c3ae8efc0f8 100644 +--- a/drivers/pci/setup-bus.c ++++ b/drivers/pci/setup-bus.c +@@ -806,11 +806,9 @@ static resource_size_t calculate_iosize(resource_size_t size, + size = (size & 0xff) + ((size & ~0xffUL) << 2); + #endif + size = size + size1; +- if (size < old_size) +- size = old_size; + +- size = ALIGN(max(size, add_size) + children_add_size, align); +- return size; ++ size = max(size, add_size) + children_add_size; ++ return ALIGN(max(size, old_size), align); + } + + static resource_size_t calculate_memsize(resource_size_t size, +-- +2.39.5 + diff --git a/queue-5.15/pci-vmd-disable-msi-remapping-bypass-under-xen.patch b/queue-5.15/pci-vmd-disable-msi-remapping-bypass-under-xen.patch new file mode 100644 index 0000000000..7f9e2dbf5b --- /dev/null +++ b/queue-5.15/pci-vmd-disable-msi-remapping-bypass-under-xen.patch @@ -0,0 +1,78 @@ +From b09c1f96d01e736106a49722d29d95dac30ee663 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Feb 2025 10:20:56 +0100 +Subject: PCI: vmd: Disable MSI remapping bypass under Xen +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Roger Pau Monne + +[ Upstream commit 6c4d5aadf5df31ea0ac025980670eee9beaf466b ] + +MSI remapping bypass (directly configuring MSI entries for devices on the +VMD bus) won't work under Xen, as Xen is not aware of devices in such bus, +and hence cannot configure the entries using the pIRQ interface in the PV +case, and in the PVH case traps won't be setup for MSI entries for such +devices. + +Until Xen is aware of devices in the VMD bus prevent the +VMD_FEAT_CAN_BYPASS_MSI_REMAP capability from being used when running as +any kind of Xen guest. + +The MSI remapping bypass is an optional feature of VMD bridges, and hence +when running under Xen it will be masked and devices will be forced to +redirect its interrupts from the VMD bridge. That mode of operation must +always be supported by VMD bridges and works when Xen is not aware of +devices behind the VMD bridge. + +Signed-off-by: Roger Pau Monné +Acked-by: Bjorn Helgaas +Message-ID: <20250219092059.90850-3-roger.pau@citrix.com> +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/vmd.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c +index 1195c570599c0..846590706a384 100644 +--- a/drivers/pci/controller/vmd.c ++++ b/drivers/pci/controller/vmd.c +@@ -17,6 +17,8 @@ + #include + #include + ++#include ++ + #include + #include + #include +@@ -826,6 +828,24 @@ static int vmd_probe(struct pci_dev *dev, const struct pci_device_id *id) + struct vmd_dev *vmd; + int err; + ++ if (xen_domain()) { ++ /* ++ * Xen doesn't have knowledge about devices in the VMD bus ++ * because the config space of devices behind the VMD bridge is ++ * not known to Xen, and hence Xen cannot discover or configure ++ * them in any way. ++ * ++ * Bypass of MSI remapping won't work in that case as direct ++ * write by Linux to the MSI entries won't result in functional ++ * interrupts, as Xen is the entity that manages the host ++ * interrupt controller and must configure interrupts. However ++ * multiplexing of interrupts by the VMD bridge will work under ++ * Xen, so force the usage of that mode which must always be ++ * supported by VMD bridges. ++ */ ++ features &= ~VMD_FEAT_CAN_BYPASS_MSI_REMAP; ++ } ++ + if (resource_size(&dev->resource[VMD_CFGBAR]) < (1 << 20)) + return -ENOMEM; + +-- +2.39.5 + diff --git a/queue-5.15/perf-amd-ibs-fix-perf_ibs_op.cnt_mask-for-curcnt.patch b/queue-5.15/perf-amd-ibs-fix-perf_ibs_op.cnt_mask-for-curcnt.patch new file mode 100644 index 0000000000..e83dbf58eb --- /dev/null +++ b/queue-5.15/perf-amd-ibs-fix-perf_ibs_op.cnt_mask-for-curcnt.patch @@ -0,0 +1,63 @@ +From 913671b0d94634f452f56dc86632488f8bbe9e60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 05:44:33 +0000 +Subject: perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt + +From: Ravi Bangoria + +[ Upstream commit 46dcf85566170d4528b842bf83ffc350d71771fa ] + +IBS Op uses two counters: MaxCnt and CurCnt. MaxCnt is programmed with +the desired sample period. IBS hw generates sample when CurCnt reaches +to MaxCnt. The size of these counter used to be 20 bits but later they +were extended to 27 bits. The 7 bit extension is indicated by CPUID +Fn8000_001B_EAX[6 / OpCntExt]. + +perf_ibs->cnt_mask variable contains bit masks for MaxCnt and CurCnt. +But IBS driver does not set upper 7 bits of CurCnt in cnt_mask even +when OpCntExt CPUID bit is set. Fix this. + +IBS driver uses cnt_mask[CurCnt] bits only while disabling an event. +Fortunately, CurCnt bits are not read from MSR while re-enabling the +event, instead MaxCnt is programmed with desired period and CurCnt is +set to 0. Hence, we did not see any issues so far. + +Signed-off-by: Ravi Bangoria +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Namhyung Kim +Link: https://lkml.kernel.org/r/20250115054438.1021-5-ravi.bangoria@amd.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/amd/ibs.c | 3 ++- + arch/x86/include/asm/perf_event.h | 1 + + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c +index b605e08f9a8ef..2b83056029942 100644 +--- a/arch/x86/events/amd/ibs.c ++++ b/arch/x86/events/amd/ibs.c +@@ -803,7 +803,8 @@ static __init int perf_event_ibs_init(void) + if (ibs_caps & IBS_CAPS_OPCNTEXT) { + perf_ibs_op.max_period |= IBS_OP_MAX_CNT_EXT_MASK; + perf_ibs_op.config_mask |= IBS_OP_MAX_CNT_EXT_MASK; +- perf_ibs_op.cnt_mask |= IBS_OP_MAX_CNT_EXT_MASK; ++ perf_ibs_op.cnt_mask |= (IBS_OP_MAX_CNT_EXT_MASK | ++ IBS_OP_CUR_CNT_EXT_MASK); + } + + ret = perf_ibs_pmu_init(&perf_ibs_op, "ibs_op"); +diff --git a/arch/x86/include/asm/perf_event.h b/arch/x86/include/asm/perf_event.h +index 0e4efcde07831..cbfca9d2c419b 100644 +--- a/arch/x86/include/asm/perf_event.h ++++ b/arch/x86/include/asm/perf_event.h +@@ -417,6 +417,7 @@ struct pebs_xmm { + */ + #define IBS_OP_CUR_CNT (0xFFF80ULL<<32) + #define IBS_OP_CUR_CNT_RAND (0x0007FULL<<32) ++#define IBS_OP_CUR_CNT_EXT_MASK (0x7FULL<<52) + #define IBS_OP_CNT_CTL (1ULL<<19) + #define IBS_OP_VAL (1ULL<<18) + #define IBS_OP_ENABLE (1ULL<<17) +-- +2.39.5 + diff --git a/queue-5.15/phy-core-don-t-require-set_mode-callback-for-phy_get.patch b/queue-5.15/phy-core-don-t-require-set_mode-callback-for-phy_get.patch new file mode 100644 index 0000000000..7cebf16766 --- /dev/null +++ b/queue-5.15/phy-core-don-t-require-set_mode-callback-for-phy_get.patch @@ -0,0 +1,54 @@ +From afec26f9450be534e62769a7d4840667c18259c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Feb 2025 14:31:45 +0200 +Subject: phy: core: don't require set_mode() callback for phy_get_mode() to + work + +From: Dmitry Baryshkov + +[ Upstream commit d58c04e305afbaa9dda7969151f06c4efe2c98b0 ] + +As reported by Damon Ding, the phy_get_mode() call doesn't work as +expected unless the PHY driver has a .set_mode() call. This prompts PHY +drivers to have empty stubs for .set_mode() for the sake of being able +to get the mode. + +Make .set_mode() callback truly optional and update PHY's mode even if +it there is none. + +Cc: Damon Ding +Link: https://lore.kernel.org/r/96f8310f-93f1-4bcb-8637-137e1159ff83@rock-chips.com +Tested-by: Damon Ding +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20250209-phy-fix-set-moe-v2-1-76e248503856@linaro.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/phy-core.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c +index e2bfd56d5086e..21f12aeb7747f 100644 +--- a/drivers/phy/phy-core.c ++++ b/drivers/phy/phy-core.c +@@ -360,13 +360,14 @@ EXPORT_SYMBOL_GPL(phy_power_off); + + int phy_set_mode_ext(struct phy *phy, enum phy_mode mode, int submode) + { +- int ret; ++ int ret = 0; + +- if (!phy || !phy->ops->set_mode) ++ if (!phy) + return 0; + + mutex_lock(&phy->mutex); +- ret = phy->ops->set_mode(phy, mode, submode); ++ if (phy->ops->set_mode) ++ ret = phy->ops->set_mode(phy, mode, submode); + if (!ret) + phy->attrs.mode = mode; + mutex_unlock(&phy->mutex); +-- +2.39.5 + diff --git a/queue-5.15/pinctrl-bcm281xx-use-unsigned-int-instead-of-bare-un.patch b/queue-5.15/pinctrl-bcm281xx-use-unsigned-int-instead-of-bare-un.patch new file mode 100644 index 0000000000..2687b4fde6 --- /dev/null +++ b/queue-5.15/pinctrl-bcm281xx-use-unsigned-int-instead-of-bare-un.patch @@ -0,0 +1,177 @@ +From 8a5b98d66c2a3c6a7b5c6acc4113ae7ead831908 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Mar 2025 21:54:47 +0100 +Subject: pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned" + +From: Artur Weber + +[ Upstream commit 07b5a2a13f4704c5eae3be7277ec54ffdba45f72 ] + +Replace uses of bare "unsigned" with "unsigned int" to fix checkpatch +warnings. No functional change. + +Signed-off-by: Artur Weber +Link: https://lore.kernel.org/20250303-bcm21664-pinctrl-v3-2-5f8b80e4ab51@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/bcm/pinctrl-bcm281xx.c | 44 +++++++++++++------------- + 1 file changed, 22 insertions(+), 22 deletions(-) + +diff --git a/drivers/pinctrl/bcm/pinctrl-bcm281xx.c b/drivers/pinctrl/bcm/pinctrl-bcm281xx.c +index fbfddcc39d5cc..6ab3481ba902a 100644 +--- a/drivers/pinctrl/bcm/pinctrl-bcm281xx.c ++++ b/drivers/pinctrl/bcm/pinctrl-bcm281xx.c +@@ -79,7 +79,7 @@ static enum bcm281xx_pin_type hdmi_pin = BCM281XX_PIN_TYPE_HDMI; + struct bcm281xx_pin_function { + const char *name; + const char * const *groups; +- const unsigned ngroups; ++ const unsigned int ngroups; + }; + + /* +@@ -91,10 +91,10 @@ struct bcm281xx_pinctrl_data { + + /* List of all pins */ + const struct pinctrl_pin_desc *pins; +- const unsigned npins; ++ const unsigned int npins; + + const struct bcm281xx_pin_function *functions; +- const unsigned nfunctions; ++ const unsigned int nfunctions; + + struct regmap *regmap; + }; +@@ -948,7 +948,7 @@ static struct bcm281xx_pinctrl_data bcm281xx_pinctrl = { + }; + + static inline enum bcm281xx_pin_type pin_type_get(struct pinctrl_dev *pctldev, +- unsigned pin) ++ unsigned int pin) + { + struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev); + +@@ -992,7 +992,7 @@ static int bcm281xx_pinctrl_get_groups_count(struct pinctrl_dev *pctldev) + } + + static const char *bcm281xx_pinctrl_get_group_name(struct pinctrl_dev *pctldev, +- unsigned group) ++ unsigned int group) + { + struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev); + +@@ -1000,9 +1000,9 @@ static const char *bcm281xx_pinctrl_get_group_name(struct pinctrl_dev *pctldev, + } + + static int bcm281xx_pinctrl_get_group_pins(struct pinctrl_dev *pctldev, +- unsigned group, ++ unsigned int group, + const unsigned **pins, +- unsigned *num_pins) ++ unsigned int *num_pins) + { + struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev); + +@@ -1014,7 +1014,7 @@ static int bcm281xx_pinctrl_get_group_pins(struct pinctrl_dev *pctldev, + + static void bcm281xx_pinctrl_pin_dbg_show(struct pinctrl_dev *pctldev, + struct seq_file *s, +- unsigned offset) ++ unsigned int offset) + { + seq_printf(s, " %s", dev_name(pctldev->dev)); + } +@@ -1036,7 +1036,7 @@ static int bcm281xx_pinctrl_get_fcns_count(struct pinctrl_dev *pctldev) + } + + static const char *bcm281xx_pinctrl_get_fcn_name(struct pinctrl_dev *pctldev, +- unsigned function) ++ unsigned int function) + { + struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev); + +@@ -1044,9 +1044,9 @@ static const char *bcm281xx_pinctrl_get_fcn_name(struct pinctrl_dev *pctldev, + } + + static int bcm281xx_pinctrl_get_fcn_groups(struct pinctrl_dev *pctldev, +- unsigned function, ++ unsigned int function, + const char * const **groups, +- unsigned * const num_groups) ++ unsigned int * const num_groups) + { + struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev); + +@@ -1057,8 +1057,8 @@ static int bcm281xx_pinctrl_get_fcn_groups(struct pinctrl_dev *pctldev, + } + + static int bcm281xx_pinmux_set(struct pinctrl_dev *pctldev, +- unsigned function, +- unsigned group) ++ unsigned int function, ++ unsigned int group) + { + struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev); + const struct bcm281xx_pin_function *f = &pdata->functions[function]; +@@ -1089,7 +1089,7 @@ static const struct pinmux_ops bcm281xx_pinctrl_pinmux_ops = { + }; + + static int bcm281xx_pinctrl_pin_config_get(struct pinctrl_dev *pctldev, +- unsigned pin, ++ unsigned int pin, + unsigned long *config) + { + return -ENOTSUPP; +@@ -1098,9 +1098,9 @@ static int bcm281xx_pinctrl_pin_config_get(struct pinctrl_dev *pctldev, + + /* Goes through the configs and update register val/mask */ + static int bcm281xx_std_pin_update(struct pinctrl_dev *pctldev, +- unsigned pin, ++ unsigned int pin, + unsigned long *configs, +- unsigned num_configs, ++ unsigned int num_configs, + u32 *val, + u32 *mask) + { +@@ -1214,9 +1214,9 @@ static const u16 bcm281xx_pullup_map[] = { + + /* Goes through the configs and update register val/mask */ + static int bcm281xx_i2c_pin_update(struct pinctrl_dev *pctldev, +- unsigned pin, ++ unsigned int pin, + unsigned long *configs, +- unsigned num_configs, ++ unsigned int num_configs, + u32 *val, + u32 *mask) + { +@@ -1284,9 +1284,9 @@ static int bcm281xx_i2c_pin_update(struct pinctrl_dev *pctldev, + + /* Goes through the configs and update register val/mask */ + static int bcm281xx_hdmi_pin_update(struct pinctrl_dev *pctldev, +- unsigned pin, ++ unsigned int pin, + unsigned long *configs, +- unsigned num_configs, ++ unsigned int num_configs, + u32 *val, + u32 *mask) + { +@@ -1328,9 +1328,9 @@ static int bcm281xx_hdmi_pin_update(struct pinctrl_dev *pctldev, + } + + static int bcm281xx_pinctrl_pin_config_set(struct pinctrl_dev *pctldev, +- unsigned pin, ++ unsigned int pin, + unsigned long *configs, +- unsigned num_configs) ++ unsigned int num_configs) + { + struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev); + enum bcm281xx_pin_type pin_type; +-- +2.39.5 + diff --git a/queue-5.15/pinctrl-devicetree-do-not-goto-err-when-probing-hogs.patch b/queue-5.15/pinctrl-devicetree-do-not-goto-err-when-probing-hogs.patch new file mode 100644 index 0000000000..943f4ab428 --- /dev/null +++ b/queue-5.15/pinctrl-devicetree-do-not-goto-err-when-probing-hogs.patch @@ -0,0 +1,110 @@ +From f1b515bb4a4c34ce6e6235aa053a19391bbc11c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jan 2025 18:00:09 +0100 +Subject: pinctrl: devicetree: do not goto err when probing hogs in + pinctrl_dt_to_map + +From: Valentin Caron + +[ Upstream commit c98868e816209e568c9d72023ba0bc1e4d96e611 ] + +Cross case in pinctrl framework make impossible to an hogged pin and +another, not hogged, used within the same device-tree node. For example +with this simplified device-tree : + + &pinctrl { + pinctrl_pin_1: pinctrl-pin-1 { + pins = "dummy-pinctrl-pin"; + }; + }; + + &rtc { + pinctrl-names = "default" + pinctrl-0 = <&pinctrl_pin_1 &rtc_pin_1> + + rtc_pin_1: rtc-pin-1 { + pins = "dummy-rtc-pin"; + }; + }; + +"pinctrl_pin_1" configuration is never set. This produces this path in +the code: + + really_probe() + pinctrl_bind_pins() + | devm_pinctrl_get() + | pinctrl_get() + | create_pinctrl() + | pinctrl_dt_to_map() + | // Hog pin create an abort for all pins of the node + | ret = dt_to_map_one_config() + | | /* Do not defer probing of hogs (circular loop) */ + | | if (np_pctldev == p->dev->of_node) + | | return -ENODEV; + | if (ret) + | goto err + | + call_driver_probe() + stm32_rtc_probe() + pinctrl_enable() + pinctrl_claim_hogs() + create_pinctrl() + for_each_maps(maps_node, i, map) + // Not hog pin is skipped + if (pctldev && strcmp(dev_name(pctldev->dev), + map->ctrl_dev_name)) + continue; + +At the first call of create_pinctrl() the hogged pin produces an abort to +avoid a defer of hogged pins. All other pin configurations are trashed. + +At the second call, create_pinctrl is now called with pctldev parameter to +get hogs, but in this context only hogs are set. And other pins are +skipped. + +To handle this, do not produce an abort in the first call of +create_pinctrl(). Classic pin configuration will be set in +pinctrl_bind_pins() context. And the hogged pin configuration will be set +in pinctrl_claim_hogs() context. + +Signed-off-by: Valentin Caron +Link: https://lore.kernel.org/20250116170009.2075544-1-valentin.caron@foss.st.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/devicetree.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c +index 0220228c50404..d9279fc7be832 100644 +--- a/drivers/pinctrl/devicetree.c ++++ b/drivers/pinctrl/devicetree.c +@@ -143,10 +143,14 @@ static int dt_to_map_one_config(struct pinctrl *p, + pctldev = get_pinctrl_dev_from_of_node(np_pctldev); + if (pctldev) + break; +- /* Do not defer probing of hogs (circular loop) */ ++ /* ++ * Do not defer probing of hogs (circular loop) ++ * ++ * Return 1 to let the caller catch the case. ++ */ + if (np_pctldev == p->dev->of_node) { + of_node_put(np_pctldev); +- return -ENODEV; ++ return 1; + } + } + of_node_put(np_pctldev); +@@ -265,6 +269,8 @@ int pinctrl_dt_to_map(struct pinctrl *p, struct pinctrl_dev *pctldev) + ret = dt_to_map_one_config(p, pctldev, statename, + np_config); + of_node_put(np_config); ++ if (ret == 1) ++ continue; + if (ret < 0) + goto err; + } +-- +2.39.5 + diff --git a/queue-5.15/pinctrl-meson-define-the-pull-up-down-resistor-value.patch b/queue-5.15/pinctrl-meson-define-the-pull-up-down-resistor-value.patch new file mode 100644 index 0000000000..c73a373ef8 --- /dev/null +++ b/queue-5.15/pinctrl-meson-define-the-pull-up-down-resistor-value.patch @@ -0,0 +1,53 @@ +From 9eb09f7e96f5b51c8f0328c168df459c98ff3871 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Mar 2025 20:01:32 +0100 +Subject: pinctrl: meson: define the pull up/down resistor value as 60 kOhm + +From: Martin Blumenstingl + +[ Upstream commit e56088a13708757da68ad035269d69b93ac8c389 ] + +The public datasheets of the following Amlogic SoCs describe a typical +resistor value for the built-in pull up/down resistor: +- Meson8/8b/8m2: not documented +- GXBB (S905): 60 kOhm +- GXL (S905X): 60 kOhm +- GXM (S912): 60 kOhm +- G12B (S922X): 60 kOhm +- SM1 (S905D3): 60 kOhm + +The public G12B and SM1 datasheets additionally state min and max +values: +- min value: 50 kOhm for both, pull-up and pull-down +- max value for the pull-up: 70 kOhm +- max value for the pull-down: 130 kOhm + +Use 60 kOhm in the pinctrl-meson driver as well so it's shown in the +debugfs output. It may not be accurate for Meson8/8b/8m2 but in reality +60 kOhm is closer to the actual value than 1 Ohm. + +Signed-off-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/20250329190132.855196-1-martin.blumenstingl@googlemail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/meson/pinctrl-meson.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/meson/pinctrl-meson.c b/drivers/pinctrl/meson/pinctrl-meson.c +index 49851444a6e3b..d239ad85a510d 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson.c ++++ b/drivers/pinctrl/meson/pinctrl-meson.c +@@ -486,7 +486,7 @@ static int meson_pinconf_get(struct pinctrl_dev *pcdev, unsigned int pin, + case PIN_CONFIG_BIAS_PULL_DOWN: + case PIN_CONFIG_BIAS_PULL_UP: + if (meson_pinconf_get_pull(pc, pin) == param) +- arg = 1; ++ arg = 60000; + else + return -EINVAL; + break; +-- +2.39.5 + diff --git a/queue-5.15/pnfs-flexfiles-report-enetdown-as-a-connection-error.patch b/queue-5.15/pnfs-flexfiles-report-enetdown-as-a-connection-error.patch new file mode 100644 index 0000000000..03e350f811 --- /dev/null +++ b/queue-5.15/pnfs-flexfiles-report-enetdown-as-a-connection-error.patch @@ -0,0 +1,37 @@ +From e8a2735cb67e4dc415c09eb7bf0365c4825495cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Mar 2025 12:45:01 -0400 +Subject: pNFS/flexfiles: Report ENETDOWN as a connection error + +From: Trond Myklebust + +[ Upstream commit aa42add73ce9b9e3714723d385c254b75814e335 ] + +If the client should see an ENETDOWN when trying to connect to the data +server, it might still be able to talk to the metadata server through +another NIC. If so, report the error. + +Signed-off-by: Trond Myklebust +Reviewed-by: Jeff Layton +Tested-by: Jeff Layton +Acked-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfs/flexfilelayout/flexfilelayout.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c +index 4fed292de029f..a55eec241657d 100644 +--- a/fs/nfs/flexfilelayout/flexfilelayout.c ++++ b/fs/nfs/flexfilelayout/flexfilelayout.c +@@ -1258,6 +1258,7 @@ static void ff_layout_io_track_ds_error(struct pnfs_layout_segment *lseg, + case -ECONNRESET: + case -EHOSTDOWN: + case -EHOSTUNREACH: ++ case -ENETDOWN: + case -ENETUNREACH: + case -EADDRINUSE: + case -ENOBUFS: +-- +2.39.5 + diff --git a/queue-5.15/posix-timers-add-cond_resched-to-posix_timer_add-sea.patch b/queue-5.15/posix-timers-add-cond_resched-to-posix_timer_add-sea.patch new file mode 100644 index 0000000000..6310ab2359 --- /dev/null +++ b/queue-5.15/posix-timers-add-cond_resched-to-posix_timer_add-sea.patch @@ -0,0 +1,41 @@ +From 9a0b0a09c6bf25e907923723cacef4ec7d6df593 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Mar 2025 17:48:17 +0100 +Subject: posix-timers: Add cond_resched() to posix_timer_add() search loop + +From: Eric Dumazet + +[ Upstream commit 5f2909c6cd13564a07ae692a95457f52295c4f22 ] + +With a large number of POSIX timers the search for a valid ID might cause a +soft lockup on PREEMPT_NONE/VOLUNTARY kernels. + +Add cond_resched() to the loop to prevent that. + +[ tglx: Split out from Eric's series ] + +Signed-off-by: Eric Dumazet +Signed-off-by: Thomas Gleixner +Reviewed-by: Frederic Weisbecker +Link: https://lore.kernel.org/all/20250214135911.2037402-2-edumazet@google.com +Link: https://lore.kernel.org/all/20250308155623.635612865@linutronix.de +Signed-off-by: Sasha Levin +--- + kernel/time/posix-timers.