From: Sasha Levin Date: Sun, 2 Feb 2025 04:05:19 +0000 (-0500) Subject: Fixes for 6.12 X-Git-Tag: v6.6.76~75 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6ff4bd91b34a7c63400d68710604c841c0a7d893;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.12 Signed-off-by: Sasha Levin --- diff --git a/queue-6.12/acpi-fan-cleanup-resources-in-the-error-path-of-.pro.patch b/queue-6.12/acpi-fan-cleanup-resources-in-the-error-path-of-.pro.patch new file mode 100644 index 0000000000..1b25bb8109 --- /dev/null +++ b/queue-6.12/acpi-fan-cleanup-resources-in-the-error-path-of-.pro.patch @@ -0,0 +1,59 @@ +From 0c42b4ce85ea68a385fc5b082764f1e05f757d4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 12:28:12 +0900 +Subject: ACPI: fan: cleanup resources in the error path of .probe() + +From: Joe Hattori + +[ Upstream commit c759bc8e9046f9812238f506d70f07d3ea4206d4 ] + +Call thermal_cooling_device_unregister() and sysfs_remove_link() in the +error path of acpi_fan_probe() to fix possible memory leak. + +This bug was found by an experimental static analysis tool that I am +developing. + +Fixes: 05a83d972293 ("ACPI: register ACPI Fan as generic thermal cooling device") +Signed-off-by: Joe Hattori +Link: https://patch.msgid.link/20241211032812.210164-1-joe@pf.is.s.u-tokyo.ac.jp +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/fan_core.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/acpi/fan_core.c b/drivers/acpi/fan_core.c +index 7cea4495f19bb..300e5d9199864 100644 +--- a/drivers/acpi/fan_core.c ++++ b/drivers/acpi/fan_core.c +@@ -371,19 +371,25 @@ static int acpi_fan_probe(struct platform_device *pdev) + result = sysfs_create_link(&pdev->dev.kobj, + &cdev->device.kobj, + "thermal_cooling"); +- if (result) ++ if (result) { + dev_err(&pdev->dev, "Failed to create sysfs link 'thermal_cooling'\n"); ++ goto err_unregister; ++ } + + result = sysfs_create_link(&cdev->device.kobj, + &pdev->dev.kobj, + "device"); + if (result) { + dev_err(&pdev->dev, "Failed to create sysfs link 'device'\n"); +- goto err_end; ++ goto err_remove_link; + } + + return 0; + ++err_remove_link: ++ sysfs_remove_link(&pdev->dev.kobj, "thermal_cooling"); ++err_unregister: ++ thermal_cooling_device_unregister(cdev); + err_end: + if (fan->acpi4) + acpi_fan_delete_attributes(device); +-- +2.39.5 + diff --git a/queue-6.12/afs-fix-cleanup-of-immediately-failed-async-calls.patch b/queue-6.12/afs-fix-cleanup-of-immediately-failed-async-calls.patch new file mode 100644 index 0000000000..b7fb652d33 --- /dev/null +++ b/queue-6.12/afs-fix-cleanup-of-immediately-failed-async-calls.patch @@ -0,0 +1,113 @@ +From 9be3e12dd07d2101a7c82fa567d106ccf79d0d2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Dec 2024 20:41:14 +0000 +Subject: afs: Fix cleanup of immediately failed async calls + +From: David Howells + +[ Upstream commit 9750be93b2be12b6d92323b97d7c055099d279e6 ] + +If we manage to begin an async call, but fail to transmit any data on it +due to a signal, we then abort it which causes a race between the +notification of call completion from rxrpc and our attempt to cancel the +notification. The notification will be necessary, however, for async +FetchData to terminate the netfs subrequest. + +However, since we get a notification from rxrpc upon completion of a call +(aborted or otherwise), we can just leave it to that. + +This leads to calls not getting cleaned up, but appearing in +/proc/net/rxrpc/calls as being aborted with code 6. + +Fix this by making the "error_do_abort:" case of afs_make_call() abort the +call and then abandon it to the notification handler. + +Fixes: 34fa47612bfe ("afs: Fix race in async call refcounting") +Reported-by: Marc Dionne +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/20241216204124.3752367-25-dhowells@redhat.com +cc: linux-afs@lists.infradead.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/afs/internal.h | 9 +++++++++ + fs/afs/rxrpc.c | 12 +++++++++--- + include/trace/events/afs.h | 2 ++ + 3 files changed, 20 insertions(+), 3 deletions(-) + +diff --git a/fs/afs/internal.h b/fs/afs/internal.h +index c9d620175e80c..d9760b2a8d8de 100644 +--- a/fs/afs/internal.h ++++ b/fs/afs/internal.h +@@ -1346,6 +1346,15 @@ extern void afs_send_simple_reply(struct afs_call *, const void *, size_t); + extern int afs_extract_data(struct afs_call *, bool); + extern int afs_protocol_error(struct afs_call *, enum afs_eproto_cause); + ++static inline void afs_see_call(struct afs_call *call, enum afs_call_trace why) ++{ ++ int r = refcount_read(&call->ref); ++ ++ trace_afs_call(call->debug_id, why, r, ++ atomic_read(&call->net->nr_outstanding_calls), ++ __builtin_return_address(0)); ++} ++ + static inline void afs_make_op_call(struct afs_operation *op, struct afs_call *call, + gfp_t gfp) + { +diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c +index 9f2a3bb56ec69..a122c6366ce19 100644 +--- a/fs/afs/rxrpc.c ++++ b/fs/afs/rxrpc.c +@@ -430,11 +430,16 @@ void afs_make_call(struct afs_call *call, gfp_t gfp) + return; + + error_do_abort: +- if (ret != -ECONNABORTED) { ++ if (ret != -ECONNABORTED) + rxrpc_kernel_abort_call(call->net->socket, rxcall, + RX_USER_ABORT, ret, + afs_abort_send_data_error); +- } else { ++ if (call->async) { ++ afs_see_call(call, afs_call_trace_async_abort); ++ return; ++ } ++ ++ if (ret == -ECONNABORTED) { + len = 0; + iov_iter_kvec(&msg.msg_iter, ITER_DEST, NULL, 0, 0); + rxrpc_kernel_recv_data(call->net->socket, rxcall, +@@ -445,6 +450,8 @@ void afs_make_call(struct afs_call *call, gfp_t gfp) + call->error = ret; + trace_afs_call_done(call); + error_kill_call: ++ if (call->async) ++ afs_see_call(call, afs_call_trace_async_kill); + if (call->type->done) + call->type->done(call); + +@@ -602,7 +609,6 @@ static void afs_deliver_to_call(struct afs_call *call) + abort_code = 0; + call_complete: + afs_set_call_complete(call, ret, remote_abort); +- state = AFS_CALL_COMPLETE; + goto done; + } + +diff --git a/include/trace/events/afs.h b/include/trace/events/afs.h +index a0aed1a428a18..9a75590227f26 100644 +--- a/include/trace/events/afs.h ++++ b/include/trace/events/afs.h +@@ -118,6 +118,8 @@ enum yfs_cm_operation { + */ + #define afs_call_traces \ + EM(afs_call_trace_alloc, "ALLOC") \ ++ EM(afs_call_trace_async_abort, "ASYAB") \ ++ EM(afs_call_trace_async_kill, "ASYKL") \ + EM(afs_call_trace_free, "FREE ") \ + EM(afs_call_trace_get, "GET ") \ + EM(afs_call_trace_put, "PUT ") \ +-- +2.39.5 + diff --git a/queue-6.12/afs-fix-directory-format-encoding-struct.patch b/queue-6.12/afs-fix-directory-format-encoding-struct.patch new file mode 100644 index 0000000000..6ae8b5cd57 --- /dev/null +++ b/queue-6.12/afs-fix-directory-format-encoding-struct.patch @@ -0,0 +1,45 @@ +From 306fd6b89768f08f3e39e0b8ab118940a8abc7ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Dec 2024 20:41:03 +0000 +Subject: afs: Fix directory format encoding struct + +From: David Howells + +[ Upstream commit 07a10767853adcbdbf436dc91393b729b52c4e81 ] + +The AFS directory format structure, union afs_xdr_dir_block::meta, has too +many alloc counter slots declared and so pushes the hash table along and +over the data. This doesn't cause a problem at the moment because I'm +currently ignoring the hash table and only using the correct number of +alloc_ctrs in the code anyway. In future, however, I should start using +the hash table to try and speed up afs_lookup(). + +Fix this by using the correct constant to declare the counter array. + +Fixes: 4ea219a839bf ("afs: Split the directory content defs into a header") +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/20241216204124.3752367-14-dhowells@redhat.com +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/afs/xdr_fs.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/afs/xdr_fs.h b/fs/afs/xdr_fs.h +index 8ca8681645077..cc5f143d21a34 100644 +--- a/fs/afs/xdr_fs.h ++++ b/fs/afs/xdr_fs.h +@@ -88,7 +88,7 @@ union afs_xdr_dir_block { + + struct { + struct afs_xdr_dir_hdr hdr; +- u8 alloc_ctrs[AFS_DIR_MAX_BLOCKS]; ++ u8 alloc_ctrs[AFS_DIR_BLOCKS_WITH_CTR]; + __be16 hashtable[AFS_DIR_HASHTBL_SIZE]; + } meta; + +-- +2.39.5 + diff --git a/queue-6.12/afs-fix-eexist-error-returned-from-afs_rmdir-to-be-e.patch b/queue-6.12/afs-fix-eexist-error-returned-from-afs_rmdir-to-be-e.patch new file mode 100644 index 0000000000..fac1bd9566 --- /dev/null +++ b/queue-6.12/afs-fix-eexist-error-returned-from-afs_rmdir-to-be-e.patch @@ -0,0 +1,48 @@ +From 0bf319cd79870d054175c4361eddf4bf91e10a27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Dec 2024 20:41:02 +0000 +Subject: afs: Fix EEXIST error returned from afs_rmdir() to be ENOTEMPTY + +From: David Howells + +[ Upstream commit b49194da2aff2c879dec9c59ef8dec0f2b0809ef ] + +AFS servers pass back a code indicating EEXIST when they're asked to remove +a directory that is not empty rather than ENOTEMPTY because not all the +systems that an AFS server can run on have the latter error available and +AFS preexisted the addition of that error in general. + +Fix afs_rmdir() to translate EEXIST to ENOTEMPTY. + +Fixes: 260a980317da ("[AFS]: Add "directory write" support.") +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/20241216204124.3752367-13-dhowells@redhat.com +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/afs/dir.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/fs/afs/dir.c b/fs/afs/dir.c +index ada363af5aab8..50edd1cae28ac 100644 +--- a/fs/afs/dir.c ++++ b/fs/afs/dir.c +@@ -1472,7 +1472,12 @@ static int afs_rmdir(struct inode *dir, struct dentry *dentry) + op->file[1].vnode = vnode; + } + +- return afs_do_sync_operation(op); ++ ret = afs_do_sync_operation(op); ++ ++ /* Not all systems that can host afs servers have ENOTEMPTY. */ ++ if (ret == -EEXIST) ++ ret = -ENOTEMPTY; ++ return ret; + + error: + return afs_put_operation(op); +-- +2.39.5 + diff --git a/queue-6.12/afs-fix-the-fallback-handling-for-the-yfs.removefile.patch b/queue-6.12/afs-fix-the-fallback-handling-for-the-yfs.removefile.patch new file mode 100644 index 0000000000..9ef41cba05 --- /dev/null +++ b/queue-6.12/afs-fix-the-fallback-handling-for-the-yfs.removefile.patch @@ -0,0 +1,48 @@ +From d35d4a20de01efb7fb2df114faa61ddf1f67f198 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jan 2025 14:46:03 +0000 +Subject: afs: Fix the fallback handling for the YFS.RemoveFile2 RPC call + +From: David Howells + +[ Upstream commit e30458d690f35abb01de8b3cbc09285deb725d00 ] + +Fix a pair of bugs in the fallback handling for the YFS.RemoveFile2 RPC +call: + + (1) Fix the abort code check to also look for RXGEN_OPCODE. The lack of + this masks the second bug. + + (2) call->server is now not used for ordinary filesystem RPC calls that + have an operation descriptor. Fix to use call->op->server instead. + +Fixes: e49c7b2f6de7 ("afs: Build an abstraction around an "operation" concept") +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/109541.1736865963@warthog.procyon.org.uk +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/afs/yfsclient.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/afs/yfsclient.c b/fs/afs/yfsclient.c +index 024227aba4cd5..362845f9aaaef 100644 +--- a/fs/afs/yfsclient.c ++++ b/fs/afs/yfsclient.c +@@ -666,8 +666,9 @@ static int yfs_deliver_fs_remove_file2(struct afs_call *call) + static void yfs_done_fs_remove_file2(struct afs_call *call) + { + if (call->error == -ECONNABORTED && +- call->abort_code == RX_INVALID_OPERATION) { +- set_bit(AFS_SERVER_FL_NO_RM2, &call->server->flags); ++ (call->abort_code == RX_INVALID_OPERATION || ++ call->abort_code == RXGEN_OPCODE)) { ++ set_bit(AFS_SERVER_FL_NO_RM2, &call->op->server->flags); + call->op->flags |= AFS_OPERATION_DOWNGRADE; + } + } +-- +2.39.5 + diff --git a/queue-6.12/alsa-hda-fix-compilation-of-snd_hdac_adsp_xxx-helper.patch b/queue-6.12/alsa-hda-fix-compilation-of-snd_hdac_adsp_xxx-helper.patch new file mode 100644 index 0000000000..a698d5c36f --- /dev/null +++ b/queue-6.12/alsa-hda-fix-compilation-of-snd_hdac_adsp_xxx-helper.patch @@ -0,0 +1,197 @@ +From bf8898686ded914f186228e83802693eacbb6e20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 12:33:25 +0100 +Subject: ALSA: hda: Fix compilation of snd_hdac_adsp_xxx() helpers + +From: Cezary Rojewski + +[ Upstream commit 7579790915387396e26041ceafbc07348658edef ] + +The snd_hdac_adsp_xxx() wrap snd_hdac_reg_xxx() helpers to simplify +register access for AudioDSP drivers e.g.: the avs-driver. Byte- and +word-variants of said helps do not expand to bare readx/writex() +operations but functions instead and, due to pointer type +incompatibility, cause compilation to fail. + +As the macros are utilized by the avs-driver alone, relocate the code +introduced with commit c19bd02e9029 ("ALSA: hda: Add helper macros for +DSP capable devices") into the avs/ directory and update it to operate +on 'adev' i.e.: the avs-driver-context directly to fix the issue. + +Fixes: c19bd02e9029 ("ALSA: hda: Add helper macros for DSP capable devices") +Signed-off-by: Cezary Rojewski +Acked-by: Mark Brown +Link: https://patch.msgid.link/20250110113326.3809897-2-cezary.rojewski@intel.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + include/sound/hdaudio_ext.h | 45 --------------------------------- + sound/soc/intel/avs/apl.c | 1 + + sound/soc/intel/avs/cnl.c | 1 + + sound/soc/intel/avs/registers.h | 45 +++++++++++++++++++++++++++++++++ + sound/soc/intel/avs/skl.c | 1 + + 5 files changed, 48 insertions(+), 45 deletions(-) + +diff --git a/include/sound/hdaudio_ext.h b/include/sound/hdaudio_ext.h +index 957295364a5e3..4c7a40e149a59 100644 +--- a/include/sound/hdaudio_ext.h ++++ b/include/sound/hdaudio_ext.h +@@ -2,8 +2,6 @@ + #ifndef __SOUND_HDAUDIO_EXT_H + #define __SOUND_HDAUDIO_EXT_H + +-#include +-#include + #include + + int snd_hdac_ext_bus_init(struct hdac_bus *bus, struct device *dev, +@@ -119,49 +117,6 @@ int snd_hdac_ext_bus_link_put(struct hdac_bus *bus, struct hdac_ext_link *hlink) + + void snd_hdac_ext_bus_link_power(struct hdac_device *codec, bool enable); + +-#define snd_hdac_adsp_writeb(chip, reg, value) \ +- snd_hdac_reg_writeb(chip, (chip)->dsp_ba + (reg), value) +-#define snd_hdac_adsp_readb(chip, reg) \ +- snd_hdac_reg_readb(chip, (chip)->dsp_ba + (reg)) +-#define snd_hdac_adsp_writew(chip, reg, value) \ +- snd_hdac_reg_writew(chip, (chip)->dsp_ba + (reg), value) +-#define snd_hdac_adsp_readw(chip, reg) \ +- snd_hdac_reg_readw(chip, (chip)->dsp_ba + (reg)) +-#define snd_hdac_adsp_writel(chip, reg, value) \ +- snd_hdac_reg_writel(chip, (chip)->dsp_ba + (reg), value) +-#define snd_hdac_adsp_readl(chip, reg) \ +- snd_hdac_reg_readl(chip, (chip)->dsp_ba + (reg)) +-#define snd_hdac_adsp_writeq(chip, reg, value) \ +- snd_hdac_reg_writeq(chip, (chip)->dsp_ba + (reg), value) +-#define snd_hdac_adsp_readq(chip, reg) \ +- snd_hdac_reg_readq(chip, (chip)->dsp_ba + (reg)) +- +-#define snd_hdac_adsp_updateb(chip, reg, mask, val) \ +- snd_hdac_adsp_writeb(chip, reg, \ +- (snd_hdac_adsp_readb(chip, reg) & ~(mask)) | (val)) +-#define snd_hdac_adsp_updatew(chip, reg, mask, val) \ +- snd_hdac_adsp_writew(chip, reg, \ +- (snd_hdac_adsp_readw(chip, reg) & ~(mask)) | (val)) +-#define snd_hdac_adsp_updatel(chip, reg, mask, val) \ +- snd_hdac_adsp_writel(chip, reg, \ +- (snd_hdac_adsp_readl(chip, reg) & ~(mask)) | (val)) +-#define snd_hdac_adsp_updateq(chip, reg, mask, val) \ +- snd_hdac_adsp_writeq(chip, reg, \ +- (snd_hdac_adsp_readq(chip, reg) & ~(mask)) | (val)) +- +-#define snd_hdac_adsp_readb_poll(chip, reg, val, cond, delay_us, timeout_us) \ +- readb_poll_timeout((chip)->dsp_ba + (reg), val, cond, \ +- delay_us, timeout_us) +-#define snd_hdac_adsp_readw_poll(chip, reg, val, cond, delay_us, timeout_us) \ +- readw_poll_timeout((chip)->dsp_ba + (reg), val, cond, \ +- delay_us, timeout_us) +-#define snd_hdac_adsp_readl_poll(chip, reg, val, cond, delay_us, timeout_us) \ +- readl_poll_timeout((chip)->dsp_ba + (reg), val, cond, \ +- delay_us, timeout_us) +-#define snd_hdac_adsp_readq_poll(chip, reg, val, cond, delay_us, timeout_us) \ +- readq_poll_timeout((chip)->dsp_ba + (reg), val, cond, \ +- delay_us, timeout_us) +- + struct hdac_ext_device; + + /* ops common to all codec drivers */ +diff --git a/sound/soc/intel/avs/apl.c b/sound/soc/intel/avs/apl.c +index d443fe8d51aee..3dccf0a57a3a1 100644 +--- a/sound/soc/intel/avs/apl.c ++++ b/sound/soc/intel/avs/apl.c +@@ -12,6 +12,7 @@ + #include "avs.h" + #include "messages.h" + #include "path.h" ++#include "registers.h" + #include "topology.h" + + static irqreturn_t avs_apl_dsp_interrupt(struct avs_dev *adev) +diff --git a/sound/soc/intel/avs/cnl.c b/sound/soc/intel/avs/cnl.c +index bd3c4bb8bf5a1..03f8fb0dc187f 100644 +--- a/sound/soc/intel/avs/cnl.c ++++ b/sound/soc/intel/avs/cnl.c +@@ -9,6 +9,7 @@ + #include + #include "avs.h" + #include "messages.h" ++#include "registers.h" + + static void avs_cnl_ipc_interrupt(struct avs_dev *adev) + { +diff --git a/sound/soc/intel/avs/registers.h b/sound/soc/intel/avs/registers.h +index f76e91cff2a9a..5b6d60eb3c18b 100644 +--- a/sound/soc/intel/avs/registers.h ++++ b/sound/soc/intel/avs/registers.h +@@ -9,6 +9,8 @@ + #ifndef __SOUND_SOC_INTEL_AVS_REGS_H + #define __SOUND_SOC_INTEL_AVS_REGS_H + ++#include ++#include + #include + + #define AZX_PCIREG_PGCTL 0x44 +@@ -98,4 +100,47 @@ + #define avs_downlink_addr(adev) \ + avs_sram_addr(adev, AVS_DOWNLINK_WINDOW) + ++#define snd_hdac_adsp_writeb(adev, reg, value) \ ++ snd_hdac_reg_writeb(&(adev)->base.core, (adev)->dsp_ba + (reg), value) ++#define snd_hdac_adsp_readb(adev, reg) \ ++ snd_hdac_reg_readb(&(adev)->base.core, (adev)->dsp_ba + (reg)) ++#define snd_hdac_adsp_writew(adev, reg, value) \ ++ snd_hdac_reg_writew(&(adev)->base.core, (adev)->dsp_ba + (reg), value) ++#define snd_hdac_adsp_readw(adev, reg) \ ++ snd_hdac_reg_readw(&(adev)->base.core, (adev)->dsp_ba + (reg)) ++#define snd_hdac_adsp_writel(adev, reg, value) \ ++ snd_hdac_reg_writel(&(adev)->base.core, (adev)->dsp_ba + (reg), value) ++#define snd_hdac_adsp_readl(adev, reg) \ ++ snd_hdac_reg_readl(&(adev)->base.core, (adev)->dsp_ba + (reg)) ++#define snd_hdac_adsp_writeq(adev, reg, value) \ ++ snd_hdac_reg_writeq(&(adev)->base.core, (adev)->dsp_ba + (reg), value) ++#define snd_hdac_adsp_readq(adev, reg) \ ++ snd_hdac_reg_readq(&(adev)->base.core, (adev)->dsp_ba + (reg)) ++ ++#define snd_hdac_adsp_updateb(adev, reg, mask, val) \ ++ snd_hdac_adsp_writeb(adev, reg, \ ++ (snd_hdac_adsp_readb(adev, reg) & ~(mask)) | (val)) ++#define snd_hdac_adsp_updatew(adev, reg, mask, val) \ ++ snd_hdac_adsp_writew(adev, reg, \ ++ (snd_hdac_adsp_readw(adev, reg) & ~(mask)) | (val)) ++#define snd_hdac_adsp_updatel(adev, reg, mask, val) \ ++ snd_hdac_adsp_writel(adev, reg, \ ++ (snd_hdac_adsp_readl(adev, reg) & ~(mask)) | (val)) ++#define snd_hdac_adsp_updateq(adev, reg, mask, val) \ ++ snd_hdac_adsp_writeq(adev, reg, \ ++ (snd_hdac_adsp_readq(adev, reg) & ~(mask)) | (val)) ++ ++#define snd_hdac_adsp_readb_poll(adev, reg, val, cond, delay_us, timeout_us) \ ++ readb_poll_timeout((adev)->dsp_ba + (reg), val, cond, \ ++ delay_us, timeout_us) ++#define snd_hdac_adsp_readw_poll(adev, reg, val, cond, delay_us, timeout_us) \ ++ readw_poll_timeout((adev)->dsp_ba + (reg), val, cond, \ ++ delay_us, timeout_us) ++#define snd_hdac_adsp_readl_poll(adev, reg, val, cond, delay_us, timeout_us) \ ++ readl_poll_timeout((adev)->dsp_ba + (reg), val, cond, \ ++ delay_us, timeout_us) ++#define snd_hdac_adsp_readq_poll(adev, reg, val, cond, delay_us, timeout_us) \ ++ readq_poll_timeout((adev)->dsp_ba + (reg), val, cond, \ ++ delay_us, timeout_us) ++ + #endif /* __SOUND_SOC_INTEL_AVS_REGS_H */ +diff --git a/sound/soc/intel/avs/skl.c b/sound/soc/intel/avs/skl.c +index 34f859d6e5a49..d66ef000de9ee 100644 +--- a/sound/soc/intel/avs/skl.c ++++ b/sound/soc/intel/avs/skl.c +@@ -12,6 +12,7 @@ + #include "avs.h" + #include "cldma.h" + #include "messages.h" ++#include "registers.h" + + void avs_skl_ipc_interrupt(struct avs_dev *adev) + { +-- +2.39.5 + diff --git a/queue-6.12/alsa-hda-realtek-fixed-headphone-distorted-sound-on-.patch b/queue-6.12/alsa-hda-realtek-fixed-headphone-distorted-sound-on-.patch new file mode 100644 index 0000000000..3bbd5b8de9 --- /dev/null +++ b/queue-6.12/alsa-hda-realtek-fixed-headphone-distorted-sound-on-.patch @@ -0,0 +1,37 @@ +From 3e8964ac4b3e2e17d12879c5d6c0237e78b13833 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 14:44:01 +0800 +Subject: ALSA: hda/realtek - Fixed headphone distorted sound on Acer Aspire + A115-31 laptop + +From: Kailang Yang + +[ Upstream commit 5cb4e5b056772e341b590755a976081776422053 ] + +Sound played through headphones is distorted. + +Fixes: 34ab5bbc6e82 ("ALSA: hda/realtek - Add Headset Mic supported Acer NB platform") +Closes: https://lore.kernel.org/linux-sound/e142749b-7714-4733-9452-918fbe328c8f@gmail.com/ +Signed-off-by: Kailang Yang +Link: https://lore.kernel.org/0a89b6c18ed94378a105fa61e9f290e4@realtek.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 8c4de5a253add..5d99a4ea176a1 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10143,6 +10143,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1025, 0x1360, "Acer Aspire A115", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x141f, "Acer Spin SP513-54N", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x142b, "Acer Swift SF314-42", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x1430, "Acer TravelMate B311R-31", ALC256_FIXUP_ACER_MIC_NO_PRESENCE), +-- +2.39.5 + diff --git a/queue-6.12/alsa-seq-make-dependency-on-ump-clearer.patch b/queue-6.12/alsa-seq-make-dependency-on-ump-clearer.patch new file mode 100644 index 0000000000..5fcb9d77bf --- /dev/null +++ b/queue-6.12/alsa-seq-make-dependency-on-ump-clearer.patch @@ -0,0 +1,53 @@ +From d6ad0b3546f99cc33215e4f2b8a59d10962f290e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jan 2025 13:55:47 +0100 +Subject: ALSA: seq: Make dependency on UMP clearer + +From: Takashi Iwai + +[ Upstream commit 9001d515443518d72222ba4d58e247696b625071 ] + +CONFIG_SND_SEQ_UMP_CLIENT is a Kconfig for a sequencer client +corresponding to the UMP rawmidi, while we have another major knob +CONFIG_SND_SEQ_UMP that specifies whether the sequencer core supports +UMP packets or not. Strictly speaking both of them are independent, +but practically seen, it makes no sense to enable +CONFIG_SND_SEQ_UMP_CLIENT without UMP support itself. + +This patch makes such an implicit dependency clearer. Now +CONFIG_SND_SEQ_UMP_CLIENT depends on both CONFIG_SND_UMP and +CONFIG_SND_SEQ_UMP. Meanwhile, CONFIG_SND_SEQ_UMP is enabled as +default when CONFIG_SND_UMP is set. + +Fixes: 81fd444aa371 ("ALSA: seq: Bind UMP device") +Link: https://patch.msgid.link/20250101125548.25961-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/seq/Kconfig | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/core/seq/Kconfig b/sound/core/seq/Kconfig +index 0374bbf51cd4d..e4f58cb985d47 100644 +--- a/sound/core/seq/Kconfig ++++ b/sound/core/seq/Kconfig +@@ -62,7 +62,7 @@ config SND_SEQ_VIRMIDI + + config SND_SEQ_UMP + bool "Support for UMP events" +- default y if SND_SEQ_UMP_CLIENT ++ default SND_UMP + help + Say Y here to enable the support for handling UMP (Universal MIDI + Packet) events via ALSA sequencer infrastructure, which is an +@@ -71,6 +71,6 @@ config SND_SEQ_UMP + among legacy and UMP clients. + + config SND_SEQ_UMP_CLIENT +- def_tristate SND_UMP ++ def_tristate SND_UMP && SND_SEQ_UMP + + endif # SND_SEQUENCER +-- +2.39.5 + diff --git a/queue-6.12/arm-at91-pm-change-bu-power-switch-to-automatic-mode.patch b/queue-6.12/arm-at91-pm-change-bu-power-switch-to-automatic-mode.patch new file mode 100644 index 0000000000..0496b5262d --- /dev/null +++ b/queue-6.12/arm-at91-pm-change-bu-power-switch-to-automatic-mode.patch @@ -0,0 +1,93 @@ +From b22ee10e2e880c1721d4d396af07dbd246bbf85f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Nov 2024 17:56:48 +0100 +Subject: ARM: at91: pm: change BU Power Switch to automatic mode + +From: Nicolas Ferre + +[ Upstream commit 6fc5bdfa872b7da51b5507a1327a17c3db2fcf95 ] + +Change how the Backup Unit Power is configured and force the +automatic/hardware mode. +This change eliminates the need for software management of the power +switch, ensuring it transitions to the backup power source before +entering low power modes. + +This is done in the only location where this switch was configured. It's +usually done in the bootloader. + +Previously, the loss of the VDDANA (or VDDIN33) power source was not +automatically compensated by an alternative power source. This resulted +in the loss of Backup Unit content, including Backup Self-refresh low +power mode information, OTP emulation configuration, and boot +configuration, for instance. + +Fixes: ac809e7879b1 ("ARM: at91: pm: switch backup area to vbat in backup mode") +Signed-off-by: Nicolas Ferre +Link: https://lore.kernel.org/r/20241125165648.509162-1-nicolas.ferre@microchip.com +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + arch/arm/mach-at91/pm.c | 31 ++++++++++++++++++++----------- + 1 file changed, 20 insertions(+), 11 deletions(-) + +diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c +index b9b995f8a36e1..05a1547642b60 100644 +--- a/arch/arm/mach-at91/pm.c ++++ b/arch/arm/mach-at91/pm.c +@@ -598,7 +598,21 @@ static int at91_suspend_finish(unsigned long val) + return 0; + } + +-static void at91_pm_switch_ba_to_vbat(void) ++/** ++ * at91_pm_switch_ba_to_auto() - Configure Backup Unit Power Switch ++ * to automatic/hardware mode. ++ * ++ * The Backup Unit Power Switch can be managed either by software or hardware. ++ * Enabling hardware mode allows the automatic transition of power between ++ * VDDANA (or VDDIN33) and VDDBU (or VBAT, respectively), based on the ++ * availability of these power sources. ++ * ++ * If the Backup Unit Power Switch is already in automatic mode, no action is ++ * required. If it is in software-controlled mode, it is switched to automatic ++ * mode to enhance safety and eliminate the need for toggling between power ++ * sources. ++ */ ++static void at91_pm_switch_ba_to_auto(void) + { + unsigned int offset = offsetof(struct at91_pm_sfrbu_regs, pswbu); + unsigned int val; +@@ -609,24 +623,19 @@ static void at91_pm_switch_ba_to_vbat(void) + + val = readl(soc_pm.data.sfrbu + offset); + +- /* Already on VBAT. */ +- if (!(val & soc_pm.sfrbu_regs.pswbu.state)) ++ /* Already on auto/hardware. */ ++ if (!(val & soc_pm.sfrbu_regs.pswbu.ctrl)) + return; + +- val &= ~soc_pm.sfrbu_regs.pswbu.softsw; +- val |= soc_pm.sfrbu_regs.pswbu.key | soc_pm.sfrbu_regs.pswbu.ctrl; ++ val &= ~soc_pm.sfrbu_regs.pswbu.ctrl; ++ val |= soc_pm.sfrbu_regs.pswbu.key; + writel(val, soc_pm.data.sfrbu + offset); +- +- /* Wait for update. */ +- val = readl(soc_pm.data.sfrbu + offset); +- while (val & soc_pm.sfrbu_regs.pswbu.state) +- val = readl(soc_pm.data.sfrbu + offset); + } + + static void at91_pm_suspend(suspend_state_t state) + { + if (soc_pm.data.mode == AT91_PM_BACKUP) { +- at91_pm_switch_ba_to_vbat(); ++ at91_pm_switch_ba_to_auto(); + + cpu_suspend(0, at91_suspend_finish); + +-- +2.39.5 + diff --git a/queue-6.12/arm-dts-aspeed-yosemite4-add-required-properties-for.patch b/queue-6.12/arm-dts-aspeed-yosemite4-add-required-properties-for.patch new file mode 100644 index 0000000000..29d2d4f579 --- /dev/null +++ b/queue-6.12/arm-dts-aspeed-yosemite4-add-required-properties-for.patch @@ -0,0 +1,47 @@ +From 134d2203e54cba050af22bb5bfd16fe388654afd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Oct 2024 15:42:45 +0800 +Subject: ARM: dts: aspeed: yosemite4: Add required properties for IOE on fan + boards + +From: Ricky CX Wu + +[ Upstream commit c64ac96f8f8d957cdc6ec3c93dd9a6c4e6d78506 ] + +Add the required properties for IO expander on fan boards. + +Fixes: 2b8d94f4b4a4 ("ARM: dts: aspeed: yosemite4: add Facebook Yosemite 4 BMC") +Signed-off-by: Ricky CX Wu +Signed-off-by: Delphine CC Chiu +Link: https://patch.msgid.link/20241003074251.3818101-5-Delphine_CC_Chiu@wiwynn.com +Signed-off-by: Andrew Jeffery +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-yosemite4.dts | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-yosemite4.dts b/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-yosemite4.dts +index 7ed76cd4fd2d0..331578b24c204 100644 +--- a/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-yosemite4.dts ++++ b/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-yosemite4.dts +@@ -470,6 +470,8 @@ + gpio@22{ + compatible = "ti,tca6424"; + reg = <0x22>; ++ gpio-controller; ++ #gpio-cells = <2>; + }; + + pwm@23{ +@@ -520,6 +522,8 @@ + gpio@22{ + compatible = "ti,tca6424"; + reg = <0x22>; ++ gpio-controller; ++ #gpio-cells = <2>; + }; + + pwm@23{ +-- +2.39.5 + diff --git a/queue-6.12/arm-dts-aspeed-yosemite4-correct-the-compatible-stri.patch b/queue-6.12/arm-dts-aspeed-yosemite4-correct-the-compatible-stri.patch new file mode 100644 index 0000000000..26f16a7dbd --- /dev/null +++ b/queue-6.12/arm-dts-aspeed-yosemite4-correct-the-compatible-stri.patch @@ -0,0 +1,46 @@ +From 4660008f9be4f8825470a085fe71a87dc16f356a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Sep 2024 16:52:13 +0800 +Subject: ARM: dts: aspeed: yosemite4: correct the compatible string of adm1272 + +From: Ricky CX Wu + +[ Upstream commit ece3e20e3389ec8a32944ad44746ee379bf1d3eb ] + +Remove the space in the compatible string of adm1272 to match the +pattern of compatible. + +Fixes: 2b8d94f4b4a4 ("ARM: dts: aspeed: yosemite4: add Facebook Yosemite 4 BMC") +Signed-off-by: Ricky CX Wu +Signed-off-by: Delphine CC Chiu +Fixes: 2b8d94f4b4a4765d ("ARM: dts: aspeed: yosemite4: add Facebook Yosemite 4 BMC") +Reviewed-by: Andrew Jeffery +Link: https://patch.msgid.link/20240927085213.331127-1-Delphine_CC_Chiu@wiwynn.com +Signed-off-by: Andrew Jeffery +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-yosemite4.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-yosemite4.dts b/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-yosemite4.dts +index 98477792aa005..7ed76cd4fd2d0 100644 +--- a/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-yosemite4.dts ++++ b/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-yosemite4.dts +@@ -284,12 +284,12 @@ + &i2c11 { + status = "okay"; + power-sensor@10 { +- compatible = "adi, adm1272"; ++ compatible = "adi,adm1272"; + reg = <0x10>; + }; + + power-sensor@12 { +- compatible = "adi, adm1272"; ++ compatible = "adi,adm1272"; + reg = <0x12>; + }; + +-- +2.39.5 + diff --git a/queue-6.12/arm-dts-aspeed-yosemite4-correct-the-compatible-stri.patch-32371 b/queue-6.12/arm-dts-aspeed-yosemite4-correct-the-compatible-stri.patch-32371 new file mode 100644 index 0000000000..a76e21347f --- /dev/null +++ b/queue-6.12/arm-dts-aspeed-yosemite4-correct-the-compatible-stri.patch-32371 @@ -0,0 +1,77 @@ +From f1fe0743bf21377b7ffd17f7d241cca94e561332 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Oct 2024 15:42:46 +0800 +Subject: ARM: dts: aspeed: yosemite4: correct the compatible string for + max31790 + +From: Ricky CX Wu + +[ Upstream commit b1a1ecb669bfa763ee5e86a038d7c9363eee7548 ] + +Fix the compatible string for max31790 to match the binding document. + +Fixes: 2b8d94f4b4a4 ("ARM: dts: aspeed: yosemite4: add Facebook Yosemite 4 BMC") +Signed-off-by: Ricky CX Wu +Signed-off-by: Delphine CC Chiu +Link: https://patch.msgid.link/20241003074251.3818101-6-Delphine_CC_Chiu@wiwynn.com +Signed-off-by: Andrew Jeffery +Signed-off-by: Sasha Levin +--- + .../dts/aspeed/aspeed-bmc-facebook-yosemite4.dts | 16 ++++------------ + 1 file changed, 4 insertions(+), 12 deletions(-) + +diff --git a/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-yosemite4.dts b/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-yosemite4.dts +index 331578b24c204..14d1751031068 100644 +--- a/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-yosemite4.dts ++++ b/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-yosemite4.dts +@@ -461,10 +461,8 @@ + }; + + pwm@20{ +- compatible = "max31790"; ++ compatible = "maxim,max31790"; + reg = <0x20>; +- #address-cells = <1>; +- #size-cells = <0>; + }; + + gpio@22{ +@@ -475,10 +473,8 @@ + }; + + pwm@23{ +- compatible = "max31790"; ++ compatible = "maxim,max31790"; + reg = <0x23>; +- #address-cells = <1>; +- #size-cells = <0>; + }; + + adc@33 { +@@ -513,10 +509,8 @@ + }; + + pwm@20{ +- compatible = "max31790"; ++ compatible = "maxim,max31790"; + reg = <0x20>; +- #address-cells = <1>; +- #size-cells = <0>; + }; + + gpio@22{ +@@ -527,10 +521,8 @@ + }; + + pwm@23{ +- compatible = "max31790"; ++ compatible = "maxim,max31790"; + reg = <0x23>; +- #address-cells = <1>; +- #size-cells = <0>; + }; + + adc@33 { +-- +2.39.5 + diff --git a/queue-6.12/arm-dts-imx7-tqma7-add-missing-vs-supply-for-lm75a-r.patch b/queue-6.12/arm-dts-imx7-tqma7-add-missing-vs-supply-for-lm75a-r.patch new file mode 100644 index 0000000000..e3dff14dbe --- /dev/null +++ b/queue-6.12/arm-dts-imx7-tqma7-add-missing-vs-supply-for-lm75a-r.patch @@ -0,0 +1,37 @@ +From fe1da669f2a9702876b9a2c578011e4cdb750184 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Nov 2024 14:49:21 +0100 +Subject: ARM: dts: imx7-tqma7: add missing vs-supply for LM75A (rev. 01xxx) + +From: Alexander Stein + +[ Upstream commit 78e08cebfe41a99d12a3a79d3e3be913559182e2 ] + +Add missing supply for LM75. Fixes the kernel warning: + lm75 0-0048: supply vs not found, using dummy regulator + +Fixes: c9d4affbe60a ("ARM: dts: imx: tqma7: add lm75a sensor (rev. 01xxx)") +Signed-off-by: Alexander Stein +Reviewed-by: Markus Niebel +Reviewed-by: Bruno Thomsen +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/nxp/imx/imx7-tqma7.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/nxp/imx/imx7-tqma7.dtsi b/arch/arm/boot/dts/nxp/imx/imx7-tqma7.dtsi +index 028961eb71089..91ca23a66bf3c 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx7-tqma7.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx7-tqma7.dtsi +@@ -135,6 +135,7 @@ + lm75a: temperature-sensor@48 { + compatible = "national,lm75a"; + reg = <0x48>; ++ vs-supply = <&vgen4_reg>; + }; + + /* NXP SE97BTP with temperature sensor + eeprom, TQMa7x 02xx */ +-- +2.39.5 + diff --git a/queue-6.12/arm-dts-mediatek-mt7623-fix-ir-nodename.patch b/queue-6.12/arm-dts-mediatek-mt7623-fix-ir-nodename.patch new file mode 100644 index 0000000000..6d662ce53f --- /dev/null +++ b/queue-6.12/arm-dts-mediatek-mt7623-fix-ir-nodename.patch @@ -0,0 +1,42 @@ +From 008d008d3431915788e3452f9bec0aa5469283bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 11:46:33 +0200 +Subject: ARM: dts: mediatek: mt7623: fix IR nodename +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 90234cf9b37c57201a24b78c217a91a8af774109 ] + +Fix following validation error: +arch/arm/boot/dts/mediatek/mt7623a-rfb-emmc.dtb: cir@10013000: $nodename:0: 'cir@10013000' does not match '^ir(-receiver)?(@[a-f0-9]+)?$' + from schema $id: http://devicetree.org/schemas/media/mediatek,mt7622-cir.yaml# + +Fixes: 91044f38dae7 ("arm: dts: mt7623: add ir nodes to the mt7623.dtsi file") +Cc: linux-media@vger.kernel.org +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20240617094634.23173-1-zajec5@gmail.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/mediatek/mt7623.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/mediatek/mt7623.dtsi b/arch/arm/boot/dts/mediatek/mt7623.dtsi +index 814586abc2979..fd7a89cc337d6 100644 +--- a/arch/arm/boot/dts/mediatek/mt7623.dtsi ++++ b/arch/arm/boot/dts/mediatek/mt7623.dtsi +@@ -308,7 +308,7 @@ + clock-names = "spi", "wrap"; + }; + +- cir: cir@10013000 { ++ cir: ir-receiver@10013000 { + compatible = "mediatek,mt7623-cir"; + reg = <0 0x10013000 0 0x1000>; + interrupts = ; +-- +2.39.5 + diff --git a/queue-6.12/arm-dts-microchip-sama5d27_wlsom1_ek-add-no-1-8-v-pr.patch b/queue-6.12/arm-dts-microchip-sama5d27_wlsom1_ek-add-no-1-8-v-pr.patch new file mode 100644 index 0000000000..892f5f3525 --- /dev/null +++ b/queue-6.12/arm-dts-microchip-sama5d27_wlsom1_ek-add-no-1-8-v-pr.patch @@ -0,0 +1,45 @@ +From 4e43d3c8105c361bad89f7c78c26311ed8f25feb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Nov 2024 18:01:07 +0200 +Subject: ARM: dts: microchip: sama5d27_wlsom1_ek: Add no-1-8-v property to + sdmmc0 node + +From: Cristian Birsan + +[ Upstream commit 4d9e5965df04c0adf260c3009c55d5fe240f7286 ] + +Add no-1-8-v property to sdmmc0 node to keep VDDSDMMC power rail at 3.3V. +This property will stop the LDO regulator from switching to 1.8V when the +MMC core detects an UHS SD Card. VDDSDMMC power rail is used by all the +SDMMC interface pins in GPIO mode (PA0 - PA13). + +On this board, PA10 is used as GPIO to enable the power switch controlling +USB Vbus for the USB Host. The change is needed to fix the PA10 voltage +level to 3.3V instead of 1.8V. + +Fixes: 5d4c3cfb63fe ("ARM: dts: at91: sama5d27_wlsom1: add SAMA5D27 wlsom1 and wlsom1-ek") +Suggested-by: Mihai Sain +Signed-off-by: Cristian Birsan +Tested-by: Andrei Simion +Link: https://lore.kernel.org/r/20241119160107.598411-3-cristian.birsan@microchip.com +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/microchip/at91-sama5d27_wlsom1_ek.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/microchip/at91-sama5d27_wlsom1_ek.dts b/arch/arm/boot/dts/microchip/at91-sama5d27_wlsom1_ek.dts +index 15239834d886e..35a933eec5738 100644 +--- a/arch/arm/boot/dts/microchip/at91-sama5d27_wlsom1_ek.dts ++++ b/arch/arm/boot/dts/microchip/at91-sama5d27_wlsom1_ek.dts +@@ -197,6 +197,7 @@ + + &sdmmc0 { + bus-width = <4>; ++ no-1-8-v; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_sdmmc0_default>; + status = "okay"; +-- +2.39.5 + diff --git a/queue-6.12/arm-dts-microchip-sama5d29_curiosity-add-no-1-8-v-pr.patch b/queue-6.12/arm-dts-microchip-sama5d29_curiosity-add-no-1-8-v-pr.patch new file mode 100644 index 0000000000..482404a57c --- /dev/null +++ b/queue-6.12/arm-dts-microchip-sama5d29_curiosity-add-no-1-8-v-pr.patch @@ -0,0 +1,45 @@ +From 91bd5878e9ce315e13794b43829d883aba63ebc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Nov 2024 18:01:06 +0200 +Subject: ARM: dts: microchip: sama5d29_curiosity: Add no-1-8-v property to + sdmmc0 node + +From: Cristian Birsan + +[ Upstream commit c21c23a0f2e9869676eff0d53fb89e151e14c873 ] + +Add no-1-8-v property to sdmmc0 node to keep VDDSDMMC power rail at 3.3V. +This property will stop the LDO regulator from switching to 1.8V when the +MMC core detects an UHS SD Card. VDDSDMMC power rail is used by all the +SDMMC interface pins in GPIO mode (PA0 - PA13). + +On this board, PA6 is used as GPIO to enable the power switch controlling +USB Vbus for the USB Host. The change is needed to fix the PA6 voltage +level to 3.3V instead of 1.8V. + +Fixes: d85c4229e925 ("ARM: dts: at91: sama5d29_curiosity: Add device tree for sama5d29_curiosity board") +Suggested-by: Mihai Sain +Signed-off-by: Cristian Birsan +Tested-by: Andrei Simion +Link: https://lore.kernel.org/r/20241119160107.598411-2-cristian.birsan@microchip.com +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/microchip/at91-sama5d29_curiosity.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/microchip/at91-sama5d29_curiosity.dts b/arch/arm/boot/dts/microchip/at91-sama5d29_curiosity.dts +index 951a0c97d3c6b..5933840bb8f7e 100644 +--- a/arch/arm/boot/dts/microchip/at91-sama5d29_curiosity.dts ++++ b/arch/arm/boot/dts/microchip/at91-sama5d29_curiosity.dts +@@ -514,6 +514,7 @@ + + &sdmmc0 { + bus-width = <4>; ++ no-1-8-v; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_sdmmc0_default>; + disable-wp; +-- +2.39.5 + diff --git a/queue-6.12/arm-dts-socfpga-use-reset-name-stmmaceth-ocp-instead.patch b/queue-6.12/arm-dts-socfpga-use-reset-name-stmmaceth-ocp-instead.patch new file mode 100644 index 0000000000..a1486e7e06 --- /dev/null +++ b/queue-6.12/arm-dts-socfpga-use-reset-name-stmmaceth-ocp-instead.patch @@ -0,0 +1,104 @@ +From ea1096fb28ac37c99dad73325fd73cb6fcf13d5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Oct 2024 15:59:07 +0100 +Subject: arm: dts: socfpga: use reset-name "stmmaceth-ocp" instead of "ahb" + +From: Mamta Shukla + +[ Upstream commit 62a40a0d5634834790f7166ab592be247390d857 ] + +The ahb reset is deasserted in probe before first register access, while the +stmmacheth-ocp reset needs to be asserted every time before changing the phy +mode in Arria10[1]. + +Changed in Upstream to "ahb"(331085a423b arm64: dts: socfpga: change the +reset-name of "stmmaceth-ocp" to "ahb" ).This change was intended for arm64 +socfpga and it is not applicable to Arria10. + +Further with STMMAC-SELFTEST Driver enabled, ethtool test also FAILS. +$ ethtool -t eth0 +[ 322.946709] socfpga-dwmac ff800000.ethernet eth0: entered promiscuous mode +[ 323.374558] socfpga-dwmac ff800000.ethernet eth0: left promiscuous mode +The test result is FAIL +The test extra info: + 1. MAC Loopback 0 + 2. PHY Loopback -110 + 3. MMC Counters -110 + 4. EEE -95 + 5. Hash Filter MC 0 + 6. Perfect Filter UC -110 + 7. MC Filter -110 + 8. UC Filter 0 + 9. Flow Control -110 +10. RSS -95 +11. VLAN Filtering -95 +12. VLAN Filtering (perf) -95 +13. Double VLAN Filter -95 +14. Double VLAN Filter (perf) -95 +15. Flexible RX Parser -95 +16. SA Insertion (desc) -95 +17. SA Replacement (desc) -95 +18. SA Insertion (reg) -95 +19. SA Replacement (reg) -95 +20. VLAN TX Insertion -95 +21. SVLAN TX Insertion -95 +22. L3 DA Filtering -95 +23. L3 SA Filtering -95 +24. L4 DA TCP Filtering -95 +25. L4 SA TCP Filtering -95 +26. L4 DA UDP Filtering -95 +27. L4 SA UDP Filtering -95 +28. ARP Offload -95 +29. Jumbo Frame -110 +30. Multichannel Jumbo -95 +31. Split Header -95 +32. TBS (ETF Scheduler) -95 + +[ 324.881327] socfpga-dwmac ff800000.ethernet eth0: Link is Down +[ 327.995360] socfpga-dwmac ff800000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx + +Link:[1] https://www.intel.com/content/www/us/en/docs/programmable/683711/21-2/functional-description-of-the-emac.html +Fixes: 331085a423b ("arm64: dts: socfpga: change the reset-name of "stmmaceth-ocp" to "ahb") +Signed-off-by: Mamta Shukla +Tested-by: Ahmad Fatoum +Reviewed-by: Ahmad Fatoum +Signed-off-by: Dinh Nguyen +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/intel/socfpga/socfpga_arria10.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/intel/socfpga/socfpga_arria10.dtsi b/arch/arm/boot/dts/intel/socfpga/socfpga_arria10.dtsi +index 6b6e77596ffa8..b108265e9bde4 100644 +--- a/arch/arm/boot/dts/intel/socfpga/socfpga_arria10.dtsi ++++ b/arch/arm/boot/dts/intel/socfpga/socfpga_arria10.dtsi +@@ -440,7 +440,7 @@ + clocks = <&l4_mp_clk>, <&peri_emac_ptp_clk>; + clock-names = "stmmaceth", "ptp_ref"; + resets = <&rst EMAC0_RESET>, <&rst EMAC0_OCP_RESET>; +- reset-names = "stmmaceth", "ahb"; ++ reset-names = "stmmaceth", "stmmaceth-ocp"; + snps,axi-config = <&socfpga_axi_setup>; + status = "disabled"; + }; +@@ -460,7 +460,7 @@ + clocks = <&l4_mp_clk>, <&peri_emac_ptp_clk>; + clock-names = "stmmaceth", "ptp_ref"; + resets = <&rst EMAC1_RESET>, <&rst EMAC1_OCP_RESET>; +- reset-names = "stmmaceth", "ahb"; ++ reset-names = "stmmaceth", "stmmaceth-ocp"; + snps,axi-config = <&socfpga_axi_setup>; + status = "disabled"; + }; +@@ -480,7 +480,7 @@ + clocks = <&l4_mp_clk>, <&peri_emac_ptp_clk>; + clock-names = "stmmaceth", "ptp_ref"; + resets = <&rst EMAC2_RESET>, <&rst EMAC2_OCP_RESET>; +- reset-names = "stmmaceth", "ahb"; ++ reset-names = "stmmaceth", "stmmaceth-ocp"; + snps,axi-config = <&socfpga_axi_setup>; + status = "disabled"; + }; +-- +2.39.5 + diff --git a/queue-6.12/arm-dts-stm32-deduplicate-serial-aliases-and-chosen-.patch b/queue-6.12/arm-dts-stm32-deduplicate-serial-aliases-and-chosen-.patch new file mode 100644 index 0000000000..713c5d10ee --- /dev/null +++ b/queue-6.12/arm-dts-stm32-deduplicate-serial-aliases-and-chosen-.patch @@ -0,0 +1,113 @@ +From ce907dd51a8f476d4a359e849bd8e8201aed21f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2024 00:29:44 +0100 +Subject: ARM: dts: stm32: Deduplicate serial aliases and chosen node for + STM32MP15xx DHCOM SoM + +From: Marek Vasut + +[ Upstream commit 73317d327123472cb70e9ecbe050310f1d235e93 ] + +Deduplicate /aliases { serialN = ... } and /chosen node into +stm32mp15xx-dhcom-som.dtsi , since the content is identical +on all carrier boards using the STM32MP15xx DHCOM SoM. No +functional change. + +Signed-off-by: Marek Vasut +Reviewed-by: Christoph Niedermaier +Signed-off-by: Alexandre Torgue +Stable-dep-of: 479b8227ffc4 ("ARM: dts: stm32: Swap USART3 and UART8 alias on STM32MP15xx DHCOM SoM") +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/st/stm32mp15xx-dhcom-drc02.dtsi | 12 ------------ + arch/arm/boot/dts/st/stm32mp15xx-dhcom-pdk2.dtsi | 10 ---------- + arch/arm/boot/dts/st/stm32mp15xx-dhcom-picoitx.dtsi | 10 ---------- + arch/arm/boot/dts/st/stm32mp15xx-dhcom-som.dtsi | 7 +++++++ + 4 files changed, 7 insertions(+), 32 deletions(-) + +diff --git a/arch/arm/boot/dts/st/stm32mp15xx-dhcom-drc02.dtsi b/arch/arm/boot/dts/st/stm32mp15xx-dhcom-drc02.dtsi +index bb4f8a0b937f3..abe2dfe706364 100644 +--- a/arch/arm/boot/dts/st/stm32mp15xx-dhcom-drc02.dtsi ++++ b/arch/arm/boot/dts/st/stm32mp15xx-dhcom-drc02.dtsi +@@ -6,18 +6,6 @@ + #include + #include + +-/ { +- aliases { +- serial0 = &uart4; +- serial1 = &usart3; +- serial2 = &uart8; +- }; +- +- chosen { +- stdout-path = "serial0:115200n8"; +- }; +-}; +- + &adc { + status = "disabled"; + }; +diff --git a/arch/arm/boot/dts/st/stm32mp15xx-dhcom-pdk2.dtsi b/arch/arm/boot/dts/st/stm32mp15xx-dhcom-pdk2.dtsi +index 171d7c7658fa8..0fb4e55843b9d 100644 +--- a/arch/arm/boot/dts/st/stm32mp15xx-dhcom-pdk2.dtsi ++++ b/arch/arm/boot/dts/st/stm32mp15xx-dhcom-pdk2.dtsi +@@ -7,16 +7,6 @@ + #include + + / { +- aliases { +- serial0 = &uart4; +- serial1 = &usart3; +- serial2 = &uart8; +- }; +- +- chosen { +- stdout-path = "serial0:115200n8"; +- }; +- + clk_ext_audio_codec: clock-codec { + compatible = "fixed-clock"; + #clock-cells = <0>; +diff --git a/arch/arm/boot/dts/st/stm32mp15xx-dhcom-picoitx.dtsi b/arch/arm/boot/dts/st/stm32mp15xx-dhcom-picoitx.dtsi +index b5bc53accd6b2..01c693cc03446 100644 +--- a/arch/arm/boot/dts/st/stm32mp15xx-dhcom-picoitx.dtsi ++++ b/arch/arm/boot/dts/st/stm32mp15xx-dhcom-picoitx.dtsi +@@ -7,16 +7,6 @@ + #include + + / { +- aliases { +- serial0 = &uart4; +- serial1 = &usart3; +- serial2 = &uart8; +- }; +- +- chosen { +- stdout-path = "serial0:115200n8"; +- }; +- + led { + compatible = "gpio-leds"; + +diff --git a/arch/arm/boot/dts/st/stm32mp15xx-dhcom-som.dtsi b/arch/arm/boot/dts/st/stm32mp15xx-dhcom-som.dtsi +index 74a11ccc5333f..086d3a60ccce2 100644 +--- a/arch/arm/boot/dts/st/stm32mp15xx-dhcom-som.dtsi ++++ b/arch/arm/boot/dts/st/stm32mp15xx-dhcom-som.dtsi +@@ -14,6 +14,13 @@ + ethernet1 = &ksz8851; + rtc0 = &hwrtc; + rtc1 = &rtc; ++ serial0 = &uart4; ++ serial1 = &usart3; ++ serial2 = &uart8; ++ }; ++ ++ chosen { ++ stdout-path = "serial0:115200n8"; + }; + + memory@c0000000 { +-- +2.39.5 + diff --git a/queue-6.12/arm-dts-stm32-fix-ipcc-exti-declaration-on-stm32mp15.patch b/queue-6.12/arm-dts-stm32-fix-ipcc-exti-declaration-on-stm32mp15.patch new file mode 100644 index 0000000000..2f57f0008f --- /dev/null +++ b/queue-6.12/arm-dts-stm32-fix-ipcc-exti-declaration-on-stm32mp15.patch @@ -0,0 +1,44 @@ +From 397ceb46784d5e5856b4212c7aecf1aee9c69368 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 18:17:59 +0100 +Subject: ARM: dts: stm32: Fix IPCC EXTI declaration on stm32mp151 + +From: Arnaud Pouliquen + +[ Upstream commit 4ea654242e0c75bdf6b45d3c619c5fdcb2e9312a ] + +The GIC IRQ type used for IPCC RX should be IRQ_TYPE_LEVEL_HIGH. +Replacing the interrupt with the EXTI event changes the type to +the numeric value 1, meaning IRQ_TYPE_EDGE_RISING. + +The issue is that EXTI event 61 is a direct event.The IRQ type of +direct events is not used by EXTI and is propagated to the parent +IRQ controller of EXTI, the GIC. + +Align the IRQ type to the value expected by the GIC by replacing +the second parameter "1" with IRQ_TYPE_LEVEL_HIGH. + +Fixes: 7d9802bb0e34 ("ARM: dts: stm32: remove the IPCC "wakeup" IRQ on stm32mp151") +Signed-off-by: Arnaud Pouliquen +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/st/stm32mp151.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/st/stm32mp151.dtsi b/arch/arm/boot/dts/st/stm32mp151.dtsi +index 4f878ec102c1f..fdc42a89bd37d 100644 +--- a/arch/arm/boot/dts/st/stm32mp151.dtsi ++++ b/arch/arm/boot/dts/st/stm32mp151.dtsi +@@ -129,7 +129,7 @@ + reg = <0x4c001000 0x400>; + st,proc-id = <0>; + interrupts-extended = +- <&exti 61 1>, ++ <&exti 61 IRQ_TYPE_LEVEL_HIGH>, + <&intc GIC_SPI 101 IRQ_TYPE_LEVEL_HIGH>; + interrupt-names = "rx", "tx"; + clocks = <&rcc IPCC>; +-- +2.39.5 + diff --git a/queue-6.12/arm-dts-stm32-increase-cpu-core-voltage-on-stm32mp13.patch b/queue-6.12/arm-dts-stm32-increase-cpu-core-voltage-on-stm32mp13.patch new file mode 100644 index 0000000000..adcb02a18b --- /dev/null +++ b/queue-6.12/arm-dts-stm32-increase-cpu-core-voltage-on-stm32mp13.patch @@ -0,0 +1,44 @@ +From b261af16c24be9d0c4646e9cca05ad28c2da6f91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2024 23:46:22 +0100 +Subject: ARM: dts: stm32: Increase CPU core voltage on STM32MP13xx DHCOR SoM + +From: Marek Vasut + +[ Upstream commit a4422a9183278162093d4524fdf4b6bbd7dd8a28 ] + +The STM32MP13xx DHCOR DHSBC is populated with STM32MP13xx part capable +of 1 GHz operation, increase the CPU core voltage to 1.35 V to make +sure the SoC is stable even if the blobs unconditionally force the CPU +to 1 GHz operation. + +It is not possible to make use of CPUfreq on the STM32MP13xx because +the SCMI protocol 0x13 is not implemented by upstream OpTee-OS which +is the SCMI provider. + +Fixes: 6331bddce649 ("ARM: dts: stm32: Add support for STM32MP13xx DHCOR SoM and DHSBC board") +Signed-off-by: Marek Vasut +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/st/stm32mp13xx-dhcor-som.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/st/stm32mp13xx-dhcor-som.dtsi b/arch/arm/boot/dts/st/stm32mp13xx-dhcor-som.dtsi +index ddad6497775b8..ffb7233b063d2 100644 +--- a/arch/arm/boot/dts/st/stm32mp13xx-dhcor-som.dtsi ++++ b/arch/arm/boot/dts/st/stm32mp13xx-dhcor-som.dtsi +@@ -85,8 +85,8 @@ + + vddcpu: buck1 { /* VDD_CPU_1V2 */ + regulator-name = "vddcpu"; +- regulator-min-microvolt = <1250000>; +- regulator-max-microvolt = <1250000>; ++ regulator-min-microvolt = <1350000>; ++ regulator-max-microvolt = <1350000>; + regulator-always-on; + regulator-initial-mode = <0>; + regulator-over-current-protection; +-- +2.39.5 + diff --git a/queue-6.12/arm-dts-stm32-swap-usart3-and-uart8-alias-on-stm32mp.patch b/queue-6.12/arm-dts-stm32-swap-usart3-and-uart8-alias-on-stm32mp.patch new file mode 100644 index 0000000000..0f213a677f --- /dev/null +++ b/queue-6.12/arm-dts-stm32-swap-usart3-and-uart8-alias-on-stm32mp.patch @@ -0,0 +1,41 @@ +From 2104a420bec1a031f7daeb7be0e16517dc1008d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Dec 2024 23:36:25 +0100 +Subject: ARM: dts: stm32: Swap USART3 and UART8 alias on STM32MP15xx DHCOM SoM + +From: Marek Vasut + +[ Upstream commit 479b8227ffc433929ba49200182b6383569f9615 ] + +Swap USART3 and UART8 aliases on STM32MP15xx DHCOM SoM, +make sure UART8 is listed first, USART3 second, because +the UART8 is labeled as UART2 on the SoM pinout, while +USART3 is labeled as UART3 on the SoM pinout. + +Fixes: 34e0c7847dcf ("ARM: dts: stm32: Add DH Electronics DHCOM STM32MP1 SoM and PDK2 board") +Signed-off-by: Marek Vasut +Reviewed-by: Christoph Niedermaier +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/st/stm32mp15xx-dhcom-som.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/st/stm32mp15xx-dhcom-som.dtsi b/arch/arm/boot/dts/st/stm32mp15xx-dhcom-som.dtsi +index 086d3a60ccce2..142d4a8731f8d 100644 +--- a/arch/arm/boot/dts/st/stm32mp15xx-dhcom-som.dtsi ++++ b/arch/arm/boot/dts/st/stm32mp15xx-dhcom-som.dtsi +@@ -15,8 +15,8 @@ + rtc0 = &hwrtc; + rtc1 = &rtc; + serial0 = &uart4; +- serial1 = &usart3; +- serial2 = &uart8; ++ serial1 = &uart8; ++ serial2 = &usart3; + }; + + chosen { +-- +2.39.5 + diff --git a/queue-6.12/arm-omap1-fix-up-the-retu-irq-on-nokia-770.patch b/queue-6.12/arm-omap1-fix-up-the-retu-irq-on-nokia-770.patch new file mode 100644 index 0000000000..dec6494e15 --- /dev/null +++ b/queue-6.12/arm-omap1-fix-up-the-retu-irq-on-nokia-770.patch @@ -0,0 +1,38 @@ +From 1a59245de0cfc4a8ce8fa17cc5634ee071e2466a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jan 2025 14:12:15 +0200 +Subject: ARM: omap1: Fix up the Retu IRQ on Nokia 770 + +From: Aaro Koskinen + +[ Upstream commit ad455e48bba7f21bb5108406da0854cf8dede8ea ] + +The Retu IRQ is off by one, as a result the power button does not work. +Fix it. + +Fixes: 084b6f216778 ("ARM: omap1: Fix up the Nokia 770 board device IRQs") +Signed-off-by: Aaro Koskinen +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/Z3UxH_fOzuftjnuX@darkstar.musicnaut.iki.fi +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap1/board-nokia770.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/mach-omap1/board-nokia770.c b/arch/arm/mach-omap1/board-nokia770.c +index 3312ef93355da..a5bf5554800fe 100644 +--- a/arch/arm/mach-omap1/board-nokia770.c ++++ b/arch/arm/mach-omap1/board-nokia770.c +@@ -289,7 +289,7 @@ static struct gpiod_lookup_table nokia770_irq_gpio_table = { + GPIO_LOOKUP("gpio-0-15", 15, "ads7846_irq", + GPIO_ACTIVE_HIGH), + /* GPIO used for retu IRQ */ +- GPIO_LOOKUP("gpio-48-63", 15, "retu_irq", ++ GPIO_LOOKUP("gpio-48-63", 14, "retu_irq", + GPIO_ACTIVE_HIGH), + /* GPIO used for tahvo IRQ */ + GPIO_LOOKUP("gpio-32-47", 8, "tahvo_irq", +-- +2.39.5 + diff --git a/queue-6.12/arm64-defconfig-remove-obsolete-config_sm_dispcc_865.patch b/queue-6.12/arm64-defconfig-remove-obsolete-config_sm_dispcc_865.patch new file mode 100644 index 0000000000..307ca9aa25 --- /dev/null +++ b/queue-6.12/arm64-defconfig-remove-obsolete-config_sm_dispcc_865.patch @@ -0,0 +1,39 @@ +From 3da46547a2046803028a45cb91f6a967a9a70f51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Dec 2024 16:12:58 +0000 +Subject: arm64: defconfig: remove obsolete CONFIG_SM_DISPCC_8650 + +From: Ross Burton + +[ Upstream commit 9be2923ff9641d6491b8ea43791382966505435f ] + +This option was removed from the Kconfig in commit 802b83205519 ("clk: +qcom: fold dispcc-sm8650 info dispcc-sm8550") but it was not removed +from the defconfig. + +Fixes: 802b83205519 ("clk: qcom: fold dispcc-sm8650 info dispcc-sm8550") +Signed-off-by: Ross Burton +Reviewed-by: Krzysztof Kozlowski +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20241213-clkmaster-v1-1-dcbf7fad37b1@arm.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/configs/defconfig | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig +index 5fdbfea7a5b29..8fe7dbae33bf9 100644 +--- a/arch/arm64/configs/defconfig ++++ b/arch/arm64/configs/defconfig +@@ -1347,7 +1347,6 @@ CONFIG_SM_DISPCC_6115=m + CONFIG_SM_DISPCC_8250=y + CONFIG_SM_DISPCC_8450=m + CONFIG_SM_DISPCC_8550=m +-CONFIG_SM_DISPCC_8650=m + CONFIG_SM_GCC_4450=y + CONFIG_SM_GCC_6115=y + CONFIG_SM_GCC_8350=y +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-allwinner-a64-explicitly-assign-clock-pare.patch b/queue-6.12/arm64-dts-allwinner-a64-explicitly-assign-clock-pare.patch new file mode 100644 index 0000000000..37e1d60146 --- /dev/null +++ b/queue-6.12/arm64-dts-allwinner-a64-explicitly-assign-clock-pare.patch @@ -0,0 +1,76 @@ +From 5c6930863ed5c499e4e2fbf4c86a8f90cbdc6421 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jan 2025 23:36:59 -0800 +Subject: arm64: dts: allwinner: a64: explicitly assign clock parent for TCON0 + +From: Vasily Khoruzhick + +[ Upstream commit 8715c91a836502929c637c76a26335ede8818acf ] + +TCON0 seems to need a different clock parent depending on output type. +For RGB it has to be PLL-VIDEO0-2X, while for DSI it has to be PLL-MIPI, +so select it explicitly. + +Video output doesn't work if incorrect clock is assigned. + +On my Pinebook I manually configured PLL-VIDEO0-2X and PLL-MIPI to the same +rate, and while video output works fine with PLL-VIDEO0-2X, it doesn't +work at all (as in no picture) with PLL-MIPI. + +Fixes: ca1170b69968 ("clk: sunxi-ng: a64: force select PLL_MIPI in TCON0 mux") +Reviewed-by: Dragan Simic +Reviewed-by: Chen-Yu Tsai +Tested-by: Frank Oltmanns # on PinePhone +Tested-by: Stuart Gathman # on OG Pinebook +Signed-off-by: Vasily Khoruzhick +Link: https://patch.msgid.link/20250104074035.1611136-4-anarsoul@gmail.com +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts | 2 ++ + arch/arm64/boot/dts/allwinner/sun50i-a64-teres-i.dts | 2 ++ + arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi | 2 ++ + 3 files changed, 6 insertions(+) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts +index 379c2c8466f50..86d44349e0951 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts +@@ -390,6 +390,8 @@ + &tcon0 { + pinctrl-names = "default"; + pinctrl-0 = <&lcd_rgb666_pins>; ++ assigned-clocks = <&ccu CLK_TCON0>; ++ assigned-clock-parents = <&ccu CLK_PLL_VIDEO0_2X>; + + status = "okay"; + }; +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-teres-i.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-teres-i.dts +index b407e1dd08a73..ec055510af8b6 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-teres-i.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-teres-i.dts +@@ -369,6 +369,8 @@ + &tcon0 { + pinctrl-names = "default"; + pinctrl-0 = <&lcd_rgb666_pins>; ++ assigned-clocks = <&ccu CLK_TCON0>; ++ assigned-clock-parents = <&ccu CLK_PLL_VIDEO0_2X>; + + status = "okay"; + }; +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi +index a5c3920e0f048..0fecf0abb204c 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi ++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi +@@ -445,6 +445,8 @@ + clock-names = "ahb", "tcon-ch0"; + clock-output-names = "tcon-data-clock"; + #clock-cells = <0>; ++ assigned-clocks = <&ccu CLK_TCON0>; ++ assigned-clock-parents = <&ccu CLK_PLL_MIPI>; + resets = <&ccu RST_BUS_TCON0>, <&ccu RST_BUS_LVDS>; + reset-names = "lcd", "lvds"; + +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-imx93-use-imx93_clk_spdif_ipg-as-spdif-ipg.patch b/queue-6.12/arm64-dts-imx93-use-imx93_clk_spdif_ipg-as-spdif-ipg.patch new file mode 100644 index 0000000000..efb6a58af4 --- /dev/null +++ b/queue-6.12/arm64-dts-imx93-use-imx93_clk_spdif_ipg-as-spdif-ipg.patch @@ -0,0 +1,41 @@ +From 977c65cfceb5c9cf4e65383b5b631ef93db38e7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Nov 2024 09:58:05 +0800 +Subject: arm64: dts: imx93: Use IMX93_CLK_SPDIF_IPG as SPDIF IPG clock + +From: Shengjiu Wang + +[ Upstream commit 570b890e66334f283710af36feb2115f16c7a27c ] + +IMX93_CLK_BUS_WAKEUP is not accurate IPG clock, which +missed the clock gate part. + +IMX93_CLK_SPDIF_IPG is the correct clock. + +Fixes: 1c4a4f7362fd ("arm64: dts: imx93: Add audio device nodes") +Signed-off-by: Shengjiu Wang +Reviewed-by: Frank Li +Acked-by: Shawn Guo +Link: https://lore.kernel.org/r/20241119015805.3840606-4-shengjiu.wang@nxp.com +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx93.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx93.dtsi b/arch/arm64/boot/dts/freescale/imx93.dtsi +index 04b9b3d31f4fa..7bc3852c6ef8f 100644 +--- a/arch/arm64/boot/dts/freescale/imx93.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx93.dtsi +@@ -917,7 +917,7 @@ + reg-names = "ram", "regs", "rxfifo", "txfifo"; + interrupts = , + ; +- clocks = <&clk IMX93_CLK_BUS_WAKEUP>, ++ clocks = <&clk IMX93_CLK_SPDIF_IPG>, + <&clk IMX93_CLK_SPDIF_GATE>, + <&clk IMX93_CLK_DUMMY>, + <&clk IMX93_CLK_AUD_XCVR_GATE>; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-marvell-cn9131-cf-solidwan-fix-cp1-comphy-.patch b/queue-6.12/arm64-dts-marvell-cn9131-cf-solidwan-fix-cp1-comphy-.patch new file mode 100644 index 0000000000..53df76162e --- /dev/null +++ b/queue-6.12/arm64-dts-marvell-cn9131-cf-solidwan-fix-cp1-comphy-.patch @@ -0,0 +1,54 @@ +From 1b67cf389e9f87f5184e1c7aa813b4600e246f79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Nov 2024 18:33:08 +0100 +Subject: arm64: dts: marvell: cn9131-cf-solidwan: fix cp1 comphy links + +From: Josua Mayer + +[ Upstream commit 09cdb973afa7a18ce8e66807daff94609cc4b8a4 ] + +Marvell CN913x platforms use common phy framework for configuring and +linking serdes lanes according to their usage. +Each CP (X) features 5 serdes lanes (Y) represented by cpX_comphyY +nodes. + +CN9131 SolidWAN uses CP1 serdes lanes 3 and 5 for eth1 and eth2 of CP1 +respectively. Devicetree however wrongly links from these ports to the +comphy of CP0. + +Replace the wrong links to cp0_comphy with cp1_comphy inside cp1_eth1, +cp1_eth2. + +Fixes: 1280840d2030 ("arm64: dts: add description for solidrun cn9131 solidwan board") +Signed-off-by: Josua Mayer +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/marvell/cn9131-cf-solidwan.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/marvell/cn9131-cf-solidwan.dts b/arch/arm64/boot/dts/marvell/cn9131-cf-solidwan.dts +index b1ea7dcaed17d..47234d0858dd2 100644 +--- a/arch/arm64/boot/dts/marvell/cn9131-cf-solidwan.dts ++++ b/arch/arm64/boot/dts/marvell/cn9131-cf-solidwan.dts +@@ -435,7 +435,7 @@ + managed = "in-band-status"; + phy-mode = "sgmii"; + phy = <&cp1_phy0>; +- phys = <&cp0_comphy3 1>; ++ phys = <&cp1_comphy3 1>; + status = "okay"; + }; + +@@ -444,7 +444,7 @@ + managed = "in-band-status"; + phy-mode = "sgmii"; + phy = <&cp1_phy1>; +- phys = <&cp0_comphy5 2>; ++ phys = <&cp1_comphy5 2>; + status = "okay"; + }; + +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-medaitek-mt8395-nio-12l-drop-regulator-com.patch b/queue-6.12/arm64-dts-medaitek-mt8395-nio-12l-drop-regulator-com.patch new file mode 100644 index 0000000000..db465c0b36 --- /dev/null +++ b/queue-6.12/arm64-dts-medaitek-mt8395-nio-12l-drop-regulator-com.patch @@ -0,0 +1,53 @@ +From 1115297d1e4718c41c773152b52face0a2a6a235 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 13:24:25 +0800 +Subject: arm64: dts: medaitek: mt8395-nio-12l: Drop regulator-compatible + property + +From: Chen-Yu Tsai + +[ Upstream commit ab60442f26b15ba69b210974722a851ed03188ff ] + +The "regulator-compatible" property has been deprecated since 2012 in +commit 13511def87b9 ("regulator: deprecate regulator-compatible DT +property"), which is so old it's not even mentioned in the converted +regulator bindings YAML file. It should not have been used for new +submissions such as the MT6315. + +Drop the "regulator-compatible" property from the board dts. The +property values are the same as the node name, so everything should +continue to work. + +Fixes: 96564b1e2ea4 ("arm64: dts: mediatek: Introduce the MT8395 Radxa NIO 12L board") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20241211052427.4178367-8-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8395-radxa-nio-12l.dts | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8395-radxa-nio-12l.dts b/arch/arm64/boot/dts/mediatek/mt8395-radxa-nio-12l.dts +index 14ec970c4e491..41dc34837b02e 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8395-radxa-nio-12l.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8395-radxa-nio-12l.dts +@@ -812,7 +812,6 @@ + + regulators { + mt6315_6_vbuck1: vbuck1 { +- regulator-compatible = "vbuck1"; + regulator-name = "Vbcpu"; + regulator-min-microvolt = <300000>; + regulator-max-microvolt = <1193750>; +@@ -829,7 +828,6 @@ + + regulators { + mt6315_7_vbuck1: vbuck1 { +- regulator-compatible = "vbuck1"; + regulator-name = "Vgpu"; + regulator-min-microvolt = <300000>; + regulator-max-microvolt = <1193750>; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-mediatek-add-per-soc-compatibles-for-keypa.patch b/queue-6.12/arm64-dts-mediatek-add-per-soc-compatibles-for-keypa.patch new file mode 100644 index 0000000000..a20c75583e --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-add-per-soc-compatibles-for-keypa.patch @@ -0,0 +1,56 @@ +From cadc7ec1150fd3019253a133193746ef2f5fb65a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Dec 2024 16:26:20 -0300 +Subject: arm64: dts: mediatek: add per-SoC compatibles for keypad nodes + +From: Val Packett + +[ Upstream commit 6139d9e9e397dc9711cf10f8f548a8f9da3b5323 ] + +The mt6779-keypad binding specifies using a compatible for the +actual SoC before the generic MT6779 one. + +Fixes: a8013418d35c ("arm64: dts: mediatek: mt8183: add keyboard node") +Fixes: 6ff945376556 ("arm64: dts: mediatek: Initial mt8365-evk support") +Signed-off-by: Val Packett +Reviewed-by: Mattijs Korpershoek +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20241225192631.25017-3-val@packett.cool +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8183.dtsi | 3 ++- + arch/arm64/boot/dts/mediatek/mt8365.dtsi | 3 ++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183.dtsi b/arch/arm64/boot/dts/mediatek/mt8183.dtsi +index 0a6578aacf828..9cd5e0cef02a2 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi +@@ -1024,7 +1024,8 @@ + }; + + keyboard: keyboard@10010000 { +- compatible = "mediatek,mt6779-keypad"; ++ compatible = "mediatek,mt8183-keypad", ++ "mediatek,mt6779-keypad"; + reg = <0 0x10010000 0 0x1000>; + interrupts = ; + clocks = <&clk26m>; +diff --git a/arch/arm64/boot/dts/mediatek/mt8365.dtsi b/arch/arm64/boot/dts/mediatek/mt8365.dtsi +index 9c91fe8ea0f96..2bf8c9d02b6ee 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8365.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8365.dtsi +@@ -449,7 +449,8 @@ + }; + + keypad: keypad@10010000 { +- compatible = "mediatek,mt6779-keypad"; ++ compatible = "mediatek,mt8365-keypad", ++ "mediatek,mt6779-keypad"; + reg = <0 0x10010000 0 0x1000>; + wakeup-source; + interrupts = ; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-mediatek-mt7988-add-missing-clock-div-prop.patch b/queue-6.12/arm64-dts-mediatek-mt7988-add-missing-clock-div-prop.patch new file mode 100644 index 0000000000..047365d38a --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-mt7988-add-missing-clock-div-prop.patch @@ -0,0 +1,52 @@ +From decb9120a90d88b88aab819d0d2bd0d2ee21c0a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Dec 2024 10:12:19 +0100 +Subject: arm64: dts: mediatek: mt7988: Add missing clock-div property for i2c + +From: Frank Wunderlich + +[ Upstream commit e14b49db0087aa5d72f736d7306220ff2e3777f5 ] + +I2C binding requires clock-div property. + +Signed-off-by: Frank Wunderlich +Fixes: 660c230bf302 ("arm64: dts: mediatek: mt7988: add I2C controllers") +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20241217091238.16032-6-linux@fw-web.de +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7988a.dtsi | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7988a.dtsi b/arch/arm64/boot/dts/mediatek/mt7988a.dtsi +index aa728331e876b..284e240b79977 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7988a.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7988a.dtsi +@@ -129,6 +129,7 @@ + reg = <0 0x11003000 0 0x1000>, + <0 0x10217080 0 0x80>; + interrupts = ; ++ clock-div = <1>; + clocks = <&infracfg CLK_INFRA_I2C_BCK>, + <&infracfg CLK_INFRA_66M_AP_DMA_BCK>; + clock-names = "main", "dma"; +@@ -142,6 +143,7 @@ + reg = <0 0x11004000 0 0x1000>, + <0 0x10217100 0 0x80>; + interrupts = ; ++ clock-div = <1>; + clocks = <&infracfg CLK_INFRA_I2C_BCK>, + <&infracfg CLK_INFRA_66M_AP_DMA_BCK>; + clock-names = "main", "dma"; +@@ -155,6 +157,7 @@ + reg = <0 0x11005000 0 0x1000>, + <0 0x10217180 0 0x80>; + interrupts = ; ++ clock-div = <1>; + clocks = <&infracfg CLK_INFRA_I2C_BCK>, + <&infracfg CLK_INFRA_66M_AP_DMA_BCK>; + clock-names = "main", "dma"; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-mediatek-mt8173-elm-drop-regulator-compati.patch b/queue-6.12/arm64-dts-mediatek-mt8173-elm-drop-regulator-compati.patch new file mode 100644 index 0000000000..d2e269c492 --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-mt8173-elm-drop-regulator-compati.patch @@ -0,0 +1,213 @@ +From e987d53962d73ddcf289dfdbbd8291150f21973f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 13:24:21 +0800 +Subject: arm64: dts: mediatek: mt8173-elm: Drop regulator-compatible property + +From: Chen-Yu Tsai + +[ Upstream commit 4b907b3ea5fba240808136cc5599d14b52230b39 ] + +The "regulator-compatible" property has been deprecated since 2012 in +commit 13511def87b9 ("regulator: deprecate regulator-compatible DT +property"), which is so old it's not even mentioned in the converted +regulator bindings YAML file. It is also not listed in the MT6397 +regulator bindings. Having them present produces a whole bunch of +validation errors: + + Unevaluated properties are not allowed ('regulator-compatible' was unexpected) + +Drop the "regulator-compatible" property from the board dts. The +property values are the same as the node name, so everything should +continue to work. + +Fixes: 689b937bedde ("arm64: dts: mediatek: add mt8173 elm and hana board") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20241211052427.4178367-4-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi | 23 -------------------- + 1 file changed, 23 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi b/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi +index b4d85147b77b0..dfa2e9ec6b33f 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi +@@ -946,7 +946,6 @@ + compatible = "mediatek,mt6397-regulator"; + + mt6397_vpca15_reg: buck_vpca15 { +- regulator-compatible = "buck_vpca15"; + regulator-name = "vpca15"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -956,7 +955,6 @@ + }; + + mt6397_vpca7_reg: buck_vpca7 { +- regulator-compatible = "buck_vpca7"; + regulator-name = "vpca7"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -966,7 +964,6 @@ + }; + + mt6397_vsramca15_reg: buck_vsramca15 { +- regulator-compatible = "buck_vsramca15"; + regulator-name = "vsramca15"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -975,7 +972,6 @@ + }; + + mt6397_vsramca7_reg: buck_vsramca7 { +- regulator-compatible = "buck_vsramca7"; + regulator-name = "vsramca7"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -984,7 +980,6 @@ + }; + + mt6397_vcore_reg: buck_vcore { +- regulator-compatible = "buck_vcore"; + regulator-name = "vcore"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -993,7 +988,6 @@ + }; + + mt6397_vgpu_reg: buck_vgpu { +- regulator-compatible = "buck_vgpu"; + regulator-name = "vgpu"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -1002,7 +996,6 @@ + }; + + mt6397_vdrm_reg: buck_vdrm { +- regulator-compatible = "buck_vdrm"; + regulator-name = "vdrm"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <1400000>; +@@ -1011,7 +1004,6 @@ + }; + + mt6397_vio18_reg: buck_vio18 { +- regulator-compatible = "buck_vio18"; + regulator-name = "vio18"; + regulator-min-microvolt = <1620000>; + regulator-max-microvolt = <1980000>; +@@ -1020,18 +1012,15 @@ + }; + + mt6397_vtcxo_reg: ldo_vtcxo { +- regulator-compatible = "ldo_vtcxo"; + regulator-name = "vtcxo"; + regulator-always-on; + }; + + mt6397_va28_reg: ldo_va28 { +- regulator-compatible = "ldo_va28"; + regulator-name = "va28"; + }; + + mt6397_vcama_reg: ldo_vcama { +- regulator-compatible = "ldo_vcama"; + regulator-name = "vcama"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; +@@ -1039,18 +1028,15 @@ + }; + + mt6397_vio28_reg: ldo_vio28 { +- regulator-compatible = "ldo_vio28"; + regulator-name = "vio28"; + regulator-always-on; + }; + + mt6397_vusb_reg: ldo_vusb { +- regulator-compatible = "ldo_vusb"; + regulator-name = "vusb"; + }; + + mt6397_vmc_reg: ldo_vmc { +- regulator-compatible = "ldo_vmc"; + regulator-name = "vmc"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <3300000>; +@@ -1058,7 +1044,6 @@ + }; + + mt6397_vmch_reg: ldo_vmch { +- regulator-compatible = "ldo_vmch"; + regulator-name = "vmch"; + regulator-min-microvolt = <3000000>; + regulator-max-microvolt = <3300000>; +@@ -1066,7 +1051,6 @@ + }; + + mt6397_vemc_3v3_reg: ldo_vemc3v3 { +- regulator-compatible = "ldo_vemc3v3"; + regulator-name = "vemc_3v3"; + regulator-min-microvolt = <3000000>; + regulator-max-microvolt = <3300000>; +@@ -1074,7 +1058,6 @@ + }; + + mt6397_vgp1_reg: ldo_vgp1 { +- regulator-compatible = "ldo_vgp1"; + regulator-name = "vcamd"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; +@@ -1082,7 +1065,6 @@ + }; + + mt6397_vgp2_reg: ldo_vgp2 { +- regulator-compatible = "ldo_vgp2"; + regulator-name = "vcamio"; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; +@@ -1090,7 +1072,6 @@ + }; + + mt6397_vgp3_reg: ldo_vgp3 { +- regulator-compatible = "ldo_vgp3"; + regulator-name = "vcamaf"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; +@@ -1098,7 +1079,6 @@ + }; + + mt6397_vgp4_reg: ldo_vgp4 { +- regulator-compatible = "ldo_vgp4"; + regulator-name = "vgp4"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3300000>; +@@ -1106,7 +1086,6 @@ + }; + + mt6397_vgp5_reg: ldo_vgp5 { +- regulator-compatible = "ldo_vgp5"; + regulator-name = "vgp5"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3000000>; +@@ -1114,7 +1093,6 @@ + }; + + mt6397_vgp6_reg: ldo_vgp6 { +- regulator-compatible = "ldo_vgp6"; + regulator-name = "vgp6"; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; +@@ -1123,7 +1101,6 @@ + }; + + mt6397_vibr_reg: ldo_vibr { +- regulator-compatible = "ldo_vibr"; + regulator-name = "vibr"; + regulator-min-microvolt = <1300000>; + regulator-max-microvolt = <3300000>; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-mediatek-mt8173-elm-fix-mt6397-pmic-sub-no.patch b/queue-6.12/arm64-dts-mediatek-mt8173-elm-fix-mt6397-pmic-sub-no.patch new file mode 100644 index 0000000000..b62874184c --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-mt8173-elm-fix-mt6397-pmic-sub-no.patch @@ -0,0 +1,58 @@ +From 52ce74c655cf38bc6e96bf4556400b5e8efed1fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 17:26:12 +0800 +Subject: arm64: dts: mediatek: mt8173-elm: Fix MT6397 PMIC sub-node names + +From: Chen-Yu Tsai + +[ Upstream commit beb06b727194f68b0a4b5183e50c88265ce185af ] + +The MT6397 PMIC bindings specify exact names for its sub-nodes. The +names used in the current dts don't match, causing a validation error. + +Fix up the names. Also drop the label for the regulators node, since +any reference should be against the individual regulator sub-nodes. + +Fixes: 689b937bedde ("arm64: dts: mediatek: add mt8173 elm and hana board") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20241210092614.3951748-1-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi b/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi +index dfa2e9ec6b33f..309e2d104fdc9 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi +@@ -931,7 +931,7 @@ + interrupt-controller; + #interrupt-cells = <2>; + +- clock: mt6397clock { ++ clock: clocks { + compatible = "mediatek,mt6397-clk"; + #clock-cells = <1>; + }; +@@ -942,7 +942,7 @@ + #gpio-cells = <2>; + }; + +- regulator: mt6397regulator { ++ regulators { + compatible = "mediatek,mt6397-regulator"; + + mt6397_vpca15_reg: buck_vpca15 { +@@ -1108,7 +1108,7 @@ + }; + }; + +- rtc: mt6397rtc { ++ rtc: rtc { + compatible = "mediatek,mt6397-rtc"; + }; + }; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-mediatek-mt8173-evb-drop-regulator-compati.patch b/queue-6.12/arm64-dts-mediatek-mt8173-evb-drop-regulator-compati.patch new file mode 100644 index 0000000000..24b5c5e411 --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-mt8173-evb-drop-regulator-compati.patch @@ -0,0 +1,214 @@ +From cc4cedccdd9b94da323870ad121f7102821d1ee5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 13:24:20 +0800 +Subject: arm64: dts: mediatek: mt8173-evb: Drop regulator-compatible property + +From: Chen-Yu Tsai + +[ Upstream commit a6d5983e40f5d5b219337569cdd269727f5a3e2e ] + +The "regulator-compatible" property has been deprecated since 2012 in +commit 13511def87b9 ("regulator: deprecate regulator-compatible DT +property"), which is so old it's not even mentioned in the converted +regulator bindings YAML file. It is also not listed in the MT6397 +regulator bindings. Having them present produces a whole bunch of +validation errors: + + Unevaluated properties are not allowed ('regulator-compatible' was unexpected) + +Drop the "regulator-compatible" property from the board dts. The +property values are the same as the node name, so everything should +continue to work. + +Fixes: 16ea61fc5614 ("arm64: dts: mt8173-evb: Add PMIC support") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20241211052427.4178367-3-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8173-evb.dts | 23 --------------------- + 1 file changed, 23 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts +index bb4671c18e3bd..511c16cb1d59c 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts +@@ -311,7 +311,6 @@ + compatible = "mediatek,mt6397-regulator"; + + mt6397_vpca15_reg: buck_vpca15 { +- regulator-compatible = "buck_vpca15"; + regulator-name = "vpca15"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -320,7 +319,6 @@ + }; + + mt6397_vpca7_reg: buck_vpca7 { +- regulator-compatible = "buck_vpca7"; + regulator-name = "vpca7"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -329,7 +327,6 @@ + }; + + mt6397_vsramca15_reg: buck_vsramca15 { +- regulator-compatible = "buck_vsramca15"; + regulator-name = "vsramca15"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -338,7 +335,6 @@ + }; + + mt6397_vsramca7_reg: buck_vsramca7 { +- regulator-compatible = "buck_vsramca7"; + regulator-name = "vsramca7"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -347,7 +343,6 @@ + }; + + mt6397_vcore_reg: buck_vcore { +- regulator-compatible = "buck_vcore"; + regulator-name = "vcore"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -356,7 +351,6 @@ + }; + + mt6397_vgpu_reg: buck_vgpu { +- regulator-compatible = "buck_vgpu"; + regulator-name = "vgpu"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -365,7 +359,6 @@ + }; + + mt6397_vdrm_reg: buck_vdrm { +- regulator-compatible = "buck_vdrm"; + regulator-name = "vdrm"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <1400000>; +@@ -374,7 +367,6 @@ + }; + + mt6397_vio18_reg: buck_vio18 { +- regulator-compatible = "buck_vio18"; + regulator-name = "vio18"; + regulator-min-microvolt = <1620000>; + regulator-max-microvolt = <1980000>; +@@ -383,19 +375,16 @@ + }; + + mt6397_vtcxo_reg: ldo_vtcxo { +- regulator-compatible = "ldo_vtcxo"; + regulator-name = "vtcxo"; + regulator-always-on; + }; + + mt6397_va28_reg: ldo_va28 { +- regulator-compatible = "ldo_va28"; + regulator-name = "va28"; + regulator-always-on; + }; + + mt6397_vcama_reg: ldo_vcama { +- regulator-compatible = "ldo_vcama"; + regulator-name = "vcama"; + regulator-min-microvolt = <1500000>; + regulator-max-microvolt = <2800000>; +@@ -403,18 +392,15 @@ + }; + + mt6397_vio28_reg: ldo_vio28 { +- regulator-compatible = "ldo_vio28"; + regulator-name = "vio28"; + regulator-always-on; + }; + + mt6397_vusb_reg: ldo_vusb { +- regulator-compatible = "ldo_vusb"; + regulator-name = "vusb"; + }; + + mt6397_vmc_reg: ldo_vmc { +- regulator-compatible = "ldo_vmc"; + regulator-name = "vmc"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <3300000>; +@@ -422,7 +408,6 @@ + }; + + mt6397_vmch_reg: ldo_vmch { +- regulator-compatible = "ldo_vmch"; + regulator-name = "vmch"; + regulator-min-microvolt = <3000000>; + regulator-max-microvolt = <3300000>; +@@ -430,7 +415,6 @@ + }; + + mt6397_vemc_3v3_reg: ldo_vemc3v3 { +- regulator-compatible = "ldo_vemc3v3"; + regulator-name = "vemc_3v3"; + regulator-min-microvolt = <3000000>; + regulator-max-microvolt = <3300000>; +@@ -438,7 +422,6 @@ + }; + + mt6397_vgp1_reg: ldo_vgp1 { +- regulator-compatible = "ldo_vgp1"; + regulator-name = "vcamd"; + regulator-min-microvolt = <1220000>; + regulator-max-microvolt = <3300000>; +@@ -446,7 +429,6 @@ + }; + + mt6397_vgp2_reg: ldo_vgp2 { +- regulator-compatible = "ldo_vgp2"; + regulator-name = "vcamio"; + regulator-min-microvolt = <1000000>; + regulator-max-microvolt = <3300000>; +@@ -454,7 +436,6 @@ + }; + + mt6397_vgp3_reg: ldo_vgp3 { +- regulator-compatible = "ldo_vgp3"; + regulator-name = "vcamaf"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3300000>; +@@ -462,7 +443,6 @@ + }; + + mt6397_vgp4_reg: ldo_vgp4 { +- regulator-compatible = "ldo_vgp4"; + regulator-name = "vgp4"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3300000>; +@@ -470,7 +450,6 @@ + }; + + mt6397_vgp5_reg: ldo_vgp5 { +- regulator-compatible = "ldo_vgp5"; + regulator-name = "vgp5"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3000000>; +@@ -478,7 +457,6 @@ + }; + + mt6397_vgp6_reg: ldo_vgp6 { +- regulator-compatible = "ldo_vgp6"; + regulator-name = "vgp6"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3300000>; +@@ -486,7 +464,6 @@ + }; + + mt6397_vibr_reg: ldo_vibr { +- regulator-compatible = "ldo_vibr"; + regulator-name = "vibr"; + regulator-min-microvolt = <1300000>; + regulator-max-microvolt = <3300000>; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-mediatek-mt8173-evb-fix-mt6397-pmic-sub-no.patch b/queue-6.12/arm64-dts-mediatek-mt8173-evb-fix-mt6397-pmic-sub-no.patch new file mode 100644 index 0000000000..e28e996871 --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-mt8173-evb-fix-mt6397-pmic-sub-no.patch @@ -0,0 +1,40 @@ +From 65c4655554164bbbfdf54d91f33089b54f698b09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 17:26:13 +0800 +Subject: arm64: dts: mediatek: mt8173-evb: Fix MT6397 PMIC sub-node names + +From: Chen-Yu Tsai + +[ Upstream commit 9545ba142865b9099d43c972b9ebcf463606499a ] + +The MT6397 PMIC bindings specify exact names for its sub-nodes. The +names used in the current dts don't match, causing a validation error. + +Fix up the names. Also drop the label for the regulators node, since +any reference should be against the individual regulator sub-nodes. + +Fixes: 16ea61fc5614 ("arm64: dts: mt8173-evb: Add PMIC support") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20241210092614.3951748-2-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8173-evb.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts +index 511c16cb1d59c..9fffed0ef4bff 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts +@@ -307,7 +307,7 @@ + interrupt-controller; + #interrupt-cells = <2>; + +- mt6397regulator: mt6397regulator { ++ regulators { + compatible = "mediatek,mt6397-regulator"; + + mt6397_vpca15_reg: buck_vpca15 { +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-mediatek-mt8183-kenzo-support-second-sourc.patch b/queue-6.12/arm64-dts-mediatek-mt8183-kenzo-support-second-sourc.patch new file mode 100644 index 0000000000..45dd47f7cb --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-mt8183-kenzo-support-second-sourc.patch @@ -0,0 +1,47 @@ +From 223da2ecccfa7d132f0167f620c86371d02ddaa8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Dec 2024 05:27:47 +0000 +Subject: arm64: dts: mediatek: mt8183: kenzo: Support second source + touchscreen + +From: Hsin-Te Yuan + +[ Upstream commit 5ec5dc73c5ac0c6e06803dc3b5aea4493e856568 ] + +Some kenzo devices use second source touchscreen. + +Fixes: 0a9cefe21aec ("arm64: dts: mt8183: Add kukui-jacuzzi-kenzo board") +Signed-off-by: Hsin-Te Yuan +Link: https://lore.kernel.org/r/20241213-touchscreen-v3-1-7c1f670913f9@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + .../dts/mediatek/mt8183-kukui-jacuzzi-kenzo.dts | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-kenzo.dts b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-kenzo.dts +index e8241587949b2..561770fcf69e6 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-kenzo.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-kenzo.dts +@@ -12,3 +12,18 @@ + chassis-type = "laptop"; + compatible = "google,juniper-sku17", "google,juniper", "mediatek,mt8183"; + }; ++ ++&i2c0 { ++ touchscreen@40 { ++ compatible = "hid-over-i2c"; ++ reg = <0x40>; ++ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&touchscreen_pins>; ++ ++ interrupts-extended = <&pio 155 IRQ_TYPE_LEVEL_LOW>; ++ ++ post-power-on-delay-ms = <70>; ++ hid-descr-addr = <0x0001>; ++ }; ++}; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-mediatek-mt8183-kukui-jacuzzi-drop-pp3300_.patch b/queue-6.12/arm64-dts-mediatek-mt8183-kukui-jacuzzi-drop-pp3300_.patch new file mode 100644 index 0000000000..3459b8af74 --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-mt8183-kukui-jacuzzi-drop-pp3300_.patch @@ -0,0 +1,41 @@ +From 50cbd5c3679055d35f0aa3d4f3f7d34f25c816e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Oct 2024 15:02:20 +0800 +Subject: arm64: dts: mediatek: mt8183-kukui-jacuzzi: Drop pp3300_panel voltage + settings + +From: Chen-Yu Tsai + +[ Upstream commit 0b5b1c881a909f17c05ef4b1ccb421e077f6e466 ] + +The pp3300_panel fixed regulator is just a load switch. It does not have +any regulating capabilities. Thus having voltage constraints on it is +wrong. + +Remove the voltage constraints. + +Fixes: cabc71b08eb5 ("arm64: dts: mt8183: Add kukui-jacuzzi-damu board") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20241030070224.1006331-2-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi +index 49e053b932e76..80888bd4ad823 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi +@@ -39,8 +39,6 @@ + pp3300_panel: pp3300-panel { + compatible = "regulator-fixed"; + regulator-name = "pp3300_panel"; +- regulator-min-microvolt = <3300000>; +- regulator-max-microvolt = <3300000>; + pinctrl-names = "default"; + pinctrl-0 = <&pp3300_panel_pins>; + +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-mediatek-mt8183-willow-support-second-sour.patch b/queue-6.12/arm64-dts-mediatek-mt8183-willow-support-second-sour.patch new file mode 100644 index 0000000000..54ab646186 --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-mt8183-willow-support-second-sour.patch @@ -0,0 +1,50 @@ +From b3837e2c762163fe3c47c8992ca898666e50a3be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Dec 2024 05:27:48 +0000 +Subject: arm64: dts: mediatek: mt8183: willow: Support second source + touchscreen + +From: Hsin-Te Yuan + +[ Upstream commit 9594935260d76bffe200bea6cfab6ba0752e70d9 ] + +Some willow devices use second source touchscreen. + +Fixes: f006bcf1c972 ("arm64: dts: mt8183: Add kukui-jacuzzi-willow board") +Signed-off-by: Hsin-Te Yuan +Link: https://lore.kernel.org/r/20241213-touchscreen-v3-2-7c1f670913f9@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + .../dts/mediatek/mt8183-kukui-jacuzzi-willow.dtsi | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-willow.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-willow.dtsi +index 76d33540166f9..c942e461a177e 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-willow.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-willow.dtsi +@@ -6,6 +6,21 @@ + /dts-v1/; + #include "mt8183-kukui-jacuzzi.dtsi" + ++&i2c0 { ++ touchscreen@40 { ++ compatible = "hid-over-i2c"; ++ reg = <0x40>; ++ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&touchscreen_pins>; ++ ++ interrupts-extended = <&pio 155 IRQ_TYPE_LEVEL_LOW>; ++ ++ post-power-on-delay-ms = <70>; ++ hid-descr-addr = <0x0001>; ++ }; ++}; ++ + &i2c2 { + trackpad@2c { + compatible = "hid-over-i2c"; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-mediatek-mt8186-move-wakeup-to-mtu3-to-get.patch b/queue-6.12/arm64-dts-mediatek-mt8186-move-wakeup-to-mtu3-to-get.patch new file mode 100644 index 0000000000..5c5cc9916d --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-mt8186-move-wakeup-to-mtu3-to-get.patch @@ -0,0 +1,83 @@ +From 263e9ffcf888756de8be4d5d90fe8a24fc50a585 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2024 16:01:45 -0500 +Subject: arm64: dts: mediatek: mt8186: Move wakeup to MTU3 to get working + suspend +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 253b4e96f5783fddede1b82274a7b4e0aa57d761 ] + +The current DT has the wakeup-source and mediatek,syscon-wakeup +properties in the XHCI nodes, which configures USB wakeup after powering +down the XHCI hardware block. However, since the XHCI controller is +behind an MTU3 (USB3 DRD controller), the MTU3 only gets powered down +after USB wakeup has been configured, causing the system to detect a +wakeup, and results in broken suspend support as the system resumes +immediately. + +Move the wakeup properties to the MTU3 nodes so that USB wakeup is only +enabled after the MTU3 has powered down. + +With this change in place, it is possible to suspend and resume, and +also to wakeup through USB, as tested on the Google Steelix (Lenovo 300e +Yoga Chromebook Gen 4). + +Fixes: f6c3e61c5486 ("arm64: dts: mediatek: mt8186: Add MTU3 nodes") +Reported-by: Wojciech Macek +Suggested-by: AngeloGioacchino Del Regno +Signed-off-by: Nícolas F. R. A. Prado +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20241106-mt8186-suspend-with-usb-wakeup-v1-1-07734a4c8236@collabora.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8186.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8186.dtsi b/arch/arm64/boot/dts/mediatek/mt8186.dtsi +index 148c332018b0d..ac34ba3afacb0 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8186.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8186.dtsi +@@ -1570,6 +1570,8 @@ + #address-cells = <2>; + #size-cells = <2>; + ranges; ++ wakeup-source; ++ mediatek,syscon-wakeup = <&pericfg 0x420 2>; + status = "disabled"; + + usb_host0: usb@11200000 { +@@ -1583,8 +1585,6 @@ + <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_XHCI>; + clock-names = "sys_ck", "ref_ck", "mcu_ck", "dma_ck", "xhci_ck"; + interrupts = ; +- mediatek,syscon-wakeup = <&pericfg 0x420 2>; +- wakeup-source; + status = "disabled"; + }; + }; +@@ -1636,6 +1636,8 @@ + #address-cells = <2>; + #size-cells = <2>; + ranges; ++ wakeup-source; ++ mediatek,syscon-wakeup = <&pericfg 0x424 2>; + status = "disabled"; + + usb_host1: usb@11280000 { +@@ -1649,8 +1651,6 @@ + <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_P1_XHCI>; + clock-names = "sys_ck", "ref_ck", "mcu_ck", "dma_ck","xhci_ck"; + interrupts = ; +- mediatek,syscon-wakeup = <&pericfg 0x424 2>; +- wakeup-source; + status = "disabled"; + }; + }; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-mediatek-mt8192-asurada-drop-regulator-com.patch b/queue-6.12/arm64-dts-mediatek-mt8192-asurada-drop-regulator-com.patch new file mode 100644 index 0000000000..672c381a90 --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-mt8192-asurada-drop-regulator-com.patch @@ -0,0 +1,61 @@ +From 9b742e8defc1ad179d5013e2e1f26199c4f812d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 13:24:22 +0800 +Subject: arm64: dts: mediatek: mt8192-asurada: Drop regulator-compatible + property + +From: Chen-Yu Tsai + +[ Upstream commit d1fb968551c8688652b8b817bb081fdc9c25cd48 ] + +The "regulator-compatible" property has been deprecated since 2012 in +commit 13511def87b9 ("regulator: deprecate regulator-compatible DT +property"), which is so old it's not even mentioned in the converted +regulator bindings YAML file. It should not have been used for new +submissions such as the MT6315. + +Drop the "regulator-compatible" property from the board dts. The +property values are the same as the node name, so everything should +continue to work. + +Fixes: 3183cb62b033 ("arm64: dts: mediatek: asurada: Add SPMI regulators") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20241211052427.4178367-5-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi b/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi +index 08d71ddf36683..ad52c1d6e4eef 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi +@@ -1420,7 +1420,6 @@ + + regulators { + mt6315_6_vbuck1: vbuck1 { +- regulator-compatible = "vbuck1"; + regulator-name = "Vbcpu"; + regulator-min-microvolt = <400000>; + regulator-max-microvolt = <1193750>; +@@ -1430,7 +1429,6 @@ + }; + + mt6315_6_vbuck3: vbuck3 { +- regulator-compatible = "vbuck3"; + regulator-name = "Vlcpu"; + regulator-min-microvolt = <400000>; + regulator-max-microvolt = <1193750>; +@@ -1447,7 +1445,6 @@ + + regulators { + mt6315_7_vbuck1: vbuck1 { +- regulator-compatible = "vbuck1"; + regulator-name = "Vgpu"; + regulator-min-microvolt = <400000>; + regulator-max-microvolt = <800000>; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-mediatek-mt8195-cherry-drop-regulator-comp.patch b/queue-6.12/arm64-dts-mediatek-mt8195-cherry-drop-regulator-comp.patch new file mode 100644 index 0000000000..21739ca132 --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-mt8195-cherry-drop-regulator-comp.patch @@ -0,0 +1,53 @@ +From 0db5d96c58325940f53b398693fe077b9e6d5233 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 13:24:23 +0800 +Subject: arm64: dts: mediatek: mt8195-cherry: Drop regulator-compatible + property + +From: Chen-Yu Tsai + +[ Upstream commit 4dbaa5d5def2c49e44efaa5e796c23d9b904be09 ] + +The "regulator-compatible" property has been deprecated since 2012 in +commit 13511def87b9 ("regulator: deprecate regulator-compatible DT +property"), which is so old it's not even mentioned in the converted +regulator bindings YAML file. It should not have been used for new +submissions such as the MT6315. + +Drop the "regulator-compatible" property from the board dts. The +property values are the same as the node name, so everything should +continue to work. + +Fixes: 260c04d425eb ("arm64: dts: mediatek: cherry: Enable MT6315 regulators on SPMI bus") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20241211052427.4178367-6-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi b/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi +index 2c7b2223ee76b..5056e07399e23 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi +@@ -1285,7 +1285,6 @@ + + regulators { + mt6315_6_vbuck1: vbuck1 { +- regulator-compatible = "vbuck1"; + regulator-name = "Vbcpu"; + regulator-min-microvolt = <400000>; + regulator-max-microvolt = <1193750>; +@@ -1303,7 +1302,6 @@ + + regulators { + mt6315_7_vbuck1: vbuck1 { +- regulator-compatible = "vbuck1"; + regulator-name = "Vgpu"; + regulator-min-microvolt = <400000>; + regulator-max-microvolt = <1193750>; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-mediatek-mt8195-demo-drop-regulator-compat.patch b/queue-6.12/arm64-dts-mediatek-mt8195-demo-drop-regulator-compat.patch new file mode 100644 index 0000000000..b77e4e472c --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-mt8195-demo-drop-regulator-compat.patch @@ -0,0 +1,108 @@ +From 382bf670ed6d33db29cd1f02eb52889cf16154da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 13:24:24 +0800 +Subject: arm64: dts: mediatek: mt8195-demo: Drop regulator-compatible property + +From: Chen-Yu Tsai + +[ Upstream commit 2a8af9b95f504260a6d8200a11f0ae5c90e9f787 ] + +The "regulator-compatible" property has been deprecated since 2012 in +commit 13511def87b9 ("regulator: deprecate regulator-compatible DT +property"), which is so old it's not even mentioned in the converted +regulator bindings YAML file. It is also not listed in the MT6360 +regulator and charger bindings. + +Drop the "regulator-compatible" property from the board dts. The MT6360 +bindings actually require the lowercase name, so with the property +present the regulators were likely not actually working. + +Fixes: 6147314aeedc ("arm64: dts: mediatek: Add device-tree for MT8195 Demo board") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20241211052427.4178367-7-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8195-demo.dts | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8195-demo.dts b/arch/arm64/boot/dts/mediatek/mt8195-demo.dts +index 31d424b8fc7ce..bfb75296795c3 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195-demo.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8195-demo.dts +@@ -137,7 +137,6 @@ + richtek,vinovp-microvolt = <14500000>; + + otg_vbus_regulator: usb-otg-vbus-regulator { +- regulator-compatible = "usb-otg-vbus"; + regulator-name = "usb-otg-vbus"; + regulator-min-microvolt = <4425000>; + regulator-max-microvolt = <5825000>; +@@ -149,7 +148,6 @@ + LDO_VIN3-supply = <&mt6360_buck2>; + + mt6360_buck1: buck1 { +- regulator-compatible = "BUCK1"; + regulator-name = "mt6360,buck1"; + regulator-min-microvolt = <300000>; + regulator-max-microvolt = <1300000>; +@@ -160,7 +158,6 @@ + }; + + mt6360_buck2: buck2 { +- regulator-compatible = "BUCK2"; + regulator-name = "mt6360,buck2"; + regulator-min-microvolt = <300000>; + regulator-max-microvolt = <1300000>; +@@ -171,7 +168,6 @@ + }; + + mt6360_ldo1: ldo1 { +- regulator-compatible = "LDO1"; + regulator-name = "mt6360,ldo1"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3600000>; +@@ -180,7 +176,6 @@ + }; + + mt6360_ldo2: ldo2 { +- regulator-compatible = "LDO2"; + regulator-name = "mt6360,ldo2"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3600000>; +@@ -189,7 +184,6 @@ + }; + + mt6360_ldo3: ldo3 { +- regulator-compatible = "LDO3"; + regulator-name = "mt6360,ldo3"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3600000>; +@@ -198,7 +192,6 @@ + }; + + mt6360_ldo5: ldo5 { +- regulator-compatible = "LDO5"; + regulator-name = "mt6360,ldo5"; + regulator-min-microvolt = <2700000>; + regulator-max-microvolt = <3600000>; +@@ -207,7 +200,6 @@ + }; + + mt6360_ldo6: ldo6 { +- regulator-compatible = "LDO6"; + regulator-name = "mt6360,ldo6"; + regulator-min-microvolt = <500000>; + regulator-max-microvolt = <2100000>; +@@ -216,7 +208,6 @@ + }; + + mt6360_ldo7: ldo7 { +- regulator-compatible = "LDO7"; + regulator-name = "mt6360,ldo7"; + regulator-min-microvolt = <500000>; + regulator-max-microvolt = <2100000>; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch b/queue-6.12/arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch new file mode 100644 index 0000000000..08acac84af --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch @@ -0,0 +1,55 @@ +From cec463ae89abf1fc1a8e4de396ae21c789d5122c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Dec 2024 19:01:08 -0300 +Subject: arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from + pcie1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 3d7fdd8e38aafd4858935df2392762c1ab8fb40f ] + +The MAC reset for PCIe port 1 on MT8195 when asserted during suspend +causes the system to hang during resume with the following error (with +no_console_suspend enabled): + + mtk-pcie-gen3 112f8000.pcie: PCIe link down, current LTSSM state: detect.quiet (0x0) + mtk-pcie-gen3 112f8000.pcie: PM: dpm_run_callback(): genpd_resume_noirq+0x0/0x24 returns -110 + mtk-pcie-gen3 112f8000.pcie: PM: failed to resume noirq: error -110 + +This issue is specific to MT8195. On MT8192 with the PCIe reset, +MT8192_INFRA_RST4_PCIE_TOP_SWRST, added to the DT node, the issue is not +observed. + +Since without the reset, the PCIe controller and WiFi card connected to +it, work just as well, remove the reset to allow the system to suspend +and resume properly. + +Fixes: ecc0af6a3fe6 ("arm64: dts: mt8195: Add pcie and pcie phy nodes") +Signed-off-by: Nícolas F. R. A. Prado +Link: https://lore.kernel.org/r/20241218-mt8195-pcie1-reset-suspend-fix-v1-1-1c021dda42a6@collabora.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8195.dtsi | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +index ade685ed2190b..04e41b557d448 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +@@ -1611,9 +1611,6 @@ + phy-names = "pcie-phy"; + power-domains = <&spm MT8195_POWER_DOMAIN_PCIE_MAC_P1>; + +- resets = <&infracfg_ao MT8195_INFRA_RST2_PCIE_P1_SWRST>; +- reset-names = "mac"; +- + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 7>; + interrupt-map = <0 0 0 1 &pcie_intc1 0>, +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-mediatek-mt8395-genio-1200-evk-drop-regula.patch b/queue-6.12/arm64-dts-mediatek-mt8395-genio-1200-evk-drop-regula.patch new file mode 100644 index 0000000000..2f9b4fee4c --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-mt8395-genio-1200-evk-drop-regula.patch @@ -0,0 +1,53 @@ +From 998e30e1923da137dd8cc046043d246ed325ed06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 13:24:26 +0800 +Subject: arm64: dts: mediatek: mt8395-genio-1200-evk: Drop + regulator-compatible property + +From: Chen-Yu Tsai + +[ Upstream commit b99bf07c2c8b3c85c1935ddca2a73bc686f8d847 ] + +The "regulator-compatible" property has been deprecated since 2012 in +commit 13511def87b9 ("regulator: deprecate regulator-compatible DT +property"), which is so old it's not even mentioned in the converted +regulator bindings YAML file. It should not have been used for new +submissions such as the MT6315. + +Drop the "regulator-compatible" property from the board dts. The +property values are the same as the node name, so everything should +continue to work. + +Fixes: f2b543a191b6 ("arm64: dts: mediatek: add device-tree for Genio 1200 EVK board") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20241211052427.4178367-9-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8395-genio-1200-evk.dts | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8395-genio-1200-evk.dts b/arch/arm64/boot/dts/mediatek/mt8395-genio-1200-evk.dts +index b4b48eb93f3c5..6f34b06a0359a 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8395-genio-1200-evk.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8395-genio-1200-evk.dts +@@ -820,7 +820,6 @@ + + regulators { + mt6315_6_vbuck1: vbuck1 { +- regulator-compatible = "vbuck1"; + regulator-name = "Vbcpu"; + regulator-min-microvolt = <300000>; + regulator-max-microvolt = <1193750>; +@@ -837,7 +836,6 @@ + + regulators { + mt6315_7_vbuck1: vbuck1 { +- regulator-compatible = "vbuck1"; + regulator-name = "Vgpu"; + regulator-min-microvolt = <300000>; + regulator-max-microvolt = <1193750>; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-mediatek-mt8516-add-i2c-clock-div-property.patch b/queue-6.12/arm64-dts-mediatek-mt8516-add-i2c-clock-div-property.patch new file mode 100644 index 0000000000..3f2248d6bd --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-mt8516-add-i2c-clock-div-property.patch @@ -0,0 +1,74 @@ +From 9713b0e07710d8ed18e1e843997b6c024d7cfab5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Dec 2024 16:05:06 -0300 +Subject: arm64: dts: mediatek: mt8516: add i2c clock-div property + +From: Val Packett + +[ Upstream commit eb72341fd92b7af510d236e5a8554d855ed38d3c ] + +Move the clock-div property from the pumpkin board dtsi to the SoC's +since it belongs to the SoC itself and is required on other devices. + +Fixes: 5236347bde42 ("arm64: dts: mediatek: add dtsi for MT8516") +Signed-off-by: Val Packett +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20241204190524.21862-4-val@packett.cool +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8516.dtsi | 3 +++ + arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi | 2 -- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8516.dtsi b/arch/arm64/boot/dts/mediatek/mt8516.dtsi +index 098c32ebf6788..dd17d8a88c190 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8516.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8516.dtsi +@@ -344,6 +344,7 @@ + reg = <0 0x11009000 0 0x90>, + <0 0x11000180 0 0x80>; + interrupts = ; ++ clock-div = <2>; + clocks = <&topckgen CLK_TOP_I2C0>, + <&topckgen CLK_TOP_APDMA>; + clock-names = "main", "dma"; +@@ -358,6 +359,7 @@ + reg = <0 0x1100a000 0 0x90>, + <0 0x11000200 0 0x80>; + interrupts = ; ++ clock-div = <2>; + clocks = <&topckgen CLK_TOP_I2C1>, + <&topckgen CLK_TOP_APDMA>; + clock-names = "main", "dma"; +@@ -372,6 +374,7 @@ + reg = <0 0x1100b000 0 0x90>, + <0 0x11000280 0 0x80>; + interrupts = ; ++ clock-div = <2>; + clocks = <&topckgen CLK_TOP_I2C2>, + <&topckgen CLK_TOP_APDMA>; + clock-names = "main", "dma"; +diff --git a/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi b/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi +index ec8dfb3d1c6d6..a356db5fcc5f3 100644 +--- a/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi ++++ b/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi +@@ -47,7 +47,6 @@ + }; + + &i2c0 { +- clock-div = <2>; + pinctrl-names = "default"; + pinctrl-0 = <&i2c0_pins_a>; + status = "okay"; +@@ -156,7 +155,6 @@ + }; + + &i2c2 { +- clock-div = <2>; + pinctrl-names = "default"; + pinctrl-0 = <&i2c2_pins_a>; + status = "okay"; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-mediatek-mt8516-fix-gicv2-range.patch b/queue-6.12/arm64-dts-mediatek-mt8516-fix-gicv2-range.patch new file mode 100644 index 0000000000..3fe270dd07 --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-mt8516-fix-gicv2-range.patch @@ -0,0 +1,44 @@ +From 8346d8fb297af2e7f432e24f9d529014b9a2b8db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Dec 2024 16:05:04 -0300 +Subject: arm64: dts: mediatek: mt8516: fix GICv2 range + +From: Val Packett + +[ Upstream commit e3ee31e4409f051c021a30122f3c470f093a7386 ] + +On the MT8167 which is based on the MT8516 DTS, the following error +was appearing on boot, breaking interrupt operation: + +GICv2 detected, but range too small and irqchip.gicv2_force_probe not set + +Similar to what's been proposed for MT7622 which has the same issue, +fix by using the range reported by force_probe. + +Link: https://lore.kernel.org/all/YmhNSLgp%2Fyg8Vr1F@makrotopia.org/ +Fixes: 5236347bde42 ("arm64: dts: mediatek: add dtsi for MT8516") +Signed-off-by: Val Packett +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20241204190524.21862-2-val@packett.cool +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8516.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8516.dtsi b/arch/arm64/boot/dts/mediatek/mt8516.dtsi +index d0b03dc4d3f43..4444293413023 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8516.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8516.dtsi +@@ -268,7 +268,7 @@ + interrupt-parent = <&gic>; + interrupt-controller; + reg = <0 0x10310000 0 0x1000>, +- <0 0x10320000 0 0x1000>, ++ <0 0x1032f000 0 0x2000>, + <0 0x10340000 0 0x2000>, + <0 0x10360000 0 0x2000>; + interrupts = +Date: Wed, 4 Dec 2024 16:05:05 -0300 +Subject: arm64: dts: mediatek: mt8516: fix wdt irq type + +From: Val Packett + +[ Upstream commit 03a80442030e7147391738fb6cbe5fa0b3b91bb1 ] + +The GICv2 does not support EDGE_FALLING interrupts, so the watchdog +would refuse to attach due to a failing check coming from the GIC driver. + +Fixes: 5236347bde42 ("arm64: dts: mediatek: add dtsi for MT8516") +Signed-off-by: Val Packett +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20241204190524.21862-3-val@packett.cool +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8516.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8516.dtsi b/arch/arm64/boot/dts/mediatek/mt8516.dtsi +index 4444293413023..098c32ebf6788 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8516.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8516.dtsi +@@ -206,7 +206,7 @@ + compatible = "mediatek,mt8516-wdt", + "mediatek,mt6589-wdt"; + reg = <0 0x10007000 0 0x1000>; +- interrupts = ; ++ interrupts = ; + #reset-cells = <1>; + }; + +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-mediatek-mt8516-reserve-192-kib-for-tf-a.patch b/queue-6.12/arm64-dts-mediatek-mt8516-reserve-192-kib-for-tf-a.patch new file mode 100644 index 0000000000..97fec1c8aa --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-mt8516-reserve-192-kib-for-tf-a.patch @@ -0,0 +1,43 @@ +From c5253588dd1771f9470628af3029e577b5322cbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Dec 2024 16:05:07 -0300 +Subject: arm64: dts: mediatek: mt8516: reserve 192 KiB for TF-A + +From: Val Packett + +[ Upstream commit 2561c7d5d497b988deccc36fe5eac7fd50b937f8 ] + +The Android DTB for the related MT8167 reserves 0x30000. This is likely +correct for MT8516 Android devices as well, and there's never any harm +in reserving 64KiB more. + +Fixes: 5236347bde42 ("arm64: dts: mediatek: add dtsi for MT8516") +Signed-off-by: Val Packett +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20241204190524.21862-5-val@packett.cool +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8516.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8516.dtsi b/arch/arm64/boot/dts/mediatek/mt8516.dtsi +index dd17d8a88c190..e30623ebac0e1 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8516.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8516.dtsi +@@ -144,10 +144,10 @@ + #size-cells = <2>; + ranges; + +- /* 128 KiB reserved for ARM Trusted Firmware (BL31) */ ++ /* 192 KiB reserved for ARM Trusted Firmware (BL31) */ + bl31_secmon_reserved: secmon@43000000 { + no-map; +- reg = <0 0x43000000 0 0x20000>; ++ reg = <0 0x43000000 0 0x30000>; + }; + }; + +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-mt8183-set-dmic-one-wire-mode-on-damu.patch b/queue-6.12/arm64-dts-mt8183-set-dmic-one-wire-mode-on-damu.patch new file mode 100644 index 0000000000..5943e56605 --- /dev/null +++ b/queue-6.12/arm64-dts-mt8183-set-dmic-one-wire-mode-on-damu.patch @@ -0,0 +1,41 @@ +From 10c4d37378ede961e7571faa3afb381f7328153c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Nov 2024 16:16:53 +0800 +Subject: arm64: dts: mt8183: set DMIC one-wire mode on Damu + +From: Hsin-Yi Wang + +[ Upstream commit 6c379e8b984815fc8f876e4bc78c4d563f13ddae ] + +Sets DMIC one-wire mode on Damu. + +Fixes: cabc71b08eb5 ("arm64: dts: mt8183: Add kukui-jacuzzi-damu board") +Signed-off-by: Hsin-Yi Wang +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Hsin-Te Yuan +Reviewed-by: Matthias Brugger +Link: https://lore.kernel.org/r/20241113-damu-v4-1-6911b69610dd@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts +index 65860b33c01fe..3935d83a047e0 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts +@@ -26,6 +26,10 @@ + hid-descr-addr = <0x0001>; + }; + ++&mt6358codec { ++ mediatek,dmic-mode = <1>; /* one-wire */ ++}; ++ + &qca_wifi { + qcom,ath10k-calibration-variant = "GO_DAMU"; + }; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-msm8916-correct-sleep-clock-frequency.patch b/queue-6.12/arm64-dts-qcom-msm8916-correct-sleep-clock-frequency.patch new file mode 100644 index 0000000000..06d9dc6f91 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-msm8916-correct-sleep-clock-frequency.patch @@ -0,0 +1,38 @@ +From 1ad1f639a62aea95c60bd7b3015355b3971a3ad6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:17:00 +0200 +Subject: arm64: dts: qcom: msm8916: correct sleep clock frequency + +From: Dmitry Baryshkov + +[ Upstream commit f088b921890cef28862913e5627bb2e2b5f82125 ] + +The MSM8916 platform uses PM8916 to provide sleep clock. According to the +documentation, that clock has 32.7645 kHz frequency. Correct the sleep +clock definition. + +Fixes: f4fb6aeafaaa ("arm64: dts: qcom: msm8916: Add fixed rate on-board oscillators") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-1-e9b08fbeadd3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi +index 0ee44706b70ba..800bfe83dbf83 100644 +--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi +@@ -125,7 +125,7 @@ + sleep_clk: sleep-clk { + compatible = "fixed-clock"; + #clock-cells = <0>; +- clock-frequency = <32768>; ++ clock-frequency = <32764>; + }; + }; + +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-msm8939-correct-sleep-clock-frequency.patch b/queue-6.12/arm64-dts-qcom-msm8939-correct-sleep-clock-frequency.patch new file mode 100644 index 0000000000..98caafda11 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-msm8939-correct-sleep-clock-frequency.patch @@ -0,0 +1,38 @@ +From 1723a6b18edb96bd83369fec26e6d96a6512fd7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:17:01 +0200 +Subject: arm64: dts: qcom: msm8939: correct sleep clock frequency + +From: Dmitry Baryshkov + +[ Upstream commit 5c775f586cde4fca3c5591c43b6dc8b243bc304c ] + +The MSM8939 platform uses PM8916 to provide sleep clock. According to the +documentation, that clock has 32.7645 kHz frequency. Correct the sleep +clock definition. + +Fixes: 61550c6c156c ("arm64: dts: qcom: Add msm8939 SoC") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-2-e9b08fbeadd3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8939.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8939.dtsi b/arch/arm64/boot/dts/qcom/msm8939.dtsi +index 7af210789879a..effa3aaeb2505 100644 +--- a/arch/arm64/boot/dts/qcom/msm8939.