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c +index 2d6cf93ca370a..fc08d4ccdeeb9 100644 +--- a/kernel/time/posix-timers.c ++++ b/kernel/time/posix-timers.c +@@ -161,6 +161,7 @@ static int posix_timer_add(struct k_itimer *timer) + return id; + } + spin_unlock(&hash_lock); ++ cond_resched(); + } + /* POSIX return code when no timer ID could be allocated */ + return -EAGAIN; +-- +2.39.5 + diff --git a/queue-5.15/powerpc-prom_init-fixup-missing-size-cells-on-powerb.patch b/queue-5.15/powerpc-prom_init-fixup-missing-size-cells-on-powerb.patch new file mode 100644 index 0000000000..9d72afb156 --- /dev/null +++ b/queue-5.15/powerpc-prom_init-fixup-missing-size-cells-on-powerb.patch @@ -0,0 +1,44 @@ +From cf1d0c499d967e91e8d6a80f588bf0596f88dd8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 18:19:09 +0100 +Subject: powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7 + +From: Andreas Schwab + +[ Upstream commit 7e67ef889c9ab7246547db73d524459f47403a77 ] + +Similar to the PowerMac3,1, the PowerBook6,7 is missing the #size-cells +property on the i2s node. + +Depends-on: commit 045b14ca5c36 ("of: WARN on deprecated #address-cells/#size-cells handling") +Signed-off-by: Andreas Schwab +Acked-by: Rob Herring (Arm) +[maddy: added "commit" work in depends-on to avoid checkpatch error] +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/875xmizl6a.fsf@igel.home +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/prom_init.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c +index 302c2acc8dcbf..491de25e38a86 100644 +--- a/arch/powerpc/kernel/prom_init.c ++++ b/arch/powerpc/kernel/prom_init.c +@@ -2978,11 +2978,11 @@ static void __init fixup_device_tree_pmac(void) + char type[8]; + phandle node; + +- // Some pmacs are missing #size-cells on escc nodes ++ // Some pmacs are missing #size-cells on escc or i2s nodes + for (node = 0; prom_next_node(&node); ) { + type[0] = '\0'; + prom_getprop(node, "device_type", type, sizeof(type)); +- if (prom_strcmp(type, "escc")) ++ if (prom_strcmp(type, "escc") && prom_strcmp(type, "i2s")) + continue; + + if (prom_getproplen(node, "#size-cells") != PROM_ERROR) +-- +2.39.5 + diff --git a/queue-5.15/r8152-add-vendor-device-id-pair-for-dell-alienware-a.patch b/queue-5.15/r8152-add-vendor-device-id-pair-for-dell-alienware-a.patch new file mode 100644 index 0000000000..072c9f09a1 --- /dev/null +++ b/queue-5.15/r8152-add-vendor-device-id-pair-for-dell-alienware-a.patch @@ -0,0 +1,50 @@ +From 1a065b8ca5ac35a239c9ecf26e00710604a99ba5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Feb 2025 23:40:33 +0100 +Subject: r8152: add vendor/device ID pair for Dell Alienware AW1022z + +From: Aleksander Jan Bajkowski + +[ Upstream commit 848b09d53d923b4caee5491f57a5c5b22d81febc ] + +The Dell AW1022z is an RTL8156B based 2.5G Ethernet controller. + +Add the vendor and product ID values to the driver. This makes Ethernet +work with the adapter. + +Signed-off-by: Aleksander Jan Bajkowski +Link: https://patch.msgid.link/20250206224033.980115-1-olek2@wp.pl +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 1 + + include/linux/usb/r8152.h | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index abf4a488075ef..6cde3d262d415 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -9853,6 +9853,7 @@ static const struct usb_device_id rtl8152_table[] = { + { USB_DEVICE(VENDOR_ID_NVIDIA, 0x09ff) }, + { USB_DEVICE(VENDOR_ID_TPLINK, 0x0601) }, + { USB_DEVICE(VENDOR_ID_DLINK, 0xb301) }, ++ { USB_DEVICE(VENDOR_ID_DELL, 0xb097) }, + { USB_DEVICE(VENDOR_ID_ASUS, 0x1976) }, + {} + }; +diff --git a/include/linux/usb/r8152.h b/include/linux/usb/r8152.h +index 33a4c146dc19c..2ca60828f28bb 100644 +--- a/include/linux/usb/r8152.h ++++ b/include/linux/usb/r8152.h +@@ -30,6 +30,7 @@ + #define VENDOR_ID_NVIDIA 0x0955 + #define VENDOR_ID_TPLINK 0x2357 + #define VENDOR_ID_DLINK 0x2001 ++#define VENDOR_ID_DELL 0x413c + #define VENDOR_ID_ASUS 0x0b05 + + #if IS_REACHABLE(CONFIG_USB_RTL8152) +-- +2.39.5 + diff --git a/queue-5.15/r8169-don-t-scan-phy-addresses-0.patch b/queue-5.15/r8169-don-t-scan-phy-addresses-0.patch new file mode 100644 index 0000000000..9ddf160ae0 --- /dev/null +++ b/queue-5.15/r8169-don-t-scan-phy-addresses-0.patch @@ -0,0 +1,36 @@ +From 0d61b3993a286063dc155112e059c7b51e757b6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Feb 2025 07:58:17 +0100 +Subject: r8169: don't scan PHY addresses > 0 + +From: Heiner Kallweit + +[ Upstream commit faac69a4ae5abb49e62c79c66b51bb905c9aa5ec ] + +The PHY address is a dummy, because r8169 PHY access registers +don't support a PHY address. Therefore scan address 0 only. + +Signed-off-by: Heiner Kallweit +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/830637dd-4016-4a68-92b3-618fcac6589d@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index d9d19ea77d20b..1ea30c9b8c07c 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -5185,6 +5185,7 @@ static int r8169_mdio_register(struct rtl8169_private *tp) + new_bus->priv = tp; + new_bus->parent = &pdev->dev; + new_bus->irq[0] = PHY_MAC_INTERRUPT; ++ new_bus->phy_mask = GENMASK(31, 1); + snprintf(new_bus->id, MII_BUS_ID_SIZE, "r8169-%x-%x", + pci_domain_nr(pdev->bus), pci_dev_id(pdev)); + +-- +2.39.5 + diff --git a/queue-5.15/rcu-fix-header-guard-for-rcu_all_qs.patch b/queue-5.15/rcu-fix-header-guard-for-rcu_all_qs.patch new file mode 100644 index 0000000000..a1a5b2a191 --- /dev/null +++ b/queue-5.15/rcu-fix-header-guard-for-rcu_all_qs.patch @@ -0,0 +1,44 @@ +From 6a83bc68c817eb5b8731efc06b5246bd6dfcdc5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Dec 2024 20:06:52 -0800 +Subject: rcu: fix header guard for rcu_all_qs() + +From: Ankur Arora + +[ Upstream commit ad6b5b73ff565e88aca7a7d1286788d80c97ba71 ] + +rcu_all_qs() is defined for !CONFIG_PREEMPT_RCU but the declaration +is conditioned on CONFIG_PREEMPTION. + +With CONFIG_PREEMPT_LAZY, CONFIG_PREEMPTION=y does not imply +CONFIG_PREEMPT_RCU=y. + +Decouple the two. + +Cc: Paul E. McKenney +Reviewed-by: Frederic Weisbecker +Reviewed-by: Sebastian Andrzej Siewior +Signed-off-by: Ankur Arora +Signed-off-by: Paul E. McKenney +Signed-off-by: Boqun Feng +Signed-off-by: Sasha Levin +--- + include/linux/rcutree.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/rcutree.h b/include/linux/rcutree.h +index 53209d6694001..3828ff8a2f9c9 100644 +--- a/include/linux/rcutree.h ++++ b/include/linux/rcutree.h +@@ -66,7 +66,7 @@ extern int rcu_scheduler_active __read_mostly; + void rcu_end_inkernel_boot(void); + bool rcu_inkernel_boot_has_ended(void); + bool rcu_is_watching(void); +-#ifndef CONFIG_PREEMPTION ++#ifndef CONFIG_PREEMPT_RCU + void rcu_all_qs(void); + #endif + +-- +2.39.5 + diff --git a/queue-5.15/rcu-handle-quiescent-states-for-preempt_rcu-n-preemp.patch b/queue-5.15/rcu-handle-quiescent-states-for-preempt_rcu-n-preemp.patch new file mode 100644 index 0000000000..46365d8cfa --- /dev/null +++ b/queue-5.15/rcu-handle-quiescent-states-for-preempt_rcu-n-preemp.patch @@ -0,0 +1,63 @@ +From 67953636105eed248d8b848c13673ef7e1e85244 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Dec 2024 20:06:56 -0800 +Subject: rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y + +From: Ankur Arora + +[ Upstream commit 83b28cfe796464ebbde1cf7916c126da6d572685 ] + +With PREEMPT_RCU=n, cond_resched() provides urgently needed quiescent +states for read-side critical sections via rcu_all_qs(). +One reason why this was needed: lacking preempt-count, the tick +handler has no way of knowing whether it is executing in a +read-side critical section or not. + +With (PREEMPT_LAZY=y, PREEMPT_DYNAMIC=n), we get (PREEMPT_COUNT=y, +PREEMPT_RCU=n). In this configuration cond_resched() is a stub and +does not provide quiescent states via rcu_all_qs(). +(PREEMPT_RCU=y provides this information via rcu_read_unlock() and +its nesting counter.) + +So, use the availability of preempt_count() to report quiescent states +in rcu_flavor_sched_clock_irq(). + +Suggested-by: Paul E. McKenney +Reviewed-by: Sebastian Andrzej Siewior +Signed-off-by: Ankur Arora +Reviewed-by: Frederic Weisbecker +Signed-off-by: Paul E. McKenney +Signed-off-by: Boqun Feng +Signed-off-by: Sasha Levin +--- + kernel/rcu/tree_plugin.h | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h +index b48b42d76474e..9e84d603e882e 100644 +--- a/kernel/rcu/tree_plugin.h ++++ b/kernel/rcu/tree_plugin.h +@@ -945,13 +945,16 @@ static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp) + */ + static void rcu_flavor_sched_clock_irq(int user) + { +- if (user || rcu_is_cpu_rrupt_from_idle()) { ++ if (user || rcu_is_cpu_rrupt_from_idle() || ++ (IS_ENABLED(CONFIG_PREEMPT_COUNT) && ++ (preempt_count() == HARDIRQ_OFFSET))) { + + /* + * Get here if this CPU took its interrupt from user +- * mode or from the idle loop, and if this is not a +- * nested interrupt. In this case, the CPU is in +- * a quiescent state, so note it. ++ * mode, from the idle loop without this being a nested ++ * interrupt, or while not holding the task preempt count ++ * (with PREEMPT_COUNT=y). In this case, the CPU is in a ++ * quiescent state, so note it. + * + * No memory barrier is required here because rcu_qs() + * references only CPU-local variables that other CPUs +-- +2.39.5 + diff --git a/queue-5.15/rdma-core-fix-best-page-size-finding-when-it-can-cro.patch b/queue-5.15/rdma-core-fix-best-page-size-finding-when-it-can-cro.patch new file mode 100644 index 0000000000..e5723e84a3 --- /dev/null +++ b/queue-5.15/rdma-core-fix-best-page-size-finding-when-it-can-cro.patch @@ -0,0 +1,139 @@ +From 315fb85d394003aa410f18f0a7772851f0da3a81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Feb 2025 14:16:23 +0000 +Subject: RDMA/core: Fix best page size finding when it can cross SG entries + +From: Michael Margolin + +[ Upstream commit 486055f5e09df959ad4e3aa4ee75b5c91ddeec2e ] + +A single scatter-gather entry is limited by a 32 bits "length" field +that is practically 4GB - PAGE_SIZE. This means that even when the +memory is physically contiguous, we might need more than one entry to +represent it. Additionally when using dmabuf, the sg_table might be +originated outside the subsystem and optimized for other needs. + +For instance an SGT of 16GB GPU continuous memory might look like this: +(a real life example) + +dma_address 34401400000, length fffff000 +dma_address 345013ff000, length fffff000 +dma_address 346013fe000, length fffff000 +dma_address 347013fd000, length fffff000 +dma_address 348013fc000, length 4000 + +Since ib_umem_find_best_pgsz works within SG entries, in the above case +we will result with the worst possible 4KB page size. + +Fix this by taking into consideration only the alignment of addresses of +real discontinuity points rather than treating SG entries as such, and +adjust the page iterator to correctly handle cross SG entry pages. + +There is currently an assumption that drivers do not ask for pages +bigger than maximal DMA size supported by their devices. + +Reviewed-by: Firas Jahjah +Reviewed-by: Yonatan Nachum +Signed-off-by: Michael Margolin +Link: https://patch.msgid.link/20250217141623.12428-1-mrgolin@amazon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/umem.c | 36 ++++++++++++++++++++++++--------- + drivers/infiniband/core/verbs.c | 11 +++++----- + 2 files changed, 32 insertions(+), 15 deletions(-) + +diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c +index 8ce569bf7525e..1d154055a335b 100644 +--- a/drivers/infiniband/core/umem.c ++++ b/drivers/infiniband/core/umem.c +@@ -80,9 +80,12 @@ unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem, + unsigned long pgsz_bitmap, + unsigned long virt) + { +- struct scatterlist *sg; ++ unsigned long curr_len = 0; ++ dma_addr_t curr_base = ~0; + unsigned long va, pgoff; ++ struct scatterlist *sg; + dma_addr_t mask; ++ dma_addr_t end; + int i; + + umem->iova = va = virt; +@@ -107,17 +110,30 @@ unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem, + pgoff = umem->address & ~PAGE_MASK; + + for_each_sgtable_dma_sg(&umem->sgt_append.sgt, sg, i) { +- /* Walk SGL and reduce max page size if VA/PA bits differ +- * for any address. ++ /* If the current entry is physically contiguous with the previous ++ * one, no need to take its start addresses into consideration. + */ +- mask |= (sg_dma_address(sg) + pgoff) ^ va; ++ if (check_add_overflow(curr_base, curr_len, &end) || ++ end != sg_dma_address(sg)) { ++ ++ curr_base = sg_dma_address(sg); ++ curr_len = 0; ++ ++ /* Reduce max page size if VA/PA bits differ */ ++ mask |= (curr_base + pgoff) ^ va; ++ ++ /* The alignment of any VA matching a discontinuity point ++ * in the physical memory sets the maximum possible page ++ * size as this must be a starting point of a new page that ++ * needs to be aligned. ++ */ ++ if (i != 0) ++ mask |= va; ++ } ++ ++ curr_len += sg_dma_len(sg); + va += sg_dma_len(sg) - pgoff; +- /* Except for the last entry, the ending iova alignment sets +- * the maximum possible page size as the low bits of the iova +- * must be zero when starting the next chunk. +- */ +- if (i != (umem->sgt_append.sgt.nents - 1)) +- mask |= va; ++ + pgoff = 0; + } + +diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c +index cae013130eb1d..bdc9564f0ff82 100644 +--- a/drivers/infiniband/core/verbs.c ++++ b/drivers/infiniband/core/verbs.c +@@ -2967,22 +2967,23 @@ EXPORT_SYMBOL(__rdma_block_iter_start); + bool __rdma_block_iter_next(struct ib_block_iter *biter) + { + unsigned int block_offset; +- unsigned int sg_delta; ++ unsigned int delta; + + if (!biter->__sg_nents || !biter->__sg) + return false; + + biter->__dma_addr = sg_dma_address(biter->__sg) + biter->__sg_advance; + block_offset = biter->__dma_addr & (BIT_ULL(biter->__pg_bit) - 1); +- sg_delta = BIT_ULL(biter->__pg_bit) - block_offset; ++ delta = BIT_ULL(biter->__pg_bit) - block_offset; + +- if (sg_dma_len(biter->__sg) - biter->__sg_advance > sg_delta) { +- biter->__sg_advance += sg_delta; +- } else { ++ while (biter->__sg_nents && biter->__sg && ++ sg_dma_len(biter->__sg) - biter->__sg_advance <= delta) { ++ delta -= sg_dma_len(biter->__sg) - biter->__sg_advance; + biter->__sg_advance = 0; + biter->__sg = sg_next(biter->__sg); + biter->__sg_nents--; + } ++ biter->__sg_advance += delta; + + return true; + } +-- +2.39.5 + diff --git a/queue-5.15/rdma-uverbs-propagate-errors-from-rdma_lookup_get_uo.patch b/queue-5.15/rdma-uverbs-propagate-errors-from-rdma_lookup_get_uo.patch new file mode 100644 index 0000000000..6eb223be26 --- /dev/null +++ b/queue-5.15/rdma-uverbs-propagate-errors-from-rdma_lookup_get_uo.patch @@ -0,0 +1,432 @@ +From 48b23005aacfa54caf3c0c8b7630ea8247532e2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Feb 2025 15:54:13 +0200 +Subject: RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject() + +From: Maher Sanalla + +[ Upstream commit 81f8f7454ad9e0bf95efdec6542afdc9a6ab1e24 ] + +Currently, the IB uverbs API calls uobj_get_uobj_read(), which in turn +uses the rdma_lookup_get_uobject() helper to retrieve user objects. +In case of failure, uobj_get_uobj_read() returns NULL, overriding the +error code from rdma_lookup_get_uobject(). The IB uverbs API then +translates this NULL to -EINVAL, masking the actual error and +complicating debugging. For example, applications calling ibv_modify_qp +that fails with EBUSY when retrieving the QP uobject will see the +overridden error code EINVAL instead, masking the actual error. + +Furthermore, based on rdma-core commit: +"2a22f1ced5f3 ("Merge pull request #1568 from jakemoroni/master")" +Kernel's IB uverbs return values are either ignored and passed on as is +to application or overridden with other errnos in a few cases. + +Thus, to improve error reporting and debuggability, propagate the +original error from rdma_lookup_get_uobject() instead of replacing it +with EINVAL. + +Signed-off-by: Maher Sanalla +Link: https://patch.msgid.link/64f9d3711b183984e939962c2f83383904f97dfb.1740577869.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/uverbs_cmd.c | 144 ++++++++++++++------------- + include/rdma/uverbs_std_types.h | 2 +- + 2 files changed, 77 insertions(+), 69 deletions(-) + +diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c +index 7797f0e4dabad..de631a6abe48d 100644 +--- a/drivers/infiniband/core/uverbs_cmd.c ++++ b/drivers/infiniband/core/uverbs_cmd.c +@@ -718,8 +718,8 @@ static int ib_uverbs_reg_mr(struct uverbs_attr_bundle *attrs) + goto err_free; + + pd = uobj_get_obj_read(pd, UVERBS_OBJECT_PD, cmd.pd_handle, attrs); +- if (!pd) { +- ret = -EINVAL; ++ if (IS_ERR(pd)) { ++ ret = PTR_ERR(pd); + goto err_free; + } + +@@ -809,8 +809,8 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs) + if (cmd.flags & IB_MR_REREG_PD) { + new_pd = uobj_get_obj_read(pd, UVERBS_OBJECT_PD, cmd.pd_handle, + attrs); +- if (!new_pd) { +- ret = -EINVAL; ++ if (IS_ERR(new_pd)) { ++ ret = PTR_ERR(new_pd); + goto put_uobjs; + } + } else { +@@ -919,8 +919,8 @@ static int ib_uverbs_alloc_mw(struct uverbs_attr_bundle *attrs) + return PTR_ERR(uobj); + + pd = uobj_get_obj_read(pd, UVERBS_OBJECT_PD, cmd.pd_handle, attrs); +- if (!pd) { +- ret = -EINVAL; ++ if (IS_ERR(pd)) { ++ ret = PTR_ERR(pd); + goto err_free; + } + +@@ -1127,8 +1127,8 @@ static int ib_uverbs_resize_cq(struct uverbs_attr_bundle *attrs) + return ret; + + cq = uobj_get_obj_read(cq, UVERBS_OBJECT_CQ, cmd.cq_handle, attrs); +- if (!cq) +- return -EINVAL; ++ if (IS_ERR(cq)) ++ return PTR_ERR(cq); + + ret = cq->device->ops.resize_cq(cq, cmd.cqe, &attrs->driver_udata); + if (ret) +@@ -1189,8 +1189,8 @@ static int ib_uverbs_poll_cq(struct uverbs_attr_bundle *attrs) + return ret; + + cq = uobj_get_obj_read(cq, UVERBS_OBJECT_CQ, cmd.cq_handle, attrs); +- if (!cq) +- return -EINVAL; ++ if (IS_ERR(cq)) ++ return PTR_ERR(cq); + + /* we copy a struct ib_uverbs_poll_cq_resp to user space */ + header_ptr = attrs->ucore.outbuf; +@@ -1238,8 +1238,8 @@ static int ib_uverbs_req_notify_cq(struct uverbs_attr_bundle *attrs) + return ret; + + cq = uobj_get_obj_read(cq, UVERBS_OBJECT_CQ, cmd.cq_handle, attrs); +- if (!cq) +- return -EINVAL; ++ if (IS_ERR(cq)) ++ return PTR_ERR(cq); + + ib_req_notify_cq(cq, cmd.solicited_only ? + IB_CQ_SOLICITED : IB_CQ_NEXT_COMP); +@@ -1321,8 +1321,8 @@ static int create_qp(struct uverbs_attr_bundle *attrs, + ind_tbl = uobj_get_obj_read(rwq_ind_table, + UVERBS_OBJECT_RWQ_IND_TBL, + cmd->rwq_ind_tbl_handle, attrs); +- if (!ind_tbl) { +- ret = -EINVAL; ++ if (IS_ERR(ind_tbl)) { ++ ret = PTR_ERR(ind_tbl); + goto err_put; + } + +@@ -1360,8 +1360,10 @@ static int create_qp(struct uverbs_attr_bundle *attrs, + if (cmd->is_srq) { + srq = uobj_get_obj_read(srq, UVERBS_OBJECT_SRQ, + cmd->srq_handle, attrs); +- if (!srq || srq->srq_type == IB_SRQT_XRC) { +- ret = -EINVAL; ++ if (IS_ERR(srq) || ++ srq->srq_type == IB_SRQT_XRC) { ++ ret = IS_ERR(srq) ? PTR_ERR(srq) : ++ -EINVAL; + goto err_put; + } + } +@@ -1371,23 +1373,29 @@ static int create_qp(struct uverbs_attr_bundle *attrs, + rcq = uobj_get_obj_read( + cq, UVERBS_OBJECT_CQ, + cmd->recv_cq_handle, attrs); +- if (!rcq) { +- ret = -EINVAL; ++ if (IS_ERR(rcq)) { ++ ret = PTR_ERR(rcq); + goto err_put; + } + } + } + } + +- if (has_sq) ++ if (has_sq) { + scq = uobj_get_obj_read(cq, UVERBS_OBJECT_CQ, + cmd->send_cq_handle, attrs); ++ if (IS_ERR(scq)) { ++ ret = PTR_ERR(scq); ++ goto err_put; ++ } ++ } ++ + if (!ind_tbl && cmd->qp_type != IB_QPT_XRC_INI) + rcq = rcq ?: scq; + pd = uobj_get_obj_read(pd, UVERBS_OBJECT_PD, cmd->pd_handle, + attrs); +- if (!pd || (!scq && has_sq)) { +- ret = -EINVAL; ++ if (IS_ERR(pd)) { ++ ret = PTR_ERR(pd); + goto err_put; + } + +@@ -1483,18 +1491,18 @@ static int create_qp(struct uverbs_attr_bundle *attrs, + err_put: + if (!IS_ERR(xrcd_uobj)) + uobj_put_read(xrcd_uobj); +- if (pd) ++ if (!IS_ERR_OR_NULL(pd)) + uobj_put_obj_read(pd); +- if (scq) ++ if (!IS_ERR_OR_NULL(scq)) + rdma_lookup_put_uobject(&scq->uobject->uevent.uobject, + UVERBS_LOOKUP_READ); +- if (rcq && rcq != scq) ++ if (!IS_ERR_OR_NULL(rcq) && rcq != scq) + rdma_lookup_put_uobject(&rcq->uobject->uevent.uobject, + UVERBS_LOOKUP_READ); +- if (srq) ++ if (!IS_ERR_OR_NULL(srq)) + rdma_lookup_put_uobject(&srq->uobject->uevent.uobject, + UVERBS_LOOKUP_READ); +- if (ind_tbl) ++ if (!IS_ERR_OR_NULL(ind_tbl)) + uobj_put_obj_read(ind_tbl); + + uobj_alloc_abort(&obj->uevent.uobject, attrs); +@@ -1656,8 +1664,8 @@ static int ib_uverbs_query_qp(struct uverbs_attr_bundle *attrs) + } + + qp = uobj_get_obj_read(qp, UVERBS_OBJECT_QP, cmd.qp_handle, attrs); +- if (!qp) { +- ret = -EINVAL; ++ if (IS_ERR(qp)) { ++ ret = PTR_ERR(qp); + goto out; + } + +@@ -1762,8 +1770,8 @@ static int modify_qp(struct uverbs_attr_bundle *attrs, + + qp = uobj_get_obj_read(qp, UVERBS_OBJECT_QP, cmd->base.qp_handle, + attrs); +- if (!qp) { +- ret = -EINVAL; ++ if (IS_ERR(qp)) { ++ ret = PTR_ERR(qp); + goto out; + } + +@@ -2028,8 +2036,8 @@ static int ib_uverbs_post_send(struct uverbs_attr_bundle *attrs) + return -ENOMEM; + + qp = uobj_get_obj_read(qp, UVERBS_OBJECT_QP, cmd.qp_handle, attrs); +- if (!qp) { +- ret = -EINVAL; ++ if (IS_ERR(qp)) { ++ ret = PTR_ERR(qp); + goto out; + } + +@@ -2066,9 +2074,9 @@ static int ib_uverbs_post_send(struct uverbs_attr_bundle *attrs) + + ud->ah = uobj_get_obj_read(ah, UVERBS_OBJECT_AH, + user_wr->wr.ud.ah, attrs); +- if (!ud->ah) { ++ if (IS_ERR(ud->ah)) { ++ ret = PTR_ERR(ud->ah); + kfree(ud); +- ret = -EINVAL; + goto out_put; + } + ud->remote_qpn = user_wr->wr.ud.remote_qpn; +@@ -2305,8 +2313,8 @@ static int ib_uverbs_post_recv(struct uverbs_attr_bundle *attrs) + return PTR_ERR(wr); + + qp = uobj_get_obj_read(qp, UVERBS_OBJECT_QP, cmd.qp_handle, attrs); +- if (!qp) { +- ret = -EINVAL; ++ if (IS_ERR(qp)) { ++ ret = PTR_ERR(qp); + goto out; + } + +@@ -2356,8 +2364,8 @@ static int ib_uverbs_post_srq_recv(struct uverbs_attr_bundle *attrs) + return PTR_ERR(wr); + + srq = uobj_get_obj_read(srq, UVERBS_OBJECT_SRQ, cmd.srq_handle, attrs); +- if (!srq) { +- ret = -EINVAL; ++ if (IS_ERR(srq)) { ++ ret = PTR_ERR(srq); + goto out; + } + +@@ -2413,8 +2421,8 @@ static int ib_uverbs_create_ah(struct uverbs_attr_bundle *attrs) + } + + pd = uobj_get_obj_read(pd, UVERBS_OBJECT_PD, cmd.pd_handle, attrs); +- if (!pd) { +- ret = -EINVAL; ++ if (IS_ERR(pd)) { ++ ret = PTR_ERR(pd); + goto err; + } + +@@ -2483,8 +2491,8 @@ static int ib_uverbs_attach_mcast(struct uverbs_attr_bundle *attrs) + return ret; + + qp = uobj_get_obj_read(qp, UVERBS_OBJECT_QP, cmd.qp_handle, attrs); +- if (!qp) +- return -EINVAL; ++ if (IS_ERR(qp)) ++ return PTR_ERR(qp); + + obj = qp->uobject; + +@@ -2533,8 +2541,8 @@ static int ib_uverbs_detach_mcast(struct uverbs_attr_bundle *attrs) + return ret; + + qp = uobj_get_obj_read(qp, UVERBS_OBJECT_QP, cmd.qp_handle, attrs); +- if (!qp) +- return -EINVAL; ++ if (IS_ERR(qp)) ++ return PTR_ERR(qp); + + obj = qp->uobject; + mutex_lock(&obj->mcast_lock); +@@ -2668,8 +2676,8 @@ static int kern_spec_to_ib_spec_action(struct uverbs_attr_bundle *attrs, + UVERBS_OBJECT_FLOW_ACTION, + kern_spec->action.handle, + attrs); +- if (!ib_spec->action.act) +- return -EINVAL; ++ if (IS_ERR(ib_spec->action.act)) ++ return PTR_ERR(ib_spec->action.act); + ib_spec->action.size = + sizeof(struct ib_flow_spec_action_handle); + flow_resources_add(uflow_res, +@@ -2686,8 +2694,8 @@ static int kern_spec_to_ib_spec_action(struct uverbs_attr_bundle *attrs, + UVERBS_OBJECT_COUNTERS, + kern_spec->flow_count.handle, + attrs); +- if (!ib_spec->flow_count.counters) +- return -EINVAL; ++ if (IS_ERR(ib_spec->flow_count.counters)) ++ return PTR_ERR(ib_spec->flow_count.counters); + ib_spec->flow_count.size = + sizeof(struct ib_flow_spec_action_count); + flow_resources_add(uflow_res, +@@ -2905,14 +2913,14 @@ static int ib_uverbs_ex_create_wq(struct uverbs_attr_bundle *attrs) + return PTR_ERR(obj); + + pd = uobj_get_obj_read(pd, UVERBS_OBJECT_PD, cmd.pd_handle, attrs); +- if (!pd) { +- err = -EINVAL; ++ if (IS_ERR(pd)) { ++ err = PTR_ERR(pd); + goto err_uobj; + } + + cq = uobj_get_obj_read(cq, UVERBS_OBJECT_CQ, cmd.cq_handle, attrs); +- if (!cq) { +- err = -EINVAL; ++ if (IS_ERR(cq)) { ++ err = PTR_ERR(cq); + goto err_put_pd; + } + +@@ -3013,8 +3021,8 @@ static int ib_uverbs_ex_modify_wq(struct uverbs_attr_bundle *attrs) + return -EINVAL; + + wq = uobj_get_obj_read(wq, UVERBS_OBJECT_WQ, cmd.wq_handle, attrs); +- if (!wq) +- return -EINVAL; ++ if (IS_ERR(wq)) ++ return PTR_ERR(wq); + + if (cmd.attr_mask & IB_WQ_FLAGS) { + wq_attr.flags = cmd.flags; +@@ -3097,8 +3105,8 @@ static int ib_uverbs_ex_create_rwq_ind_table(struct uverbs_attr_bundle *attrs) + num_read_wqs++) { + wq = uobj_get_obj_read(wq, UVERBS_OBJECT_WQ, + wqs_handles[num_read_wqs], attrs); +- if (!wq) { +- err = -EINVAL; ++ if (IS_ERR(wq)) { ++ err = PTR_ERR(wq); + goto put_wqs; + } + +@@ -3253,8 +3261,8 @@ static int ib_uverbs_ex_create_flow(struct uverbs_attr_bundle *attrs) + } + + qp = uobj_get_obj_read(qp, UVERBS_OBJECT_QP, cmd.qp_handle, attrs); +- if (!qp) { +- err = -EINVAL; ++ if (IS_ERR(qp)) { ++ err = PTR_ERR(qp); + goto err_uobj; + } + +@@ -3400,15 +3408,15 @@ static int __uverbs_create_xsrq(struct uverbs_attr_bundle *attrs, + if (ib_srq_has_cq(cmd->srq_type)) { + attr.ext.cq = uobj_get_obj_read(cq, UVERBS_OBJECT_CQ, + cmd->cq_handle, attrs); +- if (!attr.ext.cq) { +- ret = -EINVAL; ++ if (IS_ERR(attr.ext.cq)) { ++ ret = PTR_ERR(attr.ext.cq); + goto err_put_xrcd; + } + } + + pd = uobj_get_obj_read(pd, UVERBS_OBJECT_PD, cmd->pd_handle, attrs); +- if (!pd) { +- ret = -EINVAL; ++ if (IS_ERR(pd)) { ++ ret = PTR_ERR(pd); + goto err_put_cq; + } + +@@ -3515,8 +3523,8 @@ static int ib_uverbs_modify_srq(struct uverbs_attr_bundle *attrs) + return ret; + + srq = uobj_get_obj_read(srq, UVERBS_OBJECT_SRQ, cmd.srq_handle, attrs); +- if (!srq) +- return -EINVAL; ++ if (IS_ERR(srq)) ++ return PTR_ERR(srq); + + attr.max_wr = cmd.max_wr; + attr.srq_limit = cmd.srq_limit; +@@ -3543,8 +3551,8 @@ static int ib_uverbs_query_srq(struct uverbs_attr_bundle *attrs) + return ret; + + srq = uobj_get_obj_read(srq, UVERBS_OBJECT_SRQ, cmd.srq_handle, attrs); +- if (!srq) +- return -EINVAL; ++ if (IS_ERR(srq)) ++ return PTR_ERR(srq); + + ret = ib_query_srq(srq, &attr); + +@@ -3669,8 +3677,8 @@ static int ib_uverbs_ex_modify_cq(struct uverbs_attr_bundle *attrs) + return -EOPNOTSUPP; + + cq = uobj_get_obj_read(cq, UVERBS_OBJECT_CQ, cmd.cq_handle, attrs); +- if (!cq) +- return -EINVAL; ++ if (IS_ERR(cq)) ++ return PTR_ERR(cq); + + ret = rdma_set_cq_moderation(cq, cmd.attr.cq_count, cmd.attr.cq_period); + +diff --git a/include/rdma/uverbs_std_types.h b/include/rdma/uverbs_std_types.h +index fe05121169589..555ea3d142a46 100644 +--- a/include/rdma/uverbs_std_types.h ++++ b/include/rdma/uverbs_std_types.h +@@ -34,7 +34,7 @@ + static inline void *_uobj_get_obj_read(struct ib_uobject *uobj) + { + if (IS_ERR(uobj)) +- return NULL; ++ return ERR_CAST(uobj); + return uobj->object; + } + #define uobj_get_obj_read(_object, _type, _id, _attrs) \ +-- +2.39.5 + diff --git a/queue-5.15/regulator-ad5398-add-device-tree-support.patch b/queue-5.15/regulator-ad5398-add-device-tree-support.patch new file mode 100644 index 0000000000..ba2f97831c --- /dev/null +++ b/queue-5.15/regulator-ad5398-add-device-tree-support.patch @@ -0,0 +1,63 @@ +From f80fc521bf30b5844b64fe4b4a21b12b90c18b2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jan 2025 17:31:43 +0000 +Subject: regulator: ad5398: Add device tree support + +From: Isaac Scott + +[ Upstream commit 5a6a461079decea452fdcae955bccecf92e07e97 ] + +Previously, the ad5398 driver used only platform_data, which is +deprecated in favour of device tree. This caused the AD5398 to fail to +probe as it could not load its init_data. If the AD5398 has a device +tree node, pull the init_data from there using +of_get_regulator_init_data. + +Signed-off-by: Isaac Scott +Acked-by: Michael Hennerich +Link: https://patch.msgid.link/20250128173143.959600-4-isaac.scott@ideasonboard.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/ad5398.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/regulator/ad5398.c b/drivers/regulator/ad5398.c +index 75f432f61e919..f4d6e62bd963e 100644 +--- a/drivers/regulator/ad5398.c ++++ b/drivers/regulator/ad5398.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + + #define AD5398_CURRENT_EN_MASK 0x8000 + +@@ -221,15 +222,20 @@ static int ad5398_probe(struct i2c_client *client, + const struct ad5398_current_data_format *df = + (struct ad5398_current_data_format *)id->driver_data; + +- if (!init_data) +- return -EINVAL; +- + chip = devm_kzalloc(&client->dev, sizeof(*chip), GFP_KERNEL); + if (!chip) + return -ENOMEM; + + config.dev = &client->dev; ++ if (client->dev.of_node) ++ init_data = of_get_regulator_init_data(&client->dev, ++ client->dev.of_node, ++ &ad5398_reg); ++ if (!init_data) ++ return -EINVAL; ++ + config.init_data = init_data; ++ config.of_node = client->dev.of_node; + config.driver_data = chip; + + chip->client = client; +-- +2.39.5 + diff --git a/queue-5.15/remoteproc-qcom_wcnss-handle-platforms-with-only-sin.patch b/queue-5.15/remoteproc-qcom_wcnss-handle-platforms-with-only-sin.patch new file mode 100644 index 0000000000..650da507ab --- /dev/null +++ b/queue-5.15/remoteproc-qcom_wcnss-handle-platforms-with-only-sin.patch @@ -0,0 +1,113 @@ +From f43bbf3341e55c7a03c982841c20aa9d71e57e7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Feb 2025 20:56:48 +0100 +Subject: remoteproc: qcom_wcnss: Handle platforms with only single power + domain +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Matti Lehtimäki + +[ Upstream commit 65991ea8a6d1e68effdc01d95ebe39f1653f7b71 ] + +Both MSM8974 and MSM8226 have only CX as power domain with MX & PX being +handled as regulators. Handle this case by reodering pd_names to have CX +first, and handling that the driver core will already attach a single +power domain internally. + +Signed-off-by: Matti Lehtimäki +[luca: minor changes] +Signed-off-by: Luca Weiss +Link: https://lore.kernel.org/r/20250206-wcnss-singlepd-v2-2-9a53ee953dee@lucaweiss.eu +[bjorn: Added missing braces to else after multi-statement if] +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/qcom_wcnss.c | 33 ++++++++++++++++++++++++++------- + 1 file changed, 26 insertions(+), 7 deletions(-) + +diff --git a/drivers/remoteproc/qcom_wcnss.c b/drivers/remoteproc/qcom_wcnss.c +index 97a0c0dc4c77a..3e07f5621d0f2 100644 +--- a/drivers/remoteproc/qcom_wcnss.c ++++ b/drivers/remoteproc/qcom_wcnss.c +@@ -118,10 +118,10 @@ static const struct wcnss_data pronto_v1_data = { + .pmu_offset = 0x1004, + .spare_offset = 0x1088, + +- .pd_names = { "mx", "cx" }, ++ .pd_names = { "cx", "mx" }, + .vregs = (struct wcnss_vreg_info[]) { +- { "vddmx", 950000, 1150000, 0 }, + { "vddcx", .super_turbo = true}, ++ { "vddmx", 950000, 1150000, 0 }, + { "vddpx", 1800000, 1800000, 0 }, + }, + .num_pd_vregs = 2, +@@ -132,10 +132,10 @@ static const struct wcnss_data pronto_v2_data = { + .pmu_offset = 0x1004, + .spare_offset = 0x1088, + +- .pd_names = { "mx", "cx" }, ++ .pd_names = { "cx", "mx" }, + .vregs = (struct wcnss_vreg_info[]) { +- { "vddmx", 1287500, 1287500, 0 }, + { "vddcx", .super_turbo = true }, ++ { "vddmx", 1287500, 1287500, 0 }, + { "vddpx", 1800000, 1800000, 0 }, + }, + .num_pd_vregs = 2, +@@ -387,8 +387,17 @@ static irqreturn_t wcnss_stop_ack_interrupt(int irq, void *dev) + static int wcnss_init_pds(struct qcom_wcnss *wcnss, + const char * const pd_names[WCNSS_MAX_PDS]) + { ++ struct device *dev = wcnss->dev; + int i, ret; + ++ /* Handle single power domain */ ++ if (dev->pm_domain) { ++ wcnss->pds[0] = dev; ++ wcnss->num_pds = 1; ++ pm_runtime_enable(dev); ++ return 0; ++ } ++ + for (i = 0; i < WCNSS_MAX_PDS; i++) { + if (!pd_names[i]) + break; +@@ -408,8 +417,15 @@ static int wcnss_init_pds(struct qcom_wcnss *wcnss, + + static void wcnss_release_pds(struct qcom_wcnss *wcnss) + { ++ struct device *dev = wcnss->dev; + int i; + ++ /* Handle single power domain */ ++ if (wcnss->num_pds == 1 && dev->pm_domain) { ++ pm_runtime_disable(dev); ++ return; ++ } ++ + for (i = 0; i < wcnss->num_pds; i++) + dev_pm_domain_detach(wcnss->pds[i], false); + } +@@ -427,10 +443,13 @@ static int wcnss_init_regulators(struct qcom_wcnss *wcnss, + * the regulators for the power domains. For old device trees we need to + * reserve extra space to manage them through the regulator interface. + */ +- if (wcnss->num_pds) +- info += num_pd_vregs; +- else ++ if (wcnss->num_pds) { ++ info += wcnss->num_pds; ++ /* Handle single power domain case */ ++ num_vregs += num_pd_vregs - wcnss->num_pds; ++ } else { + num_vregs += num_pd_vregs; ++ } + + bulk = devm_kcalloc(wcnss->dev, + num_vregs, sizeof(struct regulator_bulk_data), +-- +2.39.5 + diff --git a/queue-5.15/rtc-ds1307-stop-disabling-alarms-on-probe.patch b/queue-5.15/rtc-ds1307-stop-disabling-alarms-on-probe.patch new file mode 100644 index 0000000000..09692696a7 --- /dev/null +++ b/queue-5.15/rtc-ds1307-stop-disabling-alarms-on-probe.patch @@ -0,0 +1,38 @@ +From 5d5a7645f4d1acef4769efe94b74d91475217c33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Mar 2025 23:37:44 +0100 +Subject: rtc: ds1307: stop disabling alarms on probe + +From: Alexandre Belloni + +[ Upstream commit dcec12617ee61beed928e889607bf37e145bf86b ] + +It is a bad practice to disable alarms on probe or remove as this will +prevent alarms across reboots. + +Link: https://lore.kernel.org/r/20250303223744.1135672-1-alexandre.belloni@bootlin.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-ds1307.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c +index 336cb9aa5e336..d5a7a377e4a61 100644 +--- a/drivers/rtc/rtc-ds1307.c ++++ b/drivers/rtc/rtc-ds1307.c +@@ -1802,10 +1802,8 @@ static int ds1307_probe(struct i2c_client *client, + * For some variants, be sure alarms can trigger when we're + * running on Vbackup (BBSQI/BBSQW) + */ +- if (want_irq || ds1307_can_wakeup_device) { ++ if (want_irq || ds1307_can_wakeup_device) + regs[0] |= DS1337_BIT_INTCN | chip->bbsqi_bit; +- regs[0] &= ~(DS1337_BIT_A2IE | DS1337_BIT_A1IE); +- } + + regmap_write(ds1307->regmap, DS1337_REG_CONTROL, + regs[0]); +-- +2.39.5 + diff --git a/queue-5.15/rtc-rv3032-fix-eerd-location.patch b/queue-5.15/rtc-rv3032-fix-eerd-location.patch new file mode 100644 index 0000000000..56955f338a --- /dev/null +++ b/queue-5.15/rtc-rv3032-fix-eerd-location.patch @@ -0,0 +1,34 @@ +From fb5164c104edb805ced18e0509418f5c81e5b22b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Mar 2025 22:42:41 +0100 +Subject: rtc: rv3032: fix EERD location + +From: Alexandre Belloni + +[ Upstream commit b0f9cb4a0706b0356e84d67e48500b77b343debe ] + +EERD is bit 2 in CTRL1 + +Link: https://lore.kernel.org/r/20250306214243.1167692-1-alexandre.belloni@bootlin.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-rv3032.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-rv3032.c b/drivers/rtc/rtc-rv3032.c +index 1b62ed2f14594..6b7712f0b09ce 100644 +--- a/drivers/rtc/rtc-rv3032.c ++++ b/drivers/rtc/rtc-rv3032.c +@@ -69,7 +69,7 @@ + #define RV3032_CLKOUT2_FD_MSK GENMASK(6, 5) + #define RV3032_CLKOUT2_OS BIT(7) + +-#define RV3032_CTRL1_EERD BIT(3) ++#define RV3032_CTRL1_EERD BIT(2) + #define RV3032_CTRL1_WADA BIT(5) + + #define RV3032_CTRL2_STOP BIT(0) +-- +2.39.5 + diff --git a/queue-5.15/samples-bpf-fix-compilation-failure-for-samples-bpf-.patch b/queue-5.15/samples-bpf-fix-compilation-failure-for-samples-bpf-.patch new file mode 100644 index 0000000000..7285d9cca1 --- /dev/null +++ b/queue-5.15/samples-bpf-fix-compilation-failure-for-samples-bpf-.patch @@ -0,0 +1,59 @@ +From 12a02bebc949ab57a0adea61f0935a947af17ef1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Apr 2025 17:50:42 +0800 +Subject: samples/bpf: Fix compilation failure for samples/bpf on LoongArch + Fedora + +From: Haoran Jiang + +[ Upstream commit 548762f05d19c5542db7590bcdfb9be1fb928376 ] + +When building the latest samples/bpf on LoongArch Fedora + + make M=samples/bpf + +There are compilation errors as follows: + +In file included from ./linux/samples/bpf/sockex2_kern.c:2: +In file included from ./include/uapi/linux/in.h:25: +In file included from ./include/linux/socket.h:8: +In file included from ./include/linux/uio.h:9: +In file included from ./include/linux/thread_info.h:60: +In file included from ./arch/loongarch/include/asm/thread_info.h:15: +In file included from ./arch/loongarch/include/asm/processor.h:13: +In file included from ./arch/loongarch/include/asm/cpu-info.h:11: +./arch/loongarch/include/asm/loongarch.h:13:10: fatal error: 'larchintrin.h' file not found + ^~~~~~~~~~~~~~~ +1 error generated. + +larchintrin.h is included in /usr/lib64/clang/14.0.6/include, +and the header file location is specified at compile time. + +Test on LoongArch Fedora: +https://github.com/fedora-remix-loongarch/releases-info + +Signed-off-by: Haoran Jiang +Signed-off-by: zhangxi +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250425095042.838824-1-jianghaoran@kylinos.cn +Signed-off-by: Sasha Levin +--- + samples/bpf/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile +index e2c9ea65df9fb..9edf83eb2a99d 100644 +--- a/samples/bpf/Makefile ++++ b/samples/bpf/Makefile +@@ -438,7 +438,7 @@ $(obj)/%.o: $(src)/%.c + @echo " CLANG-bpf " $@ + $(Q)$(CLANG) $(NOSTDINC_FLAGS) $(LINUXINCLUDE) $(BPF_EXTRA_CFLAGS) \ + -I$(obj) -I$(srctree)/tools/testing/selftests/bpf/ \ +- -I$(LIBBPF_INCLUDE) \ ++ -I$(LIBBPF_INCLUDE) $(CLANG_SYS_INCLUDES) \ + -D__KERNEL__ -D__BPF_TRACING__ -Wno-unused-value -Wno-pointer-sign \ + -D__TARGET_ARCH_$(SRCARCH) -Wno-compare-distinct-pointer-types \ + -Wno-gnu-variable-sized-type-not-at-end \ +-- +2.39.5 + diff --git a/queue-5.15/scsi-lpfc-handle-duplicate-d_ids-in-ndlp-search-by-d.patch b/queue-5.15/scsi-lpfc-handle-duplicate-d_ids-in-ndlp-search-by-d.patch new file mode 100644 index 0000000000..f05b96c0e2 --- /dev/null +++ b/queue-5.15/scsi-lpfc-handle-duplicate-d_ids-in-ndlp-search-by-d.patch @@ -0,0 +1,66 @@ +From da5f11e35db1cac397d44df2ade9326b207409c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jan 2025 16:05:22 -0800 +Subject: scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine + +From: Justin Tee + +[ Upstream commit 56c3d809b7b450379162d0b8a70bbe71ab8db706 ] + +After a port swap between separate fabrics, there may be multiple nodes in +the vport's fc_nodes list with the same fabric well known address. +Duplication is temporary and eventually resolves itself after dev_loss_tmo +expires, but nameserver queries may still occur before dev_loss_tmo. This +possibly results in returning stale fabric ndlp objects. Fix by adding an +nlp_state check to ensure the ndlp search routine returns the correct newer +allocated ndlp fabric object. + +Signed-off-by: Justin Tee +Link: https://lore.kernel.org/r/20250131000524.163662-5-justintee8345@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_hbadisc.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c +index 54aff304cdcf4..d04669ae878bd 100644 +--- a/drivers/scsi/lpfc/lpfc_hbadisc.c ++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c +@@ -5631,6 +5631,7 @@ static struct lpfc_nodelist * + __lpfc_findnode_did(struct lpfc_vport *vport, uint32_t did) + { + struct lpfc_nodelist *ndlp; ++ struct lpfc_nodelist *np = NULL; + uint32_t data1; + + list_for_each_entry(ndlp, &vport->fc_nodes, nlp_listp) { +@@ -5645,14 +5646,20 @@ __lpfc_findnode_did(struct lpfc_vport *vport, uint32_t did) + ndlp, ndlp->nlp_DID, + ndlp->nlp_flag, data1, ndlp->nlp_rpi, + ndlp->active_rrqs_xri_bitmap); +- return ndlp; ++ ++ /* Check for new or potentially stale node */ ++ if (ndlp->nlp_state != NLP_STE_UNUSED_NODE) ++ return ndlp; ++ np = ndlp; + } + } + +- /* FIND node did NOT FOUND */ +- lpfc_printf_vlog(vport, KERN_INFO, LOG_NODE, +- "0932 FIND node did x%x NOT FOUND.\n", did); +- return NULL; ++ if (!np) ++ /* FIND node did NOT FOUND */ ++ lpfc_printf_vlog(vport, KERN_INFO, LOG_NODE, ++ "0932 FIND node did x%x NOT FOUND.\n", did); ++ ++ return np; + } + + struct lpfc_nodelist * +-- +2.39.5 + diff --git a/queue-5.15/scsi-mpt3sas-send-a-diag-reset-if-target-reset-fails.patch b/queue-5.15/scsi-mpt3sas-send-a-diag-reset-if-target-reset-fails.patch new file mode 100644 index 0000000000..906d948073 --- /dev/null +++ b/queue-5.15/scsi-mpt3sas-send-a-diag-reset-if-target-reset-fails.patch @@ -0,0 +1,64 @@ +From cc7ff452a81896f297cd4d161f6c134b441a145a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Feb 2025 17:26:55 -0800 +Subject: scsi: mpt3sas: Send a diag reset if target reset fails + +From: Shivasharan S + +[ Upstream commit 5612d6d51ed2634a033c95de2edec7449409cbb9 ] + +When an IOCTL times out and driver issues a target reset, if firmware +fails the task management elevate the recovery by issuing a diag reset to +controller. + +Signed-off-by: Shivasharan S +Link: https://lore.kernel.org/r/1739410016-27503-5-git-send-email-shivasharan.srikanteshwara@broadcom.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_ctl.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_ctl.c b/drivers/scsi/mpt3sas/mpt3sas_ctl.c +index 20336175c14f5..81cd96b93bdf8 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_ctl.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_ctl.c +@@ -678,6 +678,7 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg, + size_t data_in_sz = 0; + long ret; + u16 device_handle = MPT3SAS_INVALID_DEVICE_HANDLE; ++ int tm_ret; + + issue_reset = 0; + +@@ -1111,18 +1112,25 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg, + if (pcie_device && (!ioc->tm_custom_handling) && + (!(mpt3sas_scsih_is_pcie_scsi_device( + pcie_device->device_info)))) +- mpt3sas_scsih_issue_locked_tm(ioc, ++ tm_ret = mpt3sas_scsih_issue_locked_tm(ioc, + le16_to_cpu(mpi_request->FunctionDependent1), + 0, 0, 0, + MPI2_SCSITASKMGMT_TASKTYPE_TARGET_RESET, 0, + 0, pcie_device->reset_timeout, + MPI26_SCSITASKMGMT_MSGFLAGS_PROTOCOL_LVL_RST_PCIE); + else +- mpt3sas_scsih_issue_locked_tm(ioc, ++ tm_ret = mpt3sas_scsih_issue_locked_tm(ioc, + le16_to_cpu(mpi_request->FunctionDependent1), + 0, 0, 0, + MPI2_SCSITASKMGMT_TASKTYPE_TARGET_RESET, 0, + 0, 30, MPI2_SCSITASKMGMT_MSGFLAGS_LINK_RESET); ++ ++ if (tm_ret != SUCCESS) { ++ ioc_info(ioc, ++ "target reset failed, issue hard reset: handle (0x%04x)\n", ++ le16_to_cpu(mpi_request->FunctionDependent1)); ++ mpt3sas_base_hard_reset_handler(ioc, FORCE_BIG_HAMMER); ++ } + } else + mpt3sas_base_hard_reset_handler(ioc, FORCE_BIG_HAMMER); + } +-- +2.39.5 + diff --git a/queue-5.15/scsi-st-erase-does-not-change-tape-location.patch b/queue-5.15/scsi-st-erase-does-not-change-tape-location.patch new file mode 100644 index 0000000000..9d38b09fa5 --- /dev/null +++ b/queue-5.15/scsi-st-erase-does-not-change-tape-location.patch @@ -0,0 +1,38 @@ +From 4da79dbb1d43316e0ce8865d27ff7cf1070ef3a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 13:25:15 +0200 +Subject: scsi: st: ERASE does not change tape location +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kai Mäkisara + +[ Upstream commit ad77cebf97bd42c93ab4e3bffd09f2b905c1959a ] + +The SCSI ERASE command erases from the current position onwards. Don't +clear the position variables. + +Signed-off-by: Kai Mäkisara +Link: https://lore.kernel.org/r/20250311112516.5548-3-Kai.Makisara@kolumbus.fi +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/st.