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8939.dtsi +@@ -34,7 +34,7 @@ + sleep_clk: sleep-clk { + compatible = "fixed-clock"; + #clock-cells = <0>; +- clock-frequency = <32768>; ++ clock-frequency = <32764>; + }; + }; + +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-msm8994-correct-sleep-clock-frequency.patch b/queue-6.12/arm64-dts-qcom-msm8994-correct-sleep-clock-frequency.patch new file mode 100644 index 0000000000..f4b2d61b56 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-msm8994-correct-sleep-clock-frequency.patch @@ -0,0 +1,38 @@ +From a491e1950dc136ce11cb24afb118719d326565ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:17:02 +0200 +Subject: arm64: dts: qcom: msm8994: correct sleep clock frequency + +From: Dmitry Baryshkov + +[ Upstream commit a4148d869d47d8c86da0291dd95d411a5ebe90c8 ] + +The MSM8994 platform uses PM8994/6 to provide sleep clock. According to the +documentation, that clock has 32.7645 kHz frequency. Correct the sleep +clock definition. + +Fixes: feeaf56ac78d ("arm64: dts: msm8994 SoC and Huawei Angler (Nexus 6P) support") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-3-e9b08fbeadd3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8994.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8994.dtsi b/arch/arm64/boot/dts/qcom/msm8994.dtsi +index ed2b90148d9f7..8a7de1dba2b9d 100644 +--- a/arch/arm64/boot/dts/qcom/msm8994.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8994.dtsi +@@ -34,7 +34,7 @@ + sleep_clk: sleep-clk { + compatible = "fixed-clock"; + #clock-cells = <0>; +- clock-frequency = <32768>; ++ clock-frequency = <32764>; + clock-output-names = "sleep_clk"; + }; + }; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-msm8994-describe-usb-interrupts.patch b/queue-6.12/arm64-dts-qcom-msm8994-describe-usb-interrupts.patch new file mode 100644 index 0000000000..c803d6434d --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-msm8994-describe-usb-interrupts.patch @@ -0,0 +1,44 @@ +From e7222374711308238b7e72ede8621a78e10d2780 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Nov 2024 23:12:48 +0100 +Subject: arm64: dts: qcom: msm8994: Describe USB interrupts + +From: Konrad Dybcio + +[ Upstream commit c910544d2234709660d60f80345c285616e73b1c ] + +Previously the interrupt lanes were not described, fix that. + +Fixes: d9be0bc95f25 ("arm64: dts: qcom: msm8994: Add USB support") +Signed-off-by: Konrad Dybcio +Tested-by: Petr Vorel +Link: https://lore.kernel.org/r/20241129-topic-qcom_usb_dtb_fixup-v1-4-cba24120c058@oss.qualcomm.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8994.dtsi | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/msm8994.dtsi b/arch/arm64/boot/dts/qcom/msm8994.dtsi +index fc2a7f13f690e..ed2b90148d9f7 100644 +--- a/arch/arm64/boot/dts/qcom/msm8994.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8994.dtsi +@@ -437,6 +437,15 @@ + #size-cells = <1>; + ranges; + ++ interrupts = , ++ , ++ , ++ ; ++ interrupt-names = "pwr_event", ++ "qusb2_phy", ++ "hs_phy_irq", ++ "ss_phy_irq"; ++ + clocks = <&gcc GCC_USB30_MASTER_CLK>, + <&gcc GCC_SYS_NOC_USB3_AXI_CLK>, + <&gcc GCC_USB30_SLEEP_CLK>, +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-msm8996-fix-up-usb3-interrupts.patch b/queue-6.12/arm64-dts-qcom-msm8996-fix-up-usb3-interrupts.patch new file mode 100644 index 0000000000..34cb63e812 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-msm8996-fix-up-usb3-interrupts.patch @@ -0,0 +1,49 @@ +From 6534e6d12159966268bf3c0dd2151b537e32efba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Nov 2024 23:12:47 +0100 +Subject: arm64: dts: qcom: msm8996: Fix up USB3 interrupts + +From: Konrad Dybcio + +[ Upstream commit 9cb9c9f4e1380da317a056afd26d66a835c5796c ] + +Add the missing interrupt lines and fix qusb2_phy being an impostor +of hs_phy_irq. + +This happens to also fix warnings such as: + +usb@6af8800: interrupt-names: ['hs_phy_irq', 'ss_phy_irq'] is too short + +Fixes: 4753492de9df ("arm64: dts: qcom: msm8996: Add usb3 interrupts") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20241129-topic-qcom_usb_dtb_fixup-v1-3-cba24120c058@oss.qualcomm.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8996.dtsi | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index e5966724f37c6..0a8884145865d 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -3065,9 +3065,14 @@ + #size-cells = <1>; + ranges; + +- interrupts = , ++ interrupts = , ++ , ++ , + ; +- interrupt-names = "hs_phy_irq", "ss_phy_irq"; ++ interrupt-names = "pwr_event", ++ "qusb2_phy", ++ "hs_phy_irq", ++ "ss_phy_irq"; + + clocks = <&gcc GCC_SYS_NOC_USB3_AXI_CLK>, + <&gcc GCC_USB30_MASTER_CLK>, +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-msm8996-xiaomi-gemini-fix-lp5562-led1.patch b/queue-6.12/arm64-dts-qcom-msm8996-xiaomi-gemini-fix-lp5562-led1.patch new file mode 100644 index 0000000000..5a477a48c2 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-msm8996-xiaomi-gemini-fix-lp5562-led1.patch @@ -0,0 +1,38 @@ +From 15a65b0e3f244db5050803eb417fbdd80ab91541 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Oct 2024 04:19:48 +0200 +Subject: arm64: dts: qcom: msm8996-xiaomi-gemini: Fix LP5562 LED1 reg property + +From: Marek Vasut + +[ Upstream commit 02e784c5023232c48c6ec79b52ac8929d4e4db34 ] + +The LP5562 led@1 reg property should likely be set to 1 to match +the unit. Fix it. + +Fixes: 4ac46b3682c5 ("arm64: dts: qcom: msm8996: xiaomi-gemini: Add support for Xiaomi Mi 5") +Signed-off-by: Marek Vasut +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241006022012.366601-1-marex@denx.de +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts b/arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts +index f8e9d90afab00..dbad8f57f2fa3 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts ++++ b/arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts +@@ -64,7 +64,7 @@ + }; + + led@1 { +- reg = <0>; ++ reg = <1>; + chan-name = "button-backlight1"; + led-cur = /bits/ 8 <0x32>; + max-cur = /bits/ 8 <0xc8>; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-q-dr-u1000-correct-sleep-clock-freque.patch b/queue-6.12/arm64-dts-qcom-q-dr-u1000-correct-sleep-clock-freque.patch new file mode 100644 index 0000000000..6b9d954e58 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-q-dr-u1000-correct-sleep-clock-freque.patch @@ -0,0 +1,52 @@ +From 4a51e29a33459f05b0558cab5518070edb3253d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:17:04 +0200 +Subject: arm64: dts: qcom: q[dr]u1000: correct sleep clock frequency + +From: Dmitry Baryshkov + +[ Upstream commit 5546604e034b6c383b65676ff8615b346897eccd ] + +The Q[DR]U1000 platforms use PM8150 to provide sleep clock. According to +the documentation, that clock has 32.7645 kHz frequency. Correct the +sleep clock definition. + +Fixes: d1f2cfe2f669 ("arm64: dts: qcom: Add base QDU1000/QRU1000 IDP DTs") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-5-e9b08fbeadd3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/qdu1000-idp.dts | 2 +- + arch/arm64/boot/dts/qcom/qru1000-idp.dts | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/qdu1000-idp.dts b/arch/arm64/boot/dts/qcom/qdu1000-idp.dts +index e65305f8136c8..c73eda75faf82 100644 +--- a/arch/arm64/boot/dts/qcom/qdu1000-idp.dts ++++ b/arch/arm64/boot/dts/qcom/qdu1000-idp.dts +@@ -31,7 +31,7 @@ + + sleep_clk: sleep-clk { + compatible = "fixed-clock"; +- clock-frequency = <32000>; ++ clock-frequency = <32764>; + #clock-cells = <0>; + }; + }; +diff --git a/arch/arm64/boot/dts/qcom/qru1000-idp.dts b/arch/arm64/boot/dts/qcom/qru1000-idp.dts +index 1c781d9e24cf4..52ce51e56e2fd 100644 +--- a/arch/arm64/boot/dts/qcom/qru1000-idp.dts ++++ b/arch/arm64/boot/dts/qcom/qru1000-idp.dts +@@ -31,7 +31,7 @@ + + sleep_clk: sleep-clk { + compatible = "fixed-clock"; +- clock-frequency = <32000>; ++ clock-frequency = <32764>; + #clock-cells = <0>; + }; + }; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-qcm6490-shift-otter-remove-invalid-or.patch b/queue-6.12/arm64-dts-qcom-qcm6490-shift-otter-remove-invalid-or.patch new file mode 100644 index 0000000000..6e1acb6ca7 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-qcm6490-shift-otter-remove-invalid-or.patch @@ -0,0 +1,42 @@ +From 57061b24c25dd7d50963265d66228f722a740624 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 13:44:44 +0100 +Subject: arm64: dts: qcom: qcm6490-shift-otter: remove invalid + orientation-switch + +From: Neil Armstrong + +[ Upstream commit abb00f0fbf31d71b9f725e58d6a29634175f28a8 ] + +The orientation-switch property is not documented in the PHY bindings, +remove it. + +This fixes: +qcm6490-shift-otter.dts: phy@88e3000: 'orientation-switch' does not match any of the regexes: 'pinctrl-[0-9]+' + from schema $id: http://devicetree.org/schemas/phy/qcom,usb-snps-femto-v2.yaml# + +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20241230-topic-misc-dt-fixes-v4-1-1e6880e9dda3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/qcm6490-shift-otter.dts | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/qcm6490-shift-otter.dts b/arch/arm64/boot/dts/qcom/qcm6490-shift-otter.dts +index 4667e47a74bc5..75930f9576966 100644 +--- a/arch/arm64/boot/dts/qcom/qcm6490-shift-otter.dts ++++ b/arch/arm64/boot/dts/qcom/qcm6490-shift-otter.dts +@@ -942,8 +942,6 @@ + + qcom,squelch-detector-bp = <(-2090)>; + +- orientation-switch; +- + status = "okay"; + }; + +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-qcs404-correct-sleep-clock-frequency.patch b/queue-6.12/arm64-dts-qcom-qcs404-correct-sleep-clock-frequency.patch new file mode 100644 index 0000000000..b8a69f8e41 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-qcs404-correct-sleep-clock-frequency.patch @@ -0,0 +1,38 @@ +From 41c0ec5a1cf5ff26b6ed186a9b9fbdd3f2fe71cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:17:03 +0200 +Subject: arm64: dts: qcom: qcs404: correct sleep clock frequency + +From: Dmitry Baryshkov + +[ Upstream commit 1473ff0b69de68b23ce9874548cdabc64d72725e ] + +The QCS40x platforms use PMS405 to provide sleep clock. According to the +documentation, that clock has 32.7645 kHz frequency. Correct the sleep +clock definition. + +Fixes: 9181bb939984 ("arm64: dts: qcom: Add SDX75 platform and IDP board support") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-4-e9b08fbeadd3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/qcs404.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/qcs404.dtsi b/arch/arm64/boot/dts/qcom/qcs404.dtsi +index cddc16bac0cea..81a161c0cc5a8 100644 +--- a/arch/arm64/boot/dts/qcom/qcs404.dtsi ++++ b/arch/arm64/boot/dts/qcom/qcs404.dtsi +@@ -28,7 +28,7 @@ + sleep_clk: sleep-clk { + compatible = "fixed-clock"; + #clock-cells = <0>; +- clock-frequency = <32768>; ++ clock-frequency = <32764>; + }; + }; + +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-qrb4210-rb2-correct-sleep-clock-frequ.patch b/queue-6.12/arm64-dts-qcom-qrb4210-rb2-correct-sleep-clock-frequ.patch new file mode 100644 index 0000000000..3633b3b19a --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-qrb4210-rb2-correct-sleep-clock-frequ.patch @@ -0,0 +1,38 @@ +From 0e1e1f1e925fbc2f365eaa41a7e6d32e07e7d6cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:17:05 +0200 +Subject: arm64: dts: qcom: qrb4210-rb2: correct sleep clock frequency + +From: Dmitry Baryshkov + +[ Upstream commit 298192f365a343d84e9d2755e47bebebf0cfb82e ] + +Qualcomm RB2 board uses PM6125 to provide sleep clock. According to the +documentation, that clock has 32.7645 kHz frequency. Correct the sleep +clock definition. + +Fixes: 8d58a8c0d930 ("arm64: dts: qcom: Add base qrb4210-rb2 board dts") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-6-e9b08fbeadd3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/qrb4210-rb2.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts b/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts +index 1888d99d398b1..f99fb9159e0b6 100644 +--- a/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts ++++ b/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts +@@ -545,7 +545,7 @@ + }; + + &sleep_clk { +- clock-frequency = <32000>; ++ clock-frequency = <32764>; + }; + + &tlmm { +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sa8775p-update-sleep_clk-frequency.patch b/queue-6.12/arm64-dts-qcom-sa8775p-update-sleep_clk-frequency.patch new file mode 100644 index 0000000000..453c5a37ed --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sa8775p-update-sleep_clk-frequency.patch @@ -0,0 +1,37 @@ +From c32cffeafadd663ddc326c947dda236c38a339dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2024 14:22:53 +0530 +Subject: arm64: dts: qcom: sa8775p: Update sleep_clk frequency + +From: Taniya Das + +[ Upstream commit 30f7dfd2c4899630becf477447e8bbe92683d2c6 ] + +Fix the sleep_clk frequency is 32000 on SA8775P. + +Fixes: 603f96d4c9d0 ("arm64: dts: qcom: add initial support for qcom sa8775p-ride") +Reviewed-by: Konrad Dybcio +Signed-off-by: Taniya Das +Link: https://lore.kernel.org/r/20241025-sa8775p-mm-v4-resend-patches-v6-1-329a2cac09ae@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sa8775p-ride.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sa8775p-ride.dtsi b/arch/arm64/boot/dts/qcom/sa8775p-ride.dtsi +index 0c1b21def4b62..adb71aeff339b 100644 +--- a/arch/arm64/boot/dts/qcom/sa8775p-ride.dtsi ++++ b/arch/arm64/boot/dts/qcom/sa8775p-ride.dtsi +@@ -517,7 +517,7 @@ + }; + + &sleep_clk { +- clock-frequency = <32764>; ++ clock-frequency = <32000>; + }; + + &spi16 { +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sc7180-change-labels-to-lower-case.patch b/queue-6.12/arm64-dts-qcom-sc7180-change-labels-to-lower-case.patch new file mode 100644 index 0000000000..00599fb935 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sc7180-change-labels-to-lower-case.patch @@ -0,0 +1,1064 @@ +From 763efc3dd3b728edfdc5edf87b8a771fb32cc0bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Oct 2024 17:47:29 +0200 +Subject: arm64: dts: qcom: sc7180: change labels to lower-case + +From: Krzysztof Kozlowski + +[ Upstream commit e5f90735136562c0653714b43ff1aeb331600d24 ] + +DTS coding style expects labels to be lowercase. No functional impact. +Verified with comparing decompiled DTB (dtx_diff and fdtdump+diff). + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20241022-dts-qcom-label-v3-4-0505bc7d2c56@linaro.org +Signed-off-by: Bjorn Andersson +Stable-dep-of: 092febd32a99 ("arm64: dts: qcom: sc7180: fix psci power domain node names") +Signed-off-by: Sasha Levin +--- + .../boot/dts/qcom/sc7180-firmware-tfa.dtsi | 84 ++-- + .../boot/dts/qcom/sc7180-trogdor-coachz.dtsi | 8 +- + .../dts/qcom/sc7180-trogdor-homestar.dtsi | 8 +- + .../dts/qcom/sc7180-trogdor-wormdingler.dtsi | 8 +- + arch/arm64/boot/dts/qcom/sc7180.dtsi | 362 +++++++++--------- + arch/arm64/boot/dts/qcom/sm7125.dtsi | 16 +- + 6 files changed, 243 insertions(+), 243 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7180-firmware-tfa.dtsi b/arch/arm64/boot/dts/qcom/sc7180-firmware-tfa.dtsi +index ee35a454dbf6f..59162b3afcb84 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180-firmware-tfa.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7180-firmware-tfa.dtsi +@@ -6,82 +6,82 @@ + * by Qualcomm firmware. + */ + +-&CPU0 { ++&cpu0 { + /delete-property/ power-domains; + /delete-property/ power-domain-names; + +- cpu-idle-states = <&LITTLE_CPU_SLEEP_0 +- &LITTLE_CPU_SLEEP_1 +- &CLUSTER_SLEEP_0>; ++ cpu-idle-states = <&little_cpu_sleep_0 ++ &little_cpu_sleep_1 ++ &cluster_sleep_0>; + }; + +-&CPU1 { ++&cpu1 { + /delete-property/ power-domains; + /delete-property/ power-domain-names; + +- cpu-idle-states = <&LITTLE_CPU_SLEEP_0 +- &LITTLE_CPU_SLEEP_1 +- &CLUSTER_SLEEP_0>; ++ cpu-idle-states = <&little_cpu_sleep_0 ++ &little_cpu_sleep_1 ++ &cluster_sleep_0>; + }; + +-&CPU2 { ++&cpu2 { + /delete-property/ power-domains; + /delete-property/ power-domain-names; + +- cpu-idle-states = <&LITTLE_CPU_SLEEP_0 +- &LITTLE_CPU_SLEEP_1 +- &CLUSTER_SLEEP_0>; ++ cpu-idle-states = <&little_cpu_sleep_0 ++ &little_cpu_sleep_1 ++ &cluster_sleep_0>; + }; + +-&CPU3 { ++&cpu3 { + /delete-property/ power-domains; + /delete-property/ power-domain-names; + +- cpu-idle-states = <&LITTLE_CPU_SLEEP_0 +- &LITTLE_CPU_SLEEP_1 +- &CLUSTER_SLEEP_0>; ++ cpu-idle-states = <&little_cpu_sleep_0 ++ &little_cpu_sleep_1 ++ &cluster_sleep_0>; + }; + +-&CPU4 { ++&cpu4 { + /delete-property/ power-domains; + /delete-property/ power-domain-names; + +- cpu-idle-states = <&LITTLE_CPU_SLEEP_0 +- &LITTLE_CPU_SLEEP_1 +- &CLUSTER_SLEEP_0>; ++ cpu-idle-states = <&little_cpu_sleep_0 ++ &little_cpu_sleep_1 ++ &cluster_sleep_0>; + }; + +-&CPU5 { ++&cpu5 { + /delete-property/ power-domains; + /delete-property/ power-domain-names; + +- cpu-idle-states = <&LITTLE_CPU_SLEEP_0 +- &LITTLE_CPU_SLEEP_1 +- &CLUSTER_SLEEP_0>; ++ cpu-idle-states = <&little_cpu_sleep_0 ++ &little_cpu_sleep_1 ++ &cluster_sleep_0>; + }; + +-&CPU6 { ++&cpu6 { + /delete-property/ power-domains; + /delete-property/ power-domain-names; + +- cpu-idle-states = <&BIG_CPU_SLEEP_0 +- &BIG_CPU_SLEEP_1 +- &CLUSTER_SLEEP_0>; ++ cpu-idle-states = <&big_cpu_sleep_0 ++ &big_cpu_sleep_1 ++ &cluster_sleep_0>; + }; + +-&CPU7 { ++&cpu7 { + /delete-property/ power-domains; + /delete-property/ power-domain-names; + +- cpu-idle-states = <&BIG_CPU_SLEEP_0 +- &BIG_CPU_SLEEP_1 +- &CLUSTER_SLEEP_0>; ++ cpu-idle-states = <&big_cpu_sleep_0 ++ &big_cpu_sleep_1 ++ &cluster_sleep_0>; + }; + + /delete-node/ &domain_idle_states; + + &idle_states { +- CLUSTER_SLEEP_0: cluster-sleep-0 { ++ cluster_sleep_0: cluster-sleep-0 { + compatible = "arm,idle-state"; + idle-state-name = "cluster-power-down"; + arm,psci-suspend-param = <0x40003444>; +@@ -92,15 +92,15 @@ + }; + }; + +-/delete-node/ &CPU_PD0; +-/delete-node/ &CPU_PD1; +-/delete-node/ &CPU_PD2; +-/delete-node/ &CPU_PD3; +-/delete-node/ &CPU_PD4; +-/delete-node/ &CPU_PD5; +-/delete-node/ &CPU_PD6; +-/delete-node/ &CPU_PD7; +-/delete-node/ &CLUSTER_PD; ++/delete-node/ &cpu_pd0; ++/delete-node/ &cpu_pd1; ++/delete-node/ &cpu_pd2; ++/delete-node/ &cpu_pd3; ++/delete-node/ &cpu_pd4; ++/delete-node/ &cpu_pd5; ++/delete-node/ &cpu_pd6; ++/delete-node/ &cpu_pd7; ++/delete-node/ &cluster_pd; + + &apps_rsc { + /delete-property/ power-domains; +diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi +index 3c124bbe2f4c9..25b17b0425f24 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi +@@ -53,14 +53,14 @@ + cooling-maps { + map0 { + trip = <&skin_temp_alert0>; +- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + + map1 { + trip = <&skin_temp_alert1>; +- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + }; + }; +diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-homestar.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor-homestar.dtsi +index b2df22faafe88..f57976906d630 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-homestar.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-homestar.dtsi +@@ -71,14 +71,14 @@ + cooling-maps { + map0 { + trip = <&skin_temp_alert0>; +- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + + map1 { + trip = <&skin_temp_alert1>; +- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + }; + }; +diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-wormdingler.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor-wormdingler.dtsi +index af89d80426abb..d4925be3b1fcf 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-wormdingler.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-wormdingler.dtsi +@@ -78,14 +78,14 @@ + cooling-maps { + map0 { + trip = <&skin_temp_alert0>; +- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + + map1 { + trip = <&skin_temp_alert1>; +- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + }; + }; +diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi +index b5ebf89803251..19df1c8f7891b 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi +@@ -77,28 +77,28 @@ + #address-cells = <2>; + #size-cells = <0>; + +- CPU0: cpu@0 { ++ cpu0: cpu@0 { + device_type = "cpu"; + compatible = "qcom,kryo468"; + reg = <0x0 0x0>; + clocks = <&cpufreq_hw 0>; + enable-method = "psci"; +- power-domains = <&CPU_PD0>; ++ power-domains = <&cpu_pd0>; + power-domain-names = "psci"; + capacity-dmips-mhz = <415>; + dynamic-power-coefficient = <137>; + operating-points-v2 = <&cpu0_opp_table>; + interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>, + <&osm_l3 MASTER_OSM_L3_APPS &osm_l3 SLAVE_OSM_L3>; +- next-level-cache = <&L2_0>; ++ next-level-cache = <&l2_0>; + #cooling-cells = <2>; + qcom,freq-domain = <&cpufreq_hw 0>; +- L2_0: l2-cache { ++ l2_0: l2-cache { + compatible = "cache"; + cache-level = <2>; + cache-unified; +- next-level-cache = <&L3_0>; +- L3_0: l3-cache { ++ next-level-cache = <&l3_0>; ++ l3_0: l3-cache { + compatible = "cache"; + cache-level = <3>; + cache-unified; +@@ -106,206 +106,206 @@ + }; + }; + +- CPU1: cpu@100 { ++ cpu1: cpu@100 { + device_type = "cpu"; + compatible = "qcom,kryo468"; + reg = <0x0 0x100>; + clocks = <&cpufreq_hw 0>; + enable-method = "psci"; +- power-domains = <&CPU_PD1>; ++ power-domains = <&cpu_pd1>; + power-domain-names = "psci"; + capacity-dmips-mhz = <415>; + dynamic-power-coefficient = <137>; +- next-level-cache = <&L2_100>; ++ next-level-cache = <&l2_100>; + operating-points-v2 = <&cpu0_opp_table>; + interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>, + <&osm_l3 MASTER_OSM_L3_APPS &osm_l3 SLAVE_OSM_L3>; + #cooling-cells = <2>; + qcom,freq-domain = <&cpufreq_hw 0>; +- L2_100: l2-cache { ++ l2_100: l2-cache { + compatible = "cache"; + cache-level = <2>; + cache-unified; +- next-level-cache = <&L3_0>; ++ next-level-cache = <&l3_0>; + }; + }; + +- CPU2: cpu@200 { ++ cpu2: cpu@200 { + device_type = "cpu"; + compatible = "qcom,kryo468"; + reg = <0x0 0x200>; + clocks = <&cpufreq_hw 0>; + enable-method = "psci"; +- power-domains = <&CPU_PD2>; ++ power-domains = <&cpu_pd2>; + power-domain-names = "psci"; + capacity-dmips-mhz = <415>; + dynamic-power-coefficient = <137>; +- next-level-cache = <&L2_200>; ++ next-level-cache = <&l2_200>; + operating-points-v2 = <&cpu0_opp_table>; + interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>, + <&osm_l3 MASTER_OSM_L3_APPS &osm_l3 SLAVE_OSM_L3>; + #cooling-cells = <2>; + qcom,freq-domain = <&cpufreq_hw 0>; +- L2_200: l2-cache { ++ l2_200: l2-cache { + compatible = "cache"; + cache-level = <2>; + cache-unified; +- next-level-cache = <&L3_0>; ++ next-level-cache = <&l3_0>; + }; + }; + +- CPU3: cpu@300 { ++ cpu3: cpu@300 { + device_type = "cpu"; + compatible = "qcom,kryo468"; + reg = <0x0 0x300>; + clocks = <&cpufreq_hw 0>; + enable-method = "psci"; +- power-domains = <&CPU_PD3>; ++ power-domains = <&cpu_pd3>; + power-domain-names = "psci"; + capacity-dmips-mhz = <415>; + dynamic-power-coefficient = <137>; +- next-level-cache = <&L2_300>; ++ next-level-cache = <&l2_300>; + operating-points-v2 = <&cpu0_opp_table>; + interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>, + <&osm_l3 MASTER_OSM_L3_APPS &osm_l3 SLAVE_OSM_L3>; + #cooling-cells = <2>; + qcom,freq-domain = <&cpufreq_hw 0>; +- L2_300: l2-cache { ++ l2_300: l2-cache { + compatible = "cache"; + cache-level = <2>; + cache-unified; +- next-level-cache = <&L3_0>; ++ next-level-cache = <&l3_0>; + }; + }; + +- CPU4: cpu@400 { ++ cpu4: cpu@400 { + device_type = "cpu"; + compatible = "qcom,kryo468"; + reg = <0x0 0x400>; + clocks = <&cpufreq_hw 0>; + enable-method = "psci"; +- power-domains = <&CPU_PD4>; ++ power-domains = <&cpu_pd4>; + power-domain-names = "psci"; + capacity-dmips-mhz = <415>; + dynamic-power-coefficient = <137>; +- next-level-cache = <&L2_400>; ++ next-level-cache = <&l2_400>; + operating-points-v2 = <&cpu0_opp_table>; + interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>, + <&osm_l3 MASTER_OSM_L3_APPS &osm_l3 SLAVE_OSM_L3>; + #cooling-cells = <2>; + qcom,freq-domain = <&cpufreq_hw 0>; +- L2_400: l2-cache { ++ l2_400: l2-cache { + compatible = "cache"; + cache-level = <2>; + cache-unified; +- next-level-cache = <&L3_0>; ++ next-level-cache = <&l3_0>; + }; + }; + +- CPU5: cpu@500 { ++ cpu5: cpu@500 { + device_type = "cpu"; + compatible = "qcom,kryo468"; + reg = <0x0 0x500>; + clocks = <&cpufreq_hw 0>; + enable-method = "psci"; +- power-domains = <&CPU_PD5>; ++ power-domains = <&cpu_pd5>; + power-domain-names = "psci"; + capacity-dmips-mhz = <415>; + dynamic-power-coefficient = <137>; +- next-level-cache = <&L2_500>; ++ next-level-cache = <&l2_500>; + operating-points-v2 = <&cpu0_opp_table>; + interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>, + <&osm_l3 MASTER_OSM_L3_APPS &osm_l3 SLAVE_OSM_L3>; + #cooling-cells = <2>; + qcom,freq-domain = <&cpufreq_hw 0>; +- L2_500: l2-cache { ++ l2_500: l2-cache { + compatible = "cache"; + cache-level = <2>; + cache-unified; +- next-level-cache = <&L3_0>; ++ next-level-cache = <&l3_0>; + }; + }; + +- CPU6: cpu@600 { ++ cpu6: cpu@600 { + device_type = "cpu"; + compatible = "qcom,kryo468"; + reg = <0x0 0x600>; + clocks = <&cpufreq_hw 1>; + enable-method = "psci"; +- power-domains = <&CPU_PD6>; ++ power-domains = <&cpu_pd6>; + power-domain-names = "psci"; + capacity-dmips-mhz = <1024>; + dynamic-power-coefficient = <480>; +- next-level-cache = <&L2_600>; ++ next-level-cache = <&l2_600>; + operating-points-v2 = <&cpu6_opp_table>; + interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>, + <&osm_l3 MASTER_OSM_L3_APPS &osm_l3 SLAVE_OSM_L3>; + #cooling-cells = <2>; + qcom,freq-domain = <&cpufreq_hw 1>; +- L2_600: l2-cache { ++ l2_600: l2-cache { + compatible = "cache"; + cache-level = <2>; + cache-unified; +- next-level-cache = <&L3_0>; ++ next-level-cache = <&l3_0>; + }; + }; + +- CPU7: cpu@700 { ++ cpu7: cpu@700 { + device_type = "cpu"; + compatible = "qcom,kryo468"; + reg = <0x0 0x700>; + clocks = <&cpufreq_hw 1>; + enable-method = "psci"; +- power-domains = <&CPU_PD7>; ++ power-domains = <&cpu_pd7>; + power-domain-names = "psci"; + capacity-dmips-mhz = <1024>; + dynamic-power-coefficient = <480>; +- next-level-cache = <&L2_700>; ++ next-level-cache = <&l2_700>; + operating-points-v2 = <&cpu6_opp_table>; + interconnects = <&gem_noc MASTER_APPSS_PROC 3 &mc_virt SLAVE_EBI1 3>, + <&osm_l3 MASTER_OSM_L3_APPS &osm_l3 SLAVE_OSM_L3>; + #cooling-cells = <2>; + qcom,freq-domain = <&cpufreq_hw 1>; +- L2_700: l2-cache { ++ l2_700: l2-cache { + compatible = "cache"; + cache-level = <2>; + cache-unified; +- next-level-cache = <&L3_0>; ++ next-level-cache = <&l3_0>; + }; + }; + + cpu-map { + cluster0 { + core0 { +- cpu = <&CPU0>; ++ cpu = <&cpu0>; + }; + + core1 { +- cpu = <&CPU1>; ++ cpu = <&cpu1>; + }; + + core2 { +- cpu = <&CPU2>; ++ cpu = <&cpu2>; + }; + + core3 { +- cpu = <&CPU3>; ++ cpu = <&cpu3>; + }; + + core4 { +- cpu = <&CPU4>; ++ cpu = <&cpu4>; + }; + + core5 { +- cpu = <&CPU5>; ++ cpu = <&cpu5>; + }; + + core6 { +- cpu = <&CPU6>; ++ cpu = <&cpu6>; + }; + + core7 { +- cpu = <&CPU7>; ++ cpu = <&cpu7>; + }; + }; + }; +@@ -313,7 +313,7 @@ + idle_states: idle-states { + entry-method = "psci"; + +- LITTLE_CPU_SLEEP_0: cpu-sleep-0-0 { ++ little_cpu_sleep_0: cpu-sleep-0-0 { + compatible = "arm,idle-state"; + idle-state-name = "little-power-down"; + arm,psci-suspend-param = <0x40000003>; +@@ -323,7 +323,7 @@ + local-timer-stop; + }; + +- LITTLE_CPU_SLEEP_1: cpu-sleep-0-1 { ++ little_cpu_sleep_1: cpu-sleep-0-1 { + compatible = "arm,idle-state"; + idle-state-name = "little-rail-power-down"; + arm,psci-suspend-param = <0x40000004>; +@@ -333,7 +333,7 @@ + local-timer-stop; + }; + +- BIG_CPU_SLEEP_0: cpu-sleep-1-0 { ++ big_cpu_sleep_0: cpu-sleep-1-0 { + compatible = "arm,idle-state"; + idle-state-name = "big-power-down"; + arm,psci-suspend-param = <0x40000003>; +@@ -343,7 +343,7 @@ + local-timer-stop; + }; + +- BIG_CPU_SLEEP_1: cpu-sleep-1-1 { ++ big_cpu_sleep_1: cpu-sleep-1-1 { + compatible = "arm,idle-state"; + idle-state-name = "big-rail-power-down"; + arm,psci-suspend-param = <0x40000004>; +@@ -355,7 +355,7 @@ + }; + + domain_idle_states: domain-idle-states { +- CLUSTER_SLEEP_PC: cluster-sleep-0 { ++ cluster_sleep_pc: cluster-sleep-0 { + compatible = "domain-idle-state"; + idle-state-name = "cluster-l3-power-collapse"; + arm,psci-suspend-param = <0x41000044>; +@@ -364,7 +364,7 @@ + min-residency-us = <6118>; + }; + +- CLUSTER_SLEEP_CX_RET: cluster-sleep-1 { ++ cluster_sleep_cx_ret: cluster-sleep-1 { + compatible = "domain-idle-state"; + idle-state-name = "cluster-cx-retention"; + arm,psci-suspend-param = <0x41001244>; +@@ -373,7 +373,7 @@ + min-residency-us = <8467>; + }; + +- CLUSTER_AOSS_SLEEP: cluster-sleep-2 { ++ cluster_aoss_sleep: cluster-sleep-2 { + compatible = "domain-idle-state"; + idle-state-name = "cluster-power-down"; + arm,psci-suspend-param = <0x4100b244>; +@@ -583,59 +583,59 @@ + compatible = "arm,psci-1.0"; + method = "smc"; + +- CPU_PD0: cpu0 { ++ cpu_pd0: cpu0 { + #power-domain-cells = <0>; +- power-domains = <&CLUSTER_PD>; +- domain-idle-states = <&LITTLE_CPU_SLEEP_0 &LITTLE_CPU_SLEEP_1>; ++ power-domains = <&cluster_pd>; ++ domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>; + }; + +- CPU_PD1: cpu1 { ++ cpu_pd1: cpu1 { + #power-domain-cells = <0>; +- power-domains = <&CLUSTER_PD>; +- domain-idle-states = <&LITTLE_CPU_SLEEP_0 &LITTLE_CPU_SLEEP_1>; ++ power-domains = <&cluster_pd>; ++ domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>; + }; + +- CPU_PD2: cpu2 { ++ cpu_pd2: cpu2 { + #power-domain-cells = <0>; +- power-domains = <&CLUSTER_PD>; +- domain-idle-states = <&LITTLE_CPU_SLEEP_0 &LITTLE_CPU_SLEEP_1>; ++ power-domains = <&cluster_pd>; ++ domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>; + }; + +- CPU_PD3: cpu3 { ++ cpu_pd3: cpu3 { + #power-domain-cells = <0>; +- power-domains = <&CLUSTER_PD>; +- domain-idle-states = <&LITTLE_CPU_SLEEP_0 &LITTLE_CPU_SLEEP_1>; ++ power-domains = <&cluster_pd>; ++ domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>; + }; + +- CPU_PD4: cpu4 { ++ cpu_pd4: cpu4 { + #power-domain-cells = <0>; +- power-domains = <&CLUSTER_PD>; +- domain-idle-states = <&LITTLE_CPU_SLEEP_0 &LITTLE_CPU_SLEEP_1>; ++ power-domains = <&cluster_pd>; ++ domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>; + }; + +- CPU_PD5: cpu5 { ++ cpu_pd5: cpu5 { + #power-domain-cells = <0>; +- power-domains = <&CLUSTER_PD>; +- domain-idle-states = <&LITTLE_CPU_SLEEP_0 &LITTLE_CPU_SLEEP_1>; ++ power-domains = <&cluster_pd>; ++ domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>; + }; + +- CPU_PD6: cpu6 { ++ cpu_pd6: cpu6 { + #power-domain-cells = <0>; +- power-domains = <&CLUSTER_PD>; +- domain-idle-states = <&BIG_CPU_SLEEP_0 &BIG_CPU_SLEEP_1>; ++ power-domains = <&cluster_pd>; ++ domain-idle-states = <&big_cpu_sleep_0 &big_cpu_sleep_1>; + }; + +- CPU_PD7: cpu7 { ++ cpu_pd7: cpu7 { + #power-domain-cells = <0>; +- power-domains = <&CLUSTER_PD>; +- domain-idle-states = <&BIG_CPU_SLEEP_0 &BIG_CPU_SLEEP_1>; ++ power-domains = <&cluster_pd>; ++ domain-idle-states = <&big_cpu_sleep_0 &big_cpu_sleep_1>; + }; + +- CLUSTER_PD: cpu-cluster0 { ++ cluster_pd: cpu-cluster0 { + #power-domain-cells = <0>; +- domain-idle-states = <&CLUSTER_SLEEP_PC +- &CLUSTER_SLEEP_CX_RET +- &CLUSTER_AOSS_SLEEP>; ++ domain-idle-states = <&cluster_sleep_pc ++ &cluster_sleep_cx_ret ++ &cluster_aoss_sleep>; + }; + }; + +@@ -2546,7 +2546,7 @@ + compatible = "arm,coresight-etm4x", "arm,primecell"; + reg = <0 0x07040000 0 0x1000>; + +- cpu = <&CPU0>; ++ cpu = <&cpu0>; + + clocks = <&aoss_qmp>; + clock-names = "apb_pclk"; +@@ -2566,7 +2566,7 @@ + compatible = "arm,coresight-etm4x", "arm,primecell"; + reg = <0 0x07140000 0 0x1000>; + +- cpu = <&CPU1>; ++ cpu = <&cpu1>; + + clocks = <&aoss_qmp>; + clock-names = "apb_pclk"; +@@ -2586,7 +2586,7 @@ + compatible = "arm,coresight-etm4x", "arm,primecell"; + reg = <0 0x07240000 0 0x1000>; + +- cpu = <&CPU2>; ++ cpu = <&cpu2>; + + clocks = <&aoss_qmp>; + clock-names = "apb_pclk"; +@@ -2606,7 +2606,7 @@ + compatible = "arm,coresight-etm4x", "arm,primecell"; + reg = <0 0x07340000 0 0x1000>; + +- cpu = <&CPU3>; ++ cpu = <&cpu3>; + + clocks = <&aoss_qmp>; + clock-names = "apb_pclk"; +@@ -2626,7 +2626,7 @@ + compatible = "arm,coresight-etm4x", "arm,primecell"; + reg = <0 0x07440000 0 0x1000>; + +- cpu = <&CPU4>; ++ cpu = <&cpu4>; + + clocks = <&aoss_qmp>; + clock-names = "apb_pclk"; +@@ -2646,7 +2646,7 @@ + compatible = "arm,coresight-etm4x", "arm,primecell"; + reg = <0 0x07540000 0 0x1000>; + +- cpu = <&CPU5>; ++ cpu = <&cpu5>; + + clocks = <&aoss_qmp>; + clock-names = "apb_pclk"; +@@ -2666,7 +2666,7 @@ + compatible = "arm,coresight-etm4x", "arm,primecell"; + reg = <0 0x07640000 0 0x1000>; + +- cpu = <&CPU6>; ++ cpu = <&cpu6>; + + clocks = <&aoss_qmp>; + clock-names = "apb_pclk"; +@@ -2686,7 +2686,7 @@ + compatible = "arm,coresight-etm4x", "arm,primecell"; + reg = <0 0x07740000 0 0x1000>; + +- cpu = <&CPU7>; ++ cpu = <&cpu7>; + + clocks = <&aoss_qmp>; + clock-names = "apb_pclk"; +@@ -3734,7 +3734,7 @@ + , + , + ; +- power-domains = <&CLUSTER_PD>; ++ power-domains = <&cluster_pd>; + + rpmhcc: clock-controller { + compatible = "qcom,sc7180-rpmh-clk"; +@@ -4063,21 +4063,21 @@ + cooling-maps { + map0 { + trip = <&cpu0_alert0>; +- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + map1 { + trip = <&cpu0_alert1>; +- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + }; + }; +@@ -4111,21 +4111,21 @@ + cooling-maps { + map0 { + trip = <&cpu1_alert0>; +- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + map1 { + trip = <&cpu1_alert1>; +- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + }; + }; +@@ -4159,21 +4159,21 @@ + cooling-maps { + map0 { + trip = <&cpu2_alert0>; +- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + map1 { + trip = <&cpu2_alert1>; +- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + }; + }; +@@ -4207,21 +4207,21 @@ + cooling-maps { + map0 { + trip = <&cpu3_alert0>; +- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + map1 { + trip = <&cpu3_alert1>; +- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + }; + }; +@@ -4255,21 +4255,21 @@ + cooling-maps { + map0 { + trip = <&cpu4_alert0>; +- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + map1 { + trip = <&cpu4_alert1>; +- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + }; + }; +@@ -4303,21 +4303,21 @@ + cooling-maps { + map0 { + trip = <&cpu5_alert0>; +- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + map1 { + trip = <&cpu5_alert1>; +- cooling-device = <&CPU0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu4 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu5 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + }; + }; +@@ -4351,13 +4351,13 @@ + cooling-maps { + map0 { + trip = <&cpu6_alert0>; +- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + map1 { + trip = <&cpu6_alert1>; +- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + }; + }; +@@ -4391,13 +4391,13 @@ + cooling-maps { + map0 { + trip = <&cpu7_alert0>; +- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + map1 { + trip = <&cpu7_alert1>; +- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + }; + }; +@@ -4431,13 +4431,13 @@ + cooling-maps { + map0 { + trip = <&cpu8_alert0>; +- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + map1 { + trip = <&cpu8_alert1>; +- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + }; + }; +@@ -4471,13 +4471,13 @@ + cooling-maps { + map0 { + trip = <&cpu9_alert0>; +- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + map1 { + trip = <&cpu9_alert1>; +- cooling-device = <&CPU6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, +- <&CPU7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ cooling-device = <&cpu6 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, ++ <&cpu7 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + }; + }; +diff --git a/arch/arm64/boot/dts/qcom/sm7125.dtsi b/arch/arm64/boot/dts/qcom/sm7125.dtsi +index 12dd72859a433..a53145a610a3c 100644 +--- a/arch/arm64/boot/dts/qcom/sm7125.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm7125.dtsi +@@ -6,11 +6,11 @@ + #include "sc7180.dtsi" + + /* SM7125 uses Kryo 465 instead of Kryo 468 */ +-&CPU0 { compatible = "qcom,kryo465"; }; +-&CPU1 { compatible = "qcom,kryo465"; }; +-&CPU2 { compatible = "qcom,kryo465"; }; +-&CPU3 { compatible = "qcom,kryo465"; }; +-&CPU4 { compatible = "qcom,kryo465"; }; +-&CPU5 { compatible = "qcom,kryo465"; }; +-&CPU6 { compatible = "qcom,kryo465"; }; +-&CPU7 { compatible = "qcom,kryo465"; }; ++&cpu0 { compatible = "qcom,kryo465"; }; ++&cpu1 { compatible = "qcom,kryo465"; }; ++&cpu2 { compatible = "qcom,kryo465"; }; ++&cpu3 { compatible = "qcom,kryo465"; }; ++&cpu4 { compatible = "qcom,kryo465"; }; ++&cpu5 { compatible = "qcom,kryo465"; }; ++&cpu6 { compatible = "qcom,kryo465"; }; ++&cpu7 { compatible = "qcom,kryo465"; }; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sc7180-fix-psci-power-domain-node-nam.patch b/queue-6.12/arm64-dts-qcom-sc7180-fix-psci-power-domain-node-nam.patch new file mode 100644 index 0000000000..f55d50f702 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sc7180-fix-psci-power-domain-node-nam.patch @@ -0,0 +1,96 @@ +From fbed2a4f779832cff33b9b0c2008cca4511f4861 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 13:44:48 +0100 +Subject: arm64: dts: qcom: sc7180: fix psci power domain node names + +From: Neil Armstrong + +[ Upstream commit 092febd32a99800902f865ed86b83314faa9c7e4 ] + +Rename the psci power domain node names to match the bindings. + +This Fixes: +sc7180-acer-aspire1.dts: psci: 'cpu-cluster0', 'cpu0', 'cpu1', 'cpu2', 'cpu3', 'cpu4', 'cpu5', 'cpu6', 'cpu7' do not match any of the regexes: '^power-domain-', 'pinctrl-[0-9]+' + +Reviewed-by: Douglas Anderson +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20241230-topic-misc-dt-fixes-v4-5-1e6880e9dda3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7180.dtsi | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi +index 19df1c8f7891b..249b257fc6a74 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi +@@ -583,55 +583,55 @@ + compatible = "arm,psci-1.0"; + method = "smc"; + +- cpu_pd0: cpu0 { ++ cpu_pd0: power-domain-cpu0 { + #power-domain-cells = <0>; + power-domains = <&cluster_pd>; + domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>; + }; + +- cpu_pd1: cpu1 { ++ cpu_pd1: power-domain-cpu1 { + #power-domain-cells = <0>; + power-domains = <&cluster_pd>; + domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>; + }; + +- cpu_pd2: cpu2 { ++ cpu_pd2: power-domain-cpu2 { + #power-domain-cells = <0>; + power-domains = <&cluster_pd>; + domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>; + }; + +- cpu_pd3: cpu3 { ++ cpu_pd3: power-domain-cpu3 { + #power-domain-cells = <0>; + power-domains = <&cluster_pd>; + domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>; + }; + +- cpu_pd4: cpu4 { ++ cpu_pd4: power-domain-cpu4 { + #power-domain-cells = <0>; + power-domains = <&cluster_pd>; + domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>; + }; + +- cpu_pd5: cpu5 { ++ cpu_pd5: power-domain-cpu5 { + #power-domain-cells = <0>; + power-domains = <&cluster_pd>; + domain-idle-states = <&little_cpu_sleep_0 &little_cpu_sleep_1>; + }; + +- cpu_pd6: cpu6 { ++ cpu_pd6: power-domain-cpu6 { + #power-domain-cells = <0>; + power-domains = <&cluster_pd>; + domain-idle-states = <&big_cpu_sleep_0 &big_cpu_sleep_1>; + }; + +- cpu_pd7: cpu7 { ++ cpu_pd7: power-domain-cpu7 { + #power-domain-cells = <0>; + power-domains = <&cluster_pd>; + domain-idle-states = <&big_cpu_sleep_0 &big_cpu_sleep_1>; + }; + +- cluster_pd: cpu-cluster0 { ++ cluster_pd: power-domain-cluster { + #power-domain-cells = <0>; + domain-idle-states = <&cluster_sleep_pc + &cluster_sleep_cx_ret +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sc7180-trogdor-pompom-rename-5v-choke.patch b/queue-6.12/arm64-dts-qcom-sc7180-trogdor-pompom-rename-5v-choke.patch new file mode 100644 index 0000000000..9ce45bfc42 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sc7180-trogdor-pompom-rename-5v-choke.patch @@ -0,0 +1,46 @@ +From 64bbc49cd652b43f248147715c19d369d890fb72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 13:44:47 +0100 +Subject: arm64: dts: qcom: sc7180-trogdor-pompom: rename 5v-choke thermal zone + +From: Neil Armstrong + +[ Upstream commit 9180b38d706c29ed212181a77999c35ae9ff6879 ] + +Rename the 5v-choke thermal zone to satisfy the bindings. + +This fixes: +sc7180-trogdor-pompom-r2-lte.dts: thermal-zones: '5v-choke-thermal' does not match any of the regexes: '^[a-zA-Z][a-zA-Z0-9\\-]{1,10}-thermal$', 'pinctrl-[0-9]+' + from schema $id: http://devicetree.org/schemas/thermal/thermal-zones.yaml# + +Reviewed-by: Douglas Anderson +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20241230-topic-misc-dt-fixes-v4-4-1e6880e9dda3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7180-trogdor-pompom.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-pompom.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor-pompom.dtsi +index ac8d4589e3fb7..f7300ffbb4519 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-pompom.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-pompom.dtsi +@@ -12,11 +12,11 @@ + + / { + thermal-zones { +- 5v-choke-thermal { ++ choke-5v-thermal { + thermal-sensors = <&pm6150_adc_tm 1>; + + trips { +- 5v-choke-crit { ++ choke-5v-crit { + temperature = <125000>; + hysteresis = <1000>; + type = "critical"; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sc7180-trogdor-quackingstick-add-miss.patch b/queue-6.12/arm64-dts-qcom-sc7180-trogdor-quackingstick-add-miss.patch new file mode 100644 index 0000000000..4432d0f3e9 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sc7180-trogdor-quackingstick-add-miss.patch @@ -0,0 +1,42 @@ +From 72078c9fb8740dd5fb846d6c04ccda81b336e51a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 13:44:46 +0100 +Subject: arm64: dts: qcom: sc7180-trogdor-quackingstick: add missing + avee-supply + +From: Neil Armstrong + +[ Upstream commit aa09de104d421e7ff8d8cde9af98568ce62a002c ] + +The bindings requires the avee-supply, use the same regulator as +the avdd (positive voltage) which would also provide the negative +voltage by definition. + +The fixes: +sc7180-trogdor-quackingstick-r0.dts: panel@0: 'avee-supply' is a required property + from schema $id: http://devicetree.org/schemas/display/panel/boe,tv101wum-nl6.yaml# + +Reviewed-by: Douglas Anderson +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20241230-topic-misc-dt-fixes-v4-3-1e6880e9dda3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7180-trogdor-quackingstick.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-quackingstick.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor-quackingstick.dtsi +index 00229b1515e60..ff8996b4de4e1 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-quackingstick.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-quackingstick.dtsi +@@ -78,6 +78,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&lcd_rst>; + avdd-supply = <&ppvar_lcd>; ++ avee-supply = <&ppvar_lcd>; + pp1800-supply = <&v1p8_disp>; + pp3300-supply = <&pp3300_dx_edp>; + backlight = <&backlight>; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sc7280-correct-sleep-clock-frequency.patch b/queue-6.12/arm64-dts-qcom-sc7280-correct-sleep-clock-frequency.patch new file mode 100644 index 0000000000..c906db0834 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sc7280-correct-sleep-clock-frequency.patch @@ -0,0 +1,38 @@ +From f093d0bb17f9ff7fccf41e32720dfba73542ec47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:17:07 +0200 +Subject: arm64: dts: qcom: sc7280: correct sleep clock frequency + +From: Dmitry Baryshkov + +[ Upstream commit f6ccdca14eac545320ab03d6ca91ca343e7372e5 ] + +The SC7280 platform uses PMK8350 to provide sleep clock. According to the +documentation, that clock has 32.7645 kHz frequency. Correct the sleep +clock definition. + +Fixes: 7a1f4e7f740d ("arm64: dts: qcom: sc7280: Add basic dts/dtsi files for sc7280 soc") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-8-e9b08fbeadd3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi +index 3d8410683402f..8fbc95cf63fe7 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi +@@ -83,7 +83,7 @@ + + sleep_clk: sleep-clk { + compatible = "fixed-clock"; +- clock-frequency = <32000>; ++ clock-frequency = <32764>; + #clock-cells = <0>; + }; + }; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sc8280xp-fix-interrupt-type-of-camss-.patch b/queue-6.12/arm64-dts-qcom-sc8280xp-fix-interrupt-type-of-camss-.patch new file mode 100644 index 0000000000..ba4856f4ef --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sc8280xp-fix-interrupt-type-of-camss-.patch @@ -0,0 +1,77 @@ +From 9f00eeaa7d010d6a4e2ca7f5d64ce4955d43bad0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Nov 2024 14:29:48 +0200 +Subject: arm64: dts: qcom: sc8280xp: Fix interrupt type of camss interrupts + +From: Vladimir Zapolskiy + +[ Upstream commit b08535cd41c27b4f32319b5bff754c9da6dc2205 ] + +Qualcomm IP catalog says that all CAMSS interrupts are edge rising, +fix it in the CAMSS device tree node for sc8280xp SoC. + +Fixes: 5994dd60753e ("arm64: dts: qcom: sc8280xp: camss: Add CAMSS block definition") +Signed-off-by: Vladimir Zapolskiy +Reviewed-by: Bryan O'Donoghue +Tested-by: Johan Hovold +Link: https://lore.kernel.org/r/20241127122950.885982-5-vladimir.zapolskiy@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 40 +++++++++++++------------- + 1 file changed, 20 insertions(+), 20 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +index 4debb4edaf3d1..b1e0e51a55829 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +@@ -3882,26 +3882,26 @@ + "vfe3", + "csid3"; + +- interrupts = , +- , +- , +- , +- , +- , +- , +- , +- , +- , +- , +- , +- , +- , +- , +- , +- , +- , +- , +- ; ++ interrupts = , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ ; + interrupt-names = "csid1_lite", + "vfe_lite1", + "csiphy3", +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sc8280xp-fix-up-remoteproc-register-s.patch b/queue-6.12/arm64-dts-qcom-sc8280xp-fix-up-remoteproc-register-s.patch new file mode 100644 index 0000000000..c4a9e8b8a7 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sc8280xp-fix-up-remoteproc-register-s.patch @@ -0,0 +1,58 @@ +From 0b0852984bb53e38962316ee28d9d604b1f10d0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Dec 2024 23:19:37 +0100 +Subject: arm64: dts: qcom: sc8280xp: Fix up remoteproc register space sizes + +From: Konrad Dybcio + +[ Upstream commit 7ec7e327286182c65d0b5b81dff498d620fe9e8c ] + +Make sure the remoteproc reg ranges reflect the entire register space +they refer to. + +Since they're unused by the driver, there's no functional change. + +Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") +Signed-off-by: Konrad Dybcio +Reviewed-by: Bryan O'Donoghue +Link: https://lore.kernel.org/r/20241212-topic-8280_rproc_reg-v1-1-bd1c696e91b0@oss.qualcomm.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +index 80a57aa228397..4debb4edaf3d1 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +@@ -2725,7 +2725,7 @@ + + remoteproc_adsp: remoteproc@3000000 { + compatible = "qcom,sc8280xp-adsp-pas"; +- reg = <0 0x03000000 0 0x100>; ++ reg = <0 0x03000000 0 0x10000>; + + interrupts-extended = <&intc GIC_SPI 162 IRQ_TYPE_EDGE_RISING>, + <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>, +@@ -5205,7 +5205,7 @@ + + remoteproc_nsp0: remoteproc@1b300000 { + compatible = "qcom,sc8280xp-nsp0-pas"; +- reg = <0 0x1b300000 0 0x100>; ++ reg = <0 0x1b300000 0 0x10000>; + + interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>, + <&smp2p_nsp0_in 0 IRQ_TYPE_EDGE_RISING>, +@@ -5336,7 +5336,7 @@ + + remoteproc_nsp1: remoteproc@21300000 { + compatible = "qcom,sc8280xp-nsp1-pas"; +- reg = <0 0x21300000 0 0x100>; ++ reg = <0 0x21300000 0 0x10000>; + + interrupts-extended = <&intc GIC_SPI 887 IRQ_TYPE_EDGE_RISING>, + <&smp2p_nsp1_in 0 IRQ_TYPE_EDGE_RISING>, +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sdm845-db845c-navigation-mezzanine-co.patch b/queue-6.12/arm64-dts-qcom-sdm845-db845c-navigation-mezzanine-co.patch new file mode 100644 index 0000000000..17300119b0 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sdm845-db845c-navigation-mezzanine-co.patch @@ -0,0 +1,84 @@ +From 2db447189046c6d8aa5dad049f029c340009101e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2024 16:43:24 +0100 +Subject: arm64: dts: qcom: sdm845-db845c-navigation-mezzanine: Convert + mezzanine riser to dtso + +From: Bryan O'Donoghue + +[ Upstream commit 30df676a31b7a4881352097d8ae7c2bb83515a17 ] + +Convert the navigation / camera mezzanine from its own dts to a dtso. A +small amount of additional includes / address / cell size change needs to +be applied to convert. + +Tested-by: Bryan O'Donoghue # rb3 +Signed-off-by: Bryan O'Donoghue +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20241025-b4-linux-next-24-10-25-camss-dts-fixups-v1-2-cdff2f1a5792@linaro.org +[bjorn: Corrected up makefile syntax, added missing cells for cci_i2c1] +Signed-off-by: Bjorn Andersson +Stable-dep-of: 80b47f14d543 ("arm64: dts: qcom: sdm845-db845c-navigation-mezzanine: remove disabled ov7251 camera") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/Makefile | 3 +++ + ...ine.dts => sdm845-db845c-navigation-mezzanine.dtso} | 10 +++++++++- + 2 files changed, 12 insertions(+), 1 deletion(-) + rename arch/arm64/boot/dts/qcom/{sdm845-db845c-navigation-mezzanine.dts => sdm845-db845c-navigation-mezzanine.dtso} (91%) + +diff --git a/arch/arm64/boot/dts/qcom/Makefile b/arch/arm64/boot/dts/qcom/Makefile +index ae002c7cf1268..b13c169ec70d2 100644 +--- a/arch/arm64/boot/dts/qcom/Makefile ++++ b/arch/arm64/boot/dts/qcom/Makefile +@@ -207,6 +207,9 @@ dtb-$(CONFIG_ARCH_QCOM) += sdm845-cheza-r1.dtb + dtb-$(CONFIG_ARCH_QCOM) += sdm845-cheza-r2.dtb + dtb-$(CONFIG_ARCH_QCOM) += sdm845-cheza-r3.dtb + dtb-$(CONFIG_ARCH_QCOM) += sdm845-db845c.dtb ++ ++sdm845-db845c-navigation-mezzanine-dtbs := sdm845-db845c.dtb sdm845-db845c-navigation-mezzanine.dtbo ++ + dtb-$(CONFIG_ARCH_QCOM) += sdm845-db845c-navigation-mezzanine.dtb + dtb-$(CONFIG_ARCH_QCOM) += sdm845-lg-judyln.dtb + dtb-$(CONFIG_ARCH_QCOM) += sdm845-lg-judyp.dtb +diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c-navigation-mezzanine.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c-navigation-mezzanine.dtso +similarity index 91% +rename from arch/arm64/boot/dts/qcom/sdm845-db845c-navigation-mezzanine.dts +rename to arch/arm64/boot/dts/qcom/sdm845-db845c-navigation-mezzanine.dtso +index a21caa6f3fa25..b5f717d0ddd97 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-db845c-navigation-mezzanine.dts ++++ b/arch/arm64/boot/dts/qcom/sdm845-db845c-navigation-mezzanine.dtso +@@ -4,8 +4,10 @@ + */ + + /dts-v1/; ++/plugin/; + +-#include "sdm845-db845c.dts" ++#include ++#include + + &camss { + vdda-phy-supply = <&vreg_l1a_0p875>; +@@ -28,6 +30,9 @@ + }; + + &cci_i2c0 { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ + camera@10 { + compatible = "ovti,ov8856"; + reg = <0x10>; +@@ -65,6 +70,9 @@ + }; + + &cci_i2c1 { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ + camera@60 { + compatible = "ovti,ov7251"; + +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sdm845-db845c-navigation-mezzanine-re.patch b/queue-6.12/arm64-dts-qcom-sdm845-db845c-navigation-mezzanine-re.patch new file mode 100644 index 0000000000..824a177d3d --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sdm845-db845c-navigation-mezzanine-re.patch @@ -0,0 +1,83 @@ +From d3daac04393bf824f77cb89e4edaec746ca7338c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 13:44:45 +0100 +Subject: arm64: dts: qcom: sdm845-db845c-navigation-mezzanine: remove disabled + ov7251 camera + +From: Neil Armstrong + +[ Upstream commit 80b47f14d5433068dd6738c9e6e17ff6648bae41 ] + +The ov7251node has bindings check errors in the endpoint, and the +camera node was disabled since the beginning. Even when switching the +node to okay, the endpoint description to the csiphy is missing along +with the csiphy parameters. + +Drop the ov7251 camera entirely until it's properly described. + +This obviously fixes: +sdm845-db845c-navigation-mezzanine.dtso: camera@60: port:endpoint:data-lanes: [0, 1] is too long + from schema $id: http://devicetree.org/schemas/media/i2c/ovti,ov7251.yaml# + +Reviewed-by: Konrad Dybcio +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20241230-topic-misc-dt-fixes-v4-2-1e6880e9dda3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + .../sdm845-db845c-navigation-mezzanine.dtso | 42 ------------------- + 1 file changed, 42 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c-navigation-mezzanine.dtso b/arch/arm64/boot/dts/qcom/sdm845-db845c-navigation-mezzanine.dtso +index b5f717d0ddd97..51f1a4883ab8f 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-db845c-navigation-mezzanine.dtso ++++ b/arch/arm64/boot/dts/qcom/sdm845-db845c-navigation-mezzanine.dtso +@@ -68,45 +68,3 @@ + }; + }; + }; +- +-&cci_i2c1 { +- #address-cells = <1>; +- #size-cells = <0>; +- +- camera@60 { +- compatible = "ovti,ov7251"; +- +- /* I2C address as per ov7251.txt linux documentation */ +- reg = <0x60>; +- +- /* CAM3_RST_N */ +- enable-gpios = <&tlmm 21 GPIO_ACTIVE_HIGH>; +- pinctrl-names = "default"; +- pinctrl-0 = <&cam3_default>; +- +- clocks = <&clock_camcc CAM_CC_MCLK3_CLK>; +- clock-names = "xclk"; +- clock-frequency = <24000000>; +- +- /* +- * The &vreg_s4a_1p8 trace always powered on. +- * +- * The 2.8V vdda-supply regulator is enabled when the +- * vreg_s4a_1p8 trace is pulled high. +- * It too is represented by a fixed regulator. +- * +- * No 1.2V vddd-supply regulator is used. +- */ +- vdddo-supply = <&vreg_lvs1a_1p8>; +- vdda-supply = <&cam3_avdd_2v8>; +- +- status = "disabled"; +- +- port { +- ov7251_ep: endpoint { +- data-lanes = <0 1>; +-/* remote-endpoint = <&csiphy3_ep>; */ +- }; +- }; +- }; +-}; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sdm845-fix-interrupt-types-of-camss-i.patch b/queue-6.12/arm64-dts-qcom-sdm845-fix-interrupt-types-of-camss-i.patch new file mode 100644 index 0000000000..881e7d621d --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sdm845-fix-interrupt-types-of-camss-i.patch @@ -0,0 +1,56 @@ +From ea607294f0fb944d7ce6bcf70b5b618a9472e91b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Nov 2024 14:29:49 +0200 +Subject: arm64: dts: qcom: sdm845: Fix interrupt types of camss interrupts + +From: Vladimir Zapolskiy + +[ Upstream commit cb96722b728e81ad97f5b5b20dea64cd294a5452 ] + +Qualcomm IP catalog says that all CAMSS interrupts is edge rising, +fix it in the CAMSS device tree node for sdm845 SoC. + +Fixes: d48a6698a6b7 ("arm64: dts: qcom: sdm845: Add CAMSS ISP node") +Signed-off-by: Vladimir Zapolskiy +Reviewed-by: Bryan O'Donoghue +Link: https://lore.kernel.org/r/20241127122950.885982-6-vladimir.zapolskiy@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845.dtsi | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index 54077549b9da7..0a0cef9dfcc41 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -4326,16 +4326,16 @@ + "vfe1", + "vfe_lite"; + +- interrupts = , +- , +- , +- , +- , +- , +- , +- , +- , +- ; ++ interrupts = , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ ; + interrupt-names = "csid0", + "csid1", + "csid2", +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sdx75-correct-sleep-clock-frequency.patch b/queue-6.12/arm64-dts-qcom-sdx75-correct-sleep-clock-frequency.patch new file mode 100644 index 0000000000..ffdb3f47e2 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sdx75-correct-sleep-clock-frequency.patch @@ -0,0 +1,38 @@ +From 29331c3d4f11ea76d055bdde973730464a756344 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:17:08 +0200 +Subject: arm64: dts: qcom: sdx75: correct sleep clock frequency + +From: Dmitry Baryshkov + +[ Upstream commit b8021da9ddc65fa041e12ea1e0ff2dfce5c926eb ] + +The SDX75 platform uses PMK8550 to provide sleep clock. According to the +documentation, that clock has 32.7645 kHz frequency. Correct the sleep +clock definition. + +Fixes: 9181bb939984 ("arm64: dts: qcom: Add SDX75 platform and IDP board support") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-9-e9b08fbeadd3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdx75.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdx75.dtsi b/arch/arm64/boot/dts/qcom/sdx75.dtsi +index 7cf3fcb469a86..dcb925348e3f3 100644 +--- a/arch/arm64/boot/dts/qcom/sdx75.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdx75.dtsi +@@ -34,7 +34,7 @@ + + sleep_clk: sleep-clk { + compatible = "fixed-clock"; +- clock-frequency = <32000>; ++ clock-frequency = <32764>; + #clock-cells = <0>; + }; + }; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sm4450-correct-sleep-clock-frequency.patch b/queue-6.12/arm64-dts-qcom-sm4450-correct-sleep-clock-frequency.patch new file mode 100644 index 0000000000..aed4594cc2 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sm4450-correct-sleep-clock-frequency.patch @@ -0,0 +1,38 @@ +From 8d7e839ca9a74c803030612a8e39bb584b486909 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:17:09 +0200 +Subject: arm64: dts: qcom: sm4450: correct sleep clock frequency + +From: Dmitry Baryshkov + +[ Upstream commit 158e67cf3619dbb5b9914bb364889041f4b90eea ] + +The SM4450 platform uses PM4450 to provide sleep clock. According to the +documentation, that clock has 32.7645 kHz frequency. Correct the sleep +clock definition. + +Fixes: 7a1fd03e7410 ("arm64: dts: qcom: Adds base SM4450 DTSI") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-10-e9b08fbeadd3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm4450.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm4450.dtsi b/arch/arm64/boot/dts/qcom/sm4450.dtsi +index 1e05cd00b635e..0bbacab6842c3 100644 +--- a/arch/arm64/boot/dts/qcom/sm4450.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm4450.dtsi +@@ -29,7 +29,7 @@ + + sleep_clk: sleep-clk { + compatible = "fixed-clock"; +- clock-frequency = <32000>; ++ clock-frequency = <32764>; + #clock-cells = <0>; + }; + +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sm6125-correct-sleep-clock-frequency.patch b/queue-6.12/arm64-dts-qcom-sm6125-correct-sleep-clock-frequency.patch new file mode 100644 index 0000000000..df04f721c9 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sm6125-correct-sleep-clock-frequency.patch @@ -0,0 +1,38 @@ +From 8191232a7a02dbf80b69d4706547ed84cb659f01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:17:10 +0200 +Subject: arm64: dts: qcom: sm6125: correct sleep clock frequency + +From: Dmitry Baryshkov + +[ Upstream commit b3c547e1507862f0e4d46432b665c5c6e61e14d6 ] + +The SM6125 platform uses PM6125 to provide sleep clock. According to the +documentation, that clock has 32.7645 kHz frequency. Correct the sleep +clock definition. + +Fixes: cff4bbaf2a2d ("arm64: dts: qcom: Add support for SM6125") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-11-e9b08fbeadd3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm6125.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm6125.dtsi b/arch/arm64/boot/dts/qcom/sm6125.dtsi +index 133610d14fc41..1f7fd429ad428 100644 +--- a/arch/arm64/boot/dts/qcom/sm6125.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm6125.dtsi +@@ -28,7 +28,7 @@ + sleep_clk: sleep-clk { + compatible = "fixed-clock"; + #clock-cells = <0>; +- clock-frequency = <32000>; ++ clock-frequency = <32764>; + clock-output-names = "sleep_clk"; + }; + }; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sm6375-correct-sleep-clock-frequency.patch b/queue-6.12/arm64-dts-qcom-sm6375-correct-sleep-clock-frequency.patch new file mode 100644 index 0000000000..a3e4354dff --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sm6375-correct-sleep-clock-frequency.patch @@ -0,0 +1,38 @@ +From f6620836a3934c0b9f8f10ffef075cc218049a9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:17:11 +0200 +Subject: arm64: dts: qcom: sm6375: correct sleep clock frequency + +From: Dmitry Baryshkov + +[ Upstream commit 223382c94f1f07c475d39713e4c058401480b441 ] + +The SM6375 platform uses PM6125 to provide sleep clock. According to the +documentation, that clock has 32.7645 kHz frequency. Correct the sleep +clock definition. + +Fixes: 59d34ca97f91 ("arm64: dts: qcom: Add initial device tree for SM6375") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-12-e9b08fbeadd3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm6375.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm6375.dtsi b/arch/arm64/boot/dts/qcom/sm6375.dtsi +index 4d519dd6e7ef2..72e01437ded12 100644 +--- a/arch/arm64/boot/dts/qcom/sm6375.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm6375.dtsi +@@ -29,7 +29,7 @@ + + sleep_clk: sleep-clk { + compatible = "fixed-clock"; +- clock-frequency = <32000>; ++ clock-frequency = <32764>; + #clock-cells = <0>; + }; + }; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sm7225-fairphone-fp4-drop-extra-qcom-.patch b/queue-6.12/arm64-dts-qcom-sm7225-fairphone-fp4-drop-extra-qcom-.patch new file mode 100644 index 0000000000..6cb438e153 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sm7225-fairphone-fp4-drop-extra-qcom-.patch @@ -0,0 +1,38 @@ +From ab00fb3ac2e09e58f608eaaf1bf457de9df72885 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2024 09:55:01 +0100 +Subject: arm64: dts: qcom: sm7225-fairphone-fp4: Drop extra qcom,msm-id value + +From: Luca Weiss + +[ Upstream commit 7fb88e0d4dc1a40a29d49b603faa1484334c60f3 ] + +The ID 434 is for SM6350 while 459 is for SM7225. Fairphone 4 is only +SM7225, so drop the unused 434 entry. + +Fixes: 4cbea668767d ("arm64: dts: qcom: sm7225: Add device tree for Fairphone 4") +Signed-off-by: Luca Weiss +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20241220-fp4-msm-id-v1-1-2b75af02032a@fairphone.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts b/arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts +index 2ee2561b57b1d..52b16a4fdc432 100644 +--- a/arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts ++++ b/arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts +@@ -32,7 +32,7 @@ + chassis-type = "handset"; + + /* required for bootloader to select correct board */ +- qcom,msm-id = <434 0x10000>, <459 0x10000>; ++ qcom,msm-id = <459 0x10000>; + qcom,board-id = <8 32>; + + aliases { +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sm8150-microsoft-surface-duo-fix-typo.patch b/queue-6.12/arm64-dts-qcom-sm8150-microsoft-surface-duo-fix-typo.patch new file mode 100644 index 0000000000..361f4703d4 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sm8150-microsoft-surface-duo-fix-typo.patch @@ -0,0 +1,53 @@ +From b5475ea73ca9dbd16733b5c3492a06a1f1e48122 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 13:44:49 +0100 +Subject: arm64: dts: qcom: sm8150-microsoft-surface-duo: fix typos in da7280 + properties + +From: Neil Armstrong + +[ Upstream commit 9875adffb87da5c40f4013e55104f5e2fc071c2a ] + +The dlg,const-op-mode & dlg,periodic-op-mode were mis-names with twice +the "dlg," prefix, drop one to match the bindings. + +This fixes: +sm8150-microsoft-surface-duo.dtb: da7280@4a: 'dlg,const-op-mode' is a required property + from schema $id: http://devicetree.org/schemas/input/dlg,da7280.yaml# +m8150-microsoft-surface-duo.dtb: da7280@4a: 'dlg,periodic-op-mode' is a required property + from schema $id: http://devicetree.org/schemas/input/dlg,da7280.yaml# +sm8150-microsoft-surface-duo.dtb: da7280@4a: 'dlg,dlg,const-op-mode', 'dlg,dlg,periodic-op-mode' do not match any of the regexes: 'pinctrl-[0-9]+' + from schema $id: http://devicetree.org/schemas/input/dlg,da7280.yaml# + +With the dlg,da7280.yaml converted from dlg,da7280.txt at [1]. + +[1] https://lore.kernel.org/all/20241206-topic-misc-da7280-convert-v2-1-1c3539f75604@linaro.org/ + +Fixes: d1f781db47a8 ("arm64: dts: qcom: add initial device-tree for Microsoft Surface Duo") +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20241230-topic-misc-dt-fixes-v4-6-1e6880e9dda3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8150-microsoft-surface-duo.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8150-microsoft-surface-duo.dts b/arch/arm64/boot/dts/qcom/sm8150-microsoft-surface-duo.dts +index b039773c44653..a1323a8b8e6bf 100644 +--- a/arch/arm64/boot/dts/qcom/sm8150-microsoft-surface-duo.dts ++++ b/arch/arm64/boot/dts/qcom/sm8150-microsoft-surface-duo.dts +@@ -376,8 +376,8 @@ + pinctrl-0 = <&da7280_intr_default>; + + dlg,actuator-type = "LRA"; +- dlg,dlg,const-op-mode = <1>; +- dlg,dlg,periodic-op-mode = <1>; ++ dlg,const-op-mode = <1>; ++ dlg,periodic-op-mode = <1>; + dlg,nom-microvolt = <2000000>; + dlg,abs-max-microvolt = <2000000>; + dlg,imax-microamp = <129000>; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sm8250-correct-sleep-clock-frequency.patch b/queue-6.12/arm64-dts-qcom-sm8250-correct-sleep-clock-frequency.patch new file mode 100644 index 0000000000..f6ee564c21 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sm8250-correct-sleep-clock-frequency.patch @@ -0,0 +1,38 @@ +From fb9240d63fd7c2c94f2a4392f6835d936494be61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:17:12 +0200 +Subject: arm64: dts: qcom: sm8250: correct sleep clock frequency + +From: Dmitry Baryshkov + +[ Upstream commit 75420e437eed69fa95d1d7c339dad86dea35319a ] + +The SM8250 platform uses PM8150 to provide sleep clock. According to the +documentation, that clock has 32.7645 kHz frequency. Correct the sleep +clock definition. + +Fixes: 9ff8b0591fcf ("arm64: dts: qcom: sm8250: use the right clock-freqency for sleep-clk") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-13-e9b08fbeadd3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi +index 630f4eff20bf8..22d99e4cf96d2 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi +@@ -84,7 +84,7 @@ + + sleep_clk: sleep-clk { + compatible = "fixed-clock"; +- clock-frequency = <32768>; ++ clock-frequency = <32764>; + #clock-cells = <0>; + }; + }; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sm8250-fix-interrupt-types-of-camss-i.patch b/queue-6.12/arm64-dts-qcom-sm8250-fix-interrupt-types-of-camss-i.patch new file mode 100644 index 0000000000..5b854699e0 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sm8250-fix-interrupt-types-of-camss-i.patch @@ -0,0 +1,64 @@ +From 7c3c98f09697c18f34f21083d87109b5edce2f8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Nov 2024 14:29:50 +0200 +Subject: arm64: dts: qcom: sm8250: Fix interrupt types of camss interrupts + +From: Vladimir Zapolskiy + +[ Upstream commit 6c7bba42ebc3da56e64d4aec4c4a31dd454e05fd ] + +Qualcomm IP catalog says that all CAMSS interrupts is edge rising, +fix it in the CAMSS device tree node for sm8250 SoC. + +Fixes: 30325603b910 ("arm64: dts: qcom: sm8250: camss: Add CAMSS block definition") +Signed-off-by: Vladimir Zapolskiy +Reviewed-by: Bryan O'Donoghue +Link: https://lore.kernel.org/r/20241127122950.885982-7-vladimir.zapolskiy@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8250.dtsi | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi +index 22d99e4cf96d2..faa36d17b9f2c 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi +@@ -4481,20 +4481,20 @@ + "vfe_lite0", + "vfe_lite1"; + +- interrupts = , +- , +- , +- , +- , +- , +- , +- , +- , +- , +- , +- , +- , +- ; ++ interrupts = , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ ; + interrupt-names = "csiphy0", + "csiphy1", + "csiphy2", +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sm8350-correct-sleep-clock-frequency.patch b/queue-6.12/arm64-dts-qcom-sm8350-correct-sleep-clock-frequency.patch new file mode 100644 index 0000000000..b74e4c1c19 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sm8350-correct-sleep-clock-frequency.patch @@ -0,0 +1,38 @@ +From 9a39a2a8628bcf7c3206e88884809c81ea79415d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:17:13 +0200 +Subject: arm64: dts: qcom: sm8350: correct sleep clock frequency + +From: Dmitry Baryshkov + +[ Upstream commit f4cc8c75cfc5d06084a31da2ff67e477565f0cae ] + +The SM8350 platform uses PMK8350 to provide sleep clock. According to the +documentation, that clock has 32.7645 kHz frequency. Correct the sleep +clock definition. + +Fixes: b7e8f433a673 ("arm64: dts: qcom: Add basic devicetree support for SM8350 SoC") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-14-e9b08fbeadd3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8350.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi +index 37a2aba0d4cae..041750d71e455 100644 +--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi +@@ -42,7 +42,7 @@ + + sleep_clk: sleep-clk { + compatible = "fixed-clock"; +- clock-frequency = <32000>; ++ clock-frequency = <32764>; + #clock-cells = <0>; + }; + }; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sm8450-correct-sleep-clock-frequency.patch b/queue-6.12/arm64-dts-qcom-sm8450-correct-sleep-clock-frequency.patch new file mode 100644 index 0000000000..84abec217d --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sm8450-correct-sleep-clock-frequency.patch @@ -0,0 +1,38 @@ +From 54bf2eb1472c1b4a95e0002e49a7c46083980830 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:17:14 +0200 +Subject: arm64: dts: qcom: sm8450: correct sleep clock frequency + +From: Dmitry Baryshkov + +[ Upstream commit c375ff3b887abf376607d4769c1114c5e3b6ea72 ] + +The SM8450 platform uses PMK8350 to provide sleep clock. According to the +documentation, that clock has 32.7645 kHz frequency. Correct the sleep +clock definition. + +Fixes: 5188049c9b36 ("arm64: dts: qcom: Add base SM8450 DTSI") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-15-e9b08fbeadd3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8450.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi +index 38cb524cc5689..f7d52e491b694 100644 +--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi +@@ -43,7 +43,7 @@ + sleep_clk: sleep-clk { + compatible = "fixed-clock"; + #clock-cells = <0>; +- clock-frequency = <32000>; ++ clock-frequency = <32764>; + }; + }; + +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sm8550-correct-sleep-clock-frequency.patch b/queue-6.12/arm64-dts-qcom-sm8550-correct-sleep-clock-frequency.patch new file mode 100644 index 0000000000..80c438f7c3 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sm8550-correct-sleep-clock-frequency.patch @@ -0,0 +1,113 @@ +From fb3271fbece9a7317d063e7f2f5fcc2ea063088a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:17:15 +0200 +Subject: arm64: dts: qcom: sm8550: correct sleep clock frequency + +From: Dmitry Baryshkov + +[ Upstream commit e59334a088c3e722c0a287d4616af997f46c985e ] + +The SM8550 platform uses PMK8550 to provide sleep clock. According to the +documentation, that clock has 32.7645 kHz frequency. Correct the sleep +clock definition. + +Fixes: 0b12da4e28d8 ("arm64: dts: qcom: add base AIM300 dtsi") +Fixes: b5e25ded2721 ("arm64: dts: qcom: sm8550: add support for the SM8550-HDK board") +Fixes: 71342fb91eae ("arm64: dts: qcom: Add base SM8550 MTP dts") +Fixes: d228efe88469 ("arm64: dts: qcom: sm8550-qrd: add QRD8550") +Fixes: ba2c082a401f ("arm64: dts: qcom: sm8550: Add support for Samsung Galaxy Z Fold5") +Fixes: 39c596304e44 ("arm64: dts: qcom: Add SM8550 Xperia 1 V") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-16-e9b08fbeadd3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/qcs8550-aim300.dtsi | 2 +- + arch/arm64/boot/dts/qcom/sm8550-hdk.dts | 2 +- + arch/arm64/boot/dts/qcom/sm8550-mtp.dts | 2 +- + arch/arm64/boot/dts/qcom/sm8550-qrd.dts | 2 +- + arch/arm64/boot/dts/qcom/sm8550-samsung-q5q.dts | 2 +- + arch/arm64/boot/dts/qcom/sm8550-sony-xperia-yodo-pdx234.dts | 2 +- + 6 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/qcs8550-aim300.dtsi b/arch/arm64/boot/dts/qcom/qcs8550-aim300.dtsi +index f6960e2d466a2..e6ac529e6b721 100644 +--- a/arch/arm64/boot/dts/qcom/qcs8550-aim300.dtsi ++++ b/arch/arm64/boot/dts/qcom/qcs8550-aim300.dtsi +@@ -367,7 +367,7 @@ + }; + + &sleep_clk { +- clock-frequency = <32000>; ++ clock-frequency = <32764>; + }; + + &ufs_mem_hc { +diff --git a/arch/arm64/boot/dts/qcom/sm8550-hdk.dts b/arch/arm64/boot/dts/qcom/sm8550-hdk.dts +index 01c9216026057..29bc1ddfc7b25 100644 +--- a/arch/arm64/boot/dts/qcom/sm8550-hdk.dts ++++ b/arch/arm64/boot/dts/qcom/sm8550-hdk.dts +@@ -1172,7 +1172,7 @@ + }; + + &sleep_clk { +- clock-frequency = <32000>; ++ clock-frequency = <32764>; + }; + + &swr0 { +diff --git a/arch/arm64/boot/dts/qcom/sm8550-mtp.dts b/arch/arm64/boot/dts/qcom/sm8550-mtp.dts +index ab447fc252f7d..5648ab60ba4c4 100644 +--- a/arch/arm64/boot/dts/qcom/sm8550-mtp.dts ++++ b/arch/arm64/boot/dts/qcom/sm8550-mtp.dts +@@ -825,7 +825,7 @@ + }; + + &sleep_clk { +- clock-frequency = <32000>; ++ clock-frequency = <32764>; + }; + + &swr0 { +diff --git a/arch/arm64/boot/dts/qcom/sm8550-qrd.dts b/arch/arm64/boot/dts/qcom/sm8550-qrd.dts +index 6052dd922ec55..3a6cb27913048 100644 +--- a/arch/arm64/boot/dts/qcom/sm8550-qrd.dts ++++ b/arch/arm64/boot/dts/qcom/sm8550-qrd.dts +@@ -1005,7 +1005,7 @@ + }; + + &sleep_clk { +- clock-frequency = <32000>; ++ clock-frequency = <32764>; + }; + + &swr0 { +diff --git a/arch/arm64/boot/dts/qcom/sm8550-samsung-q5q.dts b/arch/arm64/boot/dts/qcom/sm8550-samsung-q5q.dts +index 3d351e90bb398..62a6b90697b06 100644 +--- a/arch/arm64/boot/dts/qcom/sm8550-samsung-q5q.dts ++++ b/arch/arm64/boot/dts/qcom/sm8550-samsung-q5q.dts +@@ -565,7 +565,7 @@ + }; + + &sleep_clk { +- clock-frequency = <32000>; ++ clock-frequency = <32764>; + }; + + &tlmm { +diff --git a/arch/arm64/boot/dts/qcom/sm8550-sony-xperia-yodo-pdx234.dts b/arch/arm64/boot/dts/qcom/sm8550-sony-xperia-yodo-pdx234.dts +index 85d487ef80a0b..d90dc7b37c4a7 100644 +--- a/arch/arm64/boot/dts/qcom/sm8550-sony-xperia-yodo-pdx234.dts ++++ b/arch/arm64/boot/dts/qcom/sm8550-sony-xperia-yodo-pdx234.dts +@@ -722,7 +722,7 @@ + }; + + &sleep_clk { +- clock-frequency = <32000>; ++ clock-frequency = <32764>; + }; + + &tlmm { +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sm8650-correct-sleep-clock-frequency.patch b/queue-6.12/arm64-dts-qcom-sm8650-correct-sleep-clock-frequency.patch new file mode 100644 index 0000000000..2277a6b71a --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sm8650-correct-sleep-clock-frequency.patch @@ -0,0 +1,68 @@ +From 2c46afd241ea17cd7a342730a34c566d2e09618d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:17:16 +0200 +Subject: arm64: dts: qcom: sm8650: correct sleep clock frequency + +From: Dmitry Baryshkov + +[ Upstream commit 448db0ba6ad2aafee2cbd91b491246749f6a6abc ] + +The SM8650 platform uses PMK8550 to provide sleep clock. According to the +documentation, that clock has 32.7645 kHz frequency. Correct the sleep +clock definition. + +Fixes: 6fbdb3c1fac7 ("arm64: dts: qcom: sm8650: add initial SM8650 MTP dts") +Fixes: a834911d50c1 ("arm64: dts: qcom: sm8650: add initial SM8650 QRD dts") +Fixes: 01061441029e ("arm64: dts: qcom: sm8650: add support for the SM8650-HDK board") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-17-e9b08fbeadd3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8650-hdk.dts | 2 +- + arch/arm64/boot/dts/qcom/sm8650-mtp.dts | 2 +- + arch/arm64/boot/dts/qcom/sm8650-qrd.dts | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8650-hdk.dts b/arch/arm64/boot/dts/qcom/sm8650-hdk.dts +index 127c7aacd4fc3..59363267d2e0a 100644 +--- a/arch/arm64/boot/dts/qcom/sm8650-hdk.dts ++++ b/arch/arm64/boot/dts/qcom/sm8650-hdk.dts +@@ -1117,7 +1117,7 @@ + }; + + &sleep_clk { +- clock-frequency = <32000>; ++ clock-frequency = <32764>; + }; + + &swr0 { +diff --git a/arch/arm64/boot/dts/qcom/sm8650-mtp.dts b/arch/arm64/boot/dts/qcom/sm8650-mtp.dts +index c63822f5b1278..74275ca668c76 100644 +--- a/arch/arm64/boot/dts/qcom/sm8650-mtp.dts ++++ b/arch/arm64/boot/dts/qcom/sm8650-mtp.dts +@@ -734,7 +734,7 @@ + }; + + &sleep_clk { +- clock-frequency = <32000>; ++ clock-frequency = <32764>; + }; + + &swr0 { +diff --git a/arch/arm64/boot/dts/qcom/sm8650-qrd.dts b/arch/arm64/boot/dts/qcom/sm8650-qrd.dts +index 8ca0d28eba9bd..1689699d6de71 100644 +--- a/arch/arm64/boot/dts/qcom/sm8650-qrd.dts ++++ b/arch/arm64/boot/dts/qcom/sm8650-qrd.dts +@@ -1045,7 +1045,7 @@ + }; + + &sleep_clk { +- clock-frequency = <32000>; ++ clock-frequency = <32764>; + }; + + &spi4 { +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-sm8650-fix-cdsp-context-banks-unit-ad.patch b/queue-6.12/arm64-dts-qcom-sm8650-fix-cdsp-context-banks-unit-ad.patch new file mode 100644 index 0000000000..20a6d227ea --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sm8650-fix-cdsp-context-banks-unit-ad.patch @@ -0,0 +1,62 @@ +From bbbb9a3efec23279bb20636c69f8257e35b6983a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Nov 2024 15:42:04 +0100 +Subject: arm64: dts: qcom: sm8650: Fix CDSP context banks unit addresses + +From: Krzysztof Kozlowski + +[ Upstream commit ff2b76ae689b71e2d7a2e70bfd8d71537c39164d ] + +There is a mismatch between 'reg' property and unit address for last +there CDSP compute context banks. Current values were taken as-is from +downstream source. Considering that 'reg' is used by Linux driver as +SID of context bank and that least significant bytes of IOMMU value +match the 'reg', assume the unit-address is wrong and needs fixing. +This also won't have any practical impact, except adhering to Devicetree +spec. + +Fixes: dae8cdb0a9e1 ("arm64: dts: qcom: sm8650: Add three missing fastrpc-compute-cb nodes") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20241104144204.114279-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8650.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8650.dtsi b/arch/arm64/boot/dts/qcom/sm8650.dtsi +index 01ac3769ffa62..cd54fd723ce40 100644 +--- a/arch/arm64/boot/dts/qcom/sm8650.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8650.dtsi +@@ -5624,7 +5624,7 @@ + + /* note: secure cb9 in downstream */ + +- compute-cb@10 { ++ compute-cb@12 { + compatible = "qcom,fastrpc-compute-cb"; + reg = <12>; + +@@ -5634,7 +5634,7 @@ + dma-coherent; + }; + +- compute-cb@11 { ++ compute-cb@13 { + compatible = "qcom,fastrpc-compute-cb"; + reg = <13>; + +@@ -5644,7 +5644,7 @@ + dma-coherent; + }; + +- compute-cb@12 { ++ compute-cb@14 { + compatible = "qcom,fastrpc-compute-cb"; + reg = <14>; + +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-x1e80100-correct-sleep-clock-frequenc.patch b/queue-6.12/arm64-dts-qcom-x1e80100-correct-sleep-clock-frequenc.patch new file mode 100644 index 0000000000..2afb8bfe4d --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-x1e80100-correct-sleep-clock-frequenc.patch @@ -0,0 +1,38 @@ +From bb8c180a210fd8bf14899ebaf44e88b95a4269df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:17:17 +0200 +Subject: arm64: dts: qcom: x1e80100: correct sleep clock frequency + +From: Dmitry Baryshkov + +[ Upstream commit 67e25a3e12d128336114a5d1572e055a8bd33129 ] + +The X1E80100 platform uses PMK8550 to provide sleep clock. According to the +documentation, that clock has 32.7645 kHz frequency. Correct the sleep +clock definition. + +Fixes: af16b00578a7 ("arm64: dts: qcom: Add base X1E80100 dtsi and the QCP dts") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-18-e9b08fbeadd3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/x1e80100.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/x1e80100.dtsi b/arch/arm64/boot/dts/qcom/x1e80100.dtsi +index a97ceff939d88..f0797df9619b1 100644 +--- a/arch/arm64/boot/dts/qcom/x1e80100.dtsi ++++ b/arch/arm64/boot/dts/qcom/x1e80100.dtsi +@@ -38,7 +38,7 @@ + + sleep_clk: sleep-clk { + compatible = "fixed-clock"; +- clock-frequency = <32000>; ++ clock-frequency = <32764>; + #clock-cells = <0>; + }; + +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-qcom-x1e80100-romulus-update-firmware-node.patch b/queue-6.12/arm64-dts-qcom-x1e80100-romulus-update-firmware-node.patch new file mode 100644 index 0000000000..7d42106b9d --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-x1e80100-romulus-update-firmware-node.patch @@ -0,0 +1,46 @@ +From eb96f3359e52570cfb268bba84a9bd0596e7986b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 23:14:59 +1030 +Subject: arm64: dts: qcom: x1e80100-romulus: Update firmware nodes + +From: Joel Stanley + +[ Upstream commit 983833061d9599a534e44fd6d335080d1a0ba985 ] + +Other x1e machines use _dtbs.elf for these firmwares, which matches the +filenames shipped by Windows. + +Fixes: 09d77be56093 ("arm64: dts: qcom: Add support for X1-based Surface Laptop 7 devices") +Signed-off-by: Joel Stanley +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20250108124500.44011-1-joel@jms.id.au +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/x1e80100-microsoft-romulus.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/x1e80100-microsoft-romulus.dtsi b/arch/arm64/boot/dts/qcom/x1e80100-microsoft-romulus.dtsi +index cdb401767c420..89e39d5527857 100644 +--- a/arch/arm64/boot/dts/qcom/x1e80100-microsoft-romulus.dtsi ++++ b/arch/arm64/boot/dts/qcom/x1e80100-microsoft-romulus.dtsi +@@ -680,14 +680,14 @@ + + &remoteproc_adsp { + firmware-name = "qcom/x1e80100/microsoft/Romulus/qcadsp8380.mbn", +- "qcom/x1e80100/microsoft/Romulus/adsp_dtb.mbn"; ++ "qcom/x1e80100/microsoft/Romulus/adsp_dtbs.elf"; + + status = "okay"; + }; + + &remoteproc_cdsp { + firmware-name = "qcom/x1e80100/microsoft/Romulus/qccdsp8380.mbn", +- "qcom/x1e80100/microsoft/Romulus/cdsp_dtb.mbn"; ++ "qcom/x1e80100/microsoft/Romulus/cdsp_dtbs.elf"; + + status = "okay"; + }; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-renesas-rzg3s-smarc-fix-the-debug-serial-a.patch b/queue-6.12/arm64-dts-renesas-rzg3s-smarc-fix-the-debug-serial-a.patch new file mode 100644 index 0000000000..ccfef556f1 --- /dev/null +++ b/queue-6.12/arm64-dts-renesas-rzg3s-smarc-fix-the-debug-serial-a.patch @@ -0,0 +1,66 @@ +From c302f9aba2713011efd54b75f1b2bd35c7ab7478 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Nov 2024 15:43:58 +0200 +Subject: arm64: dts: renesas: rzg3s-smarc: Fix the debug serial alias + +From: Claudiu Beznea + +[ Upstream commit 08811b984f5af8eeda4fb157894fe9bf230ec1e1 ] + +The debug serial of the RZ/G3S is SCIF0 which is routed on the Renesas +RZ SMARC Carrier II board on the SER3_UART. Use serial3 alias for it for +better hardware description. Along with it, the chosen properties were +moved to the device tree corresponding to the RZ SMARC Carrier II board. + +Fixes: adb4f0c5699c ("arm64: dts: renesas: Add initial support for RZ/G3S SMARC SoM") +Fixes: d1ae4200bb26 ("arm64: dts: renesas: Add initial device tree for RZ SMARC Carrier-II Board") +Signed-off-by: Claudiu Beznea +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20241115134401.3893008-6-claudiu.beznea.uj@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/rzg3s-smarc-som.dtsi | 5 ----- + arch/arm64/boot/dts/renesas/rzg3s-smarc.dtsi | 7 ++++++- + 2 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/rzg3s-smarc-som.dtsi b/arch/arm64/boot/dts/renesas/rzg3s-smarc-som.dtsi +index 21bfa4e03972f..612cdc7efabbc 100644 +--- a/arch/arm64/boot/dts/renesas/rzg3s-smarc-som.dtsi ++++ b/arch/arm64/boot/dts/renesas/rzg3s-smarc-som.dtsi +@@ -42,11 +42,6 @@ + #endif + }; + +- chosen { +- bootargs = "ignore_loglevel"; +- stdout-path = "serial0:115200n8"; +- }; +- + memory@48000000 { + device_type = "memory"; + /* First 128MB is reserved for secure area. */ +diff --git a/arch/arm64/boot/dts/renesas/rzg3s-smarc.dtsi b/arch/arm64/boot/dts/renesas/rzg3s-smarc.dtsi +index 7945d44e6ee15..af2ab1629104b 100644 +--- a/arch/arm64/boot/dts/renesas/rzg3s-smarc.dtsi ++++ b/arch/arm64/boot/dts/renesas/rzg3s-smarc.dtsi +@@ -12,10 +12,15 @@ + / { + aliases { + i2c0 = &i2c0; +- serial0 = &scif0; ++ serial3 = &scif0; + mmc1 = &sdhi1; + }; + ++ chosen { ++ bootargs = "ignore_loglevel"; ++ stdout-path = "serial3:115200n8"; ++ }; ++ + keys { + compatible = "gpio-keys"; + +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-rockchip-fix-num-channels-property-of-wolf.patch b/queue-6.12/arm64-dts-rockchip-fix-num-channels-property-of-wolf.patch new file mode 100644 index 0000000000..d0b2193187 --- /dev/null +++ b/queue-6.12/arm64-dts-rockchip-fix-num-channels-property-of-wolf.patch @@ -0,0 +1,38 @@ +From 439e7ea93f12e7f6bcec4adccf9c0ad45c4d6fd1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Dec 2024 11:43:11 +0100 +Subject: arm64: dts: rockchip: fix num-channels property of wolfvision pf5 mic + +From: Michael Riesch + +[ Upstream commit 11d07966c83f5eccf6b927cb32862aef58488e23 ] + +The Rockchip RK3568 PDM block always considers stereo inputs. Therefore, +the number of channels must be always an even number, even if a single +mono microphone is attached. + +Fixes: 0be29f76633a ("arm64: dts: rockchip: add wolfvision pf5 mainboard") +Signed-off-by: Michael Riesch +Link: https://lore.kernel.org/r/20241218-b4-wolfvision-pf5-update-v1-1-1d1959858708@wolfvision.net +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3568-wolfvision-pf5.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-wolfvision-pf5.dts b/arch/arm64/boot/dts/rockchip/rk3568-wolfvision-pf5.dts +index 170b14f92f51b..f9ef0af8aa1ac 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-wolfvision-pf5.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3568-wolfvision-pf5.dts +@@ -53,7 +53,7 @@ + + pdm_codec: pdm-codec { + compatible = "dmic-codec"; +- num-channels = <1>; ++ num-channels = <2>; + #sound-dai-cells = <0>; + }; + +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-rockchip-fix-sdmmc-access-on-rk3308-rock-s.patch b/queue-6.12/arm64-dts-rockchip-fix-sdmmc-access-on-rk3308-rock-s.patch new file mode 100644 index 0000000000..d6b8f4f41f --- /dev/null +++ b/queue-6.12/arm64-dts-rockchip-fix-sdmmc-access-on-rk3308-rock-s.patch @@ -0,0 +1,81 @@ +From 26c361b240f3662480168b857dd3186e5e0bb0b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Nov 2024 23:08:36 +0000 +Subject: arm64: dts: rockchip: Fix sdmmc access on rk3308-rock-s0 v1.1 boards + +From: Jonas Karlman + +[ Upstream commit 26c100232b09ced0857306ac9831a4fa9c9aa231 ] + +BootROM leave GPIO4_D6 configured as SDMMC_PWREN function and DW MCI +driver set PRWEN high on MMC_POWER_UP and low on MMC_POWER_OFF. +Similarly U-Boot also set PRWEN high before accessing mmc. + +However, HW revision prior to v1.2 must pull GPIO4_D6 low to access +sdmmc. For HW revision v1.2 the state of GPIO4_D6 has no impact. + +Model an always-on active low fixed regulator using GPIO4_D6 to fix +use of sdmmc on older HW revisions of the board. + +Fixes: adeb5d2a4ba4 ("arm64: dts: rockchip: Add Radxa ROCK S0") +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20241119230838.4137130-1-jonas@kwiboo.se +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + .../boot/dts/rockchip/rk3308-rock-s0.dts | 25 ++++++++++++++++++- + 1 file changed, 24 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3308-rock-s0.dts b/arch/arm64/boot/dts/rockchip/rk3308-rock-s0.dts +index bd6419a5c20a2..8311af4c8689f 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3308-rock-s0.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3308-rock-s0.dts +@@ -74,6 +74,23 @@ + vin-supply = <&vcc5v0_sys>; + }; + ++ /* ++ * HW revision prior to v1.2 must pull GPIO4_D6 low to access sdmmc. ++ * This is modeled as an always-on active low fixed regulator. ++ */ ++ vcc_sd: regulator-3v3-vcc-sd { ++ compatible = "regulator-fixed"; ++ gpios = <&gpio4 RK_PD6 GPIO_ACTIVE_LOW>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&sdmmc_2030>; ++ regulator-name = "vcc_sd"; ++ regulator-always-on; ++ regulator-boot-on; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ vin-supply = <&vcc_io>; ++ }; ++ + vcc5v0_sys: regulator-5v0-vcc-sys { + compatible = "regulator-fixed"; + regulator-name = "vcc5v0_sys"; +@@ -181,6 +198,12 @@ + }; + }; + ++ sdmmc { ++ sdmmc_2030: sdmmc-2030 { ++ rockchip,pins = <4 RK_PD6 RK_FUNC_GPIO &pcfg_pull_none>; ++ }; ++ }; ++ + wifi { + wifi_reg_on: wifi-reg-on { + rockchip,pins = <0 RK_PA2 RK_FUNC_GPIO &pcfg_pull_none>; +@@ -233,7 +256,7 @@ + cap-mmc-highspeed; + cap-sd-highspeed; + disable-wp; +- vmmc-supply = <&vcc_io>; ++ vmmc-supply = <&vcc_sd>; + status = "okay"; + }; + +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-ti-k3-am62-remove-duplicate-gicr-reg.patch b/queue-6.12/arm64-dts-ti-k3-am62-remove-duplicate-gicr-reg.patch new file mode 100644 index 0000000000..6b6c2f0a01 --- /dev/null +++ b/queue-6.12/arm64-dts-ti-k3-am62-remove-duplicate-gicr-reg.patch @@ -0,0 +1,37 @@ +From d59bce831bd9f120e3b7ed6594340ab8ba740b72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 14:59:24 -0600 +Subject: arm64: dts: ti: k3-am62: Remove duplicate GICR reg + +From: Bryan Brattlof + +[ Upstream commit 72c691d77ea5d0c4636fd3e9f0ad80d813c7d1a7 ] + +The GIC Redistributor control register range is mapped twice. Remove +the extra entry from the reg range. + +Fixes: f1d17330a5be ("arm64: dts: ti: Introduce base support for AM62x SoC") +Reported-by: Bin Liu +Signed-off-by: Bryan Brattlof +Link: https://lore.kernel.org/r/20241210-am62-gic-fixup-v1-1-758b4d5b4a0a@ti.com +Signed-off-by: Nishanth Menon +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am62-main.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi +index 5b92aef5b284b..60c6814206a1f 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi +@@ -23,7 +23,6 @@ + interrupt-controller; + reg = <0x00 0x01800000 0x00 0x10000>, /* GICD */ + <0x00 0x01880000 0x00 0xc0000>, /* GICR */ +- <0x00 0x01880000 0x00 0xc0000>, /* GICR */ + <0x01 0x00000000 0x00 0x2000>, /* GICC */ + <0x01 0x00010000 0x00 0x1000>, /* GICH */ + <0x01 0x00020000 0x00 0x2000>; /* GICV */ +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-ti-k3-am62a-remove-duplicate-gicr-reg.patch b/queue-6.12/arm64-dts-ti-k3-am62a-remove-duplicate-gicr-reg.patch new file mode 100644 index 0000000000..6f65ff8c4e --- /dev/null +++ b/queue-6.12/arm64-dts-ti-k3-am62a-remove-duplicate-gicr-reg.patch @@ -0,0 +1,37 @@ +From e71d0d7710c5d7ccca4bc10326dc8cb44d83eccb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 14:59:25 -0600 +Subject: arm64: dts: ti: k3-am62a: Remove duplicate GICR reg + +From: Bryan Brattlof + +[ Upstream commit 6f0232577e260cdbc25508e27bb0b75ade7e7ebc ] + +The GIC Redistributor control range is mapped twice. Remove the extra +entry from the reg range. + +Fixes: 5fc6b1b62639 ("arm64: dts: ti: Introduce AM62A7 family of SoCs") +Reported-by: Bin Liu +Signed-off-by: Bryan Brattlof +Link: https://lore.kernel.org/r/20241210-am62-gic-fixup-v1-2-758b4d5b4a0a@ti.com +Signed-off-by: Nishanth Menon +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am62a-main.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi +index 16a578ae2b412..56945d29e0150 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi +@@ -18,7 +18,6 @@ + compatible = "arm,gic-v3"; + reg = <0x00 0x01800000 0x00 0x10000>, /* GICD */ + <0x00 0x01880000 0x00 0xc0000>, /* GICR */ +- <0x00 0x01880000 0x00 0xc0000>, /* GICR */ + <0x01 0x00000000 0x00 0x2000>, /* GICC */ + <0x01 0x00010000 0x00 0x1000>, /* GICH */ + <0x01 0x00020000 0x00 0x2000>; /* GICV */ +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-ti-k3-am642-hummingboard-t-convert-overlay.patch b/queue-6.12/arm64-dts-ti-k3-am642-hummingboard-t-convert-overlay.patch new file mode 100644 index 0000000000..fe5aba64cb --- /dev/null +++ b/queue-6.12/arm64-dts-ti-k3-am642-hummingboard-t-convert-overlay.patch @@ -0,0 +1,122 @@ +From 083e85bb20127c674ecd9992f8276fb32e7ab3e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jan 2025 13:30:22 +0100 +Subject: arm64: dts: ti: k3-am642-hummingboard-t: Convert overlay to board dts + +From: Josua Mayer + +[ Upstream commit e2b69180431968250bf3c0c581155f1b37d057c1 ] + +SolidRun HummingBoard-T has two options for M.2 connector, supporting +either PCI-E or USB-3.1 Gen 1 - depending on configuration of a mux +on the serdes lane. +The required configurations in device-tree were modeled as overlays. + +The USB-3.1 overlay uses /delete-property/ to unset a boolean property +on the usb controller limiting it to USB-2.0 by default. +Overlays can not delete a property from the base dtb, therefore this +overlay is at this time useless. + +Convert both overlays into full dts by including the base board dts. +While the pcie overlay was functional, both are converted for a +consistent user experience when selecting between the two mutually +exclusive configurations. + +Reported-by: Geert Uytterhoeven +Closes: https://lore.kernel.org/linux-devicetree/CAMuHMdXTgpTnJ9U7egC2XjFXXNZ5uiY1O+WxNd6LPJW5Rs5KTw@mail.gmail.com +Fixes: bbef42084cc1 ("arm64: dts: ti: hummingboard-t: add overlays for m.2 pci-e and usb-3") +Signed-off-by: Josua Mayer +Link: https://lore.kernel.org/r/20250101-am64-hb-fix-overlay-v2-1-78143f5da28c@solid-run.com +Signed-off-by: Nishanth Menon +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/Makefile | 4 ---- + ...-pcie.dtso => k3-am642-hummingboard-t-pcie.dts} | 14 ++++++++------ + ...-usb3.dtso => k3-am642-hummingboard-t-usb3.dts} | 13 ++++++++----- + 3 files changed, 16 insertions(+), 15 deletions(-) + rename arch/arm64/boot/dts/ti/{k3-am642-hummingboard-t-pcie.dtso => k3-am642-hummingboard-t-pcie.dts} (78%) + rename arch/arm64/boot/dts/ti/{k3-am642-hummingboard-t-usb3.dtso => k3-am642-hummingboard-t-usb3.dts} (74%) + +diff --git a/arch/arm64/boot/dts/ti/Makefile b/arch/arm64/boot/dts/ti/Makefile +index bcd392c3206e5..562e6d57bc991 100644 +--- a/arch/arm64/boot/dts/ti/Makefile ++++ b/arch/arm64/boot/dts/ti/Makefile +@@ -41,10 +41,6 @@ dtb-$(CONFIG_ARCH_K3) += k3-am62x-sk-csi2-imx219.dtbo + dtb-$(CONFIG_ARCH_K3) += k3-am62x-sk-hdmi-audio.dtbo + + # Boards with AM64x SoC +-k3-am642-hummingboard-t-pcie-dtbs := \ +- k3-am642-hummingboard-t.dtb k3-am642-hummingboard-t-pcie.dtbo +-k3-am642-hummingboard-t-usb3-dtbs := \ +- k3-am642-hummingboard-t.dtb k3-am642-hummingboard-t-usb3.dtbo + dtb-$(CONFIG_ARCH_K3) += k3-am642-evm.dtb + dtb-$(CONFIG_ARCH_K3) += k3-am642-evm-icssg1-dualemac.dtbo + dtb-$(CONFIG_ARCH_K3) += k3-am642-evm-icssg1-dualemac-mii.dtbo +diff --git a/arch/arm64/boot/dts/ti/k3-am642-hummingboard-t-pcie.dtso b/arch/arm64/boot/dts/ti/k3-am642-hummingboard-t-pcie.dts +similarity index 78% +rename from arch/arm64/boot/dts/ti/k3-am642-hummingboard-t-pcie.dtso +rename to arch/arm64/boot/dts/ti/k3-am642-hummingboard-t-pcie.dts +index bd9a5caf20da5..023b2a6aaa566 100644 +--- a/arch/arm64/boot/dts/ti/k3-am642-hummingboard-t-pcie.dtso ++++ b/arch/arm64/boot/dts/ti/k3-am642-hummingboard-t-pcie.dts +@@ -2,17 +2,19 @@ + /* + * Copyright (C) 2023 Josua Mayer + * +- * Overlay for SolidRun AM642 HummingBoard-T to enable PCI-E. ++ * DTS for SolidRun AM642 HummingBoard-T, ++ * running on Cortex A53, with PCI-E. ++ * + */ + +-/dts-v1/; +-/plugin/; +- +-#include +-#include ++#include "k3-am642-hummingboard-t.dts" + + #include "k3-serdes.h" + ++/ { ++ model = "SolidRun AM642 HummingBoard-T with PCI-E"; ++}; ++ + &pcie0_rc { + pinctrl-names = "default"; + pinctrl-0 = <&pcie0_default_pins>; +diff --git a/arch/arm64/boot/dts/ti/k3-am642-hummingboard-t-usb3.dtso b/arch/arm64/boot/dts/ti/k3-am642-hummingboard-t-usb3.dts +similarity index 74% +rename from arch/arm64/boot/dts/ti/k3-am642-hummingboard-t-usb3.dtso +rename to arch/arm64/boot/dts/ti/k3-am642-hummingboard-t-usb3.dts +index ffcc3bd3c7bc5..ee9bd618f3701 100644 +--- a/arch/arm64/boot/dts/ti/k3-am642-hummingboard-t-usb3.dtso ++++ b/arch/arm64/boot/dts/ti/k3-am642-hummingboard-t-usb3.dts +@@ -2,16 +2,19 @@ + /* + * Copyright (C) 2023 Josua Mayer + * +- * Overlay for SolidRun AM642 HummingBoard-T to enable USB-3.1. ++ * DTS for SolidRun AM642 HummingBoard-T, ++ * running on Cortex A53, with USB-3.1 Gen 1. ++ * + */ + +-/dts-v1/; +-/plugin/; +- +-#include ++#include "k3-am642-hummingboard-t.dts" + + #include "k3-serdes.h" + ++/ { ++ model = "SolidRun AM642 HummingBoard-T with USB-3.1 Gen 1"; ++}; ++ + &serdes0 { + #address-cells = <1>; + #size-cells = <0>; +-- +2.39.5 + diff --git a/queue-6.12/arm64-tegra-fix-dma-id-for-spi2.patch b/queue-6.12/arm64-tegra-fix-dma-id-for-spi2.patch new file mode 100644 index 0000000000..5cb18ff7fb --- /dev/null +++ b/queue-6.12/arm64-tegra-fix-dma-id-for-spi2.patch @@ -0,0 +1,36 @@ +From 520974e85e5fe515974d68c6fad830a13ce657e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 16:22:00 +0530 +Subject: arm64: tegra: Fix DMA ID for SPI2 + +From: Akhil R + +[ Upstream commit 346bf459db26325c09ed841fdfd6678de1b1cb3a ] + +DMA ID for SPI2 is '16'. Update the incorrect value in the devicetree. + +Fixes: bb9667d8187b ("arm64: tegra: Add SPI device tree nodes for Tegra234") +Signed-off-by: Akhil R +Link: https://lore.kernel.org/r/20241206105201.53596-1-akhilrajeev@nvidia.com +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/nvidia/tegra234.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra234.dtsi b/arch/arm64/boot/dts/nvidia/tegra234.dtsi +index 984c85eab41af..570331baa09ee 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra234.dtsi ++++ b/arch/arm64/boot/dts/nvidia/tegra234.dtsi +@@ -3900,7 +3900,7 @@ + assigned-clock-parents = <&bpmp TEGRA234_CLK_PLLP_OUT0>; + resets = <&bpmp TEGRA234_RESET_SPI2>; + reset-names = "spi"; +- dmas = <&gpcdma 19>, <&gpcdma 19>; ++ dmas = <&gpcdma 16>, <&gpcdma 16>; + dma-names = "rx", "tx"; + dma-coherent; + status = "disabled"; +-- +2.39.5 + diff --git a/queue-6.12/asoc-cs40l50-use-y-for-makefile.patch b/queue-6.12/asoc-cs40l50-use-y-for-makefile.patch new file mode 100644 index 0000000000..8e73082a95 --- /dev/null +++ b/queue-6.12/asoc-cs40l50-use-y-for-makefile.patch @@ -0,0 +1,37 @@ +From 387665c96827d065afe718be856cfbcb143633be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Dec 2024 15:18:16 +0100 +Subject: ASoC: cs40l50: Use *-y for Makefile + +From: Takashi Iwai + +[ Upstream commit 3f0b8d367db5b0c0a0096b1c2ff02ec7c5c893b6 ] + +We should use *-y instead of *-objs in Makefile for the module +objects. *-objs is used rather for host programs. + +Fixes: c486def5b3ba ("ASoC: cs40l50: Support I2S streaming to CS40L50") +Signed-off-by: Takashi Iwai +Link: https://patch.msgid.link/20241203141823.22393-2-tiwai@suse.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/Makefile b/sound/soc/codecs/Makefile +index 54cbc3feae327..56c519a5c897b 100644 +--- a/sound/soc/codecs/Makefile ++++ b/sound/soc/codecs/Makefile +@@ -79,7 +79,7 @@ snd-soc-cs35l56-shared-y := cs35l56-shared.o + snd-soc-cs35l56-i2c-y := cs35l56-i2c.o + snd-soc-cs35l56-spi-y := cs35l56-spi.o + snd-soc-cs35l56-sdw-y := cs35l56-sdw.o +-snd-soc-cs40l50-objs := cs40l50-codec.o ++snd-soc-cs40l50-y := cs40l50-codec.o + snd-soc-cs42l42-y := cs42l42.o + snd-soc-cs42l42-i2c-y := cs42l42-i2c.o + snd-soc-cs42l42-sdw-y := cs42l42-sdw.o +-- +2.39.5 + diff --git a/queue-6.12/asoc-intel-avs-do-not-readq-u32-registers.patch b/queue-6.12/asoc-intel-avs-do-not-readq-u32-registers.patch new file mode 100644 index 0000000000..0dec9a0bc0 --- /dev/null +++ b/queue-6.12/asoc-intel-avs-do-not-readq-u32-registers.patch @@ -0,0 +1,36 @@ +From 83c13bb0ba3520921af63703a0ae86faf5b54b5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jan 2025 13:22:04 +0100 +Subject: ASoC: Intel: avs: Do not readq() u32 registers + +From: Cezary Rojewski + +[ Upstream commit bca0fa5f6b5e96c03daac1ed62b1e5c5057a2048 ] + +Register reporting ROM status is 4-bytes wide. + +Fixes: 092cf7b26a48 ("ASoC: Intel: avs: Code loading over HDA") +Signed-off-by: Cezary Rojewski +Link: https://patch.msgid.link/20250109122216.3667847-2-cezary.rojewski@intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/avs/loader.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/intel/avs/loader.c b/sound/soc/intel/avs/loader.c +index 890efd2f1feab..37de077a99838 100644 +--- a/sound/soc/intel/avs/loader.c ++++ b/sound/soc/intel/avs/loader.c +@@ -308,7 +308,7 @@ avs_hda_init_rom(struct avs_dev *adev, unsigned int dma_id, bool purge) + } + + /* await ROM init */ +- ret = snd_hdac_adsp_readq_poll(adev, spec->sram->rom_status_offset, reg, ++ ret = snd_hdac_adsp_readl_poll(adev, spec->sram->rom_status_offset, reg, + (reg & 0xF) == AVS_ROM_INIT_DONE || + (reg & 0xF) == APL_ROM_FW_ENTERED, + AVS_ROM_INIT_POLLING_US, APL_ROM_INIT_TIMEOUT_US); +-- +2.39.5 + diff --git a/queue-6.12/asoc-intel-avs-fix-init-config-parsing.patch b/queue-6.12/asoc-intel-avs-fix-init-config-parsing.patch new file mode 100644 index 0000000000..86567728dc --- /dev/null +++ b/queue-6.12/asoc-intel-avs-fix-init-config-parsing.patch @@ -0,0 +1,49 @@ +From 37971581437579a13fc30445ae443bf79d8a17ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jan 2025 13:22:07 +0100 +Subject: ASoC: Intel: avs: Fix init-config parsing +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Amadeusz Sławiński + +[ Upstream commit e9ca3db9f01a7ce91ceab35cd5fa52f0c5aca174 ] + +When parsing init configs correct token should be looked up. + +Fixes: 1b4217ebbb3e ("ASoC: Intel: avs: Add topology parsing support for initial config") +Signed-off-by: Amadeusz Sławiński +Signed-off-by: Cezary Rojewski +Link: https://patch.msgid.link/20250109122216.3667847-5-cezary.rojewski@intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/avs/topology.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/avs/topology.c b/sound/soc/intel/avs/topology.c +index 5cda527020c7b..d612f20ed9893 100644 +--- a/sound/soc/intel/avs/topology.c ++++ b/sound/soc/intel/avs/topology.c +@@ -1466,7 +1466,7 @@ avs_tplg_path_template_create(struct snd_soc_component *comp, struct avs_tplg *o + + static const struct avs_tplg_token_parser mod_init_config_parsers[] = { + { +- .token = AVS_TKN_MOD_INIT_CONFIG_ID_U32, ++ .token = AVS_TKN_INIT_CONFIG_ID_U32, + .type = SND_SOC_TPLG_TUPLE_TYPE_WORD, + .offset = offsetof(struct avs_tplg_init_config, id), + .parse = avs_parse_word_token, +@@ -1519,7 +1519,7 @@ static int avs_tplg_parse_initial_configs(struct snd_soc_component *comp, + esize = le32_to_cpu(tuples->size) + le32_to_cpu(tmp->size); + + ret = parse_dictionary_entries(comp, tuples, esize, config, 1, sizeof(*config), +- AVS_TKN_MOD_INIT_CONFIG_ID_U32, ++ AVS_TKN_INIT_CONFIG_ID_U32, + mod_init_config_parsers, + ARRAY_SIZE(mod_init_config_parsers)); + +-- +2.39.5 + diff --git a/queue-6.12/asoc-intel-avs-fix-the-minimum-firmware-version-numb.patch b/queue-6.12/asoc-intel-avs-fix-the-minimum-firmware-version-numb.patch new file mode 100644 index 0000000000..d825bd1392 --- /dev/null +++ b/queue-6.12/asoc-intel-avs-fix-the-minimum-firmware-version-numb.patch @@ -0,0 +1,59 @@ +From 1e251bf07d86181849f16c79ebb1c6b1e8403e9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jan 2025 13:22:05 +0100 +Subject: ASoC: Intel: avs: Fix the minimum firmware version numbers + +From: Cezary Rojewski + +[ Upstream commit dbda5c35b88794f6e5efe1b5b20044b0b3a340d4 ] + +For few TGL-based platforms the minor version number for AudioDSP +firmware is incorrect forcing users to utilize ignore_fw_version module +parameter. + +Fixes: 5acb19ecd198 ("ASoC: Intel: avs: TGL-based platforms support") +Signed-off-by: Cezary Rojewski +Link: https://patch.msgid.link/20250109122216.3667847-3-cezary.rojewski@intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/avs/core.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/sound/soc/intel/avs/core.c b/sound/soc/intel/avs/core.c +index 73d4bde9b2f78..82839d0994ee3 100644 +--- a/sound/soc/intel/avs/core.c ++++ b/sound/soc/intel/avs/core.c +@@ -829,10 +829,10 @@ static const struct avs_spec jsl_desc = { + .hipc = &cnl_hipc_spec, + }; + +-#define AVS_TGL_BASED_SPEC(sname) \ ++#define AVS_TGL_BASED_SPEC(sname, min) \ + static const struct avs_spec sname##_desc = { \ + .name = #sname, \ +- .min_fw_version = { 10, 29, 0, 5646 }, \ ++ .min_fw_version = { 10, min, 0, 5646 }, \ + .dsp_ops = &avs_tgl_dsp_ops, \ + .core_init_mask = 1, \ + .attributes = AVS_PLATATTR_IMR, \ +@@ -840,11 +840,11 @@ static const struct avs_spec sname##_desc = { \ + .hipc = &cnl_hipc_spec, \ + } + +-AVS_TGL_BASED_SPEC(lkf); +-AVS_TGL_BASED_SPEC(tgl); +-AVS_TGL_BASED_SPEC(ehl); +-AVS_TGL_BASED_SPEC(adl); +-AVS_TGL_BASED_SPEC(adl_n); ++AVS_TGL_BASED_SPEC(lkf, 28); ++AVS_TGL_BASED_SPEC(tgl, 29); ++AVS_TGL_BASED_SPEC(ehl, 30); ++AVS_TGL_BASED_SPEC(adl, 35); ++AVS_TGL_BASED_SPEC(adl_n, 35); + + static const struct pci_device_id avs_ids[] = { + { PCI_DEVICE_DATA(INTEL, HDA_SKL_LP, &skl_desc) }, +-- +2.39.5 + diff --git a/queue-6.12/asoc-intel-avs-fix-theoretical-infinite-loop.patch b/queue-6.12/asoc-intel-avs-fix-theoretical-infinite-loop.patch new file mode 100644 index 0000000000..4ff714c1dd --- /dev/null +++ b/queue-6.12/asoc-intel-avs-fix-theoretical-infinite-loop.patch @@ -0,0 +1,40 @@ +From 8705f333d110a852f2c1b2ecc6be0038995a688f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jan 2025 13:22:06 +0100 +Subject: ASoC: Intel: avs: Fix theoretical infinite loop + +From: Cezary Rojewski + +[ Upstream commit cf4d74256fe103ece7b2647550e6c063048e5682 ] + +While 'stack_dump_size' is a u32 bitfield of 16 bits, u32 has a bigger +upper bound than the type u16 of loop counter 'offset' what in theory +may lead to infinite loop condition. + +Found out by Coverity static analyzer. + +Fixes: c8c960c10971 ("ASoC: Intel: avs: APL-based platforms support") +Signed-off-by: Cezary Rojewski +Link: https://patch.msgid.link/20250109122216.3667847-4-cezary.rojewski@intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/avs/apl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/intel/avs/apl.c b/sound/soc/intel/avs/apl.c +index 27516ef571859..d443fe8d51aee 100644 +--- a/sound/soc/intel/avs/apl.c ++++ b/sound/soc/intel/avs/apl.c +@@ -125,7 +125,7 @@ int avs_apl_coredump(struct avs_dev *adev, union avs_notify_msg *msg) + struct avs_apl_log_buffer_layout layout; + void __iomem *addr, *buf; + size_t dump_size; +- u16 offset = 0; ++ u32 offset = 0; + u8 *dump, *pos; + + dump_size = AVS_FW_REGS_SIZE + msg->ext.coredump.stack_dump_size; +-- +2.39.5 + diff --git a/queue-6.12/asoc-intel-sof_sdw-correct-mach_params-dmic_num.patch b/queue-6.12/asoc-intel-sof_sdw-correct-mach_params-dmic_num.patch new file mode 100644 index 0000000000..41ab8c7269 --- /dev/null +++ b/queue-6.12/asoc-intel-sof_sdw-correct-mach_params-dmic_num.patch @@ -0,0 +1,77 @@ +From 78381e1faf860448099672be1b0b9b5db6d910ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 15:58:54 +0800 +Subject: ASoC: Intel: sof_sdw: correct mach_params->dmic_num +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bard Liao + +[ Upstream commit 4ab80a2961c75562ffbac1f80de151a978c31659 ] + +mach_params->dmic_num will be used to set the cfg-mics value of +card->components string which should be the dmic channels. However +dmic_num is dmic link number and could be set due to the SOC_SDW_PCH_DMIC +quirk. Set mach_params->dmic_num to the default value if the dmic link +is created due to the SOC_SDW_PCH_DMIC quirk. + +Fixes: 7db9f6361170 ("ASoC: Intel: sof_sdw: overwrite mach_params->dmic_num") +Signed-off-by: Bard Liao +Reviewed-by: Kai Vehmanen +Reviewed-by: Péter Ujfalusi +Reviewed-by: Liam Girdwood +Reviewed-by: Ranjani Sridharan +Link: https://patch.msgid.link/20241206075903.195730-2-yung-chuan.liao@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_sdw.c | 24 ++++++++++++++---------- + 1 file changed, 14 insertions(+), 10 deletions(-) + +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index 41042259f2b26..b6f9e5ee7e347 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -22,6 +22,8 @@ static int quirk_override = -1; + module_param_named(quirk, quirk_override, int, 0444); + MODULE_PARM_DESC(quirk, "Board-specific quirk override"); + ++#define DMIC_DEFAULT_CHANNELS 2 ++ + static void log_quirks(struct device *dev) + { + if (SOC_SDW_JACK_JDSRC(sof_sdw_quirk)) +@@ -1063,17 +1065,19 @@ static int sof_card_dai_links_create(struct snd_soc_card *card) + hdmi_num = SOF_PRE_TGL_HDMI_COUNT; + + /* enable dmic01 & dmic16k */ +- if (sof_sdw_quirk & SOC_SDW_PCH_DMIC || mach_params->dmic_num) { +- if (ctx->ignore_internal_dmic) +- dev_warn(dev, "Ignoring PCH DMIC\n"); +- else +- dmic_num = 2; ++ if (ctx->ignore_internal_dmic) { ++ dev_warn(dev, "Ignoring internal DMIC\n"); ++ mach_params->dmic_num = 0; ++ } else if (mach_params->dmic_num) { ++ dmic_num = 2; ++ } else if (sof_sdw_quirk & SOC_SDW_PCH_DMIC) { ++ dmic_num = 2; ++ /* ++ * mach_params->dmic_num will be used to set the cfg-mics value of ++ * card->components string. Set it to the default value. ++ */ ++ mach_params->dmic_num = DMIC_DEFAULT_CHANNELS; + } +- /* +- * mach_params->dmic_num will be used to set the cfg-mics value of card->components +- * string. Overwrite it to the actual number of PCH DMICs used in the device. +- */ +- mach_params->dmic_num = dmic_num; + + if (sof_sdw_quirk & SOF_SSP_BT_OFFLOAD_PRESENT) + bt_num = 1; +-- +2.39.5 + diff --git a/queue-6.12/asoc-intel-sof_sdw-fix-dmi-match-for-lenovo-83jx-83m.patch b/queue-6.12/asoc-intel-sof_sdw-fix-dmi-match-for-lenovo-83jx-83m.patch new file mode 100644 index 0000000000..4836170518 --- /dev/null +++ b/queue-6.12/asoc-intel-sof_sdw-fix-dmi-match-for-lenovo-83jx-83m.patch @@ -0,0 +1,68 @@ +From 37eebd5294385418f83139a963e6c4fd3f793e99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jan 2025 20:33:35 +0800 +Subject: ASoC: Intel: sof_sdw: Fix DMI match for Lenovo 83JX, 83MC and 83NM + +From: Simon Trimmer + +[ Upstream commit 17615e4216115a0454e0f2007267a006231dcb7d ] + +Update the DMI match for a Lenovo laptop to a new DMI identifier. + +This laptop ships with a different DMI identifier to what was expected +and now has three match entries. It also has the DMICs connected to the +host rather than the cs42l43 codec. + +Signed-off-by: Simon Trimmer +Fixes: 83c062ae81e8 ("ASoC: Intel: sof_sdw: Add quirks for some new Lenovo laptops") +Reviewed-by: Liam Girdwood +Reviewed-by: Ranjani Sridharan +Signed-off-by: Bard Liao +Link: https://patch.msgid.link/20250102123335.256698-3-yung-chuan.liao@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_sdw.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index 9350a1ea146b0..9f2dc24d44cb5 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -586,9 +586,9 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + .callback = sof_sdw_quirk_cb, + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), +- DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "3838") ++ DMI_MATCH(DMI_PRODUCT_NAME, "83JX") + }, +- .driver_data = (void *)(SOC_SDW_SIDECAR_AMPS), ++ .driver_data = (void *)(SOC_SDW_SIDECAR_AMPS | SOC_SDW_CODEC_MIC), + }, + { + .callback = sof_sdw_quirk_cb, +@@ -598,6 +598,21 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + }, + .driver_data = (void *)(SOC_SDW_SIDECAR_AMPS | SOC_SDW_CODEC_MIC), + }, ++ { ++ .callback = sof_sdw_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "83MC") ++ }, ++ .driver_data = (void *)(SOC_SDW_SIDECAR_AMPS | SOC_SDW_CODEC_MIC), ++ }, { ++ .callback = sof_sdw_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "83NM") ++ }, ++ .driver_data = (void *)(SOC_SDW_SIDECAR_AMPS | SOC_SDW_CODEC_MIC), ++ }, + { + .callback = sof_sdw_quirk_cb, + .matches = { +-- +2.39.5 + diff --git a/queue-6.12/asoc-intel-sof_sdw-fix-dmi-match-for-lenovo-83lc.patch b/queue-6.12/asoc-intel-sof_sdw-fix-dmi-match-for-lenovo-83lc.patch new file mode 100644 index 0000000000..b8bd2a4749 --- /dev/null +++ b/queue-6.12/asoc-intel-sof_sdw-fix-dmi-match-for-lenovo-83lc.patch @@ -0,0 +1,46 @@ +From b1aab0dccd1ea23546d8bb139bb677c9e4f1547c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jan 2025 20:33:34 +0800 +Subject: ASoC: Intel: sof_sdw: Fix DMI match for Lenovo 83LC + +From: Simon Trimmer + +[ Upstream commit c9e05763f334845ba69494dd71d7cbfd05fd0e6e ] + +Update the DMI match for a Lenovo laptop to the new DMI identifier. + +This laptop ships with a different DMI identifier to what was expected, +and also has the DMICs connected to the host rather than the cs42l43 +codec. + +Signed-off-by: Simon Trimmer +Fixes: 83c062ae81e8 ("ASoC: Intel: sof_sdw: Add quirks for some new Lenovo laptops") +Reviewed-by: Liam Girdwood +Reviewed-by: Ranjani Sridharan +Signed-off-by: Bard Liao +Link: https://patch.msgid.link/20250102123335.256698-2-yung-chuan.liao@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_sdw.