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c +index a58cb2171f958..26827e94d5e38 100644 +--- a/drivers/scsi/st.c ++++ b/drivers/scsi/st.c +@@ -2884,7 +2884,6 @@ static int st_int_ioctl(struct scsi_tape *STp, unsigned int cmd_in, unsigned lon + timeout = STp->long_timeout * 8; + + DEBC_printk(STp, "Erasing tape.\n"); +- fileno = blkno = at_sm = 0; + break; + case MTSETBLK: /* Set block length */ + case MTSETDENSITY: /* Set tape density */ +-- +2.39.5 + diff --git a/queue-5.15/scsi-st-restore-some-drive-settings-after-reset.patch b/queue-5.15/scsi-st-restore-some-drive-settings-after-reset.patch new file mode 100644 index 0000000000..a77a7e3f1e --- /dev/null +++ b/queue-5.15/scsi-st-restore-some-drive-settings-after-reset.patch @@ -0,0 +1,112 @@ +From 5531e669f57d18dbd849a12f407d9bb51036d3a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jan 2025 21:49:22 +0200 +Subject: scsi: st: Restore some drive settings after reset +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kai Mäkisara + +[ Upstream commit 7081dc75df79696d8322d01821c28e53416c932c ] + +Some of the allowed operations put the tape into a known position to +continue operation assuming only the tape position has changed. But reset +sets partition, density and block size to drive default values. These +should be restored to the values before reset. + +Normally the current block size and density are stored by the drive. If +the settings have been changed, the changed values have to be saved by the +driver across reset. + +Signed-off-by: Kai Mäkisara +Link: https://lore.kernel.org/r/20250120194925.44432-2-Kai.Makisara@kolumbus.fi +Reviewed-by: John Meneghini +Tested-by: John Meneghini +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/st.c | 24 +++++++++++++++++++++--- + drivers/scsi/st.h | 2 ++ + 2 files changed, 23 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c +index 26827e94d5e38..dc0c6508d254b 100644 +--- a/drivers/scsi/st.c ++++ b/drivers/scsi/st.c +@@ -947,7 +947,6 @@ static void reset_state(struct scsi_tape *STp) + STp->partition = find_partition(STp); + if (STp->partition < 0) + STp->partition = 0; +- STp->new_partition = STp->partition; + } + } + +@@ -2916,14 +2915,17 @@ static int st_int_ioctl(struct scsi_tape *STp, unsigned int cmd_in, unsigned lon + if (cmd_in == MTSETDENSITY) { + (STp->buffer)->b_data[4] = arg; + STp->density_changed = 1; /* At least we tried ;-) */ ++ STp->changed_density = arg; + } else if (cmd_in == SET_DENS_AND_BLK) + (STp->buffer)->b_data[4] = arg >> 24; + else + (STp->buffer)->b_data[4] = STp->density; + if (cmd_in == MTSETBLK || cmd_in == SET_DENS_AND_BLK) { + ltmp = arg & MT_ST_BLKSIZE_MASK; +- if (cmd_in == MTSETBLK) ++ if (cmd_in == MTSETBLK) { + STp->blksize_changed = 1; /* At least we tried ;-) */ ++ STp->changed_blksize = arg; ++ } + } else + ltmp = STp->block_size; + (STp->buffer)->b_data[9] = (ltmp >> 16); +@@ -3624,9 +3626,25 @@ static long st_ioctl(struct file *file, unsigned int cmd_in, unsigned long arg) + retval = (-EIO); + goto out; + } +- reset_state(STp); ++ reset_state(STp); /* Clears pos_unknown */ + /* remove this when the midlevel properly clears was_reset */ + STp->device->was_reset = 0; ++ ++ /* Fix the device settings after reset, ignore errors */ ++ if (mtc.mt_op == MTREW || mtc.mt_op == MTSEEK || ++ mtc.mt_op == MTEOM) { ++ if (STp->can_partitions) { ++ /* STp->new_partition contains the ++ * latest partition set ++ */ ++ STp->partition = 0; ++ switch_partition(STp); ++ } ++ if (STp->density_changed) ++ st_int_ioctl(STp, MTSETDENSITY, STp->changed_density); ++ if (STp->blksize_changed) ++ st_int_ioctl(STp, MTSETBLK, STp->changed_blksize); ++ } + } + + if (mtc.mt_op != MTNOP && mtc.mt_op != MTSETBLK && +diff --git a/drivers/scsi/st.h b/drivers/scsi/st.h +index c0ef0d9aaf8a2..f6ac5ffe7df6f 100644 +--- a/drivers/scsi/st.h ++++ b/drivers/scsi/st.h +@@ -166,12 +166,14 @@ struct scsi_tape { + unsigned char compression_changed; + unsigned char drv_buffer; + unsigned char density; ++ unsigned char changed_density; + unsigned char door_locked; + unsigned char autorew_dev; /* auto-rewind device */ + unsigned char rew_at_close; /* rewind necessary at close */ + unsigned char inited; + unsigned char cleaning_req; /* cleaning requested? */ + int block_size; ++ int changed_blksize; + int min_block; + int max_block; + int recover_count; /* From tape opening */ +-- +2.39.5 + diff --git a/queue-5.15/scsi-st-tighten-the-page-format-heuristics-with-mode.patch b/queue-5.15/scsi-st-tighten-the-page-format-heuristics-with-mode.patch new file mode 100644 index 0000000000..b0066a26ff --- /dev/null +++ b/queue-5.15/scsi-st-tighten-the-page-format-heuristics-with-mode.patch @@ -0,0 +1,47 @@ +From 2c85c7f5c08dc485e22eed5a40326924d41ac328 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 13:25:16 +0200 +Subject: scsi: st: Tighten the page format heuristics with MODE SELECT +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kai Mäkisara + +[ Upstream commit 8db816c6f176321e42254badd5c1a8df8bfcfdb4 ] + +In the days when SCSI-2 was emerging, some drives did claim SCSI-2 but did +not correctly implement it. The st driver first tries MODE SELECT with the +page format bit set to set the block descriptor. If not successful, the +non-page format is tried. + +The test only tests the sense code and this triggers also from illegal +parameter in the parameter list. The test is limited to "old" devices and +made more strict to remove false alarms. + +Signed-off-by: Kai Mäkisara +Link: https://lore.kernel.org/r/20250311112516.5548-4-Kai.Makisara@kolumbus.fi +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/st.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c +index 956b3b9c5aad5..a58cb2171f958 100644 +--- a/drivers/scsi/st.c ++++ b/drivers/scsi/st.c +@@ -3071,7 +3071,9 @@ static int st_int_ioctl(struct scsi_tape *STp, unsigned int cmd_in, unsigned lon + cmd_in == MTSETDRVBUFFER || + cmd_in == SET_DENS_AND_BLK) { + if (cmdstatp->sense_hdr.sense_key == ILLEGAL_REQUEST && +- !(STp->use_pf & PF_TESTED)) { ++ cmdstatp->sense_hdr.asc == 0x24 && ++ (STp->device)->scsi_level <= SCSI_2 && ++ !(STp->use_pf & PF_TESTED)) { + /* Try the other possible state of Page Format if not + already tried */ + STp->use_pf = (STp->use_pf ^ USE_PF) | PF_TESTED; +-- +2.39.5 + diff --git a/queue-5.15/scsi-target-iscsi-fix-timeout-on-deleted-connection.patch b/queue-5.15/scsi-target-iscsi-fix-timeout-on-deleted-connection.patch new file mode 100644 index 0000000000..72c0388ae0 --- /dev/null +++ b/queue-5.15/scsi-target-iscsi-fix-timeout-on-deleted-connection.patch @@ -0,0 +1,57 @@ +From d0e3c0a05b75b9191afc1dae8e0ffe6c22a14a47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 13:17:57 +0300 +Subject: scsi: target: iscsi: Fix timeout on deleted connection + +From: Dmitry Bogdanov + +[ Upstream commit 7f533cc5ee4c4436cee51dc58e81dfd9c3384418 ] + +NOPIN response timer may expire on a deleted connection and crash with +such logs: + +Did not receive response to NOPIN on CID: 0, failing connection for I_T Nexus (null),i,0x00023d000125,iqn.2017-01.com.iscsi.target,t,0x3d + +BUG: Kernel NULL pointer dereference on read at 0x00000000 +NIP strlcpy+0x8/0xb0 +LR iscsit_fill_cxn_timeout_err_stats+0x5c/0xc0 [iscsi_target_mod] +Call Trace: + iscsit_handle_nopin_response_timeout+0xfc/0x120 [iscsi_target_mod] + call_timer_fn+0x58/0x1f0 + run_timer_softirq+0x740/0x860 + __do_softirq+0x16c/0x420 + irq_exit+0x188/0x1c0 + timer_interrupt+0x184/0x410 + +That is because nopin response timer may be re-started on nopin timer +expiration. + +Stop nopin timer before stopping the nopin response timer to be sure +that no one of them will be re-started. + +Signed-off-by: Dmitry Bogdanov +Link: https://lore.kernel.org/r/20241224101757.32300-1-d.bogdanov@yadro.com +Reviewed-by: Maurizio Lombardi +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/iscsi/iscsi_target.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 686a9e5918e21..b072718701329 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -4170,8 +4170,8 @@ int iscsit_close_connection( + spin_unlock(&iscsit_global->ts_bitmap_lock); + + iscsit_stop_timers_for_cmds(conn); +- iscsit_stop_nopin_response_timer(conn); + iscsit_stop_nopin_timer(conn); ++ iscsit_stop_nopin_response_timer(conn); + + if (conn->conn_transport->iscsit_wait_conn) + conn->conn_transport->iscsit_wait_conn(conn); +-- +2.39.5 + diff --git a/queue-5.15/selftests-net-have-gro.sh-t-return-a-correct-exit-co.patch b/queue-5.15/selftests-net-have-gro.sh-t-return-a-correct-exit-co.patch new file mode 100644 index 0000000000..b0d84504f8 --- /dev/null +++ b/queue-5.15/selftests-net-have-gro.sh-t-return-a-correct-exit-co.patch @@ -0,0 +1,37 @@ +From 637534184f65570eef3256f31ad03afddc44b0a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Feb 2025 11:27:23 -0800 +Subject: selftests/net: have `gro.sh -t` return a correct exit code + +From: Kevin Krakauer + +[ Upstream commit 784e6abd99f24024a8998b5916795f0bec9d2fd9 ] + +Modify gro.sh to return a useful exit code when the -t flag is used. It +formerly returned 0 no matter what. + +Tested: Ran `gro.sh -t large` and verified that test failures return 1. +Signed-off-by: Kevin Krakauer +Reviewed-by: Willem de Bruijn +Link: https://patch.msgid.link/20250226192725.621969-2-krakauer@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/gro.sh | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/net/gro.sh b/tools/testing/selftests/net/gro.sh +index 342ad27f631b1..e771f5f7faa26 100755 +--- a/tools/testing/selftests/net/gro.sh ++++ b/tools/testing/selftests/net/gro.sh +@@ -95,5 +95,6 @@ trap cleanup EXIT + if [[ "${test}" == "all" ]]; then + run_all_tests + else +- run_test "${proto}" "${test}" ++ exit_code=$(run_test "${proto}" "${test}") ++ exit $exit_code + fi; +-- +2.39.5 + diff --git a/queue-5.15/series b/queue-5.15/series new file mode 100644 index 0000000000..2f7bd9292c --- /dev/null +++ b/queue-5.15/series @@ -0,0 +1,165 @@ +scsi-target-iscsi-fix-timeout-on-deleted-connection.patch +virtio_ring-fix-data-race-by-tagging-event_triggered.patch +dma-mapping-avoid-potential-unused-data-compilation-.patch +cgroup-fix-compilation-issue-due-to-cgroup_mutex-not.patch +net-enetc-refactor-bulk-flipping-of-rx-buffers-to-se.patch +bpf-fix-possible-endless-loop-in-bpf-map-iteration.patch +samples-bpf-fix-compilation-failure-for-samples-bpf-.patch +kconfig-merge_config-use-an-empty-file-as-initfile.patch +nfsv4-check-for-delegation-validity-in-nfs_start_del.patch +tracing-mark-binary-printing-functions-with-__printf.patch +mailbox-use-error-ret-code-of-of_parse_phandle_with_.patch +fbdev-fsl-diu-fb-add-missing-device_remove_file.patch +fbcon-use-correct-erase-colour-for-clearing-in-fbcon.patch +fbdev-core-tileblit-implement-missing-margin-clearin.patch +nfsv4-treat-enetunreach-errors-as-fatal-for-state-re.patch +sunrpc-rpc_clnt_set_transport-must-not-change-the-au.patch +sunrpc-rpcbind-should-never-reset-the-port-to-the-va.patch +thermal-drivers-qoriq-power-down-tmu-on-system-suspe.patch +exit-fix-the-usage-of-delay_group_leader-exit_code-i.patch +dql-fix-dql-limit-value-when-reset.patch +lockdep-fix-wait-context-check-on-softirq-for-preemp.patch +pci-dwc-ep-ensure-proper-iteration-over-outbound-map.patch +tools-build-don-t-pass-test-log-files-to-linker.patch +pnfs-flexfiles-report-enetdown-as-a-connection-error.patch +pci-vmd-disable-msi-remapping-bypass-under-xen.patch +libnvdimm-labels-fix-divide-error-in-nd_label_data_i.patch +mmc-host-wait-for-vdd-to-settle-on-card-power-off.patch +wifi-mt76-only-mark-tx-status-failed-frames-as-acked.patch +i2c-qup-vote-for-interconnect-bandwidth-to-dram.patch +i2c-pxa-fix-call-balance-of-i2c-clk-handling-routine.patch +btrfs-make-btrfs_discard_workfn-block_group-ref-expl.patch +btrfs-avoid-linker-error-in-btrfs_find_create_tree_b.patch +btrfs-get-zone-unusable-bytes-while-holding-lock-at-.patch +btrfs-send-return-enametoolong-when-attempting-a-pat.patch +i3c-master-svc-fix-missing-stop-for-master-request.patch +dlm-make-tcp-still-work-in-multi-link-env.patch +clocksource-drivers-timer-riscv-stop-stimecmp-when-c.patch +um-store-full-csgsfs-and-ss-register-from-mcontext.patch +um-update-min_low_pfn-to-match-changes-in-uml_reserv.patch +ext4-reorder-capability-check-last.patch +scsi-st-tighten-the-page-format-heuristics-with-mode.patch +scsi-st-erase-does-not-change-tape-location.patch +vfio-pci-handle-intx-irq_notconnected.patch +tcp-reorganize-tcp_in_ack_event-and-tcp_count_delive.patch +rtc-rv3032-fix-eerd-location.patch +asoc-mediatek-mt6359-add-stub-for-mt6359_accdet_enab.patch +kbuild-fix-argument-parsing-in-scripts-config.patch +crypto-octeontx2-suppress-auth-failure-screaming-due.patch +dm-restrict-dm-device-size-to-2-63-512-bytes.patch +xen-add-support-for-xenserver-6.1-platform-device.patch +f2fs-defer-readonly-check-vs-norecovery.patch +rdma-uverbs-propagate-errors-from-rdma_lookup_get_uo.patch +posix-timers-add-cond_resched-to-posix_timer_add-sea.patch +timer_list-don-t-use-pk-through-printk.patch +netfilter-conntrack-bound-nf_conntrack-sysctl-writes.patch +arm64-mm-check-pud_type_table-in-pud_bad.patch +mmc-sdhci-disable-sd-card-clock-before-changing-para.patch +ipv6-save-dontfrag-in-cork.patch +auxdisplay-charlcd-partially-revert-move-hwidth-and-.patch +asoc-qcom-sm8250-explicitly-set-format-in-sm8250_be_.patch +cpufreq-tegra186-share-policy-per-cluster.patch +crypto-lzo-fix-compression-buffer-overrun.patch +arm64-tegra-p2597-fix-gpio-for-vdd-1v8-dis-regulator.patch +powerpc-prom_init-fixup-missing-size-cells-on-powerb.patch +tcp-bring-back-numa-dispersion-in-inet_ehash_locks_a.patch +rtc-ds1307-stop-disabling-alarms-on-probe.patch +ieee802154-ca8210-use-proper-setters-and-getters-for.patch +arm-tegra-switch-dsi-b-clock-parent-to-plld-on-tegra.patch +media-c8sectpfe-call-of_node_put-i2c_bus-only-once-i.patch +dm-cache-prevent-bug_on-by-blocking-retries-on-faile.patch +orangefs-do-not-truncate-file-size.patch +remoteproc-qcom_wcnss-handle-platforms-with-only-sin.patch +drm-amdgpu-do-not-program-agp-bar-regs-under-sriov-i.patch +media-cx231xx-set-device_caps-for-417.patch +pinctrl-bcm281xx-use-unsigned-int-instead-of-bare-un.patch +net-ethernet-ti-cpsw_new-populate-netdev-of_node.patch +net-pktgen-fix-mpls-maximum-labels-list-parsing.patch +ipv4-fib-move-fib_valid_key_len-to-rtm_to_fib_config.patch +media-uvcvideo-add-sanity-check-to-uvc_ioctl_xu_ctrl.patch +clk-imx8mp-inform-ccf-of-maximum-frequency-of-clocks.patch +x86-bugs-make-spectre-user-default-depend-on-mitigat.patch +hwmon-gpio-fan-add-missing-mutex-locks.patch +arm-at91-pm-fix-at91_suspend_finish-for-zq-calibrati.patch +drm-mediatek-mtk_dpi-add-checks-for-reg_h_fre_con-ex.patch +fpga-altera-cvp-increase-credit-timeout.patch +pci-brcmstb-expand-inbound-window-size-up-to-64gb.patch +pci-brcmstb-add-a-softdep-to-mip-msi-x-driver.patch +firmware-arm_ffa-set-dma_mask-for-ffa-devices.patch +net-mlx5-avoid-report-two-health-errors-on-same-synd.patch +selftests-net-have-gro.sh-t-return-a-correct-exit-co.patch +drm-amdkfd-kfd-release_work-possible-circular-lockin.patch +net-xgene-v2-remove-incorrect-acpi_ptr-annotation.patch +bonding-report-duplicate-mac-address-in-all-situatio.patch +soc-ti-k3-socinfo-do-not-use-syscon-helper-to-build-.patch +x86-build-fix-broken-copy-command-in-genimage.sh-whe.patch +drm-amd-display-handle-max_downscale_src_width-fail-.patch +x86-nmi-add-an-emergency-handler-in-nmi_desc-use-it-.patch +cpuidle-menu-avoid-discarding-useful-information.patch +libbpf-fix-out-of-bound-read.patch +x86-kaslr-reduce-kaslr-entropy-on-most-x86-systems.patch +mips-use-arch-specific-syscall-name-match-function.patch +mips-pm-cps-use-per-cpu-variables-as-per-cpu-not-per.patch +clocksource-mips-gic-timer-enable-counter-when-cpus-.patch +scsi-mpt3sas-send-a-diag-reset-if-target-reset-fails.patch +wifi-rtw88-fix-rtw_init_vht_cap-for-rtl8814au.patch +wifi-rtw88-fix-rtw_init_ht_cap-for-rtl8814au.patch +wifi-rtw88-fix-rtw_desc_to_mcsrate-to-handle-mcs16-3.patch +net-pktgen-fix-access-outside-of-user-given-buffer-i.patch +edac-ie31200-work-around-false-positive-build-warnin.patch +bpf-prevent-unsafe-access-to-the-sock-fields-in-the-.patch +rdma-core-fix-best-page-size-finding-when-it-can-cro.patch +can-c_can-use-of_property_present-to-test-existence-.patch +eth-mlx4-don-t-try-to-complete-xdp-frames-in-netpoll.patch +pci-fix-old_size-lower-bound-in-calculate_iosize-too.patch +acpi-hed-always-initialize-before-evged.patch +net-mlx5-modify-lsb-bitmask-in-temperature-event-to-.patch +net-mlx5-apply-rate-limiting-to-high-temperature-war.patch +asoc-ops-enforce-platform-maximum-on-initial-value.patch +asoc-tas2764-power-up-down-amp-on-mute-ops.patch +asoc-soc-dai-check-return-value-at-snd_soc_dai_set_t.patch +pinctrl-devicetree-do-not-goto-err-when-probing-hogs.patch +smack-recognize-ipv4-cipso-w-o-categories.patch +media-v4l-memset-argument-to-0-before-calling-get_mb.patch +libbpf-fix-ldx-stx-st-co-re-relocation-size-adjustme.patch +net-mlx4_core-avoid-impossible-mlx4_db_alloc-order-v.patch +phy-core-don-t-require-set_mode-callback-for-phy_get.patch +drm-amdgpu-reset-psp-cmd-to-null-after-releasing-the.patch +drm-amd-display-initial-psr_version-with-correct-set.patch +net-mlx5-extend-ethtool-loopback-selftest-to-support.patch +net-mlx5e-set-the-tx_queue_len-for-pfifo_fast.patch +net-mlx5e-reduce-rep-rxq-depth-to-256-for-ecpf.patch +wifi-mac80211-don-t-unconditionally-call-drv_mgd_com.patch +wifi-mac80211-remove-misplaced-drv_mgd_complete_tx-c.patch +arch-powerpc-perf-check-the-instruction-type-before-.patch +ip-fib_rules-fetch-net-from-fib_rule-in-fib-46-_rule.patch +r8152-add-vendor-device-id-pair-for-dell-alienware-a.patch +wifi-rtw88-fix-download_firmware_validate-for-rtl881.patch +clk-qcom-camcc-sm8250-use-clk_rcg2_shared_ops-for-so.patch +hwmon-xgene-hwmon-use-appropriate-type-for-the-laten.patch +media-qcom-camss-csid-only-add-tpg-v4l2-ctrl-if-tpg-.patch +vxlan-annotate-fdb-data-races.patch +r8169-don-t-scan-phy-addresses-0.patch +rcu-handle-quiescent-states-for-preempt_rcu-n-preemp.patch +rcu-fix-header-guard-for-rcu_all_qs.patch +net-mana-fix-warning-in-the-writer-of-client-oob.patch +scsi-lpfc-handle-duplicate-d_ids-in-ndlp-search-by-d.patch +scsi-st-restore-some-drive-settings-after-reset.patch +hid-usbkbd-fix-the-bit-shift-number-for-led_kana.patch +drm-ast-find-vbios-mode-from-regular-display-size.patch +bpftool-fix-readlink-usage-in-get_fd_type.patch +perf-amd-ibs-fix-perf_ibs_op.cnt_mask-for-curcnt.patch +wifi-rtw88-don-t-use-static-local-variable-in-rtw882.patch +spi-zynqmp-gqspi-always-acknowledge-interrupts.patch +regulator-ad5398-add-device-tree-support.patch +wifi-ath9k-return-by-of_get_mac_address.patch +drm-atomic-clarify-the-rules-around-drm_atomic_state.patch +drm-add-valid-clones-check.patch +asoc-imx-card-adjust-over-allocation-of-memory-in-im.patch +pinctrl-meson-define-the-pull-up-down-resistor-value.patch +asoc-intel-bytcr_rt5640-add-dmi-quirk-for-acer-aspir.patch +alsa-hda-realtek-add-quirk-for-hp-spectre-x360-15-df.patch +nvmet-tcp-don-t-restore-null-sk_state_change.patch +btrfs-correct-the-order-of-prelim_ref-arguments-in-b.patch +xenbus-allow-pvh-dom0-a-non-local-xenstore.patch +__legitimize_mnt-check-for-mnt_sync_umount-should-be.patch diff --git a/queue-5.15/smack-recognize-ipv4-cipso-w-o-categories.patch b/queue-5.15/smack-recognize-ipv4-cipso-w-o-categories.patch new file mode 100644 index 0000000000..234d5c9f60 --- /dev/null +++ b/queue-5.15/smack-recognize-ipv4-cipso-w-o-categories.patch @@ -0,0 +1,75 @@ +From f83f8e291d6f04afa642376e1fc8be191ca510b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jan 2025 02:40:34 +0300 +Subject: smack: recognize ipv4 CIPSO w/o categories + +From: Konstantin Andreev + +[ Upstream commit a158a937d864d0034fea14913c1f09c6d5f574b8 ] + +If SMACK label has CIPSO representation w/o categories, e.g.: + +| # cat /smack/cipso2 +| foo 10 +| @ 250/2 +| ... + +then SMACK does not recognize such CIPSO in input ipv4 packets +and substitues '*' label instead. Audit records may look like + +| lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied +| subject="*" object="_" requested=w pid=0 comm="swapper/1" ... + +This happens in two steps: + +1) security/smack/smackfs.c`smk_set_cipso + does not clear NETLBL_SECATTR_MLS_CAT + from (struct smack_known *)skp->smk_netlabel.flags + on assigning CIPSO w/o categories: + +| rcu_assign_pointer(skp->smk_netlabel.attr.mls.cat, ncats.attr.mls.cat); +| skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl; + +2) security/smack/smack_lsm.c`smack_from_secattr + can not match skp->smk_netlabel with input packet's + struct netlbl_lsm_secattr *sap + because sap->flags have not NETLBL_SECATTR_MLS_CAT (what is correct) + but skp->smk_netlabel.flags have (what is incorrect): + +| if ((sap->flags & NETLBL_SECATTR_MLS_CAT) == 0) { +| if ((skp->smk_netlabel.flags & +| NETLBL_SECATTR_MLS_CAT) == 0) +| found = 1; +| break; +| } + +This commit sets/clears NETLBL_SECATTR_MLS_CAT in +skp->smk_netlabel.flags according to the presense of CIPSO categories. +The update of smk_netlabel is not atomic, so input packets processing +still may be incorrect during short time while update proceeds. + +Signed-off-by: Konstantin Andreev +Signed-off-by: Casey Schaufler +Signed-off-by: Sasha Levin +--- + security/smack/smackfs.