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index b6f9e5ee7e347..9350a1ea146b0 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -594,9 +594,9 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + .callback = sof_sdw_quirk_cb, + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), +- DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "3832") ++ DMI_MATCH(DMI_PRODUCT_NAME, "83LC") + }, +- .driver_data = (void *)(SOC_SDW_SIDECAR_AMPS), ++ .driver_data = (void *)(SOC_SDW_SIDECAR_AMPS | SOC_SDW_CODEC_MIC), + }, + { + .callback = sof_sdw_quirk_cb, +-- +2.39.5 + diff --git a/queue-6.12/asoc-mediatek-mt8365-use-y-for-makefile.patch b/queue-6.12/asoc-mediatek-mt8365-use-y-for-makefile.patch new file mode 100644 index 0000000000..eba0cf6045 --- /dev/null +++ b/queue-6.12/asoc-mediatek-mt8365-use-y-for-makefile.patch @@ -0,0 +1,37 @@ +From 165d9a6656bd846ad88da11bc782740180f5eeaa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Dec 2024 15:18:17 +0100 +Subject: ASoC: mediatek: mt8365: Use *-y for Makefile + +From: Takashi Iwai + +[ Upstream commit e9d2a2f49244d9737f0ec33f4b7f3580faecd805 ] + +We should use *-y instead of *-objs in Makefile for the module +objects. *-objs is used rather for host programs. + +Fixes: 5bbfdad8cf8d ("ASoC: mediatek: Add MT8365 support") +Signed-off-by: Takashi Iwai +Link: https://patch.msgid.link/20241203141823.22393-3-tiwai@suse.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mediatek/mt8365/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/mediatek/mt8365/Makefile b/sound/soc/mediatek/mt8365/Makefile +index 52ba45a8498a2..b197025e34bb8 100644 +--- a/sound/soc/mediatek/mt8365/Makefile ++++ b/sound/soc/mediatek/mt8365/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + + # MTK Platform driver +-snd-soc-mt8365-pcm-objs := \ ++snd-soc-mt8365-pcm-y := \ + mt8365-afe-clk.o \ + mt8365-afe-pcm.o \ + mt8365-dai-adda.o \ +-- +2.39.5 + diff --git a/queue-6.12/asoc-renesas-rz-ssi-use-only-the-proper-amount-of-di.patch b/queue-6.12/asoc-renesas-rz-ssi-use-only-the-proper-amount-of-di.patch new file mode 100644 index 0000000000..72ab71a824 --- /dev/null +++ b/queue-6.12/asoc-renesas-rz-ssi-use-only-the-proper-amount-of-di.patch @@ -0,0 +1,41 @@ +From ef0e904dabbe2103978f6df1096f7e959fbf6abd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 19:09:34 +0200 +Subject: ASoC: renesas: rz-ssi: Use only the proper amount of dividers + +From: Claudiu Beznea + +[ Upstream commit 55c209cd4318c701e6e88e0b2512a0f12dd02a7d ] + +There is no need to populate the ckdv[] with invalid dividers as that +part will not be indexed anyway. The ssi->audio_mck/bclk_rate should +always be >= 0. While at it, change the ckdv type as u8, as the divider +128 was previously using the s8 sign bit. + +Signed-off-by: Claudiu Beznea +Fixes: 03e786bd43410fa9 ("ASoC: sh: Add RZ/G2L SSIF-2 driver") +Reviewed-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20241210170953.2936724-6-claudiu.beznea.uj@bp.renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rz-ssi.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/sound/soc/sh/rz-ssi.c b/sound/soc/sh/rz-ssi.c +index 040ce0431fd2c..32db2cead8a4e 100644 +--- a/sound/soc/sh/rz-ssi.c ++++ b/sound/soc/sh/rz-ssi.c +@@ -258,8 +258,7 @@ static void rz_ssi_stream_quit(struct rz_ssi_priv *ssi, + static int rz_ssi_clk_setup(struct rz_ssi_priv *ssi, unsigned int rate, + unsigned int channels) + { +- static s8 ckdv[16] = { 1, 2, 4, 8, 16, 32, 64, 128, +- 6, 12, 24, 48, 96, -1, -1, -1 }; ++ static u8 ckdv[] = { 1, 2, 4, 8, 16, 32, 64, 128, 6, 12, 24, 48, 96 }; + unsigned int channel_bits = 32; /* System Word Length */ + unsigned long bclk_rate = rate * channels * channel_bits; + unsigned int div; +-- +2.39.5 + diff --git a/queue-6.12/asoc-sun4i-spdif-add-clock-multiplier-settings.patch b/queue-6.12/asoc-sun4i-spdif-add-clock-multiplier-settings.patch new file mode 100644 index 0000000000..2d46b60654 --- /dev/null +++ b/queue-6.12/asoc-sun4i-spdif-add-clock-multiplier-settings.patch @@ -0,0 +1,86 @@ +From d34e1e4f4609a5c9f2c78e40a4bf97361763d99d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Nov 2024 17:55:29 +0100 +Subject: ASoC: sun4i-spdif: Add clock multiplier settings + +From: George Lander + +[ Upstream commit 0a2319308de88b9e819c0b43d0fccd857123eb31 ] + +There have been intermittent issues with the SPDIF output on H3 +and H2+ devices which has been fixed by setting the s_clk to 4 +times the audio pll. +Add a quirk for the clock multiplier as not every supported SoC +requires it. Without the multiplier, the audio at normal sampling +rates was distorted and did not play at higher sampling rates. + +Fixes: 1bd92af877ab ("ASoC: sun4i-spdif: Add support for the H3 SoC") +Signed-off-by: George Lander +Signed-off-by: Marcus Cooper +Link: https://patch.msgid.link/20241111165600.57219-2-codekipper@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sunxi/sun4i-spdif.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/sunxi/sun4i-spdif.c b/sound/soc/sunxi/sun4i-spdif.c +index 0aa4164232464..7cf623cbe9ed4 100644 +--- a/sound/soc/sunxi/sun4i-spdif.c ++++ b/sound/soc/sunxi/sun4i-spdif.c +@@ -176,6 +176,7 @@ struct sun4i_spdif_quirks { + unsigned int reg_dac_txdata; + bool has_reset; + unsigned int val_fctl_ftx; ++ unsigned int mclk_multiplier; + }; + + struct sun4i_spdif_dev { +@@ -313,6 +314,7 @@ static int sun4i_spdif_hw_params(struct snd_pcm_substream *substream, + default: + return -EINVAL; + } ++ mclk *= host->quirks->mclk_multiplier; + + ret = clk_set_rate(host->spdif_clk, mclk); + if (ret < 0) { +@@ -347,6 +349,7 @@ static int sun4i_spdif_hw_params(struct snd_pcm_substream *substream, + default: + return -EINVAL; + } ++ mclk_div *= host->quirks->mclk_multiplier; + + reg_val = 0; + reg_val |= SUN4I_SPDIF_TXCFG_ASS; +@@ -540,24 +543,28 @@ static struct snd_soc_dai_driver sun4i_spdif_dai = { + static const struct sun4i_spdif_quirks sun4i_a10_spdif_quirks = { + .reg_dac_txdata = SUN4I_SPDIF_TXFIFO, + .val_fctl_ftx = SUN4I_SPDIF_FCTL_FTX, ++ .mclk_multiplier = 1, + }; + + static const struct sun4i_spdif_quirks sun6i_a31_spdif_quirks = { + .reg_dac_txdata = SUN4I_SPDIF_TXFIFO, + .val_fctl_ftx = SUN4I_SPDIF_FCTL_FTX, + .has_reset = true, ++ .mclk_multiplier = 1, + }; + + static const struct sun4i_spdif_quirks sun8i_h3_spdif_quirks = { + .reg_dac_txdata = SUN8I_SPDIF_TXFIFO, + .val_fctl_ftx = SUN4I_SPDIF_FCTL_FTX, + .has_reset = true, ++ .mclk_multiplier = 4, + }; + + static const struct sun4i_spdif_quirks sun50i_h6_spdif_quirks = { + .reg_dac_txdata = SUN8I_SPDIF_TXFIFO, + .val_fctl_ftx = SUN50I_H6_SPDIF_FCTL_FTX, + .has_reset = true, ++ .mclk_multiplier = 1, + }; + + static const struct of_device_id sun4i_spdif_of_match[] = { +-- +2.39.5 + diff --git a/queue-6.12/asoc-wcd937x-use-y-for-makefile.patch b/queue-6.12/asoc-wcd937x-use-y-for-makefile.patch new file mode 100644 index 0000000000..91c2199391 --- /dev/null +++ b/queue-6.12/asoc-wcd937x-use-y-for-makefile.patch @@ -0,0 +1,39 @@ +From 4c64887375e11aaee5d684dfe05d6686ae0020f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Dec 2024 15:18:20 +0100 +Subject: ASoC: wcd937x: Use *-y for Makefile + +From: Takashi Iwai + +[ Upstream commit 582057d2233a5a38e1aec3f4a6d66b362b42076c ] + +We should use *-y instead of *-objs in Makefile for the module +objects. *-objs is used rather for host programs. + +Fixes: 313e978df7fc ("ASoC: codecs: wcd937x: add audio routing and Kconfig") +Signed-off-by: Takashi Iwai +Link: https://patch.msgid.link/20241203141823.22393-6-tiwai@suse.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/Makefile b/sound/soc/codecs/Makefile +index 56c519a5c897b..69cb0b39f2200 100644 +--- a/sound/soc/codecs/Makefile ++++ b/sound/soc/codecs/Makefile +@@ -324,8 +324,8 @@ snd-soc-wcd-classh-y := wcd-clsh-v2.o + snd-soc-wcd-mbhc-y := wcd-mbhc-v2.o + snd-soc-wcd9335-y := wcd9335.o + snd-soc-wcd934x-y := wcd934x.o +-snd-soc-wcd937x-objs := wcd937x.o +-snd-soc-wcd937x-sdw-objs := wcd937x-sdw.o ++snd-soc-wcd937x-y := wcd937x.o ++snd-soc-wcd937x-sdw-y := wcd937x-sdw.o + snd-soc-wcd938x-y := wcd938x.o + snd-soc-wcd938x-sdw-y := wcd938x-sdw.o + snd-soc-wcd939x-y := wcd939x.o +-- +2.39.5 + diff --git a/queue-6.12/ax25-rcu-protect-dev-ax25_ptr.patch b/queue-6.12/ax25-rcu-protect-dev-ax25_ptr.patch new file mode 100644 index 0000000000..8218a91d99 --- /dev/null +++ b/queue-6.12/ax25-rcu-protect-dev-ax25_ptr.patch @@ -0,0 +1,340 @@ +From c8bb0787a619dde19ba09989aa4b1f5e86307a4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jan 2025 21:05:14 +0000 +Subject: ax25: rcu protect dev->ax25_ptr + +From: Eric Dumazet + +[ Upstream commit 95fc45d1dea8e1253f8ec58abc5befb71553d666 ] + +syzbot found a lockdep issue [1]. + +We should remove ax25 RTNL dependency in ax25_setsockopt() + +This should also fix a variety of possible UAF in ax25. + +[1] + +WARNING: possible circular locking dependency detected +6.13.0-rc3-syzkaller-00762-g9268abe611b0 #0 Not tainted +------------------------------------------------------ +syz.5.1818/12806 is trying to acquire lock: + ffffffff8fcb3988 (rtnl_mutex){+.+.}-{4:4}, at: ax25_setsockopt+0xa55/0xe90 net/ax25/af_ax25.c:680 + +but task is already holding lock: + ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1618 [inline] + ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: ax25_setsockopt+0x209/0xe90 net/ax25/af_ax25.c:574 + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + +-> #1 (sk_lock-AF_AX25){+.+.}-{0:0}: + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 + lock_sock_nested+0x48/0x100 net/core/sock.c:3642 + lock_sock include/net/sock.h:1618 [inline] + ax25_kill_by_device net/ax25/af_ax25.c:101 [inline] + ax25_device_event+0x24d/0x580 net/ax25/af_ax25.c:146 + notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85 + __dev_notify_flags+0x207/0x400 + dev_change_flags+0xf0/0x1a0 net/core/dev.c:9026 + dev_ifsioc+0x7c8/0xe70 net/core/dev_ioctl.c:563 + dev_ioctl+0x719/0x1340 net/core/dev_ioctl.c:820 + sock_do_ioctl+0x240/0x460 net/socket.c:1234 + sock_ioctl+0x626/0x8e0 net/socket.c:1339 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:906 [inline] + __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +-> #0 (rtnl_mutex){+.+.}-{4:4}: + check_prev_add kernel/locking/lockdep.c:3161 [inline] + check_prevs_add kernel/locking/lockdep.c:3280 [inline] + validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904 + __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226 + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 + __mutex_lock_common kernel/locking/mutex.c:585 [inline] + __mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735 + ax25_setsockopt+0xa55/0xe90 net/ax25/af_ax25.c:680 + do_sock_setsockopt+0x3af/0x720 net/socket.c:2324 + __sys_setsockopt net/socket.c:2349 [inline] + __do_sys_setsockopt net/socket.c:2355 [inline] + __se_sys_setsockopt net/socket.c:2352 [inline] + __x64_sys_setsockopt+0x1ee/0x280 net/socket.c:2352 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +other info that might help us debug this: + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(sk_lock-AF_AX25); + lock(rtnl_mutex); + lock(sk_lock-AF_AX25); + lock(rtnl_mutex); + + *** DEADLOCK *** + +1 lock held by syz.5.1818/12806: + #0: ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1618 [inline] + #0: ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: ax25_setsockopt+0x209/0xe90 net/ax25/af_ax25.c:574 + +stack backtrace: +CPU: 1 UID: 0 PID: 12806 Comm: syz.5.1818 Not tainted 6.13.0-rc3-syzkaller-00762-g9268abe611b0 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 +Call Trace: + + __dump_stack lib/dump_stack.c:94 [inline] + dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 + print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074 + check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2206 + check_prev_add kernel/locking/lockdep.c:3161 [inline] + check_prevs_add kernel/locking/lockdep.c:3280 [inline] + validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904 + __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226 + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 + __mutex_lock_common kernel/locking/mutex.c:585 [inline] + __mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735 + ax25_setsockopt+0xa55/0xe90 net/ax25/af_ax25.c:680 + do_sock_setsockopt+0x3af/0x720 net/socket.c:2324 + __sys_setsockopt net/socket.c:2349 [inline] + __do_sys_setsockopt net/socket.c:2355 [inline] + __se_sys_setsockopt net/socket.c:2352 [inline] + __x64_sys_setsockopt+0x1ee/0x280 net/socket.c:2352 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f +RIP: 0033:0x7f7b62385d29 + +Fixes: c433570458e4 ("ax25: fix a use-after-free in ax25_fillin_cb()") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20250103210514.87290-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/linux/netdevice.h | 2 +- + include/net/ax25.h | 10 +++++----- + net/ax25/af_ax25.c | 12 ++++++------ + net/ax25/ax25_dev.c | 4 ++-- + net/ax25/ax25_ip.c | 3 ++- + net/ax25/ax25_out.c | 22 +++++++++++++++++----- + net/ax25/ax25_route.c | 2 ++ + 7 files changed, 35 insertions(+), 20 deletions(-) + +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index 8896705ccd638..02d3bafebbe77 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -2222,7 +2222,7 @@ struct net_device { + void *atalk_ptr; + #endif + #if IS_ENABLED(CONFIG_AX25) +- void *ax25_ptr; ++ struct ax25_dev __rcu *ax25_ptr; + #endif + #if IS_ENABLED(CONFIG_CFG80211) + struct wireless_dev *ieee80211_ptr; +diff --git a/include/net/ax25.h b/include/net/ax25.h +index cb622d84cd0cc..4ee141aae0a29 100644 +--- a/include/net/ax25.h ++++ b/include/net/ax25.h +@@ -231,6 +231,7 @@ typedef struct ax25_dev { + #endif + refcount_t refcount; + bool device_up; ++ struct rcu_head rcu; + } ax25_dev; + + typedef struct ax25_cb { +@@ -290,9 +291,8 @@ static inline void ax25_dev_hold(ax25_dev *ax25_dev) + + static inline void ax25_dev_put(ax25_dev *ax25_dev) + { +- if (refcount_dec_and_test(&ax25_dev->refcount)) { +- kfree(ax25_dev); +- } ++ if (refcount_dec_and_test(&ax25_dev->refcount)) ++ kfree_rcu(ax25_dev, rcu); + } + static inline __be16 ax25_type_trans(struct sk_buff *skb, struct net_device *dev) + { +@@ -335,9 +335,9 @@ void ax25_digi_invert(const ax25_digi *, ax25_digi *); + extern spinlock_t ax25_dev_lock; + + #if IS_ENABLED(CONFIG_AX25) +-static inline ax25_dev *ax25_dev_ax25dev(struct net_device *dev) ++static inline ax25_dev *ax25_dev_ax25dev(const struct net_device *dev) + { +- return dev->ax25_ptr; ++ return rcu_dereference_rtnl(dev->ax25_ptr); + } + #endif + +diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c +index d6f9fae06a9d8..aa6c714892ec9 100644 +--- a/net/ax25/af_ax25.c ++++ b/net/ax25/af_ax25.c +@@ -467,7 +467,7 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg) + goto out_put; + } + +-static void ax25_fillin_cb_from_dev(ax25_cb *ax25, ax25_dev *ax25_dev) ++static void ax25_fillin_cb_from_dev(ax25_cb *ax25, const ax25_dev *ax25_dev) + { + ax25->rtt = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T1]) / 2; + ax25->t1 = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T1]); +@@ -677,22 +677,22 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, + break; + } + +- rtnl_lock(); +- dev = __dev_get_by_name(&init_net, devname); ++ rcu_read_lock(); ++ dev = dev_get_by_name_rcu(&init_net, devname); + if (!dev) { +- rtnl_unlock(); ++ rcu_read_unlock(); + res = -ENODEV; + break; + } + + ax25->ax25_dev = ax25_dev_ax25dev(dev); + if (!ax25->ax25_dev) { +- rtnl_unlock(); ++ rcu_read_unlock(); + res = -ENODEV; + break; + } + ax25_fillin_cb(ax25, ax25->ax25_dev); +- rtnl_unlock(); ++ rcu_read_unlock(); + break; + + default: +diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c +index 9efd6690b3443..3733c0254a508 100644 +--- a/net/ax25/ax25_dev.c ++++ b/net/ax25/ax25_dev.c +@@ -90,7 +90,7 @@ void ax25_dev_device_up(struct net_device *dev) + + spin_lock_bh(&ax25_dev_lock); + list_add(&ax25_dev->list, &ax25_dev_list); +- dev->ax25_ptr = ax25_dev; ++ rcu_assign_pointer(dev->ax25_ptr, ax25_dev); + spin_unlock_bh(&ax25_dev_lock); + + ax25_register_dev_sysctl(ax25_dev); +@@ -125,7 +125,7 @@ void ax25_dev_device_down(struct net_device *dev) + } + } + +- dev->ax25_ptr = NULL; ++ RCU_INIT_POINTER(dev->ax25_ptr, NULL); + spin_unlock_bh(&ax25_dev_lock); + netdev_put(dev, &ax25_dev->dev_tracker); + ax25_dev_put(ax25_dev); +diff --git a/net/ax25/ax25_ip.c b/net/ax25/ax25_ip.c +index 36249776c021e..215d4ccf12b91 100644 +--- a/net/ax25/ax25_ip.c ++++ b/net/ax25/ax25_ip.c +@@ -122,6 +122,7 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff *skb) + if (dev == NULL) + dev = skb->dev; + ++ rcu_read_lock(); + if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL) { + kfree_skb(skb); + goto put; +@@ -202,7 +203,7 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff *skb) + ax25_queue_xmit(skb, dev); + + put: +- ++ rcu_read_unlock(); + ax25_route_lock_unuse(); + return NETDEV_TX_OK; + } +diff --git a/net/ax25/ax25_out.c b/net/ax25/ax25_out.c +index 3db76d2470e95..8bca2ace98e51 100644 +--- a/net/ax25/ax25_out.c ++++ b/net/ax25/ax25_out.c +@@ -39,10 +39,14 @@ ax25_cb *ax25_send_frame(struct sk_buff *skb, int paclen, const ax25_address *sr + * specified. + */ + if (paclen == 0) { +- if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL) ++ rcu_read_lock(); ++ ax25_dev = ax25_dev_ax25dev(dev); ++ if (!ax25_dev) { ++ rcu_read_unlock(); + return NULL; +- ++ } + paclen = ax25_dev->values[AX25_VALUES_PACLEN]; ++ rcu_read_unlock(); + } + + /* +@@ -53,13 +57,19 @@ ax25_cb *ax25_send_frame(struct sk_buff *skb, int paclen, const ax25_address *sr + return ax25; /* It already existed */ + } + +- if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL) ++ rcu_read_lock(); ++ ax25_dev = ax25_dev_ax25dev(dev); ++ if (!ax25_dev) { ++ rcu_read_unlock(); + return NULL; ++ } + +- if ((ax25 = ax25_create_cb()) == NULL) ++ if ((ax25 = ax25_create_cb()) == NULL) { ++ rcu_read_unlock(); + return NULL; +- ++ } + ax25_fillin_cb(ax25, ax25_dev); ++ rcu_read_unlock(); + + ax25->source_addr = *src; + ax25->dest_addr = *dest; +@@ -358,7 +368,9 @@ void ax25_queue_xmit(struct sk_buff *skb, struct net_device *dev) + { + unsigned char *ptr; + ++ rcu_read_lock(); + skb->protocol = ax25_type_trans(skb, ax25_fwd_dev(dev)); ++ rcu_read_unlock(); + + ptr = skb_push(skb, 1); + *ptr = 0x00; /* KISS */ +diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c +index b7c4d656a94b7..69de75db0c9c2 100644 +--- a/net/ax25/ax25_route.c ++++ b/net/ax25/ax25_route.c +@@ -406,6 +406,7 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr) + ax25_route_lock_unuse(); + return -EHOSTUNREACH; + } ++ rcu_read_lock(); + if ((ax25->ax25_dev = ax25_dev_ax25dev(ax25_rt->dev)) == NULL) { + err = -EHOSTUNREACH; + goto put; +@@ -442,6 +443,7 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr) + } + + put: ++ rcu_read_unlock(); + ax25_route_lock_unuse(); + return err; + } +-- +2.39.5 + diff --git a/queue-6.12/bgmac-reduce-max-frame-size-to-support-just-mtu-1500.patch b/queue-6.12/bgmac-reduce-max-frame-size-to-support-just-mtu-1500.patch new file mode 100644 index 0000000000..3893f84f57 --- /dev/null +++ b/queue-6.12/bgmac-reduce-max-frame-size-to-support-just-mtu-1500.patch @@ -0,0 +1,73 @@ +From 22f222b0e70d3a74dddbee205653df1fa5db2d70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Jan 2025 09:51:59 -0800 +Subject: bgmac: reduce max frame size to support just MTU 1500 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 752e5fcc2e77358936d36ef8e522d6439372e201 ] + +bgmac allocates new replacement buffer before handling each received +frame. Allocating & DMA-preparing 9724 B each time consumes a lot of CPU +time. Ideally bgmac should just respect currently set MTU but it isn't +the case right now. For now just revert back to the old limited frame +size. + +This change bumps NAT masquerade speed by ~95%. + +Since commit 8218f62c9c9b ("mm: page_frag: use initial zero offset for +page_frag_alloc_align()"), the bgmac driver fails to open its network +interface successfully and runs out of memory in the following call +stack: + +bgmac_open + -> bgmac_dma_init + -> bgmac_dma_rx_skb_for_slot + -> netdev_alloc_frag + +BGMAC_RX_ALLOC_SIZE = 10048 and PAGE_FRAG_CACHE_MAX_SIZE = 32768. + +Eventually we land into __page_frag_alloc_align() with the following +parameters across multiple successive calls: + +__page_frag_alloc_align: fragsz=10048, align_mask=-1, size=32768, offset=0 +__page_frag_alloc_align: fragsz=10048, align_mask=-1, size=32768, offset=10048 +__page_frag_alloc_align: fragsz=10048, align_mask=-1, size=32768, offset=20096 +__page_frag_alloc_align: fragsz=10048, align_mask=-1, size=32768, offset=30144 + +So in that case we do indeed have offset + fragsz (40192) > size (32768) +and so we would eventually return NULL. Reverting to the older 1500 +bytes MTU allows the network driver to be usable again. + +Fixes: 8c7da63978f1 ("bgmac: configure MTU and add support for frames beyond 8192 byte size") +Signed-off-by: Rafał Miłecki +[florian: expand commit message about recent commits] +Reviewed-by: Simon Horman +Signed-off-by: Florian Fainelli +Link: https://patch.msgid.link/20250127175159.1788246-1-florian.fainelli@broadcom.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bgmac.h | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bgmac.h b/drivers/net/ethernet/broadcom/bgmac.h +index d73ef262991d6..6fee9a41839c0 100644 +--- a/drivers/net/ethernet/broadcom/bgmac.h ++++ b/drivers/net/ethernet/broadcom/bgmac.h +@@ -328,8 +328,7 @@ + #define BGMAC_RX_FRAME_OFFSET 30 /* There are 2 unused bytes between header and real data */ + #define BGMAC_RX_BUF_OFFSET (NET_SKB_PAD + NET_IP_ALIGN - \ + BGMAC_RX_FRAME_OFFSET) +-/* Jumbo frame size with FCS */ +-#define BGMAC_RX_MAX_FRAME_SIZE 9724 ++#define BGMAC_RX_MAX_FRAME_SIZE 1536 + #define BGMAC_RX_BUF_SIZE (BGMAC_RX_FRAME_OFFSET + BGMAC_RX_MAX_FRAME_SIZE) + #define BGMAC_RX_ALLOC_SIZE (SKB_DATA_ALIGN(BGMAC_RX_BUF_SIZE + BGMAC_RX_BUF_OFFSET) + \ + SKB_DATA_ALIGN(sizeof(struct skb_shared_info))) +-- +2.39.5 + diff --git a/queue-6.12/block-check-blk_feat_poll-under-q_usage_count.patch b/queue-6.12/block-check-blk_feat_poll-under-q_usage_count.patch new file mode 100644 index 0000000000..249b817c18 --- /dev/null +++ b/queue-6.12/block-check-blk_feat_poll-under-q_usage_count.patch @@ -0,0 +1,114 @@ +From df292d5fc97ec1f3bae89840af03036028c931ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 06:47:11 +0100 +Subject: block: check BLK_FEAT_POLL under q_usage_count + +From: Christoph Hellwig + +[ Upstream commit 958148a6ac061a9a80a184ea678a5fa872d0c56f ] + +Otherwise feature reconfiguration can race with I/O submission. + +Also drop the bio_clear_polled in the error path, as the flag does not +matter for instant error completions, it is a left over from when we +allowed polled I/O to proceed unpolled in this case. + +Signed-off-by: Christoph Hellwig +Reviewed-by: Ming Lei +Reviewed-by: Nilay Shroff +Reviewed-by: Martin K. Petersen +Link: https://lore.kernel.org/r/20250110054726.1499538-4-hch@lst.de +Signed-off-by: Jens Axboe +Stable-dep-of: d432c817c21a ("block: don't update BLK_FEAT_POLL in __blk_mq_update_nr_hw_queues") +Signed-off-by: Sasha Levin +--- + block/blk-core.c | 22 ++++++++++++---------- + block/blk-mq.c | 12 ++++++++++-- + 2 files changed, 22 insertions(+), 12 deletions(-) + +diff --git a/block/blk-core.c b/block/blk-core.c +index 4f791a3114a12..487e8cafccc55 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -629,8 +629,14 @@ static void __submit_bio(struct bio *bio) + blk_mq_submit_bio(bio); + } else if (likely(bio_queue_enter(bio) == 0)) { + struct gendisk *disk = bio->bi_bdev->bd_disk; +- +- disk->fops->submit_bio(bio); ++ ++ if ((bio->bi_opf & REQ_POLLED) && ++ !(disk->queue->limits.features & BLK_FEAT_POLL)) { ++ bio->bi_status = BLK_STS_NOTSUPP; ++ bio_endio(bio); ++ } else { ++ disk->fops->submit_bio(bio); ++ } + blk_queue_exit(disk->queue); + } + +@@ -805,12 +811,6 @@ void submit_bio_noacct(struct bio *bio) + } + } + +- if (!(q->limits.features & BLK_FEAT_POLL) && +- (bio->bi_opf & REQ_POLLED)) { +- bio_clear_polled(bio); +- goto not_supported; +- } +- + switch (bio_op(bio)) { + case REQ_OP_READ: + break; +@@ -935,7 +935,7 @@ int bio_poll(struct bio *bio, struct io_comp_batch *iob, unsigned int flags) + return 0; + + q = bdev_get_queue(bdev); +- if (cookie == BLK_QC_T_NONE || !(q->limits.features & BLK_FEAT_POLL)) ++ if (cookie == BLK_QC_T_NONE) + return 0; + + blk_flush_plug(current->plug, false); +@@ -951,7 +951,9 @@ int bio_poll(struct bio *bio, struct io_comp_batch *iob, unsigned int flags) + */ + if (!percpu_ref_tryget(&q->q_usage_counter)) + return 0; +- if (queue_is_mq(q)) { ++ if (!(q->limits.features & BLK_FEAT_POLL)) { ++ ret = 0; ++ } else if (queue_is_mq(q)) { + ret = blk_mq_poll(q, cookie, iob, flags); + } else { + struct gendisk *disk = q->disk; +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 4e76651e786d1..784d41eb0abba 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -3092,14 +3092,22 @@ void blk_mq_submit_bio(struct bio *bio) + } + + /* +- * Device reconfiguration may change logical block size, so alignment +- * check has to be done with queue usage counter held ++ * Device reconfiguration may change logical block size or reduce the ++ * number of poll queues, so the checks for alignment and poll support ++ * have to be done with queue usage counter held. + */ + if (unlikely(bio_unaligned(bio, q))) { + bio_io_error(bio); + goto queue_exit; + } + ++ if ((bio->bi_opf & REQ_POLLED) && ++ !(q->limits.features & BLK_FEAT_POLL)) { ++ bio->bi_status = BLK_STS_NOTSUPP; ++ bio_endio(bio); ++ goto queue_exit; ++ } ++ + bio = __bio_split_to_limits(bio, &q->limits, &nr_segs); + if (!bio) + goto queue_exit; +-- +2.39.5 + diff --git a/queue-6.12/block-copy-back-bounce-buffer-to-user-space-correctl.patch b/queue-6.12/block-copy-back-bounce-buffer-to-user-space-correctl.patch new file mode 100644 index 0000000000..64d9b7490a --- /dev/null +++ b/queue-6.12/block-copy-back-bounce-buffer-to-user-space-correctl.patch @@ -0,0 +1,60 @@ +From 35b2e45d84f9fe036a969756873af15d9d6c4fac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Nov 2024 16:52:32 +0530 +Subject: block: copy back bounce buffer to user-space correctly in case of + split + +From: Christoph Hellwig + +[ Upstream commit 031141976be0bd5f385775727a4ed3cc845eb7ba ] + +Copy back the bounce buffer to user-space in entirety when the parent +bio completes. The existing code uses bip_iter.bi_size for sizing the +copy, which can be modified. So move away from that and fetch it from +the vector passed to the block layer. While at it, switch to using +better variable names. + +Fixes: 492c5d455969f ("block: bio-integrity: directly map user buffers") +Signed-off-by: Christoph Hellwig +Signed-off-by: Anuj Gupta +Reviewed-by: Keith Busch +Link: https://lore.kernel.org/r/20241128112240.8867-3-anuj20.g@samsung.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bio-integrity.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/block/bio-integrity.c b/block/bio-integrity.c +index 88e3ad73c3854..9aed61fcd0bf9 100644 +--- a/block/bio-integrity.c ++++ b/block/bio-integrity.c +@@ -118,17 +118,18 @@ static void bio_integrity_unpin_bvec(struct bio_vec *bv, int nr_vecs, + + static void bio_integrity_uncopy_user(struct bio_integrity_payload *bip) + { +- unsigned short nr_vecs = bip->bip_max_vcnt - 1; +- struct bio_vec *copy = &bip->bip_vec[1]; +- size_t bytes = bip->bip_iter.bi_size; +- struct iov_iter iter; ++ unsigned short orig_nr_vecs = bip->bip_max_vcnt - 1; ++ struct bio_vec *orig_bvecs = &bip->bip_vec[1]; ++ struct bio_vec *bounce_bvec = &bip->bip_vec[0]; ++ size_t bytes = bounce_bvec->bv_len; ++ struct iov_iter orig_iter; + int ret; + +- iov_iter_bvec(&iter, ITER_DEST, copy, nr_vecs, bytes); +- ret = copy_to_iter(bvec_virt(bip->bip_vec), bytes, &iter); ++ iov_iter_bvec(&orig_iter, ITER_DEST, orig_bvecs, orig_nr_vecs, bytes); ++ ret = copy_to_iter(bvec_virt(bounce_bvec), bytes, &orig_iter); + WARN_ON_ONCE(ret != bytes); + +- bio_integrity_unpin_bvec(copy, nr_vecs, true); ++ bio_integrity_unpin_bvec(orig_bvecs, orig_nr_vecs, true); + } + + /** +-- +2.39.5 + diff --git a/queue-6.12/block-don-t-update-blk_feat_poll-in-__blk_mq_update_.patch b/queue-6.12/block-don-t-update-blk_feat_poll-in-__blk_mq_update_.patch new file mode 100644 index 0000000000..59fb06e323 --- /dev/null +++ b/queue-6.12/block-don-t-update-blk_feat_poll-in-__blk_mq_update_.patch @@ -0,0 +1,172 @@ +From e01c0fac91b8e31e0045820772bfeda8ac138002 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 06:47:12 +0100 +Subject: block: don't update BLK_FEAT_POLL in __blk_mq_update_nr_hw_queues + +From: Christoph Hellwig + +[ Upstream commit d432c817c21a48c3baaa0d28e4d3e74b6aa238a0 ] + +When __blk_mq_update_nr_hw_queues changes the number of tag sets, it +might have to disable poll queues. Currently it does so by adjusting +the BLK_FEAT_POLL, which is a bit against the intent of features that +describe hardware / driver capabilities, but more importantly causes +nasty lock order problems with the broadly held freeze when updating the +number of hardware queues and the limits lock. Fix this by leaving +BLK_FEAT_POLL alone, and instead check for the number of poll queues in +the bio submission and poll handlers. While this adds extra work to the +fast path, the variables are in cache lines used by these operations +anyway, so it should be cheap enough. + +Fixes: 8023e144f9d6 ("block: move the poll flag to queue_limits") +Signed-off-by: Christoph Hellwig +Reviewed-by: Ming Lei +Reviewed-by: Damien Le Moal +Reviewed-by: Martin K. Petersen +Reviewed-by: Johannes Thumshirn +Reviewed-by: Nilay Shroff +Link: https://lore.kernel.org/r/20250110054726.1499538-5-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-core.c | 7 +++---- + block/blk-mq.c | 26 +++++--------------------- + block/blk-mq.h | 6 ++++++ + block/blk-sysfs.c | 9 ++++++++- + 4 files changed, 22 insertions(+), 26 deletions(-) + +diff --git a/block/blk-core.c b/block/blk-core.c +index 487e8cafccc55..42023addf9cda 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -951,14 +951,13 @@ int bio_poll(struct bio *bio, struct io_comp_batch *iob, unsigned int flags) + */ + if (!percpu_ref_tryget(&q->q_usage_counter)) + return 0; +- if (!(q->limits.features & BLK_FEAT_POLL)) { +- ret = 0; +- } else if (queue_is_mq(q)) { ++ if (queue_is_mq(q)) { + ret = blk_mq_poll(q, cookie, iob, flags); + } else { + struct gendisk *disk = q->disk; + +- if (disk && disk->fops->poll_bio) ++ if ((q->limits.features & BLK_FEAT_POLL) && disk && ++ disk->fops->poll_bio) + ret = disk->fops->poll_bio(bio, iob, flags); + } + blk_queue_exit(q); +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 784d41eb0abba..662e52ab06467 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -3101,8 +3101,7 @@ void blk_mq_submit_bio(struct bio *bio) + goto queue_exit; + } + +- if ((bio->bi_opf & REQ_POLLED) && +- !(q->limits.features & BLK_FEAT_POLL)) { ++ if ((bio->bi_opf & REQ_POLLED) && !blk_mq_can_poll(q)) { + bio->bi_status = BLK_STS_NOTSUPP; + bio_endio(bio); + goto queue_exit; +@@ -4333,12 +4332,6 @@ void blk_mq_release(struct request_queue *q) + blk_mq_sysfs_deinit(q); + } + +-static bool blk_mq_can_poll(struct blk_mq_tag_set *set) +-{ +- return set->nr_maps > HCTX_TYPE_POLL && +- set->map[HCTX_TYPE_POLL].nr_queues; +-} +- + struct request_queue *blk_mq_alloc_queue(struct blk_mq_tag_set *set, + struct queue_limits *lim, void *queuedata) + { +@@ -4349,7 +4342,7 @@ struct request_queue *blk_mq_alloc_queue(struct blk_mq_tag_set *set, + if (!lim) + lim = &default_lim; + lim->features |= BLK_FEAT_IO_STAT | BLK_FEAT_NOWAIT; +- if (blk_mq_can_poll(set)) ++ if (set->nr_maps > HCTX_TYPE_POLL) + lim->features |= BLK_FEAT_POLL; + + q = blk_alloc_queue(lim, set->numa_node); +@@ -5037,8 +5030,6 @@ static void __blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, + fallback: + blk_mq_update_queue_map(set); + list_for_each_entry(q, &set->tag_list, tag_set_list) { +- struct queue_limits lim; +- + blk_mq_realloc_hw_ctxs(set, q); + + if (q->nr_hw_queues != set->nr_hw_queues) { +@@ -5052,13 +5043,6 @@ static void __blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, + set->nr_hw_queues = prev_nr_hw_queues; + goto fallback; + } +- lim = queue_limits_start_update(q); +- if (blk_mq_can_poll(set)) +- lim.features |= BLK_FEAT_POLL; +- else +- lim.features &= ~BLK_FEAT_POLL; +- if (queue_limits_commit_update(q, &lim) < 0) +- pr_warn("updating the poll flag failed\n"); + blk_mq_map_swqueue(q); + } + +@@ -5118,9 +5102,9 @@ static int blk_hctx_poll(struct request_queue *q, struct blk_mq_hw_ctx *hctx, + int blk_mq_poll(struct request_queue *q, blk_qc_t cookie, + struct io_comp_batch *iob, unsigned int flags) + { +- struct blk_mq_hw_ctx *hctx = xa_load(&q->hctx_table, cookie); +- +- return blk_hctx_poll(q, hctx, iob, flags); ++ if (!blk_mq_can_poll(q)) ++ return 0; ++ return blk_hctx_poll(q, xa_load(&q->hctx_table, cookie), iob, flags); + } + + int blk_rq_poll(struct request *rq, struct io_comp_batch *iob, +diff --git a/block/blk-mq.h b/block/blk-mq.h +index f4ac1af77a267..364c0415293cf 100644 +--- a/block/blk-mq.h ++++ b/block/blk-mq.h +@@ -451,4 +451,10 @@ do { \ + #define blk_mq_run_dispatch_ops(q, dispatch_ops) \ + __blk_mq_run_dispatch_ops(q, true, dispatch_ops) \ + ++static inline bool blk_mq_can_poll(struct request_queue *q) ++{ ++ return (q->limits.features & BLK_FEAT_POLL) && ++ q->tag_set->map[HCTX_TYPE_POLL].nr_queues; ++} ++ + #endif +diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c +index 207577145c54f..692b27266220f 100644 +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -256,10 +256,17 @@ static ssize_t queue_##_name##_show(struct gendisk *disk, char *page) \ + !!(disk->queue->limits.features & _feature)); \ + } + +-QUEUE_SYSFS_FEATURE_SHOW(poll, BLK_FEAT_POLL); + QUEUE_SYSFS_FEATURE_SHOW(fua, BLK_FEAT_FUA); + QUEUE_SYSFS_FEATURE_SHOW(dax, BLK_FEAT_DAX); + ++static ssize_t queue_poll_show(struct gendisk *disk, char *page) ++{ ++ if (queue_is_mq(disk->queue)) ++ return sysfs_emit(page, "%u\n", blk_mq_can_poll(disk->queue)); ++ return sysfs_emit(page, "%u\n", ++ !!(disk->queue->limits.features & BLK_FEAT_POLL)); ++} ++ + static ssize_t queue_zoned_show(struct gendisk *disk, char *page) + { + if (blk_queue_is_zoned(disk->queue)) +-- +2.39.5 + diff --git a/queue-6.12/block-retry-call-probe-after-request_module-in-blk_r.patch b/queue-6.12/block-retry-call-probe-after-request_module-in-blk_r.patch new file mode 100644 index 0000000000..33c90707fe --- /dev/null +++ b/queue-6.12/block-retry-call-probe-after-request_module-in-blk_r.patch @@ -0,0 +1,85 @@ +From 6d712d48564247b60140e866628d1233dd058f83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Dec 2024 19:04:35 +0800 +Subject: block: retry call probe after request_module in blk_request_module + +From: Yang Erkun + +[ Upstream commit 457ef47c08d2979f3e59ce66267485c3faed70c8 ] + +Set kernel config: + + CONFIG_BLK_DEV_LOOP=m + CONFIG_BLK_DEV_LOOP_MIN_COUNT=0 + +Do latter: + + mknod loop0 b 7 0 + exec 4<> loop0 + +Before commit e418de3abcda ("block: switch gendisk lookup to a simple +xarray"), lookup_gendisk will first use base_probe to load module loop, +and then the retry will call loop_probe to prepare the loop disk. Finally +open for this disk will success. However, after this commit, we lose the +retry logic, and open will fail with ENXIO. Block device autoloading is +deprecated and will be removed soon, but maybe we should keep open success +until we really remove it. So, give a retry to fix it. + +Fixes: e418de3abcda ("block: switch gendisk lookup to a simple xarray") +Suggested-by: Christoph Hellwig +Signed-off-by: Yang Erkun +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20241209110435.3670985-1-yangerkun@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/genhd.c | 22 +++++++++++++++++----- + 1 file changed, 17 insertions(+), 5 deletions(-) + +diff --git a/block/genhd.c b/block/genhd.c +index 8645cf3b0816e..99344f53c7897 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -778,7 +778,7 @@ static ssize_t disk_badblocks_store(struct device *dev, + } + + #ifdef CONFIG_BLOCK_LEGACY_AUTOLOAD +-void blk_request_module(dev_t devt) ++static bool blk_probe_dev(dev_t devt) + { + unsigned int major = MAJOR(devt); + struct blk_major_name **n; +@@ -788,14 +788,26 @@ void blk_request_module(dev_t devt) + if ((*n)->major == major && (*n)->probe) { + (*n)->probe(devt); + mutex_unlock(&major_names_lock); +- return; ++ return true; + } + } + mutex_unlock(&major_names_lock); ++ return false; ++} ++ ++void blk_request_module(dev_t devt) ++{ ++ int error; ++ ++ if (blk_probe_dev(devt)) ++ return; + +- if (request_module("block-major-%d-%d", MAJOR(devt), MINOR(devt)) > 0) +- /* Make old-style 2.4 aliases work */ +- request_module("block-major-%d", MAJOR(devt)); ++ error = request_module("block-major-%d-%d", MAJOR(devt), MINOR(devt)); ++ /* Make old-style 2.4 aliases work */ ++ if (error > 0) ++ error = request_module("block-major-%d", MAJOR(devt)); ++ if (!error) ++ blk_probe_dev(devt); + } + #endif /* CONFIG_BLOCK_LEGACY_AUTOLOAD */ + +-- +2.39.5 + diff --git a/queue-6.12/bluetooth-btbcm-fix-null-deref-in-btbcm_get_board_na.patch b/queue-6.12/bluetooth-btbcm-fix-null-deref-in-btbcm_get_board_na.patch new file mode 100644 index 0000000000..be930da99c --- /dev/null +++ b/queue-6.12/bluetooth-btbcm-fix-null-deref-in-btbcm_get_board_na.patch @@ -0,0 +1,39 @@ +From ba4d67f4bae6bc565a6ee4e2e4cf3cb166aaade0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Dec 2024 17:20:46 +0800 +Subject: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() + +From: Charles Han + +[ Upstream commit b88655bc6593c6a7fdc1248b212d17e581c4334e ] + +devm_kstrdup() can return a NULL pointer on failure,but this +returned value in btbcm_get_board_name() is not checked. +Add NULL check in btbcm_get_board_name(), to handle kernel NULL +pointer dereference error. + +Fixes: f9183eaad915 ("Bluetooth: btbcm: Use devm_kstrdup()") +Signed-off-by: Charles Han +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btbcm.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/bluetooth/btbcm.c b/drivers/bluetooth/btbcm.c +index a1153ada74d20..0a60660fc8ce8 100644 +--- a/drivers/bluetooth/btbcm.c ++++ b/drivers/bluetooth/btbcm.c +@@ -553,6 +553,9 @@ static const char *btbcm_get_board_name(struct device *dev) + + /* get rid of any '/' in the compatible string */ + board_type = devm_kstrdup(dev, tmp, GFP_KERNEL); ++ if (!board_type) ++ return NULL; ++ + strreplace(board_type, '/', '-'); + + return board_type; +-- +2.39.5 + diff --git a/queue-6.12/bluetooth-btnxpuart-fix-glitches-seen-in-dual-a2dp-s.patch b/queue-6.12/bluetooth-btnxpuart-fix-glitches-seen-in-dual-a2dp-s.patch new file mode 100644 index 0000000000..a7d4071415 --- /dev/null +++ b/queue-6.12/bluetooth-btnxpuart-fix-glitches-seen-in-dual-a2dp-s.patch @@ -0,0 +1,50 @@ +From 9083b26156a5673987517c62f81d4be878995daa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jan 2025 19:49:46 +0530 +Subject: Bluetooth: btnxpuart: Fix glitches seen in dual A2DP streaming + +From: Neeraj Sanjay Kale + +[ Upstream commit 7de119bb79a63f6a1959b83117a98734914fb0b0 ] + +This fixes a regression caused by previous commit for fixing truncated +ACL data, which is causing some intermittent glitches when running two +A2DP streams. + +serdev_device_write_buf() is the root cause of the glitch, which is +reverted, and the TX work will continue to write until the queue is empty. + +This change fixes both issues. No A2DP streaming glitches or truncated +ACL data issue observed. + +Fixes: 8023dd220425 ("Bluetooth: btnxpuart: Fix driver sending truncated data") +Fixes: 689ca16e5232 ("Bluetooth: NXP: Add protocol support for NXP Bluetooth chipsets") +Signed-off-by: Neeraj Sanjay Kale +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btnxpuart.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c +index a028984f27829..84a1ad61c4ad5 100644 +--- a/drivers/bluetooth/btnxpuart.c ++++ b/drivers/bluetooth/btnxpuart.c +@@ -1336,13 +1336,12 @@ static void btnxpuart_tx_work(struct work_struct *work) + + while ((skb = nxp_dequeue(nxpdev))) { + len = serdev_device_write_buf(serdev, skb->data, skb->len); +- serdev_device_wait_until_sent(serdev, 0); + hdev->stat.byte_tx += len; + + skb_pull(skb, len); + if (skb->len > 0) { + skb_queue_head(&nxpdev->txq, skb); +- break; ++ continue; + } + + switch (hci_skb_pkt_type(skb)) { +-- +2.39.5 + diff --git a/queue-6.12/bluetooth-btrtl-check-for-null-in-btrtl_setup_realte.patch b/queue-6.12/bluetooth-btrtl-check-for-null-in-btrtl_setup_realte.patch new file mode 100644 index 0000000000..13821492dc --- /dev/null +++ b/queue-6.12/bluetooth-btrtl-check-for-null-in-btrtl_setup_realte.patch @@ -0,0 +1,45 @@ +From 7223b9c244ef91bb7ea80df72c0a9b4c47b8a736 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Dec 2024 14:57:19 +0800 +Subject: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() + +From: Max Chou + +[ Upstream commit 3c15082f3567032d196e8760753373332508c2ca ] + +If insert an USB dongle which chip is not maintained in ic_id_table, it +will hit the NULL point accessed. Add a null point check to avoid the +Kernel Oops. + +Fixes: b39910bb54d9 ("Bluetooth: Populate hci_set_hw_info for Intel and Realtek") +Reviewed-by: Alex Lu +Signed-off-by: Max Chou +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btrtl.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c +index 0bcb44cf7b31d..0a6ca6dfb9484 100644 +--- a/drivers/bluetooth/btrtl.c ++++ b/drivers/bluetooth/btrtl.c +@@ -1351,12 +1351,14 @@ int btrtl_setup_realtek(struct hci_dev *hdev) + + btrtl_set_quirks(hdev, btrtl_dev); + +- hci_set_hw_info(hdev, ++ if (btrtl_dev->ic_info) { ++ hci_set_hw_info(hdev, + "RTL lmp_subver=%u hci_rev=%u hci_ver=%u hci_bus=%u", + btrtl_dev->ic_info->lmp_subver, + btrtl_dev->ic_info->hci_rev, + btrtl_dev->ic_info->hci_ver, + btrtl_dev->ic_info->hci_bus); ++ } + + btrtl_free(btrtl_dev); + return ret; +-- +2.39.5 + diff --git a/queue-6.12/bluetooth-btusb-mediatek-add-locks-for-usb_driver_cl.patch b/queue-6.12/bluetooth-btusb-mediatek-add-locks-for-usb_driver_cl.patch new file mode 100644 index 0000000000..0f3bdba063 --- /dev/null +++ b/queue-6.12/bluetooth-btusb-mediatek-add-locks-for-usb_driver_cl.patch @@ -0,0 +1,74 @@ +From 8d217d01353a21b60c1d82fa8decceb479a3f9b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 19:36:36 -0800 +Subject: Bluetooth: btusb: mediatek: Add locks for + usb_driver_claim_interface() + +From: Douglas Anderson + +[ Upstream commit e9087e828827e5a5c85e124ce77503f2b81c3491 ] + +The documentation for usb_driver_claim_interface() says that "the +device lock" is needed when the function is called from places other +than probe(). This appears to be the lock for the USB interface +device. The Mediatek btusb code gets called via this path: + + Workqueue: hci0 hci_power_on [bluetooth] + Call trace: + usb_driver_claim_interface + btusb_mtk_claim_iso_intf + btusb_mtk_setup + hci_dev_open_sync + hci_power_on + process_scheduled_works + worker_thread + kthread + +With the above call trace the device lock hasn't been claimed. Claim +it. + +Without this fix, we'd sometimes see the error "Failed to claim iso +interface". Sometimes we'd even see worse errors, like a NULL pointer +dereference (where `intf->dev.driver` was NULL) with a trace like: + + Call trace: + usb_suspend_both + usb_runtime_suspend + __rpm_callback + rpm_suspend + pm_runtime_work + process_scheduled_works + +Both errors appear to be fixed with the proper locking. + +Fixes: ceac1cb0259d ("Bluetooth: btusb: mediatek: add ISO data transmission functions") +Signed-off-by: Douglas Anderson +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 0c85c981a8334..258a5cb6f27af 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -2632,8 +2632,15 @@ static void btusb_mtk_claim_iso_intf(struct btusb_data *data) + struct btmtk_data *btmtk_data = hci_get_priv(data->hdev); + int err; + ++ /* ++ * The function usb_driver_claim_interface() is documented to need ++ * locks held if it's not called from a probe routine. The code here ++ * is called from the hci_power_on workqueue, so grab the lock. ++ */ ++ device_lock(&btmtk_data->isopkt_intf->dev); + err = usb_driver_claim_interface(&btusb_driver, + btmtk_data->isopkt_intf, data); ++ device_unlock(&btmtk_data->isopkt_intf->dev); + if (err < 0) { + btmtk_data->isopkt_intf = NULL; + bt_dev_err(data->hdev, "Failed to claim iso interface"); +-- +2.39.5 + diff --git a/queue-6.12/bpf-bpf_local_storage-always-use-bpf_mem_alloc-in-pr.patch b/queue-6.12/bpf-bpf_local_storage-always-use-bpf_mem_alloc-in-pr.patch new file mode 100644 index 0000000000..3aea972655 --- /dev/null +++ b/queue-6.12/bpf-bpf_local_storage-always-use-bpf_mem_alloc-in-pr.patch @@ -0,0 +1,77 @@ +From 94a1c388314572205f0affc952c5ace6f4b60e5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Dec 2024 11:30:00 -0800 +Subject: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT + +From: Martin KaFai Lau + +[ Upstream commit 8eef6ac4d70eb1f0099fff93321d90ce8fa49ee1 ] + +In PREEMPT_RT, kmalloc(GFP_ATOMIC) is still not safe in non preemptible +context. bpf_mem_alloc must be used in PREEMPT_RT. This patch is +to enforce bpf_mem_alloc in the bpf_local_storage when CONFIG_PREEMPT_RT +is enabled. + +[ 35.118559] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 +[ 35.118566] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1832, name: test_progs +[ 35.118569] preempt_count: 1, expected: 0 +[ 35.118571] RCU nest depth: 1, expected: 1 +[ 35.118577] INFO: lockdep is turned off. + ... +[ 35.118647] __might_resched+0x433/0x5b0 +[ 35.118677] rt_spin_lock+0xc3/0x290 +[ 35.118700] ___slab_alloc+0x72/0xc40 +[ 35.118723] __kmalloc_noprof+0x13f/0x4e0 +[ 35.118732] bpf_map_kzalloc+0xe5/0x220 +[ 35.118740] bpf_selem_alloc+0x1d2/0x7b0 +[ 35.118755] bpf_local_storage_update+0x2fa/0x8b0 +[ 35.118784] bpf_sk_storage_get_tracing+0x15a/0x1d0 +[ 35.118791] bpf_prog_9a118d86fca78ebb_trace_inet_sock_set_state+0x44/0x66 +[ 35.118795] bpf_trace_run3+0x222/0x400 +[ 35.118820] __bpf_trace_inet_sock_set_state+0x11/0x20 +[ 35.118824] trace_inet_sock_set_state+0x112/0x130 +[ 35.118830] inet_sk_state_store+0x41/0x90 +[ 35.118836] tcp_set_state+0x3b3/0x640 + +There is no need to adjust the gfp_flags passing to the +bpf_mem_cache_alloc_flags() which only honors the GFP_KERNEL. +The verifier has ensured GFP_KERNEL is passed only in sleepable context. + +It has been an old issue since the first introduction of the +bpf_local_storage ~5 years ago, so this patch targets the bpf-next. + +bpf_mem_alloc is needed to solve it, so the Fixes tag is set +to the commit when bpf_mem_alloc was first used in the bpf_local_storage. + +Fixes: 08a7ce384e33 ("bpf: Use bpf_mem_cache_alloc/free in bpf_local_storage_elem") +Reported-by: Alexei Starovoitov +Signed-off-by: Martin KaFai Lau +Link: https://lore.kernel.org/r/20241218193000.2084281-1-martin.lau@linux.dev +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/bpf_local_storage.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/bpf_local_storage.c b/kernel/bpf/bpf_local_storage.c +index c938dea5ddbf3..050c784498abe 100644 +--- a/kernel/bpf/bpf_local_storage.c ++++ b/kernel/bpf/bpf_local_storage.c +@@ -797,8 +797,12 @@ bpf_local_storage_map_alloc(union bpf_attr *attr, + smap->elem_size = offsetof(struct bpf_local_storage_elem, + sdata.data[attr->value_size]); + +- smap->bpf_ma = bpf_ma; +- if (bpf_ma) { ++ /* In PREEMPT_RT, kmalloc(GFP_ATOMIC) is still not safe in non ++ * preemptible context. Thus, enforce all storages to use ++ * bpf_mem_alloc when CONFIG_PREEMPT_RT is enabled. ++ */ ++ smap->bpf_ma = IS_ENABLED(CONFIG_PREEMPT_RT) ? true : bpf_ma; ++ if (smap->bpf_ma) { + err = bpf_mem_alloc_init(&smap->selem_ma, smap->elem_size, false); + if (err) + goto free_smap; +-- +2.39.5 + diff --git a/queue-6.12/bpf-cancel-the-running-bpf_timer-through-kworker-for.patch b/queue-6.12/bpf-cancel-the-running-bpf_timer-through-kworker-for.patch new file mode 100644 index 0000000000..398228e25c --- /dev/null +++ b/queue-6.12/bpf-cancel-the-running-bpf_timer-through-kworker-for.patch @@ -0,0 +1,136 @@ +From a4b8f2acf25abc48321195d595a50631dd9c836a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jan 2025 18:18:15 +0800 +Subject: bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hou Tao + +[ Upstream commit 58f038e6d209d2dd862fcf5de55407855856794d ] + +During the update procedure, when overwrite element in a pre-allocated +htab, the freeing of old_element is protected by the bucket lock. The +reason why the bucket lock is necessary is that the old_element has +already been stashed in htab->extra_elems after alloc_htab_elem() +returns. If freeing the old_element after the bucket lock is unlocked, +the stashed element may be reused by concurrent update procedure and the +freeing of old_element will run concurrently with the reuse of the +old_element. However, the invocation of check_and_free_fields() may +acquire a spin-lock which violates the lockdep rule because its caller +has already held a raw-spin-lock (bucket lock). The following warning +will be reported when such race happens: + + BUG: scheduling while atomic: test_progs/676/0x00000003 + 3 locks held by test_progs/676: + #0: ffffffff864b0240 (rcu_read_lock_trace){....}-{0:0}, at: bpf_prog_test_run_syscall+0x2c0/0x830 + #1: ffff88810e961188 (&htab->lockdep_key){....}-{2:2}, at: htab_map_update_elem+0x306/0x1500 + #2: ffff8881f4eac1b8 (&base->softirq_expiry_lock){....}-{2:2}, at: hrtimer_cancel_wait_running+0xe9/0x1b0 + Modules linked in: bpf_testmod(O) + Preemption disabled at: + [] htab_map_update_elem+0x293/0x1500 + CPU: 0 UID: 0 PID: 676 Comm: test_progs Tainted: G ... 6.12.0+ #11 + Tainted: [W]=WARN, [O]=OOT_MODULE + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)... + Call Trace: + + dump_stack_lvl+0x57/0x70 + dump_stack+0x10/0x20 + __schedule_bug+0x120/0x170 + __schedule+0x300c/0x4800 + schedule_rtlock+0x37/0x60 + rtlock_slowlock_locked+0x6d9/0x54c0 + rt_spin_lock+0x168/0x230 + hrtimer_cancel_wait_running+0xe9/0x1b0 + hrtimer_cancel+0x24/0x30 + bpf_timer_delete_work+0x1d/0x40 + bpf_timer_cancel_and_free+0x5e/0x80 + bpf_obj_free_fields+0x262/0x4a0 + check_and_free_fields+0x1d0/0x280 + htab_map_update_elem+0x7fc/0x1500 + bpf_prog_9f90bc20768e0cb9_overwrite_cb+0x3f/0x43 + bpf_prog_ea601c4649694dbd_overwrite_timer+0x5d/0x7e + bpf_prog_test_run_syscall+0x322/0x830 + __sys_bpf+0x135d/0x3ca0 + __x64_sys_bpf+0x75/0xb0 + x64_sys_call+0x1b5/0xa10 + do_syscall_64+0x3b/0xc0 + entry_SYSCALL_64_after_hwframe+0x4b/0x53 + ... + + +It seems feasible to break the reuse and refill of per-cpu extra_elems +into two independent parts: reuse the per-cpu extra_elems with bucket +lock being held and refill the old_element as per-cpu extra_elems after +the bucket lock is unlocked. However, it will make the concurrent +overwrite procedures on the same CPU return unexpected -E2BIG error when +the map is full. + +Therefore, the patch fixes the lock problem by breaking the cancelling +of bpf_timer into two steps for PREEMPT_RT: +1) use hrtimer_try_to_cancel() and check its return value +2) if the timer is running, use hrtimer_cancel() through a kworker to + cancel it again +Considering that the current implementation of hrtimer_cancel() will try +to acquire a being held softirq_expiry_lock when the current timer is +running, these steps above are reasonable. However, it also has +downside. When the timer is running, the cancelling of the timer is +delayed when releasing the last map uref. The delay is also fixable +(e.g., break the cancelling of bpf timer into two parts: one part in +locked scope, another one in unlocked scope), it can be revised later if +necessary. + +It is a bit hard to decide the right fix tag. One reason is that the +problem depends on PREEMPT_RT which is enabled in v6.12. Considering the +softirq_expiry_lock lock exists since v5.4 and bpf_timer is introduced +in v5.15, the bpf_timer commit is used in the fixes tag and an extra +depends-on tag is added to state the dependency on PREEMPT_RT. + +Fixes: b00628b1c7d5 ("bpf: Introduce bpf timers.") +Depends-on: v6.12+ with PREEMPT_RT enabled +Reported-by: Sebastian Andrzej Siewior +Closes: https://lore.kernel.org/bpf/20241106084527.4gPrMnHt@linutronix.de +Signed-off-by: Hou Tao +Reviewed-by: Toke Høiland-Jørgensen +Link: https://lore.kernel.org/r/20250117101816.2101857-5-houtao@huaweicloud.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/helpers.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c +index 3d45ebe8afb48..a05aeb3458964 100644 +--- a/kernel/bpf/helpers.c ++++ b/kernel/bpf/helpers.c +@@ -1593,10 +1593,24 @@ void bpf_timer_cancel_and_free(void *val) + * To avoid these issues, punt to workqueue context when we are in a + * timer callback. + */ +- if (this_cpu_read(hrtimer_running)) ++ if (this_cpu_read(hrtimer_running)) { + queue_work(system_unbound_wq, &t->cb.delete_work); +- else ++ return; ++ } ++ ++ if (IS_ENABLED(CONFIG_PREEMPT_RT)) { ++ /* If the timer is running on other CPU, also use a kworker to ++ * wait for the completion of the timer instead of trying to ++ * acquire a sleepable lock in hrtimer_cancel() to wait for its ++ * completion. ++ */ ++ if (hrtimer_try_to_cancel(&t->timer) >= 0) ++ kfree_rcu(t, cb.rcu); ++ else ++ queue_work(system_unbound_wq, &t->cb.delete_work); ++ } else { + bpf_timer_delete_work(&t->cb.delete_work); ++ } + } + + /* This function is called by map_delete/update_elem for individual element and +-- +2.39.5 + diff --git a/queue-6.12/bpf-reject-struct_ops-registration-that-uses-module-.patch b/queue-6.12/bpf-reject-struct_ops-registration-that-uses-module-.patch new file mode 100644 index 0000000000..e903852ac0 --- /dev/null +++ b/queue-6.12/bpf-reject-struct_ops-registration-that-uses-module-.patch @@ -0,0 +1,127 @@ +From 5d362f7310c0bf545cebcdc083599379ed58d908 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2024 12:18:18 -0800 +Subject: bpf: Reject struct_ops registration that uses module ptr and the + module btf_id is missing + +From: Martin KaFai Lau + +[ Upstream commit 96ea081ed52bf077cad6d00153b6fba68e510767 ] + +There is a UAF report in the bpf_struct_ops when CONFIG_MODULES=n. +In particular, the report is on tcp_congestion_ops that has +a "struct module *owner" member. + +For struct_ops that has a "struct module *owner" member, +it can be extended either by the regular kernel module or +by the bpf_struct_ops. bpf_try_module_get() will be used +to do the refcounting and different refcount is done +based on the owner pointer. When CONFIG_MODULES=n, +the btf_id of the "struct module" is missing: + +WARN: resolve_btfids: unresolved symbol module + +Thus, the bpf_try_module_get() cannot do the correct refcounting. + +Not all subsystem's struct_ops requires the "struct module *owner" member. +e.g. the recent sched_ext_ops. + +This patch is to disable bpf_struct_ops registration if +the struct_ops has the "struct module *" member and the +"struct module" btf_id is missing. The btf_type_is_fwd() helper +is moved to the btf.h header file for this test. + +This has happened since the beginning of bpf_struct_ops which has gone +through many changes. The Fixes tag is set to a recent commit that this +patch can apply cleanly. Considering CONFIG_MODULES=n is not +common and the age of the issue, targeting for bpf-next also. + +Fixes: 1611603537a4 ("bpf: Create argument information for nullable arguments.") +Reported-by: Robert Morris +Closes: https://lore.kernel.org/bpf/74665.1733669976@localhost/ +Signed-off-by: Martin KaFai Lau +Tested-by: Eduard Zingerman +Acked-by: Eduard Zingerman +Link: https://lore.kernel.org/r/20241220201818.127152-1-martin.lau@linux.dev +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + include/linux/btf.h | 5 +++++ + kernel/bpf/bpf_struct_ops.c | 21 +++++++++++++++++++++ + kernel/bpf/btf.c | 5 ----- + 3 files changed, 26 insertions(+), 5 deletions(-) + +diff --git a/include/linux/btf.h b/include/linux/btf.h +index b8a583194c4a9..d99178ce01d21 100644 +--- a/include/linux/btf.h ++++ b/include/linux/btf.h +@@ -352,6 +352,11 @@ static inline bool btf_type_is_scalar(const struct btf_type *t) + return btf_type_is_int(t) || btf_type_is_enum(t); + } + ++static inline bool btf_type_is_fwd(const struct btf_type *t) ++{ ++ return BTF_INFO_KIND(t->info) == BTF_KIND_FWD; ++} ++ + static inline bool btf_type_is_typedef(const struct btf_type *t) + { + return BTF_INFO_KIND(t->info) == BTF_KIND_TYPEDEF; +diff --git a/kernel/bpf/bpf_struct_ops.c b/kernel/bpf/bpf_struct_ops.c +index b3a2ce1e5e22e..b70d0eef8a284 100644 +--- a/kernel/bpf/bpf_struct_ops.c ++++ b/kernel/bpf/bpf_struct_ops.c +@@ -311,6 +311,20 @@ void bpf_struct_ops_desc_release(struct bpf_struct_ops_desc *st_ops_desc) + kfree(arg_info); + } + ++static bool is_module_member(const struct btf *btf, u32 id) ++{ ++ const struct btf_type *t; ++ ++ t = btf_type_resolve_ptr(btf, id, NULL); ++ if (!t) ++ return false; ++ ++ if (!__btf_type_is_struct(t) && !btf_type_is_fwd(t)) ++ return false; ++ ++ return !strcmp(btf_name_by_offset(btf, t->name_off), "module"); ++} ++ + int bpf_struct_ops_desc_init(struct bpf_struct_ops_desc *st_ops_desc, + struct btf *btf, + struct bpf_verifier_log *log) +@@ -390,6 +404,13 @@ int bpf_struct_ops_desc_init(struct bpf_struct_ops_desc *st_ops_desc, + goto errout; + } + ++ if (!st_ops_ids[IDX_MODULE_ID] && is_module_member(btf, member->type)) { ++ pr_warn("'struct module' btf id not found. Is CONFIG_MODULES enabled? bpf_struct_ops '%s' needs module support.\n", ++ st_ops->name); ++ err = -EOPNOTSUPP; ++ goto errout; ++ } ++ + func_proto = btf_type_resolve_func_ptr(btf, + member->type, + NULL); +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index 41d20b7199c4a..a44f4be592be7 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -498,11 +498,6 @@ bool btf_type_is_void(const struct btf_type *t) + return t == &btf_void; + } + +-static bool btf_type_is_fwd(const struct btf_type *t) +-{ +- return BTF_INFO_KIND(t->info) == BTF_KIND_FWD; +-} +- + static bool btf_type_is_datasec(const struct btf_type *t) + { + return BTF_INFO_KIND(t->info) == BTF_KIND_DATASEC; +-- +2.39.5 + diff --git a/queue-6.12/bpf-send-signals-asynchronously-if-preemptible.patch b/queue-6.12/bpf-send-signals-asynchronously-if-preemptible.patch new file mode 100644 index 0000000000..d84cc1c240 --- /dev/null +++ b/queue-6.12/bpf-send-signals-asynchronously-if-preemptible.patch @@ -0,0 +1,42 @@ +From b19ac38b7d19dec9016146515f4b9a0c8f047554 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 10:36:47 +0000 +Subject: bpf: Send signals asynchronously if !preemptible + +From: Puranjay Mohan + +[ Upstream commit 87c544108b612512b254c8f79aa5c0a8546e2cc4 ] + +BPF programs can execute in all kinds of contexts and when a program +running in a non-preemptible context uses the bpf_send_signal() kfunc, +it will cause issues because this kfunc can sleep. +Change `irqs_disabled()` to `!preemptible()`. + +Reported-by: syzbot+97da3d7e0112d59971de@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/67486b09.050a0220.253251.0084.GAE@google.com/ +Fixes: 1bc7896e9ef4 ("bpf: Fix deadlock with rq_lock in bpf_send_signal()") +Signed-off-by: Puranjay Mohan +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/20250115103647.38487-1-puranjay@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/trace/bpf_trace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index b5cf605fb0e60..449efaaa387a6 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -833,7 +833,7 @@ static int bpf_send_signal_common(u32 sig, enum pid_type type) + if (unlikely(is_global_init(current))) + return -EPERM; + +- if (irqs_disabled()) { ++ if (!preemptible()) { + /* Do an early check on signal validity. Otherwise, + * the error is lost in deferred irq_work. + */ +-- +2.39.5 + diff --git a/queue-6.12/bpf-tcp-mark-bpf_load_hdr_opt-arg2-as-read-write.patch b/queue-6.12/bpf-tcp-mark-bpf_load_hdr_opt-arg2-as-read-write.patch new file mode 100644 index 0000000000..b7d35a7ad4 --- /dev/null +++ b/queue-6.12/bpf-tcp-mark-bpf_load_hdr_opt-arg2-as-read-write.patch @@ -0,0 +1,44 @@ +From 646b97f7912eb0a33dd46990319fdc8c66f1cd5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jan 2025 13:28:43 -0700 +Subject: bpf: tcp: Mark bpf_load_hdr_opt() arg2 as read-write + +From: Daniel Xu + +[ Upstream commit 8ac412a3361173e3000b16167af3d1f6f90af613 ] + +MEM_WRITE attribute is defined as: "Non-presence of MEM_WRITE means that +MEM is only being read". bpf_load_hdr_opt() both reads and writes from +its arg2 - void *search_res. + +This matters a lot for the next commit where we more precisely track +stack accesses. Without this annotation, the verifier will make false +assumptions about the contents of memory written to by helpers and +possibly prune valid branches. + +Fixes: 6fad274f06f0 ("bpf: Add MEM_WRITE attribute") +Acked-by: Martin KaFai Lau +Signed-off-by: Daniel Xu +Link: https://lore.kernel.org/r/730e45f8c39be2a5f3d8c4406cceca9d574cbf14.1736886479.git.dxu@dxuuu.xyz +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index 46da488ff0703..a2f990bf51e5e 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -7662,7 +7662,7 @@ static const struct bpf_func_proto bpf_sock_ops_load_hdr_opt_proto = { + .gpl_only = false, + .ret_type = RET_INTEGER, + .arg1_type = ARG_PTR_TO_CTX, +- .arg2_type = ARG_PTR_TO_MEM, ++ .arg2_type = ARG_PTR_TO_MEM | MEM_WRITE, + .arg3_type = ARG_CONST_SIZE, + .arg4_type = ARG_ANYTHING, + }; +-- +2.39.5 + diff --git a/queue-6.12/bpf-use-refcount_t-instead-of-atomic_t-for-mmap_coun.patch b/queue-6.12/bpf-use-refcount_t-instead-of-atomic_t-for-mmap_coun.patch new file mode 100644 index 0000000000..3d43a71d2f --- /dev/null +++ b/queue-6.12/bpf-use-refcount_t-instead-of-atomic_t-for-mmap_coun.patch @@ -0,0 +1,68 @@ +From b41e0c1001a9a35de98b52bcf19d023689460fe0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 15:16:55 +0800 +Subject: bpf: Use refcount_t instead of atomic_t for mmap_count + +From: Pei Xiao + +[ Upstream commit dfa94ce54f4139c893b9c4ec17df6f7c6a7515d3 ] + +Use an API that resembles more the actual use of mmap_count. + +Found by cocci: +kernel/bpf/arena.c:245:6-25: WARNING: atomic_dec_and_test variation before object free at line 249. + +Fixes: b90d77e5fd78 ("bpf: Fix remap of arena.") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202412292037.LXlYSHKl-lkp@intel.com/ +Signed-off-by: Pei Xiao +Link: https://lore.kernel.org/r/6ecce439a6bc81adb85d5080908ea8959b792a50.1735542814.git.xiaopei01@kylinos.cn +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/arena.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/kernel/bpf/arena.c b/kernel/bpf/arena.c +index e52b3ad231b9c..93e48c7cad4ef 100644 +--- a/kernel/bpf/arena.c ++++ b/kernel/bpf/arena.c +@@ -212,7 +212,7 @@ static u64 arena_map_mem_usage(const struct bpf_map *map) + struct vma_list { + struct vm_area_struct *vma; + struct list_head head; +- atomic_t mmap_count; ++ refcount_t mmap_count; + }; + + static int remember_vma(struct bpf_arena *arena, struct vm_area_struct *vma) +@@ -222,7 +222,7 @@ static int remember_vma(struct bpf_arena *arena, struct vm_area_struct *vma) + vml = kmalloc(sizeof(*vml), GFP_KERNEL); + if (!vml) + return -ENOMEM; +- atomic_set(&vml->mmap_count, 1); ++ refcount_set(&vml->mmap_count, 1); + vma->vm_private_data = vml; + vml->vma = vma; + list_add(&vml->head, &arena->vma_list); +@@ -233,7 +233,7 @@ static void arena_vm_open(struct vm_area_struct *vma) + { + struct vma_list *vml = vma->vm_private_data; + +- atomic_inc(&vml->mmap_count); ++ refcount_inc(&vml->mmap_count); + } + + static void arena_vm_close(struct vm_area_struct *vma) +@@ -242,7 +242,7 @@ static void arena_vm_close(struct vm_area_struct *vma) + struct bpf_arena *arena = container_of(map, struct bpf_arena, map); + struct vma_list *vml = vma->vm_private_data; + +- if (!atomic_dec_and_test(&vml->mmap_count)) ++ if (!refcount_dec_and_test(&vml->mmap_count)) + return; + guard(mutex)(&arena->lock); + /* update link list under lock */ +-- +2.39.5 + diff --git a/queue-6.12/btrfs-improve-the-warning-and-error-message-for-btrf.patch b/queue-6.12/btrfs-improve-the-warning-and-error-message-for-btrf.patch new file mode 100644 index 0000000000..40f3f81262 --- /dev/null +++ b/queue-6.12/btrfs-improve-the-warning-and-error-message-for-btrf.patch @@ -0,0 +1,112 @@ +From 1ad5cb429fbc30f3cf290e6364e9d60343a6d435 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Nov 2024 07:29:07 +1030 +Subject: btrfs: improve the warning and error message for + btrfs_remove_qgroup() + +From: Qu Wenruo + +[ Upstream commit c0def46dec9c547679a25fe7552c4bcbec0b0dd2 ] + +[WARNING] +There are several warnings about the recently introduced qgroup +auto-removal that it triggers WARN_ON() for the non-zero rfer/excl +numbers, e.g: + + ------------[ cut here ]------------ + WARNING: CPU: 67 PID: 2882 at fs/btrfs/qgroup.c:1854 btrfs_remove_qgroup+0x3df/0x450 + CPU: 67 UID: 0 PID: 2882 Comm: btrfs-cleaner Kdump: loaded Not tainted 6.11.6-300.fc41.x86_64 #1 + RIP: 0010:btrfs_remove_qgroup+0x3df/0x450 + Call Trace: + + btrfs_qgroup_cleanup_dropped_subvolume+0x97/0xc0 + btrfs_drop_snapshot+0x44e/0xa80 + btrfs_clean_one_deleted_snapshot+0xc3/0x110 + cleaner_kthread+0xd8/0x130 + kthread+0xd2/0x100 + ret_from_fork+0x34/0x50 + ret_from_fork_asm+0x1a/0x30 + + ---[ end trace 0000000000000000 ]--- + BTRFS warning (device sda): to be deleted qgroup 0/319 has non-zero numbers, rfer 258478080 rfer_cmpr 258478080 excl 0 excl_cmpr 0 + +[CAUSE] +Although the root cause is still unclear, as if qgroup is consistent a +fully dropped subvolume (with extra transaction committed) should lead +to all zero numbers for the qgroup. + +My current guess is the subvolume drop triggered the new subtree drop +threshold thus marked qgroup inconsistent, then rescan cleared it but +some corner case is not properly handled during subvolume dropping. + +But at least for this particular case, since it's only the rfer/excl not +properly reset to 0, and qgroup is already marked inconsistent, there is +nothing to be worried for the end users. + +The user space tool utilizing qgroup would queue a rescan to handle +everything, so the kernel wanring is a little overkilled. + +[ENHANCEMENT] +Enhance the warning inside btrfs_remove_qgroup() by: + +- Only do WARN() if CONFIG_BTRFS_DEBUG is enabled + As explained the kernel can handle inconsistent qgroups by simply do a + rescan, there is nothing to bother the end users. + +- Treat the reserved space leak the same as non-zero numbers + By outputting the values and trigger a WARN() if it's a debug build. + So far I haven't experienced any case related to reserved space so I + hope we will never need to bother them. + +Fixes: 839d6ea4f86d ("btrfs: automatically remove the subvolume qgroup") +Link: https://github.com/kdave/btrfs-progs/issues/922 +Signed-off-by: Qu Wenruo +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/qgroup.c | 21 ++++++++++++++++----- + 1 file changed, 16 insertions(+), 5 deletions(-) + +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index e70ed857fc743..4fcd6cd4c1c24 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -1839,9 +1839,19 @@ int btrfs_remove_qgroup(struct btrfs_trans_handle *trans, u64 qgroupid) + * Thus its reserved space should all be zero, no matter if qgroup + * is consistent or the mode. + */ +- WARN_ON(qgroup->rsv.values[BTRFS_QGROUP_RSV_DATA] || +- qgroup->rsv.values[BTRFS_QGROUP_RSV_META_PREALLOC] || +- qgroup->rsv.values[BTRFS_QGROUP_RSV_META_PERTRANS]); ++ if (qgroup->rsv.values[BTRFS_QGROUP_RSV_DATA] || ++ qgroup->rsv.values[BTRFS_QGROUP_RSV_META_PREALLOC] || ++ qgroup->rsv.values[BTRFS_QGROUP_RSV_META_PERTRANS]) { ++ WARN_ON(IS_ENABLED(CONFIG_BTRFS_DEBUG)); ++ btrfs_warn_rl(fs_info, ++"to be deleted qgroup %u/%llu has non-zero numbers, data %llu meta prealloc %llu meta pertrans %llu", ++ btrfs_qgroup_level(qgroup->qgroupid), ++ btrfs_qgroup_subvolid(qgroup->qgroupid), ++ qgroup->rsv.values[BTRFS_QGROUP_RSV_DATA], ++ qgroup->rsv.values[BTRFS_QGROUP_RSV_META_PREALLOC], ++ qgroup->rsv.values[BTRFS_QGROUP_RSV_META_PERTRANS]); ++ ++ } + /* + * The same for rfer/excl numbers, but that's only if our qgroup is + * consistent and if it's in regular qgroup mode. +@@ -1850,8 +1860,9 @@ int btrfs_remove_qgroup(struct btrfs_trans_handle *trans, u64 qgroupid) + */ + if (btrfs_qgroup_mode(fs_info) == BTRFS_QGROUP_MODE_FULL && + !(fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_INCONSISTENT)) { +- if (WARN_ON(qgroup->rfer || qgroup->excl || +- qgroup->rfer_cmpr || qgroup->excl_cmpr)) { ++ if (qgroup->rfer || qgroup->excl || ++ qgroup->rfer_cmpr || qgroup->excl_cmpr) { ++ WARN_ON(IS_ENABLED(CONFIG_BTRFS_DEBUG)); + btrfs_warn_rl(fs_info, + "to be deleted qgroup %u/%llu has non-zero numbers, rfer %llu rfer_cmpr %llu excl %llu excl_cmpr %llu", + btrfs_qgroup_level(qgroup->qgroupid), +-- +2.39.5 + diff --git a/queue-6.12/btrfs-subpage-fix-the-bitmap-dump-of-the-locked-flag.patch b/queue-6.12/btrfs-subpage-fix-the-bitmap-dump-of-the-locked-flag.patch new file mode 100644 index 0000000000..547a662c17 --- /dev/null +++ b/queue-6.12/btrfs-subpage-fix-the-bitmap-dump-of-the-locked-flag.patch @@ -0,0 +1,60 @@ +From 6c2d12307e13b176738f7cdb81ba064957d1f515 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Dec 2024 16:44:00 +1030 +Subject: btrfs: subpage: fix the bitmap dump of the locked flags + +From: Qu Wenruo + +[ Upstream commit 396294d1afee65a203d6cabd843d0782e5d7388e ] + +We're dumping the locked bitmap into the @checked_bitmap variable, +printing incorrect values during debug. + +Thankfully even during my development I haven't hit a case where I need +to dump the locked bitmap. But for the sake of consistency, fix it by +dupping the locked bitmap into @locked_bitmap variable for output. + +Fixes: 75258f20fb70 ("btrfs: subpage: dump extra subpage bitmaps for debug") +Reviewed-by: Boris Burkov +Signed-off-by: Qu Wenruo +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/subpage.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/subpage.c b/fs/btrfs/subpage.c +index fe4d719d506bf..ec7328a6bfd75 100644 +--- a/fs/btrfs/subpage.c ++++ b/fs/btrfs/subpage.c +@@ -868,6 +868,7 @@ void __cold btrfs_subpage_dump_bitmap(const struct btrfs_fs_info *fs_info, + unsigned long writeback_bitmap; + unsigned long ordered_bitmap; + unsigned long checked_bitmap; ++ unsigned long locked_bitmap; + unsigned long flags; + + ASSERT(folio_test_private(folio) && folio_get_private(folio)); +@@ -880,15 +881,16 @@ void __cold btrfs_subpage_dump_bitmap(const struct btrfs_fs_info *fs_info, + GET_SUBPAGE_BITMAP(subpage, fs_info, writeback, &writeback_bitmap); + GET_SUBPAGE_BITMAP(subpage, fs_info, ordered, &ordered_bitmap); + GET_SUBPAGE_BITMAP(subpage, fs_info, checked, &checked_bitmap); +- GET_SUBPAGE_BITMAP(subpage, fs_info, locked, &checked_bitmap); ++ GET_SUBPAGE_BITMAP(subpage, fs_info, locked, &locked_bitmap); + spin_unlock_irqrestore(&subpage->lock, flags); + + dump_page(folio_page(folio, 0), "btrfs subpage dump"); + btrfs_warn(fs_info, +-"start=%llu len=%u page=%llu, bitmaps uptodate=%*pbl dirty=%*pbl writeback=%*pbl ordered=%*pbl checked=%*pbl", ++"start=%llu len=%u page=%llu, bitmaps uptodate=%*pbl dirty=%*pbl locked=%*pbl writeback=%*pbl ordered=%*pbl checked=%*pbl", + start, len, folio_pos(folio), + sectors_per_page, &uptodate_bitmap, + sectors_per_page, &dirty_bitmap, ++ sectors_per_page, &locked_bitmap, + sectors_per_page, &writeback_bitmap, + sectors_per_page, &ordered_bitmap, + sectors_per_page, &checked_bitmap); +-- +2.39.5 + diff --git a/queue-6.12/cifs-use-cifs_autodisable_serverino-for-disabling-ci.patch b/queue-6.12/cifs-use-cifs_autodisable_serverino-for-disabling-ci.patch new file mode 100644 index 0000000000..68adb4682c --- /dev/null +++ b/queue-6.12/cifs-use-cifs_autodisable_serverino-for-disabling-ci.patch @@ -0,0 +1,44 @@ +From 45fc0565470ad6e7f30a9124547f45d4cf668887 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jan 2025 21:38:48 +0100 +Subject: cifs: Use cifs_autodisable_serverino() for disabling + CIFS_MOUNT_SERVER_INUM in readdir.c +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 015683d4ed0d23698c71f2194f09bd17dbfad044 ] + +In all other places is used function cifs_autodisable_serverino() for +disabling CIFS_MOUNT_SERVER_INUM mount flag. So use is also in readir.c +_initiate_cifs_search() function. Benefit of cifs_autodisable_serverino() +is that it also prints dmesg message that server inode numbers are being +disabled. + +Fixes: ec06aedd4454 ("cifs: clean up handling when server doesn't consistently support inode numbers") +Fixes: f534dc994397 ("cifs: clear server inode number flag while autodisabling") +Signed-off-by: Pali Rohár +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/readdir.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/readdir.c b/fs/smb/client/readdir.c +index 273358d20a46c..50f96259d9adc 100644 +--- a/fs/smb/client/readdir.c ++++ b/fs/smb/client/readdir.c +@@ -413,7 +413,7 @@ _initiate_cifs_search(const unsigned int xid, struct file *file, + cifsFile->invalidHandle = false; + } else if ((rc == -EOPNOTSUPP) && + (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM)) { +- cifs_sb->mnt_cifs_flags &= ~CIFS_MOUNT_SERVER_INUM; ++ cifs_autodisable_serverino(cifs_sb); + goto ffirst_retry; + } + error_exit: +-- +2.39.5 + diff --git a/queue-6.12/clk-analogbits-fix-incorrect-calculation-of-vco-rate.patch b/queue-6.12/clk-analogbits-fix-incorrect-calculation-of-vco-rate.patch new file mode 100644 index 0000000000..33f7450288 --- /dev/null +++ b/queue-6.12/clk-analogbits-fix-incorrect-calculation-of-vco-rate.patch @@ -0,0 +1,41 @@ +From 751ec0cf0080663d166a44078dc1b1aa76197db5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Aug 2024 23:16:39 -0700 +Subject: clk: analogbits: Fix incorrect calculation of vco rate delta + +From: Bo Gan + +[ Upstream commit d7f12857f095ef38523399d47e68787b357232f6 ] + +In wrpll_configure_for_rate() we try to determine the best PLL +configuration for a target rate. However, in the loop where we try +values of R, we should compare the derived `vco` with `target_vco_rate`. +However, we were in fact comparing it with `target_rate`, which is +actually after Q shift. This is incorrect, and sometimes can result in +suboptimal clock rates. Fix it. + +Fixes: 7b9487a9a5c4 ("clk: analogbits: add Wide-Range PLL library") +Signed-off-by: Bo Gan +Link: https://lore.kernel.org/r/20240830061639.2316-1-ganboing@gmail.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/analogbits/wrpll-cln28hpc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/analogbits/wrpll-cln28hpc.c b/drivers/clk/analogbits/wrpll-cln28hpc.c +index 65d422a588e1f..9d178afc73bdd 100644 +--- a/drivers/clk/analogbits/wrpll-cln28hpc.c ++++ b/drivers/clk/analogbits/wrpll-cln28hpc.c +@@ -292,7 +292,7 @@ int wrpll_configure_for_rate(struct wrpll_cfg *c, u32 target_rate, + vco = vco_pre * f; + } + +- delta = abs(target_rate - vco); ++ delta = abs(target_vco_rate - vco); + if (delta < best_delta) { + best_delta = delta; + best_r = r; +-- +2.39.5 + diff --git a/queue-6.12/clk-fix-an-of-node-reference-leak-in-of_clk_get_pare.patch b/queue-6.12/clk-fix-an-of-node-reference-leak-in-of_clk_get_pare.patch new file mode 100644 index 0000000000..7301a46164 --- /dev/null +++ b/queue-6.12/clk-fix-an-of-node-reference-leak-in-of_clk_get_pare.patch @@ -0,0 +1,44 @@ +From 82c4e6b3f14248d9337adc170c08b095189789de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 22:09:12 +0900 +Subject: clk: fix an OF node reference leak in of_clk_get_parent_name() + +From: Joe Hattori + +[ Upstream commit 28fa3291cad1c201967ef93edc6e7f8ccc9afbc0 ] + +Current implementation of of_clk_get_parent_name() leaks an OF node +reference on error path. Add a of_node_put() call before returning an +error. + +This bug was found by an experimental static analysis tool that I am +developing. + +Fixes: 8da411cc1964 ("clk: let of_clk_get_parent_name() fail for invalid clock-indices") +Signed-off-by: Joe Hattori +Link: https://lore.kernel.org/r/20241210130913.3615205-1-joe@pf.is.s.u-tokyo.ac.jp +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index d02451f951cf0..5b4ab94193c2b 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -5391,8 +5391,10 @@ const char *of_clk_get_parent_name(const struct device_node *np, int index) + count++; + } + /* We went off the end of 'clock-indices' without finding it */ +- if (of_property_present(clkspec.np, "clock-indices") && !found) ++ if (of_property_present(clkspec.np, "clock-indices") && !found) { ++ of_node_put(clkspec.np); + return NULL; ++ } + + if (of_property_read_string_index(clkspec.np, "clock-output-names", + index, +-- +2.39.5 + diff --git a/queue-6.12/clk-imx-add-i.mx91-clk.patch b/queue-6.12/clk-imx-add-i.mx91-clk.patch new file mode 100644 index 0000000000..b4470f0d32 --- /dev/null +++ b/queue-6.12/clk-imx-add-i.mx91-clk.patch @@ -0,0 +1,175 @@ +From a70591d9fa123daf15530e15aacee13fc5d50b4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Oct 2024 11:46:50 -0700 +Subject: clk: imx: add i.MX91 clk + +From: Pengfei Li + +[ Upstream commit a27bfff88dd2e1279c858311bc57ce4deb44f684 ] + +Reuse i.MX93 clk driver for i.MX91, because i.MX91 reuses the +Clock Control Module from i.MX93, with only a few clocks removed +and a few clocks added. + +For clocks specific to i.MX93 use PLAT_IMX93 to flag them, for +clocks specific to i.MX91, use PLAT_IMX91 to flag them. Others +are shared by both. + +Signed-off-by: Pengfei Li +Reviewed-by: Peng Fan +Link: https://lore.kernel.org/r/20241023184651.381265-5-pengfei.li_1@nxp.com +Signed-off-by: Abel Vesa +Stable-dep-of: 6a7853544482 ("clk: imx93: Add IMX93_CLK_SPDIF_IPG clock") +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx93.c | 63 +++++++++++++++++++++++-------------- + 1 file changed, 39 insertions(+), 24 deletions(-) + +diff --git a/drivers/clk/imx/clk-imx93.c b/drivers/clk/imx/clk-imx93.c +index c8b65146e76ea..58a516dd385bf 100644 +--- a/drivers/clk/imx/clk-imx93.c ++++ b/drivers/clk/imx/clk-imx93.c +@@ -15,7 +15,10 @@ + + #include "clk.h" + +-#define IMX93_CLK_END 202 ++#define IMX93_CLK_END 207 ++ ++#define PLAT_IMX93 BIT(0) ++#define PLAT_IMX91 BIT(1) + + enum clk_sel { + LOW_SPEED_IO_SEL, +@@ -55,6 +58,7 @@ static const struct imx93_clk_root { + u32 off; + enum clk_sel sel; + unsigned long flags; ++ unsigned long plat; + } root_array[] = { + /* a55/m33/bus critical clk for system run */ + { IMX93_CLK_A55_PERIPH, "a55_periph_root", 0x0000, FAST_SEL, CLK_IS_CRITICAL }, +@@ -65,7 +69,7 @@ static const struct imx93_clk_root { + { IMX93_CLK_BUS_AON, "bus_aon_root", 0x0300, LOW_SPEED_IO_SEL, CLK_IS_CRITICAL }, + { IMX93_CLK_WAKEUP_AXI, "wakeup_axi_root", 0x0380, FAST_SEL, CLK_IS_CRITICAL }, + { IMX93_CLK_SWO_TRACE, "swo_trace_root", 0x0400, LOW_SPEED_IO_SEL, }, +- { IMX93_CLK_M33_SYSTICK, "m33_systick_root", 0x0480, LOW_SPEED_IO_SEL, }, ++ { IMX93_CLK_M33_SYSTICK, "m33_systick_root", 0x0480, LOW_SPEED_IO_SEL, 0, PLAT_IMX93, }, + { IMX93_CLK_FLEXIO1, "flexio1_root", 0x0500, LOW_SPEED_IO_SEL, }, + { IMX93_CLK_FLEXIO2, "flexio2_root", 0x0580, LOW_SPEED_IO_SEL, }, + { IMX93_CLK_LPTMR1, "lptmr1_root", 0x0700, LOW_SPEED_IO_SEL, }, +@@ -122,15 +126,15 @@ static const struct imx93_clk_root { + { IMX93_CLK_HSIO_ACSCAN_80M, "hsio_acscan_80m_root", 0x1f80, LOW_SPEED_IO_SEL, }, + { IMX93_CLK_HSIO_ACSCAN_480M, "hsio_acscan_480m_root", 0x2000, MISC_SEL, }, + { IMX93_CLK_NIC_AXI, "nic_axi_root", 0x2080, FAST_SEL, CLK_IS_CRITICAL, }, +- { IMX93_CLK_ML_APB, "ml_apb_root", 0x2180, LOW_SPEED_IO_SEL, }, +- { IMX93_CLK_ML, "ml_root", 0x2200, FAST_SEL, }, ++ { IMX93_CLK_ML_APB, "ml_apb_root", 0x2180, LOW_SPEED_IO_SEL, 0, PLAT_IMX93, }, ++ { IMX93_CLK_ML, "ml_root", 0x2200, FAST_SEL, 0, PLAT_IMX93, }, + { IMX93_CLK_MEDIA_AXI, "media_axi_root", 0x2280, FAST_SEL, }, + { IMX93_CLK_MEDIA_APB, "media_apb_root", 0x2300, LOW_SPEED_IO_SEL, }, +- { IMX93_CLK_MEDIA_LDB, "media_ldb_root", 0x2380, VIDEO_SEL, }, ++ { IMX93_CLK_MEDIA_LDB, "media_ldb_root", 0x2380, VIDEO_SEL, 0, PLAT_IMX93, }, + { IMX93_CLK_MEDIA_DISP_PIX, "media_disp_pix_root", 0x2400, VIDEO_SEL, }, + { IMX93_CLK_CAM_PIX, "cam_pix_root", 0x2480, VIDEO_SEL, }, +- { IMX93_CLK_MIPI_TEST_BYTE, "mipi_test_byte_root", 0x2500, VIDEO_SEL, }, +- { IMX93_CLK_MIPI_PHY_CFG, "mipi_phy_cfg_root", 0x2580, VIDEO_SEL, }, ++ { IMX93_CLK_MIPI_TEST_BYTE, "mipi_test_byte_root", 0x2500, VIDEO_SEL, 0, PLAT_IMX93, }, ++ { IMX93_CLK_MIPI_PHY_CFG, "mipi_phy_cfg_root", 0x2580, VIDEO_SEL, 0, PLAT_IMX93, }, + { IMX93_CLK_ADC, "adc_root", 0x2700, LOW_SPEED_IO_SEL, }, + { IMX93_CLK_PDM, "pdm_root", 0x2780, AUDIO_SEL, }, + { IMX93_CLK_TSTMR1, "tstmr1_root", 0x2800, LOW_SPEED_IO_SEL, }, +@@ -139,13 +143,16 @@ static const struct imx93_clk_root { + { IMX93_CLK_MQS2, "mqs2_root", 0x2980, AUDIO_SEL, }, + { IMX93_CLK_AUDIO_XCVR, "audio_xcvr_root", 0x2a00, NON_IO_SEL, }, + { IMX93_CLK_SPDIF, "spdif_root", 0x2a80, AUDIO_SEL, }, +- { IMX93_CLK_ENET, "enet_root", 0x2b00, NON_IO_SEL, }, +- { IMX93_CLK_ENET_TIMER1, "enet_timer1_root", 0x2b80, LOW_SPEED_IO_SEL, }, +- { IMX93_CLK_ENET_TIMER2, "enet_timer2_root", 0x2c00, LOW_SPEED_IO_SEL, }, +- { IMX93_CLK_ENET_REF, "enet_ref_root", 0x2c80, NON_IO_SEL, }, +- { IMX93_CLK_ENET_REF_PHY, "enet_ref_phy_root", 0x2d00, LOW_SPEED_IO_SEL, }, +- { IMX93_CLK_I3C1_SLOW, "i3c1_slow_root", 0x2d80, LOW_SPEED_IO_SEL, }, +- { IMX93_CLK_I3C2_SLOW, "i3c2_slow_root", 0x2e00, LOW_SPEED_IO_SEL, }, ++ { IMX93_CLK_ENET, "enet_root", 0x2b00, NON_IO_SEL, 0, PLAT_IMX93, }, ++ { IMX93_CLK_ENET_TIMER1, "enet_timer1_root", 0x2b80, LOW_SPEED_IO_SEL, 0, PLAT_IMX93, }, ++ { IMX93_CLK_ENET_TIMER2, "enet_timer2_root", 0x2c00, LOW_SPEED_IO_SEL, 0, PLAT_IMX93, }, ++ { IMX93_CLK_ENET_REF, "enet_ref_root", 0x2c80, NON_IO_SEL, 0, PLAT_IMX93, }, ++ { IMX93_CLK_ENET_REF_PHY, "enet_ref_phy_root", 0x2d00, LOW_SPEED_IO_SEL, 0, PLAT_IMX93, }, ++ { IMX91_CLK_ENET1_QOS_TSN, "enet1_qos_tsn_root", 0x2b00, NON_IO_SEL, 0, PLAT_IMX91, }, ++ { IMX91_CLK_ENET_TIMER, "enet_timer_root", 0x2b80, LOW_SPEED_IO_SEL, 0, PLAT_IMX91, }, ++ { IMX91_CLK_ENET2_REGULAR, "enet2_regular_root", 0x2c80, NON_IO_SEL, 0, PLAT_IMX91, }, ++ { IMX93_CLK_I3C1_SLOW, "i3c1_slow_root", 0x2d80, LOW_SPEED_IO_SEL, 0, PLAT_IMX93, }, ++ { IMX93_CLK_I3C2_SLOW, "i3c2_slow_root", 0x2e00, LOW_SPEED_IO_SEL, 0, PLAT_IMX93, }, + { IMX93_CLK_USB_PHY_BURUNIN, "usb_phy_root", 0x2e80, LOW_SPEED_IO_SEL, }, + { IMX93_CLK_PAL_CAME_SCAN, "pal_came_scan_root", 0x2f00, MISC_SEL, } + }; +@@ -157,6 +164,7 @@ static const struct imx93_clk_ccgr { + u32 off; + unsigned long flags; + u32 *shared_count; ++ unsigned long plat; + } ccgr_array[] = { + { IMX93_CLK_A55_GATE, "a55_alt", "a55_alt_root", 0x8000, }, + /* M33 critical clk for system run */ +@@ -246,8 +254,10 @@ static const struct imx93_clk_ccgr { + { IMX93_CLK_AUD_XCVR_GATE, "aud_xcvr", "audio_xcvr_root", 0x9b80, }, + { IMX93_CLK_SPDIF_GATE, "spdif", "spdif_root", 0x9c00, }, + { IMX93_CLK_HSIO_32K_GATE, "hsio_32k", "osc_32k", 0x9dc0, }, +- { IMX93_CLK_ENET1_GATE, "enet1", "wakeup_axi_root", 0x9e00, }, +- { IMX93_CLK_ENET_QOS_GATE, "enet_qos", "wakeup_axi_root", 0x9e40, }, ++ { IMX93_CLK_ENET1_GATE, "enet1", "wakeup_axi_root", 0x9e00, 0, NULL, PLAT_IMX93, }, ++ { IMX93_CLK_ENET_QOS_GATE, "enet_qos", "wakeup_axi_root", 0x9e40, 0, NULL, PLAT_IMX93, }, ++ { IMX91_CLK_ENET2_REGULAR_GATE, "enet2_regular", "wakeup_axi_root", 0x9e00, 0, NULL, PLAT_IMX91, }, ++ { IMX91_CLK_ENET1_QOS_TSN_GATE, "enet1_qos_tsn", "wakeup_axi_root", 0x9e40, 0, NULL, PLAT_IMX91, }, + /* Critical because clk accessed during CPU idle */ + { IMX93_CLK_SYS_CNT_GATE, "sys_cnt", "osc_24m", 0x9e80, CLK_IS_CRITICAL}, + { IMX93_CLK_TSTMR1_GATE, "tstmr1", "bus_aon_root", 0x9ec0, }, +@@ -267,6 +277,7 @@ static int imx93_clocks_probe(struct platform_device *pdev) + const struct imx93_clk_ccgr *ccgr; + void __iomem *base, *anatop_base; + int i, ret; ++ const unsigned long plat = (unsigned long)device_get_match_data(&pdev->dev); + + clk_hw_data = devm_kzalloc(dev, struct_size(clk_hw_data, hws, + IMX93_CLK_END), GFP_KERNEL); +@@ -316,17 +327,20 @@ static int imx93_clocks_probe(struct platform_device *pdev) + + for (i = 0; i < ARRAY_SIZE(root_array); i++) { + root = &root_array[i]; +- clks[root->clk] = imx93_clk_composite_flags(root->name, +- parent_names[root->sel], +- 4, base + root->off, 3, +- root->flags); ++ if (!root->plat || root->plat & plat) ++ clks[root->clk] = imx93_clk_composite_flags(root->name, ++ parent_names[root->sel], ++ 4, base + root->off, 3, ++ root->flags); + } + + for (i = 0; i < ARRAY_SIZE(ccgr_array); i++) { + ccgr = &ccgr_array[i]; +- clks[ccgr->clk] = imx93_clk_gate(NULL, ccgr->name, ccgr->parent_name, +- ccgr->flags, base + ccgr->off, 0, 1, 1, 3, +- ccgr->shared_count); ++ if (!ccgr->plat || ccgr->plat & plat) ++ clks[ccgr->clk] = imx93_clk_gate(NULL, ++ ccgr->name, ccgr->parent_name, ++ ccgr->flags, base + ccgr->off, 0, 1, 1, 3, ++ ccgr->shared_count); + } + + clks[IMX93_CLK_A55_SEL] = imx_clk_hw_mux2("a55_sel", base + 0x4820, 0, 1, a55_core_sels, +@@ -356,7 +370,8 @@ static int imx93_clocks_probe(struct platform_device *pdev) + } + + static const struct of_device_id imx93_clk_of_match[] = { +- { .compatible = "fsl,imx93-ccm" }, ++ { .compatible = "fsl,imx93-ccm", .data = (void *)PLAT_IMX93 }, ++ { .compatible = "fsl,imx91-ccm", .data = (void *)PLAT_IMX91 }, + { /* Sentinel */ }, + }; + MODULE_DEVICE_TABLE(of, imx93_clk_of_match); +-- +2.39.5 + diff --git a/queue-6.12/clk-imx-apply-some-clks-only-for-i.mx93.patch b/queue-6.12/clk-imx-apply-some-clks-only-for-i.mx93.patch new file mode 100644 index 0000000000..ae6a875add --- /dev/null +++ b/queue-6.12/clk-imx-apply-some-clks-only-for-i.mx93.patch @@ -0,0 +1,93 @@ +From c119a75b4adc36609c1fa7c9597bea3f574665f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Dec 2024 08:14:43 +0800 +Subject: clk: imx: Apply some clks only for i.MX93 + +From: Peng Fan + +[ Upstream commit 48806be086360846bb308c5ee21fcab8405a3da7 ] + +Enable the LVDS gate, MIPI DSI, PXP, FLEXIO and MU only for i.MX93, +because i.MX91 does not support them. + +Update enet clk entry format to align with others. + +Fixes: a27bfff88dd2 ("clk: imx: add i.MX91 clk") +Signed-off-by: Peng Fan +Reviewed-by: Abel Vesa +Link: https://lore.kernel.org/r/20241225001443.883131-1-peng.fan@oss.nxp.com +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx93.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +diff --git a/drivers/clk/imx/clk-imx93.c b/drivers/clk/imx/clk-imx93.c +index eb818db008fb6..c5f358a75f307 100644 +--- a/drivers/clk/imx/clk-imx93.c ++++ b/drivers/clk/imx/clk-imx93.c +@@ -71,8 +71,8 @@ static const struct imx93_clk_root { + { IMX93_CLK_WAKEUP_AXI, "wakeup_axi_root", 0x0380, FAST_SEL, CLK_IS_CRITICAL }, + { IMX93_CLK_SWO_TRACE, "swo_trace_root", 0x0400, LOW_SPEED_IO_SEL, }, + { IMX93_CLK_M33_SYSTICK, "m33_systick_root", 0x0480, LOW_SPEED_IO_SEL, 0, PLAT_IMX93, }, +- { IMX93_CLK_FLEXIO1, "flexio1_root", 0x0500, LOW_SPEED_IO_SEL, }, +- { IMX93_CLK_FLEXIO2, "flexio2_root", 0x0580, LOW_SPEED_IO_SEL, }, ++ { IMX93_CLK_FLEXIO1, "flexio1_root", 0x0500, LOW_SPEED_IO_SEL, 0, PLAT_IMX93, }, ++ { IMX93_CLK_FLEXIO2, "flexio2_root", 0x0580, LOW_SPEED_IO_SEL, 0, PLAT_IMX93, }, + { IMX93_CLK_LPTMR1, "lptmr1_root", 0x0700, LOW_SPEED_IO_SEL, }, + { IMX93_CLK_LPTMR2, "lptmr2_root", 0x0780, LOW_SPEED_IO_SEL, }, + { IMX93_CLK_TPM2, "tpm2_root", 0x0880, TPM_SEL, }, +@@ -178,10 +178,10 @@ static const struct imx93_clk_ccgr { + { IMX93_CLK_WDOG5_GATE, "wdog5", "osc_24m", 0x8400, }, + { IMX93_CLK_SEMA1_GATE, "sema1", "bus_aon_root", 0x8440, }, + { IMX93_CLK_SEMA2_GATE, "sema2", "bus_wakeup_root", 0x8480, }, +- { IMX93_CLK_MU1_A_GATE, "mu1_a", "bus_aon_root", 0x84c0, CLK_IGNORE_UNUSED }, +- { IMX93_CLK_MU2_A_GATE, "mu2_a", "bus_wakeup_root", 0x84c0, CLK_IGNORE_UNUSED }, +- { IMX93_CLK_MU1_B_GATE, "mu1_b", "bus_aon_root", 0x8500, 0, &share_count_mub }, +- { IMX93_CLK_MU2_B_GATE, "mu2_b", "bus_wakeup_root", 0x8500, 0, &share_count_mub }, ++ { IMX93_CLK_MU1_A_GATE, "mu1_a", "bus_aon_root", 0x84c0, CLK_IGNORE_UNUSED, NULL, PLAT_IMX93 }, ++ { IMX93_CLK_MU2_A_GATE, "mu2_a", "bus_wakeup_root", 0x84c0, CLK_IGNORE_UNUSED, NULL, PLAT_IMX93 }, ++ { IMX93_CLK_MU1_B_GATE, "mu1_b", "bus_aon_root", 0x8500, 0, &share_count_mub, PLAT_IMX93 }, ++ { IMX93_CLK_MU2_B_GATE, "mu2_b", "bus_wakeup_root", 0x8500, 0, &share_count_mub, PLAT_IMX93 }, + { IMX93_CLK_EDMA1_GATE, "edma1", "m33_root", 0x8540, }, + { IMX93_CLK_EDMA2_GATE, "edma2", "wakeup_axi_root", 0x8580, }, + { IMX93_CLK_FLEXSPI1_GATE, "flexspi1", "flexspi1_root", 0x8640, }, +@@ -189,8 +189,8 @@ static const struct imx93_clk_ccgr { + { IMX93_CLK_GPIO2_GATE, "gpio2", "bus_wakeup_root", 0x88c0, }, + { IMX93_CLK_GPIO3_GATE, "gpio3", "bus_wakeup_root", 0x8900, }, + { IMX93_CLK_GPIO4_GATE, "gpio4", "bus_wakeup_root", 0x8940, }, +- { IMX93_CLK_FLEXIO1_GATE, "flexio1", "flexio1_root", 0x8980, }, +- { IMX93_CLK_FLEXIO2_GATE, "flexio2", "flexio2_root", 0x89c0, }, ++ { IMX93_CLK_FLEXIO1_GATE, "flexio1", "flexio1_root", 0x8980, 0, NULL, PLAT_IMX93}, ++ { IMX93_CLK_FLEXIO2_GATE, "flexio2", "flexio2_root", 0x89c0, 0, NULL, PLAT_IMX93}, + { IMX93_CLK_LPIT1_GATE, "lpit1", "bus_aon_root", 0x8a00, }, + { IMX93_CLK_LPIT2_GATE, "lpit2", "bus_wakeup_root", 0x8a40, }, + { IMX93_CLK_LPTMR1_GATE, "lptmr1", "lptmr1_root", 0x8a80, }, +@@ -239,10 +239,10 @@ static const struct imx93_clk_ccgr { + { IMX93_CLK_SAI3_GATE, "sai3", "sai3_root", 0x94c0, 0, &share_count_sai3}, + { IMX93_CLK_SAI3_IPG, "sai3_ipg_clk", "bus_wakeup_root", 0x94c0, 0, &share_count_sai3}, + { IMX93_CLK_MIPI_CSI_GATE, "mipi_csi", "media_apb_root", 0x9580, }, +- { IMX93_CLK_MIPI_DSI_GATE, "mipi_dsi", "media_apb_root", 0x95c0, }, +- { IMX93_CLK_LVDS_GATE, "lvds", "media_ldb_root", 0x9600, }, ++ { IMX93_CLK_MIPI_DSI_GATE, "mipi_dsi", "media_apb_root", 0x95c0, 0, NULL, PLAT_IMX93 }, ++ { IMX93_CLK_LVDS_GATE, "lvds", "media_ldb_root", 0x9600, 0, NULL, PLAT_IMX93 }, + { IMX93_CLK_LCDIF_GATE, "lcdif", "media_apb_root", 0x9640, }, +- { IMX93_CLK_PXP_GATE, "pxp", "media_apb_root", 0x9680, }, ++ { IMX93_CLK_PXP_GATE, "pxp", "media_apb_root", 0x9680, 0, NULL, PLAT_IMX93 }, + { IMX93_CLK_ISI_GATE, "isi", "media_apb_root", 0x96c0, }, + { IMX93_CLK_NIC_MEDIA_GATE, "nic_media", "media_axi_root", 0x9700, }, + { IMX93_CLK_USB_CONTROLLER_GATE, "usb_controller", "hsio_root", 0x9a00, }, +@@ -258,8 +258,8 @@ static const struct imx93_clk_ccgr { + { IMX93_CLK_HSIO_32K_GATE, "hsio_32k", "osc_32k", 0x9dc0, }, + { IMX93_CLK_ENET1_GATE, "enet1", "wakeup_axi_root", 0x9e00, 0, NULL, PLAT_IMX93, }, + { IMX93_CLK_ENET_QOS_GATE, "enet_qos", "wakeup_axi_root", 0x9e40, 0, NULL, PLAT_IMX93, }, +- { IMX91_CLK_ENET2_REGULAR_GATE, "enet2_regular", "wakeup_axi_root", 0x9e00, 0, NULL, PLAT_IMX91, }, +- { IMX91_CLK_ENET1_QOS_TSN_GATE, "enet1_qos_tsn", "wakeup_axi_root", 0x9e40, 0, NULL, PLAT_IMX91, }, ++ { IMX91_CLK_ENET2_REGULAR_GATE, "enet2_regular", "wakeup_axi_root", 0x9e00, 0, NULL, PLAT_IMX91, }, ++ { IMX91_CLK_ENET1_QOS_TSN_GATE, "enet1_qos_tsn", "wakeup_axi_root", 0x9e40, 0, NULL, PLAT_IMX91, }, + /* Critical because clk accessed during CPU idle */ + { IMX93_CLK_SYS_CNT_GATE, "sys_cnt", "osc_24m", 0x9e80, CLK_IS_CRITICAL}, + { IMX93_CLK_TSTMR1_GATE, "tstmr1", "bus_aon_root", 0x9ec0, }, +-- +2.39.5 + diff --git a/queue-6.12/clk-imx8mp-fix-clkout1-2-support.patch b/queue-6.12/clk-imx8mp-fix-clkout1-2-support.patch new file mode 100644 index 0000000000..c7156f9606 --- /dev/null +++ b/queue-6.12/clk-imx8mp-fix-clkout1-2-support.patch @@ -0,0 +1,45 @@ +From c82f0f0a32174e8a5e299b05f78791fe69b2b101 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Nov 2024 02:36:54 +0100 +Subject: clk: imx8mp: Fix clkout1/2 support + +From: Marek Vasut + +[ Upstream commit a9b7c84d22fb1687d63ca2a386773015cf59436b ] + +The CLKOUTn may be fed from PLL1/2/3, but the PLL1/2/3 has to be enabled +first by setting PLL_CLKE bit 11 in CCM_ANALOG_SYS_PLLn_GEN_CTRL register. +The CCM_ANALOG_SYS_PLLn_GEN_CTRL bit 11 is modeled by plln_out clock. Fix +the clock tree and place the clkout1/2 under plln_sel instead of plain plln +to let the clock subsystem correctly control the bit 11 and enable the PLL +in case the CLKOUTn is supplied by PLL1/2/3. + +Fixes: 43896f56b59e ("clk: imx8mp: add clkout1/2 support") +Signed-off-by: Marek Vasut +Reviewed-by: Peng Fan +Link: https://lore.kernel.org/r/20241112013718.333771-1-marex@denx.de +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx8mp.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/imx/clk-imx8mp.c b/drivers/clk/imx/clk-imx8mp.c +index 516dbd170c8a3..fb18f507f1213 100644 +--- a/drivers/clk/imx/clk-imx8mp.c ++++ b/drivers/clk/imx/clk-imx8mp.c +@@ -399,8 +399,9 @@ static const char * const imx8mp_dram_core_sels[] = {"dram_pll_out", "dram_alt_r + + static const char * const imx8mp_clkout_sels[] = {"audio_pll1_out", "audio_pll2_out", "video_pll1_out", + "dummy", "dummy", "gpu_pll_out", "vpu_pll_out", +- "arm_pll_out", "sys_pll1", "sys_pll2", "sys_pll3", +- "dummy", "dummy", "osc_24m", "dummy", "osc_32k"}; ++ "arm_pll_out", "sys_pll1_out", "sys_pll2_out", ++ "sys_pll3_out", "dummy", "dummy", "osc_24m", ++ "dummy", "osc_32k"}; + + static struct clk_hw **hws; + static struct clk_hw_onecell_data *clk_hw_data; +-- +2.39.5 + diff --git a/queue-6.12/clk-imx93-add-imx93_clk_spdif_ipg-clock.patch b/queue-6.12/clk-imx93-add-imx93_clk_spdif_ipg-clock.patch new file mode 100644 index 0000000000..7a05c44168 --- /dev/null +++ b/queue-6.12/clk-imx93-add-imx93_clk_spdif_ipg-clock.patch @@ -0,0 +1,59 @@ +From f4fba878cacf6eb6da21440b2ebd5c4fffe48d0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Nov 2024 09:58:04 +0800 +Subject: clk: imx93: Add IMX93_CLK_SPDIF_IPG clock + +From: Shengjiu Wang + +[ Upstream commit 6a7853544482e2336b5b8bb9a4b964f9d687f290 ] + +Split IMX93_CLK_SPDIF_IPG from IMX93_CLK_SPDIF_GATE +because the IMX93_CLK_SPDIF_GATE controls the gate +of IPG clock and root clock. Without this change, +disabling IMX93_CLK_SPDIF_GATE would also disable +the IPG clock, causing register access failures. + +Fixes: 1c4a4f7362fd ("arm64: dts: imx93: Add audio device nodes") +Signed-off-by: Shengjiu Wang +Reviewed-by: Frank Li +Link: https://lore.kernel.org/r/20241119015805.3840606-3-shengjiu.wang@nxp.com +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx93.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/imx/clk-imx93.c b/drivers/clk/imx/clk-imx93.c +index 58a516dd385bf..eb818db008fb6 100644 +--- a/drivers/clk/imx/clk-imx93.c ++++ b/drivers/clk/imx/clk-imx93.c +@@ -15,7 +15,7 @@ + + #include "clk.h" + +-#define IMX93_CLK_END 207 ++#define IMX93_CLK_END 208 + + #define PLAT_IMX93 BIT(0) + #define PLAT_IMX91 BIT(1) +@@ -38,6 +38,7 @@ static u32 share_count_sai2; + static u32 share_count_sai3; + static u32 share_count_mub; + static u32 share_count_pdm; ++static u32 share_count_spdif; + + static const char * const a55_core_sels[] = {"a55_alt", "arm_pll"}; + static const char *parent_names[MAX_SEL][4] = { +@@ -252,7 +253,8 @@ static const struct imx93_clk_ccgr { + { IMX93_CLK_MQS1_GATE, "mqs1", "sai1_root", 0x9b00, }, + { IMX93_CLK_MQS2_GATE, "mqs2", "sai3_root", 0x9b40, }, + { IMX93_CLK_AUD_XCVR_GATE, "aud_xcvr", "audio_xcvr_root", 0x9b80, }, +- { IMX93_CLK_SPDIF_GATE, "spdif", "spdif_root", 0x9c00, }, ++ { IMX93_CLK_SPDIF_IPG, "spdif_ipg_clk", "bus_wakeup_root", 0x9c00, 0, &share_count_spdif}, ++ { IMX93_CLK_SPDIF_GATE, "spdif", "spdif_root", 0x9c00, 0, &share_count_spdif}, + { IMX93_CLK_HSIO_32K_GATE, "hsio_32k", "osc_32k", 0x9dc0, }, + { IMX93_CLK_ENET1_GATE, "enet1", "wakeup_axi_root", 0x9e00, 0, NULL, PLAT_IMX93, }, + { IMX93_CLK_ENET_QOS_GATE, "enet_qos", "wakeup_axi_root", 0x9e40, 0, NULL, PLAT_IMX93, }, +-- +2.39.5 + diff --git a/queue-6.12/clk-imx93-move-imx93_clk_end-macro-to-clk-driver.patch b/queue-6.12/clk-imx93-move-imx93_clk_end-macro-to-clk-driver.patch new file mode 100644 index 0000000000..94719069d7 --- /dev/null +++ b/queue-6.12/clk-imx93-move-imx93_clk_end-macro-to-clk-driver.patch @@ -0,0 +1,41 @@ +From c23e7c6c08430b1c97fc1458bcd7bcf376645fbf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Oct 2024 11:46:47 -0700 +Subject: clk: imx93: Move IMX93_CLK_END macro to clk driver + +From: Pengfei Li + +[ Upstream commit 0af18ba60752e8a4ba34404c1d9a4a799da690f5 ] + +IMX93_CLK_END was previously defined in imx93-clock.h to indicate +the number of clocks. However, it is not part of the ABI. For starters +it does no really appear in DTS. But what's more important - new clocks +are described later, which contradicts this define in binding header. +So move this macro to clock driver. + +Signed-off-by: Pengfei Li +Reviewed-by: Abel Vesa +Link: https://lore.kernel.org/r/20241023184651.381265-2-pengfei.li_1@nxp.com +Signed-off-by: Abel Vesa +Stable-dep-of: 6a7853544482 ("clk: imx93: Add IMX93_CLK_SPDIF_IPG clock") +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx93.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/imx/clk-imx93.c b/drivers/clk/imx/clk-imx93.c +index c6a9bc8ecc1fc..c8b65146e76ea 100644 +--- a/drivers/clk/imx/clk-imx93.c ++++ b/drivers/clk/imx/clk-imx93.c +@@ -15,6 +15,8 @@ + + #include "clk.h" + ++#define IMX93_CLK_END 202 ++ + enum clk_sel { + LOW_SPEED_IO_SEL, + NON_IO_SEL, +-- +2.39.5 + diff --git a/queue-6.12/clk-qcom-camcc-x1e80100-set-titan_top_gdsc-as-the-pa.patch b/queue-6.12/clk-qcom-camcc-x1e80100-set-titan_top_gdsc-as-the-pa.patch new file mode 100644 index 0000000000..a030d3b6ae --- /dev/null +++ b/queue-6.12/clk-qcom-camcc-x1e80100-set-titan_top_gdsc-as-the-pa.patch @@ -0,0 +1,82 @@ +From 14fca62350a647cfde146070b12614d7545403dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Dec 2024 13:23:03 +0000 +Subject: clk: qcom: camcc-x1e80100: Set titan_top_gdsc as the parent GDSC of + subordinate GDSCs + +From: Bryan O'Donoghue + +[ Upstream commit d9377941f2732d2f6f53ec9520321a19c687717a ] + +The Titan TOP GDSC is the parent GDSC for all other GDSCs in the CAMCC +block. None of the subordinate blocks will switch on without the parent +GDSC switched on. + +Fixes: 76126a5129b5 ("clk: qcom: Add camcc clock driver for x1e80100") +Acked-by: Rajendra Nayak +Reviewed-by: Konrad Dybcio +Signed-off-by: Bryan O'Donoghue +Reviewed-by: Vladimir Zapolskiy +Link: https://lore.kernel.org/r/20241227-b4-linux-next-24-12-16-titan-top-gdsc-v1-1-c96ef62fc307@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/camcc-x1e80100.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/clk/qcom/camcc-x1e80100.c b/drivers/clk/qcom/camcc-x1e80100.c +index 85e76c7712ad8..b73524ae64b1b 100644 +--- a/drivers/clk/qcom/camcc-x1e80100.c ++++ b/drivers/clk/qcom/camcc-x1e80100.c +@@ -2212,6 +2212,8 @@ static struct clk_branch cam_cc_sfe_0_fast_ahb_clk = { + }, + }; + ++static struct gdsc cam_cc_titan_top_gdsc; ++ + static struct gdsc cam_cc_bps_gdsc = { + .gdscr = 0x10004, + .en_rest_wait_val = 0x2, +@@ -2221,6 +2223,7 @@ static struct gdsc cam_cc_bps_gdsc = { + .name = "cam_cc_bps_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &cam_cc_titan_top_gdsc.pd, + .flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE, + }; + +@@ -2233,6 +2236,7 @@ static struct gdsc cam_cc_ife_0_gdsc = { + .name = "cam_cc_ife_0_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &cam_cc_titan_top_gdsc.pd, + .flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE, + }; + +@@ -2245,6 +2249,7 @@ static struct gdsc cam_cc_ife_1_gdsc = { + .name = "cam_cc_ife_1_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &cam_cc_titan_top_gdsc.pd, + .flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE, + }; + +@@ -2257,6 +2262,7 @@ static struct gdsc cam_cc_ipe_0_gdsc = { + .name = "cam_cc_ipe_0_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &cam_cc_titan_top_gdsc.pd, + .flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE, + }; + +@@ -2269,6 +2275,7 @@ static struct gdsc cam_cc_sfe_0_gdsc = { + .name = "cam_cc_sfe_0_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &cam_cc_titan_top_gdsc.pd, + .flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE, + }; + +-- +2.39.5 + diff --git a/queue-6.12/clk-qcom-gcc-sdm845-do-not-use-shared-clk_ops-for-qu.patch b/queue-6.12/clk-qcom-gcc-sdm845-do-not-use-shared-clk_ops-for-qu.patch new file mode 100644 index 0000000000..004113cc99 --- /dev/null +++ b/queue-6.12/clk-qcom-gcc-sdm845-do-not-use-shared-clk_ops-for-qu.patch @@ -0,0 +1,185 @@ +From dddf231350126beb9265bb52e28dfb6a9f4bfe9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Dec 2024 23:19:12 +0530 +Subject: clk: qcom: gcc-sdm845: Do not use shared clk_ops for QUPs + +From: Amit Pundir + +[ Upstream commit f760a4bb5e927a133dcd75f7b69ccae2a331e42c ] + +Similar to the earlier fixes meant for sm8x50 and x1e platforms, +we have to stop using the shared clk ops for sdm845 QUPs as well. + +As Stephen Boyd pointed out in earlier fixes, there wasn't a problem +to mark QUP clks shared until we started parking shared RCGs at clk +registration time in commit 01a0a6cc8cfd ("clk: qcom: Park shared RCGs +upon registration"). Parking at init is actually harmful to the UART +when earlycon is used. If the device is pumping out data while the +frequency changes and we see garbage on the serial console until the +driver can probe and actually set a proper frequency. + +This patch reverts the QUP clk sharing ops part of commit 06391eddb60a +("clk: qcom: Add Global Clock controller (GCC) driver for SDM845"), so +that the QUPs on sdm845 don't get parked during clk registration and +break UART operations. + +Fixes: 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration") +Signed-off-by: Amit Pundir +Link: https://lore.kernel.org/r/20241209174912.2526928-1-amit.pundir@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sdm845.c | 32 ++++++++++++++++---------------- + 1 file changed, 16 insertions(+), 16 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-sdm845.c b/drivers/clk/qcom/gcc-sdm845.c +index dc3aa7014c3ed..c6692808a8228 100644 +--- a/drivers/clk/qcom/gcc-sdm845.c ++++ b/drivers/clk/qcom/gcc-sdm845.c +@@ -454,7 +454,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s0_clk_src_init = { + .name = "gcc_qupv3_wrap0_s0_clk_src", + .parent_data = gcc_parent_data_0, + .num_parents = ARRAY_SIZE(gcc_parent_data_0), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap0_s0_clk_src = { +@@ -470,7 +470,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s1_clk_src_init = { + .name = "gcc_qupv3_wrap0_s1_clk_src", + .parent_data = gcc_parent_data_0, + .num_parents = ARRAY_SIZE(gcc_parent_data_0), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap0_s1_clk_src = { +@@ -486,7 +486,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s2_clk_src_init = { + .name = "gcc_qupv3_wrap0_s2_clk_src", + .parent_data = gcc_parent_data_0, + .num_parents = ARRAY_SIZE(gcc_parent_data_0), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap0_s2_clk_src = { +@@ -502,7 +502,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s3_clk_src_init = { + .name = "gcc_qupv3_wrap0_s3_clk_src", + .parent_data = gcc_parent_data_0, + .num_parents = ARRAY_SIZE(gcc_parent_data_0), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap0_s3_clk_src = { +@@ -518,7 +518,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s4_clk_src_init = { + .name = "gcc_qupv3_wrap0_s4_clk_src", + .parent_data = gcc_parent_data_0, + .num_parents = ARRAY_SIZE(gcc_parent_data_0), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap0_s4_clk_src = { +@@ -534,7 +534,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s5_clk_src_init = { + .name = "gcc_qupv3_wrap0_s5_clk_src", + .parent_data = gcc_parent_data_0, + .num_parents = ARRAY_SIZE(gcc_parent_data_0), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap0_s5_clk_src = { +@@ -550,7 +550,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s6_clk_src_init = { + .name = "gcc_qupv3_wrap0_s6_clk_src", + .parent_data = gcc_parent_data_0, + .num_parents = ARRAY_SIZE(gcc_parent_data_0), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap0_s6_clk_src = { +@@ -566,7 +566,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s7_clk_src_init = { + .name = "gcc_qupv3_wrap0_s7_clk_src", + .parent_data = gcc_parent_data_0, + .num_parents = ARRAY_SIZE(gcc_parent_data_0), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap0_s7_clk_src = { +@@ -582,7 +582,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s0_clk_src_init = { + .name = "gcc_qupv3_wrap1_s0_clk_src", + .parent_data = gcc_parent_data_0, + .num_parents = ARRAY_SIZE(gcc_parent_data_0), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap1_s0_clk_src = { +@@ -598,7 +598,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s1_clk_src_init = { + .name = "gcc_qupv3_wrap1_s1_clk_src", + .parent_data = gcc_parent_data_0, + .num_parents = ARRAY_SIZE(gcc_parent_data_0), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap1_s1_clk_src = { +@@ -614,7 +614,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s2_clk_src_init = { + .name = "gcc_qupv3_wrap1_s2_clk_src", + .parent_data = gcc_parent_data_0, + .num_parents = ARRAY_SIZE(gcc_parent_data_0), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap1_s2_clk_src = { +@@ -630,7 +630,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s3_clk_src_init = { + .name = "gcc_qupv3_wrap1_s3_clk_src", + .parent_data = gcc_parent_data_0, + .num_parents = ARRAY_SIZE(gcc_parent_data_0), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap1_s3_clk_src = { +@@ -646,7 +646,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s4_clk_src_init = { + .name = "gcc_qupv3_wrap1_s4_clk_src", + .parent_data = gcc_parent_data_0, + .num_parents = ARRAY_SIZE(gcc_parent_data_0), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap1_s4_clk_src = { +@@ -662,7 +662,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s5_clk_src_init = { + .name = "gcc_qupv3_wrap1_s5_clk_src", + .parent_data = gcc_parent_data_0, + .num_parents = ARRAY_SIZE(gcc_parent_data_0), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap1_s5_clk_src = { +@@ -678,7 +678,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s6_clk_src_init = { + .name = "gcc_qupv3_wrap1_s6_clk_src", + .parent_data = gcc_parent_data_0, + .num_parents = ARRAY_SIZE(gcc_parent_data_0), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap1_s6_clk_src = { +@@ -694,7 +694,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s7_clk_src_init = { + .name = "gcc_qupv3_wrap1_s7_clk_src", + .parent_data = gcc_parent_data_0, + .num_parents = ARRAY_SIZE(gcc_parent_data_0), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap1_s7_clk_src = { +-- +2.39.5 + diff --git a/queue-6.12/clk-ralink-mtmips-remove-duplicated-xtal-clock-for-r.patch b/queue-6.12/clk-ralink-mtmips-remove-duplicated-xtal-clock-for-r.patch new file mode 100644 index 0000000000..42657028cd --- /dev/null +++ b/queue-6.12/clk-ralink-mtmips-remove-duplicated-xtal-clock-for-r.patch @@ -0,0 +1,38 @@ +From 21a4c17d6eadb894df738ee25f1588d5d90b22ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 10:36:36 +0100 +Subject: clk: ralink: mtmips: remove duplicated 'xtal' clock for Ralink SoC + RT3883 + +From: Sergio Paracuellos + +[ Upstream commit 830d8062d25581cf0beaa334486eea06834044da ] + +Ralink SoC RT3883 has already 'xtal' defined as a base clock so there is no +need to redefine it again in fixed clocks section. Hence, remove the duplicate +one from there. + +Fixes: d34db686a3d7 ("clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs") +Signed-off-by: Sergio Paracuellos +Link: https://lore.kernel.org/r/20250108093636.265033-1-sergio.paracuellos@gmail.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/ralink/clk-mtmips.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/clk/ralink/clk-mtmips.c b/drivers/clk/ralink/clk-mtmips.c +index 76285fbbdeaa2..4b5d8b741e4e1 100644 +--- a/drivers/clk/ralink/clk-mtmips.c ++++ b/drivers/clk/ralink/clk-mtmips.c +@@ -264,7 +264,6 @@ static int mtmips_register_pherip_clocks(struct device_node *np, + } + + static struct mtmips_clk_fixed rt3883_fixed_clocks[] = { +- CLK_FIXED("xtal", NULL, 40000000), + CLK_FIXED("periph", "xtal", 40000000) + }; + +-- +2.39.5 + diff --git a/queue-6.12/clk-renesas-cpg-mssr-fix-soc-node-handling-in-cpg_ms.patch b/queue-6.12/clk-renesas-cpg-mssr-fix-soc-node-handling-in-cpg_ms.patch new file mode 100644 index 0000000000..fb52d0c3fa --- /dev/null +++ b/queue-6.12/clk-renesas-cpg-mssr-fix-soc-node-handling-in-cpg_ms.patch @@ -0,0 +1,45 @@ +From f7c0eda7e1c22db13d036ce0f520450efab0c381 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Oct 2024 13:43:16 +0100 +Subject: clk: renesas: cpg-mssr: Fix 'soc' node handling in + cpg_mssr_reserved_init() + +From: Javier Carrasco + +[ Upstream commit a6ca7e6240f0651412da6a17d0e7a8f66d3455a6 ] + +A device_node reference obtained via of_find_node_by_path() requires +explicit calls to of_node_put() after it is no longer required to avoid +leaking the resource. + +Instead of adding the missing calls to of_node_put() in all execution +paths, use the cleanup attribute for 'soc' by means of the __free() +macro, which automatically calls of_node_put() when the variable goes +out of scope. + +Fixes: 6aa175476490 ("clk: renesas: cpg-mssr: Ignore all clocks assigned to non-Linux system") +Signed-off-by: Javier Carrasco +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20241031-clk-renesas-cpg-mssr-cleanup-v2-1-0010936d1154@gmail.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/clk/renesas/renesas-cpg-mssr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/renesas/renesas-cpg-mssr.c b/drivers/clk/renesas/renesas-cpg-mssr.c +index 1b421b8097965..0f27c33192e10 100644 +--- a/drivers/clk/renesas/renesas-cpg-mssr.c ++++ b/drivers/clk/renesas/renesas-cpg-mssr.c +@@ -981,7 +981,7 @@ static void __init cpg_mssr_reserved_exit(struct cpg_mssr_priv *priv) + static int __init cpg_mssr_reserved_init(struct cpg_mssr_priv *priv, + const struct cpg_mssr_info *info) + { +- struct device_node *soc = of_find_node_by_path("/soc"); ++ struct device_node *soc __free(device_node) = of_find_node_by_path("/soc"); + struct device_node *node; + uint32_t args[MAX_PHANDLE_ARGS]; + unsigned int *ids = NULL; +-- +2.39.5 + diff --git a/queue-6.12/clk-sunxi-ng-a64-drop-redundant-clk_pll_video0_2x-an.patch b/queue-6.12/clk-sunxi-ng-a64-drop-redundant-clk_pll_video0_2x-an.patch new file mode 100644 index 0000000000..b6c2725f7c --- /dev/null +++ b/queue-6.12/clk-sunxi-ng-a64-drop-redundant-clk_pll_video0_2x-an.patch @@ -0,0 +1,48 @@ +From d2386c91144027a0927a293d20abcaec1549fd33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jan 2025 23:36:58 -0800 +Subject: clk: sunxi-ng: a64: drop redundant CLK_PLL_VIDEO0_2X and CLK_PLL_MIPI + +From: Vasily Khoruzhick + +[ Upstream commit 0f368cb7ef103f284f75e962c4c89da5aa8ccec7 ] + +Drop redundant CLK_PLL_VIDEO0_2X and CLK_PLL.MIPI. These are now +defined in dt-bindings/clock/sun50i-a64-ccu.h + +Fixes: ca1170b69968 ("clk: sunxi-ng: a64: force select PLL_MIPI in TCON0 mux") +Reviewed-by: Dragan Simic +Reviewed-by: Chen-Yu Tsai +Tested-by: Frank Oltmanns # on pinephone +Tested-by: Stuart Gathman # on OG pinebook +Signed-off-by: Vasily Khoruzhick +Link: https://patch.msgid.link/20250104074035.1611136-3-anarsoul@gmail.com +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu-sun50i-a64.h | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.h b/drivers/clk/sunxi-ng/ccu-sun50i-a64.h +index a8c11c0b4e067..dfba88a5ad0f7 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.h ++++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.h +@@ -21,7 +21,6 @@ + + /* PLL_VIDEO0 exported for HDMI PHY */ + +-#define CLK_PLL_VIDEO0_2X 8 + #define CLK_PLL_VE 9 + #define CLK_PLL_DDR0 10 + +@@ -32,7 +31,6 @@ + #define CLK_PLL_PERIPH1_2X 14 + #define CLK_PLL_VIDEO1 15 + #define CLK_PLL_GPU 16 +-#define CLK_PLL_MIPI 17 + #define CLK_PLL_HSIC 18 + #define CLK_PLL_DE 19 + #define CLK_PLL_DDR1 20 +-- +2.39.5 + diff --git a/queue-6.12/clk-sunxi-ng-a64-stop-force-selecting-pll-mipi-as-tc.patch b/queue-6.12/clk-sunxi-ng-a64-stop-force-selecting-pll-mipi-as-tc.patch new file mode 100644 index 0000000000..2cef703b3b --- /dev/null +++ b/queue-6.12/clk-sunxi-ng-a64-stop-force-selecting-pll-mipi-as-tc.patch @@ -0,0 +1,76 @@ +From 4ae0838ccafaf6eb30744b0bf30385fa3f3fa866 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jan 2025 23:37:00 -0800 +Subject: clk: sunxi-ng: a64: stop force-selecting PLL-MIPI as TCON0 parent + +From: Vasily Khoruzhick + +[ Upstream commit 383ca7bee8a93be9ff5a072936981c2710d2856b ] + +Stop force-selecting PLL-MIPI as TCON0 parent, since it breaks video +output on Pinebook that uses RGB to eDP bridge. + +Partially revert commit ca1170b69968 ("clk: sunxi-ng: a64: force +select PLL_MIPI in TCON0 mux"), while still leaving +CLK_SET_RATE_NO_REPARENT flag set, since we do not want the clock to +be reparented. + +The issue is that apparently different TCON0 outputs require a different +clock, or the mux might be selecting the output type. + +I did an experiment: I manually configured PLL_MIPI and PLL_VIDEO0_2X +to the same clock rate and flipped the switch with devmem. Experiment +clearly showed that whenever PLL_MIPI is selected as TCON0 clock parent, +the video output stops working. + +Therefore, TCON0 clock parent corresponding to the output type must be +assigned in the device tree. + +Fixes: ca1170b69968 ("clk: sunxi-ng: a64: force select PLL_MIPI in TCON0 mux") +Reviewed-by: Dragan Simic +Reviewed-by: Chen-Yu Tsai +Tested-by: Frank Oltmanns # on PinePhone +Tested-by: Stuart Gathman # on OG Pinebook +Signed-off-by: Vasily Khoruzhick +Link: https://patch.msgid.link/20250104074035.1611136-5-anarsoul@gmail.com +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu-sun50i-a64.c | 13 ++++--------- + 1 file changed, 4 insertions(+), 9 deletions(-) + +diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c +index c255dba2c96db..6727a3e30a129 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c ++++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c +@@ -535,11 +535,11 @@ static SUNXI_CCU_M_WITH_MUX_GATE(de_clk, "de", de_parents, + CLK_SET_RATE_PARENT); + + /* +- * DSI output seems to work only when PLL_MIPI selected. Set it and prevent +- * the mux from reparenting. ++ * Experiments showed that RGB output requires pll-video0-2x, while DSI ++ * requires pll-mipi. It will not work with incorrect clock, the screen will ++ * be blank. ++ * sun50i-a64.dtsi assigns pll-mipi as TCON0 parent by default + */ +-#define SUN50I_A64_TCON0_CLK_REG 0x118 +- + static const char * const tcon0_parents[] = { "pll-mipi", "pll-video0-2x" }; + static const u8 tcon0_table[] = { 0, 2, }; + static SUNXI_CCU_MUX_TABLE_WITH_GATE_CLOSEST(tcon0_clk, "tcon0", tcon0_parents, +@@ -959,11 +959,6 @@ static int sun50i_a64_ccu_probe(struct platform_device *pdev) + + writel(0x515, reg + SUN50I_A64_PLL_MIPI_REG); + +- /* Set PLL MIPI as parent for TCON0 */ +- val = readl(reg + SUN50I_A64_TCON0_CLK_REG); +- val &= ~GENMASK(26, 24); +- writel(val | (0 << 24), reg + SUN50I_A64_TCON0_CLK_REG); +- + ret = devm_sunxi_ccu_probe(&pdev->dev, reg, &sun50i_a64_ccu_desc); + if (ret) + return ret; +-- +2.39.5 + diff --git a/queue-6.12/clk-thead-add-clk_ignore_unused-to-fix-th1520-boot.patch b/queue-6.12/clk-thead-add-clk_ignore_unused-to-fix-th1520-boot.patch new file mode 100644 index 0000000000..1bd4e674e1 --- /dev/null +++ b/queue-6.12/clk-thead-add-clk_ignore_unused-to-fix-th1520-boot.patch @@ -0,0 +1,57 @@ +From 53f242e06ca368b3d33c0e8edba5524ff4455228 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 12:31:25 -0800 +Subject: clk: thead: Add CLK_IGNORE_UNUSED to fix TH1520 boot + +From: Drew Fustini + +[ Upstream commit 037705e94bf6e1810b7f9dc077d0e23292229e74 ] + +Add the CLK_IGNORE_UNUSED flag to apb_pclk, cpu2peri_x2h_clk, +perisys_apb2_hclk and perisys_apb3_hclk. + +Without this flag, the boot hangs after "clk: Disabling unused clocks" +unless clk_ignore_unused is in the kernel cmdline. + +Fixes: ae81b69fd2b1 ("clk: thead: Add support for T-Head TH1520 AP_SUBSYS clocks") +Signed-off-by: Drew Fustini +Link: https://lore.kernel.org/r/20250113-th1520-clk_ignore_unused-v1-2-0b08fb813438@tenstorrent.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/thead/clk-th1520-ap.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/thead/clk-th1520-ap.c b/drivers/clk/thead/clk-th1520-ap.c +index c95b6e26ca531..d02a18fed8a85 100644 +--- a/drivers/clk/thead/clk-th1520-ap.c ++++ b/drivers/clk/thead/clk-th1520-ap.c +@@ -657,7 +657,7 @@ static struct ccu_div apb_pclk = { + .hw.init = CLK_HW_INIT_PARENTS_DATA("apb-pclk", + apb_parents, + &ccu_div_ops, +- 0), ++ CLK_IGNORE_UNUSED), + }, + }; + +@@ -794,13 +794,13 @@ static CCU_GATE(CLK_X2X_CPUSYS, x2x_cpusys_clk, "x2x-cpusys", axi4_cpusys2_aclk_ + 0x134, BIT(7), 0); + static CCU_GATE(CLK_CPU2AON_X2H, cpu2aon_x2h_clk, "cpu2aon-x2h", axi_aclk_pd, 0x138, BIT(8), 0); + static CCU_GATE(CLK_CPU2PERI_X2H, cpu2peri_x2h_clk, "cpu2peri-x2h", axi4_cpusys2_aclk_pd, +- 0x140, BIT(9), 0); ++ 0x140, BIT(9), CLK_IGNORE_UNUSED); + static CCU_GATE(CLK_PERISYS_APB1_HCLK, perisys_apb1_hclk, "perisys-apb1-hclk", perisys_ahb_hclk_pd, + 0x150, BIT(9), 0); + static CCU_GATE(CLK_PERISYS_APB2_HCLK, perisys_apb2_hclk, "perisys-apb2-hclk", perisys_ahb_hclk_pd, +- 0x150, BIT(10), 0); ++ 0x150, BIT(10), CLK_IGNORE_UNUSED); + static CCU_GATE(CLK_PERISYS_APB3_HCLK, perisys_apb3_hclk, "perisys-apb3-hclk", perisys_ahb_hclk_pd, +- 0x150, BIT(11), 0); ++ 0x150, BIT(11), CLK_IGNORE_UNUSED); + static CCU_GATE(CLK_PERISYS_APB4_HCLK, perisys_apb4_hclk, "perisys-apb4-hclk", perisys_ahb_hclk_pd, + 0x150, BIT(12), 0); + static CCU_GATE(CLK_NPU_AXI, npu_axi_clk, "npu-axi", axi_aclk_pd, 0x1c8, BIT(5), 0); +-- +2.39.5 + diff --git a/queue-6.12/clk-thead-fix-clk-gate-registration-to-pass-flags.patch b/queue-6.12/clk-thead-fix-clk-gate-registration-to-pass-flags.patch new file mode 100644 index 0000000000..bb2b608876 --- /dev/null +++ b/queue-6.12/clk-thead-fix-clk-gate-registration-to-pass-flags.patch @@ -0,0 +1,39 @@ +From 677f53bf29a43b42f7d6ce7d6d90da970c03a14f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 12:31:24 -0800 +Subject: clk: thead: Fix clk gate registration to pass flags + +From: Drew Fustini + +[ Upstream commit a826e53fd78c7f07b8ff83446c44b227b2181920 ] + +Modify the call to devm_clk_hw_register_gate_parent_data() to actually +pass the clk flags from hw.init instead of just 0. This is necessary to +allow individual clk gates to specify their own clk flags. + +Fixes: ae81b69fd2b1 ("clk: thead: Add support for T-Head TH1520 AP_SUBSYS clocks") +Signed-off-by: Drew Fustini +Link: https://lore.kernel.org/r/20250113-th1520-clk_ignore_unused-v1-1-0b08fb813438@tenstorrent.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/thead/clk-th1520-ap.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/thead/clk-th1520-ap.c b/drivers/clk/thead/clk-th1520-ap.c +index 1015fab952515..c95b6e26ca531 100644 +--- a/drivers/clk/thead/clk-th1520-ap.c ++++ b/drivers/clk/thead/clk-th1520-ap.c +@@ -1048,7 +1048,8 @@ static int th1520_clk_probe(struct platform_device *pdev) + hw = devm_clk_hw_register_gate_parent_data(dev, + cg->common.hw.init->name, + cg->common.hw.init->parent_data, +- 0, base + cg->common.cfg0, ++ cg->common.hw.init->flags, ++ base + cg->common.cfg0, + ffs(cg->enable) - 1, 0, NULL); + if (IS_ERR(hw)) + return PTR_ERR(hw); +-- +2.39.5 + diff --git a/queue-6.12/clk-thead-fix-cpu2vp_clk-for-th1520-ap_subsys-clocks.patch b/queue-6.12/clk-thead-fix-cpu2vp_clk-for-th1520-ap_subsys-clocks.patch new file mode 100644 index 0000000000..cb9977fd2a --- /dev/null +++ b/queue-6.12/clk-thead-fix-cpu2vp_clk-for-th1520-ap_subsys-clocks.patch @@ -0,0 +1,44 @@ +From 5ade09b69ca4ddef403a872a5c338c4a2be8ff52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Dec 2024 19:48:04 -0800 +Subject: clk: thead: Fix cpu2vp_clk for TH1520 AP_SUBSYS clocks + +From: Drew Fustini + +[ Upstream commit 3a43cd19f1b8d3f57f835ae50cc869f07902c062 ] + +cpu2vp_clk is a gate but was mistakenly in th1520_div_clks[] instead +of th1520_gate_clks[]. + +Fixes: ae81b69fd2b1 ("clk: thead: Add support for T-Head TH1520 AP_SUBSYS clocks") +Signed-off-by: Drew Fustini +Link: https://lore.kernel.org/r/20241228034802.1573554-1-dfustini@tenstorrent.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/thead/clk-th1520-ap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/thead/clk-th1520-ap.c b/drivers/clk/thead/clk-th1520-ap.c +index d02a18fed8a85..4c9555fc61844 100644 +--- a/drivers/clk/thead/clk-th1520-ap.c ++++ b/drivers/clk/thead/clk-th1520-ap.c +@@ -896,7 +896,6 @@ static struct ccu_common *th1520_div_clks[] = { + &vo_axi_clk.common, + &vp_apb_clk.common, + &vp_axi_clk.common, +- &cpu2vp_clk.common, + &venc_clk.common, + &dpu0_clk.common, + &dpu1_clk.common, +@@ -916,6 +915,7 @@ static struct ccu_common *th1520_gate_clks[] = { + &bmu_clk.common, + &cpu2aon_x2h_clk.common, + &cpu2peri_x2h_clk.common, ++ &cpu2vp_clk.common, + &perisys_apb1_hclk.common, + &perisys_apb2_hclk.common, + &perisys_apb3_hclk.common, +-- +2.39.5 + diff --git a/queue-6.12/coredump-do-not-lock-during-comm-reporting.patch b/queue-6.12/coredump-do-not-lock-during-comm-reporting.patch new file mode 100644 index 0000000000..d2e99820c5 --- /dev/null +++ b/queue-6.12/coredump-do-not-lock-during-comm-reporting.patch @@ -0,0 +1,42 @@ +From be5f736016ff15059c28727cb2b79986385b69f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Sep 2024 14:08:31 -0700 +Subject: coredump: Do not lock during 'comm' reporting + +From: Kees Cook + +[ Upstream commit 200f091c95bbc4b8660636bd345805c45d6eced7 ] + +The 'comm' member will always be NUL terminated, and this is not +fast-path, so we can just perform a direct memcpy during a coredump +instead of potentially deadlocking while holding the task struct lock. + +Reported-by: Vegard Nossum +Closes: https://lore.kernel.org/all/d122ece6-3606-49de-ae4d-8da88846bef2@oracle.com +Fixes: c114e9948c2b ("coredump: Standartize and fix logging") +Tested-by: Vegard Nossum +Link: https://lore.kernel.org/r/20240928210830.work.307-kees@kernel.org +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + include/linux/coredump.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/linux/coredump.h b/include/linux/coredump.h +index 45e598fe34766..77e6e195d1d68 100644 +--- a/include/linux/coredump.h ++++ b/include/linux/coredump.h +@@ -52,8 +52,8 @@ extern void do_coredump(const kernel_siginfo_t *siginfo); + #define __COREDUMP_PRINTK(Level, Format, ...) \ + do { \ + char comm[TASK_COMM_LEN]; \ +- \ +- get_task_comm(comm, current); \ ++ /* This will always be NUL terminated. */ \ ++ memcpy(comm, current->comm, sizeof(comm)); \ + printk_ratelimited(Level "coredump: %d(%*pE): " Format "\n", \ + task_tgid_vnr(current), (int)strlen(comm), comm, ##__VA_ARGS__); \ + } while (0) \ +-- +2.39.5 + diff --git a/queue-6.12/cpufreq-acpi-fix-max-frequency-computation.patch b/queue-6.12/cpufreq-acpi-fix-max-frequency-computation.patch new file mode 100644 index 0000000000..07851305cd --- /dev/null +++ b/queue-6.12/cpufreq-acpi-fix-max-frequency-computation.patch @@ -0,0 +1,122 @@ +From 5ff8353122179ff417400a414a67ad7c0cfb2c68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 10:11:07 +0530 +Subject: cpufreq: ACPI: Fix max-frequency computation + +From: Gautham R. Shenoy + +[ Upstream commit 0834667545962ef1c5e8684ed32b45d9c574acd3 ] + +Commit 3c55e94c0ade ("cpufreq: ACPI: Extend frequency tables to cover +boost frequencies") introduced an assumption in acpi_cpufreq_cpu_init() +that the first entry in the P-state table was the nominal frequency. +This assumption is incorrect. The frequency corresponding to the P0 +P-State need not be the same as the nominal frequency advertised via +CPPC. + +Since the driver is using the CPPC.highest_perf and CPPC.nominal_perf +to compute the boost-ratio, it makes sense to use CPPC.nominal_freq to +compute the max-frequency. CPPC.nominal_freq is advertised on +platforms supporting CPPC revisions 3 or higher. + +Hence, fallback to using the first entry in the P-State table only on +platforms that do not advertise CPPC.nominal_freq. + +Fixes: 3c55e94c0ade ("cpufreq: ACPI: Extend frequency tables to cover boost frequencies") +Tested-by: Dhananjay Ugwekar +Signed-off-by: Gautham R. Shenoy +Reviewed-by: Mario Limonciello +Link: https://patch.msgid.link/20250113044107.566-1-gautham.shenoy@amd.com +[ rjw: Retain reverse X-mas tree ordering of local variable declarations ] +[ rjw: Subject and changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/acpi-cpufreq.c | 36 +++++++++++++++++++++++++--------- + 1 file changed, 27 insertions(+), 9 deletions(-) + +diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c +index 0f04feb6cafaf..47e910c22a80b 100644 +--- a/drivers/cpufreq/acpi-cpufreq.c ++++ b/drivers/cpufreq/acpi-cpufreq.c +@@ -626,7 +626,14 @@ static int acpi_cpufreq_blacklist(struct cpuinfo_x86 *c) + #endif + + #ifdef CONFIG_ACPI_CPPC_LIB +-static u64 get_max_boost_ratio(unsigned int cpu) ++/* ++ * get_max_boost_ratio: Computes the max_boost_ratio as the ratio ++ * between the highest_perf and the nominal_perf. ++ * ++ * Returns the max_boost_ratio for @cpu. Returns the CPPC nominal ++ * frequency via @nominal_freq if it is non-NULL pointer. ++ */ ++static u64 get_max_boost_ratio(unsigned int cpu, u64 *nominal_freq) + { + struct cppc_perf_caps perf_caps; + u64 highest_perf, nominal_perf; +@@ -655,6 +662,9 @@ static u64 get_max_boost_ratio(unsigned int cpu) + + nominal_perf = perf_caps.nominal_perf; + ++ if (nominal_freq) ++ *nominal_freq = perf_caps.nominal_freq; ++ + if (!highest_perf || !nominal_perf) { + pr_debug("CPU%d: highest or nominal performance missing\n", cpu); + return 0; +@@ -667,8 +677,12 @@ static u64 get_max_boost_ratio(unsigned int cpu) + + return div_u64(highest_perf << SCHED_CAPACITY_SHIFT, nominal_perf); + } ++ + #else +-static inline u64 get_max_boost_ratio(unsigned int cpu) { return 0; } ++static inline u64 get_max_boost_ratio(unsigned int cpu, u64 *nominal_freq) ++{ ++ return 0; ++} + #endif + + static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy) +@@ -678,9 +692,9 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy) + struct acpi_cpufreq_data *data; + unsigned int cpu = policy->cpu; + struct cpuinfo_x86 *c = &cpu_data(cpu); ++ u64 max_boost_ratio, nominal_freq = 0; + unsigned int valid_states = 0; + unsigned int result = 0; +- u64 max_boost_ratio; + unsigned int i; + #ifdef CONFIG_SMP + static int blacklisted; +@@ -830,16 +844,20 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy) + } + freq_table[valid_states].frequency = CPUFREQ_TABLE_END; + +- max_boost_ratio = get_max_boost_ratio(cpu); ++ max_boost_ratio = get_max_boost_ratio(cpu, &nominal_freq); + if (max_boost_ratio) { +- unsigned int freq = freq_table[0].frequency; ++ unsigned int freq = nominal_freq; + + /* +- * Because the loop above sorts the freq_table entries in the +- * descending order, freq is the maximum frequency in the table. +- * Assume that it corresponds to the CPPC nominal frequency and +- * use it to set cpuinfo.max_freq. ++ * The loop above sorts the freq_table entries in the ++ * descending order. If ACPI CPPC has not advertised ++ * the nominal frequency (this is possible in CPPC ++ * revisions prior to 3), then use the first entry in ++ * the pstate table as a proxy for nominal frequency. + */ ++ if (!freq) ++ freq = freq_table[0].frequency; ++ + policy->cpuinfo.max_freq = freq * max_boost_ratio >> SCHED_CAPACITY_SHIFT; + } else { + /* +-- +2.39.5 + diff --git a/queue-6.12/cpufreq-qcom-fix-qcom_cpufreq_hw_recalc_rate-to-quer.patch b/queue-6.12/cpufreq-qcom-fix-qcom_cpufreq_hw_recalc_rate-to-quer.patch new file mode 100644 index 0000000000..c6fd54fd3a --- /dev/null +++ b/queue-6.12/cpufreq-qcom-fix-qcom_cpufreq_hw_recalc_rate-to-quer.patch @@ -0,0 +1,114 @@ +From 81d2d473618eefbf608abb234c2f88e09883b108 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 22:20:28 +0530 +Subject: cpufreq: qcom: Fix qcom_cpufreq_hw_recalc_rate() to query LUT if LMh + IRQ is not available + +From: Manivannan Sadhasivam + +[ Upstream commit 85d8b11351a8f15d6ec7a5e97909861cb3b6bcec ] + +Currently, qcom_cpufreq_hw_recalc_rate() returns the LMh throttled +frequency for the domain even if LMh IRQ is not available. But as per +qcom_cpufreq_hw_get(), the driver has to query LUT entries to get the +actual frequency of the domain. So do the same in +qcom_cpufreq_hw_recalc_rate(). + +While doing so, refactor the existing qcom_cpufreq_hw_get() function so +that qcom_cpufreq_hw_recalc_rate() can make use of the existing code and +avoid code duplication. This also requires setting the +qcom_cpufreq_data::policy even if LMh IRQ is not available. + +Fixes: 4370232c727b ("cpufreq: qcom-hw: Add CPU clock provider support") +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/qcom-cpufreq-hw.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/drivers/cpufreq/qcom-cpufreq-hw.c b/drivers/cpufreq/qcom-cpufreq-hw.c +index 900d6844c43d3..2d3f00d410207 100644 +--- a/drivers/cpufreq/qcom-cpufreq-hw.c ++++ b/drivers/cpufreq/qcom-cpufreq-hw.c +@@ -143,14 +143,12 @@ static unsigned long qcom_lmh_get_throttle_freq(struct qcom_cpufreq_data *data) + } + + /* Get the frequency requested by the cpufreq core for the CPU */ +-static unsigned int qcom_cpufreq_get_freq(unsigned int cpu) ++static unsigned int qcom_cpufreq_get_freq(struct cpufreq_policy *policy) + { + struct qcom_cpufreq_data *data; + const struct qcom_cpufreq_soc_data *soc_data; +- struct cpufreq_policy *policy; + unsigned int index; + +- policy = cpufreq_cpu_get_raw(cpu); + if (!policy) + return 0; + +@@ -163,12 +161,10 @@ static unsigned int qcom_cpufreq_get_freq(unsigned int cpu) + return policy->freq_table[index].frequency; + } + +-static unsigned int qcom_cpufreq_hw_get(unsigned int cpu) ++static unsigned int __qcom_cpufreq_hw_get(struct cpufreq_policy *policy) + { + struct qcom_cpufreq_data *data; +- struct cpufreq_policy *policy; + +- policy = cpufreq_cpu_get_raw(cpu); + if (!policy) + return 0; + +@@ -177,7 +173,12 @@ static unsigned int qcom_cpufreq_hw_get(unsigned int cpu) + if (data->throttle_irq >= 0) + return qcom_lmh_get_throttle_freq(data) / HZ_PER_KHZ; + +- return qcom_cpufreq_get_freq(cpu); ++ return qcom_cpufreq_get_freq(policy); ++} ++ ++static unsigned int qcom_cpufreq_hw_get(unsigned int cpu) ++{ ++ return __qcom_cpufreq_hw_get(cpufreq_cpu_get_raw(cpu)); + } + + static unsigned int qcom_cpufreq_hw_fast_switch(struct cpufreq_policy *policy, +@@ -363,7 +364,7 @@ static void qcom_lmh_dcvs_notify(struct qcom_cpufreq_data *data) + * If h/w throttled frequency is higher than what cpufreq has requested + * for, then stop polling and switch back to interrupt mechanism. + */ +- if (throttled_freq >= qcom_cpufreq_get_freq(cpu)) ++ if (throttled_freq >= qcom_cpufreq_get_freq(cpufreq_cpu_get_raw(cpu))) + enable_irq(data->throttle_irq); + else + mod_delayed_work(system_highpri_wq, &data->throttle_work, +@@ -441,7 +442,6 @@ static int qcom_cpufreq_hw_lmh_init(struct cpufreq_policy *policy, int index) + return data->throttle_irq; + + data->cancel_throttle = false; +- data->policy = policy; + + mutex_init(&data->throttle_lock); + INIT_DEFERRABLE_WORK(&data->throttle_work, qcom_lmh_dcvs_poll); +@@ -552,6 +552,7 @@ static int qcom_cpufreq_hw_cpu_init(struct cpufreq_policy *policy) + + policy->driver_data = data; + policy->dvfs_possible_from_any_cpu = true; ++ data->policy = policy; + + ret = qcom_cpufreq_hw_read_lut(cpu_dev, policy); + if (ret) { +@@ -622,7 +623,7 @@ static unsigned long qcom_cpufreq_hw_recalc_rate(struct clk_hw *hw, unsigned lon + { + struct qcom_cpufreq_data *data = container_of(hw, struct qcom_cpufreq_data, cpu_clk); + +- return qcom_lmh_get_throttle_freq(data); ++ return __qcom_cpufreq_hw_get(data->policy) * HZ_PER_KHZ; + } + + static const struct clk_ops qcom_cpufreq_hw_clk_ops = { +-- +2.39.5 + diff --git a/queue-6.12/cpufreq-qcom-implement-clk_ops-determine_rate-for-qc.patch b/queue-6.12/cpufreq-qcom-implement-clk_ops-determine_rate-for-qc.patch new file mode 100644 index 0000000000..bf27a86ba4 --- /dev/null +++ b/queue-6.12/cpufreq-qcom-implement-clk_ops-determine_rate-for-qc.patch @@ -0,0 +1,67 @@ +From 6509a6d634592546ceb18d7778c2e59940a2cbe2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 22:20:29 +0530 +Subject: cpufreq: qcom: Implement clk_ops::determine_rate() for qcom_cpufreq* + clocks + +From: Manivannan Sadhasivam + +[ Upstream commit a9ba290d0b829012574b6821ba08815046e60c94 ] + +determine_rate() callback is used by the clk_set_rate() API to get the +closest rate of the target rate supported by the clock. If this callback +is not implemented (nor round_rate() callback), then the API will assume +that the clock cannot set the requested rate. And since there is no parent, +it will return -EINVAL. + +This is not an issue right now as clk_set_rate() mistakenly compares the +target rate with cached rate and bails out early. But once that is fixed +to compare the target rate with the actual rate of the clock (returned by +recalc_rate()), then clk_set_rate() for this clock will start to fail as +below: + +cpu cpu0: _opp_config_clk_single: failed to set clock rate: -22 + +So implement the determine_rate() callback that just returns the actual +rate at which the clock is passed to the CPUs in a domain. + +Fixes: 4370232c727b ("cpufreq: qcom-hw: Add CPU clock provider support") +Reported-by: Johan Hovold +Suggested-by: Stephen Boyd +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Stephen Boyd +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/qcom-cpufreq-hw.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/cpufreq/qcom-cpufreq-hw.c b/drivers/cpufreq/qcom-cpufreq-hw.c +index 2d3f00d410207..e739978063839 100644 +--- a/drivers/cpufreq/qcom-cpufreq-hw.c ++++ b/drivers/cpufreq/qcom-cpufreq-hw.c +@@ -626,8 +626,21 @@ static unsigned long qcom_cpufreq_hw_recalc_rate(struct clk_hw *hw, unsigned lon + return __qcom_cpufreq_hw_get(data->policy) * HZ_PER_KHZ; + } + ++/* ++ * Since we cannot determine the closest rate of the target rate, let's just ++ * return the actual rate at which the clock is running at. This is needed to ++ * make clk_set_rate() API work properly. ++ */ ++static int qcom_cpufreq_hw_determine_rate(struct clk_hw *hw, struct clk_rate_request *req) ++{ ++ req->rate = qcom_cpufreq_hw_recalc_rate(hw, 0); ++ ++ return 0; ++} ++ + static const struct clk_ops qcom_cpufreq_hw_clk_ops = { + .recalc_rate = qcom_cpufreq_hw_recalc_rate, ++ .determine_rate = qcom_cpufreq_hw_determine_rate, + }; + + static int qcom_cpufreq_hw_driver_probe(struct platform_device *pdev) +-- +2.39.5 + diff --git a/queue-6.12/cpufreq-schedutil-fix-superfluous-updates-caused-by-.patch b/queue-6.12/cpufreq-schedutil-fix-superfluous-updates-caused-by-.patch new file mode 100644 index 0000000000..57a86a3b76 --- /dev/null +++ b/queue-6.12/cpufreq-schedutil-fix-superfluous-updates-caused-by-.patch @@ -0,0 +1,64 @@ +From 2f166d8e03efad7a64050d2969f28019b8eddb0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 17:57:32 -0800 +Subject: cpufreq: schedutil: Fix superfluous updates caused by + need_freq_update + +From: Sultan Alsawaf (unemployed) + +[ Upstream commit 8e461a1cb43d69d2fc8a97e61916dce571e6bb31 ] + +A redundant frequency update is only truly needed when there is a policy +limits change with a driver that specifies CPUFREQ_NEED_UPDATE_LIMITS. + +In spite of that, drivers specifying CPUFREQ_NEED_UPDATE_LIMITS receive a +frequency update _all the time_, not just for a policy limits change, +because need_freq_update is never cleared. + +Furthermore, ignore_dl_rate_limit()'s usage of need_freq_update also leads +to a redundant frequency update, regardless of whether or not the driver +specifies CPUFREQ_NEED_UPDATE_LIMITS, when the next chosen frequency is the +same as the current one. + +Fix the superfluous updates by only honoring CPUFREQ_NEED_UPDATE_LIMITS +when there's a policy limits change, and clearing need_freq_update when a +requisite redundant update occurs. + +This is neatly achieved by moving up the CPUFREQ_NEED_UPDATE_LIMITS test +and instead setting need_freq_update to false in sugov_update_next_freq(). + +Fixes: 600f5badb78c ("cpufreq: schedutil: Don't skip freq update when limits change") +Signed-off-by: Sultan Alsawaf (unemployed) +Reviewed-by: Christian Loehle +Link: https://patch.msgid.link/20241212015734.41241-2-sultan@kerneltoast.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + kernel/sched/cpufreq_schedutil.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c +index 28c77904ea749..e51d5ce730be1 100644 +--- a/kernel/sched/cpufreq_schedutil.c ++++ b/kernel/sched/cpufreq_schedutil.c +@@ -83,7 +83,7 @@ static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time) + + if (unlikely(sg_policy->limits_changed)) { + sg_policy->limits_changed = false; +- sg_policy->need_freq_update = true; ++ sg_policy->need_freq_update = cpufreq_driver_test_flags(CPUFREQ_NEED_UPDATE_LIMITS); + return true; + } + +@@ -96,7 +96,7 @@ static bool sugov_update_next_freq(struct sugov_policy *sg_policy, u64 time, + unsigned int next_freq) + { + if (sg_policy->need_freq_update) +- sg_policy->need_freq_update = cpufreq_driver_test_flags(CPUFREQ_NEED_UPDATE_LIMITS); ++ sg_policy->need_freq_update = false; + else if (sg_policy->next_freq == next_freq) + return false; + +-- +2.39.5 + diff --git a/queue-6.12/cpupower-fix-tsc-mhz-calculation.patch b/queue-6.12/cpupower-fix-tsc-mhz-calculation.patch new file mode 100644 index 0000000000..c1aceb7d35 --- /dev/null +++ b/queue-6.12/cpupower-fix-tsc-mhz-calculation.patch @@ -0,0 +1,114 @@ +From 05cebdb12413b984ce007ea17aee5d83f89b706e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Dec 2024 10:14:59 +0800 +Subject: cpupower: fix TSC MHz calculation + +From: He Rongguang + +[ Upstream commit 9d6c0e58514f8b57cd9c2c755e41623d6a966025 ] + +Commit 'cpupower: Make TSC read per CPU for Mperf monitor' (c2adb1877b7) +changes TSC counter reads per cpu, but left time diff global (from start +of all cpus to end of all cpus), thus diff(time) is too large for a +cpu's tsc counting, resulting in far less than acutal TSC_Mhz and thus +`cpupower monitor` showing far less than actual cpu realtime frequency. + +/proc/cpuinfo shows frequency: +cat /proc/cpuinfo | egrep -e 'processor' -e 'MHz' +... +processor : 171 +cpu MHz : 4108.498 +... + +before fix (System 100% busy): + | Mperf || Idle_Stats + CPU| C0 | Cx | Freq || POLL | C1 | C2 + 171| 0.77| 99.23| 2279|| 0.00| 0.00| 0.00 + +after fix (System 100% busy): + | Mperf || Idle_Stats + CPU| C0 | Cx | Freq || POLL | C1 | C2 + 171| 0.46| 99.54| 4095|| 0.00| 0.00| 0.00 + +Fixes: c2adb1877b76 ("cpupower: Make TSC read per CPU for Mperf monitor") +Signed-off-by: He Rongguang +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + .../cpupower/utils/idle_monitor/mperf_monitor.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c b/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c +index ae6af354a81db..08a399b0be286 100644 +--- a/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c ++++ b/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c +@@ -33,7 +33,7 @@ static int mperf_get_count_percent(unsigned int self_id, double *percent, + unsigned int cpu); + static int mperf_get_count_freq(unsigned int id, unsigned long long *count, + unsigned int cpu); +-static struct timespec time_start, time_end; ++static struct timespec *time_start, *time_end; + + static cstate_t mperf_cstates[MPERF_CSTATE_COUNT] = { + { +@@ -174,7 +174,7 @@ static int mperf_get_count_percent(unsigned int id, double *percent, + dprint("%s: TSC Ref - mperf_diff: %llu, tsc_diff: %llu\n", + mperf_cstates[id].name, mperf_diff, tsc_diff); + } else if (max_freq_mode == MAX_FREQ_SYSFS) { +- timediff = max_frequency * timespec_diff_us(time_start, time_end); ++ timediff = max_frequency * timespec_diff_us(time_start[cpu], time_end[cpu]); + *percent = 100.0 * mperf_diff / timediff; + dprint("%s: MAXFREQ - mperf_diff: %llu, time_diff: %llu\n", + mperf_cstates[id].name, mperf_diff, timediff); +@@ -207,7 +207,7 @@ static int mperf_get_count_freq(unsigned int id, unsigned long long *count, + if (max_freq_mode == MAX_FREQ_TSC_REF) { + /* Calculate max_freq from TSC count */ + tsc_diff = tsc_at_measure_end[cpu] - tsc_at_measure_start[cpu]; +- time_diff = timespec_diff_us(time_start, time_end); ++ time_diff = timespec_diff_us(time_start[cpu], time_end[cpu]); + max_frequency = tsc_diff / time_diff; + } + +@@ -226,9 +226,8 @@ static int mperf_start(void) + { + int cpu; + +- clock_gettime(CLOCK_REALTIME, &time_start); +- + for (cpu = 0; cpu < cpu_count; cpu++) { ++ clock_gettime(CLOCK_REALTIME, &time_start[cpu]); + mperf_get_tsc(&tsc_at_measure_start[cpu]); + mperf_init_stats(cpu); + } +@@ -243,9 +242,9 @@ static int mperf_stop(void) + for (cpu = 0; cpu < cpu_count; cpu++) { + mperf_measure_stats(cpu); + mperf_get_tsc(&tsc_at_measure_end[cpu]); ++ clock_gettime(CLOCK_REALTIME, &time_end[cpu]); + } + +- clock_gettime(CLOCK_REALTIME, &time_end); + return 0; + } + +@@ -349,6 +348,8 @@ struct cpuidle_monitor *mperf_register(void) + aperf_current_count = calloc(cpu_count, sizeof(unsigned long long)); + tsc_at_measure_start = calloc(cpu_count, sizeof(unsigned long long)); + tsc_at_measure_end = calloc(cpu_count, sizeof(unsigned long long)); ++ time_start = calloc(cpu_count, sizeof(struct timespec)); ++ time_end = calloc(cpu_count, sizeof(struct timespec)); + mperf_monitor.name_len = strlen(mperf_monitor.name); + return &mperf_monitor; + } +@@ -361,6 +362,8 @@ void mperf_unregister(void) + free(aperf_current_count); + free(tsc_at_measure_start); + free(tsc_at_measure_end); ++ free(time_start); ++ free(time_end); + free(is_valid); + } + +-- +2.39.5 + diff --git a/queue-6.12/crypto-api-fix-boot-up-self-test-race.patch b/queue-6.12/crypto-api-fix-boot-up-self-test-race.patch new file mode 100644 index 0000000000..fc4cfa5143 --- /dev/null +++ b/queue-6.12/crypto-api-fix-boot-up-self-test-race.patch @@ -0,0 +1,54 @@ +From bfd2469fae2efaef22bb94c8ec30f7e619a1bf53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Nov 2024 09:29:02 +0800 +Subject: crypto: api - Fix boot-up self-test race + +From: Herbert Xu + +[ Upstream commit 8dd458cbc5be9ce4427ffce7a9dcdbff4dfc4ac9 ] + +During the boot process self-tests are postponed so that all +algorithms are registered when the test starts. In the event +that algorithms are still being registered during these tests, +which can occur either because the algorithm is registered at +late_initcall, or because a self-test itself triggers the creation +of an instance, some self-tests may never start at all. + +Fix this by setting the flag at the start of crypto_start_tests. + +Note that this race is theoretical and has never been observed +in practice. + +Fixes: adad556efcdd ("crypto: api - Fix built-in testing dependency failures") +Signed-off-by: Herbert Xu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/algapi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/crypto/algapi.c b/crypto/algapi.c +index 004d27e41315f..c067412d909a1 100644 +--- a/crypto/algapi.c ++++ b/crypto/algapi.c +@@ -1022,6 +1022,8 @@ static void __init crypto_start_tests(void) + if (IS_ENABLED(CONFIG_CRYPTO_MANAGER_DISABLE_TESTS)) + return; + ++ set_crypto_boot_test_finished(); ++ + for (;;) { + struct crypto_larval *larval = NULL; + struct crypto_alg *q; +@@ -1053,8 +1055,6 @@ static void __init crypto_start_tests(void) + if (!larval) + break; + } +- +- set_crypto_boot_test_finished(); + } + + static int __init crypto_algapi_init(void) +-- +2.39.5 + diff --git a/queue-6.12/crypto-caam-use-jobr-s-space-to-access-page-0-regs.patch b/queue-6.12/crypto-caam-use-jobr-s-space-to-access-page-0-regs.patch new file mode 100644 index 0000000000..14e933399e --- /dev/null +++ b/queue-6.12/crypto-caam-use-jobr-s-space-to-access-page-0-regs.patch @@ -0,0 +1,50 @@ +From 4652e9b78048b21039db690978229f8ef8c83390 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Nov 2024 12:16:07 +0530 +Subject: crypto: caam - use JobR's space to access page 0 regs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Gaurav Jain + +[ Upstream commit 73a7496c218b7ca19ba276f54758e7f0adf269c5 ] + +On iMX8DXL/QM/QXP(SECO) & iMX8ULP(ELE) SoCs, access to controller +region(CAAM page 0) is not permitted from non secure world. +use JobR's register space to access page 0 registers. + +Fixes: 6a83830f649a ("crypto: caam - warn if blob_gen key is insecure") +Signed-off-by: Gaurav Jain +Reviewed-by: Ahmad Fatoum +Reviewed-by: Horia Geantă +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/caam/blob_gen.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/caam/blob_gen.c b/drivers/crypto/caam/blob_gen.c +index 87781c1534ee5..079a22cc9f02b 100644 +--- a/drivers/crypto/caam/blob_gen.c ++++ b/drivers/crypto/caam/blob_gen.c +@@ -2,6 +2,7 @@ + /* + * Copyright (C) 2015 Pengutronix, Steffen Trumtrar + * Copyright (C) 2021 Pengutronix, Ahmad Fatoum ++ * Copyright 2024 NXP + */ + + #define pr_fmt(fmt) "caam blob_gen: " fmt +@@ -104,7 +105,7 @@ int caam_process_blob(struct caam_blob_priv *priv, + } + + ctrlpriv = dev_get_drvdata(jrdev->parent); +- moo = FIELD_GET(CSTA_MOO, rd_reg32(&ctrlpriv->ctrl->perfmon.status)); ++ moo = FIELD_GET(CSTA_MOO, rd_reg32(&ctrlpriv->jr[0]->perfmon.status)); + if (moo != CSTA_MOO_SECURE && moo != CSTA_MOO_TRUSTED) + dev_warn(jrdev, + "using insecure test key, enable HAB to use unique device key!\n"); +-- +2.39.5 + diff --git a/queue-6.12/crypto-hisilicon-sec2-fix-for-aead-icv-error.patch b/queue-6.12/crypto-hisilicon-sec2-fix-for-aead-icv-error.patch new file mode 100644 index 0000000000..272e4f7b43 --- /dev/null +++ b/queue-6.12/crypto-hisilicon-sec2-fix-for-aead-icv-error.patch @@ -0,0 +1,320 @@ +From 4a934f396ebf07e85d7f7e1c063bf0e53978f717 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Dec 2024 17:13:34 +0800 +Subject: crypto: hisilicon/sec2 - fix for aead icv error + +From: Wenkai Lin + +[ Upstream commit fd337f852b2677b53d0859a47b58e6e6bd189f30 ] + +When the AEAD algorithm is used for encryption or decryption, +the input authentication length varies, the hardware needs to +obtain the input length to pass the integrity check verification. +Currently, the driver uses a fixed authentication length,which +causes decryption failure, so the length configuration is modified. +In addition, the step of setting the auth length is unnecessary, +so it was deleted from the setkey function. + +Fixes: 2f072d75d1ab ("crypto: hisilicon - Add aead support on SEC2") +Signed-off-by: Wenkai Lin +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/sec2/sec.h | 1 - + drivers/crypto/hisilicon/sec2/sec_crypto.c | 101 +++++++++------------ + drivers/crypto/hisilicon/sec2/sec_crypto.h | 11 --- + 3 files changed, 44 insertions(+), 69 deletions(-) + +diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h +index 410c83712e285..714bfd7c28752 100644 +--- a/drivers/crypto/hisilicon/sec2/sec.h ++++ b/drivers/crypto/hisilicon/sec2/sec.h +@@ -90,7 +90,6 @@ struct sec_auth_ctx { + dma_addr_t a_key_dma; + u8 *a_key; + u8 a_key_len; +- u8 mac_len; + u8 a_alg; + bool fallback; + struct crypto_shash *hash_tfm; +diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c +index 0558f98e221f6..72f5f33b28df9 100644 +--- a/drivers/crypto/hisilicon/sec2/sec_crypto.c ++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c +@@ -948,15 +948,14 @@ static int sec_aead_mac_init(struct sec_aead_req *req) + struct aead_request *aead_req = req->aead_req; + struct crypto_aead *tfm = crypto_aead_reqtfm(aead_req); + size_t authsize = crypto_aead_authsize(tfm); +- u8 *mac_out = req->out_mac; + struct scatterlist *sgl = aead_req->src; ++ u8 *mac_out = req->out_mac; + size_t copy_size; + off_t skip_size; + + /* Copy input mac */ + skip_size = aead_req->assoclen + aead_req->cryptlen - authsize; +- copy_size = sg_pcopy_to_buffer(sgl, sg_nents(sgl), mac_out, +- authsize, skip_size); ++ copy_size = sg_pcopy_to_buffer(sgl, sg_nents(sgl), mac_out, authsize, skip_size); + if (unlikely(copy_size != authsize)) + return -EINVAL; + +@@ -1139,7 +1138,6 @@ static int sec_aead_fallback_setkey(struct sec_auth_ctx *a_ctx, + static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, + const u32 keylen, const enum sec_hash_alg a_alg, + const enum sec_calg c_alg, +- const enum sec_mac_len mac_len, + const enum sec_cmode c_mode) + { + struct sec_ctx *ctx = crypto_aead_ctx(tfm); +@@ -1151,7 +1149,6 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, + + ctx->a_ctx.a_alg = a_alg; + ctx->c_ctx.c_alg = c_alg; +- ctx->a_ctx.mac_len = mac_len; + c_ctx->c_mode = c_mode; + + if (c_mode == SEC_CMODE_CCM || c_mode == SEC_CMODE_GCM) { +@@ -1187,10 +1184,9 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, + goto bad_key; + } + +- if ((ctx->a_ctx.mac_len & SEC_SQE_LEN_RATE_MASK) || +- (ctx->a_ctx.a_key_len & SEC_SQE_LEN_RATE_MASK)) { ++ if (ctx->a_ctx.a_key_len & SEC_SQE_LEN_RATE_MASK) { + ret = -EINVAL; +- dev_err(dev, "MAC or AUTH key length error!\n"); ++ dev_err(dev, "AUTH key length error!\n"); + goto bad_key; + } + +@@ -1202,27 +1198,19 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, + } + + +-#define GEN_SEC_AEAD_SETKEY_FUNC(name, aalg, calg, maclen, cmode) \ +-static int sec_setkey_##name(struct crypto_aead *tfm, const u8 *key, \ +- u32 keylen) \ +-{ \ +- return sec_aead_setkey(tfm, key, keylen, aalg, calg, maclen, cmode);\ +-} +- +-GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha1, SEC_A_HMAC_SHA1, +- SEC_CALG_AES, SEC_HMAC_SHA1_MAC, SEC_CMODE_CBC) +-GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha256, SEC_A_HMAC_SHA256, +- SEC_CALG_AES, SEC_HMAC_SHA256_MAC, SEC_CMODE_CBC) +-GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha512, SEC_A_HMAC_SHA512, +- SEC_CALG_AES, SEC_HMAC_SHA512_MAC, SEC_CMODE_CBC) +-GEN_SEC_AEAD_SETKEY_FUNC(aes_ccm, 0, SEC_CALG_AES, +- SEC_HMAC_CCM_MAC, SEC_CMODE_CCM) +-GEN_SEC_AEAD_SETKEY_FUNC(aes_gcm, 0, SEC_CALG_AES, +- SEC_HMAC_GCM_MAC, SEC_CMODE_GCM) +-GEN_SEC_AEAD_SETKEY_FUNC(sm4_ccm, 0, SEC_CALG_SM4, +- SEC_HMAC_CCM_MAC, SEC_CMODE_CCM) +-GEN_SEC_AEAD_SETKEY_FUNC(sm4_gcm, 0, SEC_CALG_SM4, +- SEC_HMAC_GCM_MAC, SEC_CMODE_GCM) ++#define GEN_SEC_AEAD_SETKEY_FUNC(name, aalg, calg, cmode) \ ++static int sec_setkey_##name(struct crypto_aead *tfm, const u8 *key, u32 keylen) \ ++{ \ ++ return sec_aead_setkey(tfm, key, keylen, aalg, calg, cmode); \ ++} ++ ++GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha1, SEC_A_HMAC_SHA1, SEC_CALG_AES, SEC_CMODE_CBC) ++GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha256, SEC_A_HMAC_SHA256, SEC_CALG_AES, SEC_CMODE_CBC) ++GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha512, SEC_A_HMAC_SHA512, SEC_CALG_AES, SEC_CMODE_CBC) ++GEN_SEC_AEAD_SETKEY_FUNC(aes_ccm, 0, SEC_CALG_AES, SEC_CMODE_CCM) ++GEN_SEC_AEAD_SETKEY_FUNC(aes_gcm, 0, SEC_CALG_AES, SEC_CMODE_GCM) ++GEN_SEC_AEAD_SETKEY_FUNC(sm4_ccm, 0, SEC_CALG_SM4, SEC_CMODE_CCM) ++GEN_SEC_AEAD_SETKEY_FUNC(sm4_gcm, 0, SEC_CALG_SM4, SEC_CMODE_GCM) + + static int sec_aead_sgl_map(struct sec_ctx *ctx, struct sec_req *req) + { +@@ -1470,9 +1458,10 @@ static void sec_skcipher_callback(struct sec_ctx *ctx, struct sec_req *req, + static void set_aead_auth_iv(struct sec_ctx *ctx, struct sec_req *req) + { + struct aead_request *aead_req = req->aead_req.aead_req; +- struct sec_cipher_req *c_req = &req->c_req; ++ struct crypto_aead *tfm = crypto_aead_reqtfm(aead_req); ++ size_t authsize = crypto_aead_authsize(tfm); + struct sec_aead_req *a_req = &req->aead_req; +- size_t authsize = ctx->a_ctx.mac_len; ++ struct sec_cipher_req *c_req = &req->c_req; + u32 data_size = aead_req->cryptlen; + u8 flage = 0; + u8 cm, cl; +@@ -1513,10 +1502,8 @@ static void set_aead_auth_iv(struct sec_ctx *ctx, struct sec_req *req) + static void sec_aead_set_iv(struct sec_ctx *ctx, struct sec_req *req) + { + struct aead_request *aead_req = req->aead_req.aead_req; +- struct crypto_aead *tfm = crypto_aead_reqtfm(aead_req); +- size_t authsize = crypto_aead_authsize(tfm); +- struct sec_cipher_req *c_req = &req->c_req; + struct sec_aead_req *a_req = &req->aead_req; ++ struct sec_cipher_req *c_req = &req->c_req; + + memcpy(c_req->c_ivin, aead_req->iv, ctx->c_ctx.ivsize); + +@@ -1524,15 +1511,11 @@ static void sec_aead_set_iv(struct sec_ctx *ctx, struct sec_req *req) + /* + * CCM 16Byte Cipher_IV: {1B_Flage,13B_IV,2B_counter}, + * the counter must set to 0x01 ++ * CCM 16Byte Auth_IV: {1B_AFlage,13B_IV,2B_Ptext_length} + */ +- ctx->a_ctx.mac_len = authsize; +- /* CCM 16Byte Auth_IV: {1B_AFlage,13B_IV,2B_Ptext_length} */ + set_aead_auth_iv(ctx, req); +- } +- +- /* GCM 12Byte Cipher_IV == Auth_IV */ +- if (ctx->c_ctx.c_mode == SEC_CMODE_GCM) { +- ctx->a_ctx.mac_len = authsize; ++ } else if (ctx->c_ctx.c_mode == SEC_CMODE_GCM) { ++ /* GCM 12Byte Cipher_IV == Auth_IV */ + memcpy(a_req->a_ivin, c_req->c_ivin, SEC_AIV_SIZE); + } + } +@@ -1542,9 +1525,11 @@ static void sec_auth_bd_fill_xcm(struct sec_auth_ctx *ctx, int dir, + { + struct sec_aead_req *a_req = &req->aead_req; + struct aead_request *aq = a_req->aead_req; ++ struct crypto_aead *tfm = crypto_aead_reqtfm(aq); ++ size_t authsize = crypto_aead_authsize(tfm); + + /* C_ICV_Len is MAC size, 0x4 ~ 0x10 */ +- sec_sqe->type2.icvw_kmode |= cpu_to_le16((u16)ctx->mac_len); ++ sec_sqe->type2.icvw_kmode |= cpu_to_le16((u16)authsize); + + /* mode set to CCM/GCM, don't set {A_Alg, AKey_Len, MAC_Len} */ + sec_sqe->type2.a_key_addr = sec_sqe->type2.c_key_addr; +@@ -1568,9 +1553,11 @@ static void sec_auth_bd_fill_xcm_v3(struct sec_auth_ctx *ctx, int dir, + { + struct sec_aead_req *a_req = &req->aead_req; + struct aead_request *aq = a_req->aead_req; ++ struct crypto_aead *tfm = crypto_aead_reqtfm(aq); ++ size_t authsize = crypto_aead_authsize(tfm); + + /* C_ICV_Len is MAC size, 0x4 ~ 0x10 */ +- sqe3->c_icv_key |= cpu_to_le16((u16)ctx->mac_len << SEC_MAC_OFFSET_V3); ++ sqe3->c_icv_key |= cpu_to_le16((u16)authsize << SEC_MAC_OFFSET_V3); + + /* mode set to CCM/GCM, don't set {A_Alg, AKey_Len, MAC_Len} */ + sqe3->a_key_addr = sqe3->c_key_addr; +@@ -1594,11 +1581,12 @@ static void sec_auth_bd_fill_ex(struct sec_auth_ctx *ctx, int dir, + struct sec_aead_req *a_req = &req->aead_req; + struct sec_cipher_req *c_req = &req->c_req; + struct aead_request *aq = a_req->aead_req; ++ struct crypto_aead *tfm = crypto_aead_reqtfm(aq); ++ size_t authsize = crypto_aead_authsize(tfm); + + sec_sqe->type2.a_key_addr = cpu_to_le64(ctx->a_key_dma); + +- sec_sqe->type2.mac_key_alg = +- cpu_to_le32(ctx->mac_len / SEC_SQE_LEN_RATE); ++ sec_sqe->type2.mac_key_alg = cpu_to_le32(authsize / SEC_SQE_LEN_RATE); + + sec_sqe->type2.mac_key_alg |= + cpu_to_le32((u32)((ctx->a_key_len) / +@@ -1648,11 +1636,13 @@ static void sec_auth_bd_fill_ex_v3(struct sec_auth_ctx *ctx, int dir, + struct sec_aead_req *a_req = &req->aead_req; + struct sec_cipher_req *c_req = &req->c_req; + struct aead_request *aq = a_req->aead_req; ++ struct crypto_aead *tfm = crypto_aead_reqtfm(aq); ++ size_t authsize = crypto_aead_authsize(tfm); + + sqe3->a_key_addr = cpu_to_le64(ctx->a_key_dma); + + sqe3->auth_mac_key |= +- cpu_to_le32((u32)(ctx->mac_len / ++ cpu_to_le32((u32)(authsize / + SEC_SQE_LEN_RATE) << SEC_MAC_OFFSET_V3); + + sqe3->auth_mac_key |= +@@ -1703,9 +1693,9 @@ static void sec_aead_callback(struct sec_ctx *c, struct sec_req *req, int err) + { + struct aead_request *a_req = req->aead_req.aead_req; + struct crypto_aead *tfm = crypto_aead_reqtfm(a_req); ++ size_t authsize = crypto_aead_authsize(tfm); + struct sec_aead_req *aead_req = &req->aead_req; + struct sec_cipher_req *c_req = &req->c_req; +- size_t authsize = crypto_aead_authsize(tfm); + struct sec_qp_ctx *qp_ctx = req->qp_ctx; + struct aead_request *backlog_aead_req; + struct sec_req *backlog_req; +@@ -1718,10 +1708,8 @@ static void sec_aead_callback(struct sec_ctx *c, struct sec_req *req, int err) + if (!err && c_req->encrypt) { + struct scatterlist *sgl = a_req->dst; + +- sz = sg_pcopy_from_buffer(sgl, sg_nents(sgl), +- aead_req->out_mac, +- authsize, a_req->cryptlen + +- a_req->assoclen); ++ sz = sg_pcopy_from_buffer(sgl, sg_nents(sgl), aead_req->out_mac, ++ authsize, a_req->cryptlen + a_req->assoclen); + if (unlikely(sz != authsize)) { + dev_err(c->dev, "copy out mac err!\n"); + err = -EINVAL; +@@ -2233,7 +2221,7 @@ static int sec_aead_spec_check(struct sec_ctx *ctx, struct sec_req *sreq) + { + struct aead_request *req = sreq->aead_req.aead_req; + struct crypto_aead *tfm = crypto_aead_reqtfm(req); +- size_t authsize = crypto_aead_authsize(tfm); ++ size_t sz = crypto_aead_authsize(tfm); + u8 c_mode = ctx->c_ctx.c_mode; + struct device *dev = ctx->dev; + int ret; +@@ -2244,9 +2232,8 @@ static int sec_aead_spec_check(struct sec_ctx *ctx, struct sec_req *sreq) + return -EINVAL; + } + +- if (unlikely((c_mode == SEC_CMODE_GCM && authsize < DES_BLOCK_SIZE) || +- (c_mode == SEC_CMODE_CCM && (authsize < MIN_MAC_LEN || +- authsize & MAC_LEN_MASK)))) { ++ if (unlikely((c_mode == SEC_CMODE_GCM && sz < DES_BLOCK_SIZE) || ++ (c_mode == SEC_CMODE_CCM && (sz < MIN_MAC_LEN || sz & MAC_LEN_MASK)))) { + dev_err(dev, "aead input mac length error!\n"); + return -EINVAL; + } +@@ -2266,7 +2253,7 @@ static int sec_aead_spec_check(struct sec_ctx *ctx, struct sec_req *sreq) + if (sreq->c_req.encrypt) + sreq->c_req.c_len = req->cryptlen; + else +- sreq->c_req.c_len = req->cryptlen - authsize; ++ sreq->c_req.c_len = req->cryptlen - sz; + if (c_mode == SEC_CMODE_CBC) { + if (unlikely(sreq->c_req.c_len & (AES_BLOCK_SIZE - 1))) { + dev_err(dev, "aead crypto length error!\n"); +@@ -2292,7 +2279,7 @@ static int sec_aead_param_check(struct sec_ctx *ctx, struct sec_req *sreq) + + if (ctx->sec->qm.ver == QM_HW_V2) { + if (unlikely(!req->cryptlen || (!sreq->c_req.encrypt && +- req->cryptlen <= authsize))) { ++ req->cryptlen <= authsize))) { + ctx->a_ctx.fallback = true; + return -EINVAL; + } +diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.h b/drivers/crypto/hisilicon/sec2/sec_crypto.h +index 27a0ee5ad9131..04725b514382f 100644 +--- a/drivers/crypto/hisilicon/sec2/sec_crypto.h ++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.h +@@ -23,17 +23,6 @@ enum sec_hash_alg { + SEC_A_HMAC_SHA512 = 0x15, + }; + +-enum sec_mac_len { +- SEC_HMAC_CCM_MAC = 16, +- SEC_HMAC_GCM_MAC = 16, +- SEC_SM3_MAC = 32, +- SEC_HMAC_SM3_MAC = 32, +- SEC_HMAC_MD5_MAC = 16, +- SEC_HMAC_SHA1_MAC = 20, +- SEC_HMAC_SHA256_MAC = 32, +- SEC_HMAC_SHA512_MAC = 64, +-}; +- + enum sec_cmode { + SEC_CMODE_ECB = 0x0, + SEC_CMODE_CBC = 0x1, +-- +2.39.5 + diff --git a/queue-6.12/crypto-hisilicon-sec2-fix-for-aead-invalid-authsize.patch b/queue-6.12/crypto-hisilicon-sec2-fix-for-aead-invalid-authsize.patch new file mode 100644 index 0000000000..8185cc115d --- /dev/null +++ b/queue-6.12/crypto-hisilicon-sec2-fix-for-aead-invalid-authsize.patch @@ -0,0 +1,205 @@ +From c101114d97ae053b167ca4efd924dabf86e27547 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Dec 2024 17:13:35 +0800 +Subject: crypto: hisilicon/sec2 - fix for aead invalid authsize + +From: Wenkai Lin + +[ Upstream commit a5a9d959936499a3106a1bf3b9070875d0d3dec4 ] + +When the digest alg is HMAC-SHAx or another, the authsize may be less +than 4 bytes and mac_len of the BD is set to zero, the hardware considers +it a BD configuration error and reports a ras error, so the sec driver +needs to switch to software calculation in this case, this patch add a +check for it and remove unnecessary check that has been done by crypto. + +Fixes: 2f072d75d1ab ("crypto: hisilicon - Add aead support on SEC2") +Signed-off-by: Wenkai Lin +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/sec2/sec.h | 2 +- + drivers/crypto/hisilicon/sec2/sec_crypto.c | 64 +++++++++++----------- + 2 files changed, 34 insertions(+), 32 deletions(-) + +diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h +index 714bfd7c28752..30c2b1a64695c 100644 +--- a/drivers/crypto/hisilicon/sec2/sec.h ++++ b/drivers/crypto/hisilicon/sec2/sec.h +@@ -37,6 +37,7 @@ struct sec_aead_req { + u8 *a_ivin; + dma_addr_t a_ivin_dma; + struct aead_request *aead_req; ++ bool fallback; + }; + + /* SEC request of Crypto */ +@@ -91,7 +92,6 @@ struct sec_auth_ctx { + u8 *a_key; + u8 a_key_len; + u8 a_alg; +- bool fallback; + struct crypto_shash *hash_tfm; + struct crypto_aead *fallback_aead_tfm; + }; +diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c +index 72f5f33b28df9..a9b1b9b0b03bf 100644 +--- a/drivers/crypto/hisilicon/sec2/sec_crypto.c ++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c +@@ -1119,10 +1119,7 @@ static int sec_aead_setauthsize(struct crypto_aead *aead, unsigned int authsize) + struct sec_ctx *ctx = crypto_tfm_ctx(tfm); + struct sec_auth_ctx *a_ctx = &ctx->a_ctx; + +- if (unlikely(a_ctx->fallback_aead_tfm)) +- return crypto_aead_setauthsize(a_ctx->fallback_aead_tfm, authsize); +- +- return 0; ++ return crypto_aead_setauthsize(a_ctx->fallback_aead_tfm, authsize); + } + + static int sec_aead_fallback_setkey(struct sec_auth_ctx *a_ctx, +@@ -1159,13 +1156,7 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, + } + memcpy(c_ctx->c_key, key, keylen); + +- if (unlikely(a_ctx->fallback_aead_tfm)) { +- ret = sec_aead_fallback_setkey(a_ctx, tfm, key, keylen); +- if (ret) +- return ret; +- } +- +- return 0; ++ return sec_aead_fallback_setkey(a_ctx, tfm, key, keylen); + } + + ret = crypto_authenc_extractkeys(&keys, key, keylen); +@@ -1190,6 +1181,12 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, + goto bad_key; + } + ++ ret = sec_aead_fallback_setkey(a_ctx, tfm, key, keylen); ++ if (ret) { ++ dev_err(dev, "set sec fallback key err!\n"); ++ goto bad_key; ++ } ++ + return 0; + + bad_key: +@@ -1917,8 +1914,10 @@ static void sec_aead_exit(struct crypto_aead *tfm) + + static int sec_aead_ctx_init(struct crypto_aead *tfm, const char *hash_name) + { ++ struct aead_alg *alg = crypto_aead_alg(tfm); + struct sec_ctx *ctx = crypto_aead_ctx(tfm); +- struct sec_auth_ctx *auth_ctx = &ctx->a_ctx; ++ struct sec_auth_ctx *a_ctx = &ctx->a_ctx; ++ const char *aead_name = alg->base.cra_name; + int ret; + + ret = sec_aead_init(tfm); +@@ -1927,11 +1926,20 @@ static int sec_aead_ctx_init(struct crypto_aead *tfm, const char *hash_name) + return ret; + } + +- auth_ctx->hash_tfm = crypto_alloc_shash(hash_name, 0, 0); +- if (IS_ERR(auth_ctx->hash_tfm)) { ++ a_ctx->hash_tfm = crypto_alloc_shash(hash_name, 0, 0); ++ if (IS_ERR(a_ctx->hash_tfm)) { + dev_err(ctx->dev, "aead alloc shash error!\n"); + sec_aead_exit(tfm); +- return PTR_ERR(auth_ctx->hash_tfm); ++ return PTR_ERR(a_ctx->hash_tfm); ++ } ++ ++ a_ctx->fallback_aead_tfm = crypto_alloc_aead(aead_name, 0, ++ CRYPTO_ALG_NEED_FALLBACK | CRYPTO_ALG_ASYNC); ++ if (IS_ERR(a_ctx->fallback_aead_tfm)) { ++ dev_err(ctx->dev, "aead driver alloc fallback tfm error!\n"); ++ crypto_free_shash(ctx->a_ctx.hash_tfm); ++ sec_aead_exit(tfm); ++ return PTR_ERR(a_ctx->fallback_aead_tfm); + } + + return 0; +@@ -1941,6 +1949,7 @@ static void sec_aead_ctx_exit(struct crypto_aead *tfm) + { + struct sec_ctx *ctx = crypto_aead_ctx(tfm); + ++ crypto_free_aead(ctx->a_ctx.fallback_aead_tfm); + crypto_free_shash(ctx->a_ctx.hash_tfm); + sec_aead_exit(tfm); + } +@@ -1967,7 +1976,6 @@ static int sec_aead_xcm_ctx_init(struct crypto_aead *tfm) + sec_aead_exit(tfm); + return PTR_ERR(a_ctx->fallback_aead_tfm); + } +- a_ctx->fallback = false; + + return 0; + } +@@ -2226,15 +2234,15 @@ static int sec_aead_spec_check(struct sec_ctx *ctx, struct sec_req *sreq) + struct device *dev = ctx->dev; + int ret; + +- if (unlikely(req->cryptlen + req->assoclen > MAX_INPUT_DATA_LEN || +- req->assoclen > SEC_MAX_AAD_LEN)) { +- dev_err(dev, "aead input spec error!\n"); ++ /* Hardware does not handle cases where authsize is less than 4 bytes */ ++ if (unlikely(sz < MIN_MAC_LEN)) { ++ sreq->aead_req.fallback = true; + return -EINVAL; + } + +- if (unlikely((c_mode == SEC_CMODE_GCM && sz < DES_BLOCK_SIZE) || +- (c_mode == SEC_CMODE_CCM && (sz < MIN_MAC_LEN || sz & MAC_LEN_MASK)))) { +- dev_err(dev, "aead input mac length error!\n"); ++ if (unlikely(req->cryptlen + req->assoclen > MAX_INPUT_DATA_LEN || ++ req->assoclen > SEC_MAX_AAD_LEN)) { ++ dev_err(dev, "aead input spec error!\n"); + return -EINVAL; + } + +@@ -2280,7 +2288,7 @@ static int sec_aead_param_check(struct sec_ctx *ctx, struct sec_req *sreq) + if (ctx->sec->qm.ver == QM_HW_V2) { + if (unlikely(!req->cryptlen || (!sreq->c_req.encrypt && + req->cryptlen <= authsize))) { +- ctx->a_ctx.fallback = true; ++ sreq->aead_req.fallback = true; + return -EINVAL; + } + } +@@ -2308,16 +2316,9 @@ static int sec_aead_soft_crypto(struct sec_ctx *ctx, + bool encrypt) + { + struct sec_auth_ctx *a_ctx = &ctx->a_ctx; +- struct device *dev = ctx->dev; + struct aead_request *subreq; + int ret; + +- /* Kunpeng920 aead mode not support input 0 size */ +- if (!a_ctx->fallback_aead_tfm) { +- dev_err(dev, "aead fallback tfm is NULL!\n"); +- return -EINVAL; +- } +- + subreq = aead_request_alloc(a_ctx->fallback_aead_tfm, GFP_KERNEL); + if (!subreq) + return -ENOMEM; +@@ -2349,10 +2350,11 @@ static int sec_aead_crypto(struct aead_request *a_req, bool encrypt) + req->aead_req.aead_req = a_req; + req->c_req.encrypt = encrypt; + req->ctx = ctx; ++ req->aead_req.fallback = false; + + ret = sec_aead_param_check(ctx, req); + if (unlikely(ret)) { +- if (ctx->a_ctx.fallback) ++ if (req->aead_req.fallback) + return sec_aead_soft_crypto(ctx, a_req, encrypt); + return -EINVAL; + } +-- +2.39.5 + diff --git a/queue-6.12/crypto-iaa-fix-iaa-disabling-that-occurs-when-sync_m.patch b/queue-6.12/crypto-iaa-fix-iaa-disabling-that-occurs-when-sync_m.patch new file mode 100644 index 0000000000..752ca15ff7 --- /dev/null +++ b/queue-6.12/crypto-iaa-fix-iaa-disabling-that-occurs-when-sync_m.patch @@ -0,0 +1,134 @@ +From 90100f2fa043488cdf2234f71cc2d7b0ee6dfee7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Dec 2024 14:07:07 -0800 +Subject: crypto: iaa - Fix IAA disabling that occurs when sync_mode is set to + 'async' + +From: Kanchana P Sridhar + +[ Upstream commit 4ebd9a5ca478673cfbb38795cc5b3adb4f35fe04 ] + +With the latest mm-unstable, setting the iaa_crypto sync_mode to 'async' +causes crypto testmgr.c test_acomp() failure and dmesg call traces, and +zswap being unable to use 'deflate-iaa' as a compressor: + +echo async > /sys/bus/dsa/drivers/crypto/sync_mode + +[ 255.271030] zswap: compressor deflate-iaa not available +[ 369.960673] INFO: task cryptomgr_test:4889 blocked for more than 122 seconds. +[ 369.970127] Not tainted 6.13.0-rc1-mm-unstable-12-16-2024+ #324 +[ 369.977411] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 369.986246] task:cryptomgr_test state:D stack:0 pid:4889 tgid:4889 ppid:2 flags:0x00004000 +[ 369.986253] Call Trace: +[ 369.986256] +[ 369.986260] __schedule+0x45c/0xfa0 +[ 369.986273] schedule+0x2e/0xb0 +[ 369.986277] schedule_timeout+0xe7/0x100 +[ 369.986284] ? __prepare_to_swait+0x4e/0x70 +[ 369.986290] wait_for_completion+0x8d/0x120 +[ 369.986293] test_acomp+0x284/0x670 +[ 369.986305] ? __pfx_cryptomgr_test+0x10/0x10 +[ 369.986312] alg_test_comp+0x263/0x440 +[ 369.986315] ? sched_balance_newidle+0x259/0x430 +[ 369.986320] ? __pfx_cryptomgr_test+0x10/0x10 +[ 369.986323] alg_test.part.27+0x103/0x410 +[ 369.986326] ? __schedule+0x464/0xfa0 +[ 369.986330] ? __pfx_cryptomgr_test+0x10/0x10 +[ 369.986333] cryptomgr_test+0x20/0x40 +[ 369.986336] kthread+0xda/0x110 +[ 369.986344] ? __pfx_kthread+0x10/0x10 +[ 369.986346] ret_from_fork+0x2d/0x40 +[ 369.986355] ? __pfx_kthread+0x10/0x10 +[ 369.986358] ret_from_fork_asm+0x1a/0x30 +[ 369.986365] + +This happens because the only async polling without interrupts that +iaa_crypto currently implements is with the 'sync' mode. With 'async', +iaa_crypto calls to compress/decompress submit the descriptor and return +-EINPROGRESS, without any mechanism in the driver to poll for +completions. Hence callers such as test_acomp() in crypto/testmgr.c or +zswap, that wrap the calls to crypto_acomp_compress() and +crypto_acomp_decompress() in synchronous wrappers, will block +indefinitely. Even before zswap can notice this problem, the crypto +testmgr.c's test_acomp() will fail and prevent registration of +"deflate-iaa" as a valid crypto acomp algorithm, thereby disallowing the +use of "deflate-iaa" as a zswap compress (zswap will fall-back to the +default compressor in this case). + +To fix this issue, this patch modifies the iaa_crypto sync_mode set +function to treat 'async' equivalent to 'sync', so that the correct and +only supported driver async polling without interrupts implementation is +enabled, and zswap can use 'deflate-iaa' as the compressor. + +Hence, with this patch, this is what will happen: + +echo async > /sys/bus/dsa/drivers/crypto/sync_mode +cat /sys/bus/dsa/drivers/crypto/sync_mode +sync + +There are no crypto/testmgr.c test_acomp() errors, no call traces and zswap +can use 'deflate-iaa' without any errors. The iaa_crypto documentation has +also been updated to mention this caveat with 'async' and what to expect +with this fix. + +True iaa_crypto async polling without interrupts is enabled in patch +"crypto: iaa - Implement batch_compress(), batch_decompress() API in +iaa_crypto." [1] which is under review as part of the "zswap IAA compress +batching" patch-series [2]. Until this is merged, we would appreciate it if +this current patch can be considered for a hotfix. + +[1]: https://patchwork.kernel.org/project/linux-mm/patch/20241221063119.29140-5-kanchana.p.sridhar@intel.com/ +[2]: https://patchwork.kernel.org/project/linux-mm/list/?series=920084 + +Fixes: 09646c98d ("crypto: iaa - Add irq support for the crypto async interface") +Signed-off-by: Kanchana P Sridhar +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + Documentation/driver-api/crypto/iaa/iaa-crypto.rst | 9 ++++++++- + drivers/crypto/intel/iaa/iaa_crypto_main.c | 2 +- + 2 files changed, 9 insertions(+), 2 deletions(-) + +diff --git a/Documentation/driver-api/crypto/iaa/iaa-crypto.rst b/Documentation/driver-api/crypto/iaa/iaa-crypto.rst +index bba40158dd5c5..8e50b900d51c2 100644 +--- a/Documentation/driver-api/crypto/iaa/iaa-crypto.rst ++++ b/Documentation/driver-api/crypto/iaa/iaa-crypto.rst +@@ -272,7 +272,7 @@ The available attributes are: + echo async_irq > /sys/bus/dsa/drivers/crypto/sync_mode + + Async mode without interrupts (caller must poll) can be enabled by +- writing 'async' to it:: ++ writing 'async' to it (please see Caveat):: + + echo async > /sys/bus/dsa/drivers/crypto/sync_mode + +@@ -283,6 +283,13 @@ The available attributes are: + + The default mode is 'sync'. + ++ Caveat: since the only mechanism that iaa_crypto currently implements ++ for async polling without interrupts is via the 'sync' mode as ++ described earlier, writing 'async' to ++ '/sys/bus/dsa/drivers/crypto/sync_mode' will internally enable the ++ 'sync' mode. This is to ensure correct iaa_crypto behavior until true ++ async polling without interrupts is enabled in iaa_crypto. ++ + .. _iaa_default_config: + + IAA Default Configuration +diff --git a/drivers/crypto/intel/iaa/iaa_crypto_main.c b/drivers/crypto/intel/iaa/iaa_crypto_main.c +index 237f870000702..d2f07e34f3142 100644 +--- a/drivers/crypto/intel/iaa/iaa_crypto_main.c ++++ b/drivers/crypto/intel/iaa/iaa_crypto_main.c +@@ -173,7 +173,7 @@ static int set_iaa_sync_mode(const char *name) + async_mode = false; + use_irq = false; + } else if (sysfs_streq(name, "async")) { +- async_mode = true; ++ async_mode = false; + use_irq = false; + } else if (sysfs_streq(name, "async_irq")) { + async_mode = true; +-- +2.39.5 + diff --git a/queue-6.12/crypto-ixp4xx-fix-of-node-reference-leaks-in-init_ix.patch b/queue-6.12/crypto-ixp4xx-fix-of-node-reference-leaks-in-init_ix.patch new file mode 100644 index 0000000000..619b219877 --- /dev/null +++ b/queue-6.12/crypto-ixp4xx-fix-of-node-reference-leaks-in-init_ix.patch @@ -0,0 +1,55 @@ +From 34a57d90699e574f3c307da042bfb80facf25bd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Dec 2024 16:27:20 +0900 +Subject: crypto: ixp4xx - fix OF node reference leaks in init_ixp_crypto() + +From: Joe Hattori + +[ Upstream commit 472a989029aac2b78ef2f0b18b27c568bf76d104 ] + +init_ixp_crypto() calls of_parse_phandle_with_fixed_args() multiple +times, but does not release all the obtained refcounts. Fix it by adding +of_node_put() calls. + +This bug was found by an experimental static analysis tool that I am +developing. + +Fixes: 76f24b4f46b8 ("crypto: ixp4xx - Add device tree support") +Signed-off-by: Joe Hattori +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c b/drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c +index f8a77bff88448..e43361392c83f 100644 +--- a/drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c ++++ b/drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c +@@ -471,6 +471,7 @@ static int init_ixp_crypto(struct device *dev) + return -ENODEV; + } + npe_id = npe_spec.args[0]; ++ of_node_put(npe_spec.np); + + ret = of_parse_phandle_with_fixed_args(np, "queue-rx", 1, 0, + &queue_spec); +@@ -479,6 +480,7 @@ static int init_ixp_crypto(struct device *dev) + return -ENODEV; + } + recv_qid = queue_spec.args[0]; ++ of_node_put(queue_spec.np); + + ret = of_parse_phandle_with_fixed_args(np, "queue-txready", 1, 0, + &queue_spec); +@@ -487,6 +489,7 @@ static int init_ixp_crypto(struct device *dev) + return -ENODEV; + } + send_qid = queue_spec.args[0]; ++ of_node_put(queue_spec.np); + } else { + /* + * Hardcoded engine when using platform data, this goes away +-- +2.39.5 + diff --git a/queue-6.12/crypto-tegra-do-not-transfer-req-when-tegra-init-fai.patch b/queue-6.12/crypto-tegra-do-not-transfer-req-when-tegra-init-fai.patch new file mode 100644 index 0000000000..35b2aef836 --- /dev/null +++ b/queue-6.12/crypto-tegra-do-not-transfer-req-when-tegra-init-fai.patch @@ -0,0 +1,70 @@ +From 7bf8d8a48df399fb50e07960642685b04cce7c79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Nov 2024 01:28:27 +0000 +Subject: crypto: tegra - do not transfer req when tegra init fails + +From: Chen Ridong + +[ Upstream commit 15589bda46830695a3261518bb7627afac61f519 ] + +The tegra_cmac_init or tegra_sha_init function may return an error when +memory is exhausted. It should not transfer the request when they return +an error. + +Fixes: 0880bb3b00c8 ("crypto: tegra - Add Tegra Security Engine driver") +Signed-off-by: Chen Ridong +Acked-by: Akhil R +Acked-by: Thierry Reding +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/tegra/tegra-se-aes.c | 7 +++++-- + drivers/crypto/tegra/tegra-se-hash.c | 7 +++++-- + 2 files changed, 10 insertions(+), 4 deletions(-) + +diff --git a/drivers/crypto/tegra/tegra-se-aes.c b/drivers/crypto/tegra/tegra-se-aes.c +index ae7a0f8435fc6..3106fd1e84b91 100644 +--- a/drivers/crypto/tegra/tegra-se-aes.c ++++ b/drivers/crypto/tegra/tegra-se-aes.c +@@ -1752,10 +1752,13 @@ static int tegra_cmac_digest(struct ahash_request *req) + struct crypto_ahash *tfm = crypto_ahash_reqtfm(req); + struct tegra_cmac_ctx *ctx = crypto_ahash_ctx(tfm); + struct tegra_cmac_reqctx *rctx = ahash_request_ctx(req); ++ int ret; + +- tegra_cmac_init(req); +- rctx->task |= SHA_UPDATE | SHA_FINAL; ++ ret = tegra_cmac_init(req); ++ if (ret) ++ return ret; + ++ rctx->task |= SHA_UPDATE | SHA_FINAL; + return crypto_transfer_hash_request_to_engine(ctx->se->engine, req); + } + +diff --git a/drivers/crypto/tegra/tegra-se-hash.c b/drivers/crypto/tegra/tegra-se-hash.c +index 4d4bd727f4986..0b5cdd5676b17 100644 +--- a/drivers/crypto/tegra/tegra-se-hash.c ++++ b/drivers/crypto/tegra/tegra-se-hash.c +@@ -615,13 +615,16 @@ static int tegra_sha_digest(struct ahash_request *req) + struct tegra_sha_reqctx *rctx = ahash_request_ctx(req); + struct crypto_ahash *tfm = crypto_ahash_reqtfm(req); + struct tegra_sha_ctx *ctx = crypto_ahash_ctx(tfm); ++ int ret; + + if (ctx->fallback) + return tegra_sha_fallback_digest(req); + +- tegra_sha_init(req); +- rctx->task |= SHA_UPDATE | SHA_FINAL; ++ ret = tegra_sha_init(req); ++ if (ret) ++ return ret; + ++ rctx->task |= SHA_UPDATE | SHA_FINAL; + return crypto_transfer_hash_request_to_engine(ctx->se->engine, req); + } + +-- +2.39.5 + diff --git a/queue-6.12/dev-acquire-netdev_rename_lock-before-restoring-dev-.patch b/queue-6.12/dev-acquire-netdev_rename_lock-before-restoring-dev-.patch new file mode 100644 index 0000000000..e6239a3ce8 --- /dev/null +++ b/queue-6.12/dev-acquire-netdev_rename_lock-before-restoring-dev-.patch @@ -0,0 +1,42 @@ +From 23f5d93e720a38330e55ee817da62832613bdee7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 18:55:43 +0900 +Subject: dev: Acquire netdev_rename_lock before restoring dev->name in + dev_change_name(). + +From: Kuniyuki Iwashima + +[ Upstream commit e361560a7912958ba3059f51e7dd21612d119169 ] + +The cited commit forgot to add netdev_rename_lock in one of the +error paths in dev_change_name(). + +Let's hold netdev_rename_lock before restoring the old dev->name. + +Fixes: 0840556e5a3a ("net: Protect dev->name by seqlock.") +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20250115095545.52709-2-kuniyu@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/dev.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/core/dev.c b/net/core/dev.c +index 1867a6a8d76da..9bdb8fe5ffaa5 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -1279,7 +1279,9 @@ int dev_change_name(struct net_device *dev, const char *newname) + rollback: + ret = device_rename(&dev->dev, dev->name); + if (ret) { ++ write_seqlock_bh(&netdev_rename_lock); + memcpy(dev->name, oldname, IFNAMSIZ); ++ write_sequnlock_bh(&netdev_rename_lock); + WRITE_ONCE(dev->name_assign_type, old_assign_type); + up_write(&devnet_rename_sem); + return ret; +-- +2.39.5 + diff --git a/queue-6.12/dlm-fix-removal-of-rsb-struct-that-is-master-and-dir.patch b/queue-6.12/dlm-fix-removal-of-rsb-struct-that-is-master-and-dir.patch new file mode 100644 index 0000000000..b2680f2072 --- /dev/null +++ b/queue-6.12/dlm-fix-removal-of-rsb-struct-that-is-master-and-dir.patch @@ -0,0 +1,109 @@ +From dda512b60afa9dac6aa902743a3a3810609647ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Nov 2024 15:56:44 -0500 +Subject: dlm: fix removal of rsb struct that is master and dir record + +From: Alexander Aring + +[ Upstream commit 134129520beaf3339482c557361ea0bde709cf36 ] + +An rsb struct was not being removed in the case where it +was both the master and the dir record. This case (master +and dir node) was missed in the condition for doing add_scan() +from deactivate_rsb(). Fixing this triggers a related WARN_ON +that needs to be fixed, and requires adjusting where two +del_scan() calls are made. + +Fixes: c217adfc8caa ("dlm: fix add_scan and del_scan usage") +Signed-off-by: Alexander Aring +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/lock.c | 46 ++++++++++++++++++++++++++++++---------------- + 1 file changed, 30 insertions(+), 16 deletions(-) + +diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c +index dddedaef5e93d..0c01e4423ee2a 100644 +--- a/fs/dlm/lock.c ++++ b/fs/dlm/lock.c +@@ -824,9 +824,12 @@ static int find_rsb_dir(struct dlm_ls *ls, const void *name, int len, + r->res_first_lkid = 0; + } + +- /* A dir record will not be on the scan list. */ +- if (r->res_dir_nodeid != our_nodeid) +- del_scan(ls, r); ++ /* we always deactivate scan timer for the rsb, when ++ * we move it out of the inactive state as rsb state ++ * can be changed and scan timers are only for inactive ++ * rsbs. ++ */ ++ del_scan(ls, r); + list_move(&r->res_slow_list, &ls->ls_slow_active); + rsb_clear_flag(r, RSB_INACTIVE); + kref_init(&r->res_ref); /* ref is now used in active state */ +@@ -989,10 +992,10 @@ static int find_rsb_nodir(struct dlm_ls *ls, const void *name, int len, + r->res_nodeid = 0; + } + ++ del_scan(ls, r); + list_move(&r->res_slow_list, &ls->ls_slow_active); + rsb_clear_flag(r, RSB_INACTIVE); + kref_init(&r->res_ref); +- del_scan(ls, r); + write_unlock_bh(&ls->ls_rsbtbl_lock); + + goto out; +@@ -1337,9 +1340,13 @@ static int _dlm_master_lookup(struct dlm_ls *ls, int from_nodeid, const char *na + __dlm_master_lookup(ls, r, our_nodeid, from_nodeid, true, flags, + r_nodeid, result); + +- /* A dir record rsb should never be on scan list. */ +- /* Try to fix this with del_scan? */ +- WARN_ON(!list_empty(&r->res_scan_list)); ++ /* A dir record rsb should never be on scan list. ++ * Except when we are the dir and master node. ++ * This function should only be called by the dir ++ * node. ++ */ ++ WARN_ON(!list_empty(&r->res_scan_list) && ++ r->res_master_nodeid != our_nodeid); + + write_unlock_bh(&ls->ls_rsbtbl_lock); + +@@ -1430,16 +1437,23 @@ static void deactivate_rsb(struct kref *kref) + list_move(&r->res_slow_list, &ls->ls_slow_inactive); + + /* +- * When the rsb becomes unused: +- * - If it's not a dir record for a remote master rsb, +- * then it is put on the scan list to be freed. +- * - If it's a dir record for a remote master rsb, +- * then it is kept in the inactive state until +- * receive_remove() from the master node. ++ * When the rsb becomes unused, there are two possibilities: ++ * 1. Leave the inactive rsb in place (don't remove it). ++ * 2. Add it to the scan list to be removed. ++ * ++ * 1 is done when the rsb is acting as the dir record ++ * for a remotely mastered rsb. The rsb must be left ++ * in place as an inactive rsb to act as the dir record. ++ * ++ * 2 is done when a) the rsb is not the master and not the ++ * dir record, b) when the rsb is both the master and the ++ * dir record, c) when the rsb is master but not dir record. ++ * ++ * (If no directory is used, the rsb can always be removed.) + */ +- if (!dlm_no_directory(ls) && +- (r->res_master_nodeid != our_nodeid) && +- (dlm_dir_nodeid(r) != our_nodeid)) ++ if (dlm_no_directory(ls) || ++ (r->res_master_nodeid == our_nodeid || ++ dlm_dir_nodeid(r) != our_nodeid)) + add_scan(ls, r); + + if (r->res_lvbptr) { +-- +2.39.5 + diff --git a/queue-6.12/dlm-fix-srcu_read_lock-return-type-to-int.patch b/queue-6.12/dlm-fix-srcu_read_lock-return-type-to-int.patch new file mode 100644 index 0000000000..9b4b15a0e9 --- /dev/null +++ b/queue-6.12/dlm-fix-srcu_read_lock-return-type-to-int.patch @@ -0,0 +1,38 @@ +From c9fdad7c7a47fcf93559d377f3cf55972045de81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Dec 2024 10:26:37 -0500 +Subject: dlm: fix srcu_read_lock() return type to int + +From: Alexander Aring + +[ Upstream commit 57cdd1a1cf1464199678f9338049b63fb5d5b41c ] + +The return type of srcu_read_lock() is int and not bool. Whereas we +using the ret variable only to evaluate a bool type of +dlm_lowcomms_con_has_addr() to check if an address is already being set. + +Fixes: 6f0b0b5d7ae7 ("fs: dlm: remove dlm_node_addrs lookup list") +Signed-off-by: Alexander Aring +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/lowcomms.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c +index cb3a10b041c27..f2d88a3581695 100644 +--- a/fs/dlm/lowcomms.c ++++ b/fs/dlm/lowcomms.c +@@ -462,7 +462,8 @@ static bool dlm_lowcomms_con_has_addr(const struct connection *con, + int dlm_lowcomms_addr(int nodeid, struct sockaddr_storage *addr) + { + struct connection *con; +- bool ret, idx; ++ bool ret; ++ int idx; + + idx = srcu_read_lock(&connections_srcu); + con = nodeid2con(nodeid, GFP_NOFS); +-- +2.39.5 + diff --git a/queue-6.12/dmaengine-ti-edma-fix-of-node-reference-leaks-in-edm.patch b/queue-6.12/dmaengine-ti-edma-fix-of-node-reference-leaks-in-edm.patch new file mode 100644 index 0000000000..174f7e1b56 --- /dev/null +++ b/queue-6.12/dmaengine-ti-edma-fix-of-node-reference-leaks-in-edm.patch @@ -0,0 +1,55 @@ +From a81bf7aea2a44820e462ce9c96a8ac41ab98e3f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Dec 2024 11:05:07 +0900 +Subject: dmaengine: ti: edma: fix OF node reference leaks in edma_driver + +From: Joe Hattori + +[ Upstream commit e883c64778e5a9905fce955681f8ee38c7197e0f ] + +The .probe() of edma_driver calls of_parse_phandle_with_fixed_args() but +does not release the obtained OF nodes. Thus add a of_node_put() call. + +This bug was found by an experimental verification tool that I am +developing. + +Fixes: 1be5336bc7ba ("dmaengine: edma: New device tree binding") +Signed-off-by: Joe Hattori +Reviewed-by: Dan Carpenter +Link: https://lore.kernel.org/r/20241219020507.1983124-3-joe@pf.is.s.u-tokyo.ac.jp +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ti/edma.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c +index 5f8d2e93ff3fb..7f861fb07cb83 100644 +--- a/drivers/dma/ti/edma.c ++++ b/drivers/dma/ti/edma.c +@@ -208,7 +208,6 @@ struct edma_desc { + struct edma_cc; + + struct edma_tc { +- struct device_node *node; + u16 id; + }; + +@@ -2466,13 +2465,13 @@ static int edma_probe(struct platform_device *pdev) + if (ret || i == ecc->num_tc) + break; + +- ecc->tc_list[i].node = tc_args.np; + ecc->tc_list[i].id = i; + queue_priority_mapping[i][1] = tc_args.args[0]; + if (queue_priority_mapping[i][1] > lowest_priority) { + lowest_priority = queue_priority_mapping[i][1]; + info->default_queue = i; + } ++ of_node_put(tc_args.np); + } + + /* See if we have optional dma-channel-mask array */ +-- +2.39.5 + diff --git a/queue-6.12/driver-core-class-fix-wild-pointer-dereferences-in-a.patch b/queue-6.12/driver-core-class-fix-wild-pointer-dereferences-in-a.patch new file mode 100644 index 0000000000..7bdd532dcb --- /dev/null +++ b/queue-6.12/driver-core-class-fix-wild-pointer-dereferences-in-a.patch @@ -0,0 +1,76 @@ +From cfbd0aec3de83a7cce6d599c1fbf5a83db6db10f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Jan 2025 16:34:02 +0800 +Subject: driver core: class: Fix wild pointer dereferences in API + class_dev_iter_next() + +From: Zijun Hu + +[ Upstream commit e128f82f7006991c99a58114f70ef61e937b1ac1 ] + +There are a potential wild pointer dereferences issue regarding APIs +class_dev_iter_(init|next|exit)(), as explained by below typical usage: + +// All members of @iter are wild pointers. +struct class_dev_iter iter; + +// class_dev_iter_init(@iter, @class, ...) checks parameter @class for +// potential class_to_subsys() error, and it returns void type and does +// not initialize its output parameter @iter, so caller can not detect +// the error and continues to invoke class_dev_iter_next(@iter) even if +// @iter still contains wild pointers. +class_dev_iter_init(&iter, ...); + +// Dereference these wild pointers in @iter here once suffer the error. +while (dev = class_dev_iter_next(&iter)) { ... }; + +// Also dereference these wild pointers here. +class_dev_iter_exit(&iter); + +Actually, all callers of these APIs have such usage pattern in kernel tree. +Fix by: +- Initialize output parameter @iter by memset() in class_dev_iter_init() + and give callers prompt by pr_crit() for the error. +- Check if @iter is valid in class_dev_iter_next(). + +Fixes: 7b884b7f24b4 ("driver core: class.c: convert to only use class_to_subsys") +Reviewed-by: Jonathan Cameron +Signed-off-by: Zijun Hu +Link: https://lore.kernel.org/r/20250105-class_fix-v6-1-3a2f1768d4d4@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/class.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/base/class.c b/drivers/base/class.c +index cb5359235c702..ce460e1ab1376 100644 +--- a/drivers/base/class.c ++++ b/drivers/base/class.c +@@ -323,8 +323,12 @@ void class_dev_iter_init(struct class_dev_iter *iter, const struct class *class, + struct subsys_private *sp = class_to_subsys(class); + struct klist_node *start_knode = NULL; + +- if (!sp) ++ memset(iter, 0, sizeof(*iter)); ++ if (!sp) { ++ pr_crit("%s: class %p was not registered yet\n", ++ __func__, class); + return; ++ } + + if (start) + start_knode = &start->p->knode_class; +@@ -351,6 +355,9 @@ struct device *class_dev_iter_next(struct class_dev_iter *iter) + struct klist_node *knode; + struct device *dev; + ++ if (!iter->sp) ++ return NULL; ++ + while (1) { + knode = klist_next(&iter->ki); + if (!knode) +-- +2.39.5 + diff --git a/queue-6.12/drm-amd-pm-fix-an-error-handling-path-in-vega10_enab.patch b/queue-6.12/drm-amd-pm-fix-an-error-handling-path-in-vega10_enab.patch new file mode 100644 index 0000000000..b3ea3d5c05 --- /dev/null +++ b/queue-6.12/drm-amd-pm-fix-an-error-handling-path-in-vega10_enab.patch @@ -0,0 +1,47 @@ +From 03de84a165829dd8d0bee645fe2d15cfbaaff45f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Nov 2024 21:23:18 +0100 +Subject: drm/amd/pm: Fix an error handling path in + vega10_enable_se_edc_force_stall_config() + +From: Christophe JAILLET + +[ Upstream commit a3300782d5375e280ba7040f323d01960bfe3396 ] + +In case of error after a amdgpu_gfx_rlc_enter_safe_mode() call, it is not +balanced by a corresponding amdgpu_gfx_rlc_exit_safe_mode() call. + +Add the missing call. + +Fixes: 9b7b8154cdb8 ("drm/amd/powerplay: added didt support for vega10") +Signed-off-by: Christophe JAILLET +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_powertune.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_powertune.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_powertune.c +index 3007b054c873c..776d58ea63ae9 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_powertune.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_powertune.c +@@ -1120,13 +1120,14 @@ static int vega10_enable_se_edc_force_stall_config(struct pp_hwmgr *hwmgr) + result = vega10_program_didt_config_registers(hwmgr, SEEDCForceStallPatternConfig_Vega10, VEGA10_CONFIGREG_DIDT); + result |= vega10_program_didt_config_registers(hwmgr, SEEDCCtrlForceStallConfig_Vega10, VEGA10_CONFIGREG_DIDT); + if (0 != result) +- return result; ++ goto exit_safe_mode; + + vega10_didt_set_mask(hwmgr, false); + ++exit_safe_mode: + amdgpu_gfx_rlc_exit_safe_mode(adev, 0); + +- return 0; ++ return result; + } + + static int vega10_disable_se_edc_force_stall_config(struct pp_hwmgr *hwmgr) +-- +2.39.5 + diff --git a/queue-6.12/drm-amdgpu-fix-gpu-recovery-disable-with-per-queue-r.patch b/queue-6.12/drm-amdgpu-fix-gpu-recovery-disable-with-per-queue-r.patch new file mode 100644 index 0000000000..59218c9637 --- /dev/null +++ b/queue-6.12/drm-amdgpu-fix-gpu-recovery-disable-with-per-queue-r.patch @@ -0,0 +1,48 @@ +From 8019d0aca6fe4977438d36362d5bab44ec9b6f2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 14:39:58 -0500 +Subject: drm/amdgpu: fix gpu recovery disable with per queue reset + +From: Jonathan Kim + +[ Upstream commit 86bde64cb7957be393f84e5d35fb8dfc91e4ae7e ] + +Per queue reset should be bypassed when gpu recovery is disabled +with module parameter. + +Fixes: ee0a469cf917 ("drm/amdkfd: support per-queue reset on gfx9") +Signed-off-by: Jonathan Kim +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c +index 353ac458c834b..a46d6dd6de32f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c +@@ -1133,6 +1133,9 @@ uint64_t kgd_gfx_v9_hqd_get_pq_addr(struct amdgpu_device *adev, + uint32_t low, high; + uint64_t queue_addr = 0; + ++ if (!amdgpu_gpu_recovery) ++ return 0; ++ + kgd_gfx_v9_acquire_queue(adev, pipe_id, queue_id, inst); + amdgpu_gfx_rlc_enter_safe_mode(adev, inst); + +@@ -1181,6 +1184,9 @@ uint64_t kgd_gfx_v9_hqd_reset(struct amdgpu_device *adev, + uint32_t low, high, pipe_reset_data = 0; + uint64_t queue_addr = 0; + ++ if (!amdgpu_gpu_recovery) ++ return 0; ++ + kgd_gfx_v9_acquire_queue(adev, pipe_id, queue_id, inst); + amdgpu_gfx_rlc_enter_safe_mode(adev, inst); + +-- +2.39.5 + diff --git a/queue-6.12/drm-amdgpu-fix-potential-null-pointer-dereference-in.patch b/queue-6.12/drm-amdgpu-fix-potential-null-pointer-dereference-in.patch new file mode 100644 index 0000000000..77f456040d --- /dev/null +++ b/queue-6.12/drm-amdgpu-fix-potential-null-pointer-dereference-in.patch @@ -0,0 +1,44 @@ +From 5f42c576b93a61cb24adf328ad53088e1837ac37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Dec 2024 11:00:43 +0300 +Subject: drm/amdgpu: Fix potential NULL pointer dereference in + atomctrl_get_smc_sclk_range_table + +From: Ivan Stepchenko + +[ Upstream commit 357445e28ff004d7f10967aa93ddb4bffa5c3688 ] + +The function atomctrl_get_smc_sclk_range_table() does not check the return +value of smu_atom_get_data_table(). If smu_atom_get_data_table() fails to +retrieve SMU_Info table, it returns NULL which is later dereferenced. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +In practice this should never happen as this code only gets called +on polaris chips and the vbios data table will always be present on +those chips. + +Fixes: a23eefa2f461 ("drm/amd/powerplay: enable dpm for baffin.") +Signed-off-by: Ivan Stepchenko +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c +index b56298d9da98f..5c54c9fd44619 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c +@@ -1420,6 +1420,8 @@ int atomctrl_get_smc_sclk_range_table(struct pp_hwmgr *hwmgr, struct pp_atom_ctr + GetIndexIntoMasterTable(DATA, SMU_Info), + &size, &frev, &crev); + ++ if (!psmu_info) ++ return -EINVAL; + + for (i = 0; i < psmu_info->ucSclkEntryNum; i++) { + table->entry[i].ucVco_setting = psmu_info->asSclkFcwRangeEntry[i].ucVco_setting; +-- +2.39.5 + diff --git a/queue-6.12/drm-amdgpu-tear-down-ttm-range-manager-for-doorbell-.patch b/queue-6.12/drm-amdgpu-tear-down-ttm-range-manager-for-doorbell-.patch new file mode 100644 index 0000000000..fefa9d7450 --- /dev/null +++ b/queue-6.12/drm-amdgpu-tear-down-ttm-range-manager-for-doorbell-.patch @@ -0,0 +1,38 @@ +From 50ce234888298d69653c2db225f8f837284576b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Dec 2024 00:27:21 +0800 +Subject: drm/amdgpu: tear down ttm range manager for doorbell in + amdgpu_ttm_fini() + +From: Jiang Liu + +[ Upstream commit 60a2c0c12b644450e420ffc42291d1eb248bacb7 ] + +Tear down ttm range manager for doorbell in function amdgpu_ttm_fini(), +to avoid memory leakage. + +Fixes: 792b84fb9038 ("drm/amdgpu: initialize ttm for doorbells") +Signed-off-by: Jiang Liu +Signed-off-by: Kent Russell +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +index 9f922ec50ea2d..ae9ca6788df78 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -2065,6 +2065,7 @@ void amdgpu_ttm_fini(struct amdgpu_device *adev) + ttm_range_man_fini(&adev->mman.bdev, AMDGPU_PL_GDS); + ttm_range_man_fini(&adev->mman.bdev, AMDGPU_PL_GWS); + ttm_range_man_fini(&adev->mman.bdev, AMDGPU_PL_OA); ++ ttm_range_man_fini(&adev->mman.bdev, AMDGPU_PL_DOORBELL); + ttm_device_fini(&adev->mman.bdev); + adev->mman.initialized = false; + DRM_INFO("amdgpu: ttm finalized\n"); +-- +2.39.5 + diff --git a/queue-6.12/drm-amdgpu-vcn-reset-fw_shared-under-sriov.patch b/queue-6.12/drm-amdgpu-vcn-reset-fw_shared-under-sriov.patch new file mode 100644 index 0000000000..f6a8e40ccb --- /dev/null +++ b/queue-6.12/drm-amdgpu-vcn-reset-fw_shared-under-sriov.patch @@ -0,0 +1,38 @@ +From 69f6ebe838f831352a737b5d6a59f765143b49a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 15:42:56 -0600 +Subject: drm/amdgpu/vcn: reset fw_shared under SRIOV + +From: Bokun Zhang + +[ Upstream commit 3676f37a88432132bcff55a17dc48911239b6d98 ] + +- The previous patch only considered the case for baremetal + and is not applicable for SRIOV code path. We also need to + init fw_share for SRIOV VF + +Fixes: 928cd772e18f ("drm/amdgpu/vcn: reset fw_shared when VCPU buffers corrupted on vcn v4.0.3") +Acked-by: Alex Deucher +Signed-off-by: Bokun Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c +index 6fca2915ea8fd..84c6b0f5c4c0b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c ++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c +@@ -943,6 +943,8 @@ static int vcn_v4_0_3_start_sriov(struct amdgpu_device *adev) + for (i = 0; i < adev->vcn.num_vcn_inst; i++) { + vcn_inst = GET_INST(VCN, i); + ++ vcn_v4_0_3_fw_shared_init(adev, vcn_inst); ++ + memset(&header, 0, sizeof(struct mmsch_v4_0_3_init_header)); + header.version = MMSCH_VERSION; + header.total_size = sizeof(struct mmsch_v4_0_3_init_header) >> 2; +-- +2.39.5 + diff --git a/queue-6.12/drm-bridge-it6505-change-definition-of-aux_fifo_max_.patch b/queue-6.12/drm-bridge-it6505-change-definition-of-aux_fifo_max_.patch new file mode 100644 index 0000000000..62371e7d30 --- /dev/null +++ b/queue-6.12/drm-bridge-it6505-change-definition-of-aux_fifo_max_.patch @@ -0,0 +1,39 @@ +From c68cf57e6be5e2c9c3b711ca032cd9fca515a1b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 18:51:19 +0800 +Subject: drm/bridge: it6505: Change definition of AUX_FIFO_MAX_SIZE + +From: Hermes Wu + +[ Upstream commit c14870218c14532b0f0a7805b96a4d3c92d06fb2 ] + +The hardware AUX FIFO is 16 bytes +Change definition of AUX_FIFO_MAX_SIZE to 16 + +Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver") +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Hermes Wu +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Dmitry Baryshkov +Link: https://patchwork.freedesktop.org/patch/msgid/20241230-v7-upstream-v7-1-e0fdd4844703@ite.corp-partner.google.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ite-it6505.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c +index 008d86cc562af..cf891e7677c0e 100644 +--- a/drivers/gpu/drm/bridge/ite-it6505.c ++++ b/drivers/gpu/drm/bridge/ite-it6505.c +@@ -300,7 +300,7 @@ + #define MAX_CR_LEVEL 0x03 + #define MAX_EQ_LEVEL 0x03 + #define AUX_WAIT_TIMEOUT_MS 15 +-#define AUX_FIFO_MAX_SIZE 32 ++#define AUX_FIFO_MAX_SIZE 16 + #define PIXEL_CLK_DELAY 1 + #define PIXEL_CLK_INVERSE 0 + #define ADJUST_PHASE_THRESHOLD 80000 +-- +2.39.5 + diff --git a/queue-6.12/drm-connector-allow-clearing-hdmi-infoframes.patch b/queue-6.12/drm-connector-allow-clearing-hdmi-infoframes.patch new file mode 100644 index 0000000000..eb00f50ad7 --- /dev/null +++ b/queue-6.12/drm-connector-allow-clearing-hdmi-infoframes.patch @@ -0,0 +1,76 @@ +From 19ac9df364265912d92ef9d973d5f92fe6bec229 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Dec 2024 12:19:39 -0600 +Subject: drm/connector: Allow clearing HDMI infoframes + +From: Derek Foreman + +[ Upstream commit d34357743b360c99903b5a59daab08f55b2f41a1 ] + +Our infoframe setting code currently lacks the ability to clear +infoframes. For some of the infoframes, we only need to replace them, +so if an error occurred when generating a new infoframe we would leave +a stale frame instead of clearing the frame. + +However, the Dynamic Range and Mastering (DRM) infoframe should only +be present when displaying HDR content (ie: the HDR_OUTPUT_METADATA blob +is set). If we can't clear infoframes, the stale DRM infoframe will +remain and we can never set the display back to SDR mode. + +With this change, we clear infoframes when they can not, or should not, +be generated. This fixes switching to an SDR mode from an HDR one. + +Fixes: f378b77227bc ("drm/connector: hdmi: Add Infoframes generation") +Signed-off-by: Derek Foreman +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Dmitry Baryshkov +Link: https://patchwork.freedesktop.org/patch/msgid/20241202181939.724011-1-derek.foreman@collabora.com +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/display/drm_hdmi_state_helper.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/gpu/drm/display/drm_hdmi_state_helper.c b/drivers/gpu/drm/display/drm_hdmi_state_helper.c +index feb7a3a759811..936a8f95d80f7 100644 +--- a/drivers/gpu/drm/display/drm_hdmi_state_helper.c ++++ b/drivers/gpu/drm/display/drm_hdmi_state_helper.c +@@ -347,6 +347,8 @@ static int hdmi_generate_avi_infoframe(const struct drm_connector *connector, + is_limited_range ? HDMI_QUANTIZATION_RANGE_LIMITED : HDMI_QUANTIZATION_RANGE_FULL; + int ret; + ++ infoframe->set = false; ++ + ret = drm_hdmi_avi_infoframe_from_display_mode(frame, connector, mode); + if (ret) + return ret; +@@ -376,6 +378,8 @@ static int hdmi_generate_spd_infoframe(const struct drm_connector *connector, + &infoframe->data.spd; + int ret; + ++ infoframe->set = false; ++ + ret = hdmi_spd_infoframe_init(frame, + connector->hdmi.vendor, + connector->hdmi.product); +@@ -398,6 +402,8 @@ static int hdmi_generate_hdr_infoframe(const struct drm_connector *connector, + &infoframe->data.drm; + int ret; + ++ infoframe->set = false; ++ + if (connector->max_bpc < 10) + return 0; + +@@ -425,6 +431,8 @@ static int hdmi_generate_hdmi_vendor_infoframe(const struct drm_connector *conne + &infoframe->data.vendor.hdmi; + int ret; + ++ infoframe->set = false; ++ + if (!info->has_hdmi_infoframe) + return 0; + +-- +2.39.5 + diff --git a/queue-6.12/drm-etnaviv-drop-the-offset-in-page-manipulation.patch b/queue-6.12/drm-etnaviv-drop-the-offset-in-page-manipulation.patch new file mode 100644 index 0000000000..bfbde036d8 --- /dev/null +++ b/queue-6.12/drm-etnaviv-drop-the-offset-in-page-manipulation.patch @@ -0,0 +1,110 @@ +From cc5b6c4868e20f34d46e359930f0ca45a1cab9e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Nov 2024 20:32:44 +0800 +Subject: drm/etnaviv: Drop the offset in page manipulation + +From: Sui Jingfeng + +[ Upstream commit 9aad03e7f5db7944d5ee96cd5c595c54be2236e6 ] + +The etnaviv driver, both kernel space and user space, assumes that GPU page +size is 4KiB. Its IOMMU map/unmap 4KiB physical address range once a time. +If 'sg->offset != 0' is true, then the current implementation will map the +IOVA to a wrong area, which may lead to coherency problem. Picture 0 and 1 +give the illustration, see below. + + PA start drifted + | + |<--- 'sg_dma_address(sg) - sg->offset' + | .------ sg_dma_address(sg) + | | .---- sg_dma_len(sg) + |<-sg->offset->| | + V |<-->| Another one cpu page + +----+----+----+----+ +----+----+----+----+ + |xxxx| |||||| ||||||||||||||||||||| + +----+----+----+----+ +----+----+----+----+ + ^ ^ ^ ^ + |<--- da_len --->| | | + | | | | + | .--------------' | | + | | .----------------' | + | | | .----------------' + | | | | + | | +----+----+----+----+ + | | ||||||||||||||||||||| + | | +----+----+----+----+ + | | + | '--------------. da_len = sg_dma_len(sg) + sg->offset, using + | | 'sg_dma_len(sg) + sg->offset' will lead to GPUVA + +----+ ~~~~~~~~~~~~~+ collision, but min_t(unsigned int, da_len, va_len) + |xxxx| | will clamp it to correct size. But the IOVA will + +----+ ~~~~~~~~~~~~~+ be redirect to wrong area. + ^ + | Picture 0: Possibly wrong implementation. +GPUVA (IOVA) + +-------------------------------------------------------------------------- + + .------- sg_dma_address(sg) + | .---- sg_dma_len(sg) + |<-sg->offset->| | + | |<-->| another one cpu page + +----+----+----+----+ +----+----+----+----+ + | |||||| ||||||||||||||||||||| + +----+----+----+----+ +----+----+----+----+ + ^ ^ ^ ^ + | | | | + .--------------' | | | + | | | | + | .--------------' | | + | | .----------------' | + | | | .----------------' + | | | | + +----+ +----+----+----+----+ + |||||| ||||||||||||||||||||| The first one is SZ_4K, the second is SZ_16K + +----+ +----+----+----+----+ + ^ + | Picture 1: Perfectly correct implementation. +GPUVA (IOVA) + +If sg->offset != 0 is true, IOVA will be mapped to wrong physical address. +Either because there doesn't contain the data or there contains wrong data. +Strictly speaking, the memory area that before sg_dma_address(sg) doesn't +belong to us, and it's likely that the area is being used by other process. + +Because we don't want to introduce confusions about which part is visible +to the GPU, we assumes that the size of GPUVA is always 4KiB aligned. This +is very relaxed requirement, since we already made the decision that GPU +page size is 4KiB (as a canonical decision). And softpin feature is landed, +Mesa's util_vma_heap_alloc() will certainly report correct length of GPUVA +to kernel with desired alignment ensured. + +With above statements agreed, drop the "offset in page" manipulation will +return us a correct implementation at any case. + +Fixes: a8c21a5451d8 ("drm/etnaviv: add initial etnaviv DRM driver") +Signed-off-by: Sui Jingfeng +Signed-off-by: Lucas Stach +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c +index a382920ae2be0..b7c09fc86a2cc 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c +@@ -82,8 +82,8 @@ static int etnaviv_iommu_map(struct etnaviv_iommu_context *context, + return -EINVAL; + + for_each_sgtable_dma_sg(sgt, sg, i) { +- phys_addr_t pa = sg_dma_address(sg) - sg->offset; +- unsigned int da_len = sg_dma_len(sg) + sg->offset; ++ phys_addr_t pa = sg_dma_address(sg); ++ unsigned int da_len = sg_dma_len(sg); + unsigned int bytes = min_t(unsigned int, da_len, va_len); + + VERB("map[%d]: %08x %pap(%x)", i, iova, &pa, bytes); +-- +2.39.5 + diff --git a/queue-6.12/drm-etnaviv-fix-page-property-being-used-for-non-wri.patch b/queue-6.12/drm-etnaviv-fix-page-property-being-used-for-non-wri.patch new file mode 100644 index 0000000000..7e20c42b3c --- /dev/null +++ b/queue-6.12/drm-etnaviv-fix-page-property-being-used-for-non-wri.patch @@ -0,0 +1,60 @@ +From 304b39649289463c3a21d7d651504046e033376d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Nov 2024 08:41:56 +0800 +Subject: drm/etnaviv: Fix page property being used for non writecombine + buffers + +From: Sui Jingfeng + +[ Upstream commit 834f304192834d6f0941954f3277ae0ba11a9a86 ] + +In the etnaviv_gem_vmap_impl() function, the driver vmap whatever buffers +with write combine(WC) page property, this is incorrect. Cached buffers +should be mapped with the cached page property and uncached buffers should +be mapped with the uncached page property. + +Fixes: a0a5ab3e99b8 ("drm/etnaviv: call correct function when trying to vmap a DMABUF") +Signed-off-by: Sui Jingfeng +Signed-off-by: Lucas Stach +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_gem.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c +index 5c0c9d4e3be18..d3f6df047f5a2 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c +@@ -342,6 +342,7 @@ void *etnaviv_gem_vmap(struct drm_gem_object *obj) + static void *etnaviv_gem_vmap_impl(struct etnaviv_gem_object *obj) + { + struct page **pages; ++ pgprot_t prot; + + lockdep_assert_held(&obj->lock); + +@@ -349,8 +350,19 @@ static void *etnaviv_gem_vmap_impl(struct etnaviv_gem_object *obj) + if (IS_ERR(pages)) + return NULL; + +- return vmap(pages, obj->base.size >> PAGE_SHIFT, +- VM_MAP, pgprot_writecombine(PAGE_KERNEL)); ++ switch (obj->flags & ETNA_BO_CACHE_MASK) { ++ case ETNA_BO_CACHED: ++ prot = PAGE_KERNEL; ++ break; ++ case ETNA_BO_UNCACHED: ++ prot = pgprot_noncached(PAGE_KERNEL); ++ break; ++ case ETNA_BO_WC: ++ default: ++ prot = pgprot_writecombine(PAGE_KERNEL); ++ } ++ ++ return vmap(pages, obj->base.size >> PAGE_SHIFT, VM_MAP, prot); + } + + static inline enum dma_data_direction etnaviv_op_to_dma_dir(u32 op) +-- +2.39.5 + diff --git a/queue-6.12/drm-etnaviv-map-and-unmap-gpuva-range-with-respect-t.patch b/queue-6.12/drm-etnaviv-map-and-unmap-gpuva-range-with-respect-t.patch new file mode 100644 index 0000000000..d07bd4b9aa --- /dev/null +++ b/queue-6.12/drm-etnaviv-map-and-unmap-gpuva-range-with-respect-t.patch @@ -0,0 +1,119 @@ +From bc12edee127f8517535382a81bfdf28bf27ca462 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Oct 2024 04:43:55 +0800 +Subject: drm/etnaviv: Map and unmap GPUVA range with respect to the GPUVA size + +From: Sui Jingfeng + +[ Upstream commit 68786b7f49873c69ec332a045a9bf4337d71ec20 ] + +Etnaviv assumes that GPU page size is 4KiB, however, GPUVA ranges collision +when using softpin capable GPUs on a non 4KiB CPU page size configuration. +The root cause is that kernel side BO takes up bigger address space than +userspace expect, the size of backing memory of GEM buffer objects are +required to align to the CPU PAGE_SIZE. Therefore, results in userspace +allocated GPUVA range fails to be inserted to the specified hole exactly. + +To solve this problem, record the GPU visiable size of a BO firstly, then +map and unmap the SG entry strictly with respect to the total GPUVA size. + +Signed-off-by: Sui Jingfeng +Signed-off-by: Lucas Stach +Stable-dep-of: 9aad03e7f5db ("drm/etnaviv: Drop the offset in page manipulation") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 38 +++++++++------------------ + 1 file changed, 13 insertions(+), 25 deletions(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c +index 1661d589bf3e7..a382920ae2be0 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c +@@ -69,9 +69,11 @@ static int etnaviv_context_map(struct etnaviv_iommu_context *context, + return ret; + } + +-static int etnaviv_iommu_map(struct etnaviv_iommu_context *context, u32 iova, ++static int etnaviv_iommu_map(struct etnaviv_iommu_context *context, ++ u32 iova, unsigned int va_len, + struct sg_table *sgt, int prot) +-{ struct scatterlist *sg; ++{ ++ struct scatterlist *sg; + unsigned int da = iova; + unsigned int i; + int ret; +@@ -81,14 +83,16 @@ static int etnaviv_iommu_map(struct etnaviv_iommu_context *context, u32 iova, + + for_each_sgtable_dma_sg(sgt, sg, i) { + phys_addr_t pa = sg_dma_address(sg) - sg->offset; +- size_t bytes = sg_dma_len(sg) + sg->offset; ++ unsigned int da_len = sg_dma_len(sg) + sg->offset; ++ unsigned int bytes = min_t(unsigned int, da_len, va_len); + +- VERB("map[%d]: %08x %pap(%zx)", i, iova, &pa, bytes); ++ VERB("map[%d]: %08x %pap(%x)", i, iova, &pa, bytes); + + ret = etnaviv_context_map(context, da, pa, bytes, prot); + if (ret) + goto fail; + ++ va_len -= bytes; + da += bytes; + } + +@@ -104,21 +108,7 @@ static int etnaviv_iommu_map(struct etnaviv_iommu_context *context, u32 iova, + static void etnaviv_iommu_unmap(struct etnaviv_iommu_context *context, u32 iova, + struct sg_table *sgt, unsigned len) + { +- struct scatterlist *sg; +- unsigned int da = iova; +- int i; +- +- for_each_sgtable_dma_sg(sgt, sg, i) { +- size_t bytes = sg_dma_len(sg) + sg->offset; +- +- etnaviv_context_unmap(context, da, bytes); +- +- VERB("unmap[%d]: %08x(%zx)", i, iova, bytes); +- +- BUG_ON(!PAGE_ALIGNED(bytes)); +- +- da += bytes; +- } ++ etnaviv_context_unmap(context, iova, len); + + context->flush_seq++; + } +@@ -131,7 +121,7 @@ static void etnaviv_iommu_remove_mapping(struct etnaviv_iommu_context *context, + lockdep_assert_held(&context->lock); + + etnaviv_iommu_unmap(context, mapping->vram_node.start, +- etnaviv_obj->sgt, etnaviv_obj->base.size); ++ etnaviv_obj->sgt, etnaviv_obj->size); + drm_mm_remove_node(&mapping->vram_node); + } + +@@ -305,16 +295,14 @@ int etnaviv_iommu_map_gem(struct etnaviv_iommu_context *context, + node = &mapping->vram_node; + + if (va) +- ret = etnaviv_iommu_insert_exact(context, node, +- etnaviv_obj->base.size, va); ++ ret = etnaviv_iommu_insert_exact(context, node, etnaviv_obj->size, va); + else +- ret = etnaviv_iommu_find_iova(context, node, +- etnaviv_obj->base.size); ++ ret = etnaviv_iommu_find_iova(context, node, etnaviv_obj->size); + if (ret < 0) + goto unlock; + + mapping->iova = node->start; +- ret = etnaviv_iommu_map(context, node->start, sgt, ++ ret = etnaviv_iommu_map(context, node->start, etnaviv_obj->size, sgt, + ETNAVIV_PROT_READ | ETNAVIV_PROT_WRITE); + + if (ret < 0) { +-- +2.39.5 + diff --git a/queue-6.12/drm-etnaviv-record-gpu-visible-size-of-gem-bo-separa.patch b/queue-6.12/drm-etnaviv-record-gpu-visible-size-of-gem-bo-separa.patch new file mode 100644 index 0000000000..98d2e97fd5 --- /dev/null +++ b/queue-6.12/drm-etnaviv-record-gpu-visible-size-of-gem-bo-separa.patch @@ -0,0 +1,93 @@ +From b47caf15f7fbb030c59f6cd3fd144fa489e58708 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Oct 2024 04:43:54 +0800 +Subject: drm/etnaviv: Record GPU visible size of GEM BO separately + +From: Sui Jingfeng + +[ Upstream commit b5f1eed853c6ea6a99149fd97fe179f3ebd96a02 ] + +The GPU visible size of a GEM BO is not necessarily PAGE_SIZE aligned, +which happens when CPU page size is not equal to GPU page size. Extra +precious resources such as GPU page tables and GPU TLBs may being paid +because of this but never get used. + +Track the size of GPU visible part of GEM BO separately, ensure no +GPUVA range wasting by aligning that size to GPU page size. + +Signed-off-by: Sui Jingfeng +Signed-off-by: Lucas Stach +Stable-dep-of: 9aad03e7f5db ("drm/etnaviv: Drop the offset in page manipulation") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_gem.c | 11 +++++------ + drivers/gpu/drm/etnaviv/etnaviv_gem.h | 5 +++++ + 2 files changed, 10 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c +index d3f6df047f5a2..7dce6385e5e33 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c +@@ -555,7 +555,7 @@ static const struct drm_gem_object_funcs etnaviv_gem_object_funcs = { + .vm_ops = &vm_ops, + }; + +-static int etnaviv_gem_new_impl(struct drm_device *dev, u32 flags, ++static int etnaviv_gem_new_impl(struct drm_device *dev, u32 size, u32 flags, + const struct etnaviv_gem_ops *ops, struct drm_gem_object **obj) + { + struct etnaviv_gem_object *etnaviv_obj; +@@ -582,6 +582,7 @@ static int etnaviv_gem_new_impl(struct drm_device *dev, u32 flags, + if (!etnaviv_obj) + return -ENOMEM; + ++ etnaviv_obj->size = ALIGN(size, SZ_4K); + etnaviv_obj->flags = flags; + etnaviv_obj->ops = ops; + +@@ -602,15 +603,13 @@ int etnaviv_gem_new_handle(struct drm_device *dev, struct drm_file *file, + struct drm_gem_object *obj = NULL; + int ret; + +- size = PAGE_ALIGN(size); +- +- ret = etnaviv_gem_new_impl(dev, flags, &etnaviv_gem_shmem_ops, &obj); ++ ret = etnaviv_gem_new_impl(dev, size, flags, &etnaviv_gem_shmem_ops, &obj); + if (ret) + goto fail; + + lockdep_set_class(&to_etnaviv_bo(obj)->lock, &etnaviv_shm_lock_class); + +- ret = drm_gem_object_init(dev, obj, size); ++ ret = drm_gem_object_init(dev, obj, PAGE_ALIGN(size)); + if (ret) + goto fail; + +@@ -639,7 +638,7 @@ int etnaviv_gem_new_private(struct drm_device *dev, size_t size, u32 flags, + struct drm_gem_object *obj; + int ret; + +- ret = etnaviv_gem_new_impl(dev, flags, ops, &obj); ++ ret = etnaviv_gem_new_impl(dev, size, flags, ops, &obj); + if (ret) + return ret; + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.h b/drivers/gpu/drm/etnaviv/etnaviv_gem.h +index a42d260cac2cf..687555aae8079 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.h ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.h +@@ -36,6 +36,11 @@ struct etnaviv_gem_object { + const struct etnaviv_gem_ops *ops; + struct mutex lock; + ++ /* ++ * The actual size that is visible to the GPU, not necessarily ++ * PAGE_SIZE aligned, but should be aligned to GPU page size. ++ */ ++ u32 size; + u32 flags; + + struct list_head gem_node; +-- +2.39.5 + diff --git a/queue-6.12/drm-msm-check-return-value-of-of_dma_configure.patch b/queue-6.12/drm-msm-check-return-value-of-of_dma_configure.patch new file mode 100644 index 0000000000..7906df12af --- /dev/null +++ b/queue-6.12/drm-msm-check-return-value-of-of_dma_configure.patch @@ -0,0 +1,57 @@ +From c8175811f0b67dacb06d0bdf262187e2cbac507b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Nov 2024 17:07:38 +0800 +Subject: drm/msm: Check return value of of_dma_configure() + +From: Sui Jingfeng + +[ Upstream commit b34a7401ffaee45354e81b38a4d072794079cfd6 ] + +Because the of_dma_configure() will returns '-EPROBE_DEFER' if the probe +procedure of the specific platform IOMMU driver is not finished yet. It +can also return other error code for various reasons. + +Stop pretending that it will always suceess, quit if it fail. + +Signed-off-by: Sui Jingfeng +Reviewed-by: Konrad Dybcio +Fixes: 29ac8979cdf7 ("drm/msm/a6xx: use msm_gem for GMU memory objects") +Fixes: 5a903a44a984 ("drm/msm/a6xx: Introduce GMU wrapper support") +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/622782/ +Link: https://lore.kernel.org/r/20241104090738.529848-1-sui.jingfeng@linux.dev +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c +index 14db7376c712d..e386b059187ac 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c +@@ -1603,7 +1603,9 @@ int a6xx_gmu_wrapper_init(struct a6xx_gpu *a6xx_gpu, struct device_node *node) + + gmu->dev = &pdev->dev; + +- of_dma_configure(gmu->dev, node, true); ++ ret = of_dma_configure(gmu->dev, node, true); ++ if (ret) ++ return ret; + + pm_runtime_enable(gmu->dev); + +@@ -1668,7 +1670,9 @@ int a6xx_gmu_init(struct a6xx_gpu *a6xx_gpu, struct device_node *node) + + gmu->dev = &pdev->dev; + +- of_dma_configure(gmu->dev, node, true); ++ ret = of_dma_configure(gmu->dev, node, true); ++ if (ret) ++ return ret; + + /* Fow now, don't do anything fancy until we get our feet under us */ + gmu->idle_level = GMU_IDLE_STATE_ACTIVE; +-- +2.39.5 + diff --git a/queue-6.12/drm-msm-don-t-clean-up-priv-kms-prematurely.patch b/queue-6.12/drm-msm-don-t-clean-up-priv-kms-prematurely.patch new file mode 100644 index 0000000000..8f110e91df --- /dev/null +++ b/queue-6.12/drm-msm-don-t-clean-up-priv-kms-prematurely.patch @@ -0,0 +1,39 @@ +From e5e193a6548f66f15fc7bffc668faebbe3ed0ba0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Apr 2024 05:33:01 +0300 +Subject: drm/msm: don't clean up priv->kms prematurely + +From: Dmitry Baryshkov + +[ Upstream commit ebc0deda3c2948d40419677d388b4e6081688a06 ] + +MSM display drivers provide kms structure allocated during probe(). +Don't clean up priv->kms field in case of an error. Otherwise probe +functions might fail after KMS probe deferral. + +Fixes: a2ab5d5bb6b1 ("drm/msm: allow passing struct msm_kms to msm_drv_probe()") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Fixes: 506efcba3129 ("drm/msm: carve out KMS code from msm_drv.c") +Patchwork: https://patchwork.freedesktop.org/patch/590411/ +Link: https://lore.kernel.org/r/20240420-mdp4-fixes-v1-1-96a70f64fa85@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_kms.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/msm_kms.c b/drivers/gpu/drm/msm/msm_kms.c +index af6a6fcb11736..6749f0fbca96d 100644 +--- a/drivers/gpu/drm/msm/msm_kms.c ++++ b/drivers/gpu/drm/msm/msm_kms.c +@@ -244,7 +244,6 @@ int msm_drm_kms_init(struct device *dev, const struct drm_driver *drv) + ret = priv->kms_init(ddev); + if (ret) { + DRM_DEV_ERROR(dev, "failed to load kms\n"); +- priv->kms = NULL; + return ret; + } + +-- +2.39.5 + diff --git a/queue-6.12/drm-msm-dp-set-safe_to_exit_level-before-printing-it.patch b/queue-6.12/drm-msm-dp-set-safe_to_exit_level-before-printing-it.patch new file mode 100644 index 0000000000..fb7a1cd32c --- /dev/null +++ b/queue-6.12/drm-msm-dp-set-safe_to_exit_level-before-printing-it.patch @@ -0,0 +1,44 @@ +From 6bc9e20b60726b39bdeb58bc6406b46bff500cee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Dec 2024 12:06:31 +0200 +Subject: drm/msm/dp: set safe_to_exit_level before printing it + +From: Dmitry Baryshkov + +[ Upstream commit 7dee35d79bb046bfd425aa9e58a82414f67c1cec ] + +Rather than printing random garbage from stack and pretending that it is +the default safe_to_exit_level, set the variable beforehand. + +Fixes: d13e36d7d222 ("drm/msm/dp: add audio support for Display Port on MSM") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202411081748.0PPL9MIj-lkp@intel.com/ +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/626804/ +Link: https://lore.kernel.org/r/20241202-fd-dp-audio-fixup-v2-1-d9187ea96dad@linaro.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dp/dp_audio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/dp/dp_audio.c b/drivers/gpu/drm/msm/dp/dp_audio.c +index a599fc5d63c52..f4e01da5c55b0 100644 +--- a/drivers/gpu/drm/msm/dp/dp_audio.c ++++ b/drivers/gpu/drm/msm/dp/dp_audio.c +@@ -329,10 +329,10 @@ static void dp_audio_safe_to_exit_level(struct dp_audio_private *audio) + safe_to_exit_level = 5; + break; + default: ++ safe_to_exit_level = 14; + drm_dbg_dp(audio->drm_dev, + "setting the default safe_to_exit_level = %u\n", + safe_to_exit_level); +- safe_to_exit_level = 14; + break; + } + +-- +2.39.5 + diff --git a/queue-6.12/drm-msm-dpu-link-dspp_2-_3-blocks-on-sc8180x.patch b/queue-6.12/drm-msm-dpu-link-dspp_2-_3-blocks-on-sc8180x.patch new file mode 100644 index 0000000000..862f7fbd0f --- /dev/null +++ b/queue-6.12/drm-msm-dpu-link-dspp_2-_3-blocks-on-sc8180x.patch @@ -0,0 +1,46 @@ +From f3fcb285eb40238c857ed3c3c62d843d768bb1c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2024 03:28:31 +0200 +Subject: drm/msm/dpu: link DSPP_2/_3 blocks on SC8180X + +From: Dmitry Baryshkov + +[ Upstream commit 0986163245df6bece47113e506143a7e87b0097d ] + +Link DSPP_2 to the LM_2 and DSPP_3 to the LM_3 mixer blocks. This allows +using colour transformation matrix (aka night mode) with more outputs at +the same time. + +Fixes: f5abecfe339e ("drm/msm/dpu: enable DSPP and DSC on sc8180x") +Reviewed-by: Abhinav Kumar +Signed-off-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/629954/ +Link: https://lore.kernel.org/r/20241220-dpu-fix-catalog-v2-3-38fa961ea992@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h +index bab19ddd1d4f9..641023b102bf5 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h +@@ -163,6 +163,7 @@ static const struct dpu_lm_cfg sc8180x_lm[] = { + .sblk = &sdm845_lm_sblk, + .lm_pair = LM_3, + .pingpong = PINGPONG_2, ++ .dspp = DSPP_2, + }, { + .name = "lm_3", .id = LM_3, + .base = 0x47000, .len = 0x320, +@@ -170,6 +171,7 @@ static const struct dpu_lm_cfg sc8180x_lm[] = { + .sblk = &sdm845_lm_sblk, + .lm_pair = LM_2, + .pingpong = PINGPONG_3, ++ .dspp = DSPP_3, + }, { + .name = "lm_4", .id = LM_4, + .base = 0x48000, .len = 0x320, +-- +2.39.5 + diff --git a/queue-6.12/drm-msm-dpu-link-dspp_2-_3-blocks-on-sm8150.patch b/queue-6.12/drm-msm-dpu-link-dspp_2-_3-blocks-on-sm8150.patch new file mode 100644 index 0000000000..222f1f1811 --- /dev/null +++ b/queue-6.12/drm-msm-dpu-link-dspp_2-_3-blocks-on-sm8150.patch @@ -0,0 +1,46 @@ +From 0dfc9540efcfffb8010851308004dfb99c3f1c34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2024 03:28:30 +0200 +Subject: drm/msm/dpu: link DSPP_2/_3 blocks on SM8150 + +From: Dmitry Baryshkov + +[ Upstream commit ac440a31e523805939215b24d2f0c451b48d5891 ] + +Link DSPP_2 to the LM_2 and DSPP_3 to the LM_3 mixer blocks. This allows +using colour transformation matrix (aka night mode) with more outputs at +the same time. + +Fixes: 05ae91d960fd ("drm/msm/dpu: enable DSPP support on SM8[12]50") +Reviewed-by: Abhinav Kumar +Signed-off-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/629952/ +Link: https://lore.kernel.org/r/20241220-dpu-fix-catalog-v2-2-38fa961ea992@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_0_sm8150.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_0_sm8150.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_0_sm8150.h +index 6ccfde82fecdb..421afacb72480 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_0_sm8150.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_0_sm8150.h +@@ -164,6 +164,7 @@ static const struct dpu_lm_cfg sm8150_lm[] = { + .sblk = &sdm845_lm_sblk, + .lm_pair = LM_3, + .pingpong = PINGPONG_2, ++ .dspp = DSPP_2, + }, { + .name = "lm_3", .id = LM_3, + .base = 0x47000, .len = 0x320, +@@ -171,6 +172,7 @@ static const struct dpu_lm_cfg sm8150_lm[] = { + .sblk = &sdm845_lm_sblk, + .lm_pair = LM_2, + .pingpong = PINGPONG_3, ++ .dspp = DSPP_3, + }, { + .name = "lm_4", .id = LM_4, + .base = 0x48000, .len = 0x320, +-- +2.39.5 + diff --git a/queue-6.12/drm-msm-dpu-link-dspp_2-_3-blocks-on-sm8250.patch b/queue-6.12/drm-msm-dpu-link-dspp_2-_3-blocks-on-sm8250.patch new file mode 100644 index 0000000000..600d14f194 --- /dev/null +++ b/queue-6.12/drm-msm-dpu-link-dspp_2-_3-blocks-on-sm8250.patch @@ -0,0 +1,46 @@ +From dc1800fc96478d329aa9aa256c3348f34c9170f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2024 03:28:32 +0200 +Subject: drm/msm/dpu: link DSPP_2/_3 blocks on SM8250 + +From: Dmitry Baryshkov + +[ Upstream commit 8252028092f86d413b3a83e5e76a9615073a0c7f ] + +Link DSPP_2 to the LM_2 and DSPP_3 to the LM_3 mixer blocks. This allows +using colour transformation matrix (aka night mode) with more outputs at +the same time. + +Fixes: 05ae91d960fd ("drm/msm/dpu: enable DSPP support on SM8[12]50") +Reviewed-by: Abhinav Kumar +Signed-off-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/629956/ +Link: https://lore.kernel.org/r/20241220-dpu-fix-catalog-v2-4-38fa961ea992@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_0_sm8250.