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c +index f6961a8895296..0feaa29cc0243 100644 +--- a/security/smack/smackfs.c ++++ b/security/smack/smackfs.c +@@ -921,6 +921,10 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, + if (rc >= 0) { + old_cat = skp->smk_netlabel.attr.mls.cat; + rcu_assign_pointer(skp->smk_netlabel.attr.mls.cat, ncats.attr.mls.cat); ++ if (ncats.attr.mls.cat) ++ skp->smk_netlabel.flags |= NETLBL_SECATTR_MLS_CAT; ++ else ++ skp->smk_netlabel.flags &= ~(u32)NETLBL_SECATTR_MLS_CAT; + skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl; + synchronize_rcu(); + netlbl_catmap_free(old_cat); +-- +2.39.5 + diff --git a/queue-5.15/soc-ti-k3-socinfo-do-not-use-syscon-helper-to-build-.patch b/queue-5.15/soc-ti-k3-socinfo-do-not-use-syscon-helper-to-build-.patch new file mode 100644 index 0000000000..f9f43e3d85 --- /dev/null +++ b/queue-5.15/soc-ti-k3-socinfo-do-not-use-syscon-helper-to-build-.patch @@ -0,0 +1,68 @@ +From f201aa8816ec1a1e98a94c422a174b9f6a3d4d5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jan 2025 12:17:26 -0600 +Subject: soc: ti: k3-socinfo: Do not use syscon helper to build regmap + +From: Andrew Davis + +[ Upstream commit a5caf03188e44388e8c618dcbe5fffad1a249385 ] + +The syscon helper device_node_to_regmap() is used to fetch a regmap +registered to a device node. It also currently creates this regmap +if the node did not already have a regmap associated with it. This +should only be used on "syscon" nodes. This driver is not such a +device and instead uses device_node_to_regmap() on its own node as +a hacky way to create a regmap for itself. + +This will not work going forward and so we should create our regmap +the normal way by defining our regmap_config, fetching our memory +resource, then using the normal regmap_init_mmio() function. + +Signed-off-by: Andrew Davis +Link: https://lore.kernel.org/r/20250123181726.597144-1-afd@ti.com +Signed-off-by: Nishanth Menon +Signed-off-by: Sasha Levin +--- + drivers/soc/ti/k3-socinfo.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/soc/ti/k3-socinfo.c b/drivers/soc/ti/k3-socinfo.c +index fd91129de6e5b..76a4e6eac8b53 100644 +--- a/drivers/soc/ti/k3-socinfo.c ++++ b/drivers/soc/ti/k3-socinfo.c +@@ -58,6 +58,12 @@ k3_chipinfo_partno_to_names(unsigned int partno, + return -EINVAL; + } + ++static const struct regmap_config k3_chipinfo_regmap_cfg = { ++ .reg_bits = 32, ++ .val_bits = 32, ++ .reg_stride = 4, ++}; ++ + static int k3_chipinfo_probe(struct platform_device *pdev) + { + struct device_node *node = pdev->dev.of_node; +@@ -65,13 +71,18 @@ static int k3_chipinfo_probe(struct platform_device *pdev) + struct device *dev = &pdev->dev; + struct soc_device *soc_dev; + struct regmap *regmap; ++ void __iomem *base; + u32 partno_id; + u32 variant; + u32 jtag_id; + u32 mfg; + int ret; + +- regmap = device_node_to_regmap(node); ++ base = devm_platform_ioremap_resource(pdev, 0); ++ if (IS_ERR(base)) ++ return PTR_ERR(base); ++ ++ regmap = regmap_init_mmio(dev, base, &k3_chipinfo_regmap_cfg); + if (IS_ERR(regmap)) + return PTR_ERR(regmap); + +-- +2.39.5 + diff --git a/queue-5.15/spi-zynqmp-gqspi-always-acknowledge-interrupts.patch b/queue-5.15/spi-zynqmp-gqspi-always-acknowledge-interrupts.patch new file mode 100644 index 0000000000..8eb973cd99 --- /dev/null +++ b/queue-5.15/spi-zynqmp-gqspi-always-acknowledge-interrupts.patch @@ -0,0 +1,72 @@ +From 54d72546ef2fa778084a75f10e7e24420253e7b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jan 2025 17:41:30 -0500 +Subject: spi: zynqmp-gqspi: Always acknowledge interrupts + +From: Sean Anderson + +[ Upstream commit 89785306453ce6d949e783f6936821a0b7649ee2 ] + +RXEMPTY can cause an IRQ, even though we may not do anything about it +(such as if we are waiting for more received data). We must still handle +these IRQs because we can tell they were caused by the device. + +Signed-off-by: Sean Anderson +Link: https://patch.msgid.link/20250116224130.2684544-6-sean.anderson@linux.dev +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-zynqmp-gqspi.c | 20 ++++++++------------ + 1 file changed, 8 insertions(+), 12 deletions(-) + +diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c +index 1847e3485dfea..77aef2a265615 100644 +--- a/drivers/spi/spi-zynqmp-gqspi.c ++++ b/drivers/spi/spi-zynqmp-gqspi.c +@@ -691,7 +691,6 @@ static void zynqmp_process_dma_irq(struct zynqmp_qspi *xqspi) + static irqreturn_t zynqmp_qspi_irq(int irq, void *dev_id) + { + struct zynqmp_qspi *xqspi = (struct zynqmp_qspi *)dev_id; +- irqreturn_t ret = IRQ_NONE; + u32 status, mask, dma_status = 0; + + status = zynqmp_gqspi_read(xqspi, GQSPI_ISR_OFST); +@@ -706,27 +705,24 @@ static irqreturn_t zynqmp_qspi_irq(int irq, void *dev_id) + dma_status); + } + +- if (mask & GQSPI_ISR_TXNOT_FULL_MASK) { ++ if (!mask && !dma_status) ++ return IRQ_NONE; ++ ++ if (mask & GQSPI_ISR_TXNOT_FULL_MASK) + zynqmp_qspi_filltxfifo(xqspi, GQSPI_TX_FIFO_FILL); +- ret = IRQ_HANDLED; +- } + +- if (dma_status & GQSPI_QSPIDMA_DST_I_STS_DONE_MASK) { ++ if (dma_status & GQSPI_QSPIDMA_DST_I_STS_DONE_MASK) + zynqmp_process_dma_irq(xqspi); +- ret = IRQ_HANDLED; +- } else if (!(mask & GQSPI_IER_RXEMPTY_MASK) && +- (mask & GQSPI_IER_GENFIFOEMPTY_MASK)) { ++ else if (!(mask & GQSPI_IER_RXEMPTY_MASK) && ++ (mask & GQSPI_IER_GENFIFOEMPTY_MASK)) + zynqmp_qspi_readrxfifo(xqspi, GQSPI_RX_FIFO_FILL); +- ret = IRQ_HANDLED; +- } + + if (xqspi->bytes_to_receive == 0 && xqspi->bytes_to_transfer == 0 && + ((status & GQSPI_IRQ_MASK) == GQSPI_IRQ_MASK)) { + zynqmp_gqspi_write(xqspi, GQSPI_IDR_OFST, GQSPI_ISR_IDR_MASK); + complete(&xqspi->data_completion); +- ret = IRQ_HANDLED; + } +- return ret; ++ return IRQ_HANDLED; + } + + /** +-- +2.39.5 + diff --git a/queue-5.15/sunrpc-rpc_clnt_set_transport-must-not-change-the-au.patch b/queue-5.15/sunrpc-rpc_clnt_set_transport-must-not-change-the-au.patch new file mode 100644 index 0000000000..b4e5df6b71 --- /dev/null +++ b/queue-5.15/sunrpc-rpc_clnt_set_transport-must-not-change-the-au.patch @@ -0,0 +1,38 @@ +From 51d44e373d2a4e06ffce5f1529ecccf90e9c2d91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Mar 2025 19:35:01 -0400 +Subject: SUNRPC: rpc_clnt_set_transport() must not change the autobind setting + +From: Trond Myklebust + +[ Upstream commit bf9be373b830a3e48117da5d89bb6145a575f880 ] + +The autobind setting was supposed to be determined in rpc_create(), +since commit c2866763b402 ("SUNRPC: use sockaddr + size when creating +remote transport endpoints"). + +Reviewed-by: Jeff Layton +Reviewed-by: Benjamin Coddington +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + net/sunrpc/clnt.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c +index 5de2fc7af268a..48ffdd4192538 100644 +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -275,9 +275,6 @@ static struct rpc_xprt *rpc_clnt_set_transport(struct rpc_clnt *clnt, + old = rcu_dereference_protected(clnt->cl_xprt, + lockdep_is_held(&clnt->cl_lock)); + +- if (!xprt_bound(xprt)) +- clnt->cl_autobind = 1; +- + clnt->cl_timeout = timeout; + rcu_assign_pointer(clnt->cl_xprt, xprt); + spin_unlock(&clnt->cl_lock); +-- +2.39.5 + diff --git a/queue-5.15/sunrpc-rpcbind-should-never-reset-the-port-to-the-va.patch b/queue-5.15/sunrpc-rpcbind-should-never-reset-the-port-to-the-va.patch new file mode 100644 index 0000000000..e911a2c98b --- /dev/null +++ b/queue-5.15/sunrpc-rpcbind-should-never-reset-the-port-to-the-va.patch @@ -0,0 +1,40 @@ +From 2ae25aa79782669e0d11d687d96076de382c4b11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Mar 2025 19:05:48 -0400 +Subject: SUNRPC: rpcbind should never reset the port to the value '0' + +From: Trond Myklebust + +[ Upstream commit 214c13e380ad7636631279f426387f9c4e3c14d9 ] + +If we already had a valid port number for the RPC service, then we +should not allow the rpcbind client to set it to the invalid value '0'. + +Reviewed-by: Jeff Layton +Reviewed-by: Benjamin Coddington +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + net/sunrpc/rpcb_clnt.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c +index 638b14f28101e..c49f9295fce97 100644 +--- a/net/sunrpc/rpcb_clnt.c ++++ b/net/sunrpc/rpcb_clnt.c +@@ -797,9 +797,10 @@ static void rpcb_getport_done(struct rpc_task *child, void *data) + } + + trace_rpcb_setport(child, map->r_status, map->r_port); +- xprt->ops->set_port(xprt, map->r_port); +- if (map->r_port) ++ if (map->r_port) { ++ xprt->ops->set_port(xprt, map->r_port); + xprt_set_bound(xprt); ++ } + } + + /* +-- +2.39.5 + diff --git a/queue-5.15/tcp-bring-back-numa-dispersion-in-inet_ehash_locks_a.patch b/queue-5.15/tcp-bring-back-numa-dispersion-in-inet_ehash_locks_a.patch new file mode 100644 index 0000000000..0332714d58 --- /dev/null +++ b/queue-5.15/tcp-bring-back-numa-dispersion-in-inet_ehash_locks_a.patch @@ -0,0 +1,105 @@ +From 28d7c1db98d59212b7d804de7d56fcf3c2d45c19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Mar 2025 13:05:50 +0000 +Subject: tcp: bring back NUMA dispersion in inet_ehash_locks_alloc() + +From: Eric Dumazet + +[ Upstream commit f8ece40786c9342249aa0a1b55e148ee23b2a746 ] + +We have platforms with 6 NUMA nodes and 480 cpus. + +inet_ehash_locks_alloc() currently allocates a single 64KB page +to hold all ehash spinlocks. This adds more pressure on a single node. + +Change inet_ehash_locks_alloc() to use vmalloc() to spread +the spinlocks on all online nodes, driven by NUMA policies. + +At boot time, NUMA policy is interleave=all, meaning that +tcp_hashinfo.ehash_locks gets hash dispersion on all nodes. + +Tested: + +lack5:~# grep inet_ehash_locks_alloc /proc/vmallocinfo +0x00000000d9aec4d1-0x00000000a828b652 69632 inet_ehash_locks_alloc+0x90/0x100 pages=16 vmalloc N0=2 N1=3 N2=3 N3=3 N4=3 N5=2 + +lack5:~# echo 8192 >/proc/sys/net/ipv4/tcp_child_ehash_entries +lack5:~# numactl --interleave=all unshare -n bash -c "grep inet_ehash_locks_alloc /proc/vmallocinfo" +0x000000004e99d30c-0x00000000763f3279 36864 inet_ehash_locks_alloc+0x90/0x100 pages=8 vmalloc N0=1 N1=2 N2=2 N3=1 N4=1 N5=1 +0x00000000d9aec4d1-0x00000000a828b652 69632 inet_ehash_locks_alloc+0x90/0x100 pages=16 vmalloc N0=2 N1=3 N2=3 N3=3 N4=3 N5=2 + +lack5:~# numactl --interleave=0,5 unshare -n bash -c "grep inet_ehash_locks_alloc /proc/vmallocinfo" +0x00000000fd73a33e-0x0000000004b9a177 36864 inet_ehash_locks_alloc+0x90/0x100 pages=8 vmalloc N0=4 N5=4 +0x00000000d9aec4d1-0x00000000a828b652 69632 inet_ehash_locks_alloc+0x90/0x100 pages=16 vmalloc N0=2 N1=3 N2=3 N3=3 N4=3 N5=2 + +lack5:~# echo 1024 >/proc/sys/net/ipv4/tcp_child_ehash_entries +lack5:~# numactl --interleave=all unshare -n bash -c "grep inet_ehash_locks_alloc /proc/vmallocinfo" +0x00000000db07d7a2-0x00000000ad697d29 8192 inet_ehash_locks_alloc+0x90/0x100 pages=1 vmalloc N2=1 +0x00000000d9aec4d1-0x00000000a828b652 69632 inet_ehash_locks_alloc+0x90/0x100 pages=16 vmalloc N0=2 N1=3 N2=3 N3=3 N4=3 N5=2 + +Signed-off-by: Eric Dumazet +Tested-by: Jason Xing +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20250305130550.1865988-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/inet_hashtables.c | 37 ++++++++++++++++++++++++++----------- + 1 file changed, 26 insertions(+), 11 deletions(-) + +diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c +index a2ab164e815a6..7d2c21c3cfd4a 100644 +--- a/net/ipv4/inet_hashtables.c ++++ b/net/ipv4/inet_hashtables.c +@@ -879,22 +879,37 @@ int inet_ehash_locks_alloc(struct inet_hashinfo *hashinfo) + { + unsigned int locksz = sizeof(spinlock_t); + unsigned int i, nblocks = 1; ++ spinlock_t *ptr = NULL; + +- if (locksz != 0) { +- /* allocate 2 cache lines or at least one spinlock per cpu */ +- nblocks = max(2U * L1_CACHE_BYTES / locksz, 1U); +- nblocks = roundup_pow_of_two(nblocks * num_possible_cpus()); ++ if (locksz == 0) ++ goto set_mask; + +- /* no more locks than number of hash buckets */ +- nblocks = min(nblocks, hashinfo->ehash_mask + 1); ++ /* Allocate 2 cache lines or at least one spinlock per cpu. */ ++ nblocks = max(2U * L1_CACHE_BYTES / locksz, 1U) * num_possible_cpus(); + +- hashinfo->ehash_locks = kvmalloc_array(nblocks, locksz, GFP_KERNEL); +- if (!hashinfo->ehash_locks) +- return -ENOMEM; ++ /* At least one page per NUMA node. */ ++ nblocks = max(nblocks, num_online_nodes() * PAGE_SIZE / locksz); ++ ++ nblocks = roundup_pow_of_two(nblocks); ++ ++ /* No more locks than number of hash buckets. */ ++ nblocks = min(nblocks, hashinfo->ehash_mask + 1); + +- for (i = 0; i < nblocks; i++) +- spin_lock_init(&hashinfo->ehash_locks[i]); ++ if (num_online_nodes() > 1) { ++ /* Use vmalloc() to allow NUMA policy to spread pages ++ * on all available nodes if desired. ++ */ ++ ptr = vmalloc_array(nblocks, locksz); ++ } ++ if (!ptr) { ++ ptr = kvmalloc_array(nblocks, locksz, GFP_KERNEL); ++ if (!ptr) ++ return -ENOMEM; + } ++ for (i = 0; i < nblocks; i++) ++ spin_lock_init(&ptr[i]); ++ hashinfo->ehash_locks = ptr; ++set_mask: + hashinfo->ehash_locks_mask = nblocks - 1; + return 0; + } +-- +2.39.5 + diff --git a/queue-5.15/tcp-reorganize-tcp_in_ack_event-and-tcp_count_delive.patch b/queue-5.15/tcp-reorganize-tcp_in_ack_event-and-tcp_count_delive.patch new file mode 100644 index 0000000000..97faab7df5 --- /dev/null +++ b/queue-5.15/tcp-reorganize-tcp_in_ack_event-and-tcp_count_delive.patch @@ -0,0 +1,155 @@ +From 1dec6c1f9e1e84106e2a26bb1e4c01a826296071 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Mar 2025 23:38:41 +0100 +Subject: tcp: reorganize tcp_in_ack_event() and tcp_count_delivered() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 149dfb31615e22271d2525f078c95ea49bc4db24 ] + +- Move tcp_count_delivered() earlier and split tcp_count_delivered_ce() + out of it +- Move tcp_in_ack_event() later +- While at it, remove the inline from tcp_in_ack_event() and let + the compiler to decide + +Accurate ECN's heuristics does not know if there is going +to be ACE field based CE counter increase or not until after +rtx queue has been processed. Only then the number of ACKed +bytes/pkts is available. As CE or not affects presence of +FLAG_ECE, that information for tcp_in_ack_event is not yet +available in the old location of the call to tcp_in_ack_event(). + +Signed-off-by: Ilpo Järvinen +Signed-off-by: Chia-Yu Chang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 56 +++++++++++++++++++++++++------------------- + 1 file changed, 32 insertions(+), 24 deletions(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 6bd28ac949b42..8859a38b45d5e 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -404,6 +404,20 @@ static bool tcp_ecn_rcv_ecn_echo(const struct tcp_sock *tp, const struct tcphdr + return false; + } + ++static void tcp_count_delivered_ce(struct tcp_sock *tp, u32 ecn_count) ++{ ++ tp->delivered_ce += ecn_count; ++} ++ ++/* Updates the delivered and delivered_ce counts */ ++static void tcp_count_delivered(struct tcp_sock *tp, u32 delivered, ++ bool ece_ack) ++{ ++ tp->delivered += delivered; ++ if (ece_ack) ++ tcp_count_delivered_ce(tp, delivered); ++} ++ + /* Buffer size and advertised window tuning. + * + * 1. Tuning sk->sk_sndbuf, when connection enters established state. +@@ -1112,15 +1126,6 @@ void tcp_mark_skb_lost(struct sock *sk, struct sk_buff *skb) + } + } + +-/* Updates the delivered and delivered_ce counts */ +-static void tcp_count_delivered(struct tcp_sock *tp, u32 delivered, +- bool ece_ack) +-{ +- tp->delivered += delivered; +- if (ece_ack) +- tp->delivered_ce += delivered; +-} +- + /* This procedure tags the retransmission queue when SACKs arrive. + * + * We have three tag bits: SACKED(S), RETRANS(R) and LOST(L). +@@ -3776,12 +3781,23 @@ static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag) + } + } + +-static inline void tcp_in_ack_event(struct sock *sk, u32 flags) ++static void tcp_in_ack_event(struct sock *sk, int flag) + { + const struct inet_connection_sock *icsk = inet_csk(sk); + +- if (icsk->icsk_ca_ops->in_ack_event) +- icsk->icsk_ca_ops->in_ack_event(sk, flags); ++ if (icsk->icsk_ca_ops->in_ack_event) { ++ u32 ack_ev_flags = 0; ++ ++ if (flag & FLAG_WIN_UPDATE) ++ ack_ev_flags |= CA_ACK_WIN_UPDATE; ++ if (flag & FLAG_SLOWPATH) { ++ ack_ev_flags |= CA_ACK_SLOWPATH; ++ if (flag & FLAG_ECE) ++ ack_ev_flags |= CA_ACK_ECE; ++ } ++ ++ icsk->icsk_ca_ops->in_ack_event(sk, ack_ev_flags); ++ } + } + + /* Congestion control has updated the cwnd already. So if we're in +@@ -3898,12 +3914,8 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) + tcp_snd_una_update(tp, ack); + flag |= FLAG_WIN_UPDATE; + +- tcp_in_ack_event(sk, CA_ACK_WIN_UPDATE); +- + NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPHPACKS); + } else { +- u32 ack_ev_flags = CA_ACK_SLOWPATH; +- + if (ack_seq != TCP_SKB_CB(skb)->end_seq) + flag |= FLAG_DATA; + else +@@ -3915,19 +3927,12 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) + flag |= tcp_sacktag_write_queue(sk, skb, prior_snd_una, + &sack_state); + +- if (tcp_ecn_rcv_ecn_echo(tp, tcp_hdr(skb))) { ++ if (tcp_ecn_rcv_ecn_echo(tp, tcp_hdr(skb))) + flag |= FLAG_ECE; +- ack_ev_flags |= CA_ACK_ECE; +- } + + if (sack_state.sack_delivered) + tcp_count_delivered(tp, sack_state.sack_delivered, + flag & FLAG_ECE); +- +- if (flag & FLAG_WIN_UPDATE) +- ack_ev_flags |= CA_ACK_WIN_UPDATE; +- +- tcp_in_ack_event(sk, ack_ev_flags); + } + + /* This is a deviation from RFC3168 since it states that: +@@ -3954,6 +3959,8 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) + + tcp_rack_update_reo_wnd(sk, &rs); + ++ tcp_in_ack_event(sk, flag); ++ + if (tp->tlp_high_seq) + tcp_process_tlp_ack(sk, ack, flag); + +@@ -3985,6 +3992,7 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) + return 1; + + no_queue: ++ tcp_in_ack_event(sk, flag); + /* If data was DSACKed, see if we can undo a cwnd reduction. */ + if (flag & FLAG_DSACKING_ACK) { + tcp_fastretrans_alert(sk, prior_snd_una, num_dupack, &flag, +-- +2.39.5 + diff --git a/queue-5.15/thermal-drivers-qoriq-power-down-tmu-on-system-suspe.patch b/queue-5.15/thermal-drivers-qoriq-power-down-tmu-on-system-suspe.patch new file mode 100644 index 0000000000..d8ff77231a --- /dev/null +++ b/queue-5.15/thermal-drivers-qoriq-power-down-tmu-on-system-suspe.patch @@ -0,0 +1,63 @@ +From f3f39250be986368c69e52b4df928abdcbfec7bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Dec 2024 11:48:59 -0500 +Subject: thermal/drivers/qoriq: Power down TMU on system suspend + +From: Alice Guo + +[ Upstream commit 229f3feb4b0442835b27d519679168bea2de96c2 ] + +Enable power-down of TMU (Thermal Management Unit) for TMU version 2 during +system suspend to save power. Save approximately 4.3mW on VDD_ANA_1P8 on +i.MX93 platforms. + +Signed-off-by: Alice Guo +Signed-off-by: Frank Li +Link: https://lore.kernel.org/r/20241209164859.3758906-2-Frank.Li@nxp.com +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +--- + drivers/thermal/qoriq_thermal.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/thermal/qoriq_thermal.c b/drivers/thermal/qoriq_thermal.c +index 73049f9bea252..34a5fbcc3d200 100644 +--- a/drivers/thermal/qoriq_thermal.c ++++ b/drivers/thermal/qoriq_thermal.c +@@ -19,6 +19,7 @@ + #define SITES_MAX 16 + #define TMR_DISABLE 0x0 + #define TMR_ME 0x80000000 ++#define TMR_CMD BIT(29) + #define TMR_ALPF 0x0c000000 + #define TMR_ALPF_V2 0x03000000 + #define TMTMIR_DEFAULT 0x0000000f +@@ -345,6 +346,12 @@ static int __maybe_unused qoriq_tmu_suspend(struct device *dev) + if (ret) + return ret; + ++ if (data->ver > TMU_VER1) { ++ ret = regmap_set_bits(data->regmap, REGS_TMR, TMR_CMD); ++ if (ret) ++ return ret; ++ } ++ + clk_disable_unprepare(data->clk); + + return 0; +@@ -359,6 +366,12 @@ static int __maybe_unused qoriq_tmu_resume(struct device *dev) + if (ret) + return ret; + ++ if (data->ver > TMU_VER1) { ++ ret = regmap_clear_bits(data->regmap, REGS_TMR, TMR_CMD); ++ if (ret) ++ return ret; ++ } ++ + /* Enable monitoring */ + return regmap_update_bits(data->regmap, REGS_TMR, TMR_ME, TMR_ME); + } +-- +2.39.5 + diff --git a/queue-5.15/timer_list-don-t-use-pk-through-printk.patch b/queue-5.15/timer_list-don-t-use-pk-through-printk.patch new file mode 100644 index 0000000000..e78591dd85 --- /dev/null +++ b/queue-5.15/timer_list-don-t-use-pk-through-printk.patch @@ -0,0 +1,65 @@ +From ee2b023baf7cf29759d7611b2fb83ccc04ad7459 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 10:54:47 +0100 +Subject: timer_list: Don't use %pK through printk() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit a52067c24ccf6ee4c85acffa0f155e9714f9adce ] + +This reverts commit f590308536db ("timer debug: Hide kernel addresses via +%pK in /proc/timer_list") + +The timer list helper SEQ_printf() uses either the real seq_printf() for +procfs output or vprintk() to print to the kernel log, when invoked from +SysRq-q. It uses %pK for printing pointers. + +In the past %pK was prefered over %p as it would not leak raw pointer +values into the kernel log. Since commit ad67b74d2469 ("printk: hash +addresses printed with %p") the regular %p has been improved to avoid this +issue. + +Furthermore, restricted pointers ("%pK") were never meant to be used +through printk(). They can still unintentionally leak raw pointers or +acquire sleeping looks in atomic contexts. + +Switch to the regular pointer formatting which is safer, easier to reason +about and sufficient here. + +Signed-off-by: Thomas Weißschuh +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/lkml/20250113171731-dc10e3c1-da64-4af0-b767-7c7070468023@linutronix.de/ +Link: https://lore.kernel.org/all/20250311-restricted-pointers-timer-v1-1-6626b91e54ab@linutronix.de +Signed-off-by: Sasha Levin +--- + kernel/time/timer_list.