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_0_sm8250.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_0_sm8250.h +index a57d50b1f0280..e8916ae826a6d 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_0_sm8250.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_0_sm8250.h +@@ -162,6 +162,7 @@ static const struct dpu_lm_cfg sm8250_lm[] = { + .sblk = &sdm845_lm_sblk, + .lm_pair = LM_3, + .pingpong = PINGPONG_2, ++ .dspp = DSPP_2, + }, { + .name = "lm_3", .id = LM_3, + .base = 0x47000, .len = 0x320, +@@ -169,6 +170,7 @@ static const struct dpu_lm_cfg sm8250_lm[] = { + .sblk = &sdm845_lm_sblk, + .lm_pair = LM_2, + .pingpong = PINGPONG_3, ++ .dspp = DSPP_3, + }, { + .name = "lm_4", .id = LM_4, + .base = 0x48000, .len = 0x320, +-- +2.39.5 + diff --git a/queue-6.12/drm-msm-dpu-link-dspp_2-_3-blocks-on-sm8350.patch b/queue-6.12/drm-msm-dpu-link-dspp_2-_3-blocks-on-sm8350.patch new file mode 100644 index 0000000000..17797bc655 --- /dev/null +++ b/queue-6.12/drm-msm-dpu-link-dspp_2-_3-blocks-on-sm8350.patch @@ -0,0 +1,46 @@ +From c74e1e860200ae5c36e6662991d94f24b8d53f8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2024 03:28:33 +0200 +Subject: drm/msm/dpu: link DSPP_2/_3 blocks on SM8350 + +From: Dmitry Baryshkov + +[ Upstream commit 42323d3c9e04c725d27606c31663b80a7cc30218 ] + +Link DSPP_2 to the LM_2 and DSPP_3 to the LM_3 mixer blocks. This allows +using colour transformation matrix (aka night mode) with more outputs at +the same time. + +Fixes: 0e91bcbb0016 ("drm/msm/dpu: Add SM8350 to hw catalog") +Reviewed-by: Abhinav Kumar +Signed-off-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/629959/ +Link: https://lore.kernel.org/r/20241220-dpu-fix-catalog-v2-5-38fa961ea992@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_0_sm8350.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_0_sm8350.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_0_sm8350.h +index aced16e350daa..f7c08e89c8820 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_0_sm8350.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_0_sm8350.h +@@ -162,6 +162,7 @@ static const struct dpu_lm_cfg sm8350_lm[] = { + .sblk = &sdm845_lm_sblk, + .lm_pair = LM_3, + .pingpong = PINGPONG_2, ++ .dspp = DSPP_2, + }, { + .name = "lm_3", .id = LM_3, + .base = 0x47000, .len = 0x320, +@@ -169,6 +170,7 @@ static const struct dpu_lm_cfg sm8350_lm[] = { + .sblk = &sdm845_lm_sblk, + .lm_pair = LM_2, + .pingpong = PINGPONG_3, ++ .dspp = DSPP_3, + }, { + .name = "lm_4", .id = LM_4, + .base = 0x48000, .len = 0x320, +-- +2.39.5 + diff --git a/queue-6.12/drm-msm-dpu-link-dspp_2-_3-blocks-on-sm8550.patch b/queue-6.12/drm-msm-dpu-link-dspp_2-_3-blocks-on-sm8550.patch new file mode 100644 index 0000000000..cf3592f8ba --- /dev/null +++ b/queue-6.12/drm-msm-dpu-link-dspp_2-_3-blocks-on-sm8550.patch @@ -0,0 +1,46 @@ +From a39163bbd35208c590b3b6aafa423c7ac74249c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2024 03:28:34 +0200 +Subject: drm/msm/dpu: link DSPP_2/_3 blocks on SM8550 + +From: Dmitry Baryshkov + +[ Upstream commit e21f9d85b05361bc343b11ecf84ac12c9cccbc3e ] + +Link DSPP_2 to the LM_2 and DSPP_3 to the LM_3 mixer blocks. This allows +using colour transformation matrix (aka night mode) with more outputs at +the same time. + +Fixes: efcd0107727c ("drm/msm/dpu: add support for SM8550") +Reviewed-by: Abhinav Kumar +Signed-off-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/629961/ +Link: https://lore.kernel.org/r/20241220-dpu-fix-catalog-v2-6-38fa961ea992@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_9_0_sm8550.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_9_0_sm8550.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_9_0_sm8550.h +index ad48defa154f7..a1dbbf5c652ff 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_9_0_sm8550.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_9_0_sm8550.h +@@ -160,6 +160,7 @@ static const struct dpu_lm_cfg sm8550_lm[] = { + .sblk = &sdm845_lm_sblk, + .lm_pair = LM_3, + .pingpong = PINGPONG_2, ++ .dspp = DSPP_2, + }, { + .name = "lm_3", .id = LM_3, + .base = 0x47000, .len = 0x320, +@@ -167,6 +168,7 @@ static const struct dpu_lm_cfg sm8550_lm[] = { + .sblk = &sdm845_lm_sblk, + .lm_pair = LM_2, + .pingpong = PINGPONG_3, ++ .dspp = DSPP_3, + }, { + .name = "lm_4", .id = LM_4, + .base = 0x48000, .len = 0x320, +-- +2.39.5 + diff --git a/queue-6.12/drm-msm-dpu-link-dspp_2-_3-blocks-on-sm8650.patch b/queue-6.12/drm-msm-dpu-link-dspp_2-_3-blocks-on-sm8650.patch new file mode 100644 index 0000000000..85d2dd515e --- /dev/null +++ b/queue-6.12/drm-msm-dpu-link-dspp_2-_3-blocks-on-sm8650.patch @@ -0,0 +1,46 @@ +From 4d7a45c263d3b7a9702d50cc81fa431af76de06b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2024 03:28:35 +0200 +Subject: drm/msm/dpu: link DSPP_2/_3 blocks on SM8650 + +From: Dmitry Baryshkov + +[ Upstream commit 3d3ca0915aa3692a837f7235ca9d12db26f09911 ] + +Link DSPP_2 to the LM_2 and DSPP_3 to the LM_3 mixer blocks. This allows +using colour transformation matrix (aka night mode) with more outputs at +the same time. + +Fixes: b94747f7d8c7 ("drm/msm/dpu: add support for SM8650 DPU") +Reviewed-by: Abhinav Kumar +Signed-off-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/629962/ +Link: https://lore.kernel.org/r/20241220-dpu-fix-catalog-v2-7-38fa961ea992@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_10_0_sm8650.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_10_0_sm8650.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_10_0_sm8650.h +index eb5dfff2ec4f4..e187e7b1cef16 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_10_0_sm8650.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_10_0_sm8650.h +@@ -160,6 +160,7 @@ static const struct dpu_lm_cfg sm8650_lm[] = { + .sblk = &sdm845_lm_sblk, + .lm_pair = LM_3, + .pingpong = PINGPONG_2, ++ .dspp = DSPP_2, + }, { + .name = "lm_3", .id = LM_3, + .base = 0x47000, .len = 0x400, +@@ -167,6 +168,7 @@ static const struct dpu_lm_cfg sm8650_lm[] = { + .sblk = &sdm845_lm_sblk, + .lm_pair = LM_2, + .pingpong = PINGPONG_3, ++ .dspp = DSPP_3, + }, { + .name = "lm_4", .id = LM_4, + .base = 0x48000, .len = 0x400, +-- +2.39.5 + diff --git a/queue-6.12/drm-msm-dpu-link-dspp_2-_3-blocks-on-x1e80100.patch b/queue-6.12/drm-msm-dpu-link-dspp_2-_3-blocks-on-x1e80100.patch new file mode 100644 index 0000000000..5b61442019 --- /dev/null +++ b/queue-6.12/drm-msm-dpu-link-dspp_2-_3-blocks-on-x1e80100.patch @@ -0,0 +1,46 @@ +From 633946365a6586c7fa4dafedb360c2caa191c4ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2024 03:28:36 +0200 +Subject: drm/msm/dpu: link DSPP_2/_3 blocks on X1E80100 + +From: Dmitry Baryshkov + +[ Upstream commit 3a7a4bebe0dbe22686da7de573f183e0c842883a ] + +Link DSPP_2 to the LM_2 and DSPP_3 to the LM_3 mixer blocks. This allows +using colour transformation matrix (aka night mode) with more outputs at +the same time. + +Fixes: e3b1f369db5a ("drm/msm/dpu: Add X1E80100 support") +Reviewed-by: Abhinav Kumar +Signed-off-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/629966/ +Link: https://lore.kernel.org/r/20241220-dpu-fix-catalog-v2-8-38fa961ea992@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_9_2_x1e80100.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_9_2_x1e80100.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_9_2_x1e80100.h +index a3e60ac70689e..e084406ebb071 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_9_2_x1e80100.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_9_2_x1e80100.h +@@ -159,6 +159,7 @@ static const struct dpu_lm_cfg x1e80100_lm[] = { + .sblk = &sdm845_lm_sblk, + .lm_pair = LM_3, + .pingpong = PINGPONG_2, ++ .dspp = DSPP_2, + }, { + .name = "lm_3", .id = LM_3, + .base = 0x47000, .len = 0x320, +@@ -166,6 +167,7 @@ static const struct dpu_lm_cfg x1e80100_lm[] = { + .sblk = &sdm845_lm_sblk, + .lm_pair = LM_2, + .pingpong = PINGPONG_3, ++ .dspp = DSPP_3, + }, { + .name = "lm_4", .id = LM_4, + .base = 0x48000, .len = 0x320, +-- +2.39.5 + diff --git a/queue-6.12/drm-msm-dpu-provide-dspp-and-correct-lm-config-for-s.patch b/queue-6.12/drm-msm-dpu-provide-dspp-and-correct-lm-config-for-s.patch new file mode 100644 index 0000000000..9dd76bee02 --- /dev/null +++ b/queue-6.12/drm-msm-dpu-provide-dspp-and-correct-lm-config-for-s.patch @@ -0,0 +1,98 @@ +From 9bcc31c0dc99d9e4f67021845504501617605d1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2024 03:28:29 +0200 +Subject: drm/msm/dpu: provide DSPP and correct LM config for SDM670 + +From: Dmitry Baryshkov + +[ Upstream commit 9a20f33495bfd45ca6712213f30697f686d0b6fd ] + +On SDM670 the DPU has two DSPP blocks compared to 4 DSPP blocks on +SDM845. Currently SDM670 just reuses LMs and DSPPs from SDM845. Define +platform-specific configuration for those blocks. + +Fixes: e140b7e496b7 ("drm/msm/dpu: Add hw revision 4.1 (SDM670)") +Reviewed-by: Abhinav Kumar +Signed-off-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/629951/ +Link: https://lore.kernel.org/r/20241220-dpu-fix-catalog-v2-1-38fa961ea992@linaro.org +Signed-off-by: Sasha Levin +--- + .../msm/disp/dpu1/catalog/dpu_4_1_sdm670.h | 54 ++++++++++++++++++- + 1 file changed, 52 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_4_1_sdm670.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_4_1_sdm670.h +index cbbdaebe357ec..daef07924886a 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_4_1_sdm670.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_4_1_sdm670.h +@@ -65,6 +65,54 @@ static const struct dpu_sspp_cfg sdm670_sspp[] = { + }, + }; + ++static const struct dpu_lm_cfg sdm670_lm[] = { ++ { ++ .name = "lm_0", .id = LM_0, ++ .base = 0x44000, .len = 0x320, ++ .features = MIXER_SDM845_MASK, ++ .sblk = &sdm845_lm_sblk, ++ .lm_pair = LM_1, ++ .pingpong = PINGPONG_0, ++ .dspp = DSPP_0, ++ }, { ++ .name = "lm_1", .id = LM_1, ++ .base = 0x45000, .len = 0x320, ++ .features = MIXER_SDM845_MASK, ++ .sblk = &sdm845_lm_sblk, ++ .lm_pair = LM_0, ++ .pingpong = PINGPONG_1, ++ .dspp = DSPP_1, ++ }, { ++ .name = "lm_2", .id = LM_2, ++ .base = 0x46000, .len = 0x320, ++ .features = MIXER_SDM845_MASK, ++ .sblk = &sdm845_lm_sblk, ++ .lm_pair = LM_5, ++ .pingpong = PINGPONG_2, ++ }, { ++ .name = "lm_5", .id = LM_5, ++ .base = 0x49000, .len = 0x320, ++ .features = MIXER_SDM845_MASK, ++ .sblk = &sdm845_lm_sblk, ++ .lm_pair = LM_2, ++ .pingpong = PINGPONG_3, ++ }, ++}; ++ ++static const struct dpu_dspp_cfg sdm670_dspp[] = { ++ { ++ .name = "dspp_0", .id = DSPP_0, ++ .base = 0x54000, .len = 0x1800, ++ .features = DSPP_SC7180_MASK, ++ .sblk = &sdm845_dspp_sblk, ++ }, { ++ .name = "dspp_1", .id = DSPP_1, ++ .base = 0x56000, .len = 0x1800, ++ .features = DSPP_SC7180_MASK, ++ .sblk = &sdm845_dspp_sblk, ++ }, ++}; ++ + static const struct dpu_dsc_cfg sdm670_dsc[] = { + { + .name = "dsc_0", .id = DSC_0, +@@ -88,8 +136,10 @@ const struct dpu_mdss_cfg dpu_sdm670_cfg = { + .ctl = sdm845_ctl, + .sspp_count = ARRAY_SIZE(sdm670_sspp), + .sspp = sdm670_sspp, +- .mixer_count = ARRAY_SIZE(sdm845_lm), +- .mixer = sdm845_lm, ++ .mixer_count = ARRAY_SIZE(sdm670_lm), ++ .mixer = sdm670_lm, ++ .dspp_count = ARRAY_SIZE(sdm670_dspp), ++ .dspp = sdm670_dspp, + .pingpong_count = ARRAY_SIZE(sdm845_pp), + .pingpong = sdm845_pp, + .dsc_count = ARRAY_SIZE(sdm670_dsc), +-- +2.39.5 + diff --git a/queue-6.12/drm-msm-hdmi-simplify-code-in-pll_get_integloop_gain.patch b/queue-6.12/drm-msm-hdmi-simplify-code-in-pll_get_integloop_gain.patch new file mode 100644 index 0000000000..66d6f0ca1a --- /dev/null +++ b/queue-6.12/drm-msm-hdmi-simplify-code-in-pll_get_integloop_gain.patch @@ -0,0 +1,41 @@ +From ef050c45a88fc24a1f53cbc7e267490d49887ce3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Nov 2024 15:41:00 +0800 +Subject: drm/msm/hdmi: simplify code in pll_get_integloop_gain + +From: Rex Nie + +[ Upstream commit c1beb6f75d5e60e4e57a837c665a52eb79eb19ba ] + +In pll_get_integloop_gain(), digclk_divsel=1 or 2, base=63 or 196ULL, +so the base may be 63, 126, 196, 392. The condition base <= 2046 +always true. + +Fixes: caedbf17c48d ("drm/msm: add msm8998 hdmi phy/pll support") +Signed-off-by: Rex Nie +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/624153/ +Link: https://lore.kernel.org/r/20241112074101.2206-1-rex.nie@jaguarmicro.com +Signed-off-by: Abhinav Kumar +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/hdmi/hdmi_phy_8998.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_phy_8998.c b/drivers/gpu/drm/msm/hdmi/hdmi_phy_8998.c +index e6ffaf92d26d3..1c4211cfa2a47 100644 +--- a/drivers/gpu/drm/msm/hdmi/hdmi_phy_8998.c ++++ b/drivers/gpu/drm/msm/hdmi/hdmi_phy_8998.c +@@ -137,7 +137,7 @@ static inline u32 pll_get_integloop_gain(u64 frac_start, u64 bclk, u32 ref_clk, + + base <<= (digclk_divsel == 2 ? 1 : 0); + +- return (base <= 2046 ? base : 2046); ++ return base; + } + + static inline u32 pll_get_pll_cmp(u64 fdata, unsigned long ref_clk) +-- +2.39.5 + diff --git a/queue-6.12/drm-msm-mdp4-correct-lcdc-regulator-name.patch b/queue-6.12/drm-msm-mdp4-correct-lcdc-regulator-name.patch new file mode 100644 index 0000000000..668d9d9ca1 --- /dev/null +++ b/queue-6.12/drm-msm-mdp4-correct-lcdc-regulator-name.patch @@ -0,0 +1,38 @@ +From 98214f94c14746b228ad6b4bf43522e5395a2c20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Apr 2024 05:33:03 +0300 +Subject: drm/msm/mdp4: correct LCDC regulator name + +From: Dmitry Baryshkov + +[ Upstream commit 8aa337cbe7a61a5a98a4d3f446fc968b3bac914a ] + +Correct c&p error from the conversion of LCDC regulators to the bulk +API. + +Fixes: 54f1fbcb47d4 ("drm/msm/mdp4: use bulk regulators API for LCDC encoder") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/590412/ +Link: https://lore.kernel.org/r/20240420-mdp4-fixes-v1-3-96a70f64fa85@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/mdp4/mdp4_lcdc_encoder.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_lcdc_encoder.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_lcdc_encoder.c +index 576995ddce37e..8bbc7fb881d59 100644 +--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_lcdc_encoder.c ++++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_lcdc_encoder.c +@@ -389,7 +389,7 @@ struct drm_encoder *mdp4_lcdc_encoder_init(struct drm_device *dev, + + /* TODO: different regulators in other cases? */ + mdp4_lcdc_encoder->regs[0].supply = "lvds-vccs-3p3v"; +- mdp4_lcdc_encoder->regs[1].supply = "lvds-vccs-3p3v"; ++ mdp4_lcdc_encoder->regs[1].supply = "lvds-pll-vdda"; + mdp4_lcdc_encoder->regs[2].supply = "lvds-vdda"; + + ret = devm_regulator_bulk_get(dev->dev, +-- +2.39.5 + diff --git a/queue-6.12/drm-panthor-preserve-the-result-returned-by-panthor_.patch b/queue-6.12/drm-panthor-preserve-the-result-returned-by-panthor_.patch new file mode 100644 index 0000000000..2ba333ebbc --- /dev/null +++ b/queue-6.12/drm-panthor-preserve-the-result-returned-by-panthor_.patch @@ -0,0 +1,46 @@ +From 7f81daf8b779d227dccf5da53a11b9eafe66d53d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 08:54:15 +0100 +Subject: drm/panthor: Preserve the result returned by panthor_fw_resume() + +From: Boris Brezillon + +[ Upstream commit 4bd56ca8226dda6115bca385b166ef87e867d807 ] + +WARN() will return true if the condition is true, false otherwise. +If we store the return of drm_WARN_ON() in ret, we lose the actual +error code. + +v3: +- Add R-b +v2: +- Add R-b + +Fixes: 5fe909cae118 ("drm/panthor: Add the device logical block") +Signed-off-by: Boris Brezillon +Reviewed-by: Steven Price +Reviewed-by: Adrian Larumbe +Link: https://patchwork.freedesktop.org/patch/msgid/20241211075419.2333731-2-boris.brezillon@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panthor/panthor_device.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/panthor/panthor_device.c b/drivers/gpu/drm/panthor/panthor_device.c +index 6fbff516c1c1f..01dff89bed4e1 100644 +--- a/drivers/gpu/drm/panthor/panthor_device.c ++++ b/drivers/gpu/drm/panthor/panthor_device.c +@@ -445,8 +445,8 @@ int panthor_device_resume(struct device *dev) + drm_dev_enter(&ptdev->base, &cookie)) { + panthor_gpu_resume(ptdev); + panthor_mmu_resume(ptdev); +- ret = drm_WARN_ON(&ptdev->base, panthor_fw_resume(ptdev)); +- if (!ret) { ++ ret = panthor_fw_resume(ptdev); ++ if (!drm_WARN_ON(&ptdev->base, ret)) { + panthor_sched_resume(ptdev); + } else { + panthor_mmu_suspend(ptdev); +-- +2.39.5 + diff --git a/queue-6.12/drm-rockchip-vop2-add-check-for-32-bpp-format-for-rk.patch b/queue-6.12/drm-rockchip-vop2-add-check-for-32-bpp-format-for-rk.patch new file mode 100644 index 0000000000..eb1ed78056 --- /dev/null +++ b/queue-6.12/drm-rockchip-vop2-add-check-for-32-bpp-format-for-rk.patch @@ -0,0 +1,43 @@ +From 3c1248e20ec718c43c12046a04671345b3f5b9fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Dec 2024 16:17:05 +0800 +Subject: drm/rockchip: vop2: Add check for 32 bpp format for rk3588 + +From: Andy Yan + +[ Upstream commit 7e8a56c703c67bfa8d3f71a0c1c297bb1252b897 ] + +RK3588 only support DRM_FORMAT_XRGB2101010/XBGR2101010 in afbc mode. + +Fixes: 5a028e8f062f ("drm/rockchip: vop2: Add support for rk3588") +Signed-off-by: Andy Yan +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20241214081719.3330518-7-andyshrk@163.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +index 2abc68fe2d1ff..6082b1c179aeb 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +@@ -560,6 +560,15 @@ static bool rockchip_vop2_mod_supported(struct drm_plane *plane, u32 format, + } + } + ++ if (format == DRM_FORMAT_XRGB2101010 || format == DRM_FORMAT_XBGR2101010) { ++ if (vop2->data->soc_id == 3588) { ++ if (!rockchip_afbc(plane, modifier)) { ++ drm_dbg_kms(vop2->drm, "Only support 32 bpp format with afbc\n"); ++ return false; ++ } ++ } ++ } ++ + if (modifier == DRM_FORMAT_MOD_LINEAR) + return true; + +-- +2.39.5 + diff --git a/queue-6.12/drm-rockchip-vop2-check-linear-format-for-cluster-wi.patch b/queue-6.12/drm-rockchip-vop2-check-linear-format-for-cluster-wi.patch new file mode 100644 index 0000000000..4af74b0fa5 --- /dev/null +++ b/queue-6.12/drm-rockchip-vop2-check-linear-format-for-cluster-wi.patch @@ -0,0 +1,45 @@ +From 1d1dd29ab81d05e8b67fedf16ac5d97a036660d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Dec 2024 16:17:04 +0800 +Subject: drm/rockchip: vop2: Check linear format for Cluster windows on + rk3566/8 + +From: Andy Yan + +[ Upstream commit df063c0b8ffbdca486ab2f802e716973985d8f86 ] + +The Cluster windows on rk3566/8 only support afbc mode. + +Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver") +Signed-off-by: Andy Yan +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20241214081719.3330518-6-andyshrk@163.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +index 68b5c438cdaba..2abc68fe2d1ff 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +@@ -550,6 +550,16 @@ static bool rockchip_vop2_mod_supported(struct drm_plane *plane, u32 format, + if (modifier == DRM_FORMAT_MOD_INVALID) + return false; + ++ if (vop2->data->soc_id == 3568 || vop2->data->soc_id == 3566) { ++ if (vop2_cluster_window(win)) { ++ if (modifier == DRM_FORMAT_MOD_LINEAR) { ++ drm_dbg_kms(vop2->drm, ++ "Cluster window only supports format with afbc\n"); ++ return false; ++ } ++ } ++ } ++ + if (modifier == DRM_FORMAT_MOD_LINEAR) + return true; + +-- +2.39.5 + diff --git a/queue-6.12/drm-rockchip-vop2-fix-cluster-windows-alpha-ctrl-reg.patch b/queue-6.12/drm-rockchip-vop2-fix-cluster-windows-alpha-ctrl-reg.patch new file mode 100644 index 0000000000..438d7dd58b --- /dev/null +++ b/queue-6.12/drm-rockchip-vop2-fix-cluster-windows-alpha-ctrl-reg.patch @@ -0,0 +1,67 @@ +From 3420daaadfde8c19c739bdddd80b700e30b362bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Dec 2024 20:29:15 +0800 +Subject: drm/rockchip: vop2: Fix cluster windows alpha ctrl regsiters offset + +From: Andy Yan + +[ Upstream commit 17b4b10a0df1a1421d5fbdc03bad0bd3799bc966 ] + +The phy_id of cluster windws are not increase one for each window. + +Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver") +Tested-by: Derek Foreman +Signed-off-by: Andy Yan +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20241209122943.2781431-6-andyshrk@163.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +index 30d03ff6c01f0..594923303a850 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +@@ -2159,7 +2159,6 @@ static int vop2_find_start_mixer_id_for_vp(struct vop2 *vop2, u8 port_id) + + static void vop2_setup_cluster_alpha(struct vop2 *vop2, struct vop2_win *main_win) + { +- u32 offset = (main_win->data->phys_id * 0x10); + struct vop2_alpha_config alpha_config; + struct vop2_alpha alpha; + struct drm_plane_state *bottom_win_pstate; +@@ -2167,6 +2166,7 @@ static void vop2_setup_cluster_alpha(struct vop2 *vop2, struct vop2_win *main_wi + u16 src_glb_alpha_val, dst_glb_alpha_val; + bool premulti_en = false; + bool swap = false; ++ u32 offset = 0; + + /* At one win mode, win0 is dst/bottom win, and win1 is a all zero src/top win */ + bottom_win_pstate = main_win->base.state; +@@ -2185,6 +2185,22 @@ static void vop2_setup_cluster_alpha(struct vop2 *vop2, struct vop2_win *main_wi + vop2_parse_alpha(&alpha_config, &alpha); + + alpha.src_color_ctrl.bits.src_dst_swap = swap; ++ ++ switch (main_win->data->phys_id) { ++ case ROCKCHIP_VOP2_CLUSTER0: ++ offset = 0x0; ++ break; ++ case ROCKCHIP_VOP2_CLUSTER1: ++ offset = 0x10; ++ break; ++ case ROCKCHIP_VOP2_CLUSTER2: ++ offset = 0x20; ++ break; ++ case ROCKCHIP_VOP2_CLUSTER3: ++ offset = 0x30; ++ break; ++ } ++ + vop2_writel(vop2, RK3568_CLUSTER0_MIX_SRC_COLOR_CTRL + offset, + alpha.src_color_ctrl.val); + vop2_writel(vop2, RK3568_CLUSTER0_MIX_DST_COLOR_CTRL + offset, +-- +2.39.5 + diff --git a/queue-6.12/drm-rockchip-vop2-fix-rk3588-dp-dsi-maxclk-verificat.patch b/queue-6.12/drm-rockchip-vop2-fix-rk3588-dp-dsi-maxclk-verificat.patch new file mode 100644 index 0000000000..cebaf473c9 --- /dev/null +++ b/queue-6.12/drm-rockchip-vop2-fix-rk3588-dp-dsi-maxclk-verificat.patch @@ -0,0 +1,57 @@ +From 702bb624eefae37ebf70745288c94e9a2bf42b47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Nov 2024 16:11:31 +0100 +Subject: drm/rockchip: vop2: fix rk3588 dp+dsi maxclk verification + +From: Heiko Stuebner + +[ Upstream commit 5807f4ee6d32a4cce9a4df36f0d455c64c861947 ] + +The clock is in Hz while the value checked against is in kHz, so +actual frequencies will never be able to be below to max value. +Fix this by specifying the max-value in Hz too. + +Fixes: 5a028e8f062f ("drm/rockchip: vop2: Add support for rk3588") +Signed-off-by: Heiko Stuebner +Reviewed-by: Quentin Schulz +Acked-by: Andy Yan +Reviewed-by: Sebastian Reichel +Tested-by: Sebastian Reichel +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20241115151131.416830-1-heiko@sntech.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +index 9873172e3fd33..30d03ff6c01f0 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +@@ -1721,9 +1721,9 @@ static unsigned long rk3588_calc_cru_cfg(struct vop2_video_port *vp, int id, + else + dclk_out_rate = v_pixclk >> 2; + +- dclk_rate = rk3588_calc_dclk(dclk_out_rate, 600000); ++ dclk_rate = rk3588_calc_dclk(dclk_out_rate, 600000000); + if (!dclk_rate) { +- drm_err(vop2->drm, "DP dclk_out_rate out of range, dclk_out_rate: %ld KHZ\n", ++ drm_err(vop2->drm, "DP dclk_out_rate out of range, dclk_out_rate: %ld Hz\n", + dclk_out_rate); + return 0; + } +@@ -1738,9 +1738,9 @@ static unsigned long rk3588_calc_cru_cfg(struct vop2_video_port *vp, int id, + * dclk_rate = N * dclk_core_rate N = (1,2,4 ), + * we get a little factor here + */ +- dclk_rate = rk3588_calc_dclk(dclk_out_rate, 600000); ++ dclk_rate = rk3588_calc_dclk(dclk_out_rate, 600000000); + if (!dclk_rate) { +- drm_err(vop2->drm, "MIPI dclk out of range, dclk_out_rate: %ld KHZ\n", ++ drm_err(vop2->drm, "MIPI dclk out of range, dclk_out_rate: %ld Hz\n", + dclk_out_rate); + return 0; + } +-- +2.39.5 + diff --git a/queue-6.12/drm-rockchip-vop2-fix-the-mixer-alpha-setup-for-laye.patch b/queue-6.12/drm-rockchip-vop2-fix-the-mixer-alpha-setup-for-laye.patch new file mode 100644 index 0000000000..dee87c1340 --- /dev/null +++ b/queue-6.12/drm-rockchip-vop2-fix-the-mixer-alpha-setup-for-laye.patch @@ -0,0 +1,45 @@ +From b7861563f29d9898b4ecb0db477cf59815a0946a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Dec 2024 20:29:16 +0800 +Subject: drm/rockchip: vop2: Fix the mixer alpha setup for layer 0 + +From: Andy Yan + +[ Upstream commit 6b4dfdcde3573a12b72d2869dabd4ca37ad7e9c7 ] + +The alpha setup should start from the second layer, the current calculation +starts incorrectly from the first layer, a negative offset will be obtained +in the following formula: + +offset = (mixer_id + zpos - 1) * 0x10 + +Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver") +Tested-by: Derek Foreman +Signed-off-by: Andy Yan +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20241209122943.2781431-7-andyshrk@163.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +index 594923303a850..630a204440ba8 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +@@ -2248,6 +2248,12 @@ static void vop2_setup_alpha(struct vop2_video_port *vp) + struct vop2_win *win = to_vop2_win(plane); + int zpos = plane->state->normalized_zpos; + ++ /* ++ * Need to configure alpha from second layer. ++ */ ++ if (zpos == 0) ++ continue; ++ + if (plane->state->pixel_blend_mode == DRM_MODE_BLEND_PREMULTI) + premulti_en = 1; + else +-- +2.39.5 + diff --git a/queue-6.12/drm-rockchip-vop2-fix-the-windows-switch-between-dif.patch b/queue-6.12/drm-rockchip-vop2-fix-the-windows-switch-between-dif.patch new file mode 100644 index 0000000000..196a31b4ed --- /dev/null +++ b/queue-6.12/drm-rockchip-vop2-fix-the-windows-switch-between-dif.patch @@ -0,0 +1,106 @@ +From 38d6ae6ca40b8a5e0a89e63c23ec322a93da19ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Dec 2024 16:17:01 +0800 +Subject: drm/rockchip: vop2: Fix the windows switch between different layers + +From: Andy Yan + +[ Upstream commit 0ca953ac226eaffbe1a795f5e517095a8d494921 ] + +Every layer of vop2 should bind a window, and we also need to make +sure that this window is not used by other layer. + +0x5 is a reserved layer sel value on rk3568, but it will select +Cluster3 on rk3588, configure unused layers to 0x5 will lead +alpha blending error on rk3588. + +When we bind a window from layerM to layerN, we move the old window +on layerN to layerM. + +Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver") +Tested-by: Derek Foreman +Signed-off-by: Andy Yan +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20241214081719.3330518-3-andyshrk@163.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 47 ++++++++++++++------ + 1 file changed, 34 insertions(+), 13 deletions(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +index 630a204440ba8..60b498ffd41aa 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +@@ -2330,7 +2330,10 @@ static void vop2_setup_layer_mixer(struct vop2_video_port *vp) + struct drm_plane *plane; + u32 layer_sel = 0; + u32 port_sel; +- unsigned int nlayer, ofs; ++ u8 layer_id; ++ u8 old_layer_id; ++ u8 layer_sel_id; ++ unsigned int ofs; + u32 ovl_ctrl; + int i; + struct vop2_video_port *vp0 = &vop2->vps[0]; +@@ -2374,9 +2377,30 @@ static void vop2_setup_layer_mixer(struct vop2_video_port *vp) + for (i = 0; i < vp->id; i++) + ofs += vop2->vps[i].nlayers; + +- nlayer = 0; + drm_atomic_crtc_for_each_plane(plane, &vp->crtc) { + struct vop2_win *win = to_vop2_win(plane); ++ struct vop2_win *old_win; ++ ++ layer_id = (u8)(plane->state->normalized_zpos + ofs); ++ ++ /* ++ * Find the layer this win bind in old state. ++ */ ++ for (old_layer_id = 0; old_layer_id < vop2->data->win_size; old_layer_id++) { ++ layer_sel_id = (layer_sel >> (4 * old_layer_id)) & 0xf; ++ if (layer_sel_id == win->data->layer_sel_id) ++ break; ++ } ++ ++ /* ++ * Find the win bind to this layer in old state ++ */ ++ for (i = 0; i < vop2->data->win_size; i++) { ++ old_win = &vop2->win[i]; ++ layer_sel_id = (layer_sel >> (4 * layer_id)) & 0xf; ++ if (layer_sel_id == old_win->data->layer_sel_id) ++ break; ++ } + + switch (win->data->phys_id) { + case ROCKCHIP_VOP2_CLUSTER0: +@@ -2421,17 +2445,14 @@ static void vop2_setup_layer_mixer(struct vop2_video_port *vp) + break; + } + +- layer_sel &= ~RK3568_OVL_LAYER_SEL__LAYER(plane->state->normalized_zpos + ofs, +- 0x7); +- layer_sel |= RK3568_OVL_LAYER_SEL__LAYER(plane->state->normalized_zpos + ofs, +- win->data->layer_sel_id); +- nlayer++; +- } +- +- /* configure unused layers to 0x5 (reserved) */ +- for (; nlayer < vp->nlayers; nlayer++) { +- layer_sel &= ~RK3568_OVL_LAYER_SEL__LAYER(nlayer + ofs, 0x7); +- layer_sel |= RK3568_OVL_LAYER_SEL__LAYER(nlayer + ofs, 5); ++ layer_sel &= ~RK3568_OVL_LAYER_SEL__LAYER(layer_id, 0x7); ++ layer_sel |= RK3568_OVL_LAYER_SEL__LAYER(layer_id, win->data->layer_sel_id); ++ /* ++ * When we bind a window from layerM to layerN, we also need to move the old ++ * window on layerN to layerM to avoid one window selected by two or more layers. ++ */ ++ layer_sel &= ~RK3568_OVL_LAYER_SEL__LAYER(old_layer_id, 0x7); ++ layer_sel |= RK3568_OVL_LAYER_SEL__LAYER(old_layer_id, old_win->data->layer_sel_id); + } + + vop2_writel(vop2, RK3568_OVL_LAYER_SEL, layer_sel); +-- +2.39.5 + diff --git a/queue-6.12/drm-rockchip-vop2-include-rockchip_drm_drv.h.patch b/queue-6.12/drm-rockchip-vop2-include-rockchip_drm_drv.h.patch new file mode 100644 index 0000000000..9eabdbb7d3 --- /dev/null +++ b/queue-6.12/drm-rockchip-vop2-include-rockchip_drm_drv.h.patch @@ -0,0 +1,62 @@ +From 4e64554716b92a473f29e326f21dd0d5909ba656 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Dec 2024 16:17:06 +0800 +Subject: drm/rockchip: vop2: include rockchip_drm_drv.h + +From: Min-Hua Chen + +[ Upstream commit 77b1ccb2a27c7b3b118a03bf1730def92070d31b ] + +Move rockchip_drm_drv.h in rockchip_drm_vop2.h to fix the follow +sparse warning: + +ARCH=arm64 LLVM=1 make C=1 CF='-fdiagnostic-prefix -D__CHECK_ENDIAN__' +mrproper defconfig all -j12 + +drivers/gpu/drm/rockchip/rockchip_vop2_reg.c:502:24: sparse: +warning: symbol 'vop2_platform_driver' was not declared. Should it +be static? + +It is also beneficial for the upcoming support for rk3576. + +Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver") +Signed-off-by: Min-Hua Chen +Signed-off-by: Andy Yan +Reviewed-by: Min-Hua Chen +Tested-by: Detlev Casanova +Tested-by: Michael Riesch # on RK3568 +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20241214081719.3330518-8-andyshrk@163.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 1 - + drivers/gpu/drm/rockchip/rockchip_drm_vop2.h | 1 + + 2 files changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +index 6082b1c179aeb..5880d87fe6b3a 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +@@ -33,7 +33,6 @@ + #include + #include + +-#include "rockchip_drm_drv.h" + #include "rockchip_drm_gem.h" + #include "rockchip_drm_vop2.h" + #include "rockchip_rgb.h" +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.h b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.h +index 1c4204324f9f5..130aaa40316d1 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.h ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.h +@@ -9,6 +9,7 @@ + + #include + #include ++#include "rockchip_drm_drv.h" + #include "rockchip_drm_vop.h" + + #define VOP2_VP_FEATURE_OUTPUT_10BIT BIT(0) +-- +2.39.5 + diff --git a/queue-6.12/drm-rockchip-vop2-set-axi-id-for-rk3588.patch b/queue-6.12/drm-rockchip-vop2-set-axi-id-for-rk3588.patch new file mode 100644 index 0000000000..65ba053570 --- /dev/null +++ b/queue-6.12/drm-rockchip-vop2-set-axi-id-for-rk3588.patch @@ -0,0 +1,204 @@ +From c1d4ea2a18f019c31d95f54d1d17c407248ec874 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Dec 2024 16:17:02 +0800 +Subject: drm/rockchip: vop2: Set AXI id for rk3588 + +From: Andy Yan + +[ Upstream commit 7b256880fdb2d7f23393b87bb557090f049e686a ] + +There are two AXI bus in vop2, windows attached on the same bus must +have a unique channel YUV and RGB channel ID. + +The default IDs will conflict with each other on the rk3588, so they +need to be reassigned. + +Fixes: 5a028e8f062f ("drm/rockchip: vop2: Add support for rk3588") +Signed-off-by: Andy Yan +Tested-by: Derek Foreman +Tested-by: Detlev Casanova +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20241214081719.3330518-4-andyshrk@163.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 14 +++++++++++ + drivers/gpu/drm/rockchip/rockchip_drm_vop2.h | 9 +++++++ + drivers/gpu/drm/rockchip/rockchip_vop2_reg.c | 26 +++++++++++++++++++- + 3 files changed, 48 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +index 60b498ffd41aa..cd3fb906d0089 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +@@ -1320,6 +1320,12 @@ static void vop2_plane_atomic_update(struct drm_plane *plane, + &fb->format->format, + afbc_en ? "AFBC" : "", &yrgb_mst); + ++ if (vop2->data->soc_id > 3568) { ++ vop2_win_write(win, VOP2_WIN_AXI_BUS_ID, win->data->axi_bus_id); ++ vop2_win_write(win, VOP2_WIN_AXI_YRGB_R_ID, win->data->axi_yrgb_r_id); ++ vop2_win_write(win, VOP2_WIN_AXI_UV_R_ID, win->data->axi_uv_r_id); ++ } ++ + if (vop2_cluster_window(win)) + vop2_win_write(win, VOP2_WIN_AFBC_HALF_BLOCK_EN, half_block_en); + +@@ -2908,6 +2914,10 @@ static struct reg_field vop2_cluster_regs[VOP2_WIN_MAX_REG] = { + [VOP2_WIN_Y2R_EN] = REG_FIELD(RK3568_CLUSTER_WIN_CTRL0, 8, 8), + [VOP2_WIN_R2Y_EN] = REG_FIELD(RK3568_CLUSTER_WIN_CTRL0, 9, 9), + [VOP2_WIN_CSC_MODE] = REG_FIELD(RK3568_CLUSTER_WIN_CTRL0, 10, 11), ++ [VOP2_WIN_AXI_YRGB_R_ID] = REG_FIELD(RK3568_CLUSTER_WIN_CTRL2, 0, 3), ++ [VOP2_WIN_AXI_UV_R_ID] = REG_FIELD(RK3568_CLUSTER_WIN_CTRL2, 5, 8), ++ /* RK3588 only, reserved bit on rk3568*/ ++ [VOP2_WIN_AXI_BUS_ID] = REG_FIELD(RK3568_CLUSTER_CTRL, 13, 13), + + /* Scale */ + [VOP2_WIN_SCALE_YRGB_X] = REG_FIELD(RK3568_CLUSTER_WIN_SCL_FACTOR_YRGB, 0, 15), +@@ -3000,6 +3010,10 @@ static struct reg_field vop2_esmart_regs[VOP2_WIN_MAX_REG] = { + [VOP2_WIN_YMIRROR] = REG_FIELD(RK3568_SMART_CTRL1, 31, 31), + [VOP2_WIN_COLOR_KEY] = REG_FIELD(RK3568_SMART_COLOR_KEY_CTRL, 0, 29), + [VOP2_WIN_COLOR_KEY_EN] = REG_FIELD(RK3568_SMART_COLOR_KEY_CTRL, 31, 31), ++ [VOP2_WIN_AXI_YRGB_R_ID] = REG_FIELD(RK3568_SMART_CTRL1, 4, 8), ++ [VOP2_WIN_AXI_UV_R_ID] = REG_FIELD(RK3568_SMART_CTRL1, 12, 16), ++ /* RK3588 only, reserved register on rk3568 */ ++ [VOP2_WIN_AXI_BUS_ID] = REG_FIELD(RK3588_SMART_AXI_CTRL, 1, 1), + + /* Scale */ + [VOP2_WIN_SCALE_YRGB_X] = REG_FIELD(RK3568_SMART_REGION0_SCL_FACTOR_YRGB, 0, 15), +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.h b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.h +index 615a16196aff6..1c4204324f9f5 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.h ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.h +@@ -78,6 +78,9 @@ enum vop2_win_regs { + VOP2_WIN_COLOR_KEY, + VOP2_WIN_COLOR_KEY_EN, + VOP2_WIN_DITHER_UP, ++ VOP2_WIN_AXI_BUS_ID, ++ VOP2_WIN_AXI_YRGB_R_ID, ++ VOP2_WIN_AXI_UV_R_ID, + + /* scale regs */ + VOP2_WIN_SCALE_YRGB_X, +@@ -140,6 +143,10 @@ struct vop2_win_data { + unsigned int layer_sel_id; + uint64_t feature; + ++ uint8_t axi_bus_id; ++ uint8_t axi_yrgb_r_id; ++ uint8_t axi_uv_r_id; ++ + unsigned int max_upscale_factor; + unsigned int max_downscale_factor; + const u8 dly[VOP2_DLY_MODE_MAX]; +@@ -308,6 +315,7 @@ enum dst_factor_mode { + + #define RK3568_CLUSTER_WIN_CTRL0 0x00 + #define RK3568_CLUSTER_WIN_CTRL1 0x04 ++#define RK3568_CLUSTER_WIN_CTRL2 0x08 + #define RK3568_CLUSTER_WIN_YRGB_MST 0x10 + #define RK3568_CLUSTER_WIN_CBR_MST 0x14 + #define RK3568_CLUSTER_WIN_VIR 0x18 +@@ -330,6 +338,7 @@ enum dst_factor_mode { + /* (E)smart register definition, offset relative to window base */ + #define RK3568_SMART_CTRL0 0x00 + #define RK3568_SMART_CTRL1 0x04 ++#define RK3588_SMART_AXI_CTRL 0x08 + #define RK3568_SMART_REGION0_CTRL 0x10 + #define RK3568_SMART_REGION0_YRGB_MST 0x14 + #define RK3568_SMART_REGION0_CBR_MST 0x18 +diff --git a/drivers/gpu/drm/rockchip/rockchip_vop2_reg.c b/drivers/gpu/drm/rockchip/rockchip_vop2_reg.c +index 18efb3fe1c000..e473a8f8fd32d 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_vop2_reg.c ++++ b/drivers/gpu/drm/rockchip/rockchip_vop2_reg.c +@@ -313,7 +313,7 @@ static const struct vop2_video_port_data rk3588_vop_video_ports[] = { + * AXI1 is a read only bus. + * + * Every window on a AXI bus must assigned two unique +- * read id(yrgb_id/uv_id, valid id are 0x1~0xe). ++ * read id(yrgb_r_id/uv_r_id, valid id are 0x1~0xe). + * + * AXI0: + * Cluster0/1, Esmart0/1, WriteBack +@@ -333,6 +333,9 @@ static const struct vop2_win_data rk3588_vop_win_data[] = { + .layer_sel_id = 0, + .supported_rotations = DRM_MODE_ROTATE_90 | DRM_MODE_ROTATE_270 | + DRM_MODE_REFLECT_X | DRM_MODE_REFLECT_Y, ++ .axi_bus_id = 0, ++ .axi_yrgb_r_id = 2, ++ .axi_uv_r_id = 3, + .max_upscale_factor = 4, + .max_downscale_factor = 4, + .dly = { 4, 26, 29 }, +@@ -349,6 +352,9 @@ static const struct vop2_win_data rk3588_vop_win_data[] = { + .supported_rotations = DRM_MODE_ROTATE_90 | DRM_MODE_ROTATE_270 | + DRM_MODE_REFLECT_X | DRM_MODE_REFLECT_Y, + .type = DRM_PLANE_TYPE_PRIMARY, ++ .axi_bus_id = 0, ++ .axi_yrgb_r_id = 6, ++ .axi_uv_r_id = 7, + .max_upscale_factor = 4, + .max_downscale_factor = 4, + .dly = { 4, 26, 29 }, +@@ -364,6 +370,9 @@ static const struct vop2_win_data rk3588_vop_win_data[] = { + .supported_rotations = DRM_MODE_ROTATE_90 | DRM_MODE_ROTATE_270 | + DRM_MODE_REFLECT_X | DRM_MODE_REFLECT_Y, + .type = DRM_PLANE_TYPE_PRIMARY, ++ .axi_bus_id = 1, ++ .axi_yrgb_r_id = 2, ++ .axi_uv_r_id = 3, + .max_upscale_factor = 4, + .max_downscale_factor = 4, + .dly = { 4, 26, 29 }, +@@ -379,6 +388,9 @@ static const struct vop2_win_data rk3588_vop_win_data[] = { + .supported_rotations = DRM_MODE_ROTATE_90 | DRM_MODE_ROTATE_270 | + DRM_MODE_REFLECT_X | DRM_MODE_REFLECT_Y, + .type = DRM_PLANE_TYPE_PRIMARY, ++ .axi_bus_id = 1, ++ .axi_yrgb_r_id = 6, ++ .axi_uv_r_id = 7, + .max_upscale_factor = 4, + .max_downscale_factor = 4, + .dly = { 4, 26, 29 }, +@@ -393,6 +405,9 @@ static const struct vop2_win_data rk3588_vop_win_data[] = { + .layer_sel_id = 2, + .supported_rotations = DRM_MODE_REFLECT_Y, + .type = DRM_PLANE_TYPE_OVERLAY, ++ .axi_bus_id = 0, ++ .axi_yrgb_r_id = 0x0a, ++ .axi_uv_r_id = 0x0b, + .max_upscale_factor = 8, + .max_downscale_factor = 8, + .dly = { 23, 45, 48 }, +@@ -406,6 +421,9 @@ static const struct vop2_win_data rk3588_vop_win_data[] = { + .layer_sel_id = 3, + .supported_rotations = DRM_MODE_REFLECT_Y, + .type = DRM_PLANE_TYPE_OVERLAY, ++ .axi_bus_id = 0, ++ .axi_yrgb_r_id = 0x0c, ++ .axi_uv_r_id = 0x01, + .max_upscale_factor = 8, + .max_downscale_factor = 8, + .dly = { 23, 45, 48 }, +@@ -419,6 +437,9 @@ static const struct vop2_win_data rk3588_vop_win_data[] = { + .layer_sel_id = 6, + .supported_rotations = DRM_MODE_REFLECT_Y, + .type = DRM_PLANE_TYPE_OVERLAY, ++ .axi_bus_id = 1, ++ .axi_yrgb_r_id = 0x0a, ++ .axi_uv_r_id = 0x0b, + .max_upscale_factor = 8, + .max_downscale_factor = 8, + .dly = { 23, 45, 48 }, +@@ -432,6 +453,9 @@ static const struct vop2_win_data rk3588_vop_win_data[] = { + .layer_sel_id = 7, + .supported_rotations = DRM_MODE_REFLECT_Y, + .type = DRM_PLANE_TYPE_OVERLAY, ++ .axi_bus_id = 1, ++ .axi_yrgb_r_id = 0x0c, ++ .axi_uv_r_id = 0x0d, + .max_upscale_factor = 8, + .max_downscale_factor = 8, + .dly = { 23, 45, 48 }, +-- +2.39.5 + diff --git a/queue-6.12/drm-rockchip-vop2-setup-delay-cycle-for-esmart2-3.patch b/queue-6.12/drm-rockchip-vop2-setup-delay-cycle-for-esmart2-3.patch new file mode 100644 index 0000000000..7253f32448 --- /dev/null +++ b/queue-6.12/drm-rockchip-vop2-setup-delay-cycle-for-esmart2-3.patch @@ -0,0 +1,42 @@ +From a50270f9eb2a8104429edd22b0a2d929b2682ece Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Dec 2024 16:17:03 +0800 +Subject: drm/rockchip: vop2: Setup delay cycle for Esmart2/3 + +From: Andy Yan + +[ Upstream commit c766998ba6df126ab6934d32ff2ff080316ec630 ] + +Each layer needs to set the correct delay cycle to display properly +without unexpected offset on screen. + +Fixes: 5a028e8f062f ("drm/rockchip: vop2: Add support for rk3588") +Signed-off-by: Andy Yan +Tested-by: Derek Foreman +Tested-by: Detlev Casanova +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20241214081719.3330518-5-andyshrk@163.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +index cd3fb906d0089..68b5c438cdaba 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +@@ -2493,9 +2493,11 @@ static void vop2_setup_dly_for_windows(struct vop2 *vop2) + sdly |= FIELD_PREP(RK3568_SMART_DLY_NUM__ESMART1, dly); + break; + case ROCKCHIP_VOP2_SMART0: ++ case ROCKCHIP_VOP2_ESMART2: + sdly |= FIELD_PREP(RK3568_SMART_DLY_NUM__SMART0, dly); + break; + case ROCKCHIP_VOP2_SMART1: ++ case ROCKCHIP_VOP2_ESMART3: + sdly |= FIELD_PREP(RK3568_SMART_DLY_NUM__SMART1, dly); + break; + } +-- +2.39.5 + diff --git a/queue-6.12/drm-ttm-add-ttm_bo_access.patch b/queue-6.12/drm-ttm-add-ttm_bo_access.patch new file mode 100644 index 0000000000..2b8a41af24 --- /dev/null +++ b/queue-6.12/drm-ttm-add-ttm_bo_access.patch @@ -0,0 +1,122 @@ +From 73b922f15552bb5b47cbcca4b4d2b131b89b786d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Nov 2024 09:46:09 -0800 +Subject: drm/ttm: Add ttm_bo_access +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Matthew Brost + +[ Upstream commit 7d08df5d0bd3d12d14dcec773fcddbe3eed3a8e8 ] + +Non-contiguous VRAM cannot easily be mapped in TTM nor can non-visible +VRAM easily be accessed. Add ttm_bo_access, which is similar to +ttm_bo_vm_access, to access such memory. + +v4: + - Fix checkpatch warnings (CI) +v5: + - Fix checkpatch warnings (CI) +v6: + - Fix kernel doc (Auld) +v7: + - Move ttm_bo_access to ttm_bo_vm.c (Christian) + +Cc: Christian König +Reported-by: Christoph Manszewski +Suggested-by: Thomas Hellström +Signed-off-by: Matthew Brost +Tested-by: Mika Kuoppala +Reviewed-by: Matthew Auld +Reviewed-by: Christian König +Link: https://patchwork.freedesktop.org/patch/msgid/20241126174615.2665852-3-matthew.brost@intel.com +Stable-dep-of: 5f7bec831f1f ("drm/xe: Use ttm_bo_access in xe_vm_snapshot_capture_delayed") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ttm/ttm_bo_vm.c | 40 ++++++++++++++++++++++++++------- + include/drm/ttm/ttm_bo.h | 2 ++ + 2 files changed, 34 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c +index 4212b8c91dd42..17667ab31ad4c 100644 +--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c ++++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c +@@ -405,13 +405,25 @@ static int ttm_bo_vm_access_kmap(struct ttm_buffer_object *bo, + return len; + } + +-int ttm_bo_vm_access(struct vm_area_struct *vma, unsigned long addr, +- void *buf, int len, int write) ++/** ++ * ttm_bo_access - Helper to access a buffer object ++ * ++ * @bo: ttm buffer object ++ * @offset: access offset into buffer object ++ * @buf: pointer to caller memory to read into or write from ++ * @len: length of access ++ * @write: write access ++ * ++ * Utility function to access a buffer object. Useful when buffer object cannot ++ * be easily mapped (non-contiguous, non-visible, etc...). Should not directly ++ * be exported to user space via a peak / poke interface. ++ * ++ * Returns: ++ * @len if successful, negative error code on failure. ++ */ ++int ttm_bo_access(struct ttm_buffer_object *bo, unsigned long offset, ++ void *buf, int len, int write) + { +- struct ttm_buffer_object *bo = vma->vm_private_data; +- unsigned long offset = (addr) - vma->vm_start + +- ((vma->vm_pgoff - drm_vma_node_start(&bo->base.vma_node)) +- << PAGE_SHIFT); + int ret; + + if (len < 1 || (offset + len) > bo->base.size) +@@ -429,8 +441,8 @@ int ttm_bo_vm_access(struct vm_area_struct *vma, unsigned long addr, + break; + default: + if (bo->bdev->funcs->access_memory) +- ret = bo->bdev->funcs->access_memory( +- bo, offset, buf, len, write); ++ ret = bo->bdev->funcs->access_memory ++ (bo, offset, buf, len, write); + else + ret = -EIO; + } +@@ -439,6 +451,18 @@ int ttm_bo_vm_access(struct vm_area_struct *vma, unsigned long addr, + + return ret; + } ++EXPORT_SYMBOL(ttm_bo_access); ++ ++int ttm_bo_vm_access(struct vm_area_struct *vma, unsigned long addr, ++ void *buf, int len, int write) ++{ ++ struct ttm_buffer_object *bo = vma->vm_private_data; ++ unsigned long offset = (addr) - vma->vm_start + ++ ((vma->vm_pgoff - drm_vma_node_start(&bo->base.vma_node)) ++ << PAGE_SHIFT); ++ ++ return ttm_bo_access(bo, offset, buf, len, write); ++} + EXPORT_SYMBOL(ttm_bo_vm_access); + + static const struct vm_operations_struct ttm_bo_vm_ops = { +diff --git a/include/drm/ttm/ttm_bo.h b/include/drm/ttm/ttm_bo.h +index 7b56d1ca36d75..e383dee82001e 100644 +--- a/include/drm/ttm/ttm_bo.h ++++ b/include/drm/ttm/ttm_bo.h +@@ -421,6 +421,8 @@ void ttm_bo_unpin(struct ttm_buffer_object *bo); + int ttm_bo_evict_first(struct ttm_device *bdev, + struct ttm_resource_manager *man, + struct ttm_operation_ctx *ctx); ++int ttm_bo_access(struct ttm_buffer_object *bo, unsigned long offset, ++ void *buf, int len, int write); + vm_fault_t ttm_bo_vm_reserve(struct ttm_buffer_object *bo, + struct vm_fault *vmf); + vm_fault_t ttm_bo_vm_fault_reserved(struct vm_fault *vmf, +-- +2.39.5 + diff --git a/queue-6.12/drm-v3d-fix-performance-counter-source-settings-on-v.patch b/queue-6.12/drm-v3d-fix-performance-counter-source-settings-on-v.patch new file mode 100644 index 0000000000..a81ca19d21 --- /dev/null +++ b/queue-6.12/drm-v3d-fix-performance-counter-source-settings-on-v.patch @@ -0,0 +1,129 @@ +From dc169d742242a2a05553c72429f80bf78bbac726 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2024 09:16:51 -0300 +Subject: drm/v3d: Fix performance counter source settings on V3D 7.x +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maíra Canal + +[ Upstream commit e987e22e9229d70c2083a91cc61269b2c4924955 ] + +When the new register addresses were introduced for V3D 7.x, we added +new masks for performance counter sources on V3D 7.x. Nevertheless, +we never apply these new masks when setting the sources. + +Fix the performance counter source settings on V3D 7.x by introducing +a new macro, `V3D_SET_FIELD_VER`, which allows fields setting to vary +by version. Using this macro, we can provide different values for +source mask based on the V3D version, ensuring that sources are +correctly configure on V3D 7.x. + +Fixes: 0ad5bc1ce463 ("drm/v3d: fix up register addresses for V3D 7.x") +Signed-off-by: Maíra Canal +Reviewed-by: Iago Toral Quiroga +Reviewed-by: Christian Gmeiner +Link: https://patchwork.freedesktop.org/patch/msgid/20241106121736.5707-1-mcanal@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/v3d/v3d_debugfs.c | 4 ++-- + drivers/gpu/drm/v3d/v3d_perfmon.c | 15 ++++++++------- + drivers/gpu/drm/v3d/v3d_regs.h | 29 +++++++++++++++++------------ + 3 files changed, 27 insertions(+), 21 deletions(-) + +diff --git a/drivers/gpu/drm/v3d/v3d_debugfs.c b/drivers/gpu/drm/v3d/v3d_debugfs.c +index 19e3ee7ac897f..76816f2551c10 100644 +--- a/drivers/gpu/drm/v3d/v3d_debugfs.c ++++ b/drivers/gpu/drm/v3d/v3d_debugfs.c +@@ -237,8 +237,8 @@ static int v3d_measure_clock(struct seq_file *m, void *unused) + if (v3d->ver >= 40) { + int cycle_count_reg = V3D_PCTR_CYCLE_COUNT(v3d->ver); + V3D_CORE_WRITE(core, V3D_V4_PCTR_0_SRC_0_3, +- V3D_SET_FIELD(cycle_count_reg, +- V3D_PCTR_S0)); ++ V3D_SET_FIELD_VER(cycle_count_reg, ++ V3D_PCTR_S0, v3d->ver)); + V3D_CORE_WRITE(core, V3D_V4_PCTR_0_CLR, 1); + V3D_CORE_WRITE(core, V3D_V4_PCTR_0_EN, 1); + } else { +diff --git a/drivers/gpu/drm/v3d/v3d_perfmon.c b/drivers/gpu/drm/v3d/v3d_perfmon.c +index 6ee56cbd3f1bf..e3013ac3a5c2a 100644 +--- a/drivers/gpu/drm/v3d/v3d_perfmon.c ++++ b/drivers/gpu/drm/v3d/v3d_perfmon.c +@@ -240,17 +240,18 @@ void v3d_perfmon_start(struct v3d_dev *v3d, struct v3d_perfmon *perfmon) + + for (i = 0; i < ncounters; i++) { + u32 source = i / 4; +- u32 channel = V3D_SET_FIELD(perfmon->counters[i], V3D_PCTR_S0); ++ u32 channel = V3D_SET_FIELD_VER(perfmon->counters[i], V3D_PCTR_S0, ++ v3d->ver); + + i++; +- channel |= V3D_SET_FIELD(i < ncounters ? perfmon->counters[i] : 0, +- V3D_PCTR_S1); ++ channel |= V3D_SET_FIELD_VER(i < ncounters ? perfmon->counters[i] : 0, ++ V3D_PCTR_S1, v3d->ver); + i++; +- channel |= V3D_SET_FIELD(i < ncounters ? perfmon->counters[i] : 0, +- V3D_PCTR_S2); ++ channel |= V3D_SET_FIELD_VER(i < ncounters ? perfmon->counters[i] : 0, ++ V3D_PCTR_S2, v3d->ver); + i++; +- channel |= V3D_SET_FIELD(i < ncounters ? perfmon->counters[i] : 0, +- V3D_PCTR_S3); ++ channel |= V3D_SET_FIELD_VER(i < ncounters ? perfmon->counters[i] : 0, ++ V3D_PCTR_S3, v3d->ver); + V3D_CORE_WRITE(0, V3D_V4_PCTR_0_SRC_X(source), channel); + } + +diff --git a/drivers/gpu/drm/v3d/v3d_regs.h b/drivers/gpu/drm/v3d/v3d_regs.h +index 1b1a62ad95852..6da3c69082bd6 100644 +--- a/drivers/gpu/drm/v3d/v3d_regs.h ++++ b/drivers/gpu/drm/v3d/v3d_regs.h +@@ -15,6 +15,14 @@ + fieldval & field##_MASK; \ + }) + ++#define V3D_SET_FIELD_VER(value, field, ver) \ ++ ({ \ ++ typeof(ver) _ver = (ver); \ ++ u32 fieldval = (value) << field##_SHIFT(_ver); \ ++ WARN_ON((fieldval & ~field##_MASK(_ver)) != 0); \ ++ fieldval & field##_MASK(_ver); \ ++ }) ++ + #define V3D_GET_FIELD(word, field) (((word) & field##_MASK) >> \ + field##_SHIFT) + +@@ -354,18 +362,15 @@ + #define V3D_V4_PCTR_0_SRC_28_31 0x0067c + #define V3D_V4_PCTR_0_SRC_X(x) (V3D_V4_PCTR_0_SRC_0_3 + \ + 4 * (x)) +-# define V3D_PCTR_S0_MASK V3D_MASK(6, 0) +-# define V3D_V7_PCTR_S0_MASK V3D_MASK(7, 0) +-# define V3D_PCTR_S0_SHIFT 0 +-# define V3D_PCTR_S1_MASK V3D_MASK(14, 8) +-# define V3D_V7_PCTR_S1_MASK V3D_MASK(15, 8) +-# define V3D_PCTR_S1_SHIFT 8 +-# define V3D_PCTR_S2_MASK V3D_MASK(22, 16) +-# define V3D_V7_PCTR_S2_MASK V3D_MASK(23, 16) +-# define V3D_PCTR_S2_SHIFT 16 +-# define V3D_PCTR_S3_MASK V3D_MASK(30, 24) +-# define V3D_V7_PCTR_S3_MASK V3D_MASK(31, 24) +-# define V3D_PCTR_S3_SHIFT 24 ++# define V3D_PCTR_S0_MASK(ver) (((ver) >= 71) ? V3D_MASK(7, 0) : V3D_MASK(6, 0)) ++# define V3D_PCTR_S0_SHIFT(ver) 0 ++# define V3D_PCTR_S1_MASK(ver) (((ver) >= 71) ? V3D_MASK(15, 8) : V3D_MASK(14, 8)) ++# define V3D_PCTR_S1_SHIFT(ver) 8 ++# define V3D_PCTR_S2_MASK(ver) (((ver) >= 71) ? V3D_MASK(23, 16) : V3D_MASK(22, 16)) ++# define V3D_PCTR_S2_SHIFT(ver) 16 ++# define V3D_PCTR_S3_MASK(ver) (((ver) >= 71) ? V3D_MASK(31, 24) : V3D_MASK(30, 24)) ++# define V3D_PCTR_S3_SHIFT(ver) 24 ++ + #define V3D_PCTR_CYCLE_COUNT(ver) ((ver >= 71) ? 0 : 32) + + /* Output values of the counters. */ +-- +2.39.5 + diff --git a/queue-6.12/drm-xe-use-ttm_bo_access-in-xe_vm_snapshot_capture_d.patch b/queue-6.12/drm-xe-use-ttm_bo_access-in-xe_vm_snapshot_capture_d.patch new file mode 100644 index 0000000000..2d4fac642f --- /dev/null +++ b/queue-6.12/drm-xe-use-ttm_bo_access-in-xe_vm_snapshot_capture_d.patch @@ -0,0 +1,63 @@ +From 7aad4e92ca3782686571792d117b3ffcfe05c65c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Nov 2024 09:46:13 -0800 +Subject: drm/xe: Use ttm_bo_access in xe_vm_snapshot_capture_delayed + +From: Matthew Brost + +[ Upstream commit 5f7bec831f1f17c354e4307a12cf79b018296975 ] + +Non-contiguous mapping of BO in VRAM doesn't work, use ttm_bo_access +instead. + +v2: + - Fix error handling + +Fixes: 0eb2a18a8fad ("drm/xe: Implement VM snapshot support for BO's and userptr") +Suggested-by: Matthew Auld +Signed-off-by: Matthew Brost +Reviewed-by: Matthew Auld +Link: https://patchwork.freedesktop.org/patch/msgid/20241126174615.2665852-7-matthew.brost@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_vm.c | 17 ++++++----------- + 1 file changed, 6 insertions(+), 11 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c +index c99380271de62..c8782da3a5c38 100644 +--- a/drivers/gpu/drm/xe/xe_vm.c ++++ b/drivers/gpu/drm/xe/xe_vm.c +@@ -3303,7 +3303,6 @@ void xe_vm_snapshot_capture_delayed(struct xe_vm_snapshot *snap) + + for (int i = 0; i < snap->num_snaps; i++) { + struct xe_bo *bo = snap->snap[i].bo; +- struct iosys_map src; + int err; + + if (IS_ERR(snap->snap[i].data)) +@@ -3316,16 +3315,12 @@ void xe_vm_snapshot_capture_delayed(struct xe_vm_snapshot *snap) + } + + if (bo) { +- xe_bo_lock(bo, false); +- err = ttm_bo_vmap(&bo->ttm, &src); +- if (!err) { +- xe_map_memcpy_from(xe_bo_device(bo), +- snap->snap[i].data, +- &src, snap->snap[i].bo_ofs, +- snap->snap[i].len); +- ttm_bo_vunmap(&bo->ttm, &src); +- } +- xe_bo_unlock(bo); ++ err = ttm_bo_access(&bo->ttm, snap->snap[i].bo_ofs, ++ snap->snap[i].data, snap->snap[i].len, 0); ++ if (!(err < 0) && err != snap->snap[i].len) ++ err = -EIO; ++ else if (!(err < 0)) ++ err = 0; + } else { + void __user *userptr = (void __user *)(size_t)snap->snap[i].bo_ofs; + +-- +2.39.5 + diff --git a/queue-6.12/dt-bindings-clock-add-i.mx91-clock-support.patch b/queue-6.12/dt-bindings-clock-add-i.mx91-clock-support.patch new file mode 100644 index 0000000000..65f7d6e35f --- /dev/null +++ b/queue-6.12/dt-bindings-clock-add-i.mx91-clock-support.patch @@ -0,0 +1,55 @@ +From 6e1f7a3363df127d7d7eef571a0ca52c068f68b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Oct 2024 11:46:49 -0700 +Subject: dt-bindings: clock: Add i.MX91 clock support + +From: Pengfei Li + +[ Upstream commit f029d870096fcd8565a2ee8c2d0078b9aaec4fdb ] + +i.MX91 has similar Clock Control Module(CCM) design as i.MX93, only add +few new clock compared to i.MX93. +Add a new compatible string and some new clocks for i.MX91. + +Signed-off-by: Pengfei Li +Reviewed-by: Frank Li +Acked-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20241023184651.381265-4-pengfei.li_1@nxp.com +Signed-off-by: Abel Vesa +Stable-dep-of: 32e9dea2645f ("dt-bindings: clock: imx93: Add SPDIF IPG clk") +Signed-off-by: Sasha Levin +--- + Documentation/devicetree/bindings/clock/imx93-clock.yaml | 1 + + include/dt-bindings/clock/imx93-clock.h | 5 +++++ + 2 files changed, 6 insertions(+) + +diff --git a/Documentation/devicetree/bindings/clock/imx93-clock.yaml b/Documentation/devicetree/bindings/clock/imx93-clock.yaml +index ccb53c6b96c11..98c0800732ef5 100644 +--- a/Documentation/devicetree/bindings/clock/imx93-clock.yaml ++++ b/Documentation/devicetree/bindings/clock/imx93-clock.yaml +@@ -16,6 +16,7 @@ description: | + properties: + compatible: + enum: ++ - fsl,imx91-ccm + - fsl,imx93-ccm + + reg: +diff --git a/include/dt-bindings/clock/imx93-clock.h b/include/dt-bindings/clock/imx93-clock.h +index a1d0b326bb6bf..6c685067288b5 100644 +--- a/include/dt-bindings/clock/imx93-clock.h ++++ b/include/dt-bindings/clock/imx93-clock.h +@@ -204,5 +204,10 @@ + #define IMX93_CLK_A55_SEL 199 + #define IMX93_CLK_A55_CORE 200 + #define IMX93_CLK_PDM_IPG 201 ++#define IMX91_CLK_ENET1_QOS_TSN 202 ++#define IMX91_CLK_ENET_TIMER 203 ++#define IMX91_CLK_ENET2_REGULAR 204 ++#define IMX91_CLK_ENET2_REGULAR_GATE 205 ++#define IMX91_CLK_ENET1_QOS_TSN_GATE 206 + + #endif +-- +2.39.5 + diff --git a/queue-6.12/dt-bindings-clock-imx93-add-spdif-ipg-clk.patch b/queue-6.12/dt-bindings-clock-imx93-add-spdif-ipg-clk.patch new file mode 100644 index 0000000000..6ead877f99 --- /dev/null +++ b/queue-6.12/dt-bindings-clock-imx93-add-spdif-ipg-clk.patch @@ -0,0 +1,37 @@ +From 84a0a9aa4cff941a60ba56140ff64bf3749a6b78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Nov 2024 09:58:03 +0800 +Subject: dt-bindings: clock: imx93: Add SPDIF IPG clk + +From: Shengjiu Wang + +[ Upstream commit 32e9dea2645fa10dfa08b4e333918affaf1e4de5 ] + +Add SPDIF IPG clk. The SPDIF IPG clock and root clock +share same clock gate. + +Fixes: 1c4a4f7362fd ("arm64: dts: imx93: Add audio device nodes") +Signed-off-by: Shengjiu Wang +Reviewed-by: Frank Li +Acked-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20241119015805.3840606-2-shengjiu.wang@nxp.com +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + include/dt-bindings/clock/imx93-clock.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/dt-bindings/clock/imx93-clock.h b/include/dt-bindings/clock/imx93-clock.h +index 6c685067288b5..c393fad3a3469 100644 +--- a/include/dt-bindings/clock/imx93-clock.h ++++ b/include/dt-bindings/clock/imx93-clock.h +@@ -209,5 +209,6 @@ + #define IMX91_CLK_ENET2_REGULAR 204 + #define IMX91_CLK_ENET2_REGULAR_GATE 205 + #define IMX91_CLK_ENET1_QOS_TSN_GATE 206 ++#define IMX93_CLK_SPDIF_IPG 207 + + #endif +-- +2.39.5 + diff --git a/queue-6.12/dt-bindings-clock-imx93-drop-imx93_clk_end-macro-def.patch b/queue-6.12/dt-bindings-clock-imx93-drop-imx93_clk_end-macro-def.patch new file mode 100644 index 0000000000..c36b33326a --- /dev/null +++ b/queue-6.12/dt-bindings-clock-imx93-drop-imx93_clk_end-macro-def.patch @@ -0,0 +1,37 @@ +From 5166f78898b97f7bb4112fa99e4295f11fe06de6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Oct 2024 11:46:48 -0700 +Subject: dt-bindings: clock: imx93: Drop IMX93_CLK_END macro definition + +From: Pengfei Li + +[ Upstream commit c0813ce2e5b0d1174782aff30d366509377abc7b ] + +IMX93_CLK_END should be dropped as it is not part of the ABI. + +Signed-off-by: Pengfei Li +Acked-by: Krzysztof Kozlowski +Acked-by: Peng Fan +Acked-by: Conor Dooley +Link: https://lore.kernel.org/r/20241023184651.381265-3-pengfei.li_1@nxp.com +Signed-off-by: Abel Vesa +Stable-dep-of: 32e9dea2645f ("dt-bindings: clock: imx93: Add SPDIF IPG clk") +Signed-off-by: Sasha Levin +--- + include/dt-bindings/clock/imx93-clock.h | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/include/dt-bindings/clock/imx93-clock.h b/include/dt-bindings/clock/imx93-clock.h +index 787c9e74dc96d..a1d0b326bb6bf 100644 +--- a/include/dt-bindings/clock/imx93-clock.h ++++ b/include/dt-bindings/clock/imx93-clock.h +@@ -204,6 +204,5 @@ + #define IMX93_CLK_A55_SEL 199 + #define IMX93_CLK_A55_CORE 200 + #define IMX93_CLK_PDM_IPG 201 +-#define IMX93_CLK_END 202 + + #endif +-- +2.39.5 + diff --git a/queue-6.12/dt-bindings-clock-sunxi-export-pll_video_2x-and-pll_.patch b/queue-6.12/dt-bindings-clock-sunxi-export-pll_video_2x-and-pll_.patch new file mode 100644 index 0000000000..ef7ec00913 --- /dev/null +++ b/queue-6.12/dt-bindings-clock-sunxi-export-pll_video_2x-and-pll_.patch @@ -0,0 +1,44 @@ +From a78dfac1d4e1306fc92353a43823b6e184a41375 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jan 2025 23:36:57 -0800 +Subject: dt-bindings: clock: sunxi: Export PLL_VIDEO_2X and PLL_MIPI + +From: Vasily Khoruzhick + +[ Upstream commit 9897831de614f1d8d5184547f0e7bf7665eed436 ] + +Export PLL_VIDEO_2X and PLL_MIPI, these will be used to explicitly +select TCON0 clock parent in dts + +Fixes: ca1170b69968 ("clk: sunxi-ng: a64: force select PLL_MIPI in TCON0 mux") +Reviewed-by: Dragan Simic +Reviewed-by: Chen-Yu Tsai +Tested-by: Frank Oltmanns # on PinePhone +Tested-by: Stuart Gathman # on OG Pinebook +Signed-off-by: Vasily Khoruzhick +Acked-by: Krzysztof Kozlowski +Link: https://patch.msgid.link/20250104074035.1611136-2-anarsoul@gmail.com +Signed-off-by: Chen-Yu Tsai +Stable-dep-of: 0f368cb7ef10 ("clk: sunxi-ng: a64: drop redundant CLK_PLL_VIDEO0_2X and CLK_PLL_MIPI") +Signed-off-by: Sasha Levin +--- + include/dt-bindings/clock/sun50i-a64-ccu.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/include/dt-bindings/clock/sun50i-a64-ccu.h b/include/dt-bindings/clock/sun50i-a64-ccu.h +index 175892189e9dc..4f220ea7a23cc 100644 +--- a/include/dt-bindings/clock/sun50i-a64-ccu.h ++++ b/include/dt-bindings/clock/sun50i-a64-ccu.h +@@ -44,7 +44,9 @@ + #define _DT_BINDINGS_CLK_SUN50I_A64_H_ + + #define CLK_PLL_VIDEO0 7 ++#define CLK_PLL_VIDEO0_2X 8 + #define CLK_PLL_PERIPH0 11 ++#define CLK_PLL_MIPI 17 + + #define CLK_CPUX 21 + #define CLK_BUS_MIPI_DSI 28 +-- +2.39.5 + diff --git a/queue-6.12/dt-bindings-leds-class-multicolor-fix-path-to-color-.patch b/queue-6.12/dt-bindings-leds-class-multicolor-fix-path-to-color-.patch new file mode 100644 index 0000000000..bad25d3a25 --- /dev/null +++ b/queue-6.12/dt-bindings-leds-class-multicolor-fix-path-to-color-.patch @@ -0,0 +1,38 @@ +From f67c9e2b904b3f321c4803345f9cb9681e16119e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Nov 2024 13:44:29 +0100 +Subject: dt-bindings: leds: class-multicolor: Fix path to color definitions + +From: Geert Uytterhoeven + +[ Upstream commit 609bc99a4452ffbce82d10f024a85d911c42e6cd ] + +The LED color definitions have always been in +include/dt-bindings/leds/common.h in upstream. + +Fixes: 5c7f8ffe741daae7 ("dt: bindings: Add multicolor class dt bindings documention") +Signed-off-by: Geert Uytterhoeven +Acked-by: Conor Dooley +Link: https://lore.kernel.org/r/a3c7ea92e90b77032f2e480d46418b087709286d.1731588129.git.geert+renesas@glider.be +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + .../devicetree/bindings/leds/leds-class-multicolor.yaml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml b/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml +index e850a8894758d..bb40bb9e036ee 100644 +--- a/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml ++++ b/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml +@@ -27,7 +27,7 @@ properties: + description: | + For multicolor LED support this property should be defined as either + LED_COLOR_ID_RGB or LED_COLOR_ID_MULTI which can be found in +- include/linux/leds/common.h. ++ include/dt-bindings/leds/common.h. + enum: [ 8, 9 ] + + required: +-- +2.39.5 + diff --git a/queue-6.12/dt-bindings-mfd-bd71815-fix-rsense-and-typos.patch b/queue-6.12/dt-bindings-mfd-bd71815-fix-rsense-and-typos.patch new file mode 100644 index 0000000000..0f02031ea0 --- /dev/null +++ b/queue-6.12/dt-bindings-mfd-bd71815-fix-rsense-and-typos.patch @@ -0,0 +1,77 @@ +From 9332590158abc975813a48aeaa76c0b65da1e418 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Nov 2024 19:01:06 +0200 +Subject: dt-bindings: mfd: bd71815: Fix rsense and typos + +From: Matti Vaittinen + +[ Upstream commit 6856edf7ead8c54803216a38a7b227bcb3dadff7 ] + +The sense resistor used for measuring currents is typically some tens of +milli Ohms. It has accidentally been documented to be tens of mega Ohms. +Fix the size of this resistor and a few copy-paste errors while at it. + +Drop the unsuitable 'rohm,charger-sense-resistor-ohms' property (which +can't represent resistors smaller than one Ohm), and introduce a new +'rohm,charger-sense-resistor-micro-ohms' property with appropriate +minimum, maximum and default values instead. + +Fixes: 4238dc1e6490 ("dt_bindings: mfd: Add ROHM BD71815 PMIC") +Signed-off-by: Matti Vaittinen +Acked-by: Conor Dooley +Link: https://lore.kernel.org/r/0efd8e9de0ae8d62ee4c6b78cc565b04007a245d.1731430700.git.mazziesaccount@gmail.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + .../bindings/mfd/rohm,bd71815-pmic.yaml | 20 +++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/Documentation/devicetree/bindings/mfd/rohm,bd71815-pmic.yaml b/Documentation/devicetree/bindings/mfd/rohm,bd71815-pmic.yaml +index bb81307dc11b8..4fc78efaa5504 100644 +--- a/Documentation/devicetree/bindings/mfd/rohm,bd71815-pmic.yaml ++++ b/Documentation/devicetree/bindings/mfd/rohm,bd71815-pmic.yaml +@@ -50,15 +50,15 @@ properties: + minimum: 0 + maximum: 1 + +- rohm,charger-sense-resistor-ohms: +- minimum: 10000000 +- maximum: 50000000 ++ rohm,charger-sense-resistor-micro-ohms: ++ minimum: 10000 ++ maximum: 50000 + description: | +- BD71827 and BD71828 have SAR ADC for measuring charging currents. +- External sense resistor (RSENSE in data sheet) should be used. If +- something other but 30MOhm resistor is used the resistance value +- should be given here in Ohms. +- default: 30000000 ++ BD71815 has SAR ADC for measuring charging currents. External sense ++ resistor (RSENSE in data sheet) should be used. If something other ++ but a 30 mOhm resistor is used the resistance value should be given ++ here in micro Ohms. ++ default: 30000 + + regulators: + $ref: /schemas/regulator/rohm,bd71815-regulator.yaml +@@ -67,7 +67,7 @@ properties: + + gpio-reserved-ranges: + description: | +- Usage of BD71828 GPIO pins can be changed via OTP. This property can be ++ Usage of BD71815 GPIO pins can be changed via OTP. This property can be + used to mark the pins which should not be configured for GPIO. Please see + the ../gpio/gpio.txt for more information. + +@@ -113,7 +113,7 @@ examples: + gpio-controller; + #gpio-cells = <2>; + +- rohm,charger-sense-resistor-ohms = <10000000>; ++ rohm,charger-sense-resistor-micro-ohms = <10000>; + + regulators { + buck1: buck1 { +-- +2.39.5 + diff --git a/queue-6.12/dt-bindings-mmc-controller-clarify-the-address-cells.patch b/queue-6.12/dt-bindings-mmc-controller-clarify-the-address-cells.patch new file mode 100644 index 0000000000..87274a6435 --- /dev/null +++ b/queue-6.12/dt-bindings-mmc-controller-clarify-the-address-cells.patch @@ -0,0 +1,39 @@ +From b5f74247c52fcaa53ce1802bce4b9c5a71fdd54c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Nov 2024 16:16:41 +0100 +Subject: dt-bindings: mmc: controller: clarify the address-cells description + +From: Neil Armstrong + +[ Upstream commit b2b8e93ec00b8110cb37cbde5400d5abfdaed6a7 ] + +The term "slot ID" has nothing to do with the SDIO function number +which is specified in the reg property of the subnodes, rephrase +the description to be more accurate. + +Fixes: f9b7989859dd ("dt-bindings: mmc: Add YAML schemas for the generic MMC options") +Signed-off-by: Neil Armstrong +Acked-by: Rob Herring (Arm) +Message-ID: <20241128-topic-amlogic-arm32-upstream-bindings-fixes-convert-meson-mx-sdio-v4-1-11d9f9200a59@linaro.org> +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + Documentation/devicetree/bindings/mmc/mmc-controller.yaml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/devicetree/bindings/mmc/mmc-controller.yaml b/Documentation/devicetree/bindings/mmc/mmc-controller.yaml +index 58ae298cd2fcf..23884b8184a9d 100644 +--- a/Documentation/devicetree/bindings/mmc/mmc-controller.yaml ++++ b/Documentation/devicetree/bindings/mmc/mmc-controller.yaml +@@ -25,7 +25,7 @@ properties: + "#address-cells": + const: 1 + description: | +- The cell is the slot ID if a function subnode is used. ++ The cell is the SDIO function number if a function subnode is used. + + "#size-cells": + const: 0 +-- +2.39.5 + diff --git a/queue-6.12/dts-arm64-mediatek-mt8195-remove-mt8183-compatible-f.patch b/queue-6.12/dts-arm64-mediatek-mt8195-remove-mt8183-compatible-f.patch new file mode 100644 index 0000000000..be93d5cee7 --- /dev/null +++ b/queue-6.12/dts-arm64-mediatek-mt8195-remove-mt8183-compatible-f.patch @@ -0,0 +1,39 @@ +From b5f6142fb9313d0033b49ed56a2c971449735da0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2024 02:15:31 +0800 +Subject: dts: arm64: mediatek: mt8195: Remove MT8183 compatible for OVL + +From: Jason-JH.Lin + +[ Upstream commit ce3dbc46d7e30a84b8e99c730e3172dd5efbf094 ] + +The OVL hardware capabilities have changed starting from MT8195, +making the MT8183 compatible no longer applicable. +Therefore, it is necessary to remove the MT8183 compatible for OVL. + +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Jason-JH.Lin +Fixes: b852ee68fd72 ("arm64: dts: mt8195: Add display node for vdosys0") +Link: https://lore.kernel.org/r/20241219181531.4282-5-jason-jh.lin@mediatek.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8195.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +index 04e41b557d448..f013dbad9dc4e 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +@@ -3135,7 +3135,7 @@ + }; + + ovl0: ovl@1c000000 { +- compatible = "mediatek,mt8195-disp-ovl", "mediatek,mt8183-disp-ovl"; ++ compatible = "mediatek,mt8195-disp-ovl"; + reg = <0 0x1c000000 0 0x1000>; + interrupts = ; + power-domains = <&spm MT8195_POWER_DOMAIN_VDOSYS0>; +-- +2.39.5 + diff --git a/queue-6.12/efi-sysfb_efi-fix-w-1-warnings-when-efi-is-not-set.patch b/queue-6.12/efi-sysfb_efi-fix-w-1-warnings-when-efi-is-not-set.patch new file mode 100644 index 0000000000..d3b6351651 --- /dev/null +++ b/queue-6.12/efi-sysfb_efi-fix-w-1-warnings-when-efi-is-not-set.patch @@ -0,0 +1,70 @@ +From cc23dc0c6258462420ec1715028fe8b9dcf9813a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jan 2025 15:53:09 -0800 +Subject: efi: sysfb_efi: fix W=1 warnings when EFI is not set +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Randy Dunlap + +[ Upstream commit 19fdc68aa7b90b1d3d600e873a3e050a39e7663d ] + +A build with W=1 fails because there are code and data that are not +needed or used when CONFIG_EFI is not set. Move the "#ifdef CONFIG_EFI" +block to earlier in the source file so that the unused code/data are +not built. + +drivers/firmware/efi/sysfb_efi.c:345:39: warning: ‘efifb_fwnode_ops’ defined but not used [-Wunused-const-variable=] + 345 | static const struct fwnode_operations efifb_fwnode_ops = { + | ^~~~~~~~~~~~~~~~ +drivers/firmware/efi/sysfb_efi.c:238:35: warning: ‘efifb_dmi_swap_width_height’ defined but not used [-Wunused-const-variable=] + 238 | static const struct dmi_system_id efifb_dmi_swap_width_height[] __initconst = { + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/firmware/efi/sysfb_efi.c:188:35: warning: ‘efifb_dmi_system_table’ defined but not used [-Wunused-const-variable=] + 188 | static const struct dmi_system_id efifb_dmi_system_table[] __initconst = { + | ^~~~~~~~~~~~~~~~~~~~~~ + +Fixes: 15d27b15de96 ("efi: sysfb_efi: fix build when EFI is not set") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202501071933.20nlmJJt-lkp@intel.com/ +Cc: David Rheinsberg +Cc: Hans de Goede +Cc: Javier Martinez Canillas +Cc: Peter Jones +Cc: Simona Vetter +Cc: linux-fbdev@vger.kernel.org +Cc: Ard Biesheuvel +Cc: linux-efi@vger.kernel.org +Reviewed-by: Thomas Zimmermann +Reviewed-by: Javier Martinez Canillas +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/sysfb_efi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/efi/sysfb_efi.c b/drivers/firmware/efi/sysfb_efi.c +index cc807ed35aedf..1e509595ac034 100644 +--- a/drivers/firmware/efi/sysfb_efi.c ++++ b/drivers/firmware/efi/sysfb_efi.c +@@ -91,6 +91,7 @@ void efifb_setup_from_dmi(struct screen_info *si, const char *opt) + _ret_; \ + }) + ++#ifdef CONFIG_EFI + static int __init efifb_set_system(const struct dmi_system_id *id) + { + struct efifb_dmi_info *info = id->driver_data; +@@ -346,7 +347,6 @@ static const struct fwnode_operations efifb_fwnode_ops = { + .add_links = efifb_add_links, + }; + +-#ifdef CONFIG_EFI + static struct fwnode_handle efifb_fwnode; + + __init void sysfb_apply_efi_quirks(void) +-- +2.39.5 + diff --git a/queue-6.12/erofs-fix-potential-return-value-overflow-of-z_erofs.patch b/queue-6.12/erofs-fix-potential-return-value-overflow-of-z_erofs.patch new file mode 100644 index 0000000000..508752745a --- /dev/null +++ b/queue-6.12/erofs-fix-potential-return-value-overflow-of-z_erofs.patch @@ -0,0 +1,40 @@ +From 81fdce82147348f21c5996481b4e9d1825535aea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jan 2025 12:00:58 +0800 +Subject: erofs: fix potential return value overflow of z_erofs_shrink_scan() + +From: Gao Xiang + +[ Upstream commit db902986dee453bfb5835cbc8efa67154ab34caf ] + +z_erofs_shrink_scan() could return small numbers due to the mistyped +`freed`. + +Although I don't think it has any visible impact. + +Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support") +Reviewed-by: Chao Yu +Signed-off-by: Gao Xiang +Link: https://lore.kernel.org/r/20250114040058.459981-1-hsiangkao@linux.alibaba.com +Signed-off-by: Sasha Levin +--- + fs/erofs/zdata.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c +index 6be6146b67d9c..a8fb4b525f544 100644 +--- a/fs/erofs/zdata.c ++++ b/fs/erofs/zdata.c +@@ -923,8 +923,7 @@ unsigned long z_erofs_shrink_scan(struct erofs_sb_info *sbi, + unsigned long nr_shrink) + { + struct z_erofs_pcluster *pcl; +- unsigned int freed = 0; +- unsigned long index; ++ unsigned long index, freed = 0; + + xa_lock(&sbi->managed_pslots); + xa_for_each(&sbi->managed_pslots, index, pcl) { +-- +2.39.5 + diff --git a/queue-6.12/erofs-get-rid-of-erofs_-find-insert-_workgroup.patch b/queue-6.12/erofs-get-rid-of-erofs_-find-insert-_workgroup.patch new file mode 100644 index 0000000000..6556151b3f --- /dev/null +++ b/queue-6.12/erofs-get-rid-of-erofs_-find-insert-_workgroup.patch @@ -0,0 +1,176 @@ +From df31b3fb4d84962bc7f0268bd82cec1b16996feb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Oct 2024 11:53:21 +0800 +Subject: erofs: get rid of erofs_{find,insert}_workgroup + +From: Gao Xiang + +[ Upstream commit b091e8ed24b7965953147a389bac1dc7c3e8a11c ] + +Just fold them into the only two callers since +they are simple enough. + +Reviewed-by: Chao Yu +Signed-off-by: Gao Xiang +Link: https://lore.kernel.org/r/20241021035323.3280682-1-hsiangkao@linux.alibaba.com +Stable-dep-of: db902986dee4 ("erofs: fix potential return value overflow of z_erofs_shrink_scan()") +Signed-off-by: Sasha Levin +--- + fs/erofs/internal.h | 5 +---- + fs/erofs/zdata.c | 38 +++++++++++++++++++++++++--------- + fs/erofs/zutil.c | 50 +-------------------------------------------- + 3 files changed, 30 insertions(+), 63 deletions(-) + +diff --git a/fs/erofs/internal.h b/fs/erofs/internal.h +index 77e785a6dfa7f..b9649e3b2dd56 100644 +--- a/fs/erofs/internal.h ++++ b/fs/erofs/internal.h +@@ -453,10 +453,7 @@ void erofs_release_pages(struct page **pagepool); + + #ifdef CONFIG_EROFS_FS_ZIP + void erofs_workgroup_put(struct erofs_workgroup *grp); +-struct erofs_workgroup *erofs_find_workgroup(struct super_block *sb, +- pgoff_t index); +-struct erofs_workgroup *erofs_insert_workgroup(struct super_block *sb, +- struct erofs_workgroup *grp); ++bool erofs_workgroup_get(struct erofs_workgroup *grp); + void erofs_workgroup_free_rcu(struct erofs_workgroup *grp); + void erofs_shrinker_register(struct super_block *sb); + void erofs_shrinker_unregister(struct super_block *sb); +diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c +index 1a00f061798a3..8c6082fc86b29 100644 +--- a/fs/erofs/zdata.c ++++ b/fs/erofs/zdata.c +@@ -714,9 +714,10 @@ static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe) + { + struct erofs_map_blocks *map = &fe->map; + struct super_block *sb = fe->inode->i_sb; ++ struct erofs_sb_info *sbi = EROFS_SB(sb); + bool ztailpacking = map->m_flags & EROFS_MAP_META; + struct z_erofs_pcluster *pcl; +- struct erofs_workgroup *grp; ++ struct erofs_workgroup *grp, *pre; + int err; + + if (!(map->m_flags & EROFS_MAP_ENCODED) || +@@ -752,15 +753,23 @@ static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe) + pcl->obj.index = 0; /* which indicates ztailpacking */ + } else { + pcl->obj.index = erofs_blknr(sb, map->m_pa); +- +- grp = erofs_insert_workgroup(fe->inode->i_sb, &pcl->obj); +- if (IS_ERR(grp)) { +- err = PTR_ERR(grp); +- goto err_out; ++ while (1) { ++ xa_lock(&sbi->managed_pslots); ++ pre = __xa_cmpxchg(&sbi->managed_pslots, grp->index, ++ NULL, grp, GFP_KERNEL); ++ if (!pre || xa_is_err(pre) || erofs_workgroup_get(pre)) { ++ xa_unlock(&sbi->managed_pslots); ++ break; ++ } ++ /* try to legitimize the current in-tree one */ ++ xa_unlock(&sbi->managed_pslots); ++ cond_resched(); + } +- +- if (grp != &pcl->obj) { +- fe->pcl = container_of(grp, ++ if (xa_is_err(pre)) { ++ err = xa_err(pre); ++ goto err_out; ++ } else if (pre) { ++ fe->pcl = container_of(pre, + struct z_erofs_pcluster, obj); + err = -EEXIST; + goto err_out; +@@ -789,7 +798,16 @@ static int z_erofs_pcluster_begin(struct z_erofs_decompress_frontend *fe) + DBG_BUGON(fe->owned_head == Z_EROFS_PCLUSTER_NIL); + + if (!(map->m_flags & EROFS_MAP_META)) { +- grp = erofs_find_workgroup(sb, blknr); ++ while (1) { ++ rcu_read_lock(); ++ grp = xa_load(&EROFS_SB(sb)->managed_pslots, blknr); ++ if (!grp || erofs_workgroup_get(grp)) { ++ DBG_BUGON(grp && blknr != grp->index); ++ rcu_read_unlock(); ++ break; ++ } ++ rcu_read_unlock(); ++ } + } else if ((map->m_pa & ~PAGE_MASK) + map->m_plen > PAGE_SIZE) { + DBG_BUGON(1); + return -EFSCORRUPTED; +diff --git a/fs/erofs/zutil.c b/fs/erofs/zutil.c +index 37afe20248409..218b0249a4822 100644 +--- a/fs/erofs/zutil.c ++++ b/fs/erofs/zutil.c +@@ -214,7 +214,7 @@ void erofs_release_pages(struct page **pagepool) + } + } + +-static bool erofs_workgroup_get(struct erofs_workgroup *grp) ++bool erofs_workgroup_get(struct erofs_workgroup *grp) + { + if (lockref_get_not_zero(&grp->lockref)) + return true; +@@ -231,54 +231,6 @@ static bool erofs_workgroup_get(struct erofs_workgroup *grp) + return true; + } + +-struct erofs_workgroup *erofs_find_workgroup(struct super_block *sb, +- pgoff_t index) +-{ +- struct erofs_sb_info *sbi = EROFS_SB(sb); +- struct erofs_workgroup *grp; +- +-repeat: +- rcu_read_lock(); +- grp = xa_load(&sbi->managed_pslots, index); +- if (grp) { +- if (!erofs_workgroup_get(grp)) { +- /* prefer to relax rcu read side */ +- rcu_read_unlock(); +- goto repeat; +- } +- +- DBG_BUGON(index != grp->index); +- } +- rcu_read_unlock(); +- return grp; +-} +- +-struct erofs_workgroup *erofs_insert_workgroup(struct super_block *sb, +- struct erofs_workgroup *grp) +-{ +- struct erofs_sb_info *const sbi = EROFS_SB(sb); +- struct erofs_workgroup *pre; +- +- DBG_BUGON(grp->lockref.count < 1); +-repeat: +- xa_lock(&sbi->managed_pslots); +- pre = __xa_cmpxchg(&sbi->managed_pslots, grp->index, +- NULL, grp, GFP_KERNEL); +- if (pre) { +- if (xa_is_err(pre)) { +- pre = ERR_PTR(xa_err(pre)); +- } else if (!erofs_workgroup_get(pre)) { +- /* try to legitimize the current in-tree one */ +- xa_unlock(&sbi->managed_pslots); +- cond_resched(); +- goto repeat; +- } +- grp = pre; +- } +- xa_unlock(&sbi->managed_pslots); +- return grp; +-} +- + static void __erofs_workgroup_free(struct erofs_workgroup *grp) + { + atomic_long_dec(&erofs_global_shrink_cnt); +-- +2.39.5 + diff --git a/queue-6.12/erofs-move-erofs_workgroup-operations-into-zdata.c.patch b/queue-6.12/erofs-move-erofs_workgroup-operations-into-zdata.c.patch new file mode 100644 index 0000000000..55320de318 --- /dev/null +++ b/queue-6.12/erofs-move-erofs_workgroup-operations-into-zdata.c.patch @@ -0,0 +1,367 @@ +From fc1452d3efd6434e6c9f9b4ad5215fcbbf64daa2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Oct 2024 11:53:22 +0800 +Subject: erofs: move erofs_workgroup operations into zdata.c + +From: Gao Xiang + +[ Upstream commit 9c91f959626e6d9f460b8906e27c37fca1b6456a ] + +Move related helpers into zdata.c as an intermediate step of getting +rid of `struct erofs_workgroup`, and rename: + + erofs_workgroup_put => z_erofs_put_pcluster + erofs_workgroup_get => z_erofs_get_pcluster + erofs_try_to_release_workgroup => erofs_try_to_release_pcluster + erofs_shrink_workstation => z_erofs_shrink_scan + +Reviewed-by: Chao Yu +Signed-off-by: Gao Xiang +Link: https://lore.kernel.org/r/20241021035323.3280682-2-hsiangkao@linux.alibaba.com +Stable-dep-of: db902986dee4 ("erofs: fix potential return value overflow of z_erofs_shrink_scan()") +Signed-off-by: Sasha Levin +--- + fs/erofs/internal.h | 8 ++-- + fs/erofs/zdata.c | 102 ++++++++++++++++++++++++++++++++++++++--- + fs/erofs/zutil.c | 107 +++----------------------------------------- + 3 files changed, 105 insertions(+), 112 deletions(-) + +diff --git a/fs/erofs/internal.h b/fs/erofs/internal.h +index b9649e3b2dd56..5fbc76b65f5c3 100644 +--- a/fs/erofs/internal.h ++++ b/fs/erofs/internal.h +@@ -452,17 +452,15 @@ static inline void erofs_pagepool_add(struct page **pagepool, struct page *page) + void erofs_release_pages(struct page **pagepool); + + #ifdef CONFIG_EROFS_FS_ZIP +-void erofs_workgroup_put(struct erofs_workgroup *grp); +-bool erofs_workgroup_get(struct erofs_workgroup *grp); +-void erofs_workgroup_free_rcu(struct erofs_workgroup *grp); ++extern atomic_long_t erofs_global_shrink_cnt; + void erofs_shrinker_register(struct super_block *sb); + void erofs_shrinker_unregister(struct super_block *sb); + int __init erofs_init_shrinker(void); + void erofs_exit_shrinker(void); + int __init z_erofs_init_subsystem(void); + void z_erofs_exit_subsystem(void); +-int erofs_try_to_free_all_cached_folios(struct erofs_sb_info *sbi, +- struct erofs_workgroup *egrp); ++unsigned long z_erofs_shrink_scan(struct erofs_sb_info *sbi, ++ unsigned long nr_shrink); + int z_erofs_map_blocks_iter(struct inode *inode, struct erofs_map_blocks *map, + int flags); + void *z_erofs_get_gbuf(unsigned int requiredpages); +diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c +index 8c6082fc86b29..d2235f2a0acdc 100644 +--- a/fs/erofs/zdata.c ++++ b/fs/erofs/zdata.c +@@ -587,8 +587,8 @@ static void z_erofs_bind_cache(struct z_erofs_decompress_frontend *fe) + } + + /* (erofs_shrinker) disconnect cached encoded data with pclusters */ +-int erofs_try_to_free_all_cached_folios(struct erofs_sb_info *sbi, +- struct erofs_workgroup *grp) ++static int erofs_try_to_free_all_cached_folios(struct erofs_sb_info *sbi, ++ struct erofs_workgroup *grp) + { + struct z_erofs_pcluster *const pcl = + container_of(grp, struct z_erofs_pcluster, obj); +@@ -710,6 +710,23 @@ static int z_erofs_attach_page(struct z_erofs_decompress_frontend *fe, + return ret; + } + ++static bool z_erofs_get_pcluster(struct erofs_workgroup *grp) ++{ ++ if (lockref_get_not_zero(&grp->lockref)) ++ return true; ++ ++ spin_lock(&grp->lockref.lock); ++ if (__lockref_is_dead(&grp->lockref)) { ++ spin_unlock(&grp->lockref.lock); ++ return false; ++ } ++ ++ if (!grp->lockref.count++) ++ atomic_long_dec(&erofs_global_shrink_cnt); ++ spin_unlock(&grp->lockref.lock); ++ return true; ++} ++ + static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe) + { + struct erofs_map_blocks *map = &fe->map; +@@ -757,7 +774,7 @@ static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe) + xa_lock(&sbi->managed_pslots); + pre = __xa_cmpxchg(&sbi->managed_pslots, grp->index, + NULL, grp, GFP_KERNEL); +- if (!pre || xa_is_err(pre) || erofs_workgroup_get(pre)) { ++ if (!pre || xa_is_err(pre) || z_erofs_get_pcluster(pre)) { + xa_unlock(&sbi->managed_pslots); + break; + } +@@ -801,7 +818,7 @@ static int z_erofs_pcluster_begin(struct z_erofs_decompress_frontend *fe) + while (1) { + rcu_read_lock(); + grp = xa_load(&EROFS_SB(sb)->managed_pslots, blknr); +- if (!grp || erofs_workgroup_get(grp)) { ++ if (!grp || z_erofs_get_pcluster(grp)) { + DBG_BUGON(grp && blknr != grp->index); + rcu_read_unlock(); + break; +@@ -869,7 +886,7 @@ static void z_erofs_rcu_callback(struct rcu_head *head) + struct z_erofs_pcluster, rcu)); + } + +-void erofs_workgroup_free_rcu(struct erofs_workgroup *grp) ++static void erofs_workgroup_free_rcu(struct erofs_workgroup *grp) + { + struct z_erofs_pcluster *const pcl = + container_of(grp, struct z_erofs_pcluster, obj); +@@ -877,6 +894,77 @@ void erofs_workgroup_free_rcu(struct erofs_workgroup *grp) + call_rcu(&pcl->rcu, z_erofs_rcu_callback); + } + ++static bool erofs_try_to_release_pcluster(struct erofs_sb_info *sbi, ++ struct erofs_workgroup *grp) ++{ ++ int free = false; ++ ++ spin_lock(&grp->lockref.lock); ++ if (grp->lockref.count) ++ goto out; ++ ++ /* ++ * Note that all cached folios should be detached before deleted from ++ * the XArray. Otherwise some folios could be still attached to the ++ * orphan old pcluster when the new one is available in the tree. ++ */ ++ if (erofs_try_to_free_all_cached_folios(sbi, grp)) ++ goto out; ++ ++ /* ++ * It's impossible to fail after the pcluster is freezed, but in order ++ * to avoid some race conditions, add a DBG_BUGON to observe this. ++ */ ++ DBG_BUGON(__xa_erase(&sbi->managed_pslots, grp->index) != grp); ++ ++ lockref_mark_dead(&grp->lockref); ++ free = true; ++out: ++ spin_unlock(&grp->lockref.lock); ++ if (free) { ++ atomic_long_dec(&erofs_global_shrink_cnt); ++ erofs_workgroup_free_rcu(grp); ++ } ++ return free; ++} ++ ++unsigned long z_erofs_shrink_scan(struct erofs_sb_info *sbi, ++ unsigned long nr_shrink) ++{ ++ struct erofs_workgroup *grp; ++ unsigned int freed = 0; ++ unsigned long index; ++ ++ xa_lock(&sbi->managed_pslots); ++ xa_for_each(&sbi->managed_pslots, index, grp) { ++ /* try to shrink each valid pcluster */ ++ if (!erofs_try_to_release_pcluster(sbi, grp)) ++ continue; ++ xa_unlock(&sbi->managed_pslots); ++ ++ ++freed; ++ if (!--nr_shrink) ++ return freed; ++ xa_lock(&sbi->managed_pslots); ++ } ++ xa_unlock(&sbi->managed_pslots); ++ return freed; ++} ++ ++static void z_erofs_put_pcluster(struct z_erofs_pcluster *pcl) ++{ ++ struct erofs_workgroup *grp = &pcl->obj; ++ ++ if (lockref_put_or_lock(&grp->lockref)) ++ return; ++ ++ DBG_BUGON(__lockref_is_dead(&grp->lockref)); ++ if (grp->lockref.count == 1) ++ atomic_long_inc(&erofs_global_shrink_cnt); ++ --grp->lockref.count; ++ spin_unlock(&grp->lockref.lock); ++} ++ + static void z_erofs_pcluster_end(struct z_erofs_decompress_frontend *fe) + { + struct z_erofs_pcluster *pcl = fe->pcl; +@@ -895,7 +983,7 @@ static void z_erofs_pcluster_end(struct z_erofs_decompress_frontend *fe) + * any longer if the pcluster isn't hosted by ourselves. + */ + if (fe->mode < Z_EROFS_PCLUSTER_FOLLOWED_NOINPLACE) +- erofs_workgroup_put(&pcl->obj); ++ z_erofs_put_pcluster(pcl); + + fe->pcl = NULL; + } +@@ -1327,7 +1415,7 @@ static int z_erofs_decompress_queue(const struct z_erofs_decompressqueue *io, + if (z_erofs_is_inline_pcluster(be.pcl)) + z_erofs_free_pcluster(be.pcl); + else +- erofs_workgroup_put(&be.pcl->obj); ++ z_erofs_put_pcluster(be.pcl); + } + return err; + } +diff --git a/fs/erofs/zutil.c b/fs/erofs/zutil.c +index 218b0249a4822..75704f58ecfa9 100644 +--- a/fs/erofs/zutil.c ++++ b/fs/erofs/zutil.c +@@ -2,6 +2,7 @@ + /* + * Copyright (C) 2018 HUAWEI, Inc. + * https://www.huawei.com/ ++ * Copyright (C) 2024 Alibaba Cloud + */ + #include "internal.h" + +@@ -19,13 +20,12 @@ static unsigned int z_erofs_gbuf_count, z_erofs_gbuf_nrpages, + module_param_named(global_buffers, z_erofs_gbuf_count, uint, 0444); + module_param_named(reserved_pages, z_erofs_rsv_nrpages, uint, 0444); + +-static atomic_long_t erofs_global_shrink_cnt; /* for all mounted instances */ +-/* protected by 'erofs_sb_list_lock' */ +-static unsigned int shrinker_run_no; ++atomic_long_t erofs_global_shrink_cnt; /* for all mounted instances */ + +-/* protects the mounted 'erofs_sb_list' */ ++/* protects `erofs_sb_list_lock` and the mounted `erofs_sb_list` */ + static DEFINE_SPINLOCK(erofs_sb_list_lock); + static LIST_HEAD(erofs_sb_list); ++static unsigned int shrinker_run_no; + static struct shrinker *erofs_shrinker_info; + + static unsigned int z_erofs_gbuf_id(void) +@@ -214,97 +214,6 @@ void erofs_release_pages(struct page **pagepool) + } + } + +-bool erofs_workgroup_get(struct erofs_workgroup *grp) +-{ +- if (lockref_get_not_zero(&grp->lockref)) +- return true; +- +- spin_lock(&grp->lockref.lock); +- if (__lockref_is_dead(&grp->lockref)) { +- spin_unlock(&grp->lockref.lock); +- return false; +- } +- +- if (!grp->lockref.count++) +- atomic_long_dec(&erofs_global_shrink_cnt); +- spin_unlock(&grp->lockref.lock); +- return true; +-} +- +-static void __erofs_workgroup_free(struct erofs_workgroup *grp) +-{ +- atomic_long_dec(&erofs_global_shrink_cnt); +- erofs_workgroup_free_rcu(grp); +-} +- +-void erofs_workgroup_put(struct erofs_workgroup *grp) +-{ +- if (lockref_put_or_lock(&grp->lockref)) +- return; +- +- DBG_BUGON(__lockref_is_dead(&grp->lockref)); +- if (grp->lockref.count == 1) +- atomic_long_inc(&erofs_global_shrink_cnt); +- --grp->lockref.count; +- spin_unlock(&grp->lockref.lock); +-} +- +-static bool erofs_try_to_release_workgroup(struct erofs_sb_info *sbi, +- struct erofs_workgroup *grp) +-{ +- int free = false; +- +- spin_lock(&grp->lockref.lock); +- if (grp->lockref.count) +- goto out; +- +- /* +- * Note that all cached pages should be detached before deleted from +- * the XArray. Otherwise some cached pages could be still attached to +- * the orphan old workgroup when the new one is available in the tree. +- */ +- if (erofs_try_to_free_all_cached_folios(sbi, grp)) +- goto out; +- +- /* +- * It's impossible to fail after the workgroup is freezed, +- * however in order to avoid some race conditions, add a +- * DBG_BUGON to observe this in advance. +- */ +- DBG_BUGON(__xa_erase(&sbi->managed_pslots, grp->index) != grp); +- +- lockref_mark_dead(&grp->lockref); +- free = true; +-out: +- spin_unlock(&grp->lockref.lock); +- if (free) +- __erofs_workgroup_free(grp); +- return free; +-} +- +-static unsigned long erofs_shrink_workstation(struct erofs_sb_info *sbi, +- unsigned long nr_shrink) +-{ +- struct erofs_workgroup *grp; +- unsigned int freed = 0; +- unsigned long index; +- +- xa_lock(&sbi->managed_pslots); +- xa_for_each(&sbi->managed_pslots, index, grp) { +- /* try to shrink each valid workgroup */ +- if (!erofs_try_to_release_workgroup(sbi, grp)) +- continue; +- xa_unlock(&sbi->managed_pslots); +- +- ++freed; +- if (!--nr_shrink) +- return freed; +- xa_lock(&sbi->managed_pslots); +- } +- xa_unlock(&sbi->managed_pslots); +- return freed; +-} +- + void erofs_shrinker_register(struct super_block *sb) + { + struct erofs_sb_info *sbi = EROFS_SB(sb); +@@ -321,8 +230,8 @@ void erofs_shrinker_unregister(struct super_block *sb) + struct erofs_sb_info *const sbi = EROFS_SB(sb); + + mutex_lock(&sbi->umount_mutex); +- /* clean up all remaining workgroups in memory */ +- erofs_shrink_workstation(sbi, ~0UL); ++ /* clean up all remaining pclusters in memory */ ++ z_erofs_shrink_scan(sbi, ~0UL); + + spin_lock(&erofs_sb_list_lock); + list_del(&sbi->list); +@@ -370,9 +279,7 @@ static unsigned long erofs_shrink_scan(struct shrinker *shrink, + + spin_unlock(&erofs_sb_list_lock); + sbi->shrinker_run_no = run_no; +- +- freed += erofs_shrink_workstation(sbi, nr - freed); +- ++ freed += z_erofs_shrink_scan(sbi, nr - freed); + spin_lock(&erofs_sb_list_lock); + /* Get the next list element before we move this one */ + p = p->next; +-- +2.39.5 + diff --git a/queue-6.12/erofs-sunset-struct-erofs_workgroup.patch b/queue-6.12/erofs-sunset-struct-erofs_workgroup.patch new file mode 100644 index 0000000000..3278a6b140 --- /dev/null +++ b/queue-6.12/erofs-sunset-struct-erofs_workgroup.patch @@ -0,0 +1,406 @@ +From cf96b0660979feb8c98635f3035758d78ec9978a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Oct 2024 11:53:23 +0800 +Subject: erofs: sunset `struct erofs_workgroup` + +From: Gao Xiang + +[ Upstream commit bf1aa03980f4eb1599b866ccd2c4ac577ef56a8a ] + +`struct erofs_workgroup` was introduced to provide a unique header +for all physically indexed objects. However, after big pclusters and +shared pclusters are implemented upstream, it seems that all EROFS +encoded data (which requires transformation) can be represented with +`struct z_erofs_pcluster` directly. + +Move all members into `struct z_erofs_pcluster` for simplicity. + +Reviewed-by: Chao Yu +Signed-off-by: Gao Xiang +Link: https://lore.kernel.org/r/20241021035323.3280682-3-hsiangkao@linux.alibaba.com +Stable-dep-of: db902986dee4 ("erofs: fix potential return value overflow of z_erofs_shrink_scan()") +Signed-off-by: Sasha Levin +--- + fs/erofs/internal.h | 6 -- + fs/erofs/zdata.c | 131 ++++++++++++++++++++------------------------ + 2 files changed, 60 insertions(+), 77 deletions(-) + +diff --git a/fs/erofs/internal.h b/fs/erofs/internal.h +index 5fbc76b65f5c3..edbabb3256c9a 100644 +--- a/fs/erofs/internal.h ++++ b/fs/erofs/internal.h +@@ -205,12 +205,6 @@ enum { + EROFS_ZIP_CACHE_READAROUND + }; + +-/* basic unit of the workstation of a super_block */ +-struct erofs_workgroup { +- pgoff_t index; +- struct lockref lockref; +-}; +- + enum erofs_kmap_type { + EROFS_NO_KMAP, /* don't map the buffer */ + EROFS_KMAP, /* use kmap_local_page() to map the buffer */ +diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c +index d2235f2a0acdc..6be6146b67d9c 100644 +--- a/fs/erofs/zdata.c ++++ b/fs/erofs/zdata.c +@@ -44,12 +44,15 @@ __Z_EROFS_BVSET(z_erofs_bvset_inline, Z_EROFS_INLINE_BVECS); + * A: Field should be accessed / updated in atomic for parallelized code. + */ + struct z_erofs_pcluster { +- struct erofs_workgroup obj; + struct mutex lock; ++ struct lockref lockref; + + /* A: point to next chained pcluster or TAILs */ + z_erofs_next_pcluster_t next; + ++ /* I: start block address of this pcluster */ ++ erofs_off_t index; ++ + /* L: the maximum decompression size of this round */ + unsigned int length; + +@@ -108,7 +111,7 @@ struct z_erofs_decompressqueue { + + static inline bool z_erofs_is_inline_pcluster(struct z_erofs_pcluster *pcl) + { +- return !pcl->obj.index; ++ return !pcl->index; + } + + static inline unsigned int z_erofs_pclusterpages(struct z_erofs_pcluster *pcl) +@@ -548,7 +551,7 @@ static void z_erofs_bind_cache(struct z_erofs_decompress_frontend *fe) + if (READ_ONCE(pcl->compressed_bvecs[i].page)) + continue; + +- page = find_get_page(mc, pcl->obj.index + i); ++ page = find_get_page(mc, pcl->index + i); + if (!page) { + /* I/O is needed, no possible to decompress directly */ + standalone = false; +@@ -564,13 +567,13 @@ static void z_erofs_bind_cache(struct z_erofs_decompress_frontend *fe) + continue; + set_page_private(newpage, Z_EROFS_PREALLOCATED_PAGE); + } +- spin_lock(&pcl->obj.lockref.lock); ++ spin_lock(&pcl->lockref.lock); + if (!pcl->compressed_bvecs[i].page) { + pcl->compressed_bvecs[i].page = page ? page : newpage; +- spin_unlock(&pcl->obj.lockref.lock); ++ spin_unlock(&pcl->lockref.lock); + continue; + } +- spin_unlock(&pcl->obj.lockref.lock); ++ spin_unlock(&pcl->lockref.lock); + + if (page) + put_page(page); +@@ -588,10 +591,8 @@ static void z_erofs_bind_cache(struct z_erofs_decompress_frontend *fe) + + /* (erofs_shrinker) disconnect cached encoded data with pclusters */ + static int erofs_try_to_free_all_cached_folios(struct erofs_sb_info *sbi, +- struct erofs_workgroup *grp) ++ struct z_erofs_pcluster *pcl) + { +- struct z_erofs_pcluster *const pcl = +- container_of(grp, struct z_erofs_pcluster, obj); + unsigned int pclusterpages = z_erofs_pclusterpages(pcl); + struct folio *folio; + int i; +@@ -626,8 +627,8 @@ static bool z_erofs_cache_release_folio(struct folio *folio, gfp_t gfp) + return true; + + ret = false; +- spin_lock(&pcl->obj.lockref.lock); +- if (pcl->obj.lockref.count <= 0) { ++ spin_lock(&pcl->lockref.lock); ++ if (pcl->lockref.count <= 0) { + DBG_BUGON(z_erofs_is_inline_pcluster(pcl)); + for (; bvec < end; ++bvec) { + if (bvec->page && page_folio(bvec->page) == folio) { +@@ -638,7 +639,7 @@ static bool z_erofs_cache_release_folio(struct folio *folio, gfp_t gfp) + } + } + } +- spin_unlock(&pcl->obj.lockref.lock); ++ spin_unlock(&pcl->lockref.lock); + return ret; + } + +@@ -689,15 +690,15 @@ static int z_erofs_attach_page(struct z_erofs_decompress_frontend *fe, + + if (exclusive) { + /* give priority for inplaceio to use file pages first */ +- spin_lock(&pcl->obj.lockref.lock); ++ spin_lock(&pcl->lockref.lock); + while (fe->icur > 0) { + if (pcl->compressed_bvecs[--fe->icur].page) + continue; + pcl->compressed_bvecs[fe->icur] = *bvec; +- spin_unlock(&pcl->obj.lockref.lock); ++ spin_unlock(&pcl->lockref.lock); + return 0; + } +- spin_unlock(&pcl->obj.lockref.lock); ++ spin_unlock(&pcl->lockref.lock); + + /* otherwise, check if it can be used as a bvpage */ + if (fe->mode >= Z_EROFS_PCLUSTER_FOLLOWED && +@@ -710,20 +711,20 @@ static int z_erofs_attach_page(struct z_erofs_decompress_frontend *fe, + return ret; + } + +-static bool z_erofs_get_pcluster(struct erofs_workgroup *grp) ++static bool z_erofs_get_pcluster(struct z_erofs_pcluster *pcl) + { +- if (lockref_get_not_zero(&grp->lockref)) ++ if (lockref_get_not_zero(&pcl->lockref)) + return true; + +- spin_lock(&grp->lockref.lock); +- if (__lockref_is_dead(&grp->lockref)) { +- spin_unlock(&grp->lockref.lock); ++ spin_lock(&pcl->lockref.lock); ++ if (__lockref_is_dead(&pcl->lockref)) { ++ spin_unlock(&pcl->lockref.lock); + return false; + } + +- if (!grp->lockref.count++) ++ if (!pcl->lockref.count++) + atomic_long_dec(&erofs_global_shrink_cnt); +- spin_unlock(&grp->lockref.lock); ++ spin_unlock(&pcl->lockref.lock); + return true; + } + +@@ -733,8 +734,7 @@ static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe) + struct super_block *sb = fe->inode->i_sb; + struct erofs_sb_info *sbi = EROFS_SB(sb); + bool ztailpacking = map->m_flags & EROFS_MAP_META; +- struct z_erofs_pcluster *pcl; +- struct erofs_workgroup *grp, *pre; ++ struct z_erofs_pcluster *pcl, *pre; + int err; + + if (!(map->m_flags & EROFS_MAP_ENCODED) || +@@ -748,8 +748,8 @@ static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe) + if (IS_ERR(pcl)) + return PTR_ERR(pcl); + +- spin_lock_init(&pcl->obj.lockref.lock); +- pcl->obj.lockref.count = 1; /* one ref for this request */ ++ spin_lock_init(&pcl->lockref.lock); ++ pcl->lockref.count = 1; /* one ref for this request */ + pcl->algorithmformat = map->m_algorithmformat; + pcl->length = 0; + pcl->partial = true; +@@ -767,13 +767,13 @@ static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe) + DBG_BUGON(!mutex_trylock(&pcl->lock)); + + if (ztailpacking) { +- pcl->obj.index = 0; /* which indicates ztailpacking */ ++ pcl->index = 0; /* which indicates ztailpacking */ + } else { +- pcl->obj.index = erofs_blknr(sb, map->m_pa); ++ pcl->index = erofs_blknr(sb, map->m_pa); + while (1) { + xa_lock(&sbi->managed_pslots); +- pre = __xa_cmpxchg(&sbi->managed_pslots, grp->index, +- NULL, grp, GFP_KERNEL); ++ pre = __xa_cmpxchg(&sbi->managed_pslots, pcl->index, ++ NULL, pcl, GFP_KERNEL); + if (!pre || xa_is_err(pre) || z_erofs_get_pcluster(pre)) { + xa_unlock(&sbi->managed_pslots); + break; +@@ -786,8 +786,7 @@ static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe) + err = xa_err(pre); + goto err_out; + } else if (pre) { +- fe->pcl = container_of(pre, +- struct z_erofs_pcluster, obj); ++ fe->pcl = pre; + err = -EEXIST; + goto err_out; + } +@@ -807,7 +806,7 @@ static int z_erofs_pcluster_begin(struct z_erofs_decompress_frontend *fe) + struct erofs_map_blocks *map = &fe->map; + struct super_block *sb = fe->inode->i_sb; + erofs_blk_t blknr = erofs_blknr(sb, map->m_pa); +- struct erofs_workgroup *grp = NULL; ++ struct z_erofs_pcluster *pcl = NULL; + int ret; + + DBG_BUGON(fe->pcl); +@@ -817,9 +816,9 @@ static int z_erofs_pcluster_begin(struct z_erofs_decompress_frontend *fe) + if (!(map->m_flags & EROFS_MAP_META)) { + while (1) { + rcu_read_lock(); +- grp = xa_load(&EROFS_SB(sb)->managed_pslots, blknr); +- if (!grp || z_erofs_get_pcluster(grp)) { +- DBG_BUGON(grp && blknr != grp->index); ++ pcl = xa_load(&EROFS_SB(sb)->managed_pslots, blknr); ++ if (!pcl || z_erofs_get_pcluster(pcl)) { ++ DBG_BUGON(pcl && blknr != pcl->index); + rcu_read_unlock(); + break; + } +@@ -830,8 +829,8 @@ static int z_erofs_pcluster_begin(struct z_erofs_decompress_frontend *fe) + return -EFSCORRUPTED; + } + +- if (grp) { +- fe->pcl = container_of(grp, struct z_erofs_pcluster, obj); ++ if (pcl) { ++ fe->pcl = pcl; + ret = -EEXIST; + } else { + ret = z_erofs_register_pcluster(fe); +@@ -886,21 +885,13 @@ static void z_erofs_rcu_callback(struct rcu_head *head) + struct z_erofs_pcluster, rcu)); + } + +-static void erofs_workgroup_free_rcu(struct erofs_workgroup *grp) +-{ +- struct z_erofs_pcluster *const pcl = +- container_of(grp, struct z_erofs_pcluster, obj); +- +- call_rcu(&pcl->rcu, z_erofs_rcu_callback); +-} +- + static bool erofs_try_to_release_pcluster(struct erofs_sb_info *sbi, +- struct erofs_workgroup *grp) ++ struct z_erofs_pcluster *pcl) + { + int free = false; + +- spin_lock(&grp->lockref.lock); +- if (grp->lockref.count) ++ spin_lock(&pcl->lockref.lock); ++ if (pcl->lockref.count) + goto out; + + /* +@@ -908,22 +899,22 @@ static bool erofs_try_to_release_pcluster(struct erofs_sb_info *sbi, + * the XArray. Otherwise some folios could be still attached to the + * orphan old pcluster when the new one is available in the tree. + */ +- if (erofs_try_to_free_all_cached_folios(sbi, grp)) ++ if (erofs_try_to_free_all_cached_folios(sbi, pcl)) + goto out; + + /* + * It's impossible to fail after the pcluster is freezed, but in order + * to avoid some race conditions, add a DBG_BUGON to observe this. + */ +- DBG_BUGON(__xa_erase(&sbi->managed_pslots, grp->index) != grp); ++ DBG_BUGON(__xa_erase(&sbi->managed_pslots, pcl->index) != pcl); + +- lockref_mark_dead(&grp->lockref); ++ lockref_mark_dead(&pcl->lockref); + free = true; + out: +- spin_unlock(&grp->lockref.lock); ++ spin_unlock(&pcl->lockref.lock); + if (free) { + atomic_long_dec(&erofs_global_shrink_cnt); +- erofs_workgroup_free_rcu(grp); ++ call_rcu(&pcl->rcu, z_erofs_rcu_callback); + } + return free; + } +@@ -931,14 +922,14 @@ static bool erofs_try_to_release_pcluster(struct erofs_sb_info *sbi, + unsigned long z_erofs_shrink_scan(struct erofs_sb_info *sbi, + unsigned long nr_shrink) + { +- struct erofs_workgroup *grp; ++ struct z_erofs_pcluster *pcl; + unsigned int freed = 0; + unsigned long index; + + xa_lock(&sbi->managed_pslots); +- xa_for_each(&sbi->managed_pslots, index, grp) { ++ xa_for_each(&sbi->managed_pslots, index, pcl) { + /* try to shrink each valid pcluster */ +- if (!erofs_try_to_release_pcluster(sbi, grp)) ++ if (!erofs_try_to_release_pcluster(sbi, pcl)) + continue; + xa_unlock(&sbi->managed_pslots); + +@@ -953,16 +944,14 @@ unsigned long z_erofs_shrink_scan(struct erofs_sb_info *sbi, + + static void z_erofs_put_pcluster(struct z_erofs_pcluster *pcl) + { +- struct erofs_workgroup *grp = &pcl->obj; +- +- if (lockref_put_or_lock(&grp->lockref)) ++ if (lockref_put_or_lock(&pcl->lockref)) + return; + +- DBG_BUGON(__lockref_is_dead(&grp->lockref)); +- if (grp->lockref.count == 1) ++ DBG_BUGON(__lockref_is_dead(&pcl->lockref)); ++ if (pcl->lockref.count == 1) + atomic_long_inc(&erofs_global_shrink_cnt); +- --grp->lockref.count; +- spin_unlock(&grp->lockref.lock); ++ --pcl->lockref.count; ++ spin_unlock(&pcl->lockref.lock); + } + + static void z_erofs_pcluster_end(struct z_erofs_decompress_frontend *fe) +@@ -1497,9 +1486,9 @@ static void z_erofs_fill_bio_vec(struct bio_vec *bvec, + bvec->bv_offset = 0; + bvec->bv_len = PAGE_SIZE; + repeat: +- spin_lock(&pcl->obj.lockref.lock); ++ spin_lock(&pcl->lockref.lock); + zbv = pcl->compressed_bvecs[nr]; +- spin_unlock(&pcl->obj.lockref.lock); ++ spin_unlock(&pcl->lockref.lock); + if (!zbv.page) + goto out_allocfolio; + +@@ -1561,23 +1550,23 @@ static void z_erofs_fill_bio_vec(struct bio_vec *bvec, + folio_put(folio); + out_allocfolio: + page = __erofs_allocpage(&f->pagepool, gfp, true); +- spin_lock(&pcl->obj.lockref.lock); ++ spin_lock(&pcl->lockref.lock); + if (unlikely(pcl->compressed_bvecs[nr].page != zbv.page)) { + if (page) + erofs_pagepool_add(&f->pagepool, page); +- spin_unlock(&pcl->obj.lockref.lock); ++ spin_unlock(&pcl->lockref.lock); + cond_resched(); + goto repeat; + } + pcl->compressed_bvecs[nr].page = page ? page : ERR_PTR(-ENOMEM); +- spin_unlock(&pcl->obj.lockref.lock); ++ spin_unlock(&pcl->lockref.lock); + bvec->bv_page = page; + if (!page) + return; + folio = page_folio(page); + out_tocache: + if (!tocache || bs != PAGE_SIZE || +- filemap_add_folio(mc, folio, pcl->obj.index + nr, gfp)) { ++ filemap_add_folio(mc, folio, pcl->index + nr, gfp)) { + /* turn into a temporary shortlived folio (1 ref) */ + folio->private = (void *)Z_EROFS_SHORTLIVED_PAGE; + return; +@@ -1709,7 +1698,7 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f, + + /* no device id here, thus it will always succeed */ + mdev = (struct erofs_map_dev) { +- .m_pa = erofs_pos(sb, pcl->obj.index), ++ .m_pa = erofs_pos(sb, pcl->index), + }; + (void)erofs_map_dev(sb, &mdev); + +-- +2.39.5 + diff --git a/queue-6.12/ethtool-fix-set-rxnfc-command-with-symmetric-rss-has.patch b/queue-6.12/ethtool-fix-set-rxnfc-command-with-symmetric-rss-has.patch new file mode 100644 index 0000000000..99018a5bf2 --- /dev/null +++ b/queue-6.12/ethtool-fix-set-rxnfc-command-with-symmetric-rss-has.patch @@ -0,0 +1,50 @@ +From 26b79aa17dc958b998407654bc60d7dbd7280c1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Jan 2025 21:18:45 +0200 +Subject: ethtool: Fix set RXNFC command with symmetric RSS hash + +From: Gal Pressman + +[ Upstream commit 4f5a52adeb1ad675ca33f1e1eacd9c0bbaf393d4 ] + +The sanity check that both source and destination are set when symmetric +RSS hash is requested is only relevant for ETHTOOL_SRXFH (rx-flow-hash), +it should not be performed on any other commands (e.g. +ETHTOOL_SRXCLSRLINS/ETHTOOL_SRXCLSRLDEL). + +This resolves accessing uninitialized 'info.data' field, and fixes false +errors in rule insertion: + # ethtool --config-ntuple eth2 flow-type ip4 dst-ip 255.255.255.255 action -1 loc 0 + rmgr: Cannot insert RX class rule: Invalid argument + Cannot insert classification rule + +Fixes: 13e59344fb9d ("net: ethtool: add support for symmetric-xor RSS hash") +Cc: Ahmed Zaki +Reviewed-by: Tariq Toukan +Signed-off-by: Gal Pressman +Reviewed-by: Michal Swiatkowski +Reviewed-by: Edward Cree +Reviewed-by: Ahmed Zaki +Link: https://patch.msgid.link/20250126191845.316589-1-gal@nvidia.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ethtool/ioctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c +index 8b28347039b50..7b95cf1addec4 100644 +--- a/net/ethtool/ioctl.c ++++ b/net/ethtool/ioctl.c +@@ -997,7 +997,7 @@ static noinline_for_stack int ethtool_set_rxnfc(struct net_device *dev, + ethtool_get_flow_spec_ring(info.fs.ring_cookie)) + return -EINVAL; + +- if (ops->get_rxfh) { ++ if (cmd == ETHTOOL_SRXFH && ops->get_rxfh) { + struct ethtool_rxfh_param rxfh = {}; + + rc = ops->get_rxfh(dev, &rxfh); +-- +2.39.5 + diff --git a/queue-6.12/fbdev-omapfb-fix-an-of-node-leak-in-dss_of_port_get_.patch b/queue-6.12/fbdev-omapfb-fix-an-of-node-leak-in-dss_of_port_get_.patch new file mode 100644 index 0000000000..3e1ae712a5 --- /dev/null +++ b/queue-6.12/fbdev-omapfb-fix-an-of-node-leak-in-dss_of_port_get_.patch @@ -0,0 +1,42 @@ +From 7c47bdd3102207f1b6805b7911f8f8c03bfc0523 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 10:15:37 +0900 +Subject: fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device() + +From: Joe Hattori + +[ Upstream commit de124b61e179e690277116e6be512e4f422b5dd8 ] + +dss_of_port_get_parent_device() leaks an OF node reference when i >= 2 +and struct device_node *np is present. Since of_get_next_parent() +obtains a reference of the returned OF node, call of_node_put() before +returning NULL. + +This was found by an experimental verifier that I am developing, and no +runtime test was able to be performed due to that lack of actual +devices. + +Fixes: f76ee892a99e ("omapfb: copy omapdss & displays for omapfb") +Signed-off-by: Joe Hattori +Reviewed-by: Laurent Pinchart +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/omap2/omapfb/dss/dss-of.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c b/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c +index d5a43b3bf45ec..c46108a16a9dd 100644 +--- a/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c ++++ b/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c +@@ -102,6 +102,7 @@ struct device_node *dss_of_port_get_parent_device(struct device_node *port) + np = of_get_next_parent(np); + } + ++ of_node_put(np); + return NULL; + } + +-- +2.39.5 + diff --git a/queue-6.12/firewire-test-fix-potential-null-dereference-in-fire.patch b/queue-6.12/firewire-test-fix-potential-null-dereference-in-fire.patch new file mode 100644 index 0000000000..c2c177bc9d --- /dev/null +++ b/queue-6.12/firewire-test-fix-potential-null-dereference-in-fire.patch @@ -0,0 +1,45 @@ +From db84febf1a1b8a872559bb48e691e694e81cb511 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 16:42:37 +0800 +Subject: firewire: test: Fix potential null dereference in firewire kunit test + +From: Charles Han + +[ Upstream commit 352fafe97784e81a10a7c74bd508f71a19b53c2a ] + +kunit_kzalloc() may return a NULL pointer, dereferencing it without +NULL check may lead to NULL dereference. +Add a NULL check for test_state. + +Fixes: 1c8506d62624 ("firewire: test: add test of device attributes for simple AV/C device") +Signed-off-by: Charles Han +Link: https://lore.kernel.org/r/20250110084237.8877-1-hanchunchao@inspur.com +Signed-off-by: Takashi Sakamoto +Signed-off-by: Sasha Levin +--- + drivers/firewire/device-attribute-test.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/firewire/device-attribute-test.c b/drivers/firewire/device-attribute-test.c +index 2f123c6b0a165..97478a96d1c96 100644 +--- a/drivers/firewire/device-attribute-test.c ++++ b/drivers/firewire/device-attribute-test.c +@@ -99,6 +99,7 @@ static void device_attr_simple_avc(struct kunit *test) + struct device *unit0_dev = (struct device *)&unit0.device; + static const int unit0_expected_ids[] = {0x00ffffff, 0x00ffffff, 0x0000a02d, 0x00010001}; + char *buf = kunit_kzalloc(test, PAGE_SIZE, GFP_KERNEL); ++ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, buf); + int ids[4] = {0, 0, 0, 0}; + + // Ensure associations for node and unit devices. +@@ -180,6 +181,7 @@ static void device_attr_legacy_avc(struct kunit *test) + struct device *unit0_dev = (struct device *)&unit0.device; + static const int unit0_expected_ids[] = {0x00012345, 0x00fedcba, 0x00abcdef, 0x00543210}; + char *buf = kunit_kzalloc(test, PAGE_SIZE, GFP_KERNEL); ++ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, buf); + int ids[4] = {0, 0, 0, 0}; + + // Ensure associations for node and unit devices. +-- +2.39.5 + diff --git a/queue-6.12/firmware-qcom-scm-cleanup-global-__scm-on-probe-fail.patch b/queue-6.12/firmware-qcom-scm-cleanup-global-__scm-on-probe-fail.patch new file mode 100644 index 0000000000..469890289b --- /dev/null +++ b/queue-6.12/firmware-qcom-scm-cleanup-global-__scm-on-probe-fail.patch @@ -0,0 +1,115 @@ +From d2b0500fc2deec34f386f5d386ebd34ffe7c4259 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Dec 2024 15:27:57 +0100 +Subject: firmware: qcom: scm: Cleanup global '__scm' on probe failures + +From: Krzysztof Kozlowski + +[ Upstream commit 1e76b546e6fca7eb568161f408133904ca6bcf4f ] + +If SCM driver fails the probe, it should not leave global '__scm' +variable assigned, because external users of this driver will assume the +probe finished successfully. For example TZMEM parts ('__scm->mempool') +are initialized later in the probe, but users of it (__scm_smc_call()) +rely on the '__scm' variable. + +This fixes theoretical NULL pointer exception, triggered via introducing +probe deferral in SCM driver with call trace: + + qcom_tzmem_alloc+0x70/0x1ac (P) + qcom_tzmem_alloc+0x64/0x1ac (L) + qcom_scm_assign_mem+0x78/0x194 + qcom_rmtfs_mem_probe+0x2d4/0x38c + platform_probe+0x68/0xc8 + +Fixes: 40289e35ca52 ("firmware: qcom: scm: enable the TZ mem allocator") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20241209-qcom-scm-missing-barriers-and-all-sort-of-srap-v2-4-9061013c8d92@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/firmware/qcom/qcom_scm.c | 42 ++++++++++++++++++++++---------- + 1 file changed, 29 insertions(+), 13 deletions(-) + +diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c +index 14afd68664a91..a6bdedbbf7088 100644 +--- a/drivers/firmware/qcom/qcom_scm.c ++++ b/drivers/firmware/qcom/qcom_scm.c +@@ -2001,13 +2001,17 @@ static int qcom_scm_probe(struct platform_device *pdev) + + irq = platform_get_irq_optional(pdev, 0); + if (irq < 0) { +- if (irq != -ENXIO) +- return irq; ++ if (irq != -ENXIO) { ++ ret = irq; ++ goto err; ++ } + } else { + ret = devm_request_threaded_irq(__scm->dev, irq, NULL, qcom_scm_irq_handler, + IRQF_ONESHOT, "qcom-scm", __scm); +- if (ret < 0) +- return dev_err_probe(scm->dev, ret, "Failed to request qcom-scm irq\n"); ++ if (ret < 0) { ++ dev_err_probe(scm->dev, ret, "Failed to request qcom-scm irq\n"); ++ goto err; ++ } + } + + __get_convention(); +@@ -2026,14 +2030,18 @@ static int qcom_scm_probe(struct platform_device *pdev) + qcom_scm_disable_sdi(); + + ret = of_reserved_mem_device_init(__scm->dev); +- if (ret && ret != -ENODEV) +- return dev_err_probe(__scm->dev, ret, +- "Failed to setup the reserved memory region for TZ mem\n"); ++ if (ret && ret != -ENODEV) { ++ dev_err_probe(__scm->dev, ret, ++ "Failed to setup the reserved memory region for TZ mem\n"); ++ goto err; ++ } + + ret = qcom_tzmem_enable(__scm->dev); +- if (ret) +- return dev_err_probe(__scm->dev, ret, +- "Failed to enable the TrustZone memory allocator\n"); ++ if (ret) { ++ dev_err_probe(__scm->dev, ret, ++ "Failed to enable the TrustZone memory allocator\n"); ++ goto err; ++ } + + memset(&pool_config, 0, sizeof(pool_config)); + pool_config.initial_size = 0; +@@ -2041,9 +2049,11 @@ static int qcom_scm_probe(struct platform_device *pdev) + pool_config.max_size = SZ_256K; + + __scm->mempool = devm_qcom_tzmem_pool_new(__scm->dev, &pool_config); +- if (IS_ERR(__scm->mempool)) +- return dev_err_probe(__scm->dev, PTR_ERR(__scm->mempool), +- "Failed to create the SCM memory pool\n"); ++ if (IS_ERR(__scm->mempool)) { ++ dev_err_probe(__scm->dev, PTR_ERR(__scm->mempool), ++ "Failed to create the SCM memory pool\n"); ++ goto err; ++ } + + /* + * Initialize the QSEECOM interface. +@@ -2059,6 +2069,12 @@ static int qcom_scm_probe(struct platform_device *pdev) + WARN(ret < 0, "failed to initialize qseecom: %d\n", ret); + + return 0; ++ ++err: ++ /* Paired with smp_load_acquire() in qcom_scm_is_available(). */ ++ smp_store_release(&__scm, NULL); ++ ++ return ret; + } + + static void qcom_scm_shutdown(struct platform_device *pdev) +-- +2.39.5 + diff --git a/queue-6.12/fs-fix-proc_handler-for-sysctl_nr_open.patch b/queue-6.12/fs-fix-proc_handler-for-sysctl_nr_open.patch new file mode 100644 index 0000000000..56f9f3199e --- /dev/null +++ b/queue-6.12/fs-fix-proc_handler-for-sysctl_nr_open.patch @@ -0,0 +1,37 @@ +From c23e0d8ad620f5d73b874576bac8eed3ae86f917 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Nov 2024 11:46:36 +0800 +Subject: fs: fix proc_handler for sysctl_nr_open + +From: Jinliang Zheng + +[ Upstream commit d727935cad9f6f52c8d184968f9720fdc966c669 ] + +Use proc_douintvec_minmax() instead of proc_dointvec_minmax() to handle +sysctl_nr_open, because its data type is unsigned int, not int. + +Fixes: 9b80a184eaad ("fs/file: more unsigned file descriptors") +Signed-off-by: Jinliang Zheng +Link: https://lore.kernel.org/r/20241124034636.325337-1-alexjlzheng@tencent.