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c +index ed7d6ad694fba..20a5e6962b696 100644 +--- a/kernel/time/timer_list.c ++++ b/kernel/time/timer_list.c +@@ -46,7 +46,7 @@ static void + print_timer(struct seq_file *m, struct hrtimer *taddr, struct hrtimer *timer, + int idx, u64 now) + { +- SEQ_printf(m, " #%d: <%pK>, %ps", idx, taddr, timer->function); ++ SEQ_printf(m, " #%d: <%p>, %ps", idx, taddr, timer->function); + SEQ_printf(m, ", S:%02x", timer->state); + SEQ_printf(m, "\n"); + SEQ_printf(m, " # expires at %Lu-%Lu nsecs [in %Ld to %Ld nsecs]\n", +@@ -98,7 +98,7 @@ print_active_timers(struct seq_file *m, struct hrtimer_clock_base *base, + static void + print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now) + { +- SEQ_printf(m, " .base: %pK\n", base); ++ SEQ_printf(m, " .base: %p\n", base); + SEQ_printf(m, " .index: %d\n", base->index); + + SEQ_printf(m, " .resolution: %u nsecs\n", hrtimer_resolution); +-- +2.39.5 + diff --git a/queue-5.15/tools-build-don-t-pass-test-log-files-to-linker.patch b/queue-5.15/tools-build-don-t-pass-test-log-files-to-linker.patch new file mode 100644 index 0000000000..7fb4572c25 --- /dev/null +++ b/queue-5.15/tools-build-don-t-pass-test-log-files-to-linker.patch @@ -0,0 +1,48 @@ +From d81caf85f55d6be81934ba37e2c5d16154daad8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 14:36:23 -0700 +Subject: tools/build: Don't pass test log files to linker + +From: Ian Rogers + +[ Upstream commit 935e7cb5bb80106ff4f2fe39640f430134ef8cd8 ] + +Separate test log files from object files. Depend on test log output +but don't pass to the linker. + +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Link: https://lore.kernel.org/r/20250311213628.569562-2-irogers@google.com +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/build/Makefile.build | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/tools/build/Makefile.build b/tools/build/Makefile.build +index 715092fc6a239..6a043b729b367 100644 +--- a/tools/build/Makefile.build ++++ b/tools/build/Makefile.build +@@ -130,6 +130,10 @@ objprefix := $(subst ./,,$(OUTPUT)$(dir)/) + obj-y := $(addprefix $(objprefix),$(obj-y)) + subdir-obj-y := $(addprefix $(objprefix),$(subdir-obj-y)) + ++# Separate out test log files from real build objects. ++test-y := $(filter %_log, $(obj-y)) ++obj-y := $(filter-out %_log, $(obj-y)) ++ + # Final '$(obj)-in.o' object + in-target := $(objprefix)$(obj)-in.o + +@@ -140,7 +144,7 @@ $(subdir-y): + + $(sort $(subdir-obj-y)): $(subdir-y) ; + +-$(in-target): $(obj-y) FORCE ++$(in-target): $(obj-y) $(test-y) FORCE + $(call rule_mkdir) + $(call if_changed,$(host)ld_multi) + +-- +2.39.5 + diff --git a/queue-5.15/tracing-mark-binary-printing-functions-with-__printf.patch b/queue-5.15/tracing-mark-binary-printing-functions-with-__printf.patch new file mode 100644 index 0000000000..d3a821cef0 --- /dev/null +++ b/queue-5.15/tracing-mark-binary-printing-functions-with-__printf.patch @@ -0,0 +1,158 @@ +From 8a4ba97eef7f80be7b05146fc3cb80fe50f3de09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Mar 2025 16:40:49 +0200 +Subject: tracing: Mark binary printing functions with __printf() attribute +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andy Shevchenko + +[ Upstream commit 196a062641fe68d9bfe0ad36b6cd7628c99ad22c ] + +Binary printing functions are using printf() type of format, and compiler +is not happy about them as is: + +kernel/trace/trace.c:3292:9: error: function ‘trace_vbprintk’ might be a candidate for ‘gnu_printf’ format attribute [-Werror=suggest-attribute=format] +kernel/trace/trace_seq.c:182:9: error: function ‘trace_seq_bprintf’ might be a candidate for ‘gnu_printf’ format attribute [-Werror=suggest-attribute=format] + +Fix the compilation errors by adding __printf() attribute. + +While at it, move existing __printf() attributes from the implementations +to the declarations. IT also fixes incorrect attribute parameters that are +used for trace_array_printk(). + +Signed-off-by: Andy Shevchenko +Reviewed-by: Kees Cook +Reviewed-by: Petr Mladek +Link: https://lore.kernel.org/r/20250321144822.324050-4-andriy.shevchenko@linux.intel.com +Signed-off-by: Petr Mladek +Signed-off-by: Sasha Levin +--- + include/linux/trace.h | 4 ++-- + include/linux/trace_seq.h | 8 ++++---- + kernel/trace/trace.c | 11 +++-------- + kernel/trace/trace.h | 16 +++++++++------- + 4 files changed, 18 insertions(+), 21 deletions(-) + +diff --git a/include/linux/trace.h b/include/linux/trace.h +index 2a70a447184c9..bb4d84f1c58cc 100644 +--- a/include/linux/trace.h ++++ b/include/linux/trace.h +@@ -72,8 +72,8 @@ static inline int unregister_ftrace_export(struct trace_export *export) + static inline void trace_printk_init_buffers(void) + { + } +-static inline int trace_array_printk(struct trace_array *tr, unsigned long ip, +- const char *fmt, ...) ++static inline __printf(3, 4) ++int trace_array_printk(struct trace_array *tr, unsigned long ip, const char *fmt, ...) + { + return 0; + } +diff --git a/include/linux/trace_seq.h b/include/linux/trace_seq.h +index 5a2c650d9e1c1..c230cbd25aee8 100644 +--- a/include/linux/trace_seq.h ++++ b/include/linux/trace_seq.h +@@ -77,8 +77,8 @@ extern __printf(2, 3) + void trace_seq_printf(struct trace_seq *s, const char *fmt, ...); + extern __printf(2, 0) + void trace_seq_vprintf(struct trace_seq *s, const char *fmt, va_list args); +-extern void +-trace_seq_bprintf(struct trace_seq *s, const char *fmt, const u32 *binary); ++extern __printf(2, 0) ++void trace_seq_bprintf(struct trace_seq *s, const char *fmt, const u32 *binary); + extern int trace_print_seq(struct seq_file *m, struct trace_seq *s); + extern int trace_seq_to_user(struct trace_seq *s, char __user *ubuf, + int cnt); +@@ -100,8 +100,8 @@ extern int trace_seq_hex_dump(struct trace_seq *s, const char *prefix_str, + static inline void trace_seq_printf(struct trace_seq *s, const char *fmt, ...) + { + } +-static inline void +-trace_seq_bprintf(struct trace_seq *s, const char *fmt, const u32 *binary) ++static inline __printf(2, 0) ++void trace_seq_bprintf(struct trace_seq *s, const char *fmt, const u32 *binary) + { + } + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index baf2867e6dbe4..c4fd5deca4a07 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -3402,10 +3402,9 @@ int trace_vbprintk(unsigned long ip, const char *fmt, va_list args) + } + EXPORT_SYMBOL_GPL(trace_vbprintk); + +-__printf(3, 0) +-static int +-__trace_array_vprintk(struct trace_buffer *buffer, +- unsigned long ip, const char *fmt, va_list args) ++static __printf(3, 0) ++int __trace_array_vprintk(struct trace_buffer *buffer, ++ unsigned long ip, const char *fmt, va_list args) + { + struct trace_event_call *call = &event_print; + struct ring_buffer_event *event; +@@ -3458,7 +3457,6 @@ __trace_array_vprintk(struct trace_buffer *buffer, + return len; + } + +-__printf(3, 0) + int trace_array_vprintk(struct trace_array *tr, + unsigned long ip, const char *fmt, va_list args) + { +@@ -3485,7 +3483,6 @@ int trace_array_vprintk(struct trace_array *tr, + * Note, trace_array_init_printk() must be called on @tr before this + * can be used. + */ +-__printf(3, 0) + int trace_array_printk(struct trace_array *tr, + unsigned long ip, const char *fmt, ...) + { +@@ -3530,7 +3527,6 @@ int trace_array_init_printk(struct trace_array *tr) + } + EXPORT_SYMBOL_GPL(trace_array_init_printk); + +-__printf(3, 4) + int trace_array_printk_buf(struct trace_buffer *buffer, + unsigned long ip, const char *fmt, ...) + { +@@ -3546,7 +3542,6 @@ int trace_array_printk_buf(struct trace_buffer *buffer, + return ret; + } + +-__printf(2, 0) + int trace_vprintk(unsigned long ip, const char *fmt, va_list args) + { + return trace_array_vprintk(&global_trace, ip, fmt, args); +diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h +index 449a8bd873cf7..49b4353997fad 100644 +--- a/kernel/trace/trace.h ++++ b/kernel/trace/trace.h +@@ -781,13 +781,15 @@ static inline void __init disable_tracing_selftest(const char *reason) + + extern void *head_page(struct trace_array_cpu *data); + extern unsigned long long ns2usecs(u64 nsec); +-extern int +-trace_vbprintk(unsigned long ip, const char *fmt, va_list args); +-extern int +-trace_vprintk(unsigned long ip, const char *fmt, va_list args); +-extern int +-trace_array_vprintk(struct trace_array *tr, +- unsigned long ip, const char *fmt, va_list args); ++ ++__printf(2, 0) ++int trace_vbprintk(unsigned long ip, const char *fmt, va_list args); ++__printf(2, 0) ++int trace_vprintk(unsigned long ip, const char *fmt, va_list args); ++__printf(3, 0) ++int trace_array_vprintk(struct trace_array *tr, ++ unsigned long ip, const char *fmt, va_list args); ++__printf(3, 4) + int trace_array_printk_buf(struct trace_buffer *buffer, + unsigned long ip, const char *fmt, ...); + void trace_printk_seq(struct trace_seq *s); +-- +2.39.5 + diff --git a/queue-5.15/um-store-full-csgsfs-and-ss-register-from-mcontext.patch b/queue-5.15/um-store-full-csgsfs-and-ss-register-from-mcontext.patch new file mode 100644 index 0000000000..b7fecbf5bd --- /dev/null +++ b/queue-5.15/um-store-full-csgsfs-and-ss-register-from-mcontext.patch @@ -0,0 +1,40 @@ +From 073e5e50b30a7bc5b9db0f5d09521b2fac241e3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Feb 2025 19:18:19 +0100 +Subject: um: Store full CSGSFS and SS register from mcontext + +From: Benjamin Berg + +[ Upstream commit cef721e0d53d2b64f2ba177c63a0dfdd7c0daf17 ] + +Doing this allows using registers as retrieved from an mcontext to be +pushed to a process using PTRACE_SETREGS. + +It is not entirely clear to me why CSGSFS was masked. Doing so creates +issues when using the mcontext as process state in seccomp and simply +copying the register appears to work perfectly fine for ptrace. + +Signed-off-by: Benjamin Berg +Link: https://patch.msgid.link/20250224181827.647129-2-benjamin@sipsolutions.net +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + arch/x86/um/os-Linux/mcontext.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/x86/um/os-Linux/mcontext.c b/arch/x86/um/os-Linux/mcontext.c +index 49c3744cac371..81b9d1f9f4e68 100644 +--- a/arch/x86/um/os-Linux/mcontext.c ++++ b/arch/x86/um/os-Linux/mcontext.c +@@ -26,7 +26,6 @@ void get_regs_from_mc(struct uml_pt_regs *regs, mcontext_t *mc) + COPY(RIP); + COPY2(EFLAGS, EFL); + COPY2(CS, CSGSFS); +- regs->gp[CS / sizeof(unsigned long)] &= 0xffff; +- regs->gp[CS / sizeof(unsigned long)] |= 3; ++ regs->gp[SS / sizeof(unsigned long)] = mc->gregs[REG_CSGSFS] >> 48; + #endif + } +-- +2.39.5 + diff --git a/queue-5.15/um-update-min_low_pfn-to-match-changes-in-uml_reserv.patch b/queue-5.15/um-update-min_low_pfn-to-match-changes-in-uml_reserv.patch new file mode 100644 index 0000000000..7ab52e3dd0 --- /dev/null +++ b/queue-5.15/um-update-min_low_pfn-to-match-changes-in-uml_reserv.patch @@ -0,0 +1,36 @@ +From c0fceb65011fbcdd97ca25ea7b5f0c3bd5bc9d11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Feb 2025 12:18:55 +0800 +Subject: um: Update min_low_pfn to match changes in uml_reserved + +From: Tiwei Bie + +[ Upstream commit e82cf3051e6193f61e03898f8dba035199064d36 ] + +When uml_reserved is updated, min_low_pfn must also be updated +accordingly. Otherwise, min_low_pfn will not accurately reflect +the lowest available PFN. + +Signed-off-by: Tiwei Bie +Link: https://patch.msgid.link/20250221041855.1156109-1-tiwei.btw@antgroup.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + arch/um/kernel/mem.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/um/kernel/mem.c b/arch/um/kernel/mem.c +index 8e636ce029495..50be04f7b40f3 100644 +--- a/arch/um/kernel/mem.c ++++ b/arch/um/kernel/mem.c +@@ -49,6 +49,7 @@ void __init mem_init(void) + map_memory(brk_end, __pa(brk_end), uml_reserved - brk_end, 1, 1, 0); + memblock_free(__pa(brk_end), uml_reserved - brk_end); + uml_reserved = brk_end; ++ min_low_pfn = PFN_UP(__pa(uml_reserved)); + + /* this will put all low memory onto the freelists */ + memblock_free_all(); +-- +2.39.5 + diff --git a/queue-5.15/vfio-pci-handle-intx-irq_notconnected.patch b/queue-5.15/vfio-pci-handle-intx-irq_notconnected.patch new file mode 100644 index 0000000000..4a01d2b79c --- /dev/null +++ b/queue-5.15/vfio-pci-handle-intx-irq_notconnected.patch @@ -0,0 +1,84 @@ +From db3437d6227b8d0beed8dbf2a2febe24cc7b77ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 17:06:21 -0600 +Subject: vfio/pci: Handle INTx IRQ_NOTCONNECTED + +From: Alex Williamson + +[ Upstream commit 860be250fc32de9cb24154bf21b4e36f40925707 ] + +Some systems report INTx as not routed by setting pdev->irq to +IRQ_NOTCONNECTED, resulting in a -ENOTCONN error when trying to +setup eventfd signaling. Include this in the set of conditions +for which the PIN register is virtualized to zero. + +Additionally consolidate vfio_pci_get_irq_count() to use this +virtualized value in reporting INTx support via ioctl and sanity +checking ioctl paths since pdev->irq is re-used when the device +is in MSI mode. + +The combination of these results in both the config space of the +device and the ioctl interface behaving as if the device does not +support INTx. + +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/20250311230623.1264283-1-alex.williamson@redhat.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/vfio_pci_config.c | 3 ++- + drivers/vfio/pci/vfio_pci_core.c | 10 +--------- + drivers/vfio/pci/vfio_pci_intrs.c | 2 +- + 3 files changed, 4 insertions(+), 11 deletions(-) + +diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c +index 63f6308b0f8c9..fdff3359849c1 100644 +--- a/drivers/vfio/pci/vfio_pci_config.c ++++ b/drivers/vfio/pci/vfio_pci_config.c +@@ -1756,7 +1756,8 @@ int vfio_config_init(struct vfio_pci_core_device *vdev) + cpu_to_le16(PCI_COMMAND_MEMORY); + } + +- if (!IS_ENABLED(CONFIG_VFIO_PCI_INTX) || vdev->nointx) ++ if (!IS_ENABLED(CONFIG_VFIO_PCI_INTX) || vdev->nointx || ++ vdev->pdev->irq == IRQ_NOTCONNECTED) + vconfig[PCI_INTERRUPT_PIN] = 0; + + ret = vfio_cap_init(vdev); +diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c +index f3916e6b16b9d..ea4e75be1884f 100644 +--- a/drivers/vfio/pci/vfio_pci_core.c ++++ b/drivers/vfio/pci/vfio_pci_core.c +@@ -481,15 +481,7 @@ EXPORT_SYMBOL_GPL(vfio_pci_core_finish_enable); + static int vfio_pci_get_irq_count(struct vfio_pci_core_device *vdev, int irq_type) + { + if (irq_type == VFIO_PCI_INTX_IRQ_INDEX) { +- u8 pin; +- +- if (!IS_ENABLED(CONFIG_VFIO_PCI_INTX) || +- vdev->nointx || vdev->pdev->is_virtfn) +- return 0; +- +- pci_read_config_byte(vdev->pdev, PCI_INTERRUPT_PIN, &pin); +- +- return pin ? 1 : 0; ++ return vdev->vconfig[PCI_INTERRUPT_PIN] ? 1 : 0; + } else if (irq_type == VFIO_PCI_MSI_IRQ_INDEX) { + u8 pos; + u16 flags; +diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c +index f20512c413f76..5ade5b81a0ffb 100644 +--- a/drivers/vfio/pci/vfio_pci_intrs.c ++++ b/drivers/vfio/pci/vfio_pci_intrs.c +@@ -173,7 +173,7 @@ static int vfio_intx_enable(struct vfio_pci_core_device *vdev, + if (!is_irq_none(vdev)) + return -EINVAL; + +- if (!pdev->irq) ++ if (!pdev->irq || pdev->irq == IRQ_NOTCONNECTED) + return -ENODEV; + + name = kasprintf(GFP_KERNEL, "vfio-intx(%s)", pci_name(pdev)); +-- +2.39.5 + diff --git a/queue-5.15/virtio_ring-fix-data-race-by-tagging-event_triggered.patch b/queue-5.15/virtio_ring-fix-data-race-by-tagging-event_triggered.patch new file mode 100644 index 0000000000..efd831ddee --- /dev/null +++ b/queue-5.15/virtio_ring-fix-data-race-by-tagging-event_triggered.patch @@ -0,0 +1,71 @@ +From 23fcfd924093806cbadaa37c3967b7f2783b5345 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Mar 2025 21:04:12 +0800 +Subject: virtio_ring: Fix data race by tagging event_triggered as racy for + KCSAN + +From: Zhongqiu Han + +[ Upstream commit 2e2f925fe737576df2373931c95e1a2b66efdfef ] + +syzbot reports a data-race when accessing the event_triggered, here is the +simplified stack when the issue occurred: + +================================================================== +BUG: KCSAN: data-race in virtqueue_disable_cb / virtqueue_enable_cb_delayed + +write to 0xffff8881025bc452 of 1 bytes by task 3288 on cpu 0: + virtqueue_enable_cb_delayed+0x42/0x3c0 drivers/virtio/virtio_ring.c:2653 + start_xmit+0x230/0x1310 drivers/net/virtio_net.c:3264 + __netdev_start_xmit include/linux/netdevice.h:5151 [inline] + netdev_start_xmit include/linux/netdevice.h:5160 [inline] + xmit_one net/core/dev.c:3800 [inline] + +read to 0xffff8881025bc452 of 1 bytes by interrupt on cpu 1: + virtqueue_disable_cb_split drivers/virtio/virtio_ring.c:880 [inline] + virtqueue_disable_cb+0x92/0x180 drivers/virtio/virtio_ring.c:2566 + skb_xmit_done+0x5f/0x140 drivers/net/virtio_net.c:777 + vring_interrupt+0x161/0x190 drivers/virtio/virtio_ring.c:2715 + __handle_irq_event_percpu+0x95/0x490 kernel/irq/handle.c:158 + handle_irq_event_percpu kernel/irq/handle.c:193 [inline] + +value changed: 0x01 -> 0x00 +================================================================== + +When the data race occurs, the function virtqueue_enable_cb_delayed() sets +event_triggered to false, and virtqueue_disable_cb_split/packed() reads it +as false due to the race condition. Since event_triggered is an unreliable +hint used for optimization, this should only cause the driver temporarily +suggest that the device not send an interrupt notification when the event +index is used. + +Fix this KCSAN reported data-race issue by explicitly tagging the access as +data_racy. + +Reported-by: syzbot+efe683d57990864b8c8e@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/67c7761a.050a0220.15b4b9.0018.GAE@google.com/ +Signed-off-by: Zhongqiu Han +Message-Id: <20250312130412.3516307-1-quic_zhonhan@quicinc.com> +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio_ring.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c +index 067b68168f93e..b541d861475e6 100644 +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -2125,7 +2125,7 @@ bool virtqueue_enable_cb_delayed(struct virtqueue *_vq) + struct vring_virtqueue *vq = to_vvq(_vq); + + if (vq->event_triggered) +- vq->event_triggered = false; ++ data_race(vq->event_triggered = false); + + return vq->packed_ring ? virtqueue_enable_cb_delayed_packed(_vq) : + virtqueue_enable_cb_delayed_split(_vq); +-- +2.39.5 + diff --git a/queue-5.15/vxlan-annotate-fdb-data-races.patch b/queue-5.15/vxlan-annotate-fdb-data-races.patch new file mode 100644 index 0000000000..4943499456 --- /dev/null +++ b/queue-5.15/vxlan-annotate-fdb-data-races.patch @@ -0,0 +1,144 @@ +From bea799b4578ba7967e1be0aaa15786a2d91351a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Feb 2025 16:55:42 +0200 +Subject: vxlan: Annotate FDB data races + +From: Ido Schimmel + +[ Upstream commit f6205f8215f12a96518ac9469ff76294ae7bd612 ] + +The 'used' and 'updated' fields in the FDB entry structure can be +accessed concurrently by multiple threads, leading to reports such as +[1]. Can be reproduced using [2]. + +Suppress these reports by annotating these accesses using +READ_ONCE() / WRITE_ONCE(). + +[1] +BUG: KCSAN: data-race in vxlan_xmit / vxlan_xmit + +write to 0xffff942604d263a8 of 8 bytes by task 286 on cpu 0: + vxlan_xmit+0xb29/0x2380 + dev_hard_start_xmit+0x84/0x2f0 + __dev_queue_xmit+0x45a/0x1650 + packet_xmit+0x100/0x150 + packet_sendmsg+0x2114/0x2ac0 + __sys_sendto+0x318/0x330 + __x64_sys_sendto+0x76/0x90 + x64_sys_call+0x14e8/0x1c00 + do_syscall_64+0x9e/0x1a0 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +read to 0xffff942604d263a8 of 8 bytes by task 287 on cpu 2: + vxlan_xmit+0xadf/0x2380 + dev_hard_start_xmit+0x84/0x2f0 + __dev_queue_xmit+0x45a/0x1650 + packet_xmit+0x100/0x150 + packet_sendmsg+0x2114/0x2ac0 + __sys_sendto+0x318/0x330 + __x64_sys_sendto+0x76/0x90 + x64_sys_call+0x14e8/0x1c00 + do_syscall_64+0x9e/0x1a0 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +value changed: 0x00000000fffbac6e -> 0x00000000fffbac6f + +Reported by Kernel Concurrency Sanitizer on: +CPU: 2 UID: 0 PID: 287 Comm: mausezahn Not tainted 6.13.0-rc7-01544-gb4b270f11a02 #5 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 + +[2] + #!/bin/bash + + set +H + echo whitelist > /sys/kernel/debug/kcsan + echo !vxlan_xmit > /sys/kernel/debug/kcsan + + ip link add name vx0 up type vxlan id 10010 dstport 4789 local 192.0.2.1 + bridge fdb add 00:11:22:33:44:55 dev vx0 self static dst 198.51.100.1 + taskset -c 0 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q & + taskset -c 2 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q & + +Reviewed-by: Petr Machata +Signed-off-by: Ido Schimmel +Reviewed-by: Eric Dumazet +Reviewed-by: Nikolay Aleksandrov +Link: https://patch.msgid.link/20250204145549.1216254-2-idosch@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/vxlan/vxlan_core.