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/file_table.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/file_table.c b/fs/file_table.c +index eed5ffad9997c..18735dc8269a1 100644 +--- a/fs/file_table.c ++++ b/fs/file_table.c +@@ -125,7 +125,7 @@ static struct ctl_table fs_stat_sysctls[] = { + .data = &sysctl_nr_open, + .maxlen = sizeof(unsigned int), + .mode = 0644, +- .proc_handler = proc_dointvec_minmax, ++ .proc_handler = proc_douintvec_minmax, + .extra1 = &sysctl_nr_open_min, + .extra2 = &sysctl_nr_open_max, + }, +-- +2.39.5 + diff --git a/queue-6.12/genirq-make-handle_enforce_irqctx-unconditionally-av.patch b/queue-6.12/genirq-make-handle_enforce_irqctx-unconditionally-av.patch new file mode 100644 index 0000000000..29855ec9df --- /dev/null +++ b/queue-6.12/genirq-make-handle_enforce_irqctx-unconditionally-av.patch @@ -0,0 +1,60 @@ +From 2d1b21965850fd7ea463486dc1509acd4b311b34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 11:20:43 +0100 +Subject: genirq: Make handle_enforce_irqctx() unconditionally available + +From: Thomas Gleixner + +[ Upstream commit 8d187a77f04c14fb459a5301d69f733a5a1396bc ] + +Commit 1b57d91b969c ("irqchip/gic-v2, v3: Prevent SW resends entirely") +sett the flag which enforces interrupt handling in interrupt context and +prevents software base resends for ARM GIC v2/v3. + +But it missed that the helper function which checks the flag was hidden +behind CONFIG_GENERIC_PENDING_IRQ, which is not set by ARM[64]. + +Make the helper unconditionally available so that the enforcement actually +works. + +Fixes: 1b57d91b969c ("irqchip/gic-v2, v3: Prevent SW resends entirely") +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/all/20241210101811.497716609@linutronix.de +Signed-off-by: Sasha Levin +--- + kernel/irq/internals.h | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h +index fe0272cd84a51..a29df4b02a2ed 100644 +--- a/kernel/irq/internals.h ++++ b/kernel/irq/internals.h +@@ -441,10 +441,6 @@ static inline struct cpumask *irq_desc_get_pending_mask(struct irq_desc *desc) + { + return desc->pending_mask; + } +-static inline bool handle_enforce_irqctx(struct irq_data *data) +-{ +- return irqd_is_handle_enforce_irqctx(data); +-} + bool irq_fixup_move_pending(struct irq_desc *desc, bool force_clear); + #else /* CONFIG_GENERIC_PENDING_IRQ */ + static inline bool irq_can_move_pcntxt(struct irq_data *data) +@@ -471,11 +467,12 @@ static inline bool irq_fixup_move_pending(struct irq_desc *desc, bool fclear) + { + return false; + } ++#endif /* !CONFIG_GENERIC_PENDING_IRQ */ ++ + static inline bool handle_enforce_irqctx(struct irq_data *data) + { +- return false; ++ return irqd_is_handle_enforce_irqctx(data); + } +-#endif /* !CONFIG_GENERIC_PENDING_IRQ */ + + #if !defined(CONFIG_IRQ_DOMAIN) || !defined(CONFIG_IRQ_DOMAIN_HIERARCHY) + static inline int irq_domain_activate_irq(struct irq_data *data, bool reserve) +-- +2.39.5 + diff --git a/queue-6.12/gpio-mxc-remove-dead-code-after-switch-to-dt-only.patch b/queue-6.12/gpio-mxc-remove-dead-code-after-switch-to-dt-only.patch new file mode 100644 index 0000000000..d5e86b0abc --- /dev/null +++ b/queue-6.12/gpio-mxc-remove-dead-code-after-switch-to-dt-only.patch @@ -0,0 +1,44 @@ +From e3b7db1d726997b68c58d2ae03aeb38593e05d50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 23:19:11 +0100 +Subject: gpio: mxc: remove dead code after switch to DT-only + +From: Ahmad Fatoum + +[ Upstream commit b049e7abe9001a780d58e78e3833dcceee22f396 ] + +struct platform_device::id was only set by board code, but since i.MX +became a devicetree-only platform, this will always be -1 +(PLATFORM_DEVID_NONE). + +Note: of_alias_get_id() returns a negative number on error and base +treats all negative errors the same, so we need not add any additional +error handling. + +Fixes: 0f2c7af45d7e ("gpio: mxc: Convert the driver to DT-only") +Signed-off-by: Ahmad Fatoum +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20250113-b4-imx-gpio-base-warning-v1-3-0a28731a5cf6@pengutronix.de +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-mxc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpio/gpio-mxc.c b/drivers/gpio/gpio-mxc.c +index 4cb455b2bdee7..619b6fb9d833a 100644 +--- a/drivers/gpio/gpio-mxc.c ++++ b/drivers/gpio/gpio-mxc.c +@@ -490,8 +490,7 @@ static int mxc_gpio_probe(struct platform_device *pdev) + port->gc.request = mxc_gpio_request; + port->gc.free = mxc_gpio_free; + port->gc.to_irq = mxc_gpio_to_irq; +- port->gc.base = (pdev->id < 0) ? of_alias_get_id(np, "gpio") * 32 : +- pdev->id * 32; ++ port->gc.base = of_alias_get_id(np, "gpio") * 32; + + err = devm_gpiochip_add_data(&pdev->dev, &port->gc, port); + if (err) +-- +2.39.5 + diff --git a/queue-6.12/gpio-pca953x-log-an-error-when-failing-to-get-the-re.patch b/queue-6.12/gpio-pca953x-log-an-error-when-failing-to-get-the-re.patch new file mode 100644 index 0000000000..2a66afead6 --- /dev/null +++ b/queue-6.12/gpio-pca953x-log-an-error-when-failing-to-get-the-re.patch @@ -0,0 +1,38 @@ +From 1d3a0bc10b1982cb174f743c4408db3ec4ee0699 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Dec 2024 10:39:46 +0100 +Subject: gpio: pca953x: log an error when failing to get the reset GPIO + +From: Luca Ceresoli + +[ Upstream commit 7cef813a91c468253c80633891393478b9f2c966 ] + +When the dirver fails getting this GPIO, it fails silently. Log an error +message to make debugging a lot easier by just reading dmesg. + +Signed-off-by: Luca Ceresoli +Fixes: 054ccdef8b28 ("gpio: pca953x: Add optional reset gpio control") +Link: https://lore.kernel.org/r/20241219-pca953x-log-no-reset-gpio-v1-1-9aa7bcc45ead@bootlin.com +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-pca953x.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c +index 3f2d33ee20cca..e49802f26e07f 100644 +--- a/drivers/gpio/gpio-pca953x.c ++++ b/drivers/gpio/gpio-pca953x.c +@@ -1088,7 +1088,8 @@ static int pca953x_probe(struct i2c_client *client) + */ + reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW); + if (IS_ERR(reset_gpio)) +- return PTR_ERR(reset_gpio); ++ return dev_err_probe(dev, PTR_ERR(reset_gpio), ++ "Failed to get reset gpio\n"); + } + + chip->client = client; +-- +2.39.5 + diff --git a/queue-6.12/hid-fix-generic-desktop-d-pad-controls.patch b/queue-6.12/hid-fix-generic-desktop-d-pad-controls.patch new file mode 100644 index 0000000000..18ac13383d --- /dev/null +++ b/queue-6.12/hid-fix-generic-desktop-d-pad-controls.patch @@ -0,0 +1,94 @@ +From 73d2efc15f832699b5e82aee84d8807650a409a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2024 19:23:18 +0000 +Subject: HID: fix generic desktop D-Pad controls + +From: Terry Tritton + +[ Upstream commit 80818fdc068eaab729bb793d790ae9fd053f7053 ] + +The addition of the "System Do Not Disturb" event code caused the Generic +Desktop D-Pad configuration to be skipped. This commit allows both to be +configured without conflicting with each other. + +Fixes: 22d6d060ac77 ("input: Add support for "Do Not Disturb"") +Signed-off-by: Terry Tritton +Reviewed-by: Aseda Aboagye +Reviewed-by: Carlos Llamas +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-input.c | 37 +++++++++++++++++-------------------- + include/linux/hid.h | 1 + + 2 files changed, 18 insertions(+), 20 deletions(-) + +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index fda9dce3da998..9d80635a91ebd 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -810,10 +810,23 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel + break; + } + +- if ((usage->hid & 0xf0) == 0x90) { /* SystemControl*/ +- switch (usage->hid & 0xf) { +- case 0xb: map_key_clear(KEY_DO_NOT_DISTURB); break; +- default: goto ignore; ++ if ((usage->hid & 0xf0) == 0x90) { /* SystemControl & D-pad */ ++ switch (usage->hid) { ++ case HID_GD_UP: usage->hat_dir = 1; break; ++ case HID_GD_DOWN: usage->hat_dir = 5; break; ++ case HID_GD_RIGHT: usage->hat_dir = 3; break; ++ case HID_GD_LEFT: usage->hat_dir = 7; break; ++ case HID_GD_DO_NOT_DISTURB: ++ map_key_clear(KEY_DO_NOT_DISTURB); break; ++ default: goto unknown; ++ } ++ ++ if (usage->hid <= HID_GD_LEFT) { ++ if (field->dpad) { ++ map_abs(field->dpad); ++ goto ignore; ++ } ++ map_abs(ABS_HAT0X); + } + break; + } +@@ -844,22 +857,6 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel + if (field->application == HID_GD_SYSTEM_CONTROL) + goto ignore; + +- if ((usage->hid & 0xf0) == 0x90) { /* D-pad */ +- switch (usage->hid) { +- case HID_GD_UP: usage->hat_dir = 1; break; +- case HID_GD_DOWN: usage->hat_dir = 5; break; +- case HID_GD_RIGHT: usage->hat_dir = 3; break; +- case HID_GD_LEFT: usage->hat_dir = 7; break; +- default: goto unknown; +- } +- if (field->dpad) { +- map_abs(field->dpad); +- goto ignore; +- } +- map_abs(ABS_HAT0X); +- break; +- } +- + switch (usage->hid) { + /* These usage IDs map directly to the usage codes. */ + case HID_GD_X: case HID_GD_Y: case HID_GD_Z: +diff --git a/include/linux/hid.h b/include/linux/hid.h +index a7d60a1c72a09..dd33423012538 100644 +--- a/include/linux/hid.h ++++ b/include/linux/hid.h +@@ -218,6 +218,7 @@ struct hid_item { + #define HID_GD_DOWN 0x00010091 + #define HID_GD_RIGHT 0x00010092 + #define HID_GD_LEFT 0x00010093 ++#define HID_GD_DO_NOT_DISTURB 0x0001009b + /* Microsoft Win8 Wireless Radio Controls CA usage codes */ + #define HID_GD_RFKILL_BTN 0x000100c6 + #define HID_GD_RFKILL_LED 0x000100c7 +-- +2.39.5 + diff --git a/queue-6.12/hid-hid-thrustmaster-fix-warning-in-thrustmaster_pro.patch b/queue-6.12/hid-hid-thrustmaster-fix-warning-in-thrustmaster_pro.patch new file mode 100644 index 0000000000..76d231216a --- /dev/null +++ b/queue-6.12/hid-hid-thrustmaster-fix-warning-in-thrustmaster_pro.patch @@ -0,0 +1,50 @@ +From b3e406b75986fca2664219378a64acf35f0b5bd1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 23:22:21 +0100 +Subject: HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding + endpoint check + +From: Karol Przybylski + +[ Upstream commit 50420d7c79c37a3efe4010ff9b1bb14bc61ebccf ] + +syzbot has found a type mismatch between a USB pipe and the transfer +endpoint, which is triggered by the hid-thrustmaster driver[1]. +There is a number of similar, already fixed issues [2]. +In this case as in others, implementing check for endpoint type fixes the issue. + +[1] https://syzkaller.appspot.com/bug?extid=040e8b3db6a96908d470 +[2] https://syzkaller.appspot.com/bug?extid=348331f63b034f89b622 + +Fixes: c49c33637802 ("HID: support for initialization of some Thrustmaster wheels") +Reported-by: syzbot+040e8b3db6a96908d470@syzkaller.appspotmail.com +Tested-by: syzbot+040e8b3db6a96908d470@syzkaller.appspotmail.com +Signed-off-by: Karol Przybylski +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-thrustmaster.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/hid/hid-thrustmaster.c b/drivers/hid/hid-thrustmaster.c +index cf1679b0d4fbb..6c3e758bbb09e 100644 +--- a/drivers/hid/hid-thrustmaster.c ++++ b/drivers/hid/hid-thrustmaster.c +@@ -170,6 +170,14 @@ static void thrustmaster_interrupts(struct hid_device *hdev) + ep = &usbif->cur_altsetting->endpoint[1]; + b_ep = ep->desc.bEndpointAddress; + ++ /* Are the expected endpoints present? */ ++ u8 ep_addr[1] = {b_ep}; ++ ++ if (!usb_check_int_endpoints(usbif, ep_addr)) { ++ hid_err(hdev, "Unexpected non-int endpoint\n"); ++ return; ++ } ++ + for (i = 0; i < ARRAY_SIZE(setup_arr); ++i) { + memcpy(send_buf, setup_arr[i], setup_arr_sizes[i]); + +-- +2.39.5 + diff --git a/queue-6.12/hid-multitouch-fix-support-for-goodix-pid-0x01e9.patch b/queue-6.12/hid-multitouch-fix-support-for-goodix-pid-0x01e9.patch new file mode 100644 index 0000000000..20b3de44fe --- /dev/null +++ b/queue-6.12/hid-multitouch-fix-support-for-goodix-pid-0x01e9.patch @@ -0,0 +1,42 @@ +From 2c3ee4d0bf336c7d9b5d943829ecaa5f3ef62433 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Dec 2024 10:19:32 +0100 +Subject: HID: multitouch: fix support for Goodix PID 0x01e9 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jiri Kosina + +[ Upstream commit 8ade5e05bd094485ce370fad66a6a3fb6f50bfbc ] + +Commit c8000deb68365b ("HID: multitouch: Add support for GT7868Q") added +support for 0x01e8 and 0x01e9, but the mt_device[] entries were added +twice for 0x01e8 and there was none added for 0x01e9. Fix that. + +Fixes: c8000deb68365b ("HID: multitouch: Add support for GT7868Q") +Reported-by: He Lugang +Reported-by: WangYuli +Reported-by: Ulrich Müller +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-multitouch.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index d1b7ccfb3e051..e07d63db5e1f4 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -2078,7 +2078,7 @@ static const struct hid_device_id mt_devices[] = { + I2C_DEVICE_ID_GOODIX_01E8) }, + { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, + HID_DEVICE(BUS_I2C, HID_GROUP_ANY, I2C_VENDOR_ID_GOODIX, +- I2C_DEVICE_ID_GOODIX_01E8) }, ++ I2C_DEVICE_ID_GOODIX_01E9) }, + + /* GoodTouch panels */ + { .driver_data = MT_CLS_NSMU, +-- +2.39.5 + diff --git a/queue-6.12/hwmon-fix-help-text-for-aspeed-g6-pwm-tach.patch b/queue-6.12/hwmon-fix-help-text-for-aspeed-g6-pwm-tach.patch new file mode 100644 index 0000000000..b0fa804639 --- /dev/null +++ b/queue-6.12/hwmon-fix-help-text-for-aspeed-g6-pwm-tach.patch @@ -0,0 +1,46 @@ +From 7b416f469f881e8d22ba28b00ac00ca0823865b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 22:17:36 +1030 +Subject: hwmon: Fix help text for aspeed-g6-pwm-tach + +From: Joel Stanley + +[ Upstream commit c8571eab11131cce6dcce76b3345c1524e074071 ] + +The help text has the wrong module name mentioned, and the capitalisation +of the title is inconsistent. + +Fixes: 7e1449cd15d1 ("hwmon: (aspeed-g6-pwm-tacho): Support for ASPEED g6 PWM/Fan tach") +Signed-off-by: Joel Stanley +Link: https://lore.kernel.org/r/20250110114737.64035-1-joel@jms.id.au +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/Kconfig | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig +index 08a3c863f80a2..58480a3f4683f 100644 +--- a/drivers/hwmon/Kconfig ++++ b/drivers/hwmon/Kconfig +@@ -413,7 +413,7 @@ config SENSORS_ASPEED + will be called aspeed_pwm_tacho. + + config SENSORS_ASPEED_G6 +- tristate "ASPEED g6 PWM and Fan tach driver" ++ tristate "ASPEED G6 PWM and Fan tach driver" + depends on ARCH_ASPEED || COMPILE_TEST + depends on PWM + help +@@ -421,7 +421,7 @@ config SENSORS_ASPEED_G6 + controllers. + + This driver can also be built as a module. If so, the module +- will be called aspeed_pwm_tacho. ++ will be called aspeed_g6_pwm_tach. + + config SENSORS_ATXP1 + tristate "Attansic ATXP1 VID controller" +-- +2.39.5 + diff --git a/queue-6.12/hwmon-nct6775-actually-make-use-of-the-hwmon_nct6775.patch b/queue-6.12/hwmon-nct6775-actually-make-use-of-the-hwmon_nct6775.patch new file mode 100644 index 0000000000..40dd030d91 --- /dev/null +++ b/queue-6.12/hwmon-nct6775-actually-make-use-of-the-hwmon_nct6775.patch @@ -0,0 +1,51 @@ +From 4af7856fe2ba1ee7b2d1194fbb11b29510f24a99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Dec 2024 18:31:49 +0100 +Subject: hwmon: (nct6775): Actually make use of the HWMON_NCT6775 symbol + namespace +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 2505f87eb3af55f3dd7f57d7cb7783b94b52a2d9 ] + +DEFAULT_SYMBOL_NAMESPACE must already be defined when +is included. So move the define above the include block. + +Fixes: c3963bc0a0cf ("hwmon: (nct6775) Split core and platform driver") +Signed-off-by: Uwe Kleine-König +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/nct6775-core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c +index c243b51837d2f..fa3351351825b 100644 +--- a/drivers/hwmon/nct6775-core.c ++++ b/drivers/hwmon/nct6775-core.c +@@ -42,6 +42,9 @@ + + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + ++#undef DEFAULT_SYMBOL_NAMESPACE ++#define DEFAULT_SYMBOL_NAMESPACE "HWMON_NCT6775" ++ + #include + #include + #include +@@ -56,9 +59,6 @@ + #include "lm75.h" + #include "nct6775.h" + +-#undef DEFAULT_SYMBOL_NAMESPACE +-#define DEFAULT_SYMBOL_NAMESPACE "HWMON_NCT6775" +- + #define USE_ALTERNATE + + /* used to set data->name = nct6775_device_names[data->sio_kind] */ +-- +2.39.5 + diff --git a/queue-6.12/i2c-designware-actually-make-use-of-the-i2c_dw_commo.patch b/queue-6.12/i2c-designware-actually-make-use-of-the-i2c_dw_commo.patch new file mode 100644 index 0000000000..ac79f7231a --- /dev/null +++ b/queue-6.12/i2c-designware-actually-make-use-of-the-i2c_dw_commo.patch @@ -0,0 +1,100 @@ +From 849d8cc1646e7dcbd6f0644bfab2f37552d0cdf3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 16:59:49 +0100 +Subject: i2c: designware: Actually make use of the I2C_DW_COMMON and I2C_DW + symbol namespaces +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit f0a4e9fa656ceb3b2e4c296cf6226798d804fa22 ] + +DEFAULT_SYMBOL_NAMESPACE must already be defined when +is included. So move the define above the include block. + +Fixes: fd57a3325a77 ("i2c: designware: Move exports to I2C_DW namespaces") +Signed-off-by: Uwe Kleine-König +Acked-by: Jarkko Nikula +Acked-by: Andy Shevchenko +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-common.c | 5 +++-- + drivers/i2c/busses/i2c-designware-master.c | 5 +++-- + drivers/i2c/busses/i2c-designware-slave.c | 5 +++-- + 3 files changed, 9 insertions(+), 6 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-designware-common.c b/drivers/i2c/busses/i2c-designware-common.c +index 0e7771d21469d..b3282785523d4 100644 +--- a/drivers/i2c/busses/i2c-designware-common.c ++++ b/drivers/i2c/busses/i2c-designware-common.c +@@ -8,6 +8,9 @@ + * Copyright (C) 2007 MontaVista Software Inc. + * Copyright (C) 2009 Provigent Ltd. + */ ++ ++#define DEFAULT_SYMBOL_NAMESPACE "I2C_DW_COMMON" ++ + #include + #include + #include +@@ -29,8 +32,6 @@ + #include + #include + +-#define DEFAULT_SYMBOL_NAMESPACE "I2C_DW_COMMON" +- + #include "i2c-designware-core.h" + + static char *abort_sources[] = { +diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c +index e23f93b8974e4..28188c6d0555e 100644 +--- a/drivers/i2c/busses/i2c-designware-master.c ++++ b/drivers/i2c/busses/i2c-designware-master.c +@@ -8,6 +8,9 @@ + * Copyright (C) 2007 MontaVista Software Inc. + * Copyright (C) 2009 Provigent Ltd. + */ ++ ++#define DEFAULT_SYMBOL_NAMESPACE "I2C_DW" ++ + #include + #include + #include +@@ -22,8 +25,6 @@ + #include + #include + +-#define DEFAULT_SYMBOL_NAMESPACE "I2C_DW" +- + #include "i2c-designware-core.h" + + #define AMD_TIMEOUT_MIN_US 25 +diff --git a/drivers/i2c/busses/i2c-designware-slave.c b/drivers/i2c/busses/i2c-designware-slave.c +index 0a76e10f77a2b..f0f0f1f2131d0 100644 +--- a/drivers/i2c/busses/i2c-designware-slave.c ++++ b/drivers/i2c/busses/i2c-designware-slave.c +@@ -6,6 +6,9 @@ + * + * Copyright (C) 2016 Synopsys Inc. + */ ++ ++#define DEFAULT_SYMBOL_NAMESPACE "I2C_DW" ++ + #include + #include + #include +@@ -16,8 +19,6 @@ + #include + #include + +-#define DEFAULT_SYMBOL_NAMESPACE "I2C_DW" +- + #include "i2c-designware-core.h" + + static void i2c_dw_configure_fifo_slave(struct dw_i2c_dev *dev) +-- +2.39.5 + diff --git a/queue-6.12/i3c-dw-fix-use-after-free-in-dw_i3c_master-driver-du.patch b/queue-6.12/i3c-dw-fix-use-after-free-in-dw_i3c_master-driver-du.patch new file mode 100644 index 0000000000..44fec249de --- /dev/null +++ b/queue-6.12/i3c-dw-fix-use-after-free-in-dw_i3c_master-driver-du.patch @@ -0,0 +1,58 @@ +From 4f6412cbbdc8bcda2865de22e652d1d06b526fc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Nov 2024 18:35:11 +0800 +Subject: i3c: dw: Fix use-after-free in dw_i3c_master driver due to race + condition + +From: Pei Xiao + +[ Upstream commit b75439c945b94dd8a2b645355bdb56f948052601 ] + +In dw_i3c_common_probe, &master->hj_work is bound with +dw_i3c_hj_work. And dw_i3c_master_irq_handler can call +dw_i3c_master_irq_handle_ibis function to start the work. + +If we remove the module which will call dw_i3c_common_remove to +make cleanup, it will free master->base through i3c_master_unregister +while the work mentioned above will be used. The sequence of operations +that may lead to a UAF bug is as follows: + +CPU0 CPU1 + + | dw_i3c_hj_work +dw_i3c_common_remove | +i3c_master_unregister(&master->base) | +device_unregister(&master->dev) | +device_release | +//free master->base | + | i3c_master_do_daa(&master->base) + | //use master->base + +Fix it by ensuring that the work is canceled before proceeding with +the cleanup in dw_i3c_common_remove. + +Fixes: 1dd728f5d4d4 ("i3c: master: Add driver for Synopsys DesignWare IP") +Signed-off-by: Pei Xiao +Acked-by: Mukesh Kumar Savaliya +Link: https://lore.kernel.org/r/bfc49c9527be5b513e7ceafeba314ca40a5be4bc.1732703537.git.xiaopei01@kylinos.cn +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/dw-i3c-master.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i3c/master/dw-i3c-master.c b/drivers/i3c/master/dw-i3c-master.c +index 8d694672c1104..dbcd3984f2578 100644 +--- a/drivers/i3c/master/dw-i3c-master.c ++++ b/drivers/i3c/master/dw-i3c-master.c +@@ -1624,6 +1624,7 @@ EXPORT_SYMBOL_GPL(dw_i3c_common_probe); + + void dw_i3c_common_remove(struct dw_i3c_master *master) + { ++ cancel_work_sync(&master->hj_work); + i3c_master_unregister(&master->base); + + pm_runtime_disable(master->dev); +-- +2.39.5 + diff --git a/queue-6.12/iavf-allow-changing-vlan-state-without-calling-pf.patch b/queue-6.12/iavf-allow-changing-vlan-state-without-calling-pf.patch new file mode 100644 index 0000000000..eb0174e0f7 --- /dev/null +++ b/queue-6.12/iavf-allow-changing-vlan-state-without-calling-pf.patch @@ -0,0 +1,111 @@ +From d0dbaf8c85a3f89ef77d6345069c16c0edeb6785 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Sep 2024 11:14:10 +0200 +Subject: iavf: allow changing VLAN state without calling PF + +From: Michal Swiatkowski + +[ Upstream commit ee7d79433d783346430ee32f28c9df44a88b3bb6 ] + +First case: +> ip l a l $VF name vlanx type vlan id 100 +> ip l d vlanx +> ip l a l $VF name vlanx type vlan id 100 + +As workqueue can be execute after sometime, there is a window to have +call trace like that: +- iavf_del_vlan +- iavf_add_vlan +- iavf_del_vlans (wq) + +It means that our VLAN 100 will change the state from IAVF_VLAN_ACTIVE +to IAVF_VLAN_REMOVE (iavf_del_vlan). After that in iavf_add_vlan state +won't be changed because VLAN 100 is on the filter list. The final +result is that the VLAN 100 filter isn't added in hardware (no +iavf_add_vlans call). + +To fix that change the state if the filter wasn't removed yet directly +to active. It is save as IAVF_VLAN_REMOVE means that virtchnl message +wasn't sent yet. + +Second case: +> ip l a l $VF name vlanx type vlan id 100 +Any type of VF reset ex. change trust +> ip l s $PF vf $VF_NUM trust on +> ip l d vlanx +> ip l a l $VF name vlanx type vlan id 100 + +In case of reset iavf driver is responsible for readding all filters +that are being used. To do that all VLAN filters state are changed to +IAVF_VLAN_ADD. Here is even longer window for changing VLAN state from +kernel side, as workqueue isn't called immediately. We can have call +trace like that: + +- changing to IAVF_VLAN_ADD (after reset) +- iavf_del_vlan (called from kernel ops) +- iavf_del_vlans (wq) + +Not exsisitng VLAN filters will be removed from hardware. It isn't a +bug, ice driver will handle it fine. However, we can have call trace +like that: + +- changing to IAVF_VLAN_ADD (after reset) +- iavf_del_vlan (called from kernel ops) +- iavf_add_vlan (called from kernel ops) +- iavf_del_vlans (wq) + +With fix for previous case we end up with no VLAN filters in hardware. +We have to remove VLAN filters if the state is IAVF_VLAN_ADD and delete +VLAN was called. It is save as IAVF_VLAN_ADD means that virtchnl message +wasn't sent yet. + +Fixes: 0c0da0e95105 ("iavf: refactor VLAN filter states") +Signed-off-by: Michal Swiatkowski +Reviewed-by: Przemek Kitszel +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index f782402cd7898..5516795cc250a 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -773,6 +773,11 @@ iavf_vlan_filter *iavf_add_vlan(struct iavf_adapter *adapter, + f->state = IAVF_VLAN_ADD; + adapter->num_vlan_filters++; + iavf_schedule_aq_request(adapter, IAVF_FLAG_AQ_ADD_VLAN_FILTER); ++ } else if (f->state == IAVF_VLAN_REMOVE) { ++ /* IAVF_VLAN_REMOVE means that VLAN wasn't yet removed. ++ * We can safely only change the state here. ++ */ ++ f->state = IAVF_VLAN_ACTIVE; + } + + clearout: +@@ -793,8 +798,18 @@ static void iavf_del_vlan(struct iavf_adapter *adapter, struct iavf_vlan vlan) + + f = iavf_find_vlan(adapter, vlan); + if (f) { +- f->state = IAVF_VLAN_REMOVE; +- iavf_schedule_aq_request(adapter, IAVF_FLAG_AQ_DEL_VLAN_FILTER); ++ /* IAVF_ADD_VLAN means that VLAN wasn't even added yet. ++ * Remove it from the list. ++ */ ++ if (f->state == IAVF_VLAN_ADD) { ++ list_del(&f->list); ++ kfree(f); ++ adapter->num_vlan_filters--; ++ } else { ++ f->state = IAVF_VLAN_REMOVE; ++ iavf_schedule_aq_request(adapter, ++ IAVF_FLAG_AQ_DEL_VLAN_FILTER); ++ } + } + + spin_unlock_bh(&adapter->mac_vlan_list_lock); +-- +2.39.5 + diff --git a/queue-6.12/ice-extend-dump-serdes-equalizer-values-feature.patch b/queue-6.12/ice-extend-dump-serdes-equalizer-values-feature.patch new file mode 100644 index 0000000000..3f21c17656 --- /dev/null +++ b/queue-6.12/ice-extend-dump-serdes-equalizer-values-feature.patch @@ -0,0 +1,118 @@ +From 6f64d76692245a163278c317f7022c95e5082bd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2024 06:26:05 -0400 +Subject: ice: extend dump serdes equalizer values feature + +From: Mateusz Polchlopek + +[ Upstream commit 99dbcab0cdd60e35d9f208b2f7515a19ba523ff6 ] + +Extend the work done in commit 70838938e89c ("ice: Implement driver +functionality to dump serdes equalizer values") by adding the new set of +Rx registers that can be read using command: + $ ethtool -d interface_name + +Rx equalization parameters are E810 PHY registers used by end user to +gather information about configuration and status to debug link and +connection issues in the field. + +Reviewed-by: Przemek Kitszel +Signed-off-by: Mateusz Polchlopek +Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) +Reviewed-by: Simon Horman +Signed-off-by: Tony Nguyen +Stable-dep-of: c5cc2a27e04f ("ice: remove invalid parameter of equalizer") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 17 +++++++++++++++++ + drivers/net/ethernet/intel/ice/ice_ethtool.c | 17 +++++++++++++++++ + drivers/net/ethernet/intel/ice/ice_ethtool.h | 17 +++++++++++++++++ + 3 files changed, 51 insertions(+) + +diff --git a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h +index 80f3dfd271243..2a61e1da993ed 100644 +--- a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h ++++ b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h +@@ -1492,6 +1492,23 @@ struct ice_aqc_dnl_equa_param { + #define ICE_AQC_RX_EQU_BFLF (0x13 << ICE_AQC_RX_EQU_SHIFT) + #define ICE_AQC_RX_EQU_BFHF (0x14 << ICE_AQC_RX_EQU_SHIFT) + #define ICE_AQC_RX_EQU_DRATE (0x15 << ICE_AQC_RX_EQU_SHIFT) ++#define ICE_AQC_RX_EQU_CTLE_GAINHF (0x20 << ICE_AQC_RX_EQU_SHIFT) ++#define ICE_AQC_RX_EQU_CTLE_GAINLF (0x21 << ICE_AQC_RX_EQU_SHIFT) ++#define ICE_AQC_RX_EQU_CTLE_GAINDC (0x22 << ICE_AQC_RX_EQU_SHIFT) ++#define ICE_AQC_RX_EQU_CTLE_BW (0x23 << ICE_AQC_RX_EQU_SHIFT) ++#define ICE_AQC_RX_EQU_DFE_GAIN (0x30 << ICE_AQC_RX_EQU_SHIFT) ++#define ICE_AQC_RX_EQU_DFE_GAIN2 (0x31 << ICE_AQC_RX_EQU_SHIFT) ++#define ICE_AQC_RX_EQU_DFE_2 (0x32 << ICE_AQC_RX_EQU_SHIFT) ++#define ICE_AQC_RX_EQU_DFE_3 (0x33 << ICE_AQC_RX_EQU_SHIFT) ++#define ICE_AQC_RX_EQU_DFE_4 (0x34 << ICE_AQC_RX_EQU_SHIFT) ++#define ICE_AQC_RX_EQU_DFE_5 (0x35 << ICE_AQC_RX_EQU_SHIFT) ++#define ICE_AQC_RX_EQU_DFE_6 (0x36 << ICE_AQC_RX_EQU_SHIFT) ++#define ICE_AQC_RX_EQU_DFE_7 (0x37 << ICE_AQC_RX_EQU_SHIFT) ++#define ICE_AQC_RX_EQU_DFE_8 (0x38 << ICE_AQC_RX_EQU_SHIFT) ++#define ICE_AQC_RX_EQU_DFE_9 (0x39 << ICE_AQC_RX_EQU_SHIFT) ++#define ICE_AQC_RX_EQU_DFE_10 (0x3A << ICE_AQC_RX_EQU_SHIFT) ++#define ICE_AQC_RX_EQU_DFE_11 (0x3B << ICE_AQC_RX_EQU_SHIFT) ++#define ICE_AQC_RX_EQU_DFE_12 (0x3C << ICE_AQC_RX_EQU_SHIFT) + #define ICE_AQC_TX_EQU_PRE1 0x0 + #define ICE_AQC_TX_EQU_PRE3 0x3 + #define ICE_AQC_TX_EQU_ATTEN 0x4 +diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c +index e011966e94502..f94b6bddbeaa1 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c +@@ -711,6 +711,23 @@ static int ice_get_tx_rx_equa(struct ice_hw *hw, u8 serdes_num, + { ICE_AQC_RX_EQU_BFLF, rx, &ptr->rx_equ_bflf }, + { ICE_AQC_RX_EQU_BFHF, rx, &ptr->rx_equ_bfhf }, + { ICE_AQC_RX_EQU_DRATE, rx, &ptr->rx_equ_drate }, ++ { ICE_AQC_RX_EQU_CTLE_GAINHF, rx, &ptr->rx_equ_ctle_gainhf }, ++ { ICE_AQC_RX_EQU_CTLE_GAINLF, rx, &ptr->rx_equ_ctle_gainlf }, ++ { ICE_AQC_RX_EQU_CTLE_GAINDC, rx, &ptr->rx_equ_ctle_gaindc }, ++ { ICE_AQC_RX_EQU_CTLE_BW, rx, &ptr->rx_equ_ctle_bw }, ++ { ICE_AQC_RX_EQU_DFE_GAIN, rx, &ptr->rx_equ_dfe_gain }, ++ { ICE_AQC_RX_EQU_DFE_GAIN2, rx, &ptr->rx_equ_dfe_gain_2 }, ++ { ICE_AQC_RX_EQU_DFE_2, rx, &ptr->rx_equ_dfe_2 }, ++ { ICE_AQC_RX_EQU_DFE_3, rx, &ptr->rx_equ_dfe_3 }, ++ { ICE_AQC_RX_EQU_DFE_4, rx, &ptr->rx_equ_dfe_4 }, ++ { ICE_AQC_RX_EQU_DFE_5, rx, &ptr->rx_equ_dfe_5 }, ++ { ICE_AQC_RX_EQU_DFE_6, rx, &ptr->rx_equ_dfe_6 }, ++ { ICE_AQC_RX_EQU_DFE_7, rx, &ptr->rx_equ_dfe_7 }, ++ { ICE_AQC_RX_EQU_DFE_8, rx, &ptr->rx_equ_dfe_8 }, ++ { ICE_AQC_RX_EQU_DFE_9, rx, &ptr->rx_equ_dfe_9 }, ++ { ICE_AQC_RX_EQU_DFE_10, rx, &ptr->rx_equ_dfe_10 }, ++ { ICE_AQC_RX_EQU_DFE_11, rx, &ptr->rx_equ_dfe_11 }, ++ { ICE_AQC_RX_EQU_DFE_12, rx, &ptr->rx_equ_dfe_12 }, + }; + int err; + +diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.h b/drivers/net/ethernet/intel/ice/ice_ethtool.h +index 98eb9c51d687c..8f2ad1c172c06 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool.h ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.h +@@ -16,6 +16,23 @@ struct ice_serdes_equalization_to_ethtool { + int rx_equ_bflf; + int rx_equ_bfhf; + int rx_equ_drate; ++ int rx_equ_ctle_gainhf; ++ int rx_equ_ctle_gainlf; ++ int rx_equ_ctle_gaindc; ++ int rx_equ_ctle_bw; ++ int rx_equ_dfe_gain; ++ int rx_equ_dfe_gain_2; ++ int rx_equ_dfe_2; ++ int rx_equ_dfe_3; ++ int rx_equ_dfe_4; ++ int rx_equ_dfe_5; ++ int rx_equ_dfe_6; ++ int rx_equ_dfe_7; ++ int rx_equ_dfe_8; ++ int rx_equ_dfe_9; ++ int rx_equ_dfe_10; ++ int rx_equ_dfe_11; ++ int rx_equ_dfe_12; + int tx_equ_pre1; + int tx_equ_pre3; + int tx_equ_atten; +-- +2.39.5 + diff --git a/queue-6.12/ice-fix-ice_parser_rt-bst_key-array-size.patch b/queue-6.12/ice-fix-ice_parser_rt-bst_key-array-size.patch new file mode 100644 index 0000000000..32dc786239 --- /dev/null +++ b/queue-6.12/ice-fix-ice_parser_rt-bst_key-array-size.patch @@ -0,0 +1,120 @@ +From f277f2ceb449bd2728512c49d024adc1cbf459f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Dec 2024 12:55:16 +0100 +Subject: ice: fix ice_parser_rt::bst_key array size + +From: Przemek Kitszel + +[ Upstream commit 18625e26fefced78f2ae28b25e80a07079821e04 ] + +Fix &ice_parser_rt::bst_key size. It was wrongly set to 10 instead of 20 +in the initial impl commit (see Fixes tag). All usage code assumed it was +of size 20. That was also the initial size present up to v2 of the intro +series [2], but halved by v3 [3] refactor described as "Replace magic +hardcoded values with macros." The introducing series was so big that +some ugliness was unnoticed, same for bugs :/ + +ICE_BST_KEY_TCAM_SIZE and ICE_BST_TCAM_KEY_SIZE were differing by one. +There was tmp variable @j in the scope of edited function, but was not +used in all places. This ugliness is now gone. +I'm moving ice_parser_rt::pg_prio a few positions up, to fill up one of +the holes in order to compensate for the added 10 bytes to the ::bst_key, +resulting in the same size of the whole as prior to the fix, and minimal +changes in the offsets of the fields. + +Extend also the debug dump print of the key to cover all bytes. To not +have string with 20 "%02x" and 20 params, switch to +ice_debug_array_w_prefix(). + +This fix obsoletes Ahmed's attempt at [1]. + +[1] https://lore.kernel.org/intel-wired-lan/20240823230847.172295-1-ahmed.zaki@intel.com +[2] https://lore.kernel.org/intel-wired-lan/20230605054641.2865142-13-junfeng.guo@intel.com +[3] https://lore.kernel.org/intel-wired-lan/20230817093442.2576997-13-junfeng.guo@intel.com + +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/intel-wired-lan/b1fb6ff9-b69e-4026-9988-3c783d86c2e0@stanley.mountain +Fixes: 9a4c07aaa0f5 ("ice: add parser execution main loop") +CC: Ahmed Zaki +Reviewed-by: Larysa Zaremba +Signed-off-by: Przemek Kitszel +Reviewed-by: Simon Horman +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_parser.h | 6 ++---- + drivers/net/ethernet/intel/ice/ice_parser_rt.c | 12 +++++------- + 2 files changed, 7 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_parser.h b/drivers/net/ethernet/intel/ice/ice_parser.h +index 6509d807627ce..4f56d53d56b9a 100644 +--- a/drivers/net/ethernet/intel/ice/ice_parser.h ++++ b/drivers/net/ethernet/intel/ice/ice_parser.h +@@ -257,7 +257,6 @@ ice_pg_nm_cam_match(struct ice_pg_nm_cam_item *table, int size, + /*** ICE_SID_RXPARSER_BOOST_TCAM and ICE_SID_LBL_RXPARSER_TMEM sections ***/ + #define ICE_BST_TCAM_TABLE_SIZE 256 + #define ICE_BST_TCAM_KEY_SIZE 20 +-#define ICE_BST_KEY_TCAM_SIZE 19 + + /* Boost TCAM item */ + struct ice_bst_tcam_item { +@@ -401,7 +400,6 @@ u16 ice_xlt_kb_flag_get(struct ice_xlt_kb *kb, u64 pkt_flag); + #define ICE_PARSER_GPR_NUM 128 + #define ICE_PARSER_FLG_NUM 64 + #define ICE_PARSER_ERR_NUM 16 +-#define ICE_BST_KEY_SIZE 10 + #define ICE_MARKER_ID_SIZE 9 + #define ICE_MARKER_MAX_SIZE \ + (ICE_MARKER_ID_SIZE * BITS_PER_BYTE - 1) +@@ -431,13 +429,13 @@ struct ice_parser_rt { + u8 pkt_buf[ICE_PARSER_MAX_PKT_LEN + ICE_PARSER_PKT_REV]; + u16 pkt_len; + u16 po; +- u8 bst_key[ICE_BST_KEY_SIZE]; ++ u8 bst_key[ICE_BST_TCAM_KEY_SIZE]; + struct ice_pg_cam_key pg_key; ++ u8 pg_prio; + struct ice_alu *alu0; + struct ice_alu *alu1; + struct ice_alu *alu2; + struct ice_pg_cam_action *action; +- u8 pg_prio; + struct ice_gpr_pu pu; + u8 markers[ICE_MARKER_ID_SIZE]; + bool protocols[ICE_PO_PAIR_SIZE]; +diff --git a/drivers/net/ethernet/intel/ice/ice_parser_rt.c b/drivers/net/ethernet/intel/ice/ice_parser_rt.c +index dedf5e854e4b7..3995d662e0509 100644 +--- a/drivers/net/ethernet/intel/ice/ice_parser_rt.c ++++ b/drivers/net/ethernet/intel/ice/ice_parser_rt.c +@@ -125,22 +125,20 @@ static void ice_bst_key_init(struct ice_parser_rt *rt, + else + key[idd] = imem->b_kb.prio; + +- idd = ICE_BST_KEY_TCAM_SIZE - 1; ++ idd = ICE_BST_TCAM_KEY_SIZE - 2; + for (i = idd; i >= 0; i--) { + int j; + + j = ho + idd - i; + if (j < ICE_PARSER_MAX_PKT_LEN) +- key[i] = rt->pkt_buf[ho + idd - i]; ++ key[i] = rt->pkt_buf[j]; + else + key[i] = 0; + } + +- ice_debug(rt->psr->hw, ICE_DBG_PARSER, "Generated Boost TCAM Key:\n"); +- ice_debug(rt->psr->hw, ICE_DBG_PARSER, "%02X %02X %02X %02X %02X %02X %02X %02X %02X %02X\n", +- key[0], key[1], key[2], key[3], key[4], +- key[5], key[6], key[7], key[8], key[9]); +- ice_debug(rt->psr->hw, ICE_DBG_PARSER, "\n"); ++ ice_debug_array_w_prefix(rt->psr->hw, ICE_DBG_PARSER, ++ KBUILD_MODNAME ": Generated Boost TCAM Key", ++ key, ICE_BST_TCAM_KEY_SIZE); + } + + static u16 ice_bit_rev_u16(u16 v, int len) +-- +2.39.5 + diff --git a/queue-6.12/ice-remove-invalid-parameter-of-equalizer.patch b/queue-6.12/ice-remove-invalid-parameter-of-equalizer.patch new file mode 100644 index 0000000000..1ad3a1524f --- /dev/null +++ b/queue-6.12/ice-remove-invalid-parameter-of-equalizer.patch @@ -0,0 +1,72 @@ +From a9c5be8bc1fd28c06fee2aa055d9a6993f6db961 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Dec 2024 10:50:44 +0100 +Subject: ice: remove invalid parameter of equalizer + +From: Mateusz Polchlopek + +[ Upstream commit c5cc2a27e04f2fcd77c74ada9aef76a758a24697 ] + +It occurred that in the commit 70838938e89c ("ice: Implement driver +functionality to dump serdes equalizer values") the invalid DRATE parameter +for reading has been added. The output of the command: + + $ ethtool -d + +returns the garbage value in the place where DRATE value should be +stored. + +Remove mentioned parameter to prevent return of corrupted data to +userspace. + +Fixes: 70838938e89c ("ice: Implement driver functionality to dump serdes equalizer values") +Signed-off-by: Mateusz Polchlopek +Reviewed-by: Michal Swiatkowski +Tested-by: Rinitha S (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 1 - + drivers/net/ethernet/intel/ice/ice_ethtool.c | 1 - + drivers/net/ethernet/intel/ice/ice_ethtool.h | 1 - + 3 files changed, 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h +index 2a61e1da993ed..66ae0352c6bca 100644 +--- a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h ++++ b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h +@@ -1491,7 +1491,6 @@ struct ice_aqc_dnl_equa_param { + #define ICE_AQC_RX_EQU_POST1 (0x12 << ICE_AQC_RX_EQU_SHIFT) + #define ICE_AQC_RX_EQU_BFLF (0x13 << ICE_AQC_RX_EQU_SHIFT) + #define ICE_AQC_RX_EQU_BFHF (0x14 << ICE_AQC_RX_EQU_SHIFT) +-#define ICE_AQC_RX_EQU_DRATE (0x15 << ICE_AQC_RX_EQU_SHIFT) + #define ICE_AQC_RX_EQU_CTLE_GAINHF (0x20 << ICE_AQC_RX_EQU_SHIFT) + #define ICE_AQC_RX_EQU_CTLE_GAINLF (0x21 << ICE_AQC_RX_EQU_SHIFT) + #define ICE_AQC_RX_EQU_CTLE_GAINDC (0x22 << ICE_AQC_RX_EQU_SHIFT) +diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c +index f94b6bddbeaa1..7d1feeb317be3 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c +@@ -710,7 +710,6 @@ static int ice_get_tx_rx_equa(struct ice_hw *hw, u8 serdes_num, + { ICE_AQC_RX_EQU_POST1, rx, &ptr->rx_equ_post1 }, + { ICE_AQC_RX_EQU_BFLF, rx, &ptr->rx_equ_bflf }, + { ICE_AQC_RX_EQU_BFHF, rx, &ptr->rx_equ_bfhf }, +- { ICE_AQC_RX_EQU_DRATE, rx, &ptr->rx_equ_drate }, + { ICE_AQC_RX_EQU_CTLE_GAINHF, rx, &ptr->rx_equ_ctle_gainhf }, + { ICE_AQC_RX_EQU_CTLE_GAINLF, rx, &ptr->rx_equ_ctle_gainlf }, + { ICE_AQC_RX_EQU_CTLE_GAINDC, rx, &ptr->rx_equ_ctle_gaindc }, +diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.h b/drivers/net/ethernet/intel/ice/ice_ethtool.h +index 8f2ad1c172c06..23b2cfbc9684c 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool.h ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.h +@@ -15,7 +15,6 @@ struct ice_serdes_equalization_to_ethtool { + int rx_equ_post1; + int rx_equ_bflf; + int rx_equ_bfhf; +- int rx_equ_drate; + int rx_equ_ctle_gainhf; + int rx_equ_ctle_gainlf; + int rx_equ_ctle_gaindc; +-- +2.39.5 + diff --git a/queue-6.12/ice-rework-of-dump-serdes-equalizer-values-feature.patch b/queue-6.12/ice-rework-of-dump-serdes-equalizer-values-feature.patch new file mode 100644 index 0000000000..b83b48588f --- /dev/null +++ b/queue-6.12/ice-rework-of-dump-serdes-equalizer-values-feature.patch @@ -0,0 +1,173 @@ +From 342877c2da1a88095ee89b5e7d424ad6a8f91f3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2024 06:26:04 -0400 +Subject: ice: rework of dump serdes equalizer values feature + +From: Mateusz Polchlopek + +[ Upstream commit 8ea085937dad2d0b5399bc58722934f562b9abef ] + +Refactor function ice_get_tx_rx_equa() to iterate over new table of +params instead of multiple calls to ice_aq_get_phy_equalization(). + +Subsequent commit will extend that function by add more serdes equalizer +values to dump. + +Shorten the fields of struct ice_serdes_equalization_to_ethtool for +readability purposes. + +Reviewed-by: Przemek Kitszel +Signed-off-by: Mateusz Polchlopek +Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) +Reviewed-by: Simon Horman +Signed-off-by: Tony Nguyen +Stable-dep-of: c5cc2a27e04f ("ice: remove invalid parameter of equalizer") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_ethtool.c | 93 ++++++-------------- + drivers/net/ethernet/intel/ice/ice_ethtool.h | 22 ++--- + 2 files changed, 38 insertions(+), 77 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c +index d5cc934d13594..e011966e94502 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c +@@ -693,75 +693,36 @@ static int ice_get_port_topology(struct ice_hw *hw, u8 lport, + static int ice_get_tx_rx_equa(struct ice_hw *hw, u8 serdes_num, + struct ice_serdes_equalization_to_ethtool *ptr) + { ++ static const int tx = ICE_AQC_OP_CODE_TX_EQU; ++ static const int rx = ICE_AQC_OP_CODE_RX_EQU; ++ struct { ++ int data_in; ++ int opcode; ++ int *out; ++ } aq_params[] = { ++ { ICE_AQC_TX_EQU_PRE1, tx, &ptr->tx_equ_pre1 }, ++ { ICE_AQC_TX_EQU_PRE3, tx, &ptr->tx_equ_pre3 }, ++ { ICE_AQC_TX_EQU_ATTEN, tx, &ptr->tx_equ_atten }, ++ { ICE_AQC_TX_EQU_POST1, tx, &ptr->tx_equ_post1 }, ++ { ICE_AQC_TX_EQU_PRE2, tx, &ptr->tx_equ_pre2 }, ++ { ICE_AQC_RX_EQU_PRE2, rx, &ptr->rx_equ_pre2 }, ++ { ICE_AQC_RX_EQU_PRE1, rx, &ptr->rx_equ_pre1 }, ++ { ICE_AQC_RX_EQU_POST1, rx, &ptr->rx_equ_post1 }, ++ { ICE_AQC_RX_EQU_BFLF, rx, &ptr->rx_equ_bflf }, ++ { ICE_AQC_RX_EQU_BFHF, rx, &ptr->rx_equ_bfhf }, ++ { ICE_AQC_RX_EQU_DRATE, rx, &ptr->rx_equ_drate }, ++ }; + int err; + +- err = ice_aq_get_phy_equalization(hw, ICE_AQC_TX_EQU_PRE1, +- ICE_AQC_OP_CODE_TX_EQU, serdes_num, +- &ptr->tx_equalization_pre1); +- if (err) +- return err; +- +- err = ice_aq_get_phy_equalization(hw, ICE_AQC_TX_EQU_PRE3, +- ICE_AQC_OP_CODE_TX_EQU, serdes_num, +- &ptr->tx_equalization_pre3); +- if (err) +- return err; +- +- err = ice_aq_get_phy_equalization(hw, ICE_AQC_TX_EQU_ATTEN, +- ICE_AQC_OP_CODE_TX_EQU, serdes_num, +- &ptr->tx_equalization_atten); +- if (err) +- return err; +- +- err = ice_aq_get_phy_equalization(hw, ICE_AQC_TX_EQU_POST1, +- ICE_AQC_OP_CODE_TX_EQU, serdes_num, +- &ptr->tx_equalization_post1); +- if (err) +- return err; +- +- err = ice_aq_get_phy_equalization(hw, ICE_AQC_TX_EQU_PRE2, +- ICE_AQC_OP_CODE_TX_EQU, serdes_num, +- &ptr->tx_equalization_pre2); +- if (err) +- return err; +- +- err = ice_aq_get_phy_equalization(hw, ICE_AQC_RX_EQU_PRE2, +- ICE_AQC_OP_CODE_RX_EQU, serdes_num, +- &ptr->rx_equalization_pre2); +- if (err) +- return err; +- +- err = ice_aq_get_phy_equalization(hw, ICE_AQC_RX_EQU_PRE1, +- ICE_AQC_OP_CODE_RX_EQU, serdes_num, +- &ptr->rx_equalization_pre1); +- if (err) +- return err; +- +- err = ice_aq_get_phy_equalization(hw, ICE_AQC_RX_EQU_POST1, +- ICE_AQC_OP_CODE_RX_EQU, serdes_num, +- &ptr->rx_equalization_post1); +- if (err) +- return err; +- +- err = ice_aq_get_phy_equalization(hw, ICE_AQC_RX_EQU_BFLF, +- ICE_AQC_OP_CODE_RX_EQU, serdes_num, +- &ptr->rx_equalization_bflf); +- if (err) +- return err; +- +- err = ice_aq_get_phy_equalization(hw, ICE_AQC_RX_EQU_BFHF, +- ICE_AQC_OP_CODE_RX_EQU, serdes_num, +- &ptr->rx_equalization_bfhf); +- if (err) +- return err; +- +- err = ice_aq_get_phy_equalization(hw, ICE_AQC_RX_EQU_DRATE, +- ICE_AQC_OP_CODE_RX_EQU, serdes_num, +- &ptr->rx_equalization_drate); +- if (err) +- return err; ++ for (int i = 0; i < ARRAY_SIZE(aq_params); i++) { ++ err = ice_aq_get_phy_equalization(hw, aq_params[i].data_in, ++ aq_params[i].opcode, ++ serdes_num, aq_params[i].out); ++ if (err) ++ break; ++ } + +- return 0; ++ return err; + } + + /** +diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.h b/drivers/net/ethernet/intel/ice/ice_ethtool.h +index 9acccae38625a..98eb9c51d687c 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool.h ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.h +@@ -10,17 +10,17 @@ struct ice_phy_type_to_ethtool { + }; + + struct ice_serdes_equalization_to_ethtool { +- int rx_equalization_pre2; +- int rx_equalization_pre1; +- int rx_equalization_post1; +- int rx_equalization_bflf; +- int rx_equalization_bfhf; +- int rx_equalization_drate; +- int tx_equalization_pre1; +- int tx_equalization_pre3; +- int tx_equalization_atten; +- int tx_equalization_post1; +- int tx_equalization_pre2; ++ int rx_equ_pre2; ++ int rx_equ_pre1; ++ int rx_equ_post1; ++ int rx_equ_bflf; ++ int rx_equ_bfhf; ++ int rx_equ_drate; ++ int tx_equ_pre1; ++ int tx_equ_pre3; ++ int tx_equ_atten; ++ int tx_equ_post1; ++ int tx_equ_pre2; + }; + + struct ice_regdump_to_ethtool { +-- +2.39.5 + diff --git a/queue-6.12/idpf-acquire-the-lock-before-accessing-the-xn-salt.patch b/queue-6.12/idpf-acquire-the-lock-before-accessing-the-xn-salt.patch new file mode 100644 index 0000000000..8fc946dc94 --- /dev/null +++ b/queue-6.12/idpf-acquire-the-lock-before-accessing-the-xn-salt.patch @@ -0,0 +1,49 @@ +From 46041052c0f60cf3e6802a8260f805f911ca0e42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Dec 2024 16:27:33 +0000 +Subject: idpf: Acquire the lock before accessing the xn->salt + +From: Manoj Vishwanathan + +[ Upstream commit d15fe4edd7decdf14d8ad2b78df100ea23302065 ] + +The transaction salt was being accessed before acquiring the +idpf_vc_xn_lock when idpf has to forward the virtchnl reply. + +Fixes: 34c21fa894a1 ("idpf: implement virtchnl transaction manager") +Signed-off-by: Manoj Vishwanathan +Signed-off-by: David Decotigny +Signed-off-by: Brian Vazquez +Reviewed-by: Jacob Keller +Reviewed-by: Pavan Kumar Linga +Tested-by: Krishneil Singh +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c +index 7639d520b8063..99bdb95bf2266 100644 +--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c ++++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c +@@ -612,14 +612,15 @@ idpf_vc_xn_forward_reply(struct idpf_adapter *adapter, + return -EINVAL; + } + xn = &adapter->vcxn_mngr->ring[xn_idx]; ++ idpf_vc_xn_lock(xn); + salt = FIELD_GET(IDPF_VC_XN_SALT_M, msg_info); + if (xn->salt != salt) { + dev_err_ratelimited(&adapter->pdev->dev, "Transaction salt does not match (%02x != %02x)\n", + xn->salt, salt); ++ idpf_vc_xn_unlock(xn); + return -EINVAL; + } + +- idpf_vc_xn_lock(xn); + switch (xn->state) { + case IDPF_VC_XN_WAITING: + /* success */ +-- +2.39.5 + diff --git a/queue-6.12/idpf-add-read-memory-barrier-when-checking-descripto.patch b/queue-6.12/idpf-add-read-memory-barrier-when-checking-descripto.patch new file mode 100644 index 0000000000..24a635d918 --- /dev/null +++ b/queue-6.12/idpf-add-read-memory-barrier-when-checking-descripto.patch @@ -0,0 +1,63 @@ +From d1c56c2e50fe8c3e82f4f887d7177dc0c363ac8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Nov 2024 20:40:59 -0800 +Subject: idpf: add read memory barrier when checking descriptor done bit + +From: Emil Tantilov + +[ Upstream commit 396f0165672c6a74d7379027d344b83b5f05948c ] + +Add read memory barrier to ensure the order of operations when accessing +control queue descriptors. Specifically, we want to avoid cases where loads +can be reordered: + +1. Load #1 is dispatched to read descriptor flags. +2. Load #2 is dispatched to read some other field from the descriptor. +3. Load #2 completes, accessing memory/cache at a point in time when the DD + flag is zero. +4. NIC DMA overwrites the descriptor, now the DD flag is one. +5. Any fields loaded before step 4 are now inconsistent with the actual + descriptor state. + +Add read memory barrier between steps 1 and 2, so that load #2 is not +executed until load #1 has completed. + +Fixes: 8077c727561a ("idpf: add controlq init and reset checks") +Reviewed-by: Przemek Kitszel +Reviewed-by: Sridhar Samudrala +Suggested-by: Lance Richardson +Signed-off-by: Emil Tantilov +Tested-by: Krishneil Singh +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/idpf/idpf_controlq.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/ethernet/intel/idpf/idpf_controlq.c b/drivers/net/ethernet/intel/idpf/idpf_controlq.c +index 4849590a5591f..b28991dd18703 100644 +--- a/drivers/net/ethernet/intel/idpf/idpf_controlq.c ++++ b/drivers/net/ethernet/intel/idpf/idpf_controlq.c +@@ -376,6 +376,9 @@ int idpf_ctlq_clean_sq(struct idpf_ctlq_info *cq, u16 *clean_count, + if (!(le16_to_cpu(desc->flags) & IDPF_CTLQ_FLAG_DD)) + break; + ++ /* Ensure no other fields are read until DD flag is checked */ ++ dma_rmb(); ++ + /* strip off FW internal code */ + desc_err = le16_to_cpu(desc->ret_val) & 0xff; + +@@ -563,6 +566,9 @@ int idpf_ctlq_recv(struct idpf_ctlq_info *cq, u16 *num_q_msg, + if (!(flags & IDPF_CTLQ_FLAG_DD)) + break; + ++ /* Ensure no other fields are read until DD flag is checked */ ++ dma_rmb(); ++ + q_msg[i].vmvf_type = (flags & + (IDPF_CTLQ_FLAG_FTYPE_VM | + IDPF_CTLQ_FLAG_FTYPE_PF)) >> +-- +2.39.5 + diff --git a/queue-6.12/idpf-convert-workqueues-to-unbound.patch b/queue-6.12/idpf-convert-workqueues-to-unbound.patch new file mode 100644 index 0000000000..940c44d75a --- /dev/null +++ b/queue-6.12/idpf-convert-workqueues-to-unbound.patch @@ -0,0 +1,117 @@ +From defab72f33e418fbea33a5275c8188ba30d7c428 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Dec 2024 16:27:34 +0000 +Subject: idpf: convert workqueues to unbound + +From: Marco Leogrande + +[ Upstream commit 9a5b021cb8186f1854bac2812bd4f396bb1e881c ] + +When a workqueue is created with `WQ_UNBOUND`, its work items are +served by special worker-pools, whose host workers are not bound to +any specific CPU. In the default configuration (i.e. when +`queue_delayed_work` and friends do not specify which CPU to run the +work item on), `WQ_UNBOUND` allows the work item to be executed on any +CPU in the same node of the CPU it was enqueued on. While this +solution potentially sacrifices locality, it avoids contention with +other processes that might dominate the CPU time of the processor the +work item was scheduled on. + +This is not just a theoretical problem: in a particular scenario +misconfigured process was hogging most of the time from CPU0, leaving +less than 0.5% of its CPU time to the kworker. The IDPF workqueues +that were using the kworker on CPU0 suffered large completion delays +as a result, causing performance degradation, timeouts and eventual +system crash. + +Tested: + +* I have also run a manual test to gauge the performance + improvement. The test consists of an antagonist process + (`./stress --cpu 2`) consuming as much of CPU 0 as possible. This + process is run under `taskset 01` to bind it to CPU0, and its + priority is changed with `chrt -pQ 9900 10000 ${pid}` and + `renice -n -20 ${pid}` after start. + + Then, the IDPF driver is forced to prefer CPU0 by editing all calls + to `queue_delayed_work`, `mod_delayed_work`, etc... to use CPU 0. + + Finally, `ktraces` for the workqueue events are collected. + + Without the current patch, the antagonist process can force + arbitrary delays between `workqueue_queue_work` and + `workqueue_execute_start`, that in my tests were as high as + `30ms`. With the current patch applied, the workqueue can be + migrated to another unloaded CPU in the same node, and, keeping + everything else equal, the maximum delay I could see was `6us`. + +Fixes: 0fe45467a104 ("idpf: add create vport and netdev configuration") +Signed-off-by: Marco Leogrande +Signed-off-by: Manoj Vishwanathan +Signed-off-by: Brian Vazquez +Reviewed-by: Jacob Keller +Reviewed-by: Pavan Kumar Linga +Tested-by: Krishneil Singh +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/idpf/idpf_main.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/intel/idpf/idpf_main.c b/drivers/net/ethernet/intel/idpf/idpf_main.c +index db476b3314c8a..dfd56fc5ff655 100644 +--- a/drivers/net/ethernet/intel/idpf/idpf_main.c ++++ b/drivers/net/ethernet/intel/idpf/idpf_main.c +@@ -174,7 +174,8 @@ static int idpf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + pci_set_master(pdev); + pci_set_drvdata(pdev, adapter); + +- adapter->init_wq = alloc_workqueue("%s-%s-init", 0, 0, ++ adapter->init_wq = alloc_workqueue("%s-%s-init", ++ WQ_UNBOUND | WQ_MEM_RECLAIM, 0, + dev_driver_string(dev), + dev_name(dev)); + if (!adapter->init_wq) { +@@ -183,7 +184,8 @@ static int idpf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + goto err_free; + } + +- adapter->serv_wq = alloc_workqueue("%s-%s-service", 0, 0, ++ adapter->serv_wq = alloc_workqueue("%s-%s-service", ++ WQ_UNBOUND | WQ_MEM_RECLAIM, 0, + dev_driver_string(dev), + dev_name(dev)); + if (!adapter->serv_wq) { +@@ -192,7 +194,8 @@ static int idpf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + goto err_serv_wq_alloc; + } + +- adapter->mbx_wq = alloc_workqueue("%s-%s-mbx", 0, 0, ++ adapter->mbx_wq = alloc_workqueue("%s-%s-mbx", ++ WQ_UNBOUND | WQ_MEM_RECLAIM, 0, + dev_driver_string(dev), + dev_name(dev)); + if (!adapter->mbx_wq) { +@@ -201,7 +204,8 @@ static int idpf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + goto err_mbx_wq_alloc; + } + +- adapter->stats_wq = alloc_workqueue("%s-%s-stats", 0, 0, ++ adapter->stats_wq = alloc_workqueue("%s-%s-stats", ++ WQ_UNBOUND | WQ_MEM_RECLAIM, 0, + dev_driver_string(dev), + dev_name(dev)); + if (!adapter->stats_wq) { +@@ -210,7 +214,8 @@ static int idpf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + goto err_stats_wq_alloc; + } + +- adapter->vc_event_wq = alloc_workqueue("%s-%s-vc_event", 0, 0, ++ adapter->vc_event_wq = alloc_workqueue("%s-%s-vc_event", ++ WQ_UNBOUND | WQ_MEM_RECLAIM, 0, + dev_driver_string(dev), + dev_name(dev)); + if (!adapter->vc_event_wq) { +-- +2.39.5 + diff --git a/queue-6.12/idpf-fix-transaction-timeouts-on-reset.patch b/queue-6.12/idpf-fix-transaction-timeouts-on-reset.patch new file mode 100644 index 0000000000..e1cbb16c8a --- /dev/null +++ b/queue-6.12/idpf-fix-transaction-timeouts-on-reset.patch @@ -0,0 +1,55 @@ +From dda238c7f590b3629228431bc7012153b937139c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Dec 2024 18:09:32 -0800 +Subject: idpf: fix transaction timeouts on reset + +From: Emil Tantilov + +[ Upstream commit 137da75ba72593598898a4e79da34f4b2da5d151 ] + +Restore the call to idpf_vc_xn_shutdown() at the beginning of +idpf_vc_core_deinit() provided the function is not called on remove. +In the reset path the mailbox is destroyed, leading to all transactions +timing out. + +Fixes: 09d0fb5cb30e ("idpf: deinit virtchnl transaction manager after vport and vectors") +Reviewed-by: Larysa Zaremba +Signed-off-by: Emil Tantilov +Reviewed-by: Simon Horman +Tested-by: Krishneil Singh +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c +index d46c95f91b0d8..7639d520b8063 100644 +--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c ++++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c +@@ -3077,12 +3077,21 @@ int idpf_vc_core_init(struct idpf_adapter *adapter) + */ + void idpf_vc_core_deinit(struct idpf_adapter *adapter) + { ++ bool remove_in_prog; ++ + if (!test_bit(IDPF_VC_CORE_INIT, adapter->flags)) + return; + ++ /* Avoid transaction timeouts when called during reset */ ++ remove_in_prog = test_bit(IDPF_REMOVE_IN_PROG, adapter->flags); ++ if (!remove_in_prog) ++ idpf_vc_xn_shutdown(adapter->vcxn_mngr); ++ + idpf_deinit_task(adapter); + idpf_intr_rel(adapter); +- idpf_vc_xn_shutdown(adapter->vcxn_mngr); ++ ++ if (remove_in_prog) ++ idpf_vc_xn_shutdown(adapter->vcxn_mngr); + + cancel_delayed_work_sync(&adapter->serv_task); + cancel_delayed_work_sync(&adapter->mbx_task); +-- +2.39.5 + diff --git a/queue-6.12/inet-ipmr-fix-data-races.patch b/queue-6.12/inet-ipmr-fix-data-races.patch new file mode 100644 index 0000000000..bc7457e8d0 --- /dev/null +++ b/queue-6.12/inet-ipmr-fix-data-races.patch @@ -0,0 +1,241 @@ +From 310c76e13c6913af38f83f306ac6a30b6d081ea4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jan 2025 22:10:49 +0000 +Subject: inet: ipmr: fix data-races + +From: Eric Dumazet + +[ Upstream commit 3440fa34ad99d471f1085bc2f4dedeaebc310261 ] + +Following fields of 'struct mr_mfc' can be updated +concurrently (no lock protection) from ip_mr_forward() +and ip6_mr_forward() + +- bytes +- pkt +- wrong_if +- lastuse + +They also can be read from other functions. + +Convert bytes, pkt and wrong_if to atomic_long_t, +and use READ_ONCE()/WRITE_ONCE() for lastuse. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Link: https://patch.msgid.link/20250114221049.1190631-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlxsw/spectrum_mr.c | 8 +++--- + include/linux/mroute_base.h | 6 ++-- + net/ipv4/ipmr.c | 28 +++++++++---------- + net/ipv4/ipmr_base.c | 6 ++-- + net/ipv6/ip6mr.c | 28 +++++++++---------- + 5 files changed, 38 insertions(+), 38 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c +index 69cd689dbc83e..5afe6b155ef0d 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c +@@ -1003,10 +1003,10 @@ static void mlxsw_sp_mr_route_stats_update(struct mlxsw_sp *mlxsw_sp, + mr->mr_ops->route_stats(mlxsw_sp, mr_route->route_priv, &packets, + &bytes); + +- if (mr_route->mfc->mfc_un.res.pkt != packets) +- mr_route->mfc->mfc_un.res.lastuse = jiffies; +- mr_route->mfc->mfc_un.res.pkt = packets; +- mr_route->mfc->mfc_un.res.bytes = bytes; ++ if (atomic_long_read(&mr_route->mfc->mfc_un.res.pkt) != packets) ++ WRITE_ONCE(mr_route->mfc->mfc_un.res.lastuse, jiffies); ++ atomic_long_set(&mr_route->mfc->mfc_un.res.pkt, packets); ++ atomic_long_set(&mr_route->mfc->mfc_un.res.bytes, bytes); + } + + static void mlxsw_sp_mr_stats_update(struct work_struct *work) +diff --git a/include/linux/mroute_base.h b/include/linux/mroute_base.h +index 9dd4bf1572553..58a2401e4b551 100644 +--- a/include/linux/mroute_base.h ++++ b/include/linux/mroute_base.h +@@ -146,9 +146,9 @@ struct mr_mfc { + unsigned long last_assert; + int minvif; + int maxvif; +- unsigned long bytes; +- unsigned long pkt; +- unsigned long wrong_if; ++ atomic_long_t bytes; ++ atomic_long_t pkt; ++ atomic_long_t wrong_if; + unsigned long lastuse; + unsigned char ttls[MAXVIFS]; + refcount_t refcount; +diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c +index 449a2ac40bdc0..de0d9cc7806a1 100644 +--- a/net/ipv4/ipmr.c ++++ b/net/ipv4/ipmr.c +@@ -817,7 +817,7 @@ static void ipmr_update_thresholds(struct mr_table *mrt, struct mr_mfc *cache, + cache->mfc_un.res.maxvif = vifi + 1; + } + } +- cache->mfc_un.res.lastuse = jiffies; ++ WRITE_ONCE(cache->mfc_un.res.lastuse, jiffies); + } + + static int vif_add(struct net *net, struct mr_table *mrt, +@@ -1667,9 +1667,9 @@ int ipmr_ioctl(struct sock *sk, int cmd, void *arg) + rcu_read_lock(); + c = ipmr_cache_find(mrt, sr->src.s_addr, sr->grp.s_addr); + if (c) { +- sr->pktcnt = c->_c.mfc_un.res.pkt; +- sr->bytecnt = c->_c.mfc_un.res.bytes; +- sr->wrong_if = c->_c.mfc_un.res.wrong_if; ++ sr->pktcnt = atomic_long_read(&c->_c.mfc_un.res.pkt); ++ sr->bytecnt = atomic_long_read(&c->_c.mfc_un.res.bytes); ++ sr->wrong_if = atomic_long_read(&c->_c.mfc_un.res.wrong_if); + rcu_read_unlock(); + return 0; + } +@@ -1739,9 +1739,9 @@ int ipmr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg) + rcu_read_lock(); + c = ipmr_cache_find(mrt, sr.src.s_addr, sr.grp.s_addr); + if (c) { +- sr.pktcnt = c->_c.mfc_un.res.pkt; +- sr.bytecnt = c->_c.mfc_un.res.bytes; +- sr.wrong_if = c->_c.mfc_un.res.wrong_if; ++ sr.pktcnt = atomic_long_read(&c->_c.mfc_un.res.pkt); ++ sr.bytecnt = atomic_long_read(&c->_c.mfc_un.res.bytes); ++ sr.wrong_if = atomic_long_read(&c->_c.mfc_un.res.wrong_if); + rcu_read_unlock(); + + if (copy_to_user(arg, &sr, sizeof(sr))) +@@ -1974,9 +1974,9 @@ static void ip_mr_forward(struct net *net, struct mr_table *mrt, + int vif, ct; + + vif = c->_c.mfc_parent; +- c->_c.mfc_un.res.pkt++; +- c->_c.mfc_un.res.bytes += skb->len; +- c->_c.mfc_un.res.lastuse = jiffies; ++ atomic_long_inc(&c->_c.mfc_un.res.pkt); ++ atomic_long_add(skb->len, &c->_c.mfc_un.res.bytes); ++ WRITE_ONCE(c->_c.mfc_un.res.lastuse, jiffies); + + if (c->mfc_origin == htonl(INADDR_ANY) && true_vifi >= 0) { + struct mfc_cache *cache_proxy; +@@ -2007,7 +2007,7 @@ static void ip_mr_forward(struct net *net, struct mr_table *mrt, + goto dont_forward; + } + +- c->_c.mfc_un.res.wrong_if++; ++ atomic_long_inc(&c->_c.mfc_un.res.wrong_if); + + if (true_vifi >= 0 && mrt->mroute_do_assert && + /* pimsm uses asserts, when switching from RPT to SPT, +@@ -3015,9 +3015,9 @@ static int ipmr_mfc_seq_show(struct seq_file *seq, void *v) + + if (it->cache != &mrt->mfc_unres_queue) { + seq_printf(seq, " %8lu %8lu %8lu", +- mfc->_c.mfc_un.res.pkt, +- mfc->_c.mfc_un.res.bytes, +- mfc->_c.mfc_un.res.wrong_if); ++ atomic_long_read(&mfc->_c.mfc_un.res.pkt), ++ atomic_long_read(&mfc->_c.mfc_un.res.bytes), ++ atomic_long_read(&mfc->_c.mfc_un.res.wrong_if)); + for (n = mfc->_c.mfc_un.res.minvif; + n < mfc->_c.mfc_un.res.maxvif; n++) { + if (VIF_EXISTS(mrt, n) && +diff --git a/net/ipv4/ipmr_base.c b/net/ipv4/ipmr_base.c +index f0af12a2f70bc..03b6eee407a24 100644 +--- a/net/ipv4/ipmr_base.c ++++ b/net/ipv4/ipmr_base.c +@@ -263,9 +263,9 @@ int mr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb, + lastuse = READ_ONCE(c->mfc_un.res.lastuse); + lastuse = time_after_eq(jiffies, lastuse) ? jiffies - lastuse : 0; + +- mfcs.mfcs_packets = c->mfc_un.res.pkt; +- mfcs.mfcs_bytes = c->mfc_un.res.bytes; +- mfcs.mfcs_wrong_if = c->mfc_un.res.wrong_if; ++ mfcs.mfcs_packets = atomic_long_read(&c->mfc_un.res.pkt); ++ mfcs.mfcs_bytes = atomic_long_read(&c->mfc_un.res.bytes); ++ mfcs.mfcs_wrong_if = atomic_long_read(&c->mfc_un.res.wrong_if); + if (nla_put_64bit(skb, RTA_MFC_STATS, sizeof(mfcs), &mfcs, RTA_PAD) || + nla_put_u64_64bit(skb, RTA_EXPIRES, jiffies_to_clock_t(lastuse), + RTA_PAD)) +diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c +index d5057401701c1..440048d609c37 100644 +--- a/net/ipv6/ip6mr.c ++++ b/net/ipv6/ip6mr.c +@@ -506,9 +506,9 @@ static int ipmr_mfc_seq_show(struct seq_file *seq, void *v) + + if (it->cache != &mrt->mfc_unres_queue) { + seq_printf(seq, " %8lu %8lu %8lu", +- mfc->_c.mfc_un.res.pkt, +- mfc->_c.mfc_un.res.bytes, +- mfc->_c.mfc_un.res.wrong_if); ++ atomic_long_read(&mfc->_c.mfc_un.res.pkt), ++ atomic_long_read(&mfc->_c.mfc_un.res.bytes), ++ atomic_long_read(&mfc->_c.mfc_un.res.wrong_if)); + for (n = mfc->_c.mfc_un.res.minvif; + n < mfc->_c.mfc_un.res.maxvif; n++) { + if (VIF_EXISTS(mrt, n) && +@@ -870,7 +870,7 @@ static void ip6mr_update_thresholds(struct mr_table *mrt, + cache->mfc_un.res.maxvif = vifi + 1; + } + } +- cache->mfc_un.res.lastuse = jiffies; ++ WRITE_ONCE(cache->mfc_un.res.lastuse, jiffies); + } + + static int mif6_add(struct net *net, struct mr_table *mrt, +@@ -1928,9 +1928,9 @@ int ip6mr_ioctl(struct sock *sk, int cmd, void *arg) + c = ip6mr_cache_find(mrt, &sr->src.sin6_addr, + &sr->grp.sin6_addr); + if (c) { +- sr->pktcnt = c->_c.mfc_un.res.pkt; +- sr->bytecnt = c->_c.mfc_un.res.bytes; +- sr->wrong_if = c->_c.mfc_un.res.wrong_if; ++ sr->pktcnt = atomic_long_read(&c->_c.mfc_un.res.pkt); ++ sr->bytecnt = atomic_long_read(&c->_c.mfc_un.res.bytes); ++ sr->wrong_if = atomic_long_read(&c->_c.mfc_un.res.wrong_if); + rcu_read_unlock(); + return 0; + } +@@ -2000,9 +2000,9 @@ int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg) + rcu_read_lock(); + c = ip6mr_cache_find(mrt, &sr.src.sin6_addr, &sr.grp.sin6_addr); + if (c) { +- sr.pktcnt = c->_c.mfc_un.res.pkt; +- sr.bytecnt = c->_c.mfc_un.res.bytes; +- sr.wrong_if = c->_c.mfc_un.res.wrong_if; ++ sr.pktcnt = atomic_long_read(&c->_c.mfc_un.res.pkt); ++ sr.bytecnt = atomic_long_read(&c->_c.mfc_un.res.bytes); ++ sr.wrong_if = atomic_long_read(&c->_c.mfc_un.res.wrong_if); + rcu_read_unlock(); + + if (copy_to_user(arg, &sr, sizeof(sr))) +@@ -2125,9 +2125,9 @@ static void ip6_mr_forward(struct net *net, struct mr_table *mrt, + int true_vifi = ip6mr_find_vif(mrt, dev); + + vif = c->_c.mfc_parent; +- c->_c.mfc_un.res.pkt++; +- c->_c.mfc_un.res.bytes += skb->len; +- c->_c.mfc_un.res.lastuse = jiffies; ++ atomic_long_inc(&c->_c.mfc_un.res.pkt); ++ atomic_long_add(skb->len, &c->_c.mfc_un.res.bytes); ++ WRITE_ONCE(c->_c.mfc_un.res.lastuse, jiffies); + + if (ipv6_addr_any(&c->mf6c_origin) && true_vifi >= 0) { + struct mfc6_cache *cache_proxy; +@@ -2145,7 +2145,7 @@ static void ip6_mr_forward(struct net *net, struct mr_table *mrt, + * Wrong interface: drop packet and (maybe) send PIM assert. + */ + if (rcu_access_pointer(mrt->vif_table[vif].dev) != dev) { +- c->_c.mfc_un.res.wrong_if++; ++ atomic_long_inc(&c->_c.mfc_un.res.wrong_if); + + if (true_vifi >= 0 && mrt->mroute_do_assert && + /* pimsm uses asserts, when switching from RPT to SPT, +-- +2.39.5 + diff --git a/queue-6.12/inetpeer-do-not-get-a-refcount-in-inet_getpeer.patch b/queue-6.12/inetpeer-do-not-get-a-refcount-in-inet_getpeer.patch new file mode 100644 index 0000000000..a3d0e79e72 --- /dev/null +++ b/queue-6.12/inetpeer-do-not-get-a-refcount-in-inet_getpeer.patch @@ -0,0 +1,272 @@ +From 9ec86033f829655c0bdc00221d61c52159041e35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Dec 2024 17:56:29 +0000 +Subject: inetpeer: do not get a refcount in inet_getpeer() + +From: Eric Dumazet + +[ Upstream commit a853c609504e2d1d83e71285e3622fda1f1451d8 ] + +All inet_getpeer() callers except ip4_frag_init() don't need +to acquire a permanent refcount on the inetpeer. + +They can switch to full RCU protection. + +Move the refcount_inc_not_zero() into ip4_frag_init(), +so that all the other callers no longer have to +perform a pair of expensive atomic operations on +a possibly contended cache line. + +inet_putpeer() no longer needs to be exported. + +After this patch, my DUT can receive 8,400,000 UDP packets +per second targeting closed ports, using 50% less cpu cycles +than before. + +Also change two calls to l3mdev_master_ifindex() by +l3mdev_master_ifindex_rcu() (Ido ideas) + +Fixes: 8c2bd38b95f7 ("icmp: change the order of rate limits") +Signed-off-by: Eric Dumazet +Link: https://patch.msgid.link/20241215175629.1248773-5-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/icmp.c | 9 ++++----- + net/ipv4/inetpeer.c | 8 ++------ + net/ipv4/ip_fragment.c | 15 ++++++++++----- + net/ipv4/route.c | 15 ++++++++------- + net/ipv6/icmp.c | 4 ++-- + net/ipv6/ip6_output.c | 4 ++-- + net/ipv6/ndisc.c | 6 ++++-- + 7 files changed, 32 insertions(+), 29 deletions(-) + +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index c9846159a4c3e..932bd775fc268 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -312,7 +312,6 @@ static bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt, + struct dst_entry *dst = &rt->dst; + struct inet_peer *peer; + bool rc = true; +- int vif; + + if (!apply_ratelimit) + return true; +@@ -321,12 +320,12 @@ static bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt, + if (dst->dev && (dst->dev->flags&IFF_LOOPBACK)) + goto out; + +- vif = l3mdev_master_ifindex(dst->dev); +- peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr, vif); ++ rcu_read_lock(); ++ peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr, ++ l3mdev_master_ifindex_rcu(dst->dev)); + rc = inet_peer_xrlim_allow(peer, + READ_ONCE(net->ipv4.sysctl_icmp_ratelimit)); +- if (peer) +- inet_putpeer(peer); ++ rcu_read_unlock(); + out: + if (!rc) + __ICMP_INC_STATS(net, ICMP_MIB_RATELIMITHOST); +diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c +index f4cfc10293b85..9c5ffe3b5f776 100644 +--- a/net/ipv4/inetpeer.c ++++ b/net/ipv4/inetpeer.c +@@ -109,8 +109,6 @@ static struct inet_peer *lookup(const struct inetpeer_addr *daddr, + p = rb_entry(parent, struct inet_peer, rb_node); + cmp = inetpeer_addr_cmp(daddr, &p->daddr); + if (cmp == 0) { +- if (!refcount_inc_not_zero(&p->refcnt)) +- break; + now = jiffies; + if (READ_ONCE(p->dtime) != now) + WRITE_ONCE(p->dtime, now); +@@ -174,6 +172,7 @@ static void inet_peer_gc(struct inet_peer_base *base, + } + } + ++/* Must be called under RCU : No refcount change is done here. */ + struct inet_peer *inet_getpeer(struct inet_peer_base *base, + const struct inetpeer_addr *daddr) + { +@@ -184,10 +183,8 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base, + /* Attempt a lockless lookup first. + * Because of a concurrent writer, we might not find an existing entry. + */ +- rcu_read_lock(); + seq = read_seqbegin(&base->lock); + p = lookup(daddr, base, seq, NULL, &gc_cnt, &parent, &pp); +- rcu_read_unlock(); + + if (p) + return p; +@@ -205,7 +202,7 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base, + if (p) { + p->daddr = *daddr; + p->dtime = (__u32)jiffies; +- refcount_set(&p->refcnt, 2); ++ refcount_set(&p->refcnt, 1); + atomic_set(&p->rid, 0); + p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW; + p->rate_tokens = 0; +@@ -233,7 +230,6 @@ void inet_putpeer(struct inet_peer *p) + if (refcount_dec_and_test(&p->refcnt)) + call_rcu(&p->rcu, inetpeer_free_rcu); + } +-EXPORT_SYMBOL_GPL(inet_putpeer); + + /* + * Check transmit rate limitation for given message. +diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c +index 34f9dbc4ccb40..9ca0a183a55ff 100644 +--- a/net/ipv4/ip_fragment.c ++++ b/net/ipv4/ip_fragment.c +@@ -82,15 +82,20 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb, + static void ip4_frag_init(struct inet_frag_queue *q, const void *a) + { + struct ipq *qp = container_of(q, struct ipq, q); +- struct net *net = q->fqdir->net; +- + const struct frag_v4_compare_key *key = a; ++ struct net *net = q->fqdir->net; ++ struct inet_peer *p = NULL; + + q->key.v4 = *key; + qp->ecn = 0; +- qp->peer = q->fqdir->max_dist ? +- inet_getpeer_v4(net->ipv4.peers, key->saddr, key->vif) : +- NULL; ++ if (q->fqdir->max_dist) { ++ rcu_read_lock(); ++ p = inet_getpeer_v4(net->ipv4.peers, key->saddr, key->vif); ++ if (p && !refcount_inc_not_zero(&p->refcnt)) ++ p = NULL; ++ rcu_read_unlock(); ++ } ++ qp->peer = p; + } + + static void ip4_frag_free(struct inet_frag_queue *q) +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 7a4cf60cece7c..2a27913588d05 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -870,11 +870,11 @@ void ip_rt_send_redirect(struct sk_buff *skb) + } + log_martians = IN_DEV_LOG_MARTIANS(in_dev); + vif = l3mdev_master_ifindex_rcu(rt->dst.dev); +- rcu_read_unlock(); + + net = dev_net(rt->dst.dev); + peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, vif); + if (!peer) { ++ rcu_read_unlock(); + icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, + rt_nexthop(rt, ip_hdr(skb)->daddr)); + return; +@@ -893,7 +893,7 @@ void ip_rt_send_redirect(struct sk_buff *skb) + */ + if (peer->n_redirects >= ip_rt_redirect_number) { + peer->rate_last = jiffies; +- goto out_put_peer; ++ goto out_unlock; + } + + /* Check for load limit; set rate_last to the latest sent +@@ -914,8 +914,8 @@ void ip_rt_send_redirect(struct sk_buff *skb) + &ip_hdr(skb)->saddr, inet_iif(skb), + &ip_hdr(skb)->daddr, &gw); + } +-out_put_peer: +- inet_putpeer(peer); ++out_unlock: ++ rcu_read_unlock(); + } + + static int ip_error(struct sk_buff *skb) +@@ -975,9 +975,9 @@ static int ip_error(struct sk_buff *skb) + break; + } + ++ rcu_read_lock(); + peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, +- l3mdev_master_ifindex(skb->dev)); +- ++ l3mdev_master_ifindex_rcu(skb->dev)); + send = true; + if (peer) { + now = jiffies; +@@ -989,8 +989,9 @@ static int ip_error(struct sk_buff *skb) + peer->rate_tokens -= ip_rt_error_cost; + else + send = false; +- inet_putpeer(peer); + } ++ rcu_read_unlock(); ++ + if (send) + icmp_send(skb, ICMP_DEST_UNREACH, code, 0); + +diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c +index 4593e3992c67b..a6984a29fdb9d 100644 +--- a/net/ipv6/icmp.c ++++ b/net/ipv6/icmp.c +@@ -222,10 +222,10 @@ static bool icmpv6_xrlim_allow(struct sock *sk, u8 type, + if (rt->rt6i_dst.plen < 128) + tmo >>= ((128 - rt->rt6i_dst.plen)>>5); + ++ rcu_read_lock(); + peer = inet_getpeer_v6(net->ipv6.peers, &fl6->daddr); + res = inet_peer_xrlim_allow(peer, tmo); +- if (peer) +- inet_putpeer(peer); ++ rcu_read_unlock(); + } + if (!res) + __ICMP6_INC_STATS(net, ip6_dst_idev(dst), +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index a66180a3eefe9..434ddf263b88a 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -613,6 +613,7 @@ int ip6_forward(struct sk_buff *skb) + else + target = &hdr->daddr; + ++ rcu_read_lock(); + peer = inet_getpeer_v6(net->ipv6.peers, &hdr->daddr); + + /* Limit redirects both by destination (here) +@@ -620,8 +621,7 @@ int ip6_forward(struct sk_buff *skb) + */ + if (inet_peer_xrlim_allow(peer, 1*HZ)) + ndisc_send_redirect(skb, target); +- if (peer) +- inet_putpeer(peer); ++ rcu_read_unlock(); + } else { + int addrtype = ipv6_addr_type(&hdr->saddr); + +diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c +index f113554d13325..d044c67019de6 100644 +--- a/net/ipv6/ndisc.c ++++ b/net/ipv6/ndisc.c +@@ -1731,10 +1731,12 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target) + "Redirect: destination is not a neighbour\n"); + goto release; + } ++ ++ rcu_read_lock(); + peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr); + ret = inet_peer_xrlim_allow(peer, 1*HZ); +- if (peer) +- inet_putpeer(peer); ++ rcu_read_unlock(); ++ + if (!ret) + goto release; + +-- +2.39.5 + diff --git a/queue-6.12/inetpeer-remove-create-argument-of-inet_getpeer.patch b/queue-6.12/inetpeer-remove-create-argument-of-inet_getpeer.patch new file mode 100644 index 0000000000..a2755f40fa --- /dev/null +++ b/queue-6.12/inetpeer-remove-create-argument-of-inet_getpeer.patch @@ -0,0 +1,101 @@ +From cc833efb2288f3411d6bca95a9e081a94ebf18eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Dec 2024 17:56:27 +0000 +Subject: inetpeer: remove create argument of inet_getpeer() + +From: Eric Dumazet + +[ Upstream commit 7a596a50c4a4eab946aec149171c72321b4934aa ] + +All callers of inet_getpeer() want to create an inetpeer. + +Signed-off-by: Eric Dumazet +Link: https://patch.msgid.link/20241215175629.1248773-3-edumazet@google.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: a853c609504e ("inetpeer: do not get a refcount in inet_getpeer()") +Signed-off-by: Sasha Levin +--- + include/net/inetpeer.h | 7 +++---- + net/ipv4/inetpeer.c | 11 ++--------- + 2 files changed, 5 insertions(+), 13 deletions(-) + +diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h +index 6f51f81d6cb19..f475757daafba 100644 +--- a/include/net/inetpeer.h ++++ b/include/net/inetpeer.h +@@ -96,8 +96,7 @@ static inline struct in6_addr *inetpeer_get_addr_v6(struct inetpeer_addr *iaddr) + + /* can be called with or without local BH being disabled */ + struct inet_peer *inet_getpeer(struct inet_peer_base *base, +- const struct inetpeer_addr *daddr, +- int create); ++ const struct inetpeer_addr *daddr); + + static inline struct inet_peer *inet_getpeer_v4(struct inet_peer_base *base, + __be32 v4daddr, +@@ -108,7 +107,7 @@ static inline struct inet_peer *inet_getpeer_v4(struct inet_peer_base *base, + daddr.a4.addr = v4daddr; + daddr.a4.vif = vif; + daddr.family = AF_INET; +- return inet_getpeer(base, &daddr, 1); ++ return inet_getpeer(base, &daddr); + } + + static inline struct inet_peer *inet_getpeer_v6(struct inet_peer_base *base, +@@ -118,7 +117,7 @@ static inline struct inet_peer *inet_getpeer_v6(struct inet_peer_base *base, + + daddr.a6 = *v6daddr; + daddr.family = AF_INET6; +- return inet_getpeer(base, &daddr, 1); ++ return inet_getpeer(base, &daddr); + } + + static inline int inetpeer_addr_cmp(const struct inetpeer_addr *a, +diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c +index 5bd7599634517..411a194f9c999 100644 +--- a/net/ipv4/inetpeer.c ++++ b/net/ipv4/inetpeer.c +@@ -174,13 +174,11 @@ static void inet_peer_gc(struct inet_peer_base *base, + } + + struct inet_peer *inet_getpeer(struct inet_peer_base *base, +- const struct inetpeer_addr *daddr, +- int create) ++ const struct inetpeer_addr *daddr) + { + struct inet_peer *p, *gc_stack[PEER_MAX_GC]; + struct rb_node **pp, *parent; + unsigned int gc_cnt, seq; +- int invalidated; + + /* Attempt a lockless lookup first. + * Because of a concurrent writer, we might not find an existing entry. +@@ -188,16 +186,11 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base, + rcu_read_lock(); + seq = read_seqbegin(&base->lock); + p = lookup(daddr, base, seq, NULL, &gc_cnt, &parent, &pp); +- invalidated = read_seqretry(&base->lock, seq); + rcu_read_unlock(); + + if (p) + return p; + +- /* If no writer did a change during our lookup, we can return early. */ +- if (!create && !invalidated) +- return NULL; +- + /* retry an exact lookup, taking the lock before. + * At least, nodes should be hot in our cache. + */ +@@ -206,7 +199,7 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base, + + gc_cnt = 0; + p = lookup(daddr, base, seq, gc_stack, &gc_cnt, &parent, &pp); +- if (!p && create) { ++ if (!p) { + p = kmem_cache_alloc(peer_cachep, GFP_ATOMIC); + if (p) { + p->daddr = *daddr; +-- +2.39.5 + diff --git a/queue-6.12/inetpeer-remove-create-argument-of-inet_getpeer_v-46.patch b/queue-6.12/inetpeer-remove-create-argument-of-inet_getpeer_v-46.patch new file mode 100644 index 0000000000..1d3f0ea47c --- /dev/null +++ b/queue-6.12/inetpeer-remove-create-argument-of-inet_getpeer_v-46.patch @@ -0,0 +1,151 @@ +From d0b94b4dbe33ca8d475093df6fcc43533832121d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Dec 2024 17:56:26 +0000 +Subject: inetpeer: remove create argument of inet_getpeer_v[46]() + +From: Eric Dumazet + +[ Upstream commit 661cd8fc8e9039819ca0c22e0add52b632240a9e ] + +All callers of inet_getpeer_v4() and inet_getpeer_v6() +want to create an inetpeer. + +Signed-off-by: Eric Dumazet +Link: https://patch.msgid.link/20241215175629.1248773-2-edumazet@google.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: a853c609504e ("inetpeer: do not get a refcount in inet_getpeer()") +Signed-off-by: Sasha Levin +--- + include/net/inetpeer.h | 9 ++++----- + net/ipv4/icmp.c | 2 +- + net/ipv4/ip_fragment.c | 2 +- + net/ipv4/route.c | 4 ++-- + net/ipv6/icmp.c | 2 +- + net/ipv6/ip6_output.c | 2 +- + net/ipv6/ndisc.c | 2 +- + 7 files changed, 11 insertions(+), 12 deletions(-) + +diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h +index 74ff688568a0c..6f51f81d6cb19 100644 +--- a/include/net/inetpeer.h ++++ b/include/net/inetpeer.h +@@ -101,25 +101,24 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base, + + static inline struct inet_peer *inet_getpeer_v4(struct inet_peer_base *base, + __be32 v4daddr, +- int vif, int create) ++ int vif) + { + struct inetpeer_addr daddr; + + daddr.a4.addr = v4daddr; + daddr.a4.vif = vif; + daddr.family = AF_INET; +- return inet_getpeer(base, &daddr, create); ++ return inet_getpeer(base, &daddr, 1); + } + + static inline struct inet_peer *inet_getpeer_v6(struct inet_peer_base *base, +- const struct in6_addr *v6daddr, +- int create) ++ const struct in6_addr *v6daddr) + { + struct inetpeer_addr daddr; + + daddr.a6 = *v6daddr; + daddr.family = AF_INET6; +- return inet_getpeer(base, &daddr, create); ++ return inet_getpeer(base, &daddr, 1); + } + + static inline int inetpeer_addr_cmp(const struct inetpeer_addr *a, +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index c3ad41573b33e..c9846159a4c3e 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -322,7 +322,7 @@ static bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt, + goto out; + + vif = l3mdev_master_ifindex(dst->dev); +- peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr, vif, 1); ++ peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr, vif); + rc = inet_peer_xrlim_allow(peer, + READ_ONCE(net->ipv4.sysctl_icmp_ratelimit)); + if (peer) +diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c +index a92664a5ef2ef..34f9dbc4ccb40 100644 +--- a/net/ipv4/ip_fragment.c ++++ b/net/ipv4/ip_fragment.c +@@ -89,7 +89,7 @@ static void ip4_frag_init(struct inet_frag_queue *q, const void *a) + q->key.v4 = *key; + qp->ecn = 0; + qp->peer = q->fqdir->max_dist ? +- inet_getpeer_v4(net->ipv4.peers, key->saddr, key->vif, 1) : ++ inet_getpeer_v4(net->ipv4.peers, key->saddr, key->vif) : + NULL; + } + +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 723ac9181558c..7a4cf60cece7c 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -873,7 +873,7 @@ void ip_rt_send_redirect(struct sk_buff *skb) + rcu_read_unlock(); + + net = dev_net(rt->dst.dev); +- peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, vif, 1); ++ peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, vif); + if (!peer) { + icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, + rt_nexthop(rt, ip_hdr(skb)->daddr)); +@@ -976,7 +976,7 @@ static int ip_error(struct sk_buff *skb) + } + + peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, +- l3mdev_master_ifindex(skb->dev), 1); ++ l3mdev_master_ifindex(skb->dev)); + + send = true; + if (peer) { +diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c +index 071b0bc1179d8..4593e3992c67b 100644 +--- a/net/ipv6/icmp.c ++++ b/net/ipv6/icmp.c +@@ -222,7 +222,7 @@ static bool icmpv6_xrlim_allow(struct sock *sk, u8 type, + if (rt->rt6i_dst.plen < 128) + tmo >>= ((128 - rt->rt6i_dst.plen)>>5); + +- peer = inet_getpeer_v6(net->ipv6.peers, &fl6->daddr, 1); ++ peer = inet_getpeer_v6(net->ipv6.peers, &fl6->daddr); + res = inet_peer_xrlim_allow(peer, tmo); + if (peer) + inet_putpeer(peer); +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index f26841f1490f5..a66180a3eefe9 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -613,7 +613,7 @@ int ip6_forward(struct sk_buff *skb) + else + target = &hdr->daddr; + +- peer = inet_getpeer_v6(net->ipv6.peers, &hdr->daddr, 1); ++ peer = inet_getpeer_v6(net->ipv6.peers, &hdr->daddr); + + /* Limit redirects both by destination (here) + and by source (inside ndisc_send_redirect) +diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c +index aba94a3486737..f113554d13325 100644 +--- a/net/ipv6/ndisc.c ++++ b/net/ipv6/ndisc.c +@@ -1731,7 +1731,7 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target) + "Redirect: destination is not a neighbour\n"); + goto release; + } +- peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr, 1); ++ peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr); + ret = inet_peer_xrlim_allow(peer, 1*HZ); + if (peer) + inet_putpeer(peer); +-- +2.39.5 + diff --git a/queue-6.12/inetpeer-update-inetpeer-timestamp-in-inet_getpeer.patch b/queue-6.12/inetpeer-update-inetpeer-timestamp-in-inet_getpeer.patch new file mode 100644 index 0000000000..0cf1551b3e --- /dev/null +++ b/queue-6.12/inetpeer-update-inetpeer-timestamp-in-inet_getpeer.patch @@ -0,0 +1,70 @@ +From 1f658541f142321499d24b26ff450838a5de9627 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Dec 2024 17:56:28 +0000 +Subject: inetpeer: update inetpeer timestamp in inet_getpeer() + +From: Eric Dumazet + +[ Upstream commit 50b362f21d6c10b0f7939c1482c6a1b43da82f1a ] + +inet_putpeer() will be removed in the following patch, +because we will no longer use refcounts. + +Update inetpeer timestamp (p->dtime) at lookup time. + +Signed-off-by: Eric Dumazet +Link: https://patch.msgid.link/20241215175629.1248773-4-edumazet@google.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: a853c609504e ("inetpeer: do not get a refcount in inet_getpeer()") +Signed-off-by: Sasha Levin +--- + net/ipv4/inetpeer.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c +index 411a194f9c999..f4cfc10293b85 100644 +--- a/net/ipv4/inetpeer.c ++++ b/net/ipv4/inetpeer.c +@@ -95,6 +95,7 @@ static struct inet_peer *lookup(const struct inetpeer_addr *daddr, + { + struct rb_node **pp, *parent, *next; + struct inet_peer *p; ++ u32 now; + + pp = &base->rb_root.rb_node; + parent = NULL; +@@ -110,6 +111,9 @@ static struct inet_peer *lookup(const struct inetpeer_addr *daddr, + if (cmp == 0) { + if (!refcount_inc_not_zero(&p->refcnt)) + break; ++ now = jiffies; ++ if (READ_ONCE(p->dtime) != now) ++ WRITE_ONCE(p->dtime, now); + return p; + } + if (gc_stack) { +@@ -155,9 +159,6 @@ static void inet_peer_gc(struct inet_peer_base *base, + for (i = 0; i < gc_cnt; i++) { + p = gc_stack[i]; + +- /* The READ_ONCE() pairs with the WRITE_ONCE() +- * in inet_putpeer() +- */ + delta = (__u32)jiffies - READ_ONCE(p->dtime); + + if (delta < ttl || !refcount_dec_if_one(&p->refcnt)) +@@ -229,11 +230,6 @@ EXPORT_SYMBOL_GPL(inet_getpeer); + + void inet_putpeer(struct inet_peer *p) + { +- /* The WRITE_ONCE() pairs with itself (we run lockless) +- * and the READ_ONCE() in inet_peer_gc() +- */ +- WRITE_ONCE(p->dtime, (__u32)jiffies); +- + if (refcount_dec_and_test(&p->refcnt)) + call_rcu(&p->rcu, inetpeer_free_rcu); + } +-- +2.39.5 + diff --git a/queue-6.12/iommu-amd-remove-unused-amd_iommu_domain_update.patch b/queue-6.12/iommu-amd-remove-unused-amd_iommu_domain_update.patch new file mode 100644 index 0000000000..ef619d97a3 --- /dev/null +++ b/queue-6.12/iommu-amd-remove-unused-amd_iommu_domain_update.patch @@ -0,0 +1,59 @@ +From 8875a721ec26595b0e24daf79e37e0452fc28f03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 12:34:59 -0400 +Subject: iommu/amd: Remove unused amd_iommu_domain_update() + +From: Alejandro Jimenez + +[ Upstream commit 1a684b099fac9a37e6fe2f0e594adbb1eff5181a ] + +All the callers have been removed by the below commit, remove the +implementation and prototypes. + +Fixes: 322d889ae7d3 ("iommu/amd: Remove amd_iommu_domain_update() from page table freeing") +Reviewed-by: Vasant Hegde +Signed-off-by: Alejandro Jimenez +Signed-off-by: Jason Gunthorpe +Link: https://lore.kernel.org/r/1-v2-9776c53c2966+1c7-amd_paging_flags_jgg@nvidia.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd/amd_iommu.h | 1 - + drivers/iommu/amd/iommu.c | 9 --------- + 2 files changed, 10 deletions(-) + +diff --git a/drivers/iommu/amd/amd_iommu.h b/drivers/iommu/amd/amd_iommu.h +index 6386fa4556d9b..6fac9ee8dd3ed 100644 +--- a/drivers/iommu/amd/amd_iommu.h ++++ b/drivers/iommu/amd/amd_iommu.h +@@ -87,7 +87,6 @@ int amd_iommu_complete_ppr(struct device *dev, u32 pasid, int status, int tag); + */ + void amd_iommu_flush_all_caches(struct amd_iommu *iommu); + void amd_iommu_update_and_flush_device_table(struct protection_domain *domain); +-void amd_iommu_domain_update(struct protection_domain *domain); + void amd_iommu_domain_flush_pages(struct protection_domain *domain, + u64 address, size_t size); + void amd_iommu_dev_flush_pasid_pages(struct iommu_dev_data *dev_data, +diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c +index 8364cd6fa47d0..a24a97a2c6469 100644 +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -1606,15 +1606,6 @@ void amd_iommu_update_and_flush_device_table(struct protection_domain *domain) + domain_flush_complete(domain); + } + +-void amd_iommu_domain_update(struct protection_domain *domain) +-{ +- /* Update device table */ +- amd_iommu_update_and_flush_device_table(domain); +- +- /* Flush domain TLB(s) and wait for completion */ +- amd_iommu_domain_flush_all(domain); +-} +- + int amd_iommu_complete_ppr(struct device *dev, u32 pasid, int status, int tag) + { + struct iommu_dev_data *dev_data; +-- +2.39.5 + diff --git a/queue-6.12/iommu-arm-smmuv3-update-comments-about-ats-and-bypas.patch b/queue-6.12/iommu-arm-smmuv3-update-comments-about-ats-and-bypas.patch new file mode 100644 index 0000000000..f862d06de4 --- /dev/null +++ b/queue-6.12/iommu-arm-smmuv3-update-comments-about-ats-and-bypas.patch @@ -0,0 +1,75 @@ +From 20ee9b968f70e6e90a66904e5bca950b9e39f022 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 11:40:15 -0400 +Subject: iommu/arm-smmuv3: Update comments about ATS and bypass + +From: Jason Gunthorpe + +[ Upstream commit 9b640ae7fbba13d45a8b9712dff2911a0c2b5ff4 ] + +The SMMUv3 spec has a note that BYPASS and ATS don't work together under +the STE EATS field definition. However there is another section "13.6.4 +Full ATS skipping stage 1" that explains under certain conditions BYPASS +and ATS do work together if the STE is using S1DSS to select BYPASS and +the CD table has the possibility for a substream. + +When these comments were written the understanding was that all forms of +BYPASS just didn't work and this was to be a future problem to solve. + +It turns out that ATS and IDENTITY will always work just fine: + + - If STE.Config = BYPASS then the PCI ATS is disabled + + - If a PASID domain is attached then S1DSS = BYPASS and ATS will be + enabled. This meets the requirements of 13.6.4 to automatically + generate 1:1 ATS replies on the RID. + +Update the comments to reflect this. + +Fixes: 7497f4211f4f ("iommu/arm-smmu-v3: Make changing domains be hitless for ATS") +Signed-off-by: Jason Gunthorpe +Link: https://lore.kernel.org/r/0-v1-f27174f44f39+27a33-smmuv3_ats_note_jgg@nvidia.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +index 353fea58cd318..f1a8f8c75cb0e 100644 +--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c ++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +@@ -2702,9 +2702,14 @@ static int arm_smmu_attach_prepare(struct arm_smmu_attach_state *state, + * Translation Requests and Translated transactions are denied + * as though ATS is disabled for the stream (STE.EATS == 0b00), + * causing F_BAD_ATS_TREQ and F_TRANSL_FORBIDDEN events +- * (IHI0070Ea 5.2 Stream Table Entry). Thus ATS can only be +- * enabled if we have arm_smmu_domain, those always have page +- * tables. ++ * (IHI0070Ea 5.2 Stream Table Entry). ++ * ++ * However, if we have installed a CD table and are using S1DSS ++ * then ATS will work in S1DSS bypass. See "13.6.4 Full ATS ++ * skipping stage 1". ++ * ++ * Disable ATS if we are going to create a normal 0b100 bypass ++ * STE. + */ + state->ats_enabled = arm_smmu_ats_supported(master); + } +@@ -3017,8 +3022,10 @@ static void arm_smmu_attach_dev_ste(struct iommu_domain *domain, + if (arm_smmu_ssids_in_use(&master->cd_table)) { + /* + * If a CD table has to be present then we need to run with ATS +- * on even though the RID will fail ATS queries with UR. This is +- * because we have no idea what the PASID's need. ++ * on because we have to assume a PASID is using ATS. For ++ * IDENTITY this will setup things so that S1DSS=bypass which ++ * follows the explanation in "13.6.4 Full ATS skipping stage 1" ++ * and allows for ATS on the RID to work. + */ + state.cd_needs_ats = true; + arm_smmu_attach_prepare(&state, domain); +-- +2.39.5 + diff --git a/queue-6.12/iommu-iommufd-fix-warning-in-iommufd_device_unbind.patch b/queue-6.12/iommu-iommufd-fix-warning-in-iommufd_device_unbind.patch new file mode 100644 index 0000000000..dc4660828c --- /dev/null +++ b/queue-6.12/iommu-iommufd-fix-warning-in-iommufd_device_unbind.patch @@ -0,0 +1,51 @@ +From cd8b56d4a331135e05cd94792bcb0b1222e779da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Nov 2024 01:29:00 +0530 +Subject: iommu: iommufd: fix WARNING in iommufd_device_unbind + +From: Suraj Sonawane + +[ Upstream commit d9df72c6acd683adf6dd23c061f3a414ec00b1f8 ] + +Fix an issue detected by syzbot: + +WARNING in iommufd_device_unbind iommufd: Time out waiting for iommufd object to become free + +Resolve a warning in iommufd_device_unbind caused by a timeout while +waiting for the shortterm_users reference count to reach zero. The +existing 10-second timeout is insufficient in some scenarios, resulting in +failures the above warning. + +Increase the timeout in iommufd_object_dec_wait_shortterm from 10 seconds +to 60 seconds to allow sufficient time for the reference count to drop to +zero. This change prevents premature timeouts and reduces the likelihood +of warnings during iommufd_device_unbind. + +Fixes: 6f9c4d8c468c ("iommufd: Do not UAF during iommufd_put_object()") +Link: https://patch.msgid.link/r/20241123195900.3176-1-surajsonawane0215@gmail.com +Reported-by: syzbot+c92878e123785b1fa2db@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=c92878e123785b1fa2db +Tested-by: syzbot+c92878e123785b1fa2db@syzkaller.appspotmail.com +Signed-off-by: Suraj Sonawane +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/iommu/iommufd/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/iommufd/main.c b/drivers/iommu/iommufd/main.c +index b5f5d27ee9634..649fe79d0f0cc 100644 +--- a/drivers/iommu/iommufd/main.c ++++ b/drivers/iommu/iommufd/main.c +@@ -130,7 +130,7 @@ static int iommufd_object_dec_wait_shortterm(struct iommufd_ctx *ictx, + if (wait_event_timeout(ictx->destroy_wait, + refcount_read(&to_destroy->shortterm_users) == + 0, +- msecs_to_jiffies(10000))) ++ msecs_to_jiffies(60000))) + return 0; + + pr_crit("Time out waiting for iommufd object to become free\n"); +-- +2.39.5 + diff --git a/queue-6.12/iommufd-iova_bitmap-fix-shift-out-of-bounds-in-iova_.patch b/queue-6.12/iommufd-iova_bitmap-fix-shift-out-of-bounds-in-iova_.patch new file mode 100644 index 0000000000..2ec9d1a809 --- /dev/null +++ b/queue-6.12/iommufd-iova_bitmap-fix-shift-out-of-bounds-in-iova_.patch @@ -0,0 +1,49 @@ +From 20777d3908cdc4f5bf39597457a99f55e8ef826a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 22:38:20 +0000 +Subject: iommufd/iova_bitmap: Fix shift-out-of-bounds in + iova_bitmap_offset_to_index() + +From: Qasim Ijaz + +[ Upstream commit e24c1551059268b37f6f40639883eafb281b8b9c ] + +Resolve a UBSAN shift-out-of-bounds issue in iova_bitmap_offset_to_index() +where shifting the constant "1" (of type int) by bitmap->mapped.pgshift +(an unsigned long value) could result in undefined behavior. + +The constant "1" defaults to a 32-bit "int", and when "pgshift" exceeds +31 (e.g., pgshift = 63) the shift operation overflows, as the result +cannot be represented in a 32-bit type. + +To resolve this, the constant is updated to "1UL", promoting it to an +unsigned long type to match the operand's type. + +Fixes: 58ccf0190d19 ("vfio: Add an IOVA bitmap support") +Link: https://patch.msgid.link/r/20250113223820.10713-1-qasdev00@gmail.com +Reported-by: syzbot +Closes: https://syzkaller.appspot.com/bug?extid=85992ace37d5b7b51635 +Signed-off-by: Qasim Ijaz +Reviewed-by: Joao Martins +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/iommu/iommufd/iova_bitmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/iommufd/iova_bitmap.c b/drivers/iommu/iommufd/iova_bitmap.c +index d90b9e253412f..2cdc4f542df47 100644 +--- a/drivers/iommu/iommufd/iova_bitmap.c ++++ b/drivers/iommu/iommufd/iova_bitmap.c +@@ -130,7 +130,7 @@ struct iova_bitmap { + static unsigned long iova_bitmap_offset_to_index(struct iova_bitmap *bitmap, + unsigned long iova) + { +- unsigned long pgsize = 1 << bitmap->mapped.pgshift; ++ unsigned long pgsize = 1UL << bitmap->mapped.pgshift; + + return iova / (BITS_PER_TYPE(*bitmap->bitmap) * pgsize); + } +-- +2.39.5 + diff --git a/queue-6.12/ipmi-ipmb-add-check-devm_kasprintf-returned-value.patch b/queue-6.12/ipmi-ipmb-add-check-devm_kasprintf-returned-value.patch new file mode 100644 index 0000000000..59545e5807 --- /dev/null +++ b/queue-6.12/ipmi-ipmb-add-check-devm_kasprintf-returned-value.patch @@ -0,0 +1,38 @@ +From 2bb27ab9113909fcd7883737efb0818b1cd51957 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Sep 2024 17:44:19 +0800 +Subject: ipmi: ipmb: Add check devm_kasprintf() returned value + +From: Charles Han + +[ Upstream commit 2378bd0b264ad3a1f76bd957caf33ee0c7945351 ] + +devm_kasprintf() can return a NULL pointer on failure but this +returned value is not checked. + +Fixes: 51bd6f291583 ("Add support for IPMB driver") +Signed-off-by: Charles Han +Message-ID: <20240926094419.25900-1-hanchunchao@inspur.com> +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmb_dev_int.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/char/ipmi/ipmb_dev_int.c b/drivers/char/ipmi/ipmb_dev_int.c +index 7296127181eca..8a14fd0291d89 100644 +--- a/drivers/char/ipmi/ipmb_dev_int.c ++++ b/drivers/char/ipmi/ipmb_dev_int.c +@@ -321,6 +321,9 @@ static int ipmb_probe(struct i2c_client *client) + ipmb_dev->miscdev.name = devm_kasprintf(&client->dev, GFP_KERNEL, + "%s%d", "ipmb-", + client->adapter->nr); ++ if (!ipmb_dev->miscdev.name) ++ return -ENOMEM; ++ + ipmb_dev->miscdev.fops = &ipmb_fops; + ipmb_dev->miscdev.parent = &client->dev; + ret = misc_register(&ipmb_dev->miscdev); +-- +2.39.5 + diff --git a/queue-6.12/ipmi-ssif_bmc-fix-new-request-loss-when-bmc-ready-fo.patch b/queue-6.12/ipmi-ssif_bmc-fix-new-request-loss-when-bmc-ready-fo.patch new file mode 100644 index 0000000000..d94553b5ad --- /dev/null +++ b/queue-6.12/ipmi-ssif_bmc-fix-new-request-loss-when-bmc-ready-fo.patch @@ -0,0 +1,55 @@ +From fa7ea880a2acf433c50a25bd90c8902f758cbd77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jan 2025 10:47:34 +0700 +Subject: ipmi: ssif_bmc: Fix new request loss when bmc ready for a response + +From: Quan Nguyen + +[ Upstream commit 83d8c79aa958e37724ed9c14dc7d0f66a48ad864 ] + +Cosmo found that when there is a new request comes in while BMC is +ready for a response, the complete_response(), which is called to +complete the pending response, would accidentally clear out that new +request and force ssif_bmc to move back to abort state again. + +This commit is to address that issue. + +Fixes: dd2bc5cc9e25 ("ipmi: ssif_bmc: Add SSIF BMC driver") +Reported-by: Cosmo Chou +Closes: https://lore.kernel.org/lkml/20250101165431.2113407-1-chou.cosmo@gmail.com/ +Signed-off-by: Quan Nguyen +Message-ID: <20250107034734.1842247-1-quan@os.amperecomputing.com> +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ssif_bmc.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/ipmi/ssif_bmc.c b/drivers/char/ipmi/ssif_bmc.c +index a14fafc583d4d..310f17dd9511a 100644 +--- a/drivers/char/ipmi/ssif_bmc.c ++++ b/drivers/char/ipmi/ssif_bmc.c +@@ -292,7 +292,6 @@ static void complete_response(struct ssif_bmc_ctx *ssif_bmc) + ssif_bmc->nbytes_processed = 0; + ssif_bmc->remain_len = 0; + ssif_bmc->busy = false; +- memset(&ssif_bmc->part_buf, 0, sizeof(struct ssif_part_buffer)); + wake_up_all(&ssif_bmc->wait_queue); + } + +@@ -744,9 +743,11 @@ static void on_stop_event(struct ssif_bmc_ctx *ssif_bmc, u8 *val) + ssif_bmc->aborting = true; + } + } else if (ssif_bmc->state == SSIF_RES_SENDING) { +- if (ssif_bmc->is_singlepart_read || ssif_bmc->block_num == 0xFF) ++ if (ssif_bmc->is_singlepart_read || ssif_bmc->block_num == 0xFF) { ++ memset(&ssif_bmc->part_buf, 0, sizeof(struct ssif_part_buffer)); + /* Invalidate response buffer to denote it is sent */ + complete_response(ssif_bmc); ++ } + ssif_bmc->state = SSIF_READY; + } + +-- +2.39.5 + diff --git a/queue-6.12/ipmr-do-not-call-mr_mfc_uses_dev-for-unres-entries.patch b/queue-6.12/ipmr-do-not-call-mr_mfc_uses_dev-for-unres-entries.patch new file mode 100644 index 0000000000..a810ed03ec --- /dev/null +++ b/queue-6.12/ipmr-do-not-call-mr_mfc_uses_dev-for-unres-entries.patch @@ -0,0 +1,71 @@ +From c2b4150aa5d9e8e629178256db26161d9325fe77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jan 2025 18:12:41 +0000 +Subject: ipmr: do not call mr_mfc_uses_dev() for unres entries + +From: Eric Dumazet + +[ Upstream commit 15a901361ec3fb1c393f91880e1cbf24ec0a88bd ] + +syzbot found that calling mr_mfc_uses_dev() for unres entries +would crash [1], because c->mfc_un.res.minvif / c->mfc_un.res.maxvif +alias to "struct sk_buff_head unresolved", which contain two pointers. + +This code never worked, lets remove it. + +[1] +Unable to handle kernel paging request at virtual address ffff5fff2d536613 +KASAN: maybe wild-memory-access in range [0xfffefff96a9b3098-0xfffefff96a9b309f] +Modules linked in: +CPU: 1 UID: 0 PID: 7321 Comm: syz.0.16 Not tainted 6.13.0-rc7-syzkaller-g1950a0af2d55 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 +pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline] + pc : mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334 + lr : mr_mfc_uses_dev net/ipv4/ipmr_base.c:289 [inline] + lr : mr_table_dump+0x694/0x8b0 net/ipv4/ipmr_base.c:334 +Call trace: + mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline] (P) + mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334 (P) + mr_rtm_dumproute+0x254/0x454 net/ipv4/ipmr_base.c:382 + ipmr_rtm_dumproute+0x248/0x4b4 net/ipv4/ipmr.c:2648 + rtnl_dump_all+0x2e4/0x4e8 net/core/rtnetlink.c:4327 + rtnl_dumpit+0x98/0x1d0 net/core/rtnetlink.c:6791 + netlink_dump+0x4f0/0xbc0 net/netlink/af_netlink.c:2317 + netlink_recvmsg+0x56c/0xe64 net/netlink/af_netlink.c:1973 + sock_recvmsg_nosec net/socket.c:1033 [inline] + sock_recvmsg net/socket.c:1055 [inline] + sock_read_iter+0x2d8/0x40c net/socket.c:1125 + new_sync_read fs/read_write.c:484 [inline] + vfs_read+0x740/0x970 fs/read_write.c:565 + ksys_read+0x15c/0x26c fs/read_write.c:708 + +Fixes: cb167893f41e ("net: Plumb support for filtering ipv4 and ipv6 multicast route dumps") +Reported-by: syzbot+5cfae50c0e5f2c500013@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/678fe2d1.050a0220.15cac.00b3.GAE@google.com/T/#u +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Link: https://patch.msgid.link/20250121181241.841212-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/ipmr_base.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/net/ipv4/ipmr_base.c b/net/ipv4/ipmr_base.c +index 03b6eee407a24..28d77d454d442 100644 +--- a/net/ipv4/ipmr_base.c ++++ b/net/ipv4/ipmr_base.c +@@ -330,9 +330,6 @@ int mr_table_dump(struct mr_table *mrt, struct sk_buff *skb, + list_for_each_entry(mfc, &mrt->mfc_unres_queue, list) { + if (e < s_e) + goto next_entry2; +- if (filter->dev && +- !mr_mfc_uses_dev(mrt, mfc, filter->dev)) +- goto next_entry2; + + err = fill(mrt, skb, NETLINK_CB(cb->skb).portid, + cb->nlh->nlmsg_seq, mfc, RTM_NEWROUTE, flags); +-- +2.39.5 + diff --git a/queue-6.12/ktest.pl-remove-unused-declarations-in-run_bisect_te.patch b/queue-6.12/ktest.pl-remove-unused-declarations-in-run_bisect_te.patch new file mode 100644 index 0000000000..f6bd2e0ffc --- /dev/null +++ b/queue-6.12/ktest.pl-remove-unused-declarations-in-run_bisect_te.patch @@ -0,0 +1,37 @@ +From 501e2b0f61aa2dca59ec4ec4a3f8100ba17a86d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Sep 2024 21:07:35 +0800 +Subject: ktest.pl: Remove unused declarations in run_bisect_test function + +From: Ba Jing + +[ Upstream commit 776735b954f49f85fd19e1198efa421fae2ad77c ] + +Since $output and $ret are not used in the subsequent code, the declarations +should be removed. + +Fixes: a75fececff3c ("ktest: Added sample.conf, new %default option format") +Link: https://lore.kernel.org/20240902130735.6034-1-bajing@cmss.chinamobile.com +Signed-off-by: Ba Jing +Signed-off-by: Steven Rostedt +Signed-off-by: Sasha Levin +--- + tools/testing/ktest/ktest.pl | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl +index dacad94e2be42..ecb22626805d5 100755 +--- a/tools/testing/ktest/ktest.pl ++++ b/tools/testing/ktest/ktest.pl +@@ -2960,8 +2960,6 @@ sub run_bisect_test { + + my $failed = 0; + my $result; +- my $output; +- my $ret; + + $in_bisect = 1; + +-- +2.39.5 + diff --git a/queue-6.12/landlock-handle-weird-files.patch b/queue-6.12/landlock-handle-weird-files.patch new file mode 100644 index 0000000000..bed718c784 --- /dev/null +++ b/queue-6.12/landlock-handle-weird-files.patch @@ -0,0 +1,67 @@ +From ce3279ca512b1fe79fea7f7fab9f337bff35d60b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 16:39:13 +0100 +Subject: landlock: Handle weird files +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mickaël Salaün + +[ Upstream commit 49440290a0935f428a1e43a5ac8dc275a647ff80 ] + +A corrupted filesystem (e.g. bcachefs) might return weird files. +Instead of throwing a warning and allowing access to such file, treat +them as regular files. + +Cc: Dave Chinner +Cc: Kent Overstreet +Cc: Paul Moore +Reported-by: syzbot+34b68f850391452207df@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/r/000000000000a65b35061cffca61@google.com +Reported-by: syzbot+360866a59e3c80510a62@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/r/67379b3f.050a0220.85a0.0001.GAE@google.com +Reported-by: Ubisectech Sirius +Closes: https://lore.kernel.org/r/c426821d-8380-46c4-a494-7008bbd7dd13.bugreport@ubisectech.com +Fixes: cb2c7d1a1776 ("landlock: Support filesystem access-control") +Reviewed-by: Günther Noack +Link: https://lore.kernel.org/r/20250110153918.241810-1-mic@digikod.net +Signed-off-by: Mickaël Salaün +Signed-off-by: Sasha Levin +--- + security/landlock/fs.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/security/landlock/fs.c b/security/landlock/fs.c +index e31b97a9f175a..7adb25150488f 100644 +--- a/security/landlock/fs.c ++++ b/security/landlock/fs.c +@@ -937,10 +937,6 @@ static access_mask_t get_mode_access(const umode_t mode) + switch (mode & S_IFMT) { + case S_IFLNK: + return LANDLOCK_ACCESS_FS_MAKE_SYM; +- case 0: +- /* A zero mode translates to S_IFREG. */ +- case S_IFREG: +- return LANDLOCK_ACCESS_FS_MAKE_REG; + case S_IFDIR: + return LANDLOCK_ACCESS_FS_MAKE_DIR; + case S_IFCHR: +@@ -951,9 +947,12 @@ static access_mask_t get_mode_access(const umode_t mode) + return LANDLOCK_ACCESS_FS_MAKE_FIFO; + case S_IFSOCK: + return LANDLOCK_ACCESS_FS_MAKE_SOCK; ++ case S_IFREG: ++ case 0: ++ /* A zero mode translates to S_IFREG. */ + default: +- WARN_ON_ONCE(1); +- return 0; ++ /* Treats weird files as regular files. */ ++ return LANDLOCK_ACCESS_FS_MAKE_REG; + } + } + +-- +2.39.5 + diff --git a/queue-6.12/leds-cht-wcove-use-devm_led_classdev_register-to-avo.patch b/queue-6.12/leds-cht-wcove-use-devm_led_classdev_register-to-avo.patch new file mode 100644 index 0000000000..f370635b51 --- /dev/null +++ b/queue-6.12/leds-cht-wcove-use-devm_led_classdev_register-to-avo.patch @@ -0,0 +1,51 @@ +From e3b8da3c6cf0a1ac1e3fc3d3a83371fc44303d07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2024 17:53:46 +0900 +Subject: leds: cht-wcove: Use devm_led_classdev_register() to avoid memory + leak + +From: Joe Hattori + +[ Upstream commit 417cad5dc782096350e6a967ee5dd3417a19a24e ] + +cht_wc_leds_probe() leaks memory when the second led_classdev_register() +call in the for-loop fails as it does not call the cleanup function +led_classdev_unregister() on the first device. Avoid this leak by +calling devm_led_classdev_register(). + +Fixes: 047da762b9a9 ("leds: Add Intel Cherry Trail Whiskey Cove PMIC LED driver") +Signed-off-by: Joe Hattori +Link: https://lore.kernel.org/r/20241220085346.533675-1-joe@pf.is.s.u-tokyo.ac.jp +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-cht-wcove.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/drivers/leds/leds-cht-wcove.c b/drivers/leds/leds-cht-wcove.c +index b4998402b8c6f..711ac4bd60580 100644 +--- a/drivers/leds/leds-cht-wcove.c ++++ b/drivers/leds/leds-cht-wcove.c +@@ -394,7 +394,7 @@ static int cht_wc_leds_probe(struct platform_device *pdev) + led->cdev.pattern_clear = cht_wc_leds_pattern_clear; + led->cdev.max_brightness = 255; + +- ret = led_classdev_register(&pdev->dev, &led->cdev); ++ ret = devm_led_classdev_register(&pdev->dev, &led->cdev); + if (ret < 0) + return ret; + } +@@ -406,10 +406,6 @@ static int cht_wc_leds_probe(struct platform_device *pdev) + static void cht_wc_leds_remove(struct platform_device *pdev) + { + struct cht_wc_leds *leds = platform_get_drvdata(pdev); +- int i; +- +- for (i = 0; i < CHT_WC_LED_COUNT; i++) +- led_classdev_unregister(&leds->leds[i].cdev); + + /* Restore LED1 regs if hw-control was active else leave LED1 off */ + if (!(leds->led1_initial_regs.ctrl & CHT_WC_LED1_SWCTL)) +-- +2.39.5 + diff --git a/queue-6.12/leds-netxbig-fix-an-of-node-reference-leak-in-netxbi.patch b/queue-6.12/leds-netxbig-fix-an-of-node-reference-leak-in-netxbi.patch new file mode 100644 index 0000000000..de125915e8 --- /dev/null +++ b/queue-6.12/leds-netxbig-fix-an-of-node-reference-leak-in-netxbi.patch @@ -0,0 +1,41 @@ +From 5f5105d8fa0b06f8f44570a7f628423ee3c721d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Dec 2024 16:49:23 +0900 +Subject: leds: netxbig: Fix an OF node reference leak in + netxbig_leds_get_of_pdata() + +From: Joe Hattori + +[ Upstream commit 0508316be63bb735f59bdc8fe4527cadb62210ca ] + +netxbig_leds_get_of_pdata() does not release the OF node obtained by +of_parse_phandle() when of_find_device_by_node() fails. Add an +of_node_put() call to fix the leak. + +This bug was found by an experimental static analysis tool that I am +developing. + +Fixes: 9af512e81964 ("leds: netxbig: Convert to use GPIO descriptors") +Signed-off-by: Joe Hattori +Link: https://lore.kernel.org/r/20241216074923.628509-1-joe@pf.is.s.u-tokyo.ac.jp +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-netxbig.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/leds/leds-netxbig.c b/drivers/leds/leds-netxbig.c +index af5a908b8d9ed..e95287416ef87 100644 +--- a/drivers/leds/leds-netxbig.c ++++ b/drivers/leds/leds-netxbig.c +@@ -439,6 +439,7 @@ static int netxbig_leds_get_of_pdata(struct device *dev, + } + gpio_ext_pdev = of_find_device_by_node(gpio_ext_np); + if (!gpio_ext_pdev) { ++ of_node_put(gpio_ext_np); + dev_err(dev, "Failed to find platform device for gpio-ext\n"); + return -ENODEV; + } +-- +2.39.5 + diff --git a/queue-6.12/libbpf-don-t-adjust-usdt-semaphore-address-if-.staps.patch b/queue-6.12/libbpf-don-t-adjust-usdt-semaphore-address-if-.staps.patch new file mode 100644 index 0000000000..a6c194b062 --- /dev/null +++ b/queue-6.12/libbpf-don-t-adjust-usdt-semaphore-address-if-.staps.patch @@ -0,0 +1,47 @@ +From a6865ab60c33e895e0f79366b9ad3e4400be6892 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Nov 2024 14:45:58 -0800 +Subject: libbpf: don't adjust USDT semaphore address if .stapsdt.base addr is + missing + +From: Andrii Nakryiko + +[ Upstream commit 98ebe5ef6f5c4517ba92fb3e56f95827ebea83fd ] + +USDT ELF note optionally can record an offset of .stapsdt.base, which is +used to make adjustments to USDT target attach address. Currently, +libbpf will do this address adjustment unconditionally if it finds +.stapsdt.base ELF section in target binary. But there is a corner case +where .stapsdt.base ELF section is present, but specific USDT note +doesn't reference it. In such case, libbpf will basically just add base +address and end up with absolutely incorrect USDT target address. + +This adjustment has to be done only if both .stapsdt.sema section is +present and USDT note is recording a reference to it. + +Fixes: 74cc6311cec9 ("libbpf: Add USDT notes parsing and resolution logic") +Signed-off-by: Andrii Nakryiko +Acked-by: Jiri Olsa +Link: https://lore.kernel.org/r/20241121224558.796110-1-andrii@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/usdt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/usdt.c b/tools/lib/bpf/usdt.c +index 93794f01bb67c..6ff28e7bf5e3d 100644 +--- a/tools/lib/bpf/usdt.c ++++ b/tools/lib/bpf/usdt.c +@@ -659,7 +659,7 @@ static int collect_usdt_targets(struct usdt_manager *man, Elf *elf, const char * + * [0] https://sourceware.org/systemtap/wiki/UserSpaceProbeImplementation + */ + usdt_abs_ip = note.loc_addr; +- if (base_addr) ++ if (base_addr && note.base_addr) + usdt_abs_ip += base_addr - note.base_addr; + + /* When attaching uprobes (which is what USDTs basically are) +-- +2.39.5 + diff --git a/queue-6.12/libbpf-fix-incorrect-traversal-end-type-id-when-mark.patch b/queue-6.12/libbpf-fix-incorrect-traversal-end-type-id-when-mark.patch new file mode 100644 index 0000000000..eea033cce0 --- /dev/null +++ b/queue-6.12/libbpf-fix-incorrect-traversal-end-type-id-when-mark.patch @@ -0,0 +1,43 @@ +From 63683e91de89a2846d09fa461889a49600ca1752 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 10:02:40 +0000 +Subject: libbpf: Fix incorrect traversal end type ID when marking + BTF_IS_EMBEDDED + +From: Pu Lehui + +[ Upstream commit 5ca681a86ef93369685cb63f71994f4cf7303e7c ] + +When redirecting the split BTF to the vmlinux base BTF, we need to mark +the distilled base struct/union members of split BTF structs/unions in +id_map with BTF_IS_EMBEDDED. This indicates that these types must match +both name and size later. Therefore, we need to traverse the entire +split BTF, which involves traversing type IDs from nr_dist_base_types to +nr_types. However, the current implementation uses an incorrect +traversal end type ID, so let's correct it. + +Fixes: 19e00c897d50 ("libbpf: Split BTF relocation") +Signed-off-by: Pu Lehui +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250115100241.4171581-3-pulehui@huaweicloud.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/btf_relocate.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/btf_relocate.c b/tools/lib/bpf/btf_relocate.c +index 4f7399d85eab3..8ef8003480dac 100644 +--- a/tools/lib/bpf/btf_relocate.c ++++ b/tools/lib/bpf/btf_relocate.c +@@ -212,7 +212,7 @@ static int btf_relocate_map_distilled_base(struct btf_relocate *r) + * need to match both name and size, otherwise embedding the base + * struct/union in the split type is invalid. + */ +- for (id = r->nr_dist_base_types; id < r->nr_split_types; id++) { ++ for (id = r->nr_dist_base_types; id < r->nr_dist_base_types + r->nr_split_types; id++) { + err = btf_mark_embedded_composite_type_ids(r, id); + if (err) + goto done; +-- +2.39.5 + diff --git a/queue-6.12/libbpf-fix-return-zero-when-elf_begin-failed.patch b/queue-6.12/libbpf-fix-return-zero-when-elf_begin-failed.patch new file mode 100644 index 0000000000..3c3bf1e82c --- /dev/null +++ b/queue-6.12/libbpf-fix-return-zero-when-elf_begin-failed.patch @@ -0,0 +1,36 @@ +From dd935f0427c67a9434107b3204d56ab8815ed547 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 10:02:39 +0000 +Subject: libbpf: Fix return zero when elf_begin failed + +From: Pu Lehui + +[ Upstream commit 5436a54332c19df0acbef2b87cbf9f7cba56f2dd ] + +The error number of elf_begin is omitted when encapsulating the +btf_find_elf_sections function. + +Fixes: c86f180ffc99 ("libbpf: Make btf_parse_elf process .BTF.base transparently") +Signed-off-by: Pu Lehui +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250115100241.4171581-2-pulehui@huaweicloud.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/btf.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c +index 3c131039c5232..27e7bfae953bd 100644 +--- a/tools/lib/bpf/btf.c ++++ b/tools/lib/bpf/btf.c +@@ -1185,6 +1185,7 @@ static struct btf *btf_parse_elf(const char *path, struct btf *base_btf, + + elf = elf_begin(fd, ELF_C_READ, NULL); + if (!elf) { ++ err = -LIBBPF_ERRNO__FORMAT; + pr_warn("failed to open %s as ELF file\n", path); + goto done; + } +-- +2.39.5 + diff --git a/queue-6.12/libbpf-fix-segfault-due-to-libelf-functions-not-sett.patch b/queue-6.12/libbpf-fix-segfault-due-to-libelf-functions-not-sett.patch new file mode 100644 index 0000000000..7d10a8c046 --- /dev/null +++ b/queue-6.12/libbpf-fix-segfault-due-to-libelf-functions-not-sett.patch @@ -0,0 +1,140 @@ +From d192d1f37c276697981f94ce2e3a2415be0641f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 13:59:42 +0000 +Subject: libbpf: Fix segfault due to libelf functions not setting errno + +From: Quentin Monnet + +[ Upstream commit e10500b69c3f3378f3dcfc8c2fe4cdb74fc844f5 ] + +Libelf functions do not set errno on failure. Instead, it relies on its +internal _elf_errno value, that can be retrieved via elf_errno (or the +corresponding message via elf_errmsg()). From "man libelf": + + If a libelf function encounters an error it will set an internal + error code that can be retrieved with elf_errno. Each thread + maintains its own separate error code. The meaning of each error + code can be determined with elf_errmsg, which returns a string + describing the error. + +As a consequence, libbpf should not return -errno when a function from +libelf fails, because an empty value will not be interpreted as an error +and won't prevent the program to stop. This is visible in +bpf_linker__add_file(), for example, where we call a succession of +functions that rely on libelf: + + err = err ?: linker_load_obj_file(linker, filename, opts, &obj); + err = err ?: linker_append_sec_data(linker, &obj); + err = err ?: linker_append_elf_syms(linker, &obj); + err = err ?: linker_append_elf_relos(linker, &obj); + err = err ?: linker_append_btf(linker, &obj); + err = err ?: linker_append_btf_ext(linker, &obj); + +If the object file that we try to process is not, in fact, a correct +object file, linker_load_obj_file() may fail with errno not being set, +and return 0. In this case we attempt to run linker_append_elf_sysms() +and may segfault. + +This can happen (and was discovered) with bpftool: + + $ bpftool gen object output.o sample_ret0.bpf.c + libbpf: failed to get ELF header for sample_ret0.bpf.c: invalid `Elf' handle + zsh: segmentation fault (core dumped) bpftool gen object output.o sample_ret0.bpf.c + +Fix the issue by returning a non-null error code (-EINVAL) when libelf +functions fail. + +Fixes: faf6ed321cf6 ("libbpf: Add BPF static linker APIs") +Signed-off-by: Quentin Monnet +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20241205135942.65262-1-qmo@kernel.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/linker.c | 22 ++++++++-------------- + 1 file changed, 8 insertions(+), 14 deletions(-) + +diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c +index 6985ab0f1ca9e..777600822d8e4 100644 +--- a/tools/lib/bpf/linker.c ++++ b/tools/lib/bpf/linker.c +@@ -567,17 +567,15 @@ static int linker_load_obj_file(struct bpf_linker *linker, const char *filename, + } + obj->elf = elf_begin(obj->fd, ELF_C_READ_MMAP, NULL); + if (!obj->elf) { +- err = -errno; + pr_warn_elf("failed to parse ELF file '%s'", filename); +- return err; ++ return -EINVAL; + } + + /* Sanity check ELF file high-level properties */ + ehdr = elf64_getehdr(obj->elf); + if (!ehdr) { +- err = -errno; + pr_warn_elf("failed to get ELF header for %s", filename); +- return err; ++ return -EINVAL; + } + if (ehdr->e_ident[EI_DATA] != host_endianness) { + err = -EOPNOTSUPP; +@@ -593,9 +591,8 @@ static int linker_load_obj_file(struct bpf_linker *linker, const char *filename, + } + + if (elf_getshdrstrndx(obj->elf, &obj->shstrs_sec_idx)) { +- err = -errno; + pr_warn_elf("failed to get SHSTRTAB section index for %s", filename); +- return err; ++ return -EINVAL; + } + + scn = NULL; +@@ -605,26 +602,23 @@ static int linker_load_obj_file(struct bpf_linker *linker, const char *filename, + + shdr = elf64_getshdr(scn); + if (!shdr) { +- err = -errno; + pr_warn_elf("failed to get section #%zu header for %s", + sec_idx, filename); +- return err; ++ return -EINVAL; + } + + sec_name = elf_strptr(obj->elf, obj->shstrs_sec_idx, shdr->sh_name); + if (!sec_name) { +- err = -errno; + pr_warn_elf("failed to get section #%zu name for %s", + sec_idx, filename); +- return err; ++ return -EINVAL; + } + + data = elf_getdata(scn, 0); + if (!data) { +- err = -errno; + pr_warn_elf("failed to get section #%zu (%s) data from %s", + sec_idx, sec_name, filename); +- return err; ++ return -EINVAL; + } + + sec = add_src_sec(obj, sec_name); +@@ -2635,14 +2629,14 @@ int bpf_linker__finalize(struct bpf_linker *linker) + + /* Finalize ELF layout */ + if (elf_update(linker->elf, ELF_C_NULL) < 0) { +- err = -errno; ++ err = -EINVAL; + pr_warn_elf("failed to finalize ELF layout"); + return libbpf_err(err); + } + + /* Write out final ELF contents */ + if (elf_update(linker->elf, ELF_C_WRITE) < 0) { +- err = -errno; ++ err = -EINVAL; + pr_warn_elf("failed to write ELF contents"); + return libbpf_err(err); + } +-- +2.39.5 + diff --git a/queue-6.12/loongarch-fix-warnings-during-s3-suspend.patch b/queue-6.12/loongarch-fix-warnings-during-s3-suspend.patch new file mode 100644 index 0000000000..c3d598b42a --- /dev/null +++ b/queue-6.12/loongarch-fix-warnings-during-s3-suspend.patch @@ -0,0 +1,105 @@ +From 516f85afe7296813cba96cd1d42d436d33a07a75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Jan 2025 21:49:59 +0800 +Subject: LoongArch: Fix warnings during S3 suspend + +From: Huacai Chen + +[ Upstream commit 26c0a2d93af55d30a46d5f45d3e9c42cde730168 ] + +The enable_gpe_wakeup() function calls acpi_enable_all_wakeup_gpes(), +and the later one may call the preempt_schedule_common() function, +resulting in a thread switch and causing the CPU to be in an interrupt +enabled state after the enable_gpe_wakeup() function returns, leading +to the warnings as follow. + +[ C0] WARNING: ... at kernel/time/timekeeping.c:845 ktime_get+0xbc/0xc8 +[ C0] ... +[ C0] Call Trace: +[ C0] [<90000000002243b4>] show_stack+0x64/0x188 +[ C0] [<900000000164673c>] dump_stack_lvl+0x60/0x88 +[ C0] [<90000000002687e4>] __warn+0x8c/0x148 +[ C0] [<90000000015e9978>] report_bug+0x1c0/0x2b0 +[ C0] [<90000000016478e4>] do_bp+0x204/0x3b8 +[ C0] [<90000000025b1924>] exception_handlers+0x1924/0x10000 +[ C0] [<9000000000343bbc>] ktime_get+0xbc/0xc8 +[ C0] [<9000000000354c08>] tick_sched_timer+0x30/0xb0 +[ C0] [<90000000003408e0>] __hrtimer_run_queues+0x160/0x378 +[ C0] [<9000000000341f14>] hrtimer_interrupt+0x144/0x388 +[ C0] [<9000000000228348>] constant_timer_interrupt+0x38/0x48 +[ C0] [<90000000002feba4>] __handle_irq_event_percpu+0x64/0x1e8 +[ C0] [<90000000002fed48>] handle_irq_event_percpu+0x20/0x80 +[ C0] [<9000000000306b9c>] handle_percpu_irq+0x5c/0x98 +[ C0] [<90000000002fd4a0>] generic_handle_domain_irq+0x30/0x48 +[ C0] [<9000000000d0c7b0>] handle_cpu_irq+0x70/0xa8 +[ C0] [<9000000001646b30>] handle_loongarch_irq+0x30/0x48 +[ C0] [<9000000001646bc8>] do_vint+0x80/0xe0 +[ C0] [<90000000002aea1c>] finish_task_switch.isra.0+0x8c/0x2a8 +[ C0] [<900000000164e34c>] __schedule+0x314/0xa48 +[ C0] [<900000000164ead8>] schedule+0x58/0xf0 +[ C0] [<9000000000294a2c>] worker_thread+0x224/0x498 +[ C0] [<900000000029d2f0>] kthread+0xf8/0x108 +[ C0] [<9000000000221f28>] ret_from_kernel_thread+0xc/0xa4 +[ C0] +[ C0] ---[ end trace 0000000000000000 ]--- + +The root cause is acpi_enable_all_wakeup_gpes() uses a mutex to protect +acpi_hw_enable_all_wakeup_gpes(), and acpi_ut_acquire_mutex() may cause +a thread switch. Since there is no longer concurrent execution during +loongarch_acpi_suspend(), we can call acpi_hw_enable_all_wakeup_gpes() +directly in enable_gpe_wakeup(). + +The solution is similar to commit 22db06337f590d01 ("ACPI: sleep: Avoid +breaking S3 wakeup due to might_sleep()"). + +Fixes: 366bb35a8e48 ("LoongArch: Add suspend (ACPI S3) support") +Signed-off-by: Qunqin Zhao +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/power/platform.c | 2 +- + drivers/acpi/acpica/achware.h | 2 -- + include/acpi/acpixf.h | 1 + + 3 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/loongarch/power/platform.c b/arch/loongarch/power/platform.c +index 0909729dc2e15..5bbdb9fd76e5d 100644 +--- a/arch/loongarch/power/platform.c ++++ b/arch/loongarch/power/platform.c +@@ -17,7 +17,7 @@ void enable_gpe_wakeup(void) + if (acpi_gbl_reduced_hardware) + return; + +- acpi_enable_all_wakeup_gpes(); ++ acpi_hw_enable_all_wakeup_gpes(); + } + + void enable_pci_wakeup(void) +diff --git a/drivers/acpi/acpica/achware.h b/drivers/acpi/acpica/achware.h +index 79bbfe00d241f..b8543a34caead 100644 +--- a/drivers/acpi/acpica/achware.h ++++ b/drivers/acpi/acpica/achware.h +@@ -103,8 +103,6 @@ acpi_hw_get_gpe_status(struct acpi_gpe_event_info *gpe_event_info, + + acpi_status acpi_hw_enable_all_runtime_gpes(void); + +-acpi_status acpi_hw_enable_all_wakeup_gpes(void); +- + u8 acpi_hw_check_all_gpes(acpi_handle gpe_skip_device, u32 gpe_skip_number); + + acpi_status +diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h +index d076ebd19a61e..78b24b0904888 100644 +--- a/include/acpi/acpixf.h ++++ b/include/acpi/acpixf.h +@@ -763,6 +763,7 @@ ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status + *event_status)) + ACPI_HW_DEPENDENT_RETURN_UINT32(u32 acpi_dispatch_gpe(acpi_handle gpe_device, u32 gpe_number)) + ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_hw_disable_all_gpes(void)) ++ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_hw_enable_all_wakeup_gpes(void)) + ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_disable_all_gpes(void)) + ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_enable_all_runtime_gpes(void)) + ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_enable_all_wakeup_gpes(void)) +-- +2.39.5 + diff --git a/queue-6.12/media-camif-core-add-check-for-clk_enable.patch b/queue-6.12/media-camif-core-add-check-for-clk_enable.patch new file mode 100644 index 0000000000..6b6ad5fe7f --- /dev/null +++ b/queue-6.12/media-camif-core-add-check-for-clk_enable.patch @@ -0,0 +1,50 @@ +From f962a86c5f7b90c9bfa55fb1978511d2d7c8ced3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Nov 2024 19:18:17 +0000 +Subject: media: camif-core: Add check for clk_enable() + +From: Jiasheng Jiang + +[ Upstream commit 77ed2470ac09c2b0a33cf3f98cc51d18ba9ed976 ] + +Add check for the return value of clk_enable() to gurantee the success. + +Fixes: babde1c243b2 ("[media] V4L: Add driver for S3C24XX/S3C64XX SoC series camera interface") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../media/platform/samsung/s3c-camif/camif-core.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/samsung/s3c-camif/camif-core.c b/drivers/media/platform/samsung/s3c-camif/camif-core.c +index e4529f666e206..8c597dd01713a 100644 +--- a/drivers/media/platform/samsung/s3c-camif/camif-core.c ++++ b/drivers/media/platform/samsung/s3c-camif/camif-core.c +@@ -527,10 +527,19 @@ static void s3c_camif_remove(struct platform_device *pdev) + static int s3c_camif_runtime_resume(struct device *dev) + { + struct camif_dev *camif = dev_get_drvdata(dev); ++ int ret; ++ ++ ret = clk_enable(camif->clock[CLK_GATE]); ++ if (ret) ++ return ret; + +- clk_enable(camif->clock[CLK_GATE]); + /* null op on s3c244x */ +- clk_enable(camif->clock[CLK_CAM]); ++ ret = clk_enable(camif->clock[CLK_CAM]); ++ if (ret) { ++ clk_disable(camif->clock[CLK_GATE]); ++ return ret; ++ } ++ + return 0; + } + +-- +2.39.5 + diff --git a/queue-6.12/media-dvb-usb-v2-af9035-fix-iso-c90-compilation-erro.patch b/queue-6.12/media-dvb-usb-v2-af9035-fix-iso-c90-compilation-erro.patch new file mode 100644 index 0000000000..85714c2307 --- /dev/null +++ b/queue-6.12/media-dvb-usb-v2-af9035-fix-iso-c90-compilation-erro.patch @@ -0,0 +1,70 @@ +From b72a7e55e582231df8973b5fe68185924aade045 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Sep 2024 14:27:55 -0300 +Subject: media: dvb-usb-v2: af9035: fix ISO C90 compilation error on + af9035_i2c_master_xfer + +From: Desnes Nunes + +[ Upstream commit c36b9ad1a8add3c114e25fe167efa217a813b0c7 ] + +This fixes a 'ISO C90 forbids mixed declarations and code' compilation +error on af9035_i2c_master_xfer, which is caused by the sanity check added +on user controlled msg[i], before declaring the demodulator register. + +Fixes: 7bf744f2de0a ("media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer") +Signed-off-by: Desnes Nunes +Link: https://lore.kernel.org/r/20240919172755.196907-1-desnesn@redhat.com +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb-v2/af9035.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c +index 0d2c42819d390..218f712f56b17 100644 +--- a/drivers/media/usb/dvb-usb-v2/af9035.c ++++ b/drivers/media/usb/dvb-usb-v2/af9035.c +@@ -322,13 +322,16 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, + ret = -EOPNOTSUPP; + } else if ((msg[0].addr == state->af9033_i2c_addr[0]) || + (msg[0].addr == state->af9033_i2c_addr[1])) { ++ /* demod access via firmware interface */ ++ u32 reg; ++ + if (msg[0].len < 3 || msg[1].len < 1) { + ret = -EOPNOTSUPP; + goto unlock; + } +- /* demod access via firmware interface */ +- u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 | +- msg[0].buf[2]; ++ ++ reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 | ++ msg[0].buf[2]; + + if (msg[0].addr == state->af9033_i2c_addr[1]) + reg |= 0x100000; +@@ -385,13 +388,16 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, + ret = -EOPNOTSUPP; + } else if ((msg[0].addr == state->af9033_i2c_addr[0]) || + (msg[0].addr == state->af9033_i2c_addr[1])) { ++ /* demod access via firmware interface */ ++ u32 reg; ++ + if (msg[0].len < 3) { + ret = -EOPNOTSUPP; + goto unlock; + } +- /* demod access via firmware interface */ +- u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 | +- msg[0].buf[2]; ++ ++ reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 | ++ msg[0].buf[2]; + + if (msg[0].addr == state->af9033_i2c_addr[1]) + reg |= 0x100000; +-- +2.39.5 + diff --git a/queue-6.12/media-i2c-imx290-register-0x3011-varies-between-imx3.patch b/queue-6.12/media-i2c-imx290-register-0x3011-varies-between-imx3.patch new file mode 100644 index 0000000000..5f8114c0f7 --- /dev/null +++ b/queue-6.12/media-i2c-imx290-register-0x3011-varies-between-imx3.patch @@ -0,0 +1,57 @@ +From 27ce4f06213641f235a0f61cba143b7f0a1ee0cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Nov 2024 19:17:04 +0000 +Subject: media: i2c: imx290: Register 0x3011 varies between imx327 and imx290 + +From: Dave Stevenson + +[ Upstream commit f2055c1d62d6dfd25a31d1d1923883f21305aea5 ] + +Reviewing the datasheets, register 0x3011 is meant to be 0x02 on imx327 +and 0x00 on imx290. + +Move it out of the common registers, and set it appropriately in the +sensor specific sections. (Included for imx290 to be explicit, rather +than relying on the default value). + +Fixes: 2d41947ec2c0 ("media: i2c: imx290: Add support for imx327 variant") +Signed-off-by: Dave Stevenson +Reviewed-by: Laurent Pinchart +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/imx290.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/imx290.c b/drivers/media/i2c/imx290.c +index 458905dfb3e11..a87a265cd8395 100644 +--- a/drivers/media/i2c/imx290.c ++++ b/drivers/media/i2c/imx290.c +@@ -269,7 +269,6 @@ static const struct cci_reg_sequence imx290_global_init_settings[] = { + { IMX290_WINWV, 1097 }, + { IMX290_XSOUTSEL, IMX290_XSOUTSEL_XVSOUTSEL_VSYNC | + IMX290_XSOUTSEL_XHSOUTSEL_HSYNC }, +- { CCI_REG8(0x3011), 0x02 }, + { CCI_REG8(0x3012), 0x64 }, + { CCI_REG8(0x3013), 0x00 }, + }; +@@ -277,6 +276,7 @@ static const struct cci_reg_sequence imx290_global_init_settings[] = { + static const struct cci_reg_sequence imx290_global_init_settings_290[] = { + { CCI_REG8(0x300f), 0x00 }, + { CCI_REG8(0x3010), 0x21 }, ++ { CCI_REG8(0x3011), 0x00 }, + { CCI_REG8(0x3016), 0x09 }, + { CCI_REG8(0x3070), 0x02 }, + { CCI_REG8(0x3071), 0x11 }, +@@ -330,6 +330,7 @@ static const struct cci_reg_sequence xclk_regs[][IMX290_NUM_CLK_REGS] = { + }; + + static const struct cci_reg_sequence imx290_global_init_settings_327[] = { ++ { CCI_REG8(0x3011), 0x02 }, + { CCI_REG8(0x309e), 0x4A }, + { CCI_REG8(0x309f), 0x4A }, + { CCI_REG8(0x313b), 0x61 }, +-- +2.39.5 + diff --git a/queue-6.12/media-i2c-imx412-add-missing-newline-to-prints.patch b/queue-6.12/media-i2c-imx412-add-missing-newline-to-prints.patch new file mode 100644 index 0000000000..21053cd049 --- /dev/null +++ b/queue-6.12/media-i2c-imx412-add-missing-newline-to-prints.patch @@ -0,0 +1,210 @@ +From 66f8bcfd1c626a1687c25203c89604282c6d95ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Nov 2024 22:45:46 +0100 +Subject: media: i2c: imx412: Add missing newline to prints + +From: Luca Weiss + +[ Upstream commit 33f4a7fba7229232e294f4794503283e44cd03f2 ] + +Add trailing \n to dev_dbg and dev_err prints where missing. + +Signed-off-by: Luca Weiss +Fixes: 9214e86c0cc1 ("media: i2c: Add imx412 camera sensor driver") +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/imx412.c | 42 +++++++++++++++++++------------------- + 1 file changed, 21 insertions(+), 21 deletions(-) + +diff --git a/drivers/media/i2c/imx412.c b/drivers/media/i2c/imx412.c +index 0bfe3046fcc87..c74097a59c428 100644 +--- a/drivers/media/i2c/imx412.c ++++ b/drivers/media/i2c/imx412.c +@@ -547,7 +547,7 @@ static int imx412_update_exp_gain(struct imx412 *imx412, u32 exposure, u32 gain) + + lpfr = imx412->vblank + imx412->cur_mode->height; + +- dev_dbg(imx412->dev, "Set exp %u, analog gain %u, lpfr %u", ++ dev_dbg(imx412->dev, "Set exp %u, analog gain %u, lpfr %u\n", + exposure, gain, lpfr); + + ret = imx412_write_reg(imx412, IMX412_REG_HOLD, 1, 1); +@@ -594,7 +594,7 @@ static int imx412_set_ctrl(struct v4l2_ctrl *ctrl) + case V4L2_CID_VBLANK: + imx412->vblank = imx412->vblank_ctrl->val; + +- dev_dbg(imx412->dev, "Received vblank %u, new lpfr %u", ++ dev_dbg(imx412->dev, "Received vblank %u, new lpfr %u\n", + imx412->vblank, + imx412->vblank + imx412->cur_mode->height); + +@@ -613,7 +613,7 @@ static int imx412_set_ctrl(struct v4l2_ctrl *ctrl) + exposure = ctrl->val; + analog_gain = imx412->again_ctrl->val; + +- dev_dbg(imx412->dev, "Received exp %u, analog gain %u", ++ dev_dbg(imx412->dev, "Received exp %u, analog gain %u\n", + exposure, analog_gain); + + ret = imx412_update_exp_gain(imx412, exposure, analog_gain); +@@ -622,7 +622,7 @@ static int imx412_set_ctrl(struct v4l2_ctrl *ctrl) + + break; + default: +- dev_err(imx412->dev, "Invalid control %d", ctrl->id); ++ dev_err(imx412->dev, "Invalid control %d\n", ctrl->id); + ret = -EINVAL; + } + +@@ -803,14 +803,14 @@ static int imx412_start_streaming(struct imx412 *imx412) + ret = imx412_write_regs(imx412, reg_list->regs, + reg_list->num_of_regs); + if (ret) { +- dev_err(imx412->dev, "fail to write initial registers"); ++ dev_err(imx412->dev, "fail to write initial registers\n"); + return ret; + } + + /* Setup handler will write actual exposure and gain */ + ret = __v4l2_ctrl_handler_setup(imx412->sd.ctrl_handler); + if (ret) { +- dev_err(imx412->dev, "fail to setup handler"); ++ dev_err(imx412->dev, "fail to setup handler\n"); + return ret; + } + +@@ -821,7 +821,7 @@ static int imx412_start_streaming(struct imx412 *imx412) + ret = imx412_write_reg(imx412, IMX412_REG_MODE_SELECT, + 1, IMX412_MODE_STREAMING); + if (ret) { +- dev_err(imx412->dev, "fail to start streaming"); ++ dev_err(imx412->dev, "fail to start streaming\n"); + return ret; + } + +@@ -895,7 +895,7 @@ static int imx412_detect(struct imx412 *imx412) + return ret; + + if (val != IMX412_ID) { +- dev_err(imx412->dev, "chip id mismatch: %x!=%x", ++ dev_err(imx412->dev, "chip id mismatch: %x!=%x\n", + IMX412_ID, val); + return -ENXIO; + } +@@ -927,7 +927,7 @@ static int imx412_parse_hw_config(struct imx412 *imx412) + imx412->reset_gpio = devm_gpiod_get_optional(imx412->dev, "reset", + GPIOD_OUT_LOW); + if (IS_ERR(imx412->reset_gpio)) { +- dev_err(imx412->dev, "failed to get reset gpio %ld", ++ dev_err(imx412->dev, "failed to get reset gpio %ld\n", + PTR_ERR(imx412->reset_gpio)); + return PTR_ERR(imx412->reset_gpio); + } +@@ -935,13 +935,13 @@ static int imx412_parse_hw_config(struct imx412 *imx412) + /* Get sensor input clock */ + imx412->inclk = devm_clk_get(imx412->dev, NULL); + if (IS_ERR(imx412->inclk)) { +- dev_err(imx412->dev, "could not get inclk"); ++ dev_err(imx412->dev, "could not get inclk\n"); + return PTR_ERR(imx412->inclk); + } + + rate = clk_get_rate(imx412->inclk); + if (rate != IMX412_INCLK_RATE) { +- dev_err(imx412->dev, "inclk frequency mismatch"); ++ dev_err(imx412->dev, "inclk frequency mismatch\n"); + return -EINVAL; + } + +@@ -966,14 +966,14 @@ static int imx412_parse_hw_config(struct imx412 *imx412) + + if (bus_cfg.bus.mipi_csi2.num_data_lanes != IMX412_NUM_DATA_LANES) { + dev_err(imx412->dev, +- "number of CSI2 data lanes %d is not supported", ++ "number of CSI2 data lanes %d is not supported\n", + bus_cfg.bus.mipi_csi2.num_data_lanes); + ret = -EINVAL; + goto done_endpoint_free; + } + + if (!bus_cfg.nr_of_link_frequencies) { +- dev_err(imx412->dev, "no link frequencies defined"); ++ dev_err(imx412->dev, "no link frequencies defined\n"); + ret = -EINVAL; + goto done_endpoint_free; + } +@@ -1034,7 +1034,7 @@ static int imx412_power_on(struct device *dev) + + ret = clk_prepare_enable(imx412->inclk); + if (ret) { +- dev_err(imx412->dev, "fail to enable inclk"); ++ dev_err(imx412->dev, "fail to enable inclk\n"); + goto error_reset; + } + +@@ -1145,7 +1145,7 @@ static int imx412_init_controls(struct imx412 *imx412) + imx412->hblank_ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY; + + if (ctrl_hdlr->error) { +- dev_err(imx412->dev, "control init failed: %d", ++ dev_err(imx412->dev, "control init failed: %d\n", + ctrl_hdlr->error); + v4l2_ctrl_handler_free(ctrl_hdlr); + return ctrl_hdlr->error; +@@ -1183,7 +1183,7 @@ static int imx412_probe(struct i2c_client *client) + + ret = imx412_parse_hw_config(imx412); + if (ret) { +- dev_err(imx412->dev, "HW configuration is not supported"); ++ dev_err(imx412->dev, "HW configuration is not supported\n"); + return ret; + } + +@@ -1191,14 +1191,14 @@ static int imx412_probe(struct i2c_client *client) + + ret = imx412_power_on(imx412->dev); + if (ret) { +- dev_err(imx412->dev, "failed to power-on the sensor"); ++ dev_err(imx412->dev, "failed to power-on the sensor\n"); + goto error_mutex_destroy; + } + + /* Check module identity */ + ret = imx412_detect(imx412); + if (ret) { +- dev_err(imx412->dev, "failed to find sensor: %d", ret); ++ dev_err(imx412->dev, "failed to find sensor: %d\n", ret); + goto error_power_off; + } + +@@ -1208,7 +1208,7 @@ static int imx412_probe(struct i2c_client *client) + + ret = imx412_init_controls(imx412); + if (ret) { +- dev_err(imx412->dev, "failed to init controls: %d", ret); ++ dev_err(imx412->dev, "failed to init controls: %d\n", ret); + goto error_power_off; + } + +@@ -1222,14 +1222,14 @@ static int imx412_probe(struct i2c_client *client) + imx412->pad.flags = MEDIA_PAD_FL_SOURCE; + ret = media_entity_pads_init(&imx412->sd.entity, 1, &imx412->pad); + if (ret) { +- dev_err(imx412->dev, "failed to init entity pads: %d", ret); ++ dev_err(imx412->dev, "failed to init entity pads: %d\n", ret); + goto error_handler_free; + } + + ret = v4l2_async_register_subdev_sensor(&imx412->sd); + if (ret < 0) { + dev_err(imx412->dev, +- "failed to register async subdev: %d", ret); ++ "failed to register async subdev: %d\n", ret); + goto error_media_entity; + } + +-- +2.39.5 + diff --git a/queue-6.12/media-i2c-ov9282-correct-the-exposure-offset.patch b/queue-6.12/media-i2c-ov9282-correct-the-exposure-offset.patch new file mode 100644 index 0000000000..610c16db42 --- /dev/null +++ b/queue-6.12/media-i2c-ov9282-correct-the-exposure-offset.patch @@ -0,0 +1,44 @@ +From a76c1e1b742aeab87cd446d5812fe13e06c12359 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Dec 2024 14:55:45 +0000 +Subject: media: i2c: ov9282: Correct the exposure offset + +From: Dave Stevenson + +[ Upstream commit feaf4154d69657af2bf96e6e66cca794f88b1a61 ] + +The datasheet lists that "Maximum exposure time is frame +length -25 row periods, where frame length is set by +registers {0x380E, 0x380F}". +However this driver had OV9282_EXPOSURE_OFFSET set to 12 +which allowed that restriction to be violated, and would +result in very under-exposed images. + +Correct the offset. + +Fixes: 14ea315bbeb7 ("media: i2c: Add ov9282 camera sensor driver") +Signed-off-by: Dave Stevenson +Reviewed-by: Kieran Bingham +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov9282.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/ov9282.c b/drivers/media/i2c/ov9282.c +index 9f52af6f047f3..87e5d7ce5a47e 100644 +--- a/drivers/media/i2c/ov9282.c ++++ b/drivers/media/i2c/ov9282.c +@@ -40,7 +40,7 @@ + /* Exposure control */ + #define OV9282_REG_EXPOSURE 0x3500 + #define OV9282_EXPOSURE_MIN 1 +-#define OV9282_EXPOSURE_OFFSET 12 ++#define OV9282_EXPOSURE_OFFSET 25 + #define OV9282_EXPOSURE_STEP 1 + #define OV9282_EXPOSURE_DEFAULT 0x0282 + +-- +2.39.5 + diff --git a/queue-6.12/media-lmedm04-handle-errors-for-lme2510_int_read.patch b/queue-6.12/media-lmedm04-handle-errors-for-lme2510_int_read.patch new file mode 100644 index 0000000000..2d624d7c3e --- /dev/null +++ b/queue-6.12/media-lmedm04-handle-errors-for-lme2510_int_read.patch @@ -0,0 +1,58 @@ +From 9eee30b1a6df9ad59118432446346dea0ab9c9e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 17:10:42 +0800 +Subject: media: lmedm04: Handle errors for lme2510_int_read + +From: Chen Ni + +[ Upstream commit a2836d3fe220220ff8c495ca9722f89cea8a67e7 ] + +Add check for the return value of usb_pipe_endpoint() and +usb_submit_urb() in order to catch the errors. + +Fixes: 15e1ce33182d ("[media] lmedm04: Fix usb_submit_urb BOGUS urb xfer, pipe 1 != type 3 in interrupt urb") +Signed-off-by: Chen Ni +Link: https://lore.kernel.org/r/20240521091042.1769684-1-nichen@iscas.ac.cn +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb-v2/lmedm04.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c +index 8a34e6c0d6a6d..f0537b741d135 100644 +--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c ++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c +@@ -373,6 +373,7 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap) + struct dvb_usb_device *d = adap_to_d(adap); + struct lme2510_state *lme_int = adap_to_priv(adap); + struct usb_host_endpoint *ep; ++ int ret; + + lme_int->lme_urb = usb_alloc_urb(0, GFP_KERNEL); + +@@ -390,11 +391,20 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap) + + /* Quirk of pipe reporting PIPE_BULK but behaves as interrupt */ + ep = usb_pipe_endpoint(d->udev, lme_int->lme_urb->pipe); ++ if (!ep) { ++ usb_free_urb(lme_int->lme_urb); ++ return -ENODEV; ++ } + + if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK) + lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa); + +- usb_submit_urb(lme_int->lme_urb, GFP_KERNEL); ++ ret = usb_submit_urb(lme_int->lme_urb, GFP_KERNEL); ++ if (ret) { ++ usb_free_urb(lme_int->lme_urb); ++ return ret; ++ } ++ + info("INT Interrupt Service Started"); + + return 0; +-- +2.39.5 + diff --git a/queue-6.12/media-marvell-add-check-for-clk_enable.patch b/queue-6.12/media-marvell-add-check-for-clk_enable.patch new file mode 100644 index 0000000000..679d272e50 --- /dev/null +++ b/queue-6.12/media-marvell-add-check-for-clk_enable.patch @@ -0,0 +1,42 @@ +From 6a1bc35a3ec3bf1220c1c995c4a32e1baed87ac9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Dec 2024 21:29:02 +0000 +Subject: media: marvell: Add check for clk_enable() + +From: Jiasheng Jiang + +[ Upstream commit 11f68d2ba2e1521a608af773bf788e8cfa260f68 ] + +Add check for the return value of clk_enable() to guarantee the success. + +Fixes: 81a409bfd551 ("media: marvell-ccic: provide a clock for the sensor") +Signed-off-by: Jiasheng Jiang +[Sakari Ailus: Fix spelling in commit message.] +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/marvell/mcam-core.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/marvell/mcam-core.c b/drivers/media/platform/marvell/mcam-core.c +index c81593c969e05..a62c3a484cb3f 100644 +--- a/drivers/media/platform/marvell/mcam-core.c ++++ b/drivers/media/platform/marvell/mcam-core.c +@@ -935,7 +935,12 @@ static int mclk_enable(struct clk_hw *hw) + ret = pm_runtime_resume_and_get(cam->dev); + if (ret < 0) + return ret; +- clk_enable(cam->clk[0]); ++ ret = clk_enable(cam->clk[0]); ++ if (ret) { ++ pm_runtime_put(cam->dev); ++ return ret; ++ } ++ + mcam_reg_write(cam, REG_CLKCTRL, (mclk_src << 29) | mclk_div); + mcam_ctlr_power_up(cam); + +-- +2.39.5 + diff --git a/queue-6.12/media-mipi-csis-add-check-for-clk_enable.patch b/queue-6.12/media-mipi-csis-add-check-for-clk_enable.patch new file mode 100644 index 0000000000..3e665a0204 --- /dev/null +++ b/queue-6.12/media-mipi-csis-add-check-for-clk_enable.patch @@ -0,0 +1,50 @@ +From 948540457b95ee70253e105793c1024b0b187d88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Nov 2024 19:18:18 +0000 +Subject: media: mipi-csis: Add check for clk_enable() + +From: Jiasheng Jiang + +[ Upstream commit 125ad1aeec77eb55273b420be6894b284a01e4b6 ] + +Add check for the return value of clk_enable() to gurantee the success. + +Fixes: b5f1220d587d ("[media] v4l: Add v4l2 subdev driver for S5P/EXYNOS4 MIPI-CSI receivers") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/samsung/exynos4-is/mipi-csis.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/samsung/exynos4-is/mipi-csis.c b/drivers/media/platform/samsung/exynos4-is/mipi-csis.c +index 4b9b20ba35041..38c5f22b850b9 100644 +--- a/drivers/media/platform/samsung/exynos4-is/mipi-csis.c ++++ b/drivers/media/platform/samsung/exynos4-is/mipi-csis.c +@@ -940,13 +940,19 @@ static int s5pcsis_pm_resume(struct device *dev, bool runtime) + state->supplies); + goto unlock; + } +- clk_enable(state->clock[CSIS_CLK_GATE]); ++ ret = clk_enable(state->clock[CSIS_CLK_GATE]); ++ if (ret) { ++ phy_power_off(state->phy); ++ regulator_bulk_disable(CSIS_NUM_SUPPLIES, ++ state->supplies); ++ goto unlock; ++ } + } + if (state->flags & ST_STREAMING) + s5pcsis_start_stream(state); + + state->flags &= ~ST_SUSPENDED; +- unlock: ++unlock: + mutex_unlock(&state->lock); + return ret ? -EAGAIN : 0; + } +-- +2.39.5 + diff --git a/queue-6.12/media-nxp-imx8-isi-fix-v4l2-compliance-test-errors.patch b/queue-6.12/media-nxp-imx8-isi-fix-v4l2-compliance-test-errors.patch new file mode 100644 index 0000000000..ed336668c1 --- /dev/null +++ b/queue-6.12/media-nxp-imx8-isi-fix-v4l2-compliance-test-errors.patch @@ -0,0 +1,54 @@ +From 37d432510dbde5129ac4d08221ddcc0a8f3c7d0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Sep 2024 13:33:04 +0300 +Subject: media: nxp: imx8-isi: fix v4l2-compliance test errors + +From: Laurentiu Palcu + +[ Upstream commit 7b12ab055edef2f51733d155617a401a05237bcc ] + +Running the v4l2-compliance (1.27.0-5208, SHA: af114250d48d) on the m2m +device fails on the MMAP streaming tests, with the following messages: + +fail: v4l2-test-buffers.cpp(240): g_field() == V4L2_FIELD_ANY +fail: v4l2-test-buffers.cpp(1508): buf.qbuf(node) + +Apparently, the driver does not properly set the field member of +vb2_v4l2_buffer struct, returning the default V4L2_FIELD_ANY value which +is against the guidelines. + +Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver") +Signed-off-by: Laurentiu Palcu +Reviewed-by: Laurent Pinchart +Link: https://lore.kernel.org/r/20240924103304.124085-1-laurentiu.palcu@oss.nxp.com +Signed-off-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c +index 4091f1c0e78bd..a71eb30323c8d 100644 +--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c ++++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c +@@ -861,6 +861,7 @@ int mxc_isi_video_buffer_prepare(struct mxc_isi_dev *isi, struct vb2_buffer *vb2 + const struct mxc_isi_format_info *info, + const struct v4l2_pix_format_mplane *pix) + { ++ struct vb2_v4l2_buffer *v4l2_buf = to_vb2_v4l2_buffer(vb2); + unsigned int i; + + for (i = 0; i < info->mem_planes; i++) { +@@ -875,6 +876,8 @@ int mxc_isi_video_buffer_prepare(struct mxc_isi_dev *isi, struct vb2_buffer *vb2 + vb2_set_plane_payload(vb2, i, size); + } + ++ v4l2_buf->field = pix->field; ++ + return 0; + } + +-- +2.39.5 + diff --git a/queue-6.12/media-rc-iguanair-handle-timeouts.patch b/queue-6.12/media-rc-iguanair-handle-timeouts.patch new file mode 100644 index 0000000000..2b2dd5b430 --- /dev/null +++ b/queue-6.12/media-rc-iguanair-handle-timeouts.patch @@ -0,0 +1,48 @@ +From fed7aa6cfade948ce622a9b44a8539fe68c8ec31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Nov 2024 14:17:22 +0100 +Subject: media: rc: iguanair: handle timeouts + +From: Oliver Neukum + +[ Upstream commit b98d5000c50544f14bacb248c34e5219fbe81287 ] + +In case of a timeout the IO must be cancelled or +the next IO using the URB will fail and/or overwrite +an operational URB. + +The automatic bisection fails because it arrives +at a commit that correctly lets the test case run +without an error. + +Signed-off-by: Oliver Neukum +Fixes: e99a7cfe93fd ("[media] iguanair: reuse existing urb callback for command responses") +Reported-by: syzbot+ffba8e636870dac0e0c0@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/66f5cc9a.050a0220.46d20.0004.GAE@google.com/ +Tested-by: syzbot+ffba8e636870dac0e0c0@syzkaller.appspotmail.com +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/rc/iguanair.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/rc/iguanair.c b/drivers/media/rc/iguanair.c +index 276bf3c8a8cb4..8af94246e5916 100644 +--- a/drivers/media/rc/iguanair.c ++++ b/drivers/media/rc/iguanair.c +@@ -194,8 +194,10 @@ static int iguanair_send(struct iguanair *ir, unsigned size) + if (rc) + return rc; + +- if (wait_for_completion_timeout(&ir->completion, TIMEOUT) == 0) ++ if (wait_for_completion_timeout(&ir->completion, TIMEOUT) == 0) { ++ usb_kill_urb(ir->urb_out); + return -ETIMEDOUT; ++ } + + return rc; + } +-- +2.39.5 + diff --git a/queue-6.12/media-uvcvideo-propagate-buf-error-to-userspace.patch b/queue-6.12/media-uvcvideo-propagate-buf-error-to-userspace.patch new file mode 100644 index 0000000000..5e78979694 --- /dev/null +++ b/queue-6.12/media-uvcvideo-propagate-buf-error-to-userspace.patch @@ -0,0 +1,44 @@ +From b164fc716d402eb476a86ea63f2a1a5f9dc14537 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Dec 2024 21:39:08 +0000 +Subject: media: uvcvideo: Propagate buf->error to userspace + +From: Ricardo Ribalda + +[ Upstream commit 87ce177654e388451850905a1d376658aebe8699 ] + +Now we return VB2_BUF_STATE_DONE for valid and invalid frames. Propagate +the correct value, so the user can know if the frame is valid or not via +struct v4l2_buffer->flags. + +Reported-by: Hans de Goede +Closes: https://lore.kernel.org/linux-media/84b0f212-cd88-46bb-8e6f-b94ec3eccba6@redhat.com +Fixes: 6998b6fb4b1c ("[media] uvcvideo: Use videobuf2-vmalloc") +Signed-off-by: Ricardo Ribalda +Reviewed-by: Laurent Pinchart +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20241218-uvc-deprecate-v2-1-ab814139e983@chromium.org +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_queue.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/uvc/uvc_queue.c b/drivers/media/usb/uvc/uvc_queue.c +index 16fa17bbd15ea..83ed7821fa2a7 100644 +--- a/drivers/media/usb/uvc/uvc_queue.c ++++ b/drivers/media/usb/uvc/uvc_queue.c +@@ -483,7 +483,8 @@ static void uvc_queue_buffer_complete(struct kref *ref) + + buf->state = buf->error ? UVC_BUF_STATE_ERROR : UVC_BUF_STATE_DONE; + vb2_set_plane_payload(&buf->buf.vb2_buf, 0, buf->bytesused); +- vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_DONE); ++ vb2_buffer_done(&buf->buf.vb2_buf, buf->error ? VB2_BUF_STATE_ERROR : ++ VB2_BUF_STATE_DONE); + } + + /* +-- +2.39.5 + diff --git a/queue-6.12/memory-tegra20-emc-fix-an-of-node-reference-bug-in-t.patch b/queue-6.12/memory-tegra20-emc-fix-an-of-node-reference-bug-in-t.patch new file mode 100644 index 0000000000..1854bbd28b --- /dev/null +++ b/queue-6.12/memory-tegra20-emc-fix-an-of-node-reference-bug-in-t.patch @@ -0,0 +1,67 @@ +From 89c1e6f1dff4a815aed48196054dd94e304cd9f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Dec 2024 18:14:34 +0900 +Subject: memory: tegra20-emc: fix an OF node reference bug in + tegra_emc_find_node_by_ram_code() + +From: Joe Hattori + +[ Upstream commit b9784e5cde1f9fb83661a70e580e381ae1264d12 ] + +As of_find_node_by_name() release the reference of the argument device +node, tegra_emc_find_node_by_ram_code() releases some device nodes while +still in use, resulting in possible UAFs. According to the bindings and +the in-tree DTS files, the "emc-tables" node is always device's child +node with the property "nvidia,use-ram-code", and the "lpddr2" node is a +child of the "emc-tables" node. Thus utilize the +for_each_child_of_node() macro and of_get_child_by_name() instead of +of_find_node_by_name() to simplify the code. + +This bug was found by an experimental verification tool that I am +developing. + +Fixes: 96e5da7c8424 ("memory: tegra: Introduce Tegra20 EMC driver") +Signed-off-by: Joe Hattori +Link: https://lore.kernel.org/r/20241217091434.1993597-1-joe@pf.is.s.u-tokyo.ac.jp +Link: https://lore.kernel.org/r/20241218024415.2494267-3-joe@pf.is.s.u-tokyo.ac.jp +[krzysztof: applied v1, adjust the commit msg to incorporate v2 parts] +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/memory/tegra/tegra20-emc.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/memory/tegra/tegra20-emc.c b/drivers/memory/tegra/tegra20-emc.c +index 7193f848d17e6..9b7d30a21a5bd 100644 +--- a/drivers/memory/tegra/tegra20-emc.c ++++ b/drivers/memory/tegra/tegra20-emc.c +@@ -474,14 +474,15 @@ tegra_emc_find_node_by_ram_code(struct tegra_emc *emc) + + ram_code = tegra_read_ram_code(); + +- for (np = of_find_node_by_name(dev->of_node, "emc-tables"); np; +- np = of_find_node_by_name(np, "emc-tables")) { ++ for_each_child_of_node(dev->of_node, np) { ++ if (!of_node_name_eq(np, "emc-tables")) ++ continue; + err = of_property_read_u32(np, "nvidia,ram-code", &value); + if (err || value != ram_code) { + struct device_node *lpddr2_np; + bool cfg_mismatches = false; + +- lpddr2_np = of_find_node_by_name(np, "lpddr2"); ++ lpddr2_np = of_get_child_by_name(np, "lpddr2"); + if (lpddr2_np) { + const struct lpddr2_info *info; + +@@ -518,7 +519,6 @@ tegra_emc_find_node_by_ram_code(struct tegra_emc *emc) + } + + if (cfg_mismatches) { +- of_node_put(np); + continue; + } + } +-- +2.39.5 + diff --git a/queue-6.12/mfd-syscon-fix-race-in-device_node_get_regmap.patch b/queue-6.12/mfd-syscon-fix-race-in-device_node_get_regmap.patch new file mode 100644 index 0000000000..b042401dfc --- /dev/null +++ b/queue-6.12/mfd-syscon-fix-race-in-device_node_get_regmap.patch @@ -0,0 +1,125 @@ +From 93401f122b149b3742453da7e2bc0a4264c29c68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Dec 2024 12:11:40 -0600 +Subject: mfd: syscon: Fix race in device_node_get_regmap() + +From: Rob Herring (Arm) + +[ Upstream commit 805f7aaf7fee14a57b56af01d270edf6c10765e8 ] + +It is possible for multiple, simultaneous callers calling +device_node_get_regmap() with the same node to fail to find an entry in +the syscon_list. There is a period of time while the first caller is +calling of_syscon_register() that subsequent callers also fail to find +an entry in the syscon_list and then call of_syscon_register() a second +time. + +Fix this by keeping the lock held until after of_syscon_register() +completes and adds the node to syscon_list. Convert the spinlock to a +mutex as many of the functions called in of_syscon_register() such as +kzalloc() and of_clk_get() may sleep. + +Fixes: bdb0066df96e ("mfd: syscon: Decouple syscon interface from platform devices") +Signed-off-by: Rob Herring (Arm) +Reviewed-by: Krzysztof Kozlowski +Tested-by: Krzysztof Kozlowski +Tested-by: Will McVicker +Tested-by: Pankaj Dubey +Reviewed-by: Pankaj Dubey +Link: https://lore.kernel.org/r/20241217-syscon-fixes-v2-1-4f56d750541d@kernel.org +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/syscon.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/mfd/syscon.c b/drivers/mfd/syscon.c +index 2ce15f60eb107..729e79e1be49f 100644 +--- a/drivers/mfd/syscon.c ++++ b/drivers/mfd/syscon.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -27,7 +28,7 @@ + + static struct platform_driver syscon_driver; + +-static DEFINE_SPINLOCK(syscon_list_slock); ++static DEFINE_MUTEX(syscon_list_lock); + static LIST_HEAD(syscon_list); + + struct syscon { +@@ -54,6 +55,8 @@ static struct syscon *of_syscon_register(struct device_node *np, bool check_res) + struct resource res; + struct reset_control *reset; + ++ WARN_ON(!mutex_is_locked(&syscon_list_lock)); ++ + struct syscon *syscon __free(kfree) = kzalloc(sizeof(*syscon), GFP_KERNEL); + if (!syscon) + return ERR_PTR(-ENOMEM); +@@ -144,9 +147,7 @@ static struct syscon *of_syscon_register(struct device_node *np, bool check_res) + syscon->regmap = regmap; + syscon->np = np; + +- spin_lock(&syscon_list_slock); + list_add_tail(&syscon->list, &syscon_list); +- spin_unlock(&syscon_list_slock); + + return_ptr(syscon); + +@@ -167,7 +168,7 @@ static struct regmap *device_node_get_regmap(struct device_node *np, + { + struct syscon *entry, *syscon = NULL; + +- spin_lock(&syscon_list_slock); ++ mutex_lock(&syscon_list_lock); + + list_for_each_entry(entry, &syscon_list, list) + if (entry->np == np) { +@@ -175,11 +176,11 @@ static struct regmap *device_node_get_regmap(struct device_node *np, + break; + } + +- spin_unlock(&syscon_list_slock); +- + if (!syscon) + syscon = of_syscon_register(np, check_res); + ++ mutex_unlock(&syscon_list_lock); ++ + if (IS_ERR(syscon)) + return ERR_CAST(syscon); + +@@ -210,7 +211,7 @@ int of_syscon_register_regmap(struct device_node *np, struct regmap *regmap) + return -ENOMEM; + + /* check if syscon entry already exists */ +- spin_lock(&syscon_list_slock); ++ mutex_lock(&syscon_list_lock); + + list_for_each_entry(entry, &syscon_list, list) + if (entry->np == np) { +@@ -223,12 +224,12 @@ int of_syscon_register_regmap(struct device_node *np, struct regmap *regmap) + + /* register the regmap in syscon list */ + list_add_tail(&syscon->list, &syscon_list); +- spin_unlock(&syscon_list_slock); ++ mutex_unlock(&syscon_list_lock); + + return 0; + + err_unlock: +- spin_unlock(&syscon_list_slock); ++ mutex_unlock(&syscon_list_lock); + kfree(syscon); + return ret; + } +-- +2.39.5 + diff --git a/queue-6.12/module-convert-default-symbol-namespace-to-string-li.patch b/queue-6.12/module-convert-default-symbol-namespace-to-string-li.patch new file mode 100644 index 0000000000..d0d6ff7527 --- /dev/null +++ b/queue-6.12/module-convert-default-symbol-namespace-to-string-li.patch @@ -0,0 +1,305 @@ +From fb47cd3939a75f904a4d59a4f47bfe51284cfdf2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Dec 2024 19:21:07 +0900 +Subject: module: Convert default symbol namespace to string literal +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Masahiro Yamada + +[ Upstream commit ceb8bf2ceaa77fe222fe8fe32cb7789c9099ddf1 ] + +Commit cdd30ebb1b9f ("module: Convert symbol namespace to string +literal") only converted MODULE_IMPORT_NS() and EXPORT_SYMBOL_NS(), +leaving DEFAULT_SYMBOL_NAMESPACE as a macro expansion. + +This commit converts DEFAULT_SYMBOL_NAMESPACE in the same way to avoid +annoyance for the default namespace as well. + +Signed-off-by: Masahiro Yamada +Reviewed-by: Uwe Kleine-König +Signed-off-by: Linus Torvalds +Stable-dep-of: 2505f87eb3af ("hwmon: (nct6775): Actually make use of the HWMON_NCT6775 symbol namespace") +Signed-off-by: Sasha Levin +--- + Documentation/core-api/symbol-namespaces.rst | 4 ++-- + .../translations/it_IT/core-api/symbol-namespaces.rst | 4 ++-- + .../translations/zh_CN/core-api/symbol-namespaces.rst | 4 ++-- + drivers/cdx/Makefile | 2 +- + drivers/crypto/intel/iaa/Makefile | 2 +- + drivers/crypto/intel/qat/qat_common/Makefile | 2 +- + drivers/dma/idxd/Makefile | 2 +- + drivers/gpio/gpio-idio-16.c | 2 +- + drivers/hwmon/nct6775-core.c | 2 +- + drivers/i2c/busses/i2c-designware-common.c | 2 +- + drivers/i2c/busses/i2c-designware-master.c | 2 +- + drivers/i2c/busses/i2c-designware-slave.c | 2 +- + drivers/pwm/core.c | 2 +- + drivers/pwm/pwm-dwc-core.c | 2 +- + drivers/pwm/pwm-lpss.c | 2 +- + drivers/tty/serial/sc16is7xx.c | 2 +- + drivers/usb/storage/Makefile | 2 +- + include/linux/export.h | 2 +- + 18 files changed, 21 insertions(+), 21 deletions(-) + +diff --git a/Documentation/core-api/symbol-namespaces.rst b/Documentation/core-api/symbol-namespaces.rst +index 12e4aecdae945..d1154eb438101 100644 +--- a/Documentation/core-api/symbol-namespaces.rst ++++ b/Documentation/core-api/symbol-namespaces.rst +@@ -68,7 +68,7 @@ is to define the default namespace in the ``Makefile`` of the subsystem. E.g. to + export all symbols defined in usb-common into the namespace USB_COMMON, add a + line like this to drivers/usb/common/Makefile:: + +- ccflags-y += -DDEFAULT_SYMBOL_NAMESPACE=USB_COMMON ++ ccflags-y += -DDEFAULT_SYMBOL_NAMESPACE='"USB_COMMON"' + + That will affect all EXPORT_SYMBOL() and EXPORT_SYMBOL_GPL() statements. A + symbol exported with EXPORT_SYMBOL_NS() while this definition is present, will +@@ -79,7 +79,7 @@ A second option to define the default namespace is directly in the compilation + unit as preprocessor statement. The above example would then read:: + + #undef DEFAULT_SYMBOL_NAMESPACE +- #define DEFAULT_SYMBOL_NAMESPACE USB_COMMON ++ #define DEFAULT_SYMBOL_NAMESPACE "USB_COMMON" + + within the corresponding compilation unit before any EXPORT_SYMBOL macro is + used. +diff --git a/Documentation/translations/it_IT/core-api/symbol-namespaces.rst b/Documentation/translations/it_IT/core-api/symbol-namespaces.rst +index 17abc25ee4c1e..6657f82c0101f 100644 +--- a/Documentation/translations/it_IT/core-api/symbol-namespaces.rst ++++ b/Documentation/translations/it_IT/core-api/symbol-namespaces.rst +@@ -69,7 +69,7 @@ Per esempio per esportare tutti i simboli definiti in usb-common nello spazio + dei nomi USB_COMMON, si può aggiungere la seguente linea in + drivers/usb/common/Makefile:: + +- ccflags-y += -DDEFAULT_SYMBOL_NAMESPACE=USB_COMMON ++ ccflags-y += -DDEFAULT_SYMBOL_NAMESPACE='"USB_COMMON"' + + Questo cambierà tutte le macro EXPORT_SYMBOL() ed EXPORT_SYMBOL_GPL(). Invece, + un simbolo esportato con EXPORT_SYMBOL_NS() non verrà cambiato e il simbolo +@@ -79,7 +79,7 @@ Una seconda possibilità è quella di definire il simbolo di preprocessore + direttamente nei file da compilare. L'esempio precedente diventerebbe:: + + #undef DEFAULT_SYMBOL_NAMESPACE +- #define DEFAULT_SYMBOL_NAMESPACE USB_COMMON ++ #define DEFAULT_SYMBOL_NAMESPACE "USB_COMMON" + + Questo va messo prima di un qualsiasi uso di EXPORT_SYMBOL. + +diff --git a/Documentation/translations/zh_CN/core-api/symbol-namespaces.rst b/Documentation/translations/zh_CN/core-api/symbol-namespaces.rst +index bb16f0611046d..f3e73834f7d7d 100644 +--- a/Documentation/translations/zh_CN/core-api/symbol-namespaces.rst ++++ b/Documentation/translations/zh_CN/core-api/symbol-namespaces.rst +@@ -66,7 +66,7 @@ + 子系统的 ``Makefile`` 中定义默认命名空间。例如，如果要将usb-common中定义的所有符号导 + 出到USB_COMMON命名空间，可以在drivers/usb/common/Makefile中添加这样一行:: + +- ccflags-y += -DDEFAULT_SYMBOL_NAMESPACE=USB_COMMON ++ ccflags-y += -DDEFAULT_SYMBOL_NAMESPACE='"USB_COMMON"' + + 这将影响所有 EXPORT_SYMBOL() 和 EXPORT_SYMBOL_GPL() 语句。当这个定义存在时， + 用EXPORT_SYMBOL_NS()导出的符号仍然会被导出到作为命名空间参数传递的命名空间中， +@@ -76,7 +76,7 @@ + 成:: + + #undef DEFAULT_SYMBOL_NAMESPACE +- #define DEFAULT_SYMBOL_NAMESPACE USB_COMMON ++ #define DEFAULT_SYMBOL_NAMESPACE "USB_COMMON" + + 应置于相关编译单元中任何 EXPORT_SYMBOL 宏之前 + +diff --git a/drivers/cdx/Makefile b/drivers/cdx/Makefile +index 749a3295c2bdc..3ca7068a30525 100644 +--- a/drivers/cdx/Makefile ++++ b/drivers/cdx/Makefile +@@ -5,7 +5,7 @@ + # Copyright (C) 2022-2023, Advanced Micro Devices, Inc. + # + +-ccflags-y += -DDEFAULT_SYMBOL_NAMESPACE=CDX_BUS ++ccflags-y += -DDEFAULT_SYMBOL_NAMESPACE='"CDX_BUS"' + + obj-$(CONFIG_CDX_BUS) += cdx.o controller/ + +diff --git a/drivers/crypto/intel/iaa/Makefile b/drivers/crypto/intel/iaa/Makefile +index b64b208d23440..55bda7770fac7 100644 +--- a/drivers/crypto/intel/iaa/Makefile ++++ b/drivers/crypto/intel/iaa/Makefile +@@ -3,7 +3,7 @@ + # Makefile for IAA crypto device drivers + # + +-ccflags-y += -I $(srctree)/drivers/dma/idxd -DDEFAULT_SYMBOL_NAMESPACE=IDXD ++ccflags-y += -I $(srctree)/drivers/dma/idxd -DDEFAULT_SYMBOL_NAMESPACE='"IDXD"' + + obj-$(CONFIG_CRYPTO_DEV_IAA_CRYPTO) := iaa_crypto.o + +diff --git a/drivers/crypto/intel/qat/qat_common/Makefile b/drivers/crypto/intel/qat/qat_common/Makefile +index eac73cbfdd38e..7acf9c576149b 100644 +--- a/drivers/crypto/intel/qat/qat_common/Makefile ++++ b/drivers/crypto/intel/qat/qat_common/Makefile +@@ -1,6 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0 + obj-$(CONFIG_CRYPTO_DEV_QAT) += intel_qat.o +-ccflags-y += -DDEFAULT_SYMBOL_NAMESPACE=CRYPTO_QAT ++ccflags-y += -DDEFAULT_SYMBOL_NAMESPACE='"CRYPTO_QAT"' + intel_qat-objs := adf_cfg.o \ + adf_isr.o \ + adf_ctl_drv.o \ +diff --git a/drivers/dma/idxd/Makefile b/drivers/dma/idxd/Makefile +index 2b4a0d406e1e7..9ff9d7b87b649 100644 +--- a/drivers/dma/idxd/Makefile ++++ b/drivers/dma/idxd/Makefile +@@ -1,4 +1,4 @@ +-ccflags-y += -DDEFAULT_SYMBOL_NAMESPACE=IDXD ++ccflags-y += -DDEFAULT_SYMBOL_NAMESPACE='"IDXD"' + + obj-$(CONFIG_INTEL_IDXD_BUS) += idxd_bus.o + idxd_bus-y := bus.o +diff --git a/drivers/gpio/gpio-idio-16.c b/drivers/gpio/gpio-idio-16.c +index 53b1eb876a125..2c95125892972 100644 +--- a/drivers/gpio/gpio-idio-16.c ++++ b/drivers/gpio/gpio-idio-16.c +@@ -14,7 +14,7 @@ + + #include "gpio-idio-16.h" + +-#define DEFAULT_SYMBOL_NAMESPACE GPIO_IDIO_16 ++#define DEFAULT_SYMBOL_NAMESPACE "GPIO_IDIO_16" + + #define IDIO_16_DAT_BASE 0x0 + #define IDIO_16_OUT_BASE IDIO_16_DAT_BASE +diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c +index ee04795b98aab..c243b51837d2f 100644 +--- a/drivers/hwmon/nct6775-core.c ++++ b/drivers/hwmon/nct6775-core.c +@@ -57,7 +57,7 @@ + #include "nct6775.h" + + #undef DEFAULT_SYMBOL_NAMESPACE +-#define DEFAULT_SYMBOL_NAMESPACE HWMON_NCT6775 ++#define DEFAULT_SYMBOL_NAMESPACE "HWMON_NCT6775" + + #define USE_ALTERNATE + +diff --git a/drivers/i2c/busses/i2c-designware-common.c b/drivers/i2c/busses/i2c-designware-common.c +index 9d88b4fa03e42..0e7771d21469d 100644 +--- a/drivers/i2c/busses/i2c-designware-common.c ++++ b/drivers/i2c/busses/i2c-designware-common.c +@@ -29,7 +29,7 @@ + #include + #include + +-#define DEFAULT_SYMBOL_NAMESPACE I2C_DW_COMMON ++#define DEFAULT_SYMBOL_NAMESPACE "I2C_DW_COMMON" + + #include "i2c-designware-core.h" + +diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c +index e8ac9a7bf0b3d..e23f93b8974e4 100644 +--- a/drivers/i2c/busses/i2c-designware-master.c ++++ b/drivers/i2c/busses/i2c-designware-master.c +@@ -22,7 +22,7 @@ + #include + #include + +-#define DEFAULT_SYMBOL_NAMESPACE I2C_DW ++#define DEFAULT_SYMBOL_NAMESPACE "I2C_DW" + + #include "i2c-designware-core.h" + +diff --git a/drivers/i2c/busses/i2c-designware-slave.c b/drivers/i2c/busses/i2c-designware-slave.c +index 7035296aa24ce..0a76e10f77a2b 100644 +--- a/drivers/i2c/busses/i2c-designware-slave.c ++++ b/drivers/i2c/busses/i2c-designware-slave.c +@@ -16,7 +16,7 @@ + #include + #include + +-#define DEFAULT_SYMBOL_NAMESPACE I2C_DW ++#define DEFAULT_SYMBOL_NAMESPACE "I2C_DW" + + #include "i2c-designware-core.h" + +diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c +index 210368099a064..174939359ae3e 100644 +--- a/drivers/pwm/core.c ++++ b/drivers/pwm/core.c +@@ -6,7 +6,7 @@ + * Copyright (C) 2011-2012 Avionic Design GmbH + */ + +-#define DEFAULT_SYMBOL_NAMESPACE PWM ++#define DEFAULT_SYMBOL_NAMESPACE "PWM" + + #include + #include +diff --git a/drivers/pwm/pwm-dwc-core.c b/drivers/pwm/pwm-dwc-core.c +index c8425493b95d8..6dabec93a3c64 100644 +--- a/drivers/pwm/pwm-dwc-core.c ++++ b/drivers/pwm/pwm-dwc-core.c +@@ -9,7 +9,7 @@ + * Author: Raymond Tan + */ + +-#define DEFAULT_SYMBOL_NAMESPACE dwc_pwm ++#define DEFAULT_SYMBOL_NAMESPACE "dwc_pwm" + + #include + #include +diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c +index 867e2bc8c601c..3b99feb3bb491 100644 +--- a/drivers/pwm/pwm-lpss.c ++++ b/drivers/pwm/pwm-lpss.c +@@ -19,7 +19,7 @@ + #include + #include + +-#define DEFAULT_SYMBOL_NAMESPACE PWM_LPSS ++#define DEFAULT_SYMBOL_NAMESPACE "PWM_LPSS" + + #include "pwm-lpss.h" + +diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c +index ad88a33a504f5..6a0a1cce3a897 100644 +--- a/drivers/tty/serial/sc16is7xx.c ++++ b/drivers/tty/serial/sc16is7xx.c +@@ -8,7 +8,7 @@ + */ + + #undef DEFAULT_SYMBOL_NAMESPACE +-#define DEFAULT_SYMBOL_NAMESPACE SERIAL_NXP_SC16IS7XX ++#define DEFAULT_SYMBOL_NAMESPACE "SERIAL_NXP_SC16IS7XX" + + #include + #include +diff --git a/drivers/usb/storage/Makefile b/drivers/usb/storage/Makefile +index 46635fa4a3405..28db337f190bf 100644 +--- a/drivers/usb/storage/Makefile ++++ b/drivers/usb/storage/Makefile +@@ -8,7 +8,7 @@ + + ccflags-y := -I $(srctree)/drivers/scsi + +-ccflags-y += -DDEFAULT_SYMBOL_NAMESPACE=USB_STORAGE ++ccflags-y += -DDEFAULT_SYMBOL_NAMESPACE='"USB_STORAGE"' + + obj-$(CONFIG_USB_UAS) += uas.o + obj-$(CONFIG_USB_STORAGE) += usb-storage.o +diff --git a/include/linux/export.h b/include/linux/export.h +index 0bbd02fd351db..1e04dbc675c2f 100644 +--- a/include/linux/export.h ++++ b/include/linux/export.h +@@ -60,7 +60,7 @@ + #endif + + #ifdef DEFAULT_SYMBOL_NAMESPACE +-#define _EXPORT_SYMBOL(sym, license) __EXPORT_SYMBOL(sym, license, __stringify(DEFAULT_SYMBOL_NAMESPACE)) ++#define _EXPORT_SYMBOL(sym, license) __EXPORT_SYMBOL(sym, license, DEFAULT_SYMBOL_NAMESPACE) + #else + #define _EXPORT_SYMBOL(sym, license) __EXPORT_SYMBOL(sym, license, "") + #endif +-- +2.39.5 + diff --git a/queue-6.12/module-don-t-fail-module-loading-when-setting-ro_aft.patch b/queue-6.12/module-don-t-fail-module-loading-when-setting-ro_aft.patch new file mode 100644 index 0000000000..31762ec9fd --- /dev/null +++ b/queue-6.12/module-don-t-fail-module-loading-when-setting-ro_aft.patch @@ -0,0 +1,54 @@ +From b11c0765efe95f1c1b84132bde0bcc0df10aaf89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 20:46:16 +0100 +Subject: module: Don't fail module loading when setting ro_after_init section + RO failed + +From: Christophe Leroy + +[ Upstream commit 110b1e070f1d50f5217bd2c758db094998bb7b77 ] + +Once module init has succeded it is too late to cancel loading. +If setting ro_after_init data section to read-only fails, all we +can do is to inform the user through a warning. + +Reported-by: Thomas Gleixner +Closes: https://lore.kernel.org/all/20230915082126.4187913-1-ruanjinjie@huawei.com/ +Fixes: d1909c022173 ("module: Don't ignore errors from set_memory_XX()") +Signed-off-by: Christophe Leroy +Reviewed-by: Luis Chamberlain +Link: https://lore.kernel.org/r/d6c81f38da76092de8aacc8c93c4c65cb0fe48b8.1733427536.git.christophe.leroy@csgroup.eu +Signed-off-by: Petr Pavlu +Signed-off-by: Sasha Levin +--- + kernel/module/main.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/kernel/module/main.c b/kernel/module/main.c +index 49b9bca9de12f..93a07387af3b7 100644 +--- a/kernel/module/main.c ++++ b/kernel/module/main.c +@@ -2583,7 +2583,10 @@ static noinline int do_init_module(struct module *mod) + #endif + ret = module_enable_rodata_ro(mod, true); + if (ret) +- goto fail_mutex_unlock; ++ pr_warn("%s: module_enable_rodata_ro_after_init() returned %d, " ++ "ro_after_init data might still be writable\n", ++ mod->name, ret); ++ + mod_tree_remove_init(mod); + module_arch_freeing_init(mod); + for_class_mod_mem_type(type, init) { +@@ -2622,8 +2625,6 @@ static noinline int do_init_module(struct module *mod) + + return 0; + +-fail_mutex_unlock: +- mutex_unlock(&module_mutex); + fail_free_freeinit: + kfree(freeinit); + fail: +-- +2.39.5 + diff --git a/queue-6.12/module-extend-the-preempt-disabled-section-in-derefe.patch b/queue-6.12/module-extend-the-preempt-disabled-section-in-derefe.patch new file mode 100644 index 0000000000..1a87a34ce5 --- /dev/null +++ b/queue-6.12/module-extend-the-preempt-disabled-section-in-derefe.patch @@ -0,0 +1,59 @@ +From c3f2d1acb39e357dd8e8012c5a0435fec5d3514b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 10:04:30 +0100 +Subject: module: Extend the preempt disabled section in + dereference_symbol_descriptor(). + +From: Sebastian Andrzej Siewior + +[ Upstream commit a145c848d69f9c6f32008d8319edaa133360dd74 ] + +dereference_symbol_descriptor() needs to obtain the module pointer +belonging to pointer in order to resolve that pointer. +The returned mod pointer is obtained under RCU-sched/ preempt_disable() +guarantees and needs to be used within this section to ensure that the +module is not removed in the meantime. + +Extend the preempt_disable() section to also cover +dereference_module_function_descriptor(). + +Fixes: 04b8eb7a4ccd9 ("symbol lookup: introduce dereference_symbol_descriptor()") +Cc: James E.J. Bottomley +Cc: Christophe Leroy +Cc: Helge Deller +Cc: Madhavan Srinivasan +Cc: Michael Ellerman +Cc: Naveen N Rao +Cc: Nicholas Piggin +Cc: Sergey Senozhatsky +Cc: linux-parisc@vger.kernel.org +Cc: linuxppc-dev@lists.ozlabs.org +Reviewed-by: Sergey Senozhatsky +Acked-by: Peter Zijlstra (Intel) +Signed-off-by: Sebastian Andrzej Siewior +Link: https://lore.kernel.org/r/20250108090457.512198-2-bigeasy@linutronix.de +Signed-off-by: Petr Pavlu +Signed-off-by: Sasha Levin +--- + include/linux/kallsyms.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/kallsyms.h b/include/linux/kallsyms.h +index c3f075e8f60cb..1c6a6c1704d8d 100644 +--- a/include/linux/kallsyms.h ++++ b/include/linux/kallsyms.h +@@ -57,10 +57,10 @@ static inline void *dereference_symbol_descriptor(void *ptr) + + preempt_disable(); + mod = __module_address((unsigned long)ptr); +- preempt_enable(); + + if (mod) + ptr = dereference_module_function_descriptor(mod, ptr); ++ preempt_enable(); + #endif + return ptr; + } +-- +2.39.5 + diff --git a/queue-6.12/mtd-hyperbus-hbmc-am654-fix-an-of-node-reference-lea.patch b/queue-6.12/mtd-hyperbus-hbmc-am654-fix-an-of-node-reference-lea.patch new file mode 100644 index 0000000000..4bb7ed2787 --- /dev/null +++ b/queue-6.12/mtd-hyperbus-hbmc-am654-fix-an-of-node-reference-lea.patch @@ -0,0 +1,82 @@ +From 60d780e37504f362f2fa28d1e48881276a288cf3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 22:38:09 +0900 +Subject: mtd: hyperbus: hbmc-am654: fix an OF node reference leak + +From: Joe Hattori + +[ Upstream commit bf5821909eb9c7f5d07d5c6e852ead2c373c94a0 ] + +In am654_hbmc_platform_driver, .remove() and the error path of .probe() +do not decrement the refcount of an OF node obtained by + of_get_next_child(). Fix this by adding of_node_put() calls. + +Fixes: aca31ce96814 ("mtd: hyperbus: hbmc-am654: Fix direct mapping setup flash access") +Signed-off-by: Joe Hattori +Signed-off-by: Miquel Raynal +Signed-off-by: Sasha Levin +--- + drivers/mtd/hyperbus/hbmc-am654.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +diff --git a/drivers/mtd/hyperbus/hbmc-am654.c b/drivers/mtd/hyperbus/hbmc-am654.c +index dbe3eb361cca2..4b6cbee23fe89 100644 +--- a/drivers/mtd/hyperbus/hbmc-am654.c ++++ b/drivers/mtd/hyperbus/hbmc-am654.c +@@ -174,26 +174,30 @@ static int am654_hbmc_probe(struct platform_device *pdev) + priv->hbdev.np = of_get_next_child(np, NULL); + ret = of_address_to_resource(priv->hbdev.np, 0, &res); + if (ret) +- return ret; ++ goto put_node; + + if (of_property_read_bool(dev->of_node, "mux-controls")) { + struct mux_control *control = devm_mux_control_get(dev, NULL); + +- if (IS_ERR(control)) +- return PTR_ERR(control); ++ if (IS_ERR(control)) { ++ ret = PTR_ERR(control); ++ goto put_node; ++ } + + ret = mux_control_select(control, 1); + if (ret) { + dev_err(dev, "Failed to select HBMC mux\n"); +- return ret; ++ goto put_node; + } + priv->mux_ctrl = control; + } + + priv->hbdev.map.size = resource_size(&res); + priv->hbdev.map.virt = devm_ioremap_resource(dev, &res); +- if (IS_ERR(priv->hbdev.map.virt)) +- return PTR_ERR(priv->hbdev.map.virt); ++ if (IS_ERR(priv->hbdev.map.virt)) { ++ ret = PTR_ERR(priv->hbdev.map.virt); ++ goto disable_mux; ++ } + + priv->ctlr.dev = dev; + priv->ctlr.ops = &am654_hbmc_ops; +@@ -226,6 +230,8 @@ static int am654_hbmc_probe(struct platform_device *pdev) + disable_mux: + if (priv->mux_ctrl) + mux_control_deselect(priv->mux_ctrl); ++put_node: ++ of_node_put(priv->hbdev.np); + return ret; + } + +@@ -241,6 +247,7 @@ static void am654_hbmc_remove(struct platform_device *pdev) + + if (dev_priv->rx_chan) + dma_release_channel(dev_priv->rx_chan); ++ of_node_put(priv->hbdev.np); + } + + static const struct of_device_id am654_hbmc_dt_ids[] = { +-- +2.39.5 + diff --git a/queue-6.12/mtd-rawnand-brcmnand-fix-status-read-of-brcmnand_wai.patch b/queue-6.12/mtd-rawnand-brcmnand-fix-status-read-of-brcmnand_wai.patch new file mode 100644 index 0000000000..9b2af24827 --- /dev/null +++ b/queue-6.12/mtd-rawnand-brcmnand-fix-status-read-of-brcmnand_wai.patch @@ -0,0 +1,40 @@ +From 3264e382a73485ce6faa1ec748c3abd3302b94b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Nov 2024 18:39:16 -0800 +Subject: mtd: rawnand: brcmnand: fix status read of brcmnand_waitfunc + +From: david regan + +[ Upstream commit 03271ea36ea7a58d30a4bde182eb2a0d46220467 ] + +This change fixes an issue where an error return value may be mistakenly +used as NAND status. + +Fixes: f504551b7f15 ("mtd: rawnand: Propagate error and simplify ternary operators for brcmstb_nand_wait_for_completion()") +Signed-off-by: david regan +Reviewed-by: William Zhang +Signed-off-by: Miquel Raynal +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/brcmnand/brcmnand.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c +index 1b2ec0fec60c7..e76df6a00ed4f 100644 +--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c ++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c +@@ -2342,6 +2342,11 @@ static int brcmnand_write(struct mtd_info *mtd, struct nand_chip *chip, + brcmnand_send_cmd(host, CMD_PROGRAM_PAGE); + status = brcmnand_waitfunc(chip); + ++ if (status < 0) { ++ ret = status; ++ goto out; ++ } ++ + if (status & NAND_STATUS_FAIL) { + dev_info(ctrl->dev, "program failed at %llx\n", + (unsigned long long)addr); +-- +2.39.5 + diff --git a/queue-6.12/nbd-don-t-allow-reconnect-after-disconnect.patch b/queue-6.12/nbd-don-t-allow-reconnect-after-disconnect.patch new file mode 100644 index 0000000000..8c0ca792c1 --- /dev/null +++ b/queue-6.12/nbd-don-t-allow-reconnect-after-disconnect.patch @@ -0,0 +1,75 @@ +From 6b59200da30ca42cc419fb8dabd3d04e90048771 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jan 2025 17:28:59 +0800 +Subject: nbd: don't allow reconnect after disconnect + +From: Yu Kuai + +[ Upstream commit 844b8cdc681612ff24df62cdefddeab5772fadf1 ] + +Following process can cause nbd_config UAF: + +1) grab nbd_config temporarily; + +2) nbd_genl_disconnect() flush all recv_work() and release the +initial reference: + + nbd_genl_disconnect + nbd_disconnect_and_put + nbd_disconnect + flush_workqueue(nbd->recv_workq) + if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, ...)) + nbd_config_put + -> due to step 1), reference is still not zero + +3) nbd_genl_reconfigure() queue recv_work() again; + + nbd_genl_reconfigure + config = nbd_get_config_unlocked(nbd) + if (!config) + -> succeed + if (!test_bit(NBD_RT_BOUND, ...)) + -> succeed + nbd_reconnect_socket + queue_work(nbd->recv_workq, &args->work) + +4) step 1) release the reference; + +5) Finially, recv_work() will trigger UAF: + + recv_work + nbd_config_put(nbd) + -> nbd_config is freed + atomic_dec(&config->recv_threads) + -> UAF + +Fix the problem by clearing NBD_RT_BOUND in nbd_genl_disconnect(), so +that nbd_genl_reconfigure() will fail. + +Fixes: b7aa3d39385d ("nbd: add a reconfigure netlink command") +Reported-by: syzbot+6b0df248918b92c33e6a@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/675bfb65.050a0220.1a2d0d.0006.GAE@google.com/ +Signed-off-by: Yu Kuai +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20250103092859.3574648-1-yukuai1@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/nbd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index b852050d8a966..450458267e6e6 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -2180,6 +2180,7 @@ static void nbd_disconnect_and_put(struct nbd_device *nbd) + flush_workqueue(nbd->recv_workq); + nbd_clear_que(nbd); + nbd->task_setup = NULL; ++ clear_bit(NBD_RT_BOUND, &nbd->config->runtime_flags); + mutex_unlock(&nbd->config_lock); + + if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, +-- +2.39.5 + diff --git a/queue-6.12/net-airoha-fix-error-path-in-airoha_probe.patch b/queue-6.12/net-airoha-fix-error-path-in-airoha_probe.patch new file mode 100644 index 0000000000..b54396db50 --- /dev/null +++ b/queue-6.12/net-airoha-fix-error-path-in-airoha_probe.patch @@ -0,0 +1,112 @@ +From 8c0de9fb0f5a6479cf24e31746ad6fc7aad01413 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Dec 2024 18:47:33 +0100 +Subject: net: airoha: Fix error path in airoha_probe() + +From: Lorenzo Bianconi + +[ Upstream commit 0c7469ee718e1dd929f52bfb142a7f6fb68f0765 ] + +Do not run napi_disable() if airoha_hw_init() fails since Tx/Rx napi +has not been started yet. In order to fix the issue, introduce +airoha_qdma_stop_napi routine and remove napi_disable in +airoha_hw_cleanup(). + +Fixes: 23020f049327 ("net: airoha: Introduce ethernet support for EN7581 SoC") +Reviewed-by: Michal Swiatkowski +Signed-off-by: Lorenzo Bianconi +Link: https://patch.msgid.link/20241216-airoha_probe-error-path-fix-v2-1-6b10e04e9a5c@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/airoha_eth.c | 33 ++++++++++++++++------ + 1 file changed, 25 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/mediatek/airoha_eth.c b/drivers/net/ethernet/mediatek/airoha_eth.c +index 2c26eb1852837..8d9fb2a20469a 100644 +--- a/drivers/net/ethernet/mediatek/airoha_eth.c ++++ b/drivers/net/ethernet/mediatek/airoha_eth.c +@@ -2123,17 +2123,14 @@ static void airoha_hw_cleanup(struct airoha_qdma *qdma) + if (!qdma->q_rx[i].ndesc) + continue; + +- napi_disable(&qdma->q_rx[i].napi); + netif_napi_del(&qdma->q_rx[i].napi); + airoha_qdma_cleanup_rx_queue(&qdma->q_rx[i]); + if (qdma->q_rx[i].page_pool) + page_pool_destroy(qdma->q_rx[i].page_pool); + } + +- for (i = 0; i < ARRAY_SIZE(qdma->q_tx_irq); i++) { +- napi_disable(&qdma->q_tx_irq[i].napi); ++ for (i = 0; i < ARRAY_SIZE(qdma->q_tx_irq); i++) + netif_napi_del(&qdma->q_tx_irq[i].napi); +- } + + for (i = 0; i < ARRAY_SIZE(qdma->q_tx); i++) { + if (!qdma->q_tx[i].ndesc) +@@ -2158,6 +2155,21 @@ static void airoha_qdma_start_napi(struct airoha_qdma *qdma) + } + } + ++static void airoha_qdma_stop_napi(struct airoha_qdma *qdma) ++{ ++ int i; ++ ++ for (i = 0; i < ARRAY_SIZE(qdma->q_tx_irq); i++) ++ napi_disable(&qdma->q_tx_irq[i].napi); ++ ++ for (i = 0; i < ARRAY_SIZE(qdma->q_rx); i++) { ++ if (!qdma->q_rx[i].ndesc) ++ continue; ++ ++ napi_disable(&qdma->q_rx[i].napi); ++ } ++} ++ + static void airoha_update_hw_stats(struct airoha_gdm_port *port) + { + struct airoha_eth *eth = port->qdma->eth; +@@ -2713,7 +2725,7 @@ static int airoha_probe(struct platform_device *pdev) + + err = airoha_hw_init(pdev, eth); + if (err) +- goto error; ++ goto error_hw_cleanup; + + for (i = 0; i < ARRAY_SIZE(eth->qdma); i++) + airoha_qdma_start_napi(ð->qdma[i]); +@@ -2728,13 +2740,16 @@ static int airoha_probe(struct platform_device *pdev) + err = airoha_alloc_gdm_port(eth, np); + if (err) { + of_node_put(np); +- goto error; ++ goto error_napi_stop; + } + } + + return 0; + +-error: ++error_napi_stop: ++ for (i = 0; i < ARRAY_SIZE(eth->qdma); i++) ++ airoha_qdma_stop_napi(ð->qdma[i]); ++error_hw_cleanup: + for (i = 0; i < ARRAY_SIZE(eth->qdma); i++) + airoha_hw_cleanup(ð->qdma[i]); + +@@ -2755,8 +2770,10 @@ static void airoha_remove(struct platform_device *pdev) + struct airoha_eth *eth = platform_get_drvdata(pdev); + int i; + +- for (i = 0; i < ARRAY_SIZE(eth->qdma); i++) ++ for (i = 0; i < ARRAY_SIZE(eth->qdma); i++) { ++ airoha_qdma_stop_napi(ð->qdma[i]); + airoha_hw_cleanup(ð->qdma[i]); ++ } + + for (i = 0; i < ARRAY_SIZE(eth->ports); i++) { + struct airoha_gdm_port *port = eth->ports[i]; +-- +2.39.5 + diff --git a/queue-6.12/net-airoha-fix-wrong-gdm4-register-definition.patch b/queue-6.12/net-airoha-fix-wrong-gdm4-register-definition.patch new file mode 100644 index 0000000000..b3d0e2eb37 --- /dev/null +++ b/queue-6.12/net-airoha-fix-wrong-gdm4-register-definition.patch @@ -0,0 +1,51 @@ +From 1b2829b12e5f856f52d27eb0168c3c7cdb910573 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jan 2025 16:41:40 +0100 +Subject: net: airoha: Fix wrong GDM4 register definition + +From: Christian Marangi + +[ Upstream commit d31a49d37cb132b31cc6683eef2122f8609d6229 ] + +Fix wrong GDM4 register definition, in Airoha SDK GDM4 is defined at +offset 0x2400 but this doesn't make sense as it does conflict with the +CDM4 that is in the same location. + +Following the pattern where each GDM base is at the FWD_CFG, currently +GDM4 base offset is set to 0x2500. This is correct but REG_GDM4_FWD_CFG +and REG_GDM4_SRC_PORT_SET are still using the SDK reference with the +0x2400 offset. Fix these 2 define by subtracting 0x100 to each register +to reflect the real address location. + +Fixes: 23020f049327 ("net: airoha: Introduce ethernet support for EN7581 SoC") +Signed-off-by: Christian Marangi +Acked-by: Lorenzo Bianconi +Reviewed-by: Jacob Keller +Link: https://patch.msgid.link/20250120154148.13424-1-ansuelsmth@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/airoha_eth.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mediatek/airoha_eth.c b/drivers/net/ethernet/mediatek/airoha_eth.c +index 8d9fb2a20469a..20cf7ba9d7508 100644 +--- a/drivers/net/ethernet/mediatek/airoha_eth.c ++++ b/drivers/net/ethernet/mediatek/airoha_eth.c +@@ -258,11 +258,11 @@ + #define REG_GDM3_FWD_CFG GDM3_BASE + #define GDM3_PAD_EN_MASK BIT(28) + +-#define REG_GDM4_FWD_CFG (GDM4_BASE + 0x100) ++#define REG_GDM4_FWD_CFG GDM4_BASE + #define GDM4_PAD_EN_MASK BIT(28) + #define GDM4_SPORT_OFFSET0_MASK GENMASK(11, 8) + +-#define REG_GDM4_SRC_PORT_SET (GDM4_BASE + 0x33c) ++#define REG_GDM4_SRC_PORT_SET (GDM4_BASE + 0x23c) + #define GDM4_SPORT_OFF2_MASK GENMASK(19, 16) + #define GDM4_SPORT_OFF1_MASK GENMASK(15, 12) + #define GDM4_SPORT_OFF0_MASK GENMASK(11, 8) +-- +2.39.5 + diff --git a/queue-6.12/net-avoid-race-between-device-unregistration-and-eth.patch b/queue-6.12/net-avoid-race-between-device-unregistration-and-eth.patch new file mode 100644 index 0000000000..8e298e37c6 --- /dev/null +++ b/queue-6.12/net-avoid-race-between-device-unregistration-and-eth.patch @@ -0,0 +1,73 @@ +From cbf29187199ceffa7625deb1cc063211e368d71f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jan 2025 10:21:57 +0100 +Subject: net: avoid race between device unregistration and ethnl ops + +From: Antoine Tenart + +[ Upstream commit 12e070eb6964b341b41677fd260af5a305316a1f ] + +The following trace can be seen if a device is being unregistered while +its number of channels are being modified. + + DEBUG_LOCKS_WARN_ON(lock->magic != lock) + WARNING: CPU: 3 PID: 3754 at kernel/locking/mutex.c:564 __mutex_lock+0xc8a/0x1120 + CPU: 3 UID: 0 PID: 3754 Comm: ethtool Not tainted 6.13.0-rc6+ #771 + RIP: 0010:__mutex_lock+0xc8a/0x1120 + Call Trace: + + ethtool_check_max_channel+0x1ea/0x880 + ethnl_set_channels+0x3c3/0xb10 + ethnl_default_set_doit+0x306/0x650 + genl_family_rcv_msg_doit+0x1e3/0x2c0 + genl_rcv_msg+0x432/0x6f0 + netlink_rcv_skb+0x13d/0x3b0 + genl_rcv+0x28/0x40 + netlink_unicast+0x42e/0x720 + netlink_sendmsg+0x765/0xc20 + __sys_sendto+0x3ac/0x420 + __x64_sys_sendto+0xe0/0x1c0 + do_syscall_64+0x95/0x180 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +This is because unregister_netdevice_many_notify might run before the +rtnl lock section of ethnl operations, eg. set_channels in the above +example. In this example the rss lock would be destroyed by the device +unregistration path before being used again, but in general running +ethnl operations while dismantle has started is not a good idea. + +Fix this by denying any operation on devices being unregistered. A check +was already there in ethnl_ops_begin, but not wide enough. + +Note that the same issue cannot be seen on the ioctl version +(__dev_ethtool) because the device reference is retrieved from within +the rtnl lock section there. Once dismantle started, the net device is +unlisted and no reference will be found. + +Fixes: dde91ccfa25f ("ethtool: do not perform operations on net devices being unregistered") +Signed-off-by: Antoine Tenart +Reviewed-by: Przemek Kitszel +Reviewed-by: Edward Cree +Link: https://patch.msgid.link/20250116092159.50890-1-atenart@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ethtool/netlink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ethtool/netlink.c b/net/ethtool/netlink.c +index e3f0ef6b851bb..4d18dc29b3043 100644 +--- a/net/ethtool/netlink.c ++++ b/net/ethtool/netlink.c +@@ -90,7 +90,7 @@ int ethnl_ops_begin(struct net_device *dev) + pm_runtime_get_sync(dev->dev.parent); + + if (!netif_device_present(dev) || +- dev->reg_state == NETREG_UNREGISTERING) { ++ dev->reg_state >= NETREG_UNREGISTERING) { + ret = -ENODEV; + goto err; + } +-- +2.39.5 + diff --git a/queue-6.12/net-davicom-fix-uaf-in-dm9000_drv_remove.patch b/queue-6.12/net-davicom-fix-uaf-in-dm9000_drv_remove.patch new file mode 100644 index 0000000000..c7d1cb045a --- /dev/null +++ b/queue-6.12/net-davicom-fix-uaf-in-dm9000_drv_remove.patch @@ -0,0 +1,52 @@ +From ee061c32aac24c241f1f481d5bbc31df383b1203 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jan 2025 15:42:13 -0600 +Subject: net: davicom: fix UAF in dm9000_drv_remove +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chenyuan Yang + +[ Upstream commit 19e65c45a1507a1a2926649d2db3583ed9d55fd9 ] + +dm is netdev private data and it cannot be +used after free_netdev() call. Using dm after free_netdev() +can cause UAF bug. Fix it by moving free_netdev() at the end of the +function. + +This is similar to the issue fixed in commit +ad297cd2db89 ("net: qcom/emac: fix UAF in emac_remove"). + +This bug is detected by our static analysis tool. + +Fixes: cf9e60aa69ae ("net: davicom: Fix regulator not turned off on driver removal") +Signed-off-by: Chenyuan Yang +CC: Uwe Kleine-König +Link: https://patch.msgid.link/20250123214213.623518-1-chenyuan0y@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/davicom/dm9000.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c +index 150cc94ae9f88..25a604379b2f4 100644 +--- a/drivers/net/ethernet/davicom/dm9000.c ++++ b/drivers/net/ethernet/davicom/dm9000.c +@@ -1777,10 +1777,11 @@ static void dm9000_drv_remove(struct platform_device *pdev) + + unregister_netdev(ndev); + dm9000_release_board(pdev, dm); +- free_netdev(ndev); /* free device structure */ + if (dm->power_supply) + regulator_disable(dm->power_supply); + ++ free_netdev(ndev); /* free device structure */ ++ + dev_dbg(&pdev->dev, "released and freed device\n"); + } + +-- +2.39.5 + diff --git a/queue-6.12/net-ethernet-ti-am65-cpsw-fix-freeing-irq-in-am65_cp.patch b/queue-6.12/net-ethernet-ti-am65-cpsw-fix-freeing-irq-in-am65_cp.patch new file mode 100644 index 0000000000..a9fab1802e --- /dev/null +++ b/queue-6.12/net-ethernet-ti-am65-cpsw-fix-freeing-irq-in-am65_cp.patch @@ -0,0 +1,61 @@ +From f5f36bd2bbe9b2f5c4aefcccf4b5a587b2c92a6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jan 2025 15:54:49 +0200 +Subject: net: ethernet: ti: am65-cpsw: fix freeing IRQ in + am65_cpsw_nuss_remove_tx_chns() + +From: Roger Quadros + +[ Upstream commit 4395a44acb15850e492dd1de9ec4b6479d96bc80 ] + +When getting the IRQ we use k3_udma_glue_tx_get_irq() which returns +negative error value on error. So not NULL check is not sufficient +to deteremine if IRQ is valid. Check that IRQ is greater then zero +to ensure it is valid. + +There is no issue at probe time but at runtime user can invoke +.set_channels which results in the following call chain. +am65_cpsw_set_channels() + am65_cpsw_nuss_update_tx_rx_chns() + am65_cpsw_nuss_remove_tx_chns() + am65_cpsw_nuss_init_tx_chns() + +At this point if am65_cpsw_nuss_init_tx_chns() fails due to +k3_udma_glue_tx_get_irq() then tx_chn->irq will be set to a +negative value. + +Then, at subsequent .set_channels with higher channel count we +will attempt to free an invalid IRQ in am65_cpsw_nuss_remove_tx_chns() +leading to a kernel warning. + +The issue is present in the original commit that introduced this driver, +although there, am65_cpsw_nuss_update_tx_rx_chns() existed as +am65_cpsw_nuss_update_tx_chns(). + +Fixes: 93a76530316a ("net: ethernet: ti: introduce am65x/j721e gigabit eth subsystem driver") +Signed-off-by: Roger Quadros +Reviewed-by: Simon Horman +Reviewed-by: Siddharth Vadapalli +Reviewed-by: Jacob Keller +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +index dfca13b82bdce..b13c7e958e6b4 100644 +--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c ++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +@@ -2207,7 +2207,7 @@ static void am65_cpsw_nuss_remove_tx_chns(struct am65_cpsw_common *common) + for (i = 0; i < common->tx_ch_num; i++) { + struct am65_cpsw_tx_chn *tx_chn = &common->tx_chns[i]; + +- if (tx_chn->irq) ++ if (tx_chn->irq > 0) + devm_free_irq(dev, tx_chn->irq, tx_chn); + + netif_napi_del(&tx_chn->napi_tx); +-- +2.39.5 + diff --git a/queue-6.12/net-ethtool-only-allow-set_rxnfc-with-rss-ring_cooki.patch b/queue-6.12/net-ethtool-only-allow-set_rxnfc-with-rss-ring_cooki.patch new file mode 100644 index 0000000000..f73e06782a --- /dev/null +++ b/queue-6.12/net-ethtool-only-allow-set_rxnfc-with-rss-ring_cooki.patch @@ -0,0 +1,100 @@ +From 6c8521ce496b54d061a5d11ad0dc07a10c808418 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Nov 2024 12:13:09 +0000 +Subject: net: ethtool: only allow set_rxnfc with rss + ring_cookie if driver + opts in + +From: Edward Cree + +[ Upstream commit 9e43ad7a1edef268acac603e1975c8f50a20d02f ] + +Ethtool ntuple filters with FLOW_RSS were originally defined as adding + the base queue ID (ring_cookie) to the value from the indirection table, + so that the same table could distribute over more than one set of queues + when used by different filters. +However, some drivers / hardware ignore the ring_cookie, and simply use + the indirection table entries as queue IDs directly. Thus, for drivers + which have not opted in by setting ethtool_ops.cap_rss_rxnfc_adds to + declare that they support the original (addition) semantics, reject in + ethtool_set_rxnfc any filter which combines FLOW_RSS and a nonzero ring. +(For a ring_cookie of zero, both behaviours are equivalent.) +Set the cap bit in sfc, as it is known to support this feature. + +Signed-off-by: Edward Cree +Reviewed-by: Martin Habets +Link: https://patch.msgid.link/cc3da0844083b0e301a33092a6299e4042b65221.1731499022.git.ecree.xilinx@gmail.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: 4f5a52adeb1a ("ethtool: Fix set RXNFC command with symmetric RSS hash") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/ef100_ethtool.c | 1 + + drivers/net/ethernet/sfc/ethtool.c | 1 + + include/linux/ethtool.h | 4 ++++ + net/ethtool/ioctl.c | 5 +++++ + 4 files changed, 11 insertions(+) + +diff --git a/drivers/net/ethernet/sfc/ef100_ethtool.c b/drivers/net/ethernet/sfc/ef100_ethtool.c +index 5c2551369812c..6c3b74000d3b6 100644 +--- a/drivers/net/ethernet/sfc/ef100_ethtool.c ++++ b/drivers/net/ethernet/sfc/ef100_ethtool.c +@@ -59,6 +59,7 @@ const struct ethtool_ops ef100_ethtool_ops = { + .get_rxfh_indir_size = efx_ethtool_get_rxfh_indir_size, + .get_rxfh_key_size = efx_ethtool_get_rxfh_key_size, + .rxfh_per_ctx_key = true, ++ .cap_rss_rxnfc_adds = true, + .rxfh_priv_size = sizeof(struct efx_rss_context_priv), + .get_rxfh = efx_ethtool_get_rxfh, + .set_rxfh = efx_ethtool_set_rxfh, +diff --git a/drivers/net/ethernet/sfc/ethtool.c b/drivers/net/ethernet/sfc/ethtool.c +index bb1930818beba..83d715544f7fb 100644 +--- a/drivers/net/ethernet/sfc/ethtool.c ++++ b/drivers/net/ethernet/sfc/ethtool.c +@@ -263,6 +263,7 @@ const struct ethtool_ops efx_ethtool_ops = { + .get_rxfh_indir_size = efx_ethtool_get_rxfh_indir_size, + .get_rxfh_key_size = efx_ethtool_get_rxfh_key_size, + .rxfh_per_ctx_key = true, ++ .cap_rss_rxnfc_adds = true, + .rxfh_priv_size = sizeof(struct efx_rss_context_priv), + .get_rxfh = efx_ethtool_get_rxfh, + .set_rxfh = efx_ethtool_set_rxfh, +diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h +index 12f6dc5675987..b8b935b526033 100644 +--- a/include/linux/ethtool.h ++++ b/include/linux/ethtool.h +@@ -734,6 +734,9 @@ struct kernel_ethtool_ts_info { + * @rxfh_per_ctx_key: device supports setting different RSS key for each + * additional context. Netlink API should report hfunc, key, and input_xfrm + * for every context, not just context 0. ++ * @cap_rss_rxnfc_adds: device supports nonzero ring_cookie in filters with ++ * %FLOW_RSS flag; the queue ID from the filter is added to the value from ++ * the indirection table to determine the delivery queue. + * @rxfh_indir_space: max size of RSS indirection tables, if indirection table + * size as returned by @get_rxfh_indir_size may change during lifetime + * of the device. Leave as 0 if the table size is constant. +@@ -956,6 +959,7 @@ struct ethtool_ops { + u32 cap_rss_ctx_supported:1; + u32 cap_rss_sym_xor_supported:1; + u32 rxfh_per_ctx_key:1; ++ u32 cap_rss_rxnfc_adds:1; + u32 rxfh_indir_space; + u16 rxfh_key_space; + u16 rxfh_priv_size; +diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c +index 65cfe76dafbe2..8b28347039b50 100644 +--- a/net/ethtool/ioctl.c ++++ b/net/ethtool/ioctl.c +@@ -992,6 +992,11 @@ static noinline_for_stack int ethtool_set_rxnfc(struct net_device *dev, + if (rc) + return rc; + ++ /* Nonzero ring with RSS only makes sense if NIC adds them together */ ++ if (info.flow_type & FLOW_RSS && !ops->cap_rss_rxnfc_adds && ++ ethtool_get_flow_spec_ring(info.fs.ring_cookie)) ++ return -EINVAL; ++ + if (ops->get_rxfh) { + struct ethtool_rxfh_param rxfh = {}; + +-- +2.39.5 + diff --git a/queue-6.12/net-fec-implement-tso-descriptor-cleanup.patch b/queue-6.12/net-fec-implement-tso-descriptor-cleanup.patch new file mode 100644 index 0000000000..e172ce7930 --- /dev/null +++ b/queue-6.12/net-fec-implement-tso-descriptor-cleanup.patch @@ -0,0 +1,78 @@ +From 64cf868ea000c671ba4b4532e12cd7c3f51dfd51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jan 2025 14:24:30 +0530 +Subject: net: fec: implement TSO descriptor cleanup + +From: Dheeraj Reddy Jonnalagadda + +[ Upstream commit 61dc1fd9205bc9d9918aa933a847b08e80b4dc20 ] + +Implement cleanup of descriptors in the TSO error path of +fec_enet_txq_submit_tso(). The cleanup + +- Unmaps DMA buffers for data descriptors skipping TSO header +- Clears all buffer descriptors +- Handles extended descriptors by clearing cbd_esc when enabled + +Fixes: 79f339125ea3 ("net: fec: Add software TSO support") +Signed-off-by: Dheeraj Reddy Jonnalagadda +Reviewed-by: Wei Fang +Link: https://patch.msgid.link/20250120085430.99318-1-dheeraj.linuxdev@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_main.c | 31 ++++++++++++++++++++++- + 1 file changed, 30 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 49d1748e0c043..2b05d9c6c21a4 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -840,6 +840,8 @@ static int fec_enet_txq_submit_tso(struct fec_enet_priv_tx_q *txq, + struct fec_enet_private *fep = netdev_priv(ndev); + int hdr_len, total_len, data_left; + struct bufdesc *bdp = txq->bd.cur; ++ struct bufdesc *tmp_bdp; ++ struct bufdesc_ex *ebdp; + struct tso_t tso; + unsigned int index = 0; + int ret; +@@ -913,7 +915,34 @@ static int fec_enet_txq_submit_tso(struct fec_enet_priv_tx_q *txq, + return 0; + + err_release: +- /* TODO: Release all used data descriptors for TSO */ ++ /* Release all used data descriptors for TSO */ ++ tmp_bdp = txq->bd.cur; ++ ++ while (tmp_bdp != bdp) { ++ /* Unmap data buffers */ ++ if (tmp_bdp->cbd_bufaddr && ++ !IS_TSO_HEADER(txq, fec32_to_cpu(tmp_bdp->cbd_bufaddr))) ++ dma_unmap_single(&fep->pdev->dev, ++ fec32_to_cpu(tmp_bdp->cbd_bufaddr), ++ fec16_to_cpu(tmp_bdp->cbd_datlen), ++ DMA_TO_DEVICE); ++ ++ /* Clear standard buffer descriptor fields */ ++ tmp_bdp->cbd_sc = 0; ++ tmp_bdp->cbd_datlen = 0; ++ tmp_bdp->cbd_bufaddr = 0; ++ ++ /* Handle extended descriptor if enabled */ ++ if (fep->bufdesc_ex) { ++ ebdp = (struct bufdesc_ex *)tmp_bdp; ++ ebdp->cbd_esc = 0; ++ } ++ ++ tmp_bdp = fec_enet_get_nextdesc(tmp_bdp, &txq->bd); ++ } ++ ++ dev_kfree_skb_any(skb); ++ + return ret; + } + +-- +2.39.5 + diff --git a/queue-6.12/net-hns3-fix-oops-when-unload-drivers-paralleling.patch b/queue-6.12/net-hns3-fix-oops-when-unload-drivers-paralleling.patch new file mode 100644 index 0000000000..962ae9b26f --- /dev/null +++ b/queue-6.12/net-hns3-fix-oops-when-unload-drivers-paralleling.patch @@ -0,0 +1,121 @@ +From daa68ce942e8923f1ee298063a9b293e1e507756 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Jan 2025 17:47:41 +0800 +Subject: net: hns3: fix oops when unload drivers paralleling + +From: Jian Shen + +[ Upstream commit 92e5995773774a3e70257e9c95ea03518268bea5 ] + +When unload hclge driver, it tries to disable sriov first for each +ae_dev node from hnae3_ae_dev_list. If user unloads hns3 driver at +the time, because it removes all the ae_dev nodes, and it may cause +oops. + +But we can't simply use hnae3_common_lock for this. Because in the +process flow of pci_disable_sriov(), it will trigger the remove flow +of VF, which will also take hnae3_common_lock. + +To fixes it, introduce a new mutex to protect the unload process. + +Fixes: 0dd8a25f355b ("net: hns3: disable sriov before unload hclge layer") +Signed-off-by: Jian Shen +Signed-off-by: Jijie Shao +Link: https://patch.msgid.link/20250118094741.3046663-1-shaojijie@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hnae3.c | 15 +++++++++++++++ + drivers/net/ethernet/hisilicon/hns3/hnae3.h | 2 ++ + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 ++ + .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 ++ + .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 2 ++ + 5 files changed, 23 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.c b/drivers/net/ethernet/hisilicon/hns3/hnae3.c +index 9a63fbc694083..b25fb400f4767 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c +@@ -40,6 +40,21 @@ EXPORT_SYMBOL(hnae3_unregister_ae_algo_prepare); + */ + static DEFINE_MUTEX(hnae3_common_lock); + ++/* ensure the drivers being unloaded one by one */ ++static DEFINE_MUTEX(hnae3_unload_lock); ++ ++void hnae3_acquire_unload_lock(void) ++{ ++ mutex_lock(&hnae3_unload_lock); ++} ++EXPORT_SYMBOL(hnae3_acquire_unload_lock); ++ ++void hnae3_release_unload_lock(void) ++{ ++ mutex_unlock(&hnae3_unload_lock); ++} ++EXPORT_SYMBOL(hnae3_release_unload_lock); ++ + static bool hnae3_client_match(enum hnae3_client_type client_type) + { + if (client_type == HNAE3_CLIENT_KNIC || +diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h +index d873523e84f27..388c70331a55b 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h +@@ -963,4 +963,6 @@ int hnae3_register_client(struct hnae3_client *client); + void hnae3_set_client_init_flag(struct hnae3_client *client, + struct hnae3_ae_dev *ae_dev, + unsigned int inited); ++void hnae3_acquire_unload_lock(void); ++void hnae3_release_unload_lock(void); + #endif +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index 73825b6bd485d..dc60ac3bde7f2 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -6002,9 +6002,11 @@ module_init(hns3_init_module); + */ + static void __exit hns3_exit_module(void) + { ++ hnae3_acquire_unload_lock(); + pci_unregister_driver(&hns3_driver); + hnae3_unregister_client(&client); + hns3_dbg_unregister_debugfs(); ++ hnae3_release_unload_lock(); + } + module_exit(hns3_exit_module); + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 9a67fe0554a52..06eedf80cfac4 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -12929,9 +12929,11 @@ static int __init hclge_init(void) + + static void __exit hclge_exit(void) + { ++ hnae3_acquire_unload_lock(); + hnae3_unregister_ae_algo_prepare(&ae_algo); + hnae3_unregister_ae_algo(&ae_algo); + destroy_workqueue(hclge_wq); ++ hnae3_release_unload_lock(); + } + module_init(hclge_init); + module_exit(hclge_exit); +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +index d47bd8d6145f9..fd5992164846b 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +@@ -3412,8 +3412,10 @@ static int __init hclgevf_init(void) + + static void __exit hclgevf_exit(void) + { ++ hnae3_acquire_unload_lock(); + hnae3_unregister_ae_algo(&ae_algovf); + destroy_workqueue(hclgevf_wq); ++ hnae3_release_unload_lock(); + } + module_init(hclgevf_init); + module_exit(hclgevf_exit); +-- +2.39.5 + diff --git a/queue-6.12/net-hsr-fix-fill_frame_info-regression-vs-vlan-packe.patch b/queue-6.12/net-hsr-fix-fill_frame_info-regression-vs-vlan-packe.patch new file mode 100644 index 0000000000..4a569a1c40 --- /dev/null +++ b/queue-6.12/net-hsr-fix-fill_frame_info-regression-vs-vlan-packe.patch @@ -0,0 +1,79 @@ +From 7a8fd2562f9d5643395d66bc59f0b7f5917f5f2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jan 2025 13:00:07 +0000 +Subject: net: hsr: fix fill_frame_info() regression vs VLAN packets + +From: Eric Dumazet + +[ Upstream commit 0f5697f1a3f99bc2b674b8aa3c5da822c5673c11 ] + +Stephan Wurm reported that my recent patch broke VLAN support. + +Apparently skb->mac_len is not correct for VLAN traffic as +shown by debug traces [1]. + +Use instead pskb_may_pull() to make sure the expected header +is present in skb->head. + +Many thanks to Stephan for his help. + +[1] +kernel: skb len=170 headroom=2 headlen=170 tailroom=20 + mac=(2,14) mac_len=14 net=(16,-1) trans=-1 + shinfo(txflags=0 nr_frags=0 gso(size=0 type=0 segs=0)) + csum(0x0 start=0 offset=0 ip_summed=0 complete_sw=0 valid=0 level=0) + hash(0x0 sw=0 l4=0) proto=0x0000 pkttype=0 iif=0 + priority=0x0 mark=0x0 alloc_cpu=0 vlan_all=0x0 + encapsulation=0 inner(proto=0x0000, mac=0, net=0, trans=0) +kernel: dev name=prp0 feat=0x0000000000007000 +kernel: sk family=17 type=3 proto=0 +kernel: skb headroom: 00000000: 74 00 +kernel: skb linear: 00000000: 01 0c cd 01 00 01 00 d0 93 53 9c cb 81 00 80 00 +kernel: skb linear: 00000010: 88 b8 00 01 00 98 00 00 00 00 61 81 8d 80 16 52 +kernel: skb linear: 00000020: 45 47 44 4e 43 54 52 4c 2f 4c 4c 4e 30 24 47 4f +kernel: skb linear: 00000030: 24 47 6f 43 62 81 01 14 82 16 52 45 47 44 4e 43 +kernel: skb linear: 00000040: 54 52 4c 2f 4c 4c 4e 30 24 44 73 47 6f 6f 73 65 +kernel: skb linear: 00000050: 83 07 47 6f 49 64 65 6e 74 84 08 67 8d f5 93 7e +kernel: skb linear: 00000060: 76 c8 00 85 01 01 86 01 00 87 01 00 88 01 01 89 +kernel: skb linear: 00000070: 01 00 8a 01 02 ab 33 a2 15 83 01 00 84 03 03 00 +kernel: skb linear: 00000080: 00 91 08 67 8d f5 92 77 4b c6 1f 83 01 00 a2 1a +kernel: skb linear: 00000090: a2 06 85 01 00 83 01 00 84 03 03 00 00 91 08 67 +kernel: skb linear: 000000a0: 8d f5 92 77 4b c6 1f 83 01 00 +kernel: skb tailroom: 00000000: 80 18 02 00 fe 4e 00 00 01 01 08 0a 4f fd 5e d1 +kernel: skb tailroom: 00000010: 4f fd 5e cd + +Fixes: b9653d19e556 ("net: hsr: avoid potential out-of-bound access in fill_frame_info()") +Reported-by: Stephan Wurm +Tested-by: Stephan Wurm +Closes: https://lore.kernel.org/netdev/Z4o_UC0HweBHJ_cw@PC-LX-SteWu/ +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250129130007.644084-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/hsr/hsr_forward.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c +index 40c5fbbd155d6..c0217476eb17f 100644 +--- a/net/hsr/hsr_forward.c ++++ b/net/hsr/hsr_forward.c +@@ -688,9 +688,12 @@ static int fill_frame_info(struct hsr_frame_info *frame, + frame->is_vlan = true; + + if (frame->is_vlan) { +- if (skb->mac_len < offsetofend(struct hsr_vlan_ethhdr, vlanhdr)) ++ /* Note: skb->mac_len might be wrong here. */ ++ if (!pskb_may_pull(skb, ++ skb_mac_offset(skb) + ++ offsetofend(struct hsr_vlan_ethhdr, vlanhdr))) + return -EINVAL; +- vlan_hdr = (struct hsr_vlan_ethhdr *)ethhdr; ++ vlan_hdr = (struct hsr_vlan_ethhdr *)skb_mac_header(skb); + proto = vlan_hdr->vlanhdr.h_vlan_encapsulated_proto; + /* FIXME: */ + netdev_warn_once(skb->dev, "VLAN not yet supported"); +-- +2.39.5 + diff --git a/queue-6.12/net-let-net.core.dev_weight-always-be-non-zero.patch b/queue-6.12/net-let-net.core.dev_weight-always-be-non-zero.patch new file mode 100644 index 0000000000..0dafc114cc --- /dev/null +++ b/queue-6.12/net-let-net.core.dev_weight-always-be-non-zero.patch @@ -0,0 +1,103 @@ +From 35411dd2e53e9fde9b7bc28d3e5a2ce88f8661a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jan 2025 22:30:53 +0800 +Subject: net: let net.core.dev_weight always be non-zero + +From: Liu Jian + +[ Upstream commit d1f9f79fa2af8e3b45cffdeef66e05833480148a ] + +The following problem was encountered during stability test: + +(NULL net_device): NAPI poll function process_backlog+0x0/0x530 \ + returned 1, exceeding its budget of 0. +------------[ cut here ]------------ +list_add double add: new=ffff88905f746f48, prev=ffff88905f746f48, \ + next=ffff88905f746e40. +WARNING: CPU: 18 PID: 5462 at lib/list_debug.c:35 \ + __list_add_valid_or_report+0xf3/0x130 +CPU: 18 UID: 0 PID: 5462 Comm: ping Kdump: loaded Not tainted 6.13.0-rc7+ +RIP: 0010:__list_add_valid_or_report+0xf3/0x130 +Call Trace: +? __warn+0xcd/0x250 +? __list_add_valid_or_report+0xf3/0x130 +enqueue_to_backlog+0x923/0x1070 +netif_rx_internal+0x92/0x2b0 +__netif_rx+0x15/0x170 +loopback_xmit+0x2ef/0x450 +dev_hard_start_xmit+0x103/0x490 +__dev_queue_xmit+0xeac/0x1950 +ip_finish_output2+0x6cc/0x1620 +ip_output+0x161/0x270 +ip_push_pending_frames+0x155/0x1a0 +raw_sendmsg+0xe13/0x1550 +__sys_sendto+0x3bf/0x4e0 +__x64_sys_sendto+0xdc/0x1b0 +do_syscall_64+0x5b/0x170 +entry_SYSCALL_64_after_hwframe+0x76/0x7e + +The reproduction command is as follows: + sysctl -w net.core.dev_weight=0 + ping 127.0.0.1 + +This is because when the napi's weight is set to 0, process_backlog() may +return 0 and clear the NAPI_STATE_SCHED bit of napi->state, causing this +napi to be re-polled in net_rx_action() until __do_softirq() times out. +Since the NAPI_STATE_SCHED bit has been cleared, napi_schedule_rps() can +be retriggered in enqueue_to_backlog(), causing this issue. + +Making the napi's weight always non-zero solves this problem. + +Triggering this issue requires system-wide admin (setting is +not namespaced). + +Fixes: e38766054509 ("[NET]: Fix sysctl net.core.dev_weight") +Fixes: 3d48b53fb2ae ("net: dev_weight: TX/RX orthogonality") +Signed-off-by: Liu Jian +Link: https://patch.msgid.link/20250116143053.4146855-1-liujian56@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/sysctl_net_core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c +index 86a2476678c48..5dd54a8133980 100644 +--- a/net/core/sysctl_net_core.c ++++ b/net/core/sysctl_net_core.c +@@ -303,7 +303,7 @@ static int proc_do_dev_weight(const struct ctl_table *table, int write, + int ret, weight; + + mutex_lock(&dev_weight_mutex); +- ret = proc_dointvec(table, write, buffer, lenp, ppos); ++ ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); + if (!ret && write) { + weight = READ_ONCE(weight_p); + WRITE_ONCE(net_hotdata.dev_rx_weight, weight * dev_weight_rx_bias); +@@ -396,6 +396,7 @@ static struct ctl_table net_core_table[] = { + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_do_dev_weight, ++ .extra1 = SYSCTL_ONE, + }, + { + .procname = "dev_weight_rx_bias", +@@ -403,6 +404,7 @@ static struct ctl_table net_core_table[] = { + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_do_dev_weight, ++ .extra1 = SYSCTL_ONE, + }, + { + .procname = "dev_weight_tx_bias", +@@ -410,6 +412,7 @@ static struct ctl_table net_core_table[] = { + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_do_dev_weight, ++ .extra1 = SYSCTL_ONE, + }, + { + .procname = "netdev_max_backlog", +-- +2.39.5 + diff --git a/queue-6.12/net-mlx5-hws-fix-definer-s-hws_set32-macro-for-negat.patch b/queue-6.12/net-mlx5-hws-fix-definer-s-hws_set32-macro-for-negat.patch new file mode 100644 index 0000000000..682f64f3fe --- /dev/null +++ b/queue-6.12/net-mlx5-hws-fix-definer-s-hws_set32-macro-for-negat.patch @@ -0,0 +1,44 @@ +From 9d7dc89641900ac8176084dbc2406ce637de6cd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jan 2025 20:14:10 +0200 +Subject: net/mlx5: HWS, fix definer's HWS_SET32 macro for negative offset + +From: Yevgeny Kliteynik + +[ Upstream commit be482f1d10da781db9445d2753c1e3f1fd82babf ] + +When bit offset for HWS_SET32 macro is negative, +UBSAN complains about the shift-out-of-bounds: + + UBSAN: shift-out-of-bounds in + drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c:177:2 + shift exponent -8 is negative + +Fixes: 74a778b4a63f ("net/mlx5: HWS, added definers handling") +Signed-off-by: Yevgeny Kliteynik +Reviewed-by: Erez Shitrit +Reviewed-by: Mark Bloch +Signed-off-by: Tariq Toukan +Link: https://patch.msgid.link/20250102181415.1477316-12-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_definer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_definer.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_definer.c +index 3f4c58bada374..ab5f8f07f1f7e 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_definer.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_definer.c +@@ -70,7 +70,7 @@ + u32 second_dw_mask = (mask) & ((1 << _bit_off) - 1); \ + _HWS_SET32(p, (v) >> _bit_off, byte_off, 0, (mask) >> _bit_off); \ + _HWS_SET32(p, (v) & second_dw_mask, (byte_off) + DW_SIZE, \ +- (bit_off) % BITS_IN_DW, second_dw_mask); \ ++ (bit_off + BITS_IN_DW) % BITS_IN_DW, second_dw_mask); \ + } else { \ + _HWS_SET32(p, v, byte_off, (bit_off), (mask)); \ + } \ +-- +2.39.5 + diff --git a/queue-6.12/net-mlxfw-drop-hard-coded-max-fw-flash-image-size.patch b/queue-6.12/net-mlxfw-drop-hard-coded-max-fw-flash-image-size.patch new file mode 100644 index 0000000000..666ae7b2ed --- /dev/null +++ b/queue-6.12/net-mlxfw-drop-hard-coded-max-fw-flash-image-size.patch @@ -0,0 +1,53 @@ +From c53c7b26a6777914b4880388d65ee3878a54785b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jan 2025 14:33:16 +0200 +Subject: net/mlxfw: Drop hard coded max FW flash image size + +From: Maher Sanalla + +[ Upstream commit 70d81f25cc92cc4e914516c9935ae752f27d78ad ] + +Currently, mlxfw kernel module limits FW flash image size to be +10MB at most, preventing the ability to burn recent BlueField-3 +FW that exceeds the said size limit. + +Thus, drop the hard coded limit. Instead, rely on FW's +max_component_size threshold that is reported in MCQI register +as the size limit for FW image. + +Fixes: 410ed13cae39 ("Add the mlxfw module for Mellanox firmware flash process") +Signed-off-by: Maher Sanalla +Signed-off-by: Moshe Shemesh +Reviewed-by: Ido Schimmel +Tested-by: Ido Schimmel +Reviewed-by: Michal Swiatkowski +Link: https://patch.msgid.link/1737030796-1441634-1-git-send-email-moshe@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c +index 46245e0b24623..43c84900369a3 100644 +--- a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c ++++ b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c +@@ -14,7 +14,6 @@ + #define MLXFW_FSM_STATE_WAIT_TIMEOUT_MS 30000 + #define MLXFW_FSM_STATE_WAIT_ROUNDS \ + (MLXFW_FSM_STATE_WAIT_TIMEOUT_MS / MLXFW_FSM_STATE_WAIT_CYCLE_MS) +-#define MLXFW_FSM_MAX_COMPONENT_SIZE (10 * (1 << 20)) + + static const int mlxfw_fsm_state_errno[] = { + [MLXFW_FSM_STATE_ERR_ERROR] = -EIO, +@@ -229,7 +228,6 @@ static int mlxfw_flash_component(struct mlxfw_dev *mlxfw_dev, + return err; + } + +- comp_max_size = min_t(u32, comp_max_size, MLXFW_FSM_MAX_COMPONENT_SIZE); + if (comp->data_size > comp_max_size) { + MLXFW_ERR_MSG(mlxfw_dev, extack, + "Component size is bigger than limit", -EINVAL); +-- +2.39.5 + diff --git a/queue-6.12/net-ncsi-use-dev_set_mac_address-for-get-mc-mac-addr.patch b/queue-6.12/net-ncsi-use-dev_set_mac_address-for-get-mc-mac-addr.patch new file mode 100644 index 0000000000..be526655b8 --- /dev/null +++ b/queue-6.12/net-ncsi-use-dev_set_mac_address-for-get-mc-mac-addr.patch @@ -0,0 +1,87 @@ +From 23be314fb7b670e02cae7bf27b716974c59a2761 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jan 2025 16:35:36 +0300 +Subject: net/ncsi: use dev_set_mac_address() for Get MC MAC Address handling + +From: Paul Fertser + +[ Upstream commit 05d91cdb1f9108426b14975ef4eeddf15875ca05 ] + +Copy of the rationale from 790071347a0a1a89e618eedcd51c687ea783aeb3: + +Change ndo_set_mac_address to dev_set_mac_address because +dev_set_mac_address provides a way to notify network layer about MAC +change. In other case, services may not aware about MAC change and keep +using old one which set from network adapter driver. + +As example, DHCP client from systemd do not update MAC address without +notification from net subsystem which leads to the problem with acquiring +the right address from DHCP server. + +Since dev_set_mac_address requires RTNL lock the operation can not be +performed directly in the response handler, see +9e2bbab94b88295dcc57c7580393c9ee08d7314d. + +The way of selecting the first suitable MAC address from the list is +changed, instead of having the driver check it this patch just assumes +any valid MAC should be good. + +Fixes: b8291cf3d118 ("net/ncsi: Add NC-SI 1.2 Get MC MAC Address command") +Signed-off-by: Paul Fertser +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ncsi/ncsi-rsp.c | 18 ++++++++---------- + 1 file changed, 8 insertions(+), 10 deletions(-) + +diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c +index 14bd66909ca45..4a8ce2949faea 100644 +--- a/net/ncsi/ncsi-rsp.c ++++ b/net/ncsi/ncsi-rsp.c +@@ -1089,14 +1089,12 @@ static int ncsi_rsp_handler_netlink(struct ncsi_request *nr) + static int ncsi_rsp_handler_gmcma(struct ncsi_request *nr) + { + struct ncsi_dev_priv *ndp = nr->ndp; ++ struct sockaddr *saddr = &ndp->pending_mac; + struct net_device *ndev = ndp->ndev.dev; + struct ncsi_rsp_gmcma_pkt *rsp; +- struct sockaddr saddr; +- int ret = -1; + int i; + + rsp = (struct ncsi_rsp_gmcma_pkt *)skb_network_header(nr->rsp); +- saddr.sa_family = ndev->type; + ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE; + + netdev_info(ndev, "NCSI: Received %d provisioned MAC addresses\n", +@@ -1108,20 +1106,20 @@ static int ncsi_rsp_handler_gmcma(struct ncsi_request *nr) + rsp->addresses[i][4], rsp->addresses[i][5]); + } + ++ saddr->sa_family = ndev->type; + for (i = 0; i < rsp->address_count; i++) { +- memcpy(saddr.sa_data, &rsp->addresses[i], ETH_ALEN); +- ret = ndev->netdev_ops->ndo_set_mac_address(ndev, &saddr); +- if (ret < 0) { ++ if (!is_valid_ether_addr(rsp->addresses[i])) { + netdev_warn(ndev, "NCSI: Unable to assign %pM to device\n", +- saddr.sa_data); ++ rsp->addresses[i]); + continue; + } +- netdev_warn(ndev, "NCSI: Set MAC address to %pM\n", saddr.sa_data); ++ memcpy(saddr->sa_data, rsp->addresses[i], ETH_ALEN); ++ netdev_warn(ndev, "NCSI: Will set MAC address to %pM\n", saddr->sa_data); + break; + } + +- ndp->gma_flag = ret == 0; +- return ret; ++ ndp->gma_flag = 1; ++ return 0; + } + + static struct ncsi_rsp_handler { +-- +2.39.5 + diff --git a/queue-6.12/net-netdevsim-try-to-close-udp-port-harness-races.patch b/queue-6.12/net-netdevsim-try-to-close-udp-port-harness-races.patch new file mode 100644 index 0000000000..cecec1e0e2 --- /dev/null +++ b/queue-6.12/net-netdevsim-try-to-close-udp-port-harness-races.patch @@ -0,0 +1,175 @@ +From df3f5bb4aff26734682fd0bb3686c60b8038041c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jan 2025 14:45:03 -0800 +Subject: net: netdevsim: try to close UDP port harness races + +From: Jakub Kicinski + +[ Upstream commit 50bf398e1ceacb9a7f85bd3bdca065ebe5cb6159 ] + +syzbot discovered that we remove the debugfs files after we free +the netdev. Try to clean up the relevant dir while the device +is still around. + +Reported-by: syzbot+2e5de9e3ab986b71d2bf@syzkaller.appspotmail.com +Fixes: 424be63ad831 ("netdevsim: add UDP tunnel port offload support") +Reviewed-by: Michal Swiatkowski +Link: https://patch.msgid.link/20250122224503.762705-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/netdevsim/netdevsim.h | 1 + + drivers/net/netdevsim/udp_tunnels.c | 23 +++++++++++-------- + .../drivers/net/netdevsim/udp_tunnel_nic.sh | 16 ++++++------- + 3 files changed, 23 insertions(+), 17 deletions(-) + +diff --git a/drivers/net/netdevsim/netdevsim.h b/drivers/net/netdevsim/netdevsim.h +index bf02efa10956a..84181dcb98831 100644 +--- a/drivers/net/netdevsim/netdevsim.h ++++ b/drivers/net/netdevsim/netdevsim.h +@@ -129,6 +129,7 @@ struct netdevsim { + u32 sleep; + u32 __ports[2][NSIM_UDP_TUNNEL_N_PORTS]; + u32 (*ports)[NSIM_UDP_TUNNEL_N_PORTS]; ++ struct dentry *ddir; + struct debugfs_u32_array dfs_ports[2]; + } udp_ports; + +diff --git a/drivers/net/netdevsim/udp_tunnels.c b/drivers/net/netdevsim/udp_tunnels.c +index 02dc3123eb6c1..640b4983a9a0d 100644 +--- a/drivers/net/netdevsim/udp_tunnels.c ++++ b/drivers/net/netdevsim/udp_tunnels.c +@@ -112,9 +112,11 @@ nsim_udp_tunnels_info_reset_write(struct file *file, const char __user *data, + struct net_device *dev = file->private_data; + struct netdevsim *ns = netdev_priv(dev); + +- memset(ns->udp_ports.ports, 0, sizeof(ns->udp_ports.__ports)); + rtnl_lock(); +- udp_tunnel_nic_reset_ntf(dev); ++ if (dev->reg_state == NETREG_REGISTERED) { ++ memset(ns->udp_ports.ports, 0, sizeof(ns->udp_ports.__ports)); ++ udp_tunnel_nic_reset_ntf(dev); ++ } + rtnl_unlock(); + + return count; +@@ -144,23 +146,23 @@ int nsim_udp_tunnels_info_create(struct nsim_dev *nsim_dev, + else + ns->udp_ports.ports = nsim_dev->udp_ports.