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c +index 65a2f4ab89970..9c4d7bedc7641 100644 +--- a/drivers/net/vxlan/vxlan_core.c ++++ b/drivers/net/vxlan/vxlan_core.c +@@ -334,9 +334,9 @@ static int vxlan_fdb_info(struct sk_buff *skb, struct vxlan_dev *vxlan, + be32_to_cpu(fdb->vni))) + goto nla_put_failure; + +- ci.ndm_used = jiffies_to_clock_t(now - fdb->used); ++ ci.ndm_used = jiffies_to_clock_t(now - READ_ONCE(fdb->used)); + ci.ndm_confirmed = 0; +- ci.ndm_updated = jiffies_to_clock_t(now - fdb->updated); ++ ci.ndm_updated = jiffies_to_clock_t(now - READ_ONCE(fdb->updated)); + ci.ndm_refcnt = 0; + + if (nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci)) +@@ -542,8 +542,8 @@ static struct vxlan_fdb *vxlan_find_mac(struct vxlan_dev *vxlan, + struct vxlan_fdb *f; + + f = __vxlan_find_mac(vxlan, mac, vni); +- if (f && f->used != jiffies) +- f->used = jiffies; ++ if (f && READ_ONCE(f->used) != jiffies) ++ WRITE_ONCE(f->used, jiffies); + + return f; + } +@@ -1073,12 +1073,12 @@ static int vxlan_fdb_update_existing(struct vxlan_dev *vxlan, + !(f->flags & NTF_VXLAN_ADDED_BY_USER)) { + if (f->state != state) { + f->state = state; +- f->updated = jiffies; ++ WRITE_ONCE(f->updated, jiffies); + notify = 1; + } + if (f->flags != fdb_flags) { + f->flags = fdb_flags; +- f->updated = jiffies; ++ WRITE_ONCE(f->updated, jiffies); + notify = 1; + } + } +@@ -1112,7 +1112,7 @@ static int vxlan_fdb_update_existing(struct vxlan_dev *vxlan, + } + + if (ndm_flags & NTF_USE) +- f->used = jiffies; ++ WRITE_ONCE(f->used, jiffies); + + if (notify) { + if (rd == NULL) +@@ -1525,7 +1525,7 @@ static bool vxlan_snoop(struct net_device *dev, + src_mac, &rdst->remote_ip.sa, &src_ip->sa); + + rdst->remote_ip = *src_ip; +- f->updated = jiffies; ++ WRITE_ONCE(f->updated, jiffies); + vxlan_fdb_notify(vxlan, f, rdst, RTM_NEWNEIGH, true, NULL); + } else { + u32 hash_index = fdb_head_index(vxlan, src_mac, vni); +@@ -3000,7 +3000,7 @@ static void vxlan_cleanup(struct timer_list *t) + if (f->flags & NTF_EXT_LEARNED) + continue; + +- timeout = f->used + vxlan->cfg.age_interval * HZ; ++ timeout = READ_ONCE(f->used) + vxlan->cfg.age_interval * HZ; + if (time_before_eq(timeout, jiffies)) { + netdev_dbg(vxlan->dev, + "garbage collect %pM\n", +-- +2.39.5 + diff --git a/queue-5.15/wifi-ath9k-return-by-of_get_mac_address.patch b/queue-5.15/wifi-ath9k-return-by-of_get_mac_address.patch new file mode 100644 index 0000000000..475a85e4b9 --- /dev/null +++ b/queue-5.15/wifi-ath9k-return-by-of_get_mac_address.patch @@ -0,0 +1,46 @@ +From f18cf2d7c20411285caf205191bd929915d7d948 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2024 14:23:26 -0800 +Subject: wifi: ath9k: return by of_get_mac_address +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rosen Penev + +[ Upstream commit dfffb317519f88534bb82797f055f0a2fd867e7b ] + +When using nvmem, ath9k could potentially be loaded before nvmem, which +loads after mtd. This is an issue if DT contains an nvmem mac address. + +If nvmem is not ready in time for ath9k, -EPROBE_DEFER is returned. Pass +it to _probe so that ath9k can properly grab a potentially present MAC +address. + +Signed-off-by: Rosen Penev +Acked-by: Toke Høiland-Jørgensen +Link: https://patch.msgid.link/20241105222326.194417-1-rosenp@gmail.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/init.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c +index e9a36dd7144f1..bbc9d570c4e3d 100644 +--- a/drivers/net/wireless/ath/ath9k/init.c ++++ b/drivers/net/wireless/ath/ath9k/init.c +@@ -639,7 +639,9 @@ static int ath9k_of_init(struct ath_softc *sc) + ah->ah_flags |= AH_NO_EEP_SWAP; + } + +- of_get_mac_address(np, common->macaddr); ++ ret = of_get_mac_address(np, common->macaddr); ++ if (ret == -EPROBE_DEFER) ++ return ret; + + return 0; + } +-- +2.39.5 + diff --git a/queue-5.15/wifi-mac80211-don-t-unconditionally-call-drv_mgd_com.patch b/queue-5.15/wifi-mac80211-don-t-unconditionally-call-drv_mgd_com.patch new file mode 100644 index 0000000000..ac5d8727ca --- /dev/null +++ b/queue-5.15/wifi-mac80211-don-t-unconditionally-call-drv_mgd_com.patch @@ -0,0 +1,39 @@ +From 5d9d3070e7b19e15dc712433e32bd0b0df1c8d67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Feb 2025 11:39:22 +0200 +Subject: wifi: mac80211: don't unconditionally call drv_mgd_complete_tx() + +From: Johannes Berg + +[ Upstream commit 1798271b3604b902d45033ec569f2bf77e94ecc2 ] + +We might not have called drv_mgd_prepare_tx(), so only call +drv_mgd_complete_tx() under the same conditions. + +Signed-off-by: Johannes Berg +Reviewed-by: Emmanuel Grumbach +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20250205110958.e091fc39a351.Ie6a3cdca070612a0aa4b3c6914ab9ed602d1f456@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/mlme.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index b71d3a03032e8..11d9bce1a4390 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -2336,7 +2336,8 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata, + if (tx) + ieee80211_flush_queues(local, sdata, false); + +- drv_mgd_complete_tx(sdata->local, sdata, &info); ++ if (tx || frame_buf) ++ drv_mgd_complete_tx(sdata->local, sdata, &info); + + /* clear bssid only after building the needed mgmt frames */ + eth_zero_addr(ifmgd->bssid); +-- +2.39.5 + diff --git a/queue-5.15/wifi-mac80211-remove-misplaced-drv_mgd_complete_tx-c.patch b/queue-5.15/wifi-mac80211-remove-misplaced-drv_mgd_complete_tx-c.patch new file mode 100644 index 0000000000..68a30aac1e --- /dev/null +++ b/queue-5.15/wifi-mac80211-remove-misplaced-drv_mgd_complete_tx-c.patch @@ -0,0 +1,41 @@ +From 86f078b3dfac91327f1ccd959ba32509afc42ff9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Feb 2025 11:39:21 +0200 +Subject: wifi: mac80211: remove misplaced drv_mgd_complete_tx() call + +From: Johannes Berg + +[ Upstream commit f4995cdc4d02d0abc8e9fcccad5c71ce676c1e3f ] + +In the original commit 15fae3410f1d ("mac80211: notify driver on +mgd TX completion") I evidently made a mistake and placed the +call in the "associated" if, rather than the "assoc_data". Later +I noticed the missing call and placed it in commit c042600c17d8 +("wifi: mac80211: adding missing drv_mgd_complete_tx() call"), +but didn't remove the wrong one. Remove it now. + +Signed-off-by: Johannes Berg +Reviewed-by: Emmanuel Grumbach +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20250205110958.6ed954179bbf.Id8ef8835b7e6da3bf913c76f77d201017dc8a3c9@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/mlme.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index 11d9bce1a4390..ae379bd9dccca 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -5952,7 +5952,6 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata, + ieee80211_report_disconnect(sdata, frame_buf, + sizeof(frame_buf), true, + req->reason_code, false); +- drv_mgd_complete_tx(sdata->local, sdata, &info); + return 0; + } + +-- +2.39.5 + diff --git a/queue-5.15/wifi-mt76-only-mark-tx-status-failed-frames-as-acked.patch b/queue-5.15/wifi-mt76-only-mark-tx-status-failed-frames-as-acked.patch new file mode 100644 index 0000000000..3f087c4766 --- /dev/null +++ b/queue-5.15/wifi-mt76-only-mark-tx-status-failed-frames-as-acked.patch @@ -0,0 +1,111 @@ +From f33bb9b96c7d866e34061beedf4d375cc929e5b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 11:36:43 +0100 +Subject: wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2 + +From: Felix Fietkau + +[ Upstream commit 0c5a89ceddc1728a40cb3313948401dd70e3c649 ] + +The interrupt status polling is unreliable, which can cause status events +to get lost. On all newer chips, txs-timeout is an indication that the +packet was either never sent, or never acked. +Fixes issues with inactivity polling. + +Link: https://patch.msgid.link/20250311103646.43346-6-nbd@nbd.name +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt76.h | 1 + + drivers/net/wireless/mediatek/mt76/mt76x0/pci.c | 3 ++- + drivers/net/wireless/mediatek/mt76/mt76x0/usb.c | 3 ++- + drivers/net/wireless/mediatek/mt76/mt76x2/pci.c | 3 ++- + drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 3 ++- + drivers/net/wireless/mediatek/mt76/tx.c | 3 ++- + 6 files changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h +index 27f04fb2796d7..5a90fa556203f 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76.h ++++ b/drivers/net/wireless/mediatek/mt76/mt76.h +@@ -345,6 +345,7 @@ struct mt76_hw_cap { + #define MT_DRV_RX_DMA_HDR BIT(3) + #define MT_DRV_HW_MGMT_TXQ BIT(4) + #define MT_DRV_AMSDU_OFFLOAD BIT(5) ++#define MT_DRV_IGNORE_TXS_FAILED BIT(6) + + struct mt76_driver_ops { + u32 drv_flags; +diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c b/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c +index b795e7245c075..3255f9c0ef71f 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c +@@ -151,7 +151,8 @@ mt76x0e_probe(struct pci_dev *pdev, const struct pci_device_id *id) + static const struct mt76_driver_ops drv_ops = { + .txwi_size = sizeof(struct mt76x02_txwi), + .drv_flags = MT_DRV_TX_ALIGNED4_SKBS | +- MT_DRV_SW_RX_AIRTIME, ++ MT_DRV_SW_RX_AIRTIME | ++ MT_DRV_IGNORE_TXS_FAILED, + .survey_flags = SURVEY_INFO_TIME_TX, + .update_survey = mt76x02_update_channel, + .tx_prepare_skb = mt76x02_tx_prepare_skb, +diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c b/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c +index f2b2fa7338457..7a4d62bff28ff 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c +@@ -209,7 +209,8 @@ static int mt76x0u_probe(struct usb_interface *usb_intf, + const struct usb_device_id *id) + { + static const struct mt76_driver_ops drv_ops = { +- .drv_flags = MT_DRV_SW_RX_AIRTIME, ++ .drv_flags = MT_DRV_SW_RX_AIRTIME | ++ MT_DRV_IGNORE_TXS_FAILED, + .survey_flags = SURVEY_INFO_TIME_TX, + .update_survey = mt76x02_update_channel, + .tx_prepare_skb = mt76x02u_tx_prepare_skb, +diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c b/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c +index 5cd0379d86de8..4e369bd87c900 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c +@@ -22,7 +22,8 @@ mt76x2e_probe(struct pci_dev *pdev, const struct pci_device_id *id) + static const struct mt76_driver_ops drv_ops = { + .txwi_size = sizeof(struct mt76x02_txwi), + .drv_flags = MT_DRV_TX_ALIGNED4_SKBS | +- MT_DRV_SW_RX_AIRTIME, ++ MT_DRV_SW_RX_AIRTIME | ++ MT_DRV_IGNORE_TXS_FAILED, + .survey_flags = SURVEY_INFO_TIME_TX, + .update_survey = mt76x02_update_channel, + .tx_prepare_skb = mt76x02_tx_prepare_skb, +diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c b/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c +index 9369515f36a3a..09b01e09bcfe0 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c +@@ -29,7 +29,8 @@ static int mt76x2u_probe(struct usb_interface *intf, + const struct usb_device_id *id) + { + static const struct mt76_driver_ops drv_ops = { +- .drv_flags = MT_DRV_SW_RX_AIRTIME, ++ .drv_flags = MT_DRV_SW_RX_AIRTIME | ++ MT_DRV_IGNORE_TXS_FAILED, + .survey_flags = SURVEY_INFO_TIME_TX, + .update_survey = mt76x02_update_channel, + .tx_prepare_skb = mt76x02u_tx_prepare_skb, +diff --git a/drivers/net/wireless/mediatek/mt76/tx.c b/drivers/net/wireless/mediatek/mt76/tx.c +index 134a735a06329..3fbf0153d13ca 100644 +--- a/drivers/net/wireless/mediatek/mt76/tx.c ++++ b/drivers/net/wireless/mediatek/mt76/tx.c +@@ -93,7 +93,8 @@ __mt76_tx_status_skb_done(struct mt76_dev *dev, struct sk_buff *skb, u8 flags, + __skb_unlink(skb, &dev->status_list); + + /* Tx status can be unreliable. if it fails, mark the frame as ACKed */ +- if (flags & MT_TX_CB_TXS_FAILED) { ++ if (flags & MT_TX_CB_TXS_FAILED && ++ (dev->drv->drv_flags & MT_DRV_IGNORE_TXS_FAILED)) { + info->status.rates[0].count = 0; + info->status.rates[0].idx = -1; + info->flags |= IEEE80211_TX_STAT_ACK; +-- +2.39.5 + diff --git a/queue-5.15/wifi-rtw88-don-t-use-static-local-variable-in-rtw882.patch b/queue-5.15/wifi-rtw88-don-t-use-static-local-variable-in-rtw882.patch new file mode 100644 index 0000000000..c1c15e2abe --- /dev/null +++ b/queue-5.15/wifi-rtw88-don-t-use-static-local-variable-in-rtw882.patch @@ -0,0 +1,78 @@ +From 0301395884d39e34d5856f233560c49633b4cb18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Jan 2025 16:03:11 +0200 +Subject: wifi: rtw88: Don't use static local variable in + rtw8822b_set_tx_power_index_by_rate + +From: Bitterblue Smith + +[ Upstream commit 00451eb3bec763f708e7e58326468c1e575e5a66 ] + +Some users want to plug two identical USB devices at the same time. +This static variable could theoretically cause them to use incorrect +TX power values. + +Move the variable to the caller and pass a pointer to it to +rtw8822b_set_tx_power_index_by_rate(). + +Signed-off-by: Bitterblue Smith +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/8a60f581-0ab5-4d98-a97d-dd83b605008f@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/rtw8822b.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822b.c b/drivers/net/wireless/realtek/rtw88/rtw8822b.c +index 247f26e3e8192..63ecac7201a12 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c ++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c +@@ -954,11 +954,11 @@ static void rtw8822b_query_rx_desc(struct rtw_dev *rtwdev, u8 *rx_desc, + } + + static void +-rtw8822b_set_tx_power_index_by_rate(struct rtw_dev *rtwdev, u8 path, u8 rs) ++rtw8822b_set_tx_power_index_by_rate(struct rtw_dev *rtwdev, u8 path, ++ u8 rs, u32 *phy_pwr_idx) + { + struct rtw_hal *hal = &rtwdev->hal; + static const u32 offset_txagc[2] = {0x1d00, 0x1d80}; +- static u32 phy_pwr_idx; + u8 rate, rate_idx, pwr_index, shift; + int j; + +@@ -966,12 +966,12 @@ rtw8822b_set_tx_power_index_by_rate(struct rtw_dev *rtwdev, u8 path, u8 rs) + rate = rtw_rate_section[rs][j]; + pwr_index = hal->tx_pwr_tbl[path][rate]; + shift = rate & 0x3; +- phy_pwr_idx |= ((u32)pwr_index << (shift * 8)); ++ *phy_pwr_idx |= ((u32)pwr_index << (shift * 8)); + if (shift == 0x3) { + rate_idx = rate & 0xfc; + rtw_write32(rtwdev, offset_txagc[path] + rate_idx, +- phy_pwr_idx); +- phy_pwr_idx = 0; ++ *phy_pwr_idx); ++ *phy_pwr_idx = 0; + } + } + } +@@ -979,11 +979,13 @@ rtw8822b_set_tx_power_index_by_rate(struct rtw_dev *rtwdev, u8 path, u8 rs) + static void rtw8822b_set_tx_power_index(struct rtw_dev *rtwdev) + { + struct rtw_hal *hal = &rtwdev->hal; ++ u32 phy_pwr_idx = 0; + int rs, path; + + for (path = 0; path < hal->rf_path_num; path++) { + for (rs = 0; rs < RTW_RATE_SECTION_MAX; rs++) +- rtw8822b_set_tx_power_index_by_rate(rtwdev, path, rs); ++ rtw8822b_set_tx_power_index_by_rate(rtwdev, path, rs, ++ &phy_pwr_idx); + } + } + +-- +2.39.5 + diff --git a/queue-5.15/wifi-rtw88-fix-download_firmware_validate-for-rtl881.patch b/queue-5.15/wifi-rtw88-fix-download_firmware_validate-for-rtl881.patch new file mode 100644 index 0000000000..f5e57cda26 --- /dev/null +++ b/queue-5.15/wifi-rtw88-fix-download_firmware_validate-for-rtl881.patch @@ -0,0 +1,49 @@ +From 8b4816c9c2c0c7c9e7411fcea1c935417ae42a7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Feb 2025 20:37:36 +0200 +Subject: wifi: rtw88: Fix download_firmware_validate() for RTL8814AU + +From: Bitterblue Smith + +[ Upstream commit 9e8243025cc06abc975c876dffda052073207ab3 ] + +After the firmware is uploaded, download_firmware_validate() checks some +bits in REG_MCUFW_CTRL to see if everything went okay. The +RTL8814AU power on sequence sets bits 13 and 12 to 2, which this +function does not expect, so it thinks the firmware upload failed. + +Make download_firmware_validate() ignore bits 13 and 12. + +Signed-off-by: Bitterblue Smith +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/049d2887-22fc-47b7-9e59-62627cb525f8@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/reg.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/reg.h b/drivers/net/wireless/realtek/rtw88/reg.h +index c0fb1e446245f..3e5bd64bc09c0 100644 +--- a/drivers/net/wireless/realtek/rtw88/reg.h ++++ b/drivers/net/wireless/realtek/rtw88/reg.h +@@ -107,6 +107,7 @@ + #define BIT_SHIFT_ROM_PGE 16 + #define BIT_FW_INIT_RDY BIT(15) + #define BIT_FW_DW_RDY BIT(14) ++#define BIT_CPU_CLK_SEL (BIT(12) | BIT(13)) + #define BIT_RPWM_TOGGLE BIT(7) + #define BIT_RAM_DL_SEL BIT(7) /* legacy only */ + #define BIT_DMEM_CHKSUM_OK BIT(6) +@@ -124,7 +125,7 @@ + BIT_CHECK_SUM_OK) + #define FW_READY_LEGACY (BIT_MCUFWDL_RDY | BIT_FWDL_CHK_RPT | \ + BIT_WINTINI_RDY | BIT_RAM_DL_SEL) +-#define FW_READY_MASK 0xffff ++#define FW_READY_MASK (0xffff & ~BIT_CPU_CLK_SEL) + + #define REG_MCU_TST_CFG 0x84 + #define VAL_FW_TRIGGER 0x1 +-- +2.39.5 + diff --git a/queue-5.15/wifi-rtw88-fix-rtw_desc_to_mcsrate-to-handle-mcs16-3.patch b/queue-5.15/wifi-rtw88-fix-rtw_desc_to_mcsrate-to-handle-mcs16-3.patch new file mode 100644 index 0000000000..07bf5b0a77 --- /dev/null +++ b/queue-5.15/wifi-rtw88-fix-rtw_desc_to_mcsrate-to-handle-mcs16-3.patch @@ -0,0 +1,42 @@ +From 1d85c971bf606f08ef693f8e4cb7041f19c32674 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Feb 2025 01:29:52 +0200 +Subject: wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31 + +From: Bitterblue Smith + +[ Upstream commit 86d04f8f991a0509e318fe886d5a1cf795736c7d ] + +This function translates the rate number reported by the hardware into +something mac80211 can understand. It was ignoring the 3SS and 4SS HT +rates. Translate them too. + +Also set *nss to 0 for the HT rates, just to make sure it's +initialised. + +Signed-off-by: Bitterblue Smith +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/d0a5a86b-4869-47f6-a5a7-01c0f987cc7f@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/util.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/util.c b/drivers/net/wireless/realtek/rtw88/util.c +index 2c515af214e76..bfd017d53fef8 100644 +--- a/drivers/net/wireless/realtek/rtw88/util.c ++++ b/drivers/net/wireless/realtek/rtw88/util.c +@@ -101,7 +101,8 @@ void rtw_desc_to_mcsrate(u16 rate, u8 *mcs, u8 *nss) + *nss = 4; + *mcs = rate - DESC_RATEVHT4SS_MCS0; + } else if (rate >= DESC_RATEMCS0 && +- rate <= DESC_RATEMCS15) { ++ rate <= DESC_RATEMCS31) { ++ *nss = 0; + *mcs = rate - DESC_RATEMCS0; + } + } +-- +2.39.5 + diff --git a/queue-5.15/wifi-rtw88-fix-rtw_init_ht_cap-for-rtl8814au.patch b/queue-5.15/wifi-rtw88-fix-rtw_init_ht_cap-for-rtl8814au.patch new file mode 100644 index 0000000000..da6239d62e --- /dev/null +++ b/queue-5.15/wifi-rtw88-fix-rtw_init_ht_cap-for-rtl8814au.patch @@ -0,0 +1,59 @@ +From 570e20df04257e70c82a90eb9d09c313fca84485 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Feb 2025 01:30:22 +0200 +Subject: wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU + +From: Bitterblue Smith + +[ Upstream commit c7eea1ba05ca5b0dbf77a27cf2e1e6e2fb3c0043 ] + +Set the RX mask and the highest RX rate according to the number of +spatial streams the chip can receive. For RTL8814AU that is 3. + +Signed-off-by: Bitterblue Smith +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/4e786f50-ed1c-4387-8b28-e6ff00e35e81@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/main.c | 17 ++++++----------- + 1 file changed, 6 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c +index c5d0b213a3546..5101db5ab6d27 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.c ++++ b/drivers/net/wireless/realtek/rtw88/main.c +@@ -1330,6 +1330,7 @@ static void rtw_init_ht_cap(struct rtw_dev *rtwdev, + struct ieee80211_sta_ht_cap *ht_cap) + { + struct rtw_efuse *efuse = &rtwdev->efuse; ++ int i; + + ht_cap->ht_supported = true; + ht_cap->cap = 0; +@@ -1349,17 +1350,11 @@ static void rtw_init_ht_cap(struct rtw_dev *rtwdev, + ht_cap->ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K; + ht_cap->ampdu_density = IEEE80211_HT_MPDU_DENSITY_16; + ht_cap->mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED; +- if (efuse->hw_cap.nss > 1) { +- ht_cap->mcs.rx_mask[0] = 0xFF; +- ht_cap->mcs.rx_mask[1] = 0xFF; +- ht_cap->mcs.rx_mask[4] = 0x01; +- ht_cap->mcs.rx_highest = cpu_to_le16(300); +- } else { +- ht_cap->mcs.rx_mask[0] = 0xFF; +- ht_cap->mcs.rx_mask[1] = 0x00; +- ht_cap->mcs.rx_mask[4] = 0x01; +- ht_cap->mcs.rx_highest = cpu_to_le16(150); +- } ++ ++ for (i = 0; i < efuse->hw_cap.nss; i++) ++ ht_cap->mcs.rx_mask[i] = 0xFF; ++ ht_cap->mcs.rx_mask[4] = 0x01; ++ ht_cap->mcs.rx_highest = cpu_to_le16(150 * efuse->hw_cap.nss); + } + + static void rtw_init_vht_cap(struct rtw_dev *rtwdev, +-- +2.39.5 + diff --git a/queue-5.15/wifi-rtw88-fix-rtw_init_vht_cap-for-rtl8814au.patch b/queue-5.15/wifi-rtw88-fix-rtw_init_vht_cap-for-rtl8814au.patch new file mode 100644 index 0000000000..6a67dbdf12 --- /dev/null +++ b/queue-5.15/wifi-rtw88-fix-rtw_init_vht_cap-for-rtl8814au.patch @@ -0,0 +1,68 @@ +From d43a5769a2c2f9157b7f0dd9a6eab35e4296143b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Feb 2025 01:30:48 +0200 +Subject: wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU + +From: Bitterblue Smith + +[ Upstream commit 6be7544d19fcfcb729495e793bc6181f85bb8949 ] + +Set the MCS maps and the highest rates according to the number of +spatial streams the chip has. For RTL8814AU that is 3. + +Signed-off-by: Bitterblue Smith +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/e86aa009-b5bf-4b3a-8112-ea5e3cd49465@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/main.c | 23 +++++++++-------------- + 1 file changed, 9 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c +index 23971a5737cf5..c5d0b213a3546 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.c ++++ b/drivers/net/wireless/realtek/rtw88/main.c +@@ -1366,8 +1366,9 @@ static void rtw_init_vht_cap(struct rtw_dev *rtwdev, + struct ieee80211_sta_vht_cap *vht_cap) + { + struct rtw_efuse *efuse = &rtwdev->efuse; +- u16 mcs_map; ++ u16 mcs_map = 0; + __le16 highest; ++ int i; + + if (efuse->hw_cap.ptcl != EFUSE_HW_CAP_IGNORE && + efuse->hw_cap.ptcl != EFUSE_HW_CAP_PTCL_VHT) +@@ -1390,21 +1391,15 @@ static void rtw_init_vht_cap(struct rtw_dev *rtwdev, + if (rtw_chip_has_rx_ldpc(rtwdev)) + vht_cap->cap |= IEEE80211_VHT_CAP_RXLDPC; + +- mcs_map = IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 | +- IEEE80211_VHT_MCS_NOT_SUPPORTED << 4 | +- IEEE80211_VHT_MCS_NOT_SUPPORTED << 6 | +- IEEE80211_VHT_MCS_NOT_SUPPORTED << 8 | +- IEEE80211_VHT_MCS_NOT_SUPPORTED << 10 | +- IEEE80211_VHT_MCS_NOT_SUPPORTED << 12 | +- IEEE80211_VHT_MCS_NOT_SUPPORTED << 14; +- if (efuse->hw_cap.nss > 1) { +- highest = cpu_to_le16(780); +- mcs_map |= IEEE80211_VHT_MCS_SUPPORT_0_9 << 2; +- } else { +- highest = cpu_to_le16(390); +- mcs_map |= IEEE80211_VHT_MCS_NOT_SUPPORTED << 2; ++ for (i = 0; i < 8; i++) { ++ if (i < efuse->hw_cap.nss) ++ mcs_map |= IEEE80211_VHT_MCS_SUPPORT_0_9 << (i * 2); ++ else ++ mcs_map |= IEEE80211_VHT_MCS_NOT_SUPPORTED << (i * 2); + } + ++ highest = cpu_to_le16(390 * efuse->hw_cap.nss); ++ + vht_cap->vht_mcs.rx_mcs_map = cpu_to_le16(mcs_map); + vht_cap->vht_mcs.tx_mcs_map = cpu_to_le16(mcs_map); + vht_cap->vht_mcs.rx_highest = highest; +-- +2.39.5 + diff --git a/queue-5.15/x86-bugs-make-spectre-user-default-depend-on-mitigat.patch b/queue-5.15/x86-bugs-make-spectre-user-default-depend-on-mitigat.patch new file mode 100644 index 0000000000..5cf68e01db --- /dev/null +++ b/queue-5.15/x86-bugs-make-spectre-user-default-depend-on-mitigat.patch @@ -0,0 +1,96 @@ +From d4adfe5d277d0e6c7f5d75d91a75ef85e0ca54c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Oct 2024 04:06:17 -0700 +Subject: x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 + +From: Breno Leitao + +[ Upstream commit 98fdaeb296f51ef08e727a7cc72e5b5c864c4f4d ] + +Change the default value of spectre v2 in user mode to respect the +CONFIG_MITIGATION_SPECTRE_V2 config option. + +Currently, user mode spectre v2 is set to auto +(SPECTRE_V2_USER_CMD_AUTO) by default, even if +CONFIG_MITIGATION_SPECTRE_V2 is disabled. + +Set the spectre_v2 value to auto (SPECTRE_V2_USER_CMD_AUTO) if the +Spectre v2 config (CONFIG_MITIGATION_SPECTRE_V2) is enabled, otherwise +set the value to none (SPECTRE_V2_USER_CMD_NONE). + +Important to say the command line argument "spectre_v2_user" overwrites +the default value in both cases. + +When CONFIG_MITIGATION_SPECTRE_V2 is not set, users have the flexibility +to opt-in for specific mitigations independently. In this scenario, +setting spectre_v2= will not enable spectre_v2_user=, and command line +options spectre_v2_user and spectre_v2 are independent when +CONFIG_MITIGATION_SPECTRE_V2=n. + +Signed-off-by: Breno Leitao +Signed-off-by: Ingo Molnar +Reviewed-by: Pawan Gupta +Acked-by: Josh Poimboeuf +Cc: Peter Zijlstra +Cc: David Kaplan +Link: https://lore.kernel.org/r/20241031-x86_bugs_last_v2-v2-2-b7ff1dab840e@debian.org +Signed-off-by: Sasha Levin +--- + Documentation/admin-guide/kernel-parameters.txt | 2 ++ + arch/x86/kernel/cpu/bugs.c | 10 +++++++--- + 2 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index 4bc5d8c97d097..e0670357d23f8 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -5445,6 +5445,8 @@ + + Selecting 'on' will also enable the mitigation + against user space to user space task attacks. ++ Selecting specific mitigation does not force enable ++ user mitigations. + + Selecting 'off' will disable both the kernel and + the user space protections. +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index 63af3d73d19e5..30b9292ac58fd 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -1382,9 +1382,13 @@ static __ro_after_init enum spectre_v2_mitigation_cmd spectre_v2_cmd; + static enum spectre_v2_user_cmd __init + spectre_v2_parse_user_cmdline(void) + { ++ enum spectre_v2_user_cmd mode; + char arg[20]; + int ret, i; + ++ mode = IS_ENABLED(CONFIG_MITIGATION_SPECTRE_V2) ? ++ SPECTRE_V2_USER_CMD_AUTO : SPECTRE_V2_USER_CMD_NONE; ++ + switch (spectre_v2_cmd) { + case SPECTRE_V2_CMD_NONE: + return SPECTRE_V2_USER_CMD_NONE; +@@ -1397,7 +1401,7 @@ spectre_v2_parse_user_cmdline(void) + ret = cmdline_find_option(boot_command_line, "spectre_v2_user", + arg, sizeof(arg)); + if (ret < 0) +- return SPECTRE_V2_USER_CMD_AUTO; ++ return mode; + + for (i = 0; i < ARRAY_SIZE(v2_user_options); i++) { + if (match_option(arg, ret, v2_user_options[i].option)) { +@@ -1407,8 +1411,8 @@ spectre_v2_parse_user_cmdline(void) + } + } + +- pr_err("Unknown user space protection option (%s). Switching to AUTO select\n", arg); +- return SPECTRE_V2_USER_CMD_AUTO; ++ pr_err("Unknown user space protection option (%s). Switching to default\n", arg); ++ return mode; + } + + static inline bool spectre_v2_in_eibrs_mode(enum spectre_v2_mitigation mode) +-- +2.39.5 + diff --git a/queue-5.15/x86-build-fix-broken-copy-command-in-genimage.sh-whe.patch b/queue-5.15/x86-build-fix-broken-copy-command-in-genimage.sh-whe.patch new file mode 100644 index 0000000000..846b0ba9e3 --- /dev/null +++ b/queue-5.15/x86-build-fix-broken-copy-command-in-genimage.sh-whe.patch @@ -0,0 +1,58 @@ +From feb1833c83d70c6079c472fb483e09e3467dafb3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 12:05:00 +0000 +Subject: x86/build: Fix broken copy command in genimage.sh when making + isoimage + +From: Nir Lichtman + +[ Upstream commit e451630226bd09dc730eedb4e32cab1cc7155ae8 ] + +Problem: Currently when running the "make isoimage" command there is an +error related to wrong parameters passed to the cp command: + + "cp: missing destination file operand after 'arch/x86/boot/isoimage/'" + +This is caused because FDINITRDS is an empty array. + +Solution: Check if FDINITRDS is empty before executing the "cp" command, +similar to how it is done in the case of hdimage. + +Signed-off-by: Nir Lichtman +Signed-off-by: Ingo Molnar +Cc: "H. Peter Anvin" +Cc: Ard Biesheuvel +Cc: Masahiro Yamada +Cc: Michal Marek +Link: https://lore.kernel.org/r/20250110120500.GA923218@lichtman.org +Signed-off-by: Sasha Levin +--- + arch/x86/boot/genimage.sh | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/boot/genimage.sh b/arch/x86/boot/genimage.sh +index 0673fdfc1a11a..a8a9b1daffac8 100644 +--- a/arch/x86/boot/genimage.sh ++++ b/arch/x86/boot/genimage.sh +@@ -22,6 +22,7 @@ + # This script requires: + # bash + # syslinux ++# genisoimage + # mtools (for fdimage* and hdimage) + # edk2/OVMF (for hdimage) + # +@@ -250,7 +251,9 @@ geniso() { + cp "$isolinux" "$ldlinux" "$tmp_dir" + cp "$FBZIMAGE" "$tmp_dir"/linux + echo default linux "$KCMDLINE" > "$tmp_dir"/isolinux.cfg +- cp "${FDINITRDS[@]}" "$tmp_dir"/ ++ if [ ${#FDINITRDS[@]} -gt 0 ]; then ++ cp "${FDINITRDS[@]}" "$tmp_dir"/ ++ fi + genisoimage -J -r -appid 'LINUX_BOOT' -input-charset=utf-8 \ + -quiet -o "$FIMAGE" -b isolinux.bin \ + -c boot.cat -no-emul-boot -boot-load-size 4 \ +-- +2.39.5 + diff --git a/queue-5.15/x86-kaslr-reduce-kaslr-entropy-on-most-x86-systems.patch b/queue-5.15/x86-kaslr-reduce-kaslr-entropy-on-most-x86-systems.patch new file mode 100644 index 0000000000..02e2df31b3 --- /dev/null +++ b/queue-5.15/x86-kaslr-reduce-kaslr-entropy-on-most-x86-systems.patch @@ -0,0 +1,88 @@ +From 45b6a679c1976dc9fb4012dda484af1066dd4583 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Feb 2025 10:42:34 +1100 +Subject: x86/kaslr: Reduce KASLR entropy on most x86 systems + +From: Balbir Singh + +[ Upstream commit 7ffb791423c7c518269a9aad35039ef824a40adb ] + +When CONFIG_PCI_P2PDMA=y (which is basically enabled on all +large x86 distros), it maps the PFN's via a ZONE_DEVICE +mapping using devm_memremap_pages(). The mapped virtual +address range corresponds to the pci_resource_start() +of the BAR address and size corresponding to the BAR length. + +When KASLR is enabled, the direct map range of the kernel is +reduced to the size of physical memory plus additional padding. +If the BAR address is beyond this limit, PCI peer to peer DMA +mappings fail. + +Fix this by not shrinking the size of the direct map when +CONFIG_PCI_P2PDMA=y. + +This reduces the total available entropy, but it's better than +the current work around of having to disable KASLR completely. + +[ mingo: Clarified the changelog to point out the broad impact ... ] + +Signed-off-by: Balbir Singh +Signed-off-by: Ingo Molnar +Reviewed-by: Kees Cook +Acked-by: Bjorn Helgaas # drivers/pci/Kconfig +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Andy Lutomirski +Link: https://lore.kernel.org/lkml/20250206023201.1481957-1-balbirs@nvidia.com/ +Link: https://lore.kernel.org/r/20250206234234.1912585-1-balbirs@nvidia.com +-- + arch/x86/mm/kaslr.c | 10 ++++++++-- + drivers/pci/Kconfig | 6 ++++++ + 2 files changed, 14 insertions(+), 2 deletions(-) +Signed-off-by: Sasha Levin +--- + arch/x86/mm/kaslr.c | 10 ++++++++-- + drivers/pci/Kconfig | 6 ++++++ + 2 files changed, 14 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/mm/kaslr.c b/arch/x86/mm/kaslr.c +index 37db264866b64..2ef1951ce1fd6 100644 +--- a/arch/x86/mm/kaslr.c ++++ b/arch/x86/mm/kaslr.c +@@ -96,8 +96,14 @@ void __init kernel_randomize_memory(void) + memory_tb = DIV_ROUND_UP(max_pfn << PAGE_SHIFT, 1UL << TB_SHIFT) + + CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING; + +- /* Adapt physical memory region size based on available memory */ +- if (memory_tb < kaslr_regions[0].size_tb) ++ /* ++ * Adapt physical memory region size based on available memory, ++ * except when CONFIG_PCI_P2PDMA is enabled. P2PDMA exposes the ++ * device BAR space assuming the direct map space is large enough ++ * for creating a ZONE_DEVICE mapping in the direct map corresponding ++ * to the physical BAR address. ++ */ ++ if (!IS_ENABLED(CONFIG_PCI_P2PDMA) && (memory_tb < kaslr_regions[0].size_tb)) + kaslr_regions[0].size_tb = memory_tb; + + /* +diff --git a/drivers/pci/Kconfig b/drivers/pci/Kconfig +index 43e615aa12ffa..8ed3bf14f0ce5 100644 +--- a/drivers/pci/Kconfig ++++ b/drivers/pci/Kconfig +@@ -176,6 +176,12 @@ config PCI_P2PDMA + P2P DMA transactions must be between devices behind the same root + port. + ++ Enabling this option will reduce the entropy of x86 KASLR memory ++ regions. For example - on a 46 bit system, the entropy goes down ++ from 16 bits to 15 bits. The actual reduction in entropy depends ++ on the physical address bits, on processor features, kernel config ++ (5 level page table) and physical memory present on the system. ++ + If unsure, say N. + + config PCI_LABEL +-- +2.39.5 + diff --git a/queue-5.15/x86-nmi-add-an-emergency-handler-in-nmi_desc-use-it-.patch b/queue-5.15/x86-nmi-add-an-emergency-handler-in-nmi_desc-use-it-.patch new file mode 100644 index 0000000000..503c402473 --- /dev/null +++ b/queue-5.15/x86-nmi-add-an-emergency-handler-in-nmi_desc-use-it-.patch @@ -0,0 +1,173 @@ +From 09aaa4a901a064af2bab17777eb6158d225c3ed2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Feb 2025 14:18:44 -0500 +Subject: x86/nmi: Add an emergency handler in nmi_desc & use it in + nmi_shootdown_cpus() + +From: Waiman Long + +[ Upstream commit fe37c699ae3eed6e02ee55fbf5cb9ceb7fcfd76c ] + +Depending on the type of panics, it was found that the +__register_nmi_handler() function can be called in NMI context from +nmi_shootdown_cpus() leading to a lockdep splat: + + WARNING: inconsistent lock state + inconsistent {INITIAL USE} -> {IN-NMI} usage. + + lock(&nmi_desc[0].lock); + + lock(&nmi_desc[0].lock); + + Call Trace: + _raw_spin_lock_irqsave + __register_nmi_handler + nmi_shootdown_cpus + kdump_nmi_shootdown_cpus + native_machine_crash_shutdown + __crash_kexec + +In this particular case, the following panic message was printed before: + + Kernel panic - not syncing: Fatal hardware error! + +This message seemed to be given out from __ghes_panic() running in +NMI context. + +The __register_nmi_handler() function which takes the nmi_desc lock +with irq disabled shouldn't be called from NMI context as this can +lead to deadlock. + +The nmi_shootdown_cpus() function can only be invoked once. After the +first invocation, all other CPUs should be stuck in the newly added +crash_nmi_callback() and cannot respond to a second NMI. + +Fix it by adding a new emergency NMI handler to the nmi_desc +structure and provide a new set_emergency_nmi_handler() helper to set +crash_nmi_callback() in any context. The new emergency handler will +preempt other handlers in the linked list. That will eliminate the need +to take any lock and serve the panic in NMI use case. + +Signed-off-by: Waiman Long +Signed-off-by: Ingo Molnar +Acked-by: Rik van Riel +Cc: Thomas Gleixner +Link: https://lore.kernel.org/r/20250206191844.131700-1-longman@redhat.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/nmi.h | 2 ++ + arch/x86/kernel/nmi.c | 42 ++++++++++++++++++++++++++++++++++++++ + arch/x86/kernel/reboot.c | 10 +++------ + 3 files changed, 47 insertions(+), 7 deletions(-) + +diff --git a/arch/x86/include/asm/nmi.h b/arch/x86/include/asm/nmi.h +index 1cb9c17a4cb4b..affe5522961ae 100644 +--- a/arch/x86/include/asm/nmi.h ++++ b/arch/x86/include/asm/nmi.h +@@ -58,6 +58,8 @@ int __register_nmi_handler(unsigned int, struct nmiaction *); + + void unregister_nmi_handler(unsigned int, const char *); + ++void set_emergency_nmi_handler(unsigned int type, nmi_handler_t handler); ++ + void stop_nmi(void); + void restart_nmi(void); + void local_touch_nmi(void); +diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c +index b892fe7035db5..a858d8e5d6104 100644 +--- a/arch/x86/kernel/nmi.c ++++ b/arch/x86/kernel/nmi.c +@@ -38,8 +38,12 @@ + #define CREATE_TRACE_POINTS + #include + ++/* ++ * An emergency handler can be set in any context including NMI ++ */ + struct nmi_desc { + raw_spinlock_t lock; ++ nmi_handler_t emerg_handler; + struct list_head head; + }; + +@@ -121,9 +125,22 @@ static void nmi_check_duration(struct nmiaction *action, u64 duration) + static int nmi_handle(unsigned int type, struct pt_regs *regs) + { + struct nmi_desc *desc = nmi_to_desc(type); ++ nmi_handler_t ehandler; + struct nmiaction *a; + int handled=0; + ++ /* ++ * Call the emergency handler, if set ++ * ++ * In the case of crash_nmi_callback() emergency handler, it will ++ * return in the case of the crashing CPU to enable it to complete ++ * other necessary crashing actions ASAP. Other handlers in the ++ * linked list won't need to be run. ++ */ ++ ehandler = desc->emerg_handler; ++ if (ehandler) ++ return ehandler(type, regs); ++ + rcu_read_lock(); + + /* +@@ -209,6 +226,31 @@ void unregister_nmi_handler(unsigned int type, const char *name) + } + EXPORT_SYMBOL_GPL(unregister_nmi_handler); + ++/** ++ * set_emergency_nmi_handler - Set emergency handler ++ * @type: NMI type ++ * @handler: the emergency handler to be stored ++ * ++ * Set an emergency NMI handler which, if set, will preempt all the other ++ * handlers in the linked list. If a NULL handler is passed in, it will clear ++ * it. It is expected that concurrent calls to this function will not happen ++ * or the system is screwed beyond repair. ++ */ ++void set_emergency_nmi_handler(unsigned int type, nmi_handler_t handler) ++{ ++ struct nmi_desc *desc = nmi_to_desc(type); ++ ++ if (WARN_ON_ONCE(desc->emerg_handler == handler)) ++ return; ++ desc->emerg_handler = handler; ++ ++ /* ++ * Ensure the emergency handler is visible to other CPUs before ++ * function return ++ */ ++ smp_wmb(); ++} ++ + static void + pci_serr_error(unsigned char reason, struct pt_regs *regs) + { +diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c +index deedd77c7593f..d8f7f8e43e199 100644 +--- a/arch/x86/kernel/reboot.c ++++ b/arch/x86/kernel/reboot.c +@@ -874,15 +874,11 @@ void nmi_shootdown_cpus(nmi_shootdown_cb callback) + shootdown_callback = callback; + + atomic_set(&waiting_for_crash_ipi, num_online_cpus() - 1); +- /* Would it be better to replace the trap vector here? */ +- if (register_nmi_handler(NMI_LOCAL, crash_nmi_callback, +- NMI_FLAG_FIRST, "crash")) +- return; /* Return what? */ ++ + /* +- * Ensure the new callback function is set before sending +- * out the NMI ++ * Set emergency handler to preempt other handlers. + */ +- wmb(); ++ set_emergency_nmi_handler(NMI_LOCAL, crash_nmi_callback); + + apic_send_IPI_allbutself(NMI_VECTOR); + +-- +2.39.5 + diff --git a/queue-5.15/xen-add-support-for-xenserver-6.1-platform-device.patch b/queue-5.15/xen-add-support-for-xenserver-6.1-platform-device.patch new file mode 100644 index 0000000000..9de69d526f --- /dev/null +++ b/queue-5.15/xen-add-support-for-xenserver-6.1-platform-device.patch @@ -0,0 +1,65 @@ +From 3e2aa959a6e28dfdbaa0c9cc3e600060db6f9b6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Feb 2025 14:50:15 +0000 +Subject: xen: Add support for XenServer 6.1 platform device + +From: Frediano Ziglio + +[ Upstream commit 2356f15caefc0cc63d9cc5122641754f76ef9b25 ] + +On XenServer on Windows machine a platform device with ID 2 instead of +1 is used. + +This device is mainly identical to device 1 but due to some Windows +update behaviour it was decided to use a device with a different ID. + +This causes compatibility issues with Linux which expects, if Xen +is detected, to find a Xen platform device (5853:0001) otherwise code +will crash due to some missing initialization (specifically grant +tables). Specifically from dmesg + + RIP: 0010:gnttab_expand+0x29/0x210 + Code: 90 0f 1f 44 00 00 55 31 d2 48 89 e5 41 57 41 56 41 55 41 89 fd + 41 54 53 48 83 ec 10 48 8b 05 7e 9a 49 02 44 8b 35 a7 9a 49 02 + <8b> 48 04 8d 44 39 ff f7 f1 45 8d 24 06 89 c3 e8 43 fe ff ff + 44 39 + RSP: 0000:ffffba34c01fbc88 EFLAGS: 00010086 + ... + +The device 2 is presented by Xapi adding device specification to +Qemu command line. + +Signed-off-by: Frediano Ziglio +Acked-by: Juergen Gross +Message-ID: <20250227145016.25350-1-frediano.ziglio@cloud.com> +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + drivers/xen/platform-pci.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/xen/platform-pci.c b/drivers/xen/platform-pci.c +index 6ebd819338ecb..2c77cac5594ba 100644 +--- a/drivers/xen/platform-pci.c ++++ b/drivers/xen/platform-pci.c +@@ -26,6 +26,8 @@ + + #define DRV_NAME "xen-platform-pci" + ++#define PCI_DEVICE_ID_XEN_PLATFORM_XS61 0x0002 ++ + static unsigned long platform_mmio; + static unsigned long platform_mmio_alloc; + static unsigned long platform_mmiolen; +@@ -174,6 +176,8 @@ static int platform_pci_probe(struct pci_dev *pdev, + static const struct pci_device_id platform_pci_tbl[] = { + {PCI_VENDOR_ID_XEN, PCI_DEVICE_ID_XEN_PLATFORM, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, ++ {PCI_VENDOR_ID_XEN, PCI_DEVICE_ID_XEN_PLATFORM_XS61, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, + {0,} + }; + +-- +2.39.5 + diff --git a/queue-5.15/xenbus-allow-pvh-dom0-a-non-local-xenstore.patch b/queue-5.15/xenbus-allow-pvh-dom0-a-non-local-xenstore.patch new file mode 100644 index 0000000000..a3a850fb62 --- /dev/null +++ b/queue-5.15/xenbus-allow-pvh-dom0-a-non-local-xenstore.patch @@ -0,0 +1,69 @@ +From 5b0aaa97f434506d097e9e4375c39e8c22caef0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 May 2025 16:44:56 -0400 +Subject: xenbus: Allow PVH dom0 a non-local xenstore + +From: Jason Andryuk + +[ Upstream commit 90989869baae47ee2aa3bcb6f6eb9fbbe4287958 ] + +Make xenbus_init() allow a non-local xenstore for a PVH dom0 - it is +currently forced to XS_LOCAL. With Hyperlaunch booting dom0 and a +xenstore stubdom, dom0 can be handled as a regular XS_HVM following the +late init path. + +Ideally we'd drop the use of xen_initial_domain() and just check for the +event channel instead. However, ARM has a xen,enhanced no-xenstore +mode, where the event channel and PFN would both be 0. Retain the +xen_initial_domain() check, and use that for an additional check when +the event channel is 0. + +Check the full 64bit HVM_PARAM_STORE_EVTCHN value to catch the off +chance that high bits are set for the 32bit event channel. + +Signed-off-by: Jason Andryuk +Change-Id: I5506da42e4c6b8e85079fefb2f193c8de17c7437 +Reviewed-by: Stefano Stabellini +Signed-off-by: Juergen Gross +Message-ID: <20250506204456.5220-1-jason.andryuk@amd.com> +Signed-off-by: Sasha Levin +--- + drivers/xen/xenbus/xenbus_probe.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c +index e680bd1adf9c4..2068f83556b78 100644 +--- a/drivers/xen/xenbus/xenbus_probe.c ++++ b/drivers/xen/xenbus/xenbus_probe.c +@@ -927,9 +927,15 @@ static int __init xenbus_init(void) + if (xen_pv_domain()) + xen_store_domain_type = XS_PV; + if (xen_hvm_domain()) ++ { + xen_store_domain_type = XS_HVM; +- if (xen_hvm_domain() && xen_initial_domain()) +- xen_store_domain_type = XS_LOCAL; ++ err = hvm_get_parameter(HVM_PARAM_STORE_EVTCHN, &v); ++ if (err) ++ goto out_error; ++ xen_store_evtchn = (int)v; ++ if (!v && xen_initial_domain()) ++ xen_store_domain_type = XS_LOCAL; ++ } + if (xen_pv_domain() && !xen_start_info->store_evtchn) + xen_store_domain_type = XS_LOCAL; + if (xen_pv_domain() && xen_start_info->store_evtchn) +@@ -948,10 +954,6 @@ static int __init xenbus_init(void) + xen_store_interface = gfn_to_virt(xen_store_gfn); + break; + case XS_HVM: +- err = hvm_get_parameter(HVM_PARAM_STORE_EVTCHN, &v); +- if (err) +- goto out_error; +- xen_store_evtchn = (int)v; + err = hvm_get_parameter(HVM_PARAM_STORE_PFN, &v); + if (err) + goto out_error; +-- +2.39.5 +