__ports; + +- debugfs_create_u32("udp_ports_inject_error", 0600, +- ns->nsim_dev_port->ddir, ++ ns->udp_ports.ddir = debugfs_create_dir("udp_ports", ++ ns->nsim_dev_port->ddir); ++ ++ debugfs_create_u32("inject_error", 0600, ns->udp_ports.ddir, + &ns->udp_ports.inject_error); + + ns->udp_ports.dfs_ports[0].array = ns->udp_ports.ports[0]; + ns->udp_ports.dfs_ports[0].n_elements = NSIM_UDP_TUNNEL_N_PORTS; +- debugfs_create_u32_array("udp_ports_table0", 0400, +- ns->nsim_dev_port->ddir, ++ debugfs_create_u32_array("table0", 0400, ns->udp_ports.ddir, + &ns->udp_ports.dfs_ports[0]); + + ns->udp_ports.dfs_ports[1].array = ns->udp_ports.ports[1]; + ns->udp_ports.dfs_ports[1].n_elements = NSIM_UDP_TUNNEL_N_PORTS; +- debugfs_create_u32_array("udp_ports_table1", 0400, +- ns->nsim_dev_port->ddir, ++ debugfs_create_u32_array("table1", 0400, ns->udp_ports.ddir, + &ns->udp_ports.dfs_ports[1]); + +- debugfs_create_file("udp_ports_reset", 0200, ns->nsim_dev_port->ddir, ++ debugfs_create_file("reset", 0200, ns->udp_ports.ddir, + dev, &nsim_udp_tunnels_info_reset_fops); + + /* Note: it's not normal to allocate the info struct like this! +@@ -196,6 +198,9 @@ int nsim_udp_tunnels_info_create(struct nsim_dev *nsim_dev, + + void nsim_udp_tunnels_info_destroy(struct net_device *dev) + { ++ struct netdevsim *ns = netdev_priv(dev); ++ ++ debugfs_remove_recursive(ns->udp_ports.ddir); + kfree(dev->udp_tunnel_nic_info); + dev->udp_tunnel_nic_info = NULL; + } +diff --git a/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh b/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh +index 384cfa3d38a6c..92c2f0376c081 100755 +--- a/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh ++++ b/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh +@@ -142,7 +142,7 @@ function pre_ethtool { + } + + function check_table { +- local path=$NSIM_DEV_DFS/ports/$port/udp_ports_table$1 ++ local path=$NSIM_DEV_DFS/ports/$port/udp_ports/table$1 + local -n expected=$2 + local last=$3 + +@@ -212,7 +212,7 @@ function check_tables { + } + + function print_table { +- local path=$NSIM_DEV_DFS/ports/$port/udp_ports_table$1 ++ local path=$NSIM_DEV_DFS/ports/$port/udp_ports/table$1 + read -a have < $path + + tree $NSIM_DEV_DFS/ +@@ -641,7 +641,7 @@ for port in 0 1; do + NSIM_NETDEV=`get_netdev_name old_netdevs` + ip link set dev $NSIM_NETDEV up + +- echo 110 > $NSIM_DEV_DFS/ports/$port/udp_ports_inject_error ++ echo 110 > $NSIM_DEV_DFS/ports/$port/udp_ports/inject_error + + msg="1 - create VxLANs v6" + exp0=( 0 0 0 0 ) +@@ -663,7 +663,7 @@ for port in 0 1; do + new_geneve gnv0 20000 + + msg="2 - destroy GENEVE" +- echo 2 > $NSIM_DEV_DFS/ports/$port/udp_ports_inject_error ++ echo 2 > $NSIM_DEV_DFS/ports/$port/udp_ports/inject_error + exp1=( `mke 20000 2` 0 0 0 ) + del_dev gnv0 + +@@ -764,7 +764,7 @@ for port in 0 1; do + msg="create VxLANs v4" + new_vxlan vxlan0 10000 $NSIM_NETDEV + +- echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset ++ echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset + check_tables + + msg="NIC device goes down" +@@ -775,7 +775,7 @@ for port in 0 1; do + fi + check_tables + +- echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset ++ echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset + check_tables + + msg="NIC device goes up again" +@@ -789,7 +789,7 @@ for port in 0 1; do + del_dev vxlan0 + check_tables + +- echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset ++ echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset + check_tables + + msg="destroy NIC" +@@ -896,7 +896,7 @@ msg="vacate VxLAN in overflow table" + exp0=( `mke 10000 1` `mke 10004 1` 0 `mke 10003 1` ) + del_dev vxlan2 + +-echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset ++echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset + check_tables + + msg="tunnels destroyed 2" +-- +2.39.5 + diff --git a/queue-6.12/net-phy-marvell-88q2xxx-fix-temperature-measurement-.patch b/queue-6.12/net-phy-marvell-88q2xxx-fix-temperature-measurement-.patch new file mode 100644 index 0000000000..f09746e2ce --- /dev/null +++ b/queue-6.12/net-phy-marvell-88q2xxx-fix-temperature-measurement-.patch @@ -0,0 +1,104 @@ +From 089d9b6e59631d46124c40f4232079e5ccc91a24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Jan 2025 19:43:43 +0100 +Subject: net: phy: marvell-88q2xxx: Fix temperature measurement with + reset-gpios +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dimitri Fedrau + +[ Upstream commit a197004cf3c2e6c8cc0695c787a97e62e3229754 ] + +When using temperature measurement on Marvell 88Q2XXX devices and the +reset-gpios property is set in DT, the device does a hardware reset when +interface is brought down and up again. That means that the content of +the register MDIO_MMD_PCS_MV_TEMP_SENSOR2 is reset to default and that +leads to permanent deactivation of the temperature measurement, because +activation is done in mv88q2xxx_probe. To fix this move activation of +temperature measurement to mv88q222x_config_init. + +Fixes: a557a92e6881 ("net: phy: marvell-88q2xxx: add support for temperature sensor") +Reviewed-by: Niklas Söderlund +Signed-off-by: Dimitri Fedrau +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20250118-marvell-88q2xxx-fix-hwmon-v2-1-402e62ba2dcb@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/phy/marvell-88q2xxx.c | 33 ++++++++++++++++++++++++------- + 1 file changed, 26 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/phy/marvell-88q2xxx.c b/drivers/net/phy/marvell-88q2xxx.c +index c812f16eaa3a8..b3a5a0af19da6 100644 +--- a/drivers/net/phy/marvell-88q2xxx.c ++++ b/drivers/net/phy/marvell-88q2xxx.c +@@ -95,6 +95,10 @@ + + #define MDIO_MMD_PCS_MV_TDR_OFF_CUTOFF 65246 + ++struct mv88q2xxx_priv { ++ bool enable_temp; ++}; ++ + struct mmd_val { + int devad; + u32 regnum; +@@ -669,17 +673,12 @@ static const struct hwmon_chip_info mv88q2xxx_hwmon_chip_info = { + + static int mv88q2xxx_hwmon_probe(struct phy_device *phydev) + { ++ struct mv88q2xxx_priv *priv = phydev->priv; + struct device *dev = &phydev->mdio.dev; + struct device *hwmon; + char *hwmon_name; +- int ret; +- +- /* Enable temperature sense */ +- ret = phy_modify_mmd(phydev, MDIO_MMD_PCS, MDIO_MMD_PCS_MV_TEMP_SENSOR2, +- MDIO_MMD_PCS_MV_TEMP_SENSOR2_DIS_MASK, 0); +- if (ret < 0) +- return ret; + ++ priv->enable_temp = true; + hwmon_name = devm_hwmon_sanitize_name(dev, dev_name(dev)); + if (IS_ERR(hwmon_name)) + return PTR_ERR(hwmon_name); +@@ -702,6 +701,14 @@ static int mv88q2xxx_hwmon_probe(struct phy_device *phydev) + + static int mv88q2xxx_probe(struct phy_device *phydev) + { ++ struct mv88q2xxx_priv *priv; ++ ++ priv = devm_kzalloc(&phydev->mdio.dev, sizeof(*priv), GFP_KERNEL); ++ if (!priv) ++ return -ENOMEM; ++ ++ phydev->priv = priv; ++ + return mv88q2xxx_hwmon_probe(phydev); + } + +@@ -792,6 +799,18 @@ static int mv88q222x_revb1_revb2_config_init(struct phy_device *phydev) + + static int mv88q222x_config_init(struct phy_device *phydev) + { ++ struct mv88q2xxx_priv *priv = phydev->priv; ++ int ret; ++ ++ /* Enable temperature sense */ ++ if (priv->enable_temp) { ++ ret = phy_modify_mmd(phydev, MDIO_MMD_PCS, ++ MDIO_MMD_PCS_MV_TEMP_SENSOR2, ++ MDIO_MMD_PCS_MV_TEMP_SENSOR2_DIS_MASK, 0); ++ if (ret < 0) ++ return ret; ++ } ++ + if (phydev->c45_ids.device_ids[MDIO_MMD_PMAPMD] == PHY_ID_88Q2220_REVB0) + return mv88q222x_revb0_config_init(phydev); + else +-- +2.39.5 + diff --git a/queue-6.12/net-ravb-fix-missing-rtnl-lock-in-suspend-resume-pat.patch b/queue-6.12/net-ravb-fix-missing-rtnl-lock-in-suspend-resume-pat.patch new file mode 100644 index 0000000000..60ba780ef8 --- /dev/null +++ b/queue-6.12/net-ravb-fix-missing-rtnl-lock-in-suspend-resume-pat.patch @@ -0,0 +1,122 @@ +From 7afa6686aae401f362ad6dbc9746fc4cfba3d51f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jan 2025 10:50:46 +0100 +Subject: net: ravb: Fix missing rtnl lock in suspend/resume path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kory Maincent + +[ Upstream commit 2c2ebb2b49573e5f8726112ad06b1dffc3c9ea03 ] + +Fix the suspend/resume path by ensuring the rtnl lock is held where +required. Calls to ravb_open, ravb_close and wol operations must be +performed under the rtnl lock to prevent conflicts with ongoing ndo +operations. + +Without this fix, the following warning is triggered: +[ 39.032969] ============================= +[ 39.032983] WARNING: suspicious RCU usage +[ 39.033019] ----------------------------- +[ 39.033033] drivers/net/phy/phy_device.c:2004 suspicious +rcu_dereference_protected() usage! +... +[ 39.033597] stack backtrace: +[ 39.033613] CPU: 0 UID: 0 PID: 174 Comm: python3 Not tainted +6.13.0-rc7-next-20250116-arm64-renesas-00002-g35245dfdc62c #7 +[ 39.033623] Hardware name: Renesas SMARC EVK version 2 based on +r9a08g045s33 (DT) +[ 39.033628] Call trace: +[ 39.033633] show_stack+0x14/0x1c (C) +[ 39.033652] dump_stack_lvl+0xb4/0xc4 +[ 39.033664] dump_stack+0x14/0x1c +[ 39.033671] lockdep_rcu_suspicious+0x16c/0x22c +[ 39.033682] phy_detach+0x160/0x190 +[ 39.033694] phy_disconnect+0x40/0x54 +[ 39.033703] ravb_close+0x6c/0x1cc +[ 39.033714] ravb_suspend+0x48/0x120 +[ 39.033721] dpm_run_callback+0x4c/0x14c +[ 39.033731] device_suspend+0x11c/0x4dc +[ 39.033740] dpm_suspend+0xdc/0x214 +[ 39.033748] dpm_suspend_start+0x48/0x60 +[ 39.033758] suspend_devices_and_enter+0x124/0x574 +[ 39.033769] pm_suspend+0x1ac/0x274 +[ 39.033778] state_store+0x88/0x124 +[ 39.033788] kobj_attr_store+0x14/0x24 +[ 39.033798] sysfs_kf_write+0x48/0x6c +[ 39.033808] kernfs_fop_write_iter+0x118/0x1a8 +[ 39.033817] vfs_write+0x27c/0x378 +[ 39.033825] ksys_write+0x64/0xf4 +[ 39.033833] __arm64_sys_write+0x18/0x20 +[ 39.033841] invoke_syscall+0x44/0x104 +[ 39.033852] el0_svc_common.constprop.0+0xb4/0xd4 +[ 39.033862] do_el0_svc+0x18/0x20 +[ 39.033870] el0_svc+0x3c/0xf0 +[ 39.033880] el0t_64_sync_handler+0xc0/0xc4 +[ 39.033888] el0t_64_sync+0x154/0x158 +[ 39.041274] ravb 11c30000.ethernet eth0: Link is Down + +Reported-by: Claudiu Beznea +Closes: https://lore.kernel.org/netdev/4c6419d8-c06b-495c-b987-d66c2e1ff848@tuxon.dev/ +Fixes: 0184165b2f42 ("ravb: add sleep PM suspend/resume support") +Signed-off-by: Kory Maincent +Tested-by: Niklas Söderlund +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/renesas/ravb_main.c | 22 ++++++++++++++-------- + 1 file changed, 14 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index 6f6b0566c65bc..cc4f0d16c7630 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -3208,10 +3208,15 @@ static int ravb_suspend(struct device *dev) + + netif_device_detach(ndev); + +- if (priv->wol_enabled) +- return ravb_wol_setup(ndev); ++ rtnl_lock(); ++ if (priv->wol_enabled) { ++ ret = ravb_wol_setup(ndev); ++ rtnl_unlock(); ++ return ret; ++ } + + ret = ravb_close(ndev); ++ rtnl_unlock(); + if (ret) + return ret; + +@@ -3236,19 +3241,20 @@ static int ravb_resume(struct device *dev) + if (!netif_running(ndev)) + return 0; + ++ rtnl_lock(); + /* If WoL is enabled restore the interface. */ +- if (priv->wol_enabled) { ++ if (priv->wol_enabled) + ret = ravb_wol_restore(ndev); +- if (ret) +- return ret; +- } else { ++ else + ret = pm_runtime_force_resume(dev); +- if (ret) +- return ret; ++ if (ret) { ++ rtnl_unlock(); ++ return ret; + } + + /* Reopening the interface will restore the device to the working state. */ + ret = ravb_open(ndev); ++ rtnl_unlock(); + if (ret < 0) + goto out_rpm_put; + +-- +2.39.5 + diff --git a/queue-6.12/net-rose-fix-timer-races-against-user-threads.patch b/queue-6.12/net-rose-fix-timer-races-against-user-threads.patch new file mode 100644 index 0000000000..98c2b45e3d --- /dev/null +++ b/queue-6.12/net-rose-fix-timer-races-against-user-threads.patch @@ -0,0 +1,116 @@ +From acae4f2430ccf9a3fe49f6314b90f3a936401594 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jan 2025 18:02:44 +0000 +Subject: net: rose: fix timer races against user threads + +From: Eric Dumazet + +[ Upstream commit 5de7665e0a0746b5ad7943554b34db8f8614a196 ] + +Rose timers only acquire the socket spinlock, without +checking if the socket is owned by one user thread. + +Add a check and rearm the timers if needed. + +BUG: KASAN: slab-use-after-free in rose_timer_expiry+0x31d/0x360 net/rose/rose_timer.c:174 +Read of size 2 at addr ffff88802f09b82a by task swapper/0/0 + +CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5-syzkaller-00172-gd1bf27c4e176 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 +Call Trace: + + __dump_stack lib/dump_stack.c:94 [inline] + dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 + print_address_description mm/kasan/report.c:378 [inline] + print_report+0x169/0x550 mm/kasan/report.c:489 + kasan_report+0x143/0x180 mm/kasan/report.c:602 + rose_timer_expiry+0x31d/0x360 net/rose/rose_timer.c:174 + call_timer_fn+0x187/0x650 kernel/time/timer.c:1793 + expire_timers kernel/time/timer.c:1844 [inline] + __run_timers kernel/time/timer.c:2418 [inline] + __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2430 + run_timer_base kernel/time/timer.c:2439 [inline] + run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449 + handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561 + __do_softirq kernel/softirq.c:595 [inline] + invoke_softirq kernel/softirq.c:435 [inline] + __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662 + irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 + instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] + sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 + + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Link: https://patch.msgid.link/20250122180244.1861468-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/rose/rose_timer.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/net/rose/rose_timer.c b/net/rose/rose_timer.c +index f06ddbed3fed6..1525773e94aa1 100644 +--- a/net/rose/rose_timer.c ++++ b/net/rose/rose_timer.c +@@ -122,6 +122,10 @@ static void rose_heartbeat_expiry(struct timer_list *t) + struct rose_sock *rose = rose_sk(sk); + + bh_lock_sock(sk); ++ if (sock_owned_by_user(sk)) { ++ sk_reset_timer(sk, &sk->sk_timer, jiffies + HZ/20); ++ goto out; ++ } + switch (rose->state) { + case ROSE_STATE_0: + /* Magic here: If we listen() and a new link dies before it +@@ -152,6 +156,7 @@ static void rose_heartbeat_expiry(struct timer_list *t) + } + + rose_start_heartbeat(sk); ++out: + bh_unlock_sock(sk); + sock_put(sk); + } +@@ -162,6 +167,10 @@ static void rose_timer_expiry(struct timer_list *t) + struct sock *sk = &rose->sock; + + bh_lock_sock(sk); ++ if (sock_owned_by_user(sk)) { ++ sk_reset_timer(sk, &rose->timer, jiffies + HZ/20); ++ goto out; ++ } + switch (rose->state) { + case ROSE_STATE_1: /* T1 */ + case ROSE_STATE_4: /* T2 */ +@@ -182,6 +191,7 @@ static void rose_timer_expiry(struct timer_list *t) + } + break; + } ++out: + bh_unlock_sock(sk); + sock_put(sk); + } +@@ -192,6 +202,10 @@ static void rose_idletimer_expiry(struct timer_list *t) + struct sock *sk = &rose->sock; + + bh_lock_sock(sk); ++ if (sock_owned_by_user(sk)) { ++ sk_reset_timer(sk, &rose->idletimer, jiffies + HZ/20); ++ goto out; ++ } + rose_clear_queues(sk); + + rose_write_internal(sk, ROSE_CLEAR_REQUEST); +@@ -207,6 +221,7 @@ static void rose_idletimer_expiry(struct timer_list *t) + sk->sk_state_change(sk); + sock_set_flag(sk, SOCK_DEAD); + } ++out: + bh_unlock_sock(sk); + sock_put(sk); + } +-- +2.39.5 + diff --git a/queue-6.12/net-rose-prevent-integer-overflows-in-rose_setsockop.patch b/queue-6.12/net-rose-prevent-integer-overflows-in-rose_setsockop.patch new file mode 100644 index 0000000000..712b245de0 --- /dev/null +++ b/queue-6.12/net-rose-prevent-integer-overflows-in-rose_setsockop.patch @@ -0,0 +1,90 @@ +From 258e8d885babcc359692cd0e3506a241f2199a65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 08:42:20 -0800 +Subject: net/rose: prevent integer overflows in rose_setsockopt() + +From: Nikita Zhandarovich + +[ Upstream commit d640627663bfe7d8963c7615316d7d4ef60f3b0b ] + +In case of possible unpredictably large arguments passed to +rose_setsockopt() and multiplied by extra values on top of that, +integer overflows may occur. + +Do the safest minimum and fix these issues by checking the +contents of 'opt' and returning -EINVAL if they are too large. Also, +switch to unsigned int and remove useless check for negative 'opt' +in ROSE_IDLE case. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Nikita Zhandarovich +Link: https://patch.msgid.link/20250115164220.19954-1-n.zhandarovich@fintech.ru +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/rose/af_rose.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c +index 59050caab65c8..72c65d938a150 100644 +--- a/net/rose/af_rose.c ++++ b/net/rose/af_rose.c +@@ -397,15 +397,15 @@ static int rose_setsockopt(struct socket *sock, int level, int optname, + { + struct sock *sk = sock->sk; + struct rose_sock *rose = rose_sk(sk); +- int opt; ++ unsigned int opt; + + if (level != SOL_ROSE) + return -ENOPROTOOPT; + +- if (optlen < sizeof(int)) ++ if (optlen < sizeof(unsigned int)) + return -EINVAL; + +- if (copy_from_sockptr(&opt, optval, sizeof(int))) ++ if (copy_from_sockptr(&opt, optval, sizeof(unsigned int))) + return -EFAULT; + + switch (optname) { +@@ -414,31 +414,31 @@ static int rose_setsockopt(struct socket *sock, int level, int optname, + return 0; + + case ROSE_T1: +- if (opt < 1) ++ if (opt < 1 || opt > UINT_MAX / HZ) + return -EINVAL; + rose->t1 = opt * HZ; + return 0; + + case ROSE_T2: +- if (opt < 1) ++ if (opt < 1 || opt > UINT_MAX / HZ) + return -EINVAL; + rose->t2 = opt * HZ; + return 0; + + case ROSE_T3: +- if (opt < 1) ++ if (opt < 1 || opt > UINT_MAX / HZ) + return -EINVAL; + rose->t3 = opt * HZ; + return 0; + + case ROSE_HOLDBACK: +- if (opt < 1) ++ if (opt < 1 || opt > UINT_MAX / HZ) + return -EINVAL; + rose->hb = opt * HZ; + return 0; + + case ROSE_IDLE: +- if (opt < 0) ++ if (opt > UINT_MAX / (60 * HZ)) + return -EINVAL; + rose->idle = opt * 60 * HZ; + return 0; +-- +2.39.5 + diff --git a/queue-6.12/net-sched-disallow-replacing-of-child-qdisc-from-one.patch b/queue-6.12/net-sched-disallow-replacing-of-child-qdisc-from-one.patch new file mode 100644 index 0000000000..d4453e7f3a --- /dev/null +++ b/queue-6.12/net-sched-disallow-replacing-of-child-qdisc-from-one.patch @@ -0,0 +1,115 @@ +From 9d138eb4d0391fae7c236acc7f1869f33bffd112 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 17:37:13 -0800 +Subject: net: sched: Disallow replacing of child qdisc from one parent to + another + +From: Jamal Hadi Salim + +[ Upstream commit bc50835e83f60f56e9bec2b392fb5544f250fb6f ] + +Lion Ackermann was able to create a UAF which can be abused for privilege +escalation with the following script + +Step 1. create root qdisc +tc qdisc add dev lo root handle 1:0 drr + +step2. a class for packet aggregation do demonstrate uaf +tc class add dev lo classid 1:1 drr + +step3. a class for nesting +tc class add dev lo classid 1:2 drr + +step4. a class to graft qdisc to +tc class add dev lo classid 1:3 drr + +step5. +tc qdisc add dev lo parent 1:1 handle 2:0 plug limit 1024 + +step6. +tc qdisc add dev lo parent 1:2 handle 3:0 drr + +step7. +tc class add dev lo classid 3:1 drr + +step 8. +tc qdisc add dev lo parent 3:1 handle 4:0 pfifo + +step 9. Display the class/qdisc layout + +tc class ls dev lo + class drr 1:1 root leaf 2: quantum 64Kb + class drr 1:2 root leaf 3: quantum 64Kb + class drr 3:1 root leaf 4: quantum 64Kb + +tc qdisc ls + qdisc drr 1: dev lo root refcnt 2 + qdisc plug 2: dev lo parent 1:1 + qdisc pfifo 4: dev lo parent 3:1 limit 1000p + qdisc drr 3: dev lo parent 1:2 + +step10. trigger the bug <=== prevented by this patch +tc qdisc replace dev lo parent 1:3 handle 4:0 + +step 11. Redisplay again the qdiscs/classes + +tc class ls dev lo + class drr 1:1 root leaf 2: quantum 64Kb + class drr 1:2 root leaf 3: quantum 64Kb + class drr 1:3 root leaf 4: quantum 64Kb + class drr 3:1 root leaf 4: quantum 64Kb + +tc qdisc ls + qdisc drr 1: dev lo root refcnt 2 + qdisc plug 2: dev lo parent 1:1 + qdisc pfifo 4: dev lo parent 3:1 refcnt 2 limit 1000p + qdisc drr 3: dev lo parent 1:2 + +Observe that a) parent for 4:0 does not change despite the replace request. +There can only be one parent. b) refcount has gone up by two for 4:0 and +c) both class 1:3 and 3:1 are pointing to it. + +Step 12. send one packet to plug +echo "" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10001)) +step13. send one packet to the grafted fifo +echo "" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10003)) + +step14. lets trigger the uaf +tc class delete dev lo classid 1:3 +tc class delete dev lo classid 1:1 + +The semantics of "replace" is for a del/add _on the same node_ and not +a delete from one node(3:1) and add to another node (1:3) as in step10. +While we could "fix" with a more complex approach there could be +consequences to expectations so the patch takes the preventive approach of +"disallow such config". + +Joint work with Lion Ackermann +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Jamal Hadi Salim +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250116013713.900000-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_api.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c +index a1d27bc039a36..d26ac6bd9b108 100644 +--- a/net/sched/sch_api.c ++++ b/net/sched/sch_api.c +@@ -1664,6 +1664,10 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n, + q = qdisc_lookup(dev, tcm->tcm_handle); + if (!q) + goto create_n_graft; ++ if (q->parent != tcm->tcm_parent) { ++ NL_SET_ERR_MSG(extack, "Cannot move an existing qdisc to a different parent"); ++ return -EINVAL; ++ } + if (n->nlmsg_flags & NLM_F_EXCL) { + NL_SET_ERR_MSG(extack, "Exclusivity flag on, cannot override"); + return -EEXIST; +-- +2.39.5 + diff --git a/queue-6.12/net-sched-refine-software-bypass-handling-in-tc_run.patch b/queue-6.12/net-sched-refine-software-bypass-handling-in-tc_run.patch new file mode 100644 index 0000000000..6656abc8df --- /dev/null +++ b/queue-6.12/net-sched-refine-software-bypass-handling-in-tc_run.patch @@ -0,0 +1,362 @@ +From 8cff071fa2909a5b1a737062478dba195324e5df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 09:27:54 -0500 +Subject: net: sched: refine software bypass handling in tc_run +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Xin Long + +[ Upstream commit a12c76a03386e32413ae8eaaefa337e491880632 ] + +This patch addresses issues with filter counting in block (tcf_block), +particularly for software bypass scenarios, by introducing a more +accurate mechanism using useswcnt. + +Previously, filtercnt and skipswcnt were introduced by: + + Commit 2081fd3445fe ("net: sched: cls_api: add filter counter") and + Commit f631ef39d819 ("net: sched: cls_api: add skip_sw counter") + + filtercnt tracked all tp (tcf_proto) objects added to a block, and + skipswcnt counted tp objects with the skipsw attribute set. + +The problem is: a single tp can contain multiple filters, some with skipsw +and others without. The current implementation fails in the case: + + When the first filter in a tp has skipsw, both skipswcnt and filtercnt + are incremented, then adding a second filter without skipsw to the same + tp does not modify these counters because tp->counted is already set. + + This results in bypass software behavior based solely on skipswcnt + equaling filtercnt, even when the block includes filters without + skipsw. Consequently, filters without skipsw are inadvertently bypassed. + +To address this, the patch introduces useswcnt in block to explicitly count +tp objects containing at least one filter without skipsw. Key changes +include: + + Whenever a filter without skipsw is added, its tp is marked with usesw + and counted in useswcnt. tc_run() now uses useswcnt to determine software + bypass, eliminating reliance on filtercnt and skipswcnt. + + This refined approach prevents software bypass for blocks containing + mixed filters, ensuring correct behavior in tc_run(). + +Additionally, as atomic operations on useswcnt ensure thread safety and +tp->lock guards access to tp->usesw and tp->counted, the broader lock +down_write(&block->cb_lock) is no longer required in tc_new_tfilter(), +and this resolves a performance regression caused by the filter counting +mechanism during parallel filter insertions. + + The improvement can be demonstrated using the following script: + + # cat insert_tc_rules.sh + + tc qdisc add dev ens1f0np0 ingress + for i in $(seq 16); do + taskset -c $i tc -b rules_$i.txt & + done + wait + + Each of rules_$i.txt files above includes 100000 tc filter rules to a + mlx5 driver NIC ens1f0np0. + + Without this patch: + + # time sh insert_tc_rules.sh + + real 0m50.780s + user 0m23.556s + sys 4m13.032s + + With this patch: + + # time sh insert_tc_rules.sh + + real 0m17.718s + user 0m7.807s + sys 3m45.050s + +Fixes: 047f340b36fc ("net: sched: make skip_sw actually skip software") +Reported-by: Shuang Li +Signed-off-by: Xin Long +Acked-by: Marcelo Ricardo Leitner +Reviewed-by: Asbjørn Sloth Tønnesen +Tested-by: Asbjørn Sloth Tønnesen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/pkt_cls.h | 13 +++++++-- + include/net/sch_generic.h | 5 ++-- + net/core/dev.c | 15 ++++++----- + net/sched/cls_api.c | 57 ++++++++++++++++----------------------- + net/sched/cls_bpf.c | 2 ++ + net/sched/cls_flower.c | 2 ++ + net/sched/cls_matchall.c | 2 ++ + net/sched/cls_u32.c | 4 +++ + 8 files changed, 55 insertions(+), 45 deletions(-) + +diff --git a/include/net/pkt_cls.h b/include/net/pkt_cls.h +index 4880b3a7aced5..4229e4fcd2a9e 100644 +--- a/include/net/pkt_cls.h ++++ b/include/net/pkt_cls.h +@@ -75,11 +75,11 @@ static inline bool tcf_block_non_null_shared(struct tcf_block *block) + } + + #ifdef CONFIG_NET_CLS_ACT +-DECLARE_STATIC_KEY_FALSE(tcf_bypass_check_needed_key); ++DECLARE_STATIC_KEY_FALSE(tcf_sw_enabled_key); + + static inline bool tcf_block_bypass_sw(struct tcf_block *block) + { +- return block && block->bypass_wanted; ++ return block && !atomic_read(&block->useswcnt); + } + #endif + +@@ -759,6 +759,15 @@ tc_cls_common_offload_init(struct flow_cls_common_offload *cls_common, + cls_common->extack = extack; + } + ++static inline void tcf_proto_update_usesw(struct tcf_proto *tp, u32 flags) ++{ ++ if (tp->usesw) ++ return; ++ if (tc_skip_sw(flags) && tc_in_hw(flags)) ++ return; ++ tp->usesw = true; ++} ++ + #if IS_ENABLED(CONFIG_NET_TC_SKB_EXT) + static inline struct tc_skb_ext *tc_skb_ext_alloc(struct sk_buff *skb) + { +diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h +index 5d74fa7e694cc..1e6324f0d4efd 100644 +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -425,6 +425,7 @@ struct tcf_proto { + spinlock_t lock; + bool deleting; + bool counted; ++ bool usesw; + refcount_t refcnt; + struct rcu_head rcu; + struct hlist_node destroy_ht_node; +@@ -474,9 +475,7 @@ struct tcf_block { + struct flow_block flow_block; + struct list_head owner_list; + bool keep_dst; +- bool bypass_wanted; +- atomic_t filtercnt; /* Number of filters */ +- atomic_t skipswcnt; /* Number of skip_sw filters */ ++ atomic_t useswcnt; + atomic_t offloadcnt; /* Number of oddloaded filters */ + unsigned int nooffloaddevcnt; /* Number of devs unable to do offload */ + unsigned int lockeddevcnt; /* Number of devs that require rtnl lock. */ +diff --git a/net/core/dev.c b/net/core/dev.c +index 9bdb8fe5ffaa5..7c3e2a448e5c6 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -2136,8 +2136,8 @@ EXPORT_SYMBOL_GPL(net_dec_egress_queue); + #endif + + #ifdef CONFIG_NET_CLS_ACT +-DEFINE_STATIC_KEY_FALSE(tcf_bypass_check_needed_key); +-EXPORT_SYMBOL(tcf_bypass_check_needed_key); ++DEFINE_STATIC_KEY_FALSE(tcf_sw_enabled_key); ++EXPORT_SYMBOL(tcf_sw_enabled_key); + #endif + + DEFINE_STATIC_KEY_FALSE(netstamp_needed_key); +@@ -4030,10 +4030,13 @@ static int tc_run(struct tcx_entry *entry, struct sk_buff *skb, + if (!miniq) + return ret; + +- if (static_branch_unlikely(&tcf_bypass_check_needed_key)) { +- if (tcf_block_bypass_sw(miniq->block)) +- return ret; +- } ++ /* Global bypass */ ++ if (!static_branch_likely(&tcf_sw_enabled_key)) ++ return ret; ++ ++ /* Block-wise bypass */ ++ if (tcf_block_bypass_sw(miniq->block)) ++ return ret; + + tc_skb_cb(skb)->mru = 0; + tc_skb_cb(skb)->post_ct = false; +diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c +index bbc778c233c89..dfa3067084948 100644 +--- a/net/sched/cls_api.c ++++ b/net/sched/cls_api.c +@@ -390,6 +390,7 @@ static struct tcf_proto *tcf_proto_create(const char *kind, u32 protocol, + tp->protocol = protocol; + tp->prio = prio; + tp->chain = chain; ++ tp->usesw = !tp->ops->reoffload; + spin_lock_init(&tp->lock); + refcount_set(&tp->refcnt, 1); + +@@ -410,39 +411,31 @@ static void tcf_proto_get(struct tcf_proto *tp) + refcount_inc(&tp->refcnt); + } + +-static void tcf_maintain_bypass(struct tcf_block *block) ++static void tcf_proto_count_usesw(struct tcf_proto *tp, bool add) + { +- int filtercnt = atomic_read(&block->filtercnt); +- int skipswcnt = atomic_read(&block->skipswcnt); +- bool bypass_wanted = filtercnt > 0 && filtercnt == skipswcnt; +- +- if (bypass_wanted != block->bypass_wanted) { + #ifdef CONFIG_NET_CLS_ACT +- if (bypass_wanted) +- static_branch_inc(&tcf_bypass_check_needed_key); +- else +- static_branch_dec(&tcf_bypass_check_needed_key); +-#endif +- block->bypass_wanted = bypass_wanted; ++ struct tcf_block *block = tp->chain->block; ++ bool counted = false; ++ ++ if (!add) { ++ if (tp->usesw && tp->counted) { ++ if (!atomic_dec_return(&block->useswcnt)) ++ static_branch_dec(&tcf_sw_enabled_key); ++ tp->counted = false; ++ } ++ return; + } +-} +- +-static void tcf_block_filter_cnt_update(struct tcf_block *block, bool *counted, bool add) +-{ +- lockdep_assert_not_held(&block->cb_lock); + +- down_write(&block->cb_lock); +- if (*counted != add) { +- if (add) { +- atomic_inc(&block->filtercnt); +- *counted = true; +- } else { +- atomic_dec(&block->filtercnt); +- *counted = false; +- } ++ spin_lock(&tp->lock); ++ if (tp->usesw && !tp->counted) { ++ counted = true; ++ tp->counted = true; + } +- tcf_maintain_bypass(block); +- up_write(&block->cb_lock); ++ spin_unlock(&tp->lock); ++ ++ if (counted && atomic_inc_return(&block->useswcnt) == 1) ++ static_branch_inc(&tcf_sw_enabled_key); ++#endif + } + + static void tcf_chain_put(struct tcf_chain *chain); +@@ -451,7 +444,7 @@ static void tcf_proto_destroy(struct tcf_proto *tp, bool rtnl_held, + bool sig_destroy, struct netlink_ext_ack *extack) + { + tp->ops->destroy(tp, rtnl_held, extack); +- tcf_block_filter_cnt_update(tp->chain->block, &tp->counted, false); ++ tcf_proto_count_usesw(tp, false); + if (sig_destroy) + tcf_proto_signal_destroyed(tp->chain, tp); + tcf_chain_put(tp->chain); +@@ -2404,7 +2397,7 @@ static int tc_new_tfilter(struct sk_buff *skb, struct nlmsghdr *n, + tfilter_notify(net, skb, n, tp, block, q, parent, fh, + RTM_NEWTFILTER, false, rtnl_held, extack); + tfilter_put(tp, fh); +- tcf_block_filter_cnt_update(block, &tp->counted, true); ++ tcf_proto_count_usesw(tp, true); + /* q pointer is NULL for shared blocks */ + if (q) + q->flags &= ~TCQ_F_CAN_BYPASS; +@@ -3521,8 +3514,6 @@ static void tcf_block_offload_inc(struct tcf_block *block, u32 *flags) + if (*flags & TCA_CLS_FLAGS_IN_HW) + return; + *flags |= TCA_CLS_FLAGS_IN_HW; +- if (tc_skip_sw(*flags)) +- atomic_inc(&block->skipswcnt); + atomic_inc(&block->offloadcnt); + } + +@@ -3531,8 +3522,6 @@ static void tcf_block_offload_dec(struct tcf_block *block, u32 *flags) + if (!(*flags & TCA_CLS_FLAGS_IN_HW)) + return; + *flags &= ~TCA_CLS_FLAGS_IN_HW; +- if (tc_skip_sw(*flags)) +- atomic_dec(&block->skipswcnt); + atomic_dec(&block->offloadcnt); + } + +diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c +index 1941ebec23ff9..7fbe42f0e5c2b 100644 +--- a/net/sched/cls_bpf.c ++++ b/net/sched/cls_bpf.c +@@ -509,6 +509,8 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb, + if (!tc_in_hw(prog->gen_flags)) + prog->gen_flags |= TCA_CLS_FLAGS_NOT_IN_HW; + ++ tcf_proto_update_usesw(tp, prog->gen_flags); ++ + if (oldprog) { + idr_replace(&head->handle_idr, prog, handle); + list_replace_rcu(&oldprog->link, &prog->link); +diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c +index 1008ec8a464c9..03505673d5234 100644 +--- a/net/sched/cls_flower.c ++++ b/net/sched/cls_flower.c +@@ -2503,6 +2503,8 @@ static int fl_change(struct net *net, struct sk_buff *in_skb, + if (!tc_in_hw(fnew->flags)) + fnew->flags |= TCA_CLS_FLAGS_NOT_IN_HW; + ++ tcf_proto_update_usesw(tp, fnew->flags); ++ + spin_lock(&tp->lock); + + /* tp was deleted concurrently. -EAGAIN will cause caller to lookup +diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c +index 9f1e62ca508d0..f03bf5da39ee8 100644 +--- a/net/sched/cls_matchall.c ++++ b/net/sched/cls_matchall.c +@@ -228,6 +228,8 @@ static int mall_change(struct net *net, struct sk_buff *in_skb, + if (!tc_in_hw(new->flags)) + new->flags |= TCA_CLS_FLAGS_NOT_IN_HW; + ++ tcf_proto_update_usesw(tp, new->flags); ++ + *arg = head; + rcu_assign_pointer(tp->root, new); + return 0; +diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c +index d3a03c57545bc..2a1c00048fd6f 100644 +--- a/net/sched/cls_u32.c ++++ b/net/sched/cls_u32.c +@@ -951,6 +951,8 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, + if (!tc_in_hw(new->flags)) + new->flags |= TCA_CLS_FLAGS_NOT_IN_HW; + ++ tcf_proto_update_usesw(tp, new->flags); ++ + u32_replace_knode(tp, tp_c, new); + tcf_unbind_filter(tp, &n->res); + tcf_exts_get_net(&n->exts); +@@ -1164,6 +1166,8 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, + if (!tc_in_hw(n->flags)) + n->flags |= TCA_CLS_FLAGS_NOT_IN_HW; + ++ tcf_proto_update_usesw(tp, n->flags); ++ + ins = &ht->ht[TC_U32_HASH(handle)]; + for (pins = rtnl_dereference(*ins); pins; + ins = &pins->next, pins = rtnl_dereference(*ins)) +-- +2.39.5 + diff --git a/queue-6.12/net-sh_eth-fix-missing-rtnl-lock-in-suspend-resume-p.patch b/queue-6.12/net-sh_eth-fix-missing-rtnl-lock-in-suspend-resume-p.patch new file mode 100644 index 0000000000..8cf70b6588 --- /dev/null +++ b/queue-6.12/net-sh_eth-fix-missing-rtnl-lock-in-suspend-resume-p.patch @@ -0,0 +1,60 @@ +From 86093af06f0c461d91eb5b7745f189257d6aba5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jan 2025 10:50:47 +0100 +Subject: net: sh_eth: Fix missing rtnl lock in suspend/resume path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kory Maincent + +[ Upstream commit b95102215a8d0987789715ce11c0d4ec031cbfbe ] + +Fix the suspend/resume path by ensuring the rtnl lock is held where +required. Calls to sh_eth_close, sh_eth_open and wol operations must be +performed under the rtnl lock to prevent conflicts with ongoing ndo +operations. + +Fixes: b71af04676e9 ("sh_eth: add more PM methods") +Tested-by: Niklas Söderlund +Reviewed-by: Sergey Shtylyov +Signed-off-by: Kory Maincent +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/renesas/sh_eth.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c +index 7a25903e35c30..bc12c0c7347f6 100644 +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -3494,10 +3494,12 @@ static int sh_eth_suspend(struct device *dev) + + netif_device_detach(ndev); + ++ rtnl_lock(); + if (mdp->wol_enabled) + ret = sh_eth_wol_setup(ndev); + else + ret = sh_eth_close(ndev); ++ rtnl_unlock(); + + return ret; + } +@@ -3511,10 +3513,12 @@ static int sh_eth_resume(struct device *dev) + if (!netif_running(ndev)) + return 0; + ++ rtnl_lock(); + if (mdp->wol_enabled) + ret = sh_eth_wol_restore(ndev); + else + ret = sh_eth_open(ndev); ++ rtnl_unlock(); + + if (ret < 0) + return ret; +-- +2.39.5 + diff --git a/queue-6.12/net-smc-fix-data-error-when-recvmsg-with-msg_peek-fl.patch b/queue-6.12/net-smc-fix-data-error-when-recvmsg-with-msg_peek-fl.patch new file mode 100644 index 0000000000..b0b261eb52 --- /dev/null +++ b/queue-6.12/net-smc-fix-data-error-when-recvmsg-with-msg_peek-fl.patch @@ -0,0 +1,244 @@ +From 4067a2d0442de11cb947e455b2f1604f084bfb24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Jan 2025 22:32:01 +0800 +Subject: net/smc: fix data error when recvmsg with MSG_PEEK flag + +From: Guangguan Wang + +[ Upstream commit a4b6539038c1aa1ae871aacf6e41b566c3613993 ] + +When recvmsg with MSG_PEEK flag, the data will be copied to +user's buffer without advancing consume cursor and without +reducing the length of rx available data. Once the expected +peek length is larger than the value of bytes_to_rcv, in the +loop of do while in smc_rx_recvmsg, the first loop will copy +bytes_to_rcv bytes of data from the position local_tx_ctrl.cons, +the second loop will copy the min(bytes_to_rcv, read_remaining) +bytes from the position local_tx_ctrl.cons again because of the +lacking of process with advancing consume cursor and reducing +the length of available data. So do the subsequent loops. The +data copied in the second loop and the subsequent loops will +result in data error, as it should not be copied if no more data +arrives and it should be copied from the position advancing +bytes_to_rcv bytes from the local_tx_ctrl.cons if more data arrives. + +This issue can be reproduce by the following python script: +server.py: +import socket +import time +server_ip = '0.0.0.0' +server_port = 12346 +server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) +server_socket.bind((server_ip, server_port)) +server_socket.listen(1) +print('Server is running and listening for connections...') +conn, addr = server_socket.accept() +print('Connected by', addr) +while True: + data = conn.recv(1024) + if not data: + break + print('Received request:', data.decode()) + conn.sendall(b'Hello, client!\n') + time.sleep(5) + conn.sendall(b'Hello, again!\n') +conn.close() + +client.py: +import socket +server_ip = '' +server_port = 12346 +resp=b'Hello, client!\nHello, again!\n' +client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) +client_socket.connect((server_ip, server_port)) +request = 'Hello, server!' +client_socket.sendall(request.encode()) +peek_data = client_socket.recv(len(resp), + socket.MSG_PEEK | socket.MSG_WAITALL) +print('Peeked data:', peek_data.decode()) +client_socket.close() + +Fixes: 952310ccf2d8 ("smc: receive data from RMBE") +Reported-by: D. Wythe +Signed-off-by: Guangguan Wang +Link: https://patch.msgid.link/20250104143201.35529-1-guangguan.wang@linux.alibaba.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/smc/af_smc.c | 2 +- + net/smc/smc_rx.c | 37 +++++++++++++++++++++---------------- + net/smc/smc_rx.h | 8 ++++---- + 3 files changed, 26 insertions(+), 21 deletions(-) + +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index 6cc7b846cff1b..ebc41a7b13dbe 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -2738,7 +2738,7 @@ int smc_accept(struct socket *sock, struct socket *new_sock, + release_sock(clcsk); + } else if (!atomic_read(&smc_sk(nsk)->conn.bytes_to_rcv)) { + lock_sock(nsk); +- smc_rx_wait(smc_sk(nsk), &timeo, smc_rx_data_available); ++ smc_rx_wait(smc_sk(nsk), &timeo, 0, smc_rx_data_available); + release_sock(nsk); + } + } +diff --git a/net/smc/smc_rx.c b/net/smc/smc_rx.c +index f0cbe77a80b44..79047721df511 100644 +--- a/net/smc/smc_rx.c ++++ b/net/smc/smc_rx.c +@@ -238,22 +238,23 @@ static int smc_rx_splice(struct pipe_inode_info *pipe, char *src, size_t len, + return -ENOMEM; + } + +-static int smc_rx_data_available_and_no_splice_pend(struct smc_connection *conn) ++static int smc_rx_data_available_and_no_splice_pend(struct smc_connection *conn, size_t peeked) + { +- return atomic_read(&conn->bytes_to_rcv) && ++ return smc_rx_data_available(conn, peeked) && + !atomic_read(&conn->splice_pending); + } + + /* blocks rcvbuf consumer until >=len bytes available or timeout or interrupted + * @smc smc socket + * @timeo pointer to max seconds to wait, pointer to value 0 for no timeout ++ * @peeked number of bytes already peeked + * @fcrit add'l criterion to evaluate as function pointer + * Returns: + * 1 if at least 1 byte available in rcvbuf or if socket error/shutdown. + * 0 otherwise (nothing in rcvbuf nor timeout, e.g. interrupted). + */ +-int smc_rx_wait(struct smc_sock *smc, long *timeo, +- int (*fcrit)(struct smc_connection *conn)) ++int smc_rx_wait(struct smc_sock *smc, long *timeo, size_t peeked, ++ int (*fcrit)(struct smc_connection *conn, size_t baseline)) + { + DEFINE_WAIT_FUNC(wait, woken_wake_function); + struct smc_connection *conn = &smc->conn; +@@ -262,7 +263,7 @@ int smc_rx_wait(struct smc_sock *smc, long *timeo, + struct sock *sk = &smc->sk; + int rc; + +- if (fcrit(conn)) ++ if (fcrit(conn, peeked)) + return 1; + sk_set_bit(SOCKWQ_ASYNC_WAITDATA, sk); + add_wait_queue(sk_sleep(sk), &wait); +@@ -271,7 +272,7 @@ int smc_rx_wait(struct smc_sock *smc, long *timeo, + cflags->peer_conn_abort || + READ_ONCE(sk->sk_shutdown) & RCV_SHUTDOWN || + conn->killed || +- fcrit(conn), ++ fcrit(conn, peeked), + &wait); + remove_wait_queue(sk_sleep(sk), &wait); + sk_clear_bit(SOCKWQ_ASYNC_WAITDATA, sk); +@@ -322,11 +323,11 @@ static int smc_rx_recv_urg(struct smc_sock *smc, struct msghdr *msg, int len, + return -EAGAIN; + } + +-static bool smc_rx_recvmsg_data_available(struct smc_sock *smc) ++static bool smc_rx_recvmsg_data_available(struct smc_sock *smc, size_t peeked) + { + struct smc_connection *conn = &smc->conn; + +- if (smc_rx_data_available(conn)) ++ if (smc_rx_data_available(conn, peeked)) + return true; + else if (conn->urg_state == SMC_URG_VALID) + /* we received a single urgent Byte - skip */ +@@ -344,10 +345,10 @@ static bool smc_rx_recvmsg_data_available(struct smc_sock *smc) + int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg, + struct pipe_inode_info *pipe, size_t len, int flags) + { +- size_t copylen, read_done = 0, read_remaining = len; ++ size_t copylen, read_done = 0, read_remaining = len, peeked_bytes = 0; + size_t chunk_len, chunk_off, chunk_len_sum; + struct smc_connection *conn = &smc->conn; +- int (*func)(struct smc_connection *conn); ++ int (*func)(struct smc_connection *conn, size_t baseline); + union smc_host_cursor cons; + int readable, chunk; + char *rcvbuf_base; +@@ -384,14 +385,14 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg, + if (conn->killed) + break; + +- if (smc_rx_recvmsg_data_available(smc)) ++ if (smc_rx_recvmsg_data_available(smc, peeked_bytes)) + goto copy; + + if (sk->sk_shutdown & RCV_SHUTDOWN) { + /* smc_cdc_msg_recv_action() could have run after + * above smc_rx_recvmsg_data_available() + */ +- if (smc_rx_recvmsg_data_available(smc)) ++ if (smc_rx_recvmsg_data_available(smc, peeked_bytes)) + goto copy; + break; + } +@@ -425,26 +426,28 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg, + } + } + +- if (!smc_rx_data_available(conn)) { +- smc_rx_wait(smc, &timeo, smc_rx_data_available); ++ if (!smc_rx_data_available(conn, peeked_bytes)) { ++ smc_rx_wait(smc, &timeo, peeked_bytes, smc_rx_data_available); + continue; + } + + copy: + /* initialize variables for 1st iteration of subsequent loop */ + /* could be just 1 byte, even after waiting on data above */ +- readable = atomic_read(&conn->bytes_to_rcv); ++ readable = smc_rx_data_available(conn, peeked_bytes); + splbytes = atomic_read(&conn->splice_pending); + if (!readable || (msg && splbytes)) { + if (splbytes) + func = smc_rx_data_available_and_no_splice_pend; + else + func = smc_rx_data_available; +- smc_rx_wait(smc, &timeo, func); ++ smc_rx_wait(smc, &timeo, peeked_bytes, func); + continue; + } + + smc_curs_copy(&cons, &conn->local_tx_ctrl.cons, conn); ++ if ((flags & MSG_PEEK) && peeked_bytes) ++ smc_curs_add(conn->rmb_desc->len, &cons, peeked_bytes); + /* subsequent splice() calls pick up where previous left */ + if (splbytes) + smc_curs_add(conn->rmb_desc->len, &cons, splbytes); +@@ -480,6 +483,8 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg, + } + read_remaining -= chunk_len; + read_done += chunk_len; ++ if (flags & MSG_PEEK) ++ peeked_bytes += chunk_len; + + if (chunk_len_sum == copylen) + break; /* either on 1st or 2nd iteration */ +diff --git a/net/smc/smc_rx.h b/net/smc/smc_rx.h +index db823c97d824e..994f5e42d1ba2 100644 +--- a/net/smc/smc_rx.h ++++ b/net/smc/smc_rx.h +@@ -21,11 +21,11 @@ void smc_rx_init(struct smc_sock *smc); + + int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg, + struct pipe_inode_info *pipe, size_t len, int flags); +-int smc_rx_wait(struct smc_sock *smc, long *timeo, +- int (*fcrit)(struct smc_connection *conn)); +-static inline int smc_rx_data_available(struct smc_connection *conn) ++int smc_rx_wait(struct smc_sock *smc, long *timeo, size_t peeked, ++ int (*fcrit)(struct smc_connection *conn, size_t baseline)); ++static inline int smc_rx_data_available(struct smc_connection *conn, size_t peeked) + { +- return atomic_read(&conn->bytes_to_rcv); ++ return atomic_read(&conn->bytes_to_rcv) - peeked; + } + + #endif /* SMC_RX_H */ +-- +2.39.5 + diff --git a/queue-6.12/net-stmmac-limit-fifo-size-by-hardware-capability.patch b/queue-6.12/net-stmmac-limit-fifo-size-by-hardware-capability.patch new file mode 100644 index 0000000000..5440071bf9 --- /dev/null +++ b/queue-6.12/net-stmmac-limit-fifo-size-by-hardware-capability.patch @@ -0,0 +1,57 @@ +From f01d7307c2f3888ac791468d9b107ec17a7ec700 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Jan 2025 10:38:19 +0900 +Subject: net: stmmac: Limit FIFO size by hardware capability + +From: Kunihiko Hayashi + +[ Upstream commit 044f2fbaa2725696ecbf1f02ba7ab0a8ccb7e1ae ] + +Tx/Rx FIFO size is specified by the parameter "{tx,rx}-fifo-depth" from +stmmac_platform layer. + +However, these values are constrained by upper limits determined by the +capabilities of each hardware feature. There is a risk that the upper +bits will be truncated due to the calculation, so it's appropriate to +limit them to the upper limit values and display a warning message. + +This only works if the hardware capability has the upper limit values. + +Fixes: e7877f52fd4a ("stmmac: Read tx-fifo-depth and rx-fifo-depth from the devicetree") +Signed-off-by: Kunihiko Hayashi +Reviewed-by: Yanteng Si +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 7b1ae6f397fb9..918d7f2e8ba99 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -7251,6 +7251,21 @@ static int stmmac_hw_init(struct stmmac_priv *priv) + priv->plat->tx_queues_to_use = priv->dma_cap.number_tx_queues; + } + ++ if (priv->dma_cap.rx_fifo_size && ++ priv->plat->rx_fifo_size > priv->dma_cap.rx_fifo_size) { ++ dev_warn(priv->device, ++ "Rx FIFO size (%u) exceeds dma capability\n", ++ priv->plat->rx_fifo_size); ++ priv->plat->rx_fifo_size = priv->dma_cap.rx_fifo_size; ++ } ++ if (priv->dma_cap.tx_fifo_size && ++ priv->plat->tx_fifo_size > priv->dma_cap.tx_fifo_size) { ++ dev_warn(priv->device, ++ "Tx FIFO size (%u) exceeds dma capability\n", ++ priv->plat->tx_fifo_size); ++ priv->plat->tx_fifo_size = priv->dma_cap.tx_fifo_size; ++ } ++ + priv->hw->vlan_fail_q_en = + (priv->plat->flags & STMMAC_FLAG_VLAN_FAIL_Q_EN); + priv->hw->vlan_fail_q = priv->plat->vlan_fail_q; +-- +2.39.5 + diff --git a/queue-6.12/net-stmmac-limit-the-number-of-mtl-queues-to-hardwar.patch b/queue-6.12/net-stmmac-limit-the-number-of-mtl-queues-to-hardwar.patch new file mode 100644 index 0000000000..78a24ce2ab --- /dev/null +++ b/queue-6.12/net-stmmac-limit-the-number-of-mtl-queues-to-hardwar.patch @@ -0,0 +1,57 @@ +From 350148b5f944a0e23242e341a52d6dbe1edb6a87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Jan 2025 10:38:18 +0900 +Subject: net: stmmac: Limit the number of MTL queues to hardware capability + +From: Kunihiko Hayashi + +[ Upstream commit f5fb35a3d6b36d378b2e2ecbfb9caa337d5428e6 ] + +The number of MTL queues to use is specified by the parameter +"snps,{tx,rx}-queues-to-use" from stmmac_platform layer. + +However, the maximum numbers of queues are constrained by upper limits +determined by the capability of each hardware feature. It's appropriate +to limit the values not to exceed the upper limit values and display +a warning message. + +This only works if the hardware capability has the upper limit values. + +Fixes: d976a525c371 ("net: stmmac: multiple queues dt configuration") +Signed-off-by: Kunihiko Hayashi +Reviewed-by: Yanteng Si +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index cf7b59b8cc64b..7b1ae6f397fb9 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -7236,6 +7236,21 @@ static int stmmac_hw_init(struct stmmac_priv *priv) + if (priv->dma_cap.tsoen) + dev_info(priv->device, "TSO supported\n"); + ++ if (priv->dma_cap.number_rx_queues && ++ priv->plat->rx_queues_to_use > priv->dma_cap.number_rx_queues) { ++ dev_warn(priv->device, ++ "Number of Rx queues (%u) exceeds dma capability\n", ++ priv->plat->rx_queues_to_use); ++ priv->plat->rx_queues_to_use = priv->dma_cap.number_rx_queues; ++ } ++ if (priv->dma_cap.number_tx_queues && ++ priv->plat->tx_queues_to_use > priv->dma_cap.number_tx_queues) { ++ dev_warn(priv->device, ++ "Number of Tx queues (%u) exceeds dma capability\n", ++ priv->plat->tx_queues_to_use); ++ priv->plat->tx_queues_to_use = priv->dma_cap.number_tx_queues; ++ } ++ + priv->hw->vlan_fail_q_en = + (priv->plat->flags & STMMAC_FLAG_VLAN_FAIL_Q_EN); + priv->hw->vlan_fail_q = priv->plat->vlan_fail_q; +-- +2.39.5 + diff --git a/queue-6.12/net-xdp-disallow-attaching-device-bound-programs-in-.patch b/queue-6.12/net-xdp-disallow-attaching-device-bound-programs-in-.patch new file mode 100644 index 0000000000..7501ac5c6d --- /dev/null +++ b/queue-6.12/net-xdp-disallow-attaching-device-bound-programs-in-.patch @@ -0,0 +1,55 @@ +From df6ed505cf8b68989cb8f1cad0a49387a4434ca1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Jan 2025 14:13:42 +0100 +Subject: net: xdp: Disallow attaching device-bound programs in generic mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +[ Upstream commit 3595599fa8360bb3c7afa7ee50c810b4a64106ea ] + +Device-bound programs are used to support RX metadata kfuncs. These +kfuncs are driver-specific and rely on the driver context to read the +metadata. This means they can't work in generic XDP mode. However, there +is no check to disallow such programs from being attached in generic +mode, in which case the metadata kfuncs will be called in an invalid +context, leading to crashes. + +Fix this by adding a check to disallow attaching device-bound programs +in generic mode. + +Fixes: 2b3486bc2d23 ("bpf: Introduce device-bound XDP programs") +Reported-by: Marcus Wichelmann +Closes: https://lore.kernel.org/r/dae862ec-43b5-41a0-8edf-46c59071cdda@hetzner-cloud.de +Tested-by: Marcus Wichelmann +Acked-by: Stanislav Fomichev +Signed-off-by: Toke Høiland-Jørgensen +Acked-by: Daniel Borkmann +Acked-by: Martin KaFai Lau +Link: https://patch.msgid.link/20250127131344.238147-1-toke@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/dev.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/core/dev.c b/net/core/dev.c +index 7c3e2a448e5c6..2e0fe38d0e877 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -9595,6 +9595,10 @@ static int dev_xdp_attach(struct net_device *dev, struct netlink_ext_ack *extack + NL_SET_ERR_MSG(extack, "Program bound to different device"); + return -EINVAL; + } ++ if (bpf_prog_is_dev_bound(new_prog->aux) && mode == XDP_MODE_SKB) { ++ NL_SET_ERR_MSG(extack, "Can't attach device-bound programs in generic mode"); ++ return -EINVAL; ++ } + if (new_prog->expected_attach_type == BPF_XDP_DEVMAP) { + NL_SET_ERR_MSG(extack, "BPF_XDP_DEVMAP programs can not be attached to a device"); + return -EINVAL; +-- +2.39.5 + diff --git a/queue-6.12/net_sched-sch_sfq-don-t-allow-1-packet-limit.patch b/queue-6.12/net_sched-sch_sfq-don-t-allow-1-packet-limit.patch new file mode 100644 index 0000000000..0e5631de91 --- /dev/null +++ b/queue-6.12/net_sched-sch_sfq-don-t-allow-1-packet-limit.patch @@ -0,0 +1,116 @@ +From 4538e88c527b4b6ae99726a132b570f50d15459c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Dec 2024 19:05:19 -0800 +Subject: net_sched: sch_sfq: don't allow 1 packet limit + +From: Octavian Purdila + +[ Upstream commit 10685681bafce6febb39770f3387621bf5d67d0b ] + +The current implementation does not work correctly with a limit of +1. iproute2 actually checks for this and this patch adds the check in +kernel as well. + +This fixes the following syzkaller reported crash: + +UBSAN: array-index-out-of-bounds in net/sched/sch_sfq.c:210:6 +index 65535 is out of range for type 'struct sfq_head[128]' +CPU: 0 PID: 2569 Comm: syz-executor101 Not tainted 5.10.0-smp-DEV #1 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 +Call Trace: + __dump_stack lib/dump_stack.c:79 [inline] + dump_stack+0x125/0x19f lib/dump_stack.c:120 + ubsan_epilogue lib/ubsan.c:148 [inline] + __ubsan_handle_out_of_bounds+0xed/0x120 lib/ubsan.c:347 + sfq_link net/sched/sch_sfq.c:210 [inline] + sfq_dec+0x528/0x600 net/sched/sch_sfq.c:238 + sfq_dequeue+0x39b/0x9d0 net/sched/sch_sfq.c:500 + sfq_reset+0x13/0x50 net/sched/sch_sfq.c:525 + qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026 + tbf_reset+0x3d/0x100 net/sched/sch_tbf.c:319 + qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026 + dev_reset_queue+0x8c/0x140 net/sched/sch_generic.c:1296 + netdev_for_each_tx_queue include/linux/netdevice.h:2350 [inline] + dev_deactivate_many+0x6dc/0xc20 net/sched/sch_generic.c:1362 + __dev_close_many+0x214/0x350 net/core/dev.c:1468 + dev_close_many+0x207/0x510 net/core/dev.c:1506 + unregister_netdevice_many+0x40f/0x16b0 net/core/dev.c:10738 + unregister_netdevice_queue+0x2be/0x310 net/core/dev.c:10695 + unregister_netdevice include/linux/netdevice.h:2893 [inline] + __tun_detach+0x6b6/0x1600 drivers/net/tun.c:689 + tun_detach drivers/net/tun.c:705 [inline] + tun_chr_close+0x104/0x1b0 drivers/net/tun.c:3640 + __fput+0x203/0x840 fs/file_table.c:280 + task_work_run+0x129/0x1b0 kernel/task_work.c:185 + exit_task_work include/linux/task_work.h:33 [inline] + do_exit+0x5ce/0x2200 kernel/exit.c:931 + do_group_exit+0x144/0x310 kernel/exit.c:1046 + __do_sys_exit_group kernel/exit.c:1057 [inline] + __se_sys_exit_group kernel/exit.c:1055 [inline] + __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1055 + do_syscall_64+0x6c/0xd0 + entry_SYSCALL_64_after_hwframe+0x61/0xcb +RIP: 0033:0x7fe5e7b52479 +Code: Unable to access opcode bytes at RIP 0x7fe5e7b5244f. +RSP: 002b:00007ffd3c800398 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 +RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe5e7b52479 +RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 +RBP: 00007fe5e7bcd2d0 R08: ffffffffffffffb8 R09: 0000000000000014 +R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe5e7bcd2d0 +R13: 0000000000000000 R14: 00007fe5e7bcdd20 R15: 00007fe5e7b24270 + +The crash can be also be reproduced with the following (with a tc +recompiled to allow for sfq limits of 1): + +tc qdisc add dev dummy0 handle 1: root tbf rate 1Kbit burst 100b lat 1s +../iproute2-6.9.0/tc/tc qdisc add dev dummy0 handle 2: parent 1:10 sfq limit 1 +ifconfig dummy0 up +ping -I dummy0 -f -c2 -W0.1 8.8.8.8 +sleep 1 + +Scenario that triggers the crash: + +* the first packet is sent and queued in TBF and SFQ; qdisc qlen is 1 + +* TBF dequeues: it peeks from SFQ which moves the packet to the + gso_skb list and keeps qdisc qlen set to 1. TBF is out of tokens so + it schedules itself for later. + +* the second packet is sent and TBF tries to queues it to SFQ. qdisc + qlen is now 2 and because the SFQ limit is 1 the packet is dropped + by SFQ. At this point qlen is 1, and all of the SFQ slots are empty, + however q->tail is not NULL. + +At this point, assuming no more packets are queued, when sch_dequeue +runs again it will decrement the qlen for the current empty slot +causing an underflow and the subsequent out of bounds access. + +Reported-by: syzbot +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Octavian Purdila +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20241204030520.2084663-2-tavip@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_sfq.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c +index a4b8296a2fa1c..65d5b59da5830 100644 +--- a/net/sched/sch_sfq.c ++++ b/net/sched/sch_sfq.c +@@ -652,6 +652,10 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt, + if (!p) + return -ENOMEM; + } ++ if (ctl->limit == 1) { ++ NL_SET_ERR_MSG_MOD(extack, "invalid limit"); ++ return -EINVAL; ++ } + sch_tree_lock(sch); + if (ctl->quantum) + q->quantum = ctl->quantum; +-- +2.39.5 + diff --git a/queue-6.12/net_sched-sch_sfq-handle-bigger-packets.patch b/queue-6.12/net_sched-sch_sfq-handle-bigger-packets.patch new file mode 100644 index 0000000000..45b709f130 --- /dev/null +++ b/queue-6.12/net_sched-sch_sfq-handle-bigger-packets.patch @@ -0,0 +1,167 @@ +From aa0d1fc3744465846947b7b66854cd54381c7649 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 11:16:03 +0000 +Subject: net_sched: sch_sfq: handle bigger packets +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Eric Dumazet + +[ Upstream commit e4650d7ae4252f67e997a632adfae0dd74d3a99a ] + +SFQ has an assumption on dealing with packets smaller than 64KB. + +Even before BIG TCP, TCA_STAB can provide arbitrary big values +in qdisc_pkt_len(skb) + +It is time to switch (struct sfq_slot)->allot to a 32bit field. + +sizeof(struct sfq_slot) is now 64 bytes, giving better cache locality. + +Signed-off-by: Eric Dumazet +Reviewed-by: Toke Høiland-Jørgensen +Link: https://patch.msgid.link/20241008111603.653140-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: 10685681bafc ("net_sched: sch_sfq: don't allow 1 packet limit") +Signed-off-by: Sasha Levin +--- + net/sched/sch_sfq.c | 39 +++++++++++++-------------------------- + 1 file changed, 13 insertions(+), 26 deletions(-) + +diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c +index 3b9245a3c767a..a4b8296a2fa1c 100644 +--- a/net/sched/sch_sfq.c ++++ b/net/sched/sch_sfq.c +@@ -77,12 +77,6 @@ + #define SFQ_EMPTY_SLOT 0xffff + #define SFQ_DEFAULT_HASH_DIVISOR 1024 + +-/* We use 16 bits to store allot, and want to handle packets up to 64K +- * Scale allot by 8 (1<<3) so that no overflow occurs. +- */ +-#define SFQ_ALLOT_SHIFT 3 +-#define SFQ_ALLOT_SIZE(X) DIV_ROUND_UP(X, 1 << SFQ_ALLOT_SHIFT) +- + /* This type should contain at least SFQ_MAX_DEPTH + 1 + SFQ_MAX_FLOWS values */ + typedef u16 sfq_index; + +@@ -104,7 +98,7 @@ struct sfq_slot { + sfq_index next; /* next slot in sfq RR chain */ + struct sfq_head dep; /* anchor in dep[] chains */ + unsigned short hash; /* hash value (index in ht[]) */ +- short allot; /* credit for this slot */ ++ int allot; /* credit for this slot */ + + unsigned int backlog; + struct red_vars vars; +@@ -120,7 +114,6 @@ struct sfq_sched_data { + siphash_key_t perturbation; + u8 cur_depth; /* depth of longest slot */ + u8 flags; +- unsigned short scaled_quantum; /* SFQ_ALLOT_SIZE(quantum) */ + struct tcf_proto __rcu *filter_list; + struct tcf_block *block; + sfq_index *ht; /* Hash table ('divisor' slots) */ +@@ -456,7 +449,7 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free) + */ + q->tail = slot; + /* We could use a bigger initial quantum for new flows */ +- slot->allot = q->scaled_quantum; ++ slot->allot = q->quantum; + } + if (++sch->q.qlen <= q->limit) + return NET_XMIT_SUCCESS; +@@ -493,7 +486,7 @@ sfq_dequeue(struct Qdisc *sch) + slot = &q->slots[a]; + if (slot->allot <= 0) { + q->tail = slot; +- slot->allot += q->scaled_quantum; ++ slot->allot += q->quantum; + goto next_slot; + } + skb = slot_dequeue_head(slot); +@@ -512,7 +505,7 @@ sfq_dequeue(struct Qdisc *sch) + } + q->tail->next = next_a; + } else { +- slot->allot -= SFQ_ALLOT_SIZE(qdisc_pkt_len(skb)); ++ slot->allot -= qdisc_pkt_len(skb); + } + return skb; + } +@@ -595,7 +588,7 @@ static void sfq_rehash(struct Qdisc *sch) + q->tail->next = x; + } + q->tail = slot; +- slot->allot = q->scaled_quantum; ++ slot->allot = q->quantum; + } + } + sch->q.qlen -= dropped; +@@ -628,7 +621,8 @@ static void sfq_perturbation(struct timer_list *t) + rcu_read_unlock(); + } + +-static int sfq_change(struct Qdisc *sch, struct nlattr *opt) ++static int sfq_change(struct Qdisc *sch, struct nlattr *opt, ++ struct netlink_ext_ack *extack) + { + struct sfq_sched_data *q = qdisc_priv(sch); + struct tc_sfq_qopt *ctl = nla_data(opt); +@@ -646,14 +640,10 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt) + (!is_power_of_2(ctl->divisor) || ctl->divisor > 65536)) + return -EINVAL; + +- /* slot->allot is a short, make sure quantum is not too big. */ +- if (ctl->quantum) { +- unsigned int scaled = SFQ_ALLOT_SIZE(ctl->quantum); +- +- if (scaled <= 0 || scaled > SHRT_MAX) +- return -EINVAL; ++ if ((int)ctl->quantum < 0) { ++ NL_SET_ERR_MSG_MOD(extack, "invalid quantum"); ++ return -EINVAL; + } +- + if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max, + ctl_v1->Wlog, ctl_v1->Scell_log, NULL)) + return -EINVAL; +@@ -663,10 +653,8 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt) + return -ENOMEM; + } + sch_tree_lock(sch); +- if (ctl->quantum) { ++ if (ctl->quantum) + q->quantum = ctl->quantum; +- q->scaled_quantum = SFQ_ALLOT_SIZE(q->quantum); +- } + WRITE_ONCE(q->perturb_period, ctl->perturb_period * HZ); + if (ctl->flows) + q->maxflows = min_t(u32, ctl->flows, SFQ_MAX_FLOWS); +@@ -762,12 +750,11 @@ static int sfq_init(struct Qdisc *sch, struct nlattr *opt, + q->divisor = SFQ_DEFAULT_HASH_DIVISOR; + q->maxflows = SFQ_DEFAULT_FLOWS; + q->quantum = psched_mtu(qdisc_dev(sch)); +- q->scaled_quantum = SFQ_ALLOT_SIZE(q->quantum); + q->perturb_period = 0; + get_random_bytes(&q->perturbation, sizeof(q->perturbation)); + + if (opt) { +- int err = sfq_change(sch, opt); ++ int err = sfq_change(sch, opt, extack); + if (err) + return err; + } +@@ -878,7 +865,7 @@ static int sfq_dump_class_stats(struct Qdisc *sch, unsigned long cl, + if (idx != SFQ_EMPTY_SLOT) { + const struct sfq_slot *slot = &q->slots[idx]; + +- xstats.allot = slot->allot << SFQ_ALLOT_SHIFT; ++ xstats.allot = slot->allot; + qs.qlen = slot->qlen; + qs.backlog = slot->backlog; + } +-- +2.39.5 + diff --git a/queue-6.12/netfilter-nf_tables-fix-set-size-with-rbtree-backend.patch b/queue-6.12/netfilter-nf_tables-fix-set-size-with-rbtree-backend.patch new file mode 100644 index 0000000000..8e351f6976 --- /dev/null +++ b/queue-6.12/netfilter-nf_tables-fix-set-size-with-rbtree-backend.patch @@ -0,0 +1,217 @@ +From df6fcb4560e0e9fc510567bdfda472840396f62b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jan 2025 23:40:50 +0100 +Subject: netfilter: nf_tables: fix set size with rbtree backend + +From: Pablo Neira Ayuso + +[ Upstream commit 8d738c1869f611955d91d8d0fd0012d9ef207201 ] + +The existing rbtree implementation uses singleton elements to represent +ranges, however, userspace provides a set size according to the number +of ranges in the set. + +Adjust provided userspace set size to the number of singleton elements +in the kernel by multiplying the range by two. + +Check if the no-match all-zero element is already in the set, in such +case release one slot in the set size. + +Fixes: 0ed6389c483d ("netfilter: nf_tables: rename set implementations") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_tables.h | 6 ++++ + net/netfilter/nf_tables_api.c | 49 +++++++++++++++++++++++++++++-- + net/netfilter/nft_set_rbtree.c | 43 +++++++++++++++++++++++++++ + 3 files changed, 96 insertions(+), 2 deletions(-) + +diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h +index 471c353d32a4a..788513cc384b7 100644 +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -442,6 +442,9 @@ struct nft_set_ext; + * @remove: remove element from set + * @walk: iterate over all set elements + * @get: get set elements ++ * @ksize: kernel set size ++ * @usize: userspace set size ++ * @adjust_maxsize: delta to adjust maximum set size + * @commit: commit set elements + * @abort: abort set elements + * @privsize: function to return size of set private data +@@ -495,6 +498,9 @@ struct nft_set_ops { + const struct nft_set *set, + const struct nft_set_elem *elem, + unsigned int flags); ++ u32 (*ksize)(u32 size); ++ u32 (*usize)(u32 size); ++ u32 (*adjust_maxsize)(const struct nft_set *set); + void (*commit)(struct nft_set *set); + void (*abort)(const struct nft_set *set); + u64 (*privsize)(const struct nlattr * const nla[], +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 42dc8cc721ff7..48affedb0cf3e 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -4647,6 +4647,14 @@ static int nf_tables_fill_set_concat(struct sk_buff *skb, + return 0; + } + ++static u32 nft_set_userspace_size(const struct nft_set_ops *ops, u32 size) ++{ ++ if (ops->usize) ++ return ops->usize(size); ++ ++ return size; ++} ++ + static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, + const struct nft_set *set, u16 event, u16 flags) + { +@@ -4717,7 +4725,8 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, + if (!nest) + goto nla_put_failure; + if (set->size && +- nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size))) ++ nla_put_be32(skb, NFTA_SET_DESC_SIZE, ++ htonl(nft_set_userspace_size(set->ops, set->size)))) + goto nla_put_failure; + + if (set->field_count > 1 && +@@ -5085,6 +5094,15 @@ static bool nft_set_is_same(const struct nft_set *set, + return true; + } + ++static u32 nft_set_kernel_size(const struct nft_set_ops *ops, ++ const struct nft_set_desc *desc) ++{ ++ if (ops->ksize) ++ return ops->ksize(desc->size); ++ ++ return desc->size; ++} ++ + static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info, + const struct nlattr * const nla[]) + { +@@ -5267,6 +5285,9 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info, + if (err < 0) + return err; + ++ if (desc.size) ++ desc.size = nft_set_kernel_size(set->ops, &desc); ++ + err = 0; + if (!nft_set_is_same(set, &desc, exprs, num_exprs, flags)) { + NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]); +@@ -5289,6 +5310,9 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info, + if (IS_ERR(ops)) + return PTR_ERR(ops); + ++ if (desc.size) ++ desc.size = nft_set_kernel_size(ops, &desc); ++ + udlen = 0; + if (nla[NFTA_SET_USERDATA]) + udlen = nla_len(nla[NFTA_SET_USERDATA]); +@@ -6855,6 +6879,27 @@ static bool nft_setelem_valid_key_end(const struct nft_set *set, + return true; + } + ++static u32 nft_set_maxsize(const struct nft_set *set) ++{ ++ u32 maxsize, delta; ++ ++ if (!set->size) ++ return UINT_MAX; ++ ++ if (set->ops->adjust_maxsize) ++ delta = set->ops->adjust_maxsize(set); ++ else ++ delta = 0; ++ ++ if (check_add_overflow(set->size, set->ndeact, &maxsize)) ++ return UINT_MAX; ++ ++ if (check_add_overflow(maxsize, delta, &maxsize)) ++ return UINT_MAX; ++ ++ return maxsize; ++} ++ + static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, + const struct nlattr *attr, u32 nlmsg_flags) + { +@@ -7218,7 +7263,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, + } + + if (!(flags & NFT_SET_ELEM_CATCHALL)) { +- unsigned int max = set->size ? set->size + set->ndeact : UINT_MAX; ++ unsigned int max = nft_set_maxsize(set); + + if (!atomic_add_unless(&set->nelems, 1, max)) { + err = -ENFILE; +diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c +index b7ea21327549b..2e8ef16ff191d 100644 +--- a/net/netfilter/nft_set_rbtree.c ++++ b/net/netfilter/nft_set_rbtree.c +@@ -750,6 +750,46 @@ static void nft_rbtree_gc_init(const struct nft_set *set) + priv->last_gc = jiffies; + } + ++/* rbtree stores ranges as singleton elements, each range is composed of two ++ * elements ... ++ */ ++static u32 nft_rbtree_ksize(u32 size) ++{ ++ return size * 2; ++} ++ ++/* ... hide this detail to userspace. */ ++static u32 nft_rbtree_usize(u32 size) ++{ ++ if (!size) ++ return 0; ++ ++ return size / 2; ++} ++ ++static u32 nft_rbtree_adjust_maxsize(const struct nft_set *set) ++{ ++ struct nft_rbtree *priv = nft_set_priv(set); ++ struct nft_rbtree_elem *rbe; ++ struct rb_node *node; ++ const void *key; ++ ++ node = rb_last(&priv->root); ++ if (!node) ++ return 0; ++ ++ rbe = rb_entry(node, struct nft_rbtree_elem, node); ++ if (!nft_rbtree_interval_end(rbe)) ++ return 0; ++ ++ key = nft_set_ext_key(&rbe->ext); ++ if (memchr(key, 1, set->klen)) ++ return 0; ++ ++ /* this is the all-zero no-match element. */ ++ return 1; ++} ++ + const struct nft_set_type nft_set_rbtree_type = { + .features = NFT_SET_INTERVAL | NFT_SET_MAP | NFT_SET_OBJECT | NFT_SET_TIMEOUT, + .ops = { +@@ -768,5 +808,8 @@ const struct nft_set_type nft_set_rbtree_type = { + .lookup = nft_rbtree_lookup, + .walk = nft_rbtree_walk, + .get = nft_rbtree_get, ++ .ksize = nft_rbtree_ksize, ++ .usize = nft_rbtree_usize, ++ .adjust_maxsize = nft_rbtree_adjust_maxsize, + }, + }; +-- +2.39.5 + diff --git a/queue-6.12/netfilter-nft_flow_offload-update-tcp-state-flags-un.patch b/queue-6.12/netfilter-nft_flow_offload-update-tcp-state-flags-un.patch new file mode 100644 index 0000000000..15e1ded71a --- /dev/null +++ b/queue-6.12/netfilter-nft_flow_offload-update-tcp-state-flags-un.patch @@ -0,0 +1,63 @@ +From 9193706419027ec9bac77ba3bbe77c667daaba97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jan 2025 00:50:34 +0100 +Subject: netfilter: nft_flow_offload: update tcp state flags under lock + +From: Florian Westphal + +[ Upstream commit 7a4b61406395291ffb7220a10e8951a9a8684819 ] + +The conntrack entry is already public, there is a small chance that another +CPU is handling a packet in reply direction and racing with the tcp state +update. + +Move this under ct spinlock. + +This is done once, when ct is about to be offloaded, so this should +not result in a noticeable performance hit. + +Fixes: 8437a6209f76 ("netfilter: nft_flow_offload: set liberal tracking mode for tcp") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_flow_offload.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c +index 2f732fae5a831..da9ebd00b1989 100644 +--- a/net/netfilter/nft_flow_offload.c ++++ b/net/netfilter/nft_flow_offload.c +@@ -289,6 +289,15 @@ static bool nft_flow_offload_skip(struct sk_buff *skb, int family) + return false; + } + ++static void flow_offload_ct_tcp(struct nf_conn *ct) ++{ ++ /* conntrack will not see all packets, disable tcp window validation. */ ++ spin_lock_bh(&ct->lock); ++ ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; ++ ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; ++ spin_unlock_bh(&ct->lock); ++} ++ + static void nft_flow_offload_eval(const struct nft_expr *expr, + struct nft_regs *regs, + const struct nft_pktinfo *pkt) +@@ -356,11 +365,8 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, + goto err_flow_alloc; + + flow_offload_route_init(flow, &route); +- +- if (tcph) { +- ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; +- ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; +- } ++ if (tcph) ++ flow_offload_ct_tcp(ct); + + __set_bit(NF_FLOW_HW_BIDIRECTIONAL, &flow->flags); + ret = flow_offload_add(flowtable, flow); +-- +2.39.5 + diff --git a/queue-6.12/nfs-fix-incorrect-error-handling-in-localio.patch b/queue-6.12/nfs-fix-incorrect-error-handling-in-localio.patch new file mode 100644 index 0000000000..893ffc4683 --- /dev/null +++ b/queue-6.12/nfs-fix-incorrect-error-handling-in-localio.patch @@ -0,0 +1,243 @@ +From 25befbf613f2b22daa51f06e02c8e58764acaed1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 17:29:03 -0500 +Subject: nfs: fix incorrect error handling in LOCALIO + +From: Mike Snitzer + +[ Upstream commit ead11ac50ad4b8ef1b64806e962ea984862d96ad ] + +nfs4_stat_to_errno() expects a NFSv4 error code as an argument and +returns a POSIX errno. + +The problem is LOCALIO is passing nfs4_stat_to_errno() the POSIX errno +return values from filp->f_op->read_iter(), filp->f_op->write_iter() +and vfs_fsync_range(). + +So the POSIX errno that nfs_local_pgio_done() and +nfs_local_commit_done() are passing to nfs4_stat_to_errno() are +failing to match any NFSv4 error code, which results in +nfs4_stat_to_errno() defaulting to returning -EREMOTEIO. This causes +assertions in upper layers due to -EREMOTEIO not being a valid NFSv4 +error code. + +Fix this by updating nfs_local_pgio_done() and nfs_local_commit_done() +to use the new nfs_localio_errno_to_nfs4_stat() to map a POSIX errno +to an NFSv4 error code. + +Care was taken to factor out nfs4_errtbl_common[] to avoid duplicating +the same NFS error to errno table. nfs4_errtbl_common[] is checked +first by both nfs4_stat_to_errno and nfs_localio_errno_to_nfs4_stat +before they check their own more specialized tables (nfs4_errtbl[] and +nfs4_errtbl_localio[] respectively). + +While auditing the associated error mapping tables, the (ab)use of -1 +for the last table entry was removed in favor of using ARRAY_SIZE to +iterate the nfs_errtbl[] and nfs4_errtbl[]. And 'errno_NFSERR_IO' was +removed because it caused needless obfuscation. + +Fixes: 70ba381e1a431 ("nfs: add LOCALIO support") +Reported-by: Trond Myklebust +Signed-off-by: Mike Snitzer +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/localio.c | 4 +- + fs/nfs_common/common.c | 89 +++++++++++++++++++++++++++++++++----- + include/linux/nfs_common.h | 3 +- + 3 files changed, 82 insertions(+), 14 deletions(-) + +diff --git a/fs/nfs/localio.c b/fs/nfs/localio.c +index 637528e6368ef..21b2b38fae9f3 100644 +--- a/fs/nfs/localio.c ++++ b/fs/nfs/localio.c +@@ -331,7 +331,7 @@ nfs_local_pgio_done(struct nfs_pgio_header *hdr, long status) + hdr->res.op_status = NFS4_OK; + hdr->task.tk_status = 0; + } else { +- hdr->res.op_status = nfs4_stat_to_errno(status); ++ hdr->res.op_status = nfs_localio_errno_to_nfs4_stat(status); + hdr->task.tk_status = status; + } + } +@@ -669,7 +669,7 @@ nfs_local_commit_done(struct nfs_commit_data *data, int status) + data->task.tk_status = 0; + } else { + nfs_reset_boot_verifier(data->inode); +- data->res.op_status = nfs4_stat_to_errno(status); ++ data->res.op_status = nfs_localio_errno_to_nfs4_stat(status); + data->task.tk_status = status; + } + } +diff --git a/fs/nfs_common/common.c b/fs/nfs_common/common.c +index 34a115176f97e..af09aed09fd27 100644 +--- a/fs/nfs_common/common.c ++++ b/fs/nfs_common/common.c +@@ -15,7 +15,7 @@ static const struct { + { NFS_OK, 0 }, + { NFSERR_PERM, -EPERM }, + { NFSERR_NOENT, -ENOENT }, +- { NFSERR_IO, -errno_NFSERR_IO}, ++ { NFSERR_IO, -EIO }, + { NFSERR_NXIO, -ENXIO }, + /* { NFSERR_EAGAIN, -EAGAIN }, */ + { NFSERR_ACCES, -EACCES }, +@@ -45,7 +45,6 @@ static const struct { + { NFSERR_SERVERFAULT, -EREMOTEIO }, + { NFSERR_BADTYPE, -EBADTYPE }, + { NFSERR_JUKEBOX, -EJUKEBOX }, +- { -1, -EIO } + }; + + /** +@@ -59,26 +58,29 @@ int nfs_stat_to_errno(enum nfs_stat status) + { + int i; + +- for (i = 0; nfs_errtbl[i].stat != -1; i++) { ++ for (i = 0; i < ARRAY_SIZE(nfs_errtbl); i++) { + if (nfs_errtbl[i].stat == (int)status) + return nfs_errtbl[i].errno; + } +- return nfs_errtbl[i].errno; ++ return -EIO; + } + EXPORT_SYMBOL_GPL(nfs_stat_to_errno); + + /* + * We need to translate between nfs v4 status return values and + * the local errno values which may not be the same. ++ * ++ * nfs4_errtbl_common[] is used before more specialized mappings ++ * available in nfs4_errtbl[] or nfs4_errtbl_localio[]. + */ + static const struct { + int stat; + int errno; +-} nfs4_errtbl[] = { ++} nfs4_errtbl_common[] = { + { NFS4_OK, 0 }, + { NFS4ERR_PERM, -EPERM }, + { NFS4ERR_NOENT, -ENOENT }, +- { NFS4ERR_IO, -errno_NFSERR_IO}, ++ { NFS4ERR_IO, -EIO }, + { NFS4ERR_NXIO, -ENXIO }, + { NFS4ERR_ACCESS, -EACCES }, + { NFS4ERR_EXIST, -EEXIST }, +@@ -98,15 +100,20 @@ static const struct { + { NFS4ERR_BAD_COOKIE, -EBADCOOKIE }, + { NFS4ERR_NOTSUPP, -ENOTSUPP }, + { NFS4ERR_TOOSMALL, -ETOOSMALL }, +- { NFS4ERR_SERVERFAULT, -EREMOTEIO }, + { NFS4ERR_BADTYPE, -EBADTYPE }, +- { NFS4ERR_LOCKED, -EAGAIN }, + { NFS4ERR_SYMLINK, -ELOOP }, +- { NFS4ERR_OP_ILLEGAL, -EOPNOTSUPP }, + { NFS4ERR_DEADLOCK, -EDEADLK }, ++}; ++ ++static const struct { ++ int stat; ++ int errno; ++} nfs4_errtbl[] = { ++ { NFS4ERR_SERVERFAULT, -EREMOTEIO }, ++ { NFS4ERR_LOCKED, -EAGAIN }, ++ { NFS4ERR_OP_ILLEGAL, -EOPNOTSUPP }, + { NFS4ERR_NOXATTR, -ENODATA }, + { NFS4ERR_XATTR2BIG, -E2BIG }, +- { -1, -EIO } + }; + + /* +@@ -116,7 +123,14 @@ static const struct { + int nfs4_stat_to_errno(int stat) + { + int i; +- for (i = 0; nfs4_errtbl[i].stat != -1; i++) { ++ ++ /* First check nfs4_errtbl_common */ ++ for (i = 0; i < ARRAY_SIZE(nfs4_errtbl_common); i++) { ++ if (nfs4_errtbl_common[i].stat == stat) ++ return nfs4_errtbl_common[i].errno; ++ } ++ /* Then check nfs4_errtbl */ ++ for (i = 0; i < ARRAY_SIZE(nfs4_errtbl); i++) { + if (nfs4_errtbl[i].stat == stat) + return nfs4_errtbl[i].errno; + } +@@ -132,3 +146,56 @@ int nfs4_stat_to_errno(int stat) + return -stat; + } + EXPORT_SYMBOL_GPL(nfs4_stat_to_errno); ++ ++/* ++ * This table is useful for conversion from local errno to NFS error. ++ * It provides more logically correct mappings for use with LOCALIO ++ * (which is focused on converting from errno to NFS status). ++ */ ++static const struct { ++ int stat; ++ int errno; ++} nfs4_errtbl_localio[] = { ++ /* Map errors differently than nfs4_errtbl */ ++ { NFS4ERR_IO, -EREMOTEIO }, ++ { NFS4ERR_DELAY, -EAGAIN }, ++ { NFS4ERR_FBIG, -E2BIG }, ++ /* Map errors not handled by nfs4_errtbl */ ++ { NFS4ERR_STALE, -EBADF }, ++ { NFS4ERR_STALE, -EOPENSTALE }, ++ { NFS4ERR_DELAY, -ETIMEDOUT }, ++ { NFS4ERR_DELAY, -ERESTARTSYS }, ++ { NFS4ERR_DELAY, -ENOMEM }, ++ { NFS4ERR_IO, -ETXTBSY }, ++ { NFS4ERR_IO, -EBUSY }, ++ { NFS4ERR_SERVERFAULT, -ESERVERFAULT }, ++ { NFS4ERR_SERVERFAULT, -ENFILE }, ++ { NFS4ERR_IO, -EUCLEAN }, ++ { NFS4ERR_PERM, -ENOKEY }, ++}; ++ ++/* ++ * Convert an errno to an NFS error code for LOCALIO. ++ */ ++__u32 nfs_localio_errno_to_nfs4_stat(int errno) ++{ ++ int i; ++ ++ /* First check nfs4_errtbl_common */ ++ for (i = 0; i < ARRAY_SIZE(nfs4_errtbl_common); i++) { ++ if (nfs4_errtbl_common[i].errno == errno) ++ return nfs4_errtbl_common[i].stat; ++ } ++ /* Then check nfs4_errtbl_localio */ ++ for (i = 0; i < ARRAY_SIZE(nfs4_errtbl_localio); i++) { ++ if (nfs4_errtbl_localio[i].errno == errno) ++ return nfs4_errtbl_localio[i].stat; ++ } ++ /* If we cannot translate the error, the recovery routines should ++ * handle it. ++ * Note: remaining NFSv4 error codes have values > 10000, so should ++ * not conflict with native Linux error codes. ++ */ ++ return NFS4ERR_SERVERFAULT; ++} ++EXPORT_SYMBOL_GPL(nfs_localio_errno_to_nfs4_stat); +diff --git a/include/linux/nfs_common.h b/include/linux/nfs_common.h +index 5fc02df882521..a541c3a028875 100644 +--- a/include/linux/nfs_common.h ++++ b/include/linux/nfs_common.h +@@ -9,9 +9,10 @@ + #include + + /* Mapping from NFS error code to "errno" error code. */ +-#define errno_NFSERR_IO EIO + + int nfs_stat_to_errno(enum nfs_stat status); + int nfs4_stat_to_errno(int stat); + ++__u32 nfs_localio_errno_to_nfs4_stat(int errno); ++ + #endif /* _LINUX_NFS_COMMON_H */ +-- +2.39.5 + diff --git a/queue-6.12/nfsv4.2-fix-copy_notify-xdr-buf-size-calculation.patch b/queue-6.12/nfsv4.2-fix-copy_notify-xdr-buf-size-calculation.patch new file mode 100644 index 0000000000..6b8c0789e9 --- /dev/null +++ b/queue-6.12/nfsv4.2-fix-copy_notify-xdr-buf-size-calculation.patch @@ -0,0 +1,38 @@ +From da878e36ceb13925cab0cdaa1ee8c89c468506ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Dec 2024 11:52:00 -0500 +Subject: NFSv4.2: fix COPY_NOTIFY xdr buf size calculation + +From: Olga Kornievskaia + +[ Upstream commit e8380c2d06055665b3df6c03964911375d7f9290 ] + +We need to include sequence size in the compound. + +Fixes: 0491567b51ef ("NFS: add COPY_NOTIFY operation") +Signed-off-by: Olga Kornievskaia +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs42xdr.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/nfs/nfs42xdr.c b/fs/nfs/nfs42xdr.c +index 9e3ae53e22058..becc3149aa9e5 100644 +--- a/fs/nfs/nfs42xdr.c ++++ b/fs/nfs/nfs42xdr.c +@@ -144,9 +144,11 @@ + decode_putfh_maxsz + \ + decode_offload_cancel_maxsz) + #define NFS4_enc_copy_notify_sz (compound_encode_hdr_maxsz + \ ++ encode_sequence_maxsz + \ + encode_putfh_maxsz + \ + encode_copy_notify_maxsz) + #define NFS4_dec_copy_notify_sz (compound_decode_hdr_maxsz + \ ++ decode_sequence_maxsz + \ + decode_putfh_maxsz + \ + decode_copy_notify_maxsz) + #define NFS4_enc_deallocate_sz (compound_encode_hdr_maxsz + \ +-- +2.39.5 + diff --git a/queue-6.12/nfsv4.2-mark-offload_cancel-moveable.patch b/queue-6.12/nfsv4.2-mark-offload_cancel-moveable.patch new file mode 100644 index 0000000000..5da7551b31 --- /dev/null +++ b/queue-6.12/nfsv4.2-mark-offload_cancel-moveable.patch @@ -0,0 +1,36 @@ +From 26abd587d05068fa43702921aee56bc7f12a06b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Dec 2024 11:52:01 -0500 +Subject: NFSv4.2: mark OFFLOAD_CANCEL MOVEABLE + +From: Olga Kornievskaia + +[ Upstream commit 668135b9348c53fd205f5e07d11e82b10f31b55b ] + +OFFLOAD_CANCEL should be marked MOVEABLE for when we need to move +tasks off a non-functional transport. + +Fixes: c975c2092657 ("NFS send OFFLOAD_CANCEL when COPY killed") +Signed-off-by: Olga Kornievskaia +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs42proc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c +index 531c9c20ef1d1..9f0d69e652644 100644 +--- a/fs/nfs/nfs42proc.c ++++ b/fs/nfs/nfs42proc.c +@@ -552,7 +552,7 @@ static int nfs42_do_offload_cancel_async(struct file *dst, + .rpc_message = &msg, + .callback_ops = &nfs42_offload_cancel_ops, + .workqueue = nfsiod_workqueue, +- .flags = RPC_TASK_ASYNC, ++ .flags = RPC_TASK_ASYNC | RPC_TASK_MOVEABLE, + }; + int status; + +-- +2.39.5 + diff --git a/queue-6.12/nilfs2-do-not-force-clear-folio-if-buffer-is-referen.patch b/queue-6.12/nilfs2-do-not-force-clear-folio-if-buffer-is-referen.patch new file mode 100644 index 0000000000..3a80165a67 --- /dev/null +++ b/queue-6.12/nilfs2-do-not-force-clear-folio-if-buffer-is-referen.patch @@ -0,0 +1,155 @@ +From 98dfb73dfecf4cfca40be48cbb8943e677cdeed9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 05:00:46 +0900 +Subject: nilfs2: do not force clear folio if buffer is referenced + +From: Ryusuke Konishi + +[ Upstream commit ca76bb226bf47ff04c782cacbd299f12ddee1ec1 ] + +Patch series "nilfs2: protect busy buffer heads from being force-cleared". + +This series fixes the buffer head state inconsistency issues reported by +syzbot that occurs when the filesystem is corrupted and falls back to +read-only, and the associated buffer head use-after-free issue. + +This patch (of 2): + +Syzbot has reported that after nilfs2 detects filesystem corruption and +falls back to read-only, inconsistencies in the buffer state may occur. + +One of the inconsistencies is that when nilfs2 calls mark_buffer_dirty() +to set a data or metadata buffer as dirty, but it detects that the buffer +is not in the uptodate state: + + WARNING: CPU: 0 PID: 6049 at fs/buffer.c:1177 mark_buffer_dirty+0x2e5/0x520 + fs/buffer.c:1177 + ... + Call Trace: + + nilfs_palloc_commit_alloc_entry+0x4b/0x160 fs/nilfs2/alloc.c:598 + nilfs_ifile_create_inode+0x1dd/0x3a0 fs/nilfs2/ifile.c:73 + nilfs_new_inode+0x254/0x830 fs/nilfs2/inode.c:344 + nilfs_mkdir+0x10d/0x340 fs/nilfs2/namei.c:218 + vfs_mkdir+0x2f9/0x4f0 fs/namei.c:4257 + do_mkdirat+0x264/0x3a0 fs/namei.c:4280 + __do_sys_mkdirat fs/namei.c:4295 [inline] + __se_sys_mkdirat fs/namei.c:4293 [inline] + __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4293 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +The other is when nilfs_btree_propagate(), which propagates the dirty +state to the ancestor nodes of a b-tree that point to a dirty buffer, +detects that the origin buffer is not dirty, even though it should be: + + WARNING: CPU: 0 PID: 5245 at fs/nilfs2/btree.c:2089 + nilfs_btree_propagate+0xc79/0xdf0 fs/nilfs2/btree.c:2089 + ... + Call Trace: + + nilfs_bmap_propagate+0x75/0x120 fs/nilfs2/bmap.c:345 + nilfs_collect_file_data+0x4d/0xd0 fs/nilfs2/segment.c:587 + nilfs_segctor_apply_buffers+0x184/0x340 fs/nilfs2/segment.c:1006 + nilfs_segctor_scan_file+0x28c/0xa50 fs/nilfs2/segment.c:1045 + nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1216 [inline] + nilfs_segctor_collect fs/nilfs2/segment.c:1540 [inline] + nilfs_segctor_do_construct+0x1c28/0x6b90 fs/nilfs2/segment.c:2115 + nilfs_segctor_construct+0x181/0x6b0 fs/nilfs2/segment.c:2479 + nilfs_segctor_thread_construct fs/nilfs2/segment.c:2587 [inline] + nilfs_segctor_thread+0x69e/0xe80 fs/nilfs2/segment.c:2701 + kthread+0x2f0/0x390 kernel/kthread.c:389 + ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 + ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 + + +Both of these issues are caused by the callbacks that handle the +page/folio write requests, forcibly clear various states, including the +working state of the buffers they hold, at unexpected times when they +detect read-only fallback. + +Fix these issues by checking if the buffer is referenced before clearing +the page/folio state, and skipping the clear if it is. + +Link: https://lkml.kernel.org/r/20250107200202.6432-1-konishi.ryusuke@gmail.com +Link: https://lkml.kernel.org/r/20250107200202.6432-2-konishi.ryusuke@gmail.com +Signed-off-by: Ryusuke Konishi +Reported-by: syzbot+b2b14916b77acf8626d7@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=b2b14916b77acf8626d7 +Reported-by: syzbot+d98fd19acd08b36ff422@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?extid=d98fd19acd08b36ff422 +Fixes: 8c26c4e2694a ("nilfs2: fix issue with flush kernel thread after remount in RO mode because of driver's internal error or metadata corruption") +Tested-by: syzbot+b2b14916b77acf8626d7@syzkaller.appspotmail.com +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/nilfs2/page.c | 31 +++++++++++++++++++++++++++---- + 1 file changed, 27 insertions(+), 4 deletions(-) + +diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c +index 6dd8b854cd1f3..06f18fe86407e 100644 +--- a/fs/nilfs2/page.c ++++ b/fs/nilfs2/page.c +@@ -392,6 +392,11 @@ void nilfs_clear_dirty_pages(struct address_space *mapping) + /** + * nilfs_clear_folio_dirty - discard dirty folio + * @folio: dirty folio that will be discarded ++ * ++ * nilfs_clear_folio_dirty() clears working states including dirty state for ++ * the folio and its buffers. If the folio has buffers, clear only if it is ++ * confirmed that none of the buffer heads are busy (none have valid ++ * references and none are locked). + */ + void nilfs_clear_folio_dirty(struct folio *folio) + { +@@ -399,10 +404,6 @@ void nilfs_clear_folio_dirty(struct folio *folio) + + BUG_ON(!folio_test_locked(folio)); + +- folio_clear_uptodate(folio); +- folio_clear_mappedtodisk(folio); +- folio_clear_checked(folio); +- + head = folio_buffers(folio); + if (head) { + const unsigned long clear_bits = +@@ -410,6 +411,25 @@ void nilfs_clear_folio_dirty(struct folio *folio) + BIT(BH_Async_Write) | BIT(BH_NILFS_Volatile) | + BIT(BH_NILFS_Checked) | BIT(BH_NILFS_Redirected) | + BIT(BH_Delay)); ++ bool busy, invalidated = false; ++ ++recheck_buffers: ++ busy = false; ++ bh = head; ++ do { ++ if (atomic_read(&bh->b_count) | buffer_locked(bh)) { ++ busy = true; ++ break; ++ } ++ } while (bh = bh->b_this_page, bh != head); ++ ++ if (busy) { ++ if (invalidated) ++ return; ++ invalidate_bh_lrus(); ++ invalidated = true; ++ goto recheck_buffers; ++ } + + bh = head; + do { +@@ -419,6 +439,9 @@ void nilfs_clear_folio_dirty(struct folio *folio) + } while (bh = bh->b_this_page, bh != head); + } + ++ folio_clear_uptodate(folio); ++ folio_clear_mappedtodisk(folio); ++ folio_clear_checked(folio); + __nilfs_clear_folio_dirty(folio); + } + +-- +2.39.5 + diff --git a/queue-6.12/nilfs2-handle-errors-that-nilfs_prepare_chunk-may-re.patch b/queue-6.12/nilfs2-handle-errors-that-nilfs_prepare_chunk-may-re.patch new file mode 100644 index 0000000000..9139463c55 --- /dev/null +++ b/queue-6.12/nilfs2-handle-errors-that-nilfs_prepare_chunk-may-re.patch @@ -0,0 +1,166 @@ +From 79ed18df7e197bef067cd10ffaa8f11ebfa5ca4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Jan 2025 23:26:35 +0900 +Subject: nilfs2: handle errors that nilfs_prepare_chunk() may return + +From: Ryusuke Konishi + +[ Upstream commit ee70999a988b8abc3490609142f50ebaa8344432 ] + +Patch series "nilfs2: fix issues with rename operations". + +This series fixes BUG_ON check failures reported by syzbot around rename +operations, and a minor behavioral issue where the mtime of a child +directory changes when it is renamed instead of moved. + +This patch (of 2): + +The directory manipulation routines nilfs_set_link() and +nilfs_delete_entry() rewrite the directory entry in the folio/page +previously read by nilfs_find_entry(), so error handling is omitted on the +assumption that nilfs_prepare_chunk(), which prepares the buffer for +rewriting, will always succeed for these. And if an error is returned, it +triggers the legacy BUG_ON() checks in each routine. + +This assumption is wrong, as proven by syzbot: the buffer layer called by +nilfs_prepare_chunk() may call nilfs_get_block() if necessary, which may +fail due to metadata corruption or other reasons. This has been there all +along, but improved sanity checks and error handling may have made it more +reproducible in fuzzing tests. + +Fix this issue by adding missing error paths in nilfs_set_link(), +nilfs_delete_entry(), and their caller nilfs_rename(). + +Link: https://lkml.kernel.org/r/20250111143518.7901-1-konishi.ryusuke@gmail.com +Link: https://lkml.kernel.org/r/20250111143518.7901-2-konishi.ryusuke@gmail.com +Signed-off-by: Ryusuke Konishi +Reported-by: syzbot+32c3706ebf5d95046ea1@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=32c3706ebf5d95046ea1 +Reported-by: syzbot+1097e95f134f37d9395c@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=1097e95f134f37d9395c +Fixes: 2ba466d74ed7 ("nilfs2: directory entry operations") +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/nilfs2/dir.c | 13 ++++++++++--- + fs/nilfs2/namei.c | 29 +++++++++++++++-------------- + fs/nilfs2/nilfs.h | 4 ++-- + 3 files changed, 27 insertions(+), 19 deletions(-) + +diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c +index f61c58fbf117d..0cc32e9c71cbf 100644 +--- a/fs/nilfs2/dir.c ++++ b/fs/nilfs2/dir.c +@@ -400,7 +400,7 @@ int nilfs_inode_by_name(struct inode *dir, const struct qstr *qstr, ino_t *ino) + return 0; + } + +-void nilfs_set_link(struct inode *dir, struct nilfs_dir_entry *de, ++int nilfs_set_link(struct inode *dir, struct nilfs_dir_entry *de, + struct folio *folio, struct inode *inode) + { + size_t from = offset_in_folio(folio, de); +@@ -410,11 +410,15 @@ void nilfs_set_link(struct inode *dir, struct nilfs_dir_entry *de, + + folio_lock(folio); + err = nilfs_prepare_chunk(folio, from, to); +- BUG_ON(err); ++ if (unlikely(err)) { ++ folio_unlock(folio); ++ return err; ++ } + de->inode = cpu_to_le64(inode->i_ino); + de->file_type = fs_umode_to_ftype(inode->i_mode); + nilfs_commit_chunk(folio, mapping, from, to); + inode_set_mtime_to_ts(dir, inode_set_ctime_current(dir)); ++ return 0; + } + + /* +@@ -543,7 +547,10 @@ int nilfs_delete_entry(struct nilfs_dir_entry *dir, struct folio *folio) + from = (char *)pde - kaddr; + folio_lock(folio); + err = nilfs_prepare_chunk(folio, from, to); +- BUG_ON(err); ++ if (unlikely(err)) { ++ folio_unlock(folio); ++ goto out; ++ } + if (pde) + pde->rec_len = nilfs_rec_len_to_disk(to - from); + dir->inode = 0; +diff --git a/fs/nilfs2/namei.c b/fs/nilfs2/namei.c +index 1d836a5540f3b..e02fae6757f12 100644 +--- a/fs/nilfs2/namei.c ++++ b/fs/nilfs2/namei.c +@@ -406,8 +406,10 @@ static int nilfs_rename(struct mnt_idmap *idmap, + err = PTR_ERR(new_de); + goto out_dir; + } +- nilfs_set_link(new_dir, new_de, new_folio, old_inode); ++ err = nilfs_set_link(new_dir, new_de, new_folio, old_inode); + folio_release_kmap(new_folio, new_de); ++ if (unlikely(err)) ++ goto out_dir; + nilfs_mark_inode_dirty(new_dir); + inode_set_ctime_current(new_inode); + if (dir_de) +@@ -430,28 +432,27 @@ static int nilfs_rename(struct mnt_idmap *idmap, + */ + inode_set_ctime_current(old_inode); + +- nilfs_delete_entry(old_de, old_folio); +- +- if (dir_de) { +- nilfs_set_link(old_inode, dir_de, dir_folio, new_dir); +- folio_release_kmap(dir_folio, dir_de); +- drop_nlink(old_dir); ++ err = nilfs_delete_entry(old_de, old_folio); ++ if (likely(!err)) { ++ if (dir_de) { ++ err = nilfs_set_link(old_inode, dir_de, dir_folio, ++ new_dir); ++ drop_nlink(old_dir); ++ } ++ nilfs_mark_inode_dirty(old_dir); + } +- folio_release_kmap(old_folio, old_de); +- +- nilfs_mark_inode_dirty(old_dir); + nilfs_mark_inode_dirty(old_inode); + +- err = nilfs_transaction_commit(old_dir->i_sb); +- return err; +- + out_dir: + if (dir_de) + folio_release_kmap(dir_folio, dir_de); + out_old: + folio_release_kmap(old_folio, old_de); + out: +- nilfs_transaction_abort(old_dir->i_sb); ++ if (likely(!err)) ++ err = nilfs_transaction_commit(old_dir->i_sb); ++ else ++ nilfs_transaction_abort(old_dir->i_sb); + return err; + } + +diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h +index dff241c53fc58..cb6ed54accd7b 100644 +--- a/fs/nilfs2/nilfs.h ++++ b/fs/nilfs2/nilfs.h +@@ -261,8 +261,8 @@ struct nilfs_dir_entry *nilfs_find_entry(struct inode *, const struct qstr *, + int nilfs_delete_entry(struct nilfs_dir_entry *, struct folio *); + int nilfs_empty_dir(struct inode *); + struct nilfs_dir_entry *nilfs_dotdot(struct inode *, struct folio **); +-void nilfs_set_link(struct inode *, struct nilfs_dir_entry *, +- struct folio *, struct inode *); ++int nilfs_set_link(struct inode *dir, struct nilfs_dir_entry *de, ++ struct folio *folio, struct inode *inode); + + /* file.c */ + extern int nilfs_sync_file(struct file *, loff_t, loff_t, int); +-- +2.39.5 + diff --git a/queue-6.12/nilfs2-protect-access-to-buffers-with-no-active-refe.patch b/queue-6.12/nilfs2-protect-access-to-buffers-with-no-active-refe.patch new file mode 100644 index 0000000000..571bceedda --- /dev/null +++ b/queue-6.12/nilfs2-protect-access-to-buffers-with-no-active-refe.patch @@ -0,0 +1,61 @@ +From 65a42a59a945edbf121df4aec3b718c31bcbb91d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 05:00:47 +0900 +Subject: nilfs2: protect access to buffers with no active references + +From: Ryusuke Konishi + +[ Upstream commit 367a9bffabe08c04f6d725032cce3d891b2b9e1a ] + +nilfs_lookup_dirty_data_buffers(), which iterates through the buffers +attached to dirty data folios/pages, accesses the attached buffers without +locking the folios/pages. + +For data cache, nilfs_clear_folio_dirty() may be called asynchronously +when the file system degenerates to read only, so +nilfs_lookup_dirty_data_buffers() still has the potential to cause use +after free issues when buffers lose the protection of their dirty state +midway due to this asynchronous clearing and are unintentionally freed by +try_to_free_buffers(). + +Eliminate this race issue by adjusting the lock section in this function. + +Link: https://lkml.kernel.org/r/20250107200202.6432-3-konishi.ryusuke@gmail.com +Signed-off-by: Ryusuke Konishi +Fixes: 8c26c4e2694a ("nilfs2: fix issue with flush kernel thread after remount in RO mode because of driver's internal error or metadata corruption") +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/nilfs2/segment.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c +index 5872518308973..58a598b548fa2 100644 +--- a/fs/nilfs2/segment.c ++++ b/fs/nilfs2/segment.c +@@ -734,7 +734,6 @@ static size_t nilfs_lookup_dirty_data_buffers(struct inode *inode, + if (!head) + head = create_empty_buffers(folio, + i_blocksize(inode), 0); +- folio_unlock(folio); + + bh = head; + do { +@@ -744,11 +743,14 @@ static size_t nilfs_lookup_dirty_data_buffers(struct inode *inode, + list_add_tail(&bh->b_assoc_buffers, listp); + ndirties++; + if (unlikely(ndirties >= nlimit)) { ++ folio_unlock(folio); + folio_batch_release(&fbatch); + cond_resched(); + return ndirties; + } + } while (bh = bh->b_this_page, bh != head); ++ ++ folio_unlock(folio); + } + folio_batch_release(&fbatch); + cond_resched(); +-- +2.39.5 + diff --git a/queue-6.12/nvme-add-error-check-for-xa_store-in-nvme_get_effect.patch b/queue-6.12/nvme-add-error-check-for-xa_store-in-nvme_get_effect.patch new file mode 100644 index 0000000000..935eb58775 --- /dev/null +++ b/queue-6.12/nvme-add-error-check-for-xa_store-in-nvme_get_effect.patch @@ -0,0 +1,52 @@ +From 03689ef129fec3b609d099539a5ce6f9d341c46f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2024 13:00:47 +0100 +Subject: nvme: Add error check for xa_store in nvme_get_effects_log + +From: Keisuke Nishimura + +[ Upstream commit ac32057acc7f3d7a238dafaa9b2aa2bc9750080e ] + +The xa_store() may fail due to memory allocation failure because there +is no guarantee that the index csi is already used. This fix adds an +error check of the return value of xa_store() in nvme_get_effects_log(). + +Fixes: 1cf7a12e09aa ("nvme: use an xarray to lookup the Commands Supported and Effects log") +Signed-off-by: Keisuke Nishimura +Reviewed-by: Christoph Hellwig +Reviewed-by: Sagi Grimberg +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 249914b90dbfa..f5ea15bfe6feb 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -3085,7 +3085,7 @@ int nvme_get_log(struct nvme_ctrl *ctrl, u32 nsid, u8 log_page, u8 lsp, u8 csi, + static int nvme_get_effects_log(struct nvme_ctrl *ctrl, u8 csi, + struct nvme_effects_log **log) + { +- struct nvme_effects_log *cel = xa_load(&ctrl->cels, csi); ++ struct nvme_effects_log *old, *cel = xa_load(&ctrl->cels, csi); + int ret; + + if (cel) +@@ -3102,7 +3102,11 @@ static int nvme_get_effects_log(struct nvme_ctrl *ctrl, u8 csi, + return ret; + } + +- xa_store(&ctrl->cels, csi, cel, GFP_KERNEL); ++ old = xa_store(&ctrl->cels, csi, cel, GFP_KERNEL); ++ if (xa_is_err(old)) { ++ kfree(cel); ++ return xa_err(old); ++ } + out: + *log = cel; + return 0; +-- +2.39.5 + diff --git a/queue-6.12/nvme-add-error-path-for-xa_store-in-nvme_init_effect.patch b/queue-6.12/nvme-add-error-path-for-xa_store-in-nvme_init_effect.patch new file mode 100644 index 0000000000..5efbeeb3d3 --- /dev/null +++ b/queue-6.12/nvme-add-error-path-for-xa_store-in-nvme_init_effect.patch @@ -0,0 +1,70 @@ +From 5ad0e14aec7858edddc91d9080537ad99ef7cb22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Dec 2024 16:27:20 +0100 +Subject: nvme: Add error path for xa_store in nvme_init_effects + +From: Keisuke Nishimura + +[ Upstream commit d4a95adeabc6b5a39405e49c6d5ed14dd83682c4 ] + +The xa_store() may fail due to memory allocation failure because there +is no guarantee that the index NVME_CSI_NVM is already used. This fix +introduces a new function to handle the error path. + +Fixes: cc115cbe12d9 ("nvme: always initialize known command effects") +Signed-off-by: Keisuke Nishimura +Reviewed-by: Sagi Grimberg +Reviewed-by: Christoph Hellwig +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 26 ++++++++++++++++++++++---- + 1 file changed, 22 insertions(+), 4 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index f5ea15bfe6feb..23137fcd335b0 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -3168,6 +3168,25 @@ static int nvme_init_non_mdts_limits(struct nvme_ctrl *ctrl) + return ret; + } + ++static int nvme_init_effects_log(struct nvme_ctrl *ctrl, ++ u8 csi, struct nvme_effects_log **log) ++{ ++ struct nvme_effects_log *effects, *old; ++ ++ effects = kzalloc(sizeof(*effects), GFP_KERNEL); ++ if (effects) ++ return -ENOMEM; ++ ++ old = xa_store(&ctrl->cels, csi, effects, GFP_KERNEL); ++ if (xa_is_err(old)) { ++ kfree(effects); ++ return xa_err(old); ++ } ++ ++ *log = effects; ++ return 0; ++} ++ + static void nvme_init_known_nvm_effects(struct nvme_ctrl *ctrl) + { + struct nvme_effects_log *log = ctrl->effects; +@@ -3214,10 +3233,9 @@ static int nvme_init_effects(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) + } + + if (!ctrl->effects) { +- ctrl->effects = kzalloc(sizeof(*ctrl->effects), GFP_KERNEL); +- if (!ctrl->effects) +- return -ENOMEM; +- xa_store(&ctrl->cels, NVME_CSI_NVM, ctrl->effects, GFP_KERNEL); ++ ret = nvme_init_effects_log(ctrl, NVME_CSI_NVM, &ctrl->effects); ++ if (ret < 0) ++ return ret; + } + + nvme_init_known_nvm_effects(ctrl); +-- +2.39.5 + diff --git a/queue-6.12/nvme-fix-bogus-kzalloc-return-check-in-nvme_init_eff.patch b/queue-6.12/nvme-fix-bogus-kzalloc-return-check-in-nvme_init_eff.patch new file mode 100644 index 0000000000..7c298028da --- /dev/null +++ b/queue-6.12/nvme-fix-bogus-kzalloc-return-check-in-nvme_init_eff.patch @@ -0,0 +1,36 @@ +From 93e9a49a493b6f9393bf9c15567a9664f0fc4106 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 10:27:54 -0700 +Subject: nvme: fix bogus kzalloc() return check in nvme_init_effects_log() + +From: Jens Axboe + +[ Upstream commit 170e086ad3997f816d1f551f178a03a626a130b7 ] + +nvme_init_effects_log() returns failure when kzalloc() is successful, +which is obviously wrong and causes failures to boot. Correct the +check. + +Fixes: d4a95adeabc6 ("nvme: Add error path for xa_store in nvme_init_effects") +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 23137fcd335b0..4c409efd8cec1 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -3174,7 +3174,7 @@ static int nvme_init_effects_log(struct nvme_ctrl *ctrl, + struct nvme_effects_log *effects, *old; + + effects = kzalloc(sizeof(*effects), GFP_KERNEL); +- if (effects) ++ if (!effects) + return -ENOMEM; + + old = xa_store(&ctrl->cels, csi, effects, GFP_KERNEL); +-- +2.39.5 + diff --git a/queue-6.12/nvme-tcp-fix-i-o-queue-cpu-spreading-for-multiple-co.patch b/queue-6.12/nvme-tcp-fix-i-o-queue-cpu-spreading-for-multiple-co.patch new file mode 100644 index 0000000000..883107c165 --- /dev/null +++ b/queue-6.12/nvme-tcp-fix-i-o-queue-cpu-spreading-for-multiple-co.patch @@ -0,0 +1,216 @@ +From 4e83e7e7acedb1f2cbbc98677e5edf6275a20d56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Jan 2025 23:27:11 +0200 +Subject: nvme-tcp: Fix I/O queue cpu spreading for multiple controllers + +From: Sagi Grimberg + +[ Upstream commit 32193789878c259e39b97bd0c0f2f0ccbe5cb8a8 ] + +Since day-1 we are assigning the queue io_cpu very naively. We always +base the queue id (controller scope) and assign it its matching cpu +from the online mask. This works fine when the number of queues match +the number of cpu cores. + +The problem starts when we have less queues than cpu cores. First, we +should take into account the mq_map and select a cpu within the cpus +that are assigned to this queue by the mq_map in order to minimize cross +numa cpu bouncing. + +Second, even worse is that we don't take into account multiple +controllers may have assigned queues to a given cpu. As a result we may +simply compund more and more queues on the same set of cpus, which is +suboptimal. + +We fix this by introducing global per-cpu counters that tracks the +number of queues assigned to each cpu, and we select the least used cpu +based on the mq_map and the per-cpu counters, and assign it as the queue +io_cpu. + +The behavior for a single controller is slightly optimized by selecting +better cpu candidates by consulting with the mq_map, and multiple +controllers are spreading queues among cpu cores much better, resulting +in lower average cpu load, and less likelihood to hit hotspots. + +Note that the accounting is not 100% perfect, but we don't need to be, +we're simply putting our best effort to select the best candidate cpu +core that we find at any given point. + +Another byproduct is that every controller reset/reconnect may change +the queues io_cpu mapping, based on the current LRU accounting scheme. + +Here is the baseline queue io_cpu assignment for 4 controllers, 2 queues +per controller, and 4 cpus on the host: +nvme1: queue 0: using cpu 0 +nvme1: queue 1: using cpu 1 +nvme2: queue 0: using cpu 0 +nvme2: queue 1: using cpu 1 +nvme3: queue 0: using cpu 0 +nvme3: queue 1: using cpu 1 +nvme4: queue 0: using cpu 0 +nvme4: queue 1: using cpu 1 + +And this is the fixed io_cpu assignment: +nvme1: queue 0: using cpu 0 +nvme1: queue 1: using cpu 2 +nvme2: queue 0: using cpu 1 +nvme2: queue 1: using cpu 3 +nvme3: queue 0: using cpu 0 +nvme3: queue 1: using cpu 2 +nvme4: queue 0: using cpu 1 +nvme4: queue 1: using cpu 3 + +Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver") +Suggested-by: Hannes Reinecke +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Christoph Hellwig +[fixed kbuild reported errors] +Signed-off-by: Chaitanya Kulkarni +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/tcp.c | 70 +++++++++++++++++++++++++++++++++-------- + 1 file changed, 57 insertions(+), 13 deletions(-) + +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index 55abfe5e1d254..8305d3c128074 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -54,6 +54,8 @@ MODULE_PARM_DESC(tls_handshake_timeout, + "nvme TLS handshake timeout in seconds (default 10)"); + #endif + ++static atomic_t nvme_tcp_cpu_queues[NR_CPUS]; ++ + #ifdef CONFIG_DEBUG_LOCK_ALLOC + /* lockdep can detect a circular dependency of the form + * sk_lock -> mmap_lock (page fault) -> fs locks -> sk_lock +@@ -127,6 +129,7 @@ enum nvme_tcp_queue_flags { + NVME_TCP_Q_ALLOCATED = 0, + NVME_TCP_Q_LIVE = 1, + NVME_TCP_Q_POLLING = 2, ++ NVME_TCP_Q_IO_CPU_SET = 3, + }; + + enum nvme_tcp_recv_state { +@@ -1562,23 +1565,56 @@ static bool nvme_tcp_poll_queue(struct nvme_tcp_queue *queue) + ctrl->io_queues[HCTX_TYPE_POLL]; + } + ++/** ++ * Track the number of queues assigned to each cpu using a global per-cpu ++ * counter and select the least used cpu from the mq_map. Our goal is to spread ++ * different controllers I/O threads across different cpu cores. ++ * ++ * Note that the accounting is not 100% perfect, but we don't need to be, we're ++ * simply putting our best effort to select the best candidate cpu core that we ++ * find at any given point. ++ */ + static void nvme_tcp_set_queue_io_cpu(struct nvme_tcp_queue *queue) + { + struct nvme_tcp_ctrl *ctrl = queue->ctrl; +- int qid = nvme_tcp_queue_id(queue); +- int n = 0; ++ struct blk_mq_tag_set *set = &ctrl->tag_set; ++ int qid = nvme_tcp_queue_id(queue) - 1; ++ unsigned int *mq_map = NULL; ++ int cpu, min_queues = INT_MAX, io_cpu; ++ ++ if (wq_unbound) ++ goto out; + + if (nvme_tcp_default_queue(queue)) +- n = qid - 1; ++ mq_map = set->map[HCTX_TYPE_DEFAULT].mq_map; + else if (nvme_tcp_read_queue(queue)) +- n = qid - ctrl->io_queues[HCTX_TYPE_DEFAULT] - 1; ++ mq_map = set->map[HCTX_TYPE_READ].mq_map; + else if (nvme_tcp_poll_queue(queue)) +- n = qid - ctrl->io_queues[HCTX_TYPE_DEFAULT] - +- ctrl->io_queues[HCTX_TYPE_READ] - 1; +- if (wq_unbound) +- queue->io_cpu = WORK_CPU_UNBOUND; +- else +- queue->io_cpu = cpumask_next_wrap(n - 1, cpu_online_mask, -1, false); ++ mq_map = set->map[HCTX_TYPE_POLL].mq_map; ++ ++ if (WARN_ON(!mq_map)) ++ goto out; ++ ++ /* Search for the least used cpu from the mq_map */ ++ io_cpu = WORK_CPU_UNBOUND; ++ for_each_online_cpu(cpu) { ++ int num_queues = atomic_read(&nvme_tcp_cpu_queues[cpu]); ++ ++ if (mq_map[cpu] != qid) ++ continue; ++ if (num_queues < min_queues) { ++ io_cpu = cpu; ++ min_queues = num_queues; ++ } ++ } ++ if (io_cpu != WORK_CPU_UNBOUND) { ++ queue->io_cpu = io_cpu; ++ atomic_inc(&nvme_tcp_cpu_queues[io_cpu]); ++ set_bit(NVME_TCP_Q_IO_CPU_SET, &queue->flags); ++ } ++out: ++ dev_dbg(ctrl->ctrl.device, "queue %d: using cpu %d\n", ++ qid, queue->io_cpu); + } + + static void nvme_tcp_tls_done(void *data, int status, key_serial_t pskid) +@@ -1722,7 +1758,7 @@ static int nvme_tcp_alloc_queue(struct nvme_ctrl *nctrl, int qid, + + queue->sock->sk->sk_allocation = GFP_ATOMIC; + queue->sock->sk->sk_use_task_frag = false; +- nvme_tcp_set_queue_io_cpu(queue); ++ queue->io_cpu = WORK_CPU_UNBOUND; + queue->request = NULL; + queue->data_remaining = 0; + queue->ddgst_remaining = 0; +@@ -1844,6 +1880,9 @@ static void nvme_tcp_stop_queue(struct nvme_ctrl *nctrl, int qid) + if (!test_bit(NVME_TCP_Q_ALLOCATED, &queue->flags)) + return; + ++ if (test_and_clear_bit(NVME_TCP_Q_IO_CPU_SET, &queue->flags)) ++ atomic_dec(&nvme_tcp_cpu_queues[queue->io_cpu]); ++ + mutex_lock(&queue->queue_lock); + if (test_and_clear_bit(NVME_TCP_Q_LIVE, &queue->flags)) + __nvme_tcp_stop_queue(queue); +@@ -1878,9 +1917,10 @@ static int nvme_tcp_start_queue(struct nvme_ctrl *nctrl, int idx) + nvme_tcp_init_recv_ctx(queue); + nvme_tcp_setup_sock_ops(queue); + +- if (idx) ++ if (idx) { ++ nvme_tcp_set_queue_io_cpu(queue); + ret = nvmf_connect_io_queue(nctrl, idx); +- else ++ } else + ret = nvmf_connect_admin_queue(nctrl); + + if (!ret) { +@@ -2856,6 +2896,7 @@ static struct nvmf_transport_ops nvme_tcp_transport = { + static int __init nvme_tcp_init_module(void) + { + unsigned int wq_flags = WQ_MEM_RECLAIM | WQ_HIGHPRI | WQ_SYSFS; ++ int cpu; + + BUILD_BUG_ON(sizeof(struct nvme_tcp_hdr) != 8); + BUILD_BUG_ON(sizeof(struct nvme_tcp_cmd_pdu) != 72); +@@ -2873,6 +2914,9 @@ static int __init nvme_tcp_init_module(void) + if (!nvme_tcp_wq) + return -ENOMEM; + ++ for_each_possible_cpu(cpu) ++ atomic_set(&nvme_tcp_cpu_queues[cpu], 0); ++ + nvmf_register_transport(&nvme_tcp_transport); + return 0; + } +-- +2.39.5 + diff --git a/queue-6.12/ocfs2-mark-dquot-as-inactive-if-failed-to-start-tran.patch b/queue-6.12/ocfs2-mark-dquot-as-inactive-if-failed-to-start-tran.patch new file mode 100644 index 0000000000..267b7e556b --- /dev/null +++ b/queue-6.12/ocfs2-mark-dquot-as-inactive-if-failed-to-start-tran.patch @@ -0,0 +1,68 @@ +From 7aa072962f9a2d53a3f3887f29a2c39c2d9a4982 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jan 2025 22:06:53 +0800 +Subject: ocfs2: mark dquot as inactive if failed to start trans while + releasing dquot + +From: Su Yue + +[ Upstream commit 276c61385f6bc3223a5ecd307cf4aba2dfbb9a31 ] + +While running fstests generic/329, the kernel workqueue +quota_release_workfn is dead looping in calling ocfs2_release_dquot(). +The ocfs2 state is already readonly but ocfs2_release_dquot wants to +start a transaction but fails and returns. + +===================================================================== +[ 2918.123602 ][ T275 ] On-disk corruption discovered. Please run +fsck.ocfs2 once the filesystem is unmounted. +[ 2918.124034 ][ T275 ] (kworker/u135:1,275,11):ocfs2_release_dquot:765 +ERROR: status = -30 +[ 2918.124452 ][ T275 ] (kworker/u135:1,275,11):ocfs2_release_dquot:795 +ERROR: status = -30 +[ 2918.124883 ][ T275 ] (kworker/u135:1,275,11):ocfs2_start_trans:357 +ERROR: status = -30 +[ 2918.125276 ][ T275 ] OCFS2: abort (device dm-0): ocfs2_start_trans: +Detected aborted journal +[ 2918.125710 ][ T275 ] On-disk corruption discovered. Please run +fsck.ocfs2 once the filesystem is unmounted. +===================================================================== + +ocfs2_release_dquot() is much like dquot_release(), which is called by +ext4 to handle similar situation. So here fix it by marking the dquot as +inactive like what dquot_release() does. + +Link: https://lkml.kernel.org/r/20250106140653.92292-1-glass.su@suse.com +Fixes: 9e33d69f553a ("ocfs2: Implementation of local and global quota file handling") +Signed-off-by: Su Yue +Reviewed-by: Joseph Qi +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Jun Piao +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/ocfs2/quota_global.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c +index 3404e7a30c330..15d9acd456ecc 100644 +--- a/fs/ocfs2/quota_global.c ++++ b/fs/ocfs2/quota_global.c +@@ -761,6 +761,11 @@ static int ocfs2_release_dquot(struct dquot *dquot) + handle = ocfs2_start_trans(osb, + ocfs2_calc_qdel_credits(dquot->dq_sb, dquot->dq_id.type)); + if (IS_ERR(handle)) { ++ /* ++ * Mark dquot as inactive to avoid endless cycle in ++ * quota_release_workfn(). ++ */ ++ clear_bit(DQ_ACTIVE_B, &dquot->dq_flags); + status = PTR_ERR(handle); + mlog_errno(status); + goto out_ilock; +-- +2.39.5 + diff --git a/queue-6.12/octeon_ep-remove-firmware-stats-fetch-in-ndo_get_sta.patch b/queue-6.12/octeon_ep-remove-firmware-stats-fetch-in-ndo_get_sta.patch new file mode 100644 index 0000000000..2cde7d2d2f --- /dev/null +++ b/queue-6.12/octeon_ep-remove-firmware-stats-fetch-in-ndo_get_sta.patch @@ -0,0 +1,82 @@ +From fc65d0d3edadd77f08489796cfb727530222ba73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jan 2025 01:46:50 -0800 +Subject: octeon_ep: remove firmware stats fetch in ndo_get_stats64 + +From: Shinas Rasheed + +[ Upstream commit 1f64255bb76c11d0c41a7d81d7cec68e49d5362d ] + +The firmware stats fetch call that happens in ndo_get_stats64() +is currently not required, and causes a warning to issue. + +The warn log is given below: + +[ 123.316837] ------------[ cut here ]------------ +[ 123.316840] Voluntary context switch within RCU read-side critical section! +[ 123.316917] pc : rcu_note_context_switch+0x2e4/0x300 +[ 123.316919] lr : rcu_note_context_switch+0x2e4/0x300 +[ 123.316947] Call trace: +[ 123.316949] rcu_note_context_switch+0x2e4/0x300 +[ 123.316952] __schedule+0x84/0x584 +[ 123.316955] schedule+0x38/0x90 +[ 123.316956] schedule_timeout+0xa0/0x1d4 +[ 123.316959] octep_send_mbox_req+0x190/0x230 [octeon_ep] +[ 123.316966] octep_ctrl_net_get_if_stats+0x78/0x100 [octeon_ep] +[ 123.316970] octep_get_stats64+0xd4/0xf0 [octeon_ep] +[ 123.316975] dev_get_stats+0x4c/0x114 +[ 123.316977] dev_seq_printf_stats+0x3c/0x11c +[ 123.316980] dev_seq_show+0x1c/0x40 +[ 123.316982] seq_read_iter+0x3cc/0x4e0 +[ 123.316985] seq_read+0xc8/0x110 +[ 123.316987] proc_reg_read+0x9c/0xec +[ 123.316990] vfs_read+0xc8/0x2ec +[ 123.316993] ksys_read+0x70/0x100 +[ 123.316995] __arm64_sys_read+0x20/0x30 +[ 123.316997] invoke_syscall.constprop.0+0x7c/0xd0 +[ 123.317000] do_el0_svc+0xb4/0xd0 +[ 123.317002] el0_svc+0xe8/0x1f4 +[ 123.317005] el0t_64_sync_handler+0x134/0x150 +[ 123.317006] el0t_64_sync+0x17c/0x180 +[ 123.317008] ---[ end trace 63399811432ab69b ]--- + +Fixes: 6a610a46bad1 ("octeon_ep: add support for ndo ops") +Signed-off-by: Shinas Rasheed +Link: https://patch.msgid.link/20250117094653.2588578-2-srasheed@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeon_ep/octep_main.c | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c +index 549436efc2048..730aa5632ccee 100644 +--- a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c ++++ b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c +@@ -995,12 +995,6 @@ static void octep_get_stats64(struct net_device *netdev, + struct octep_device *oct = netdev_priv(netdev); + int q; + +- if (netif_running(netdev)) +- octep_ctrl_net_get_if_stats(oct, +- OCTEP_CTRL_NET_INVALID_VFID, +- &oct->iface_rx_stats, +- &oct->iface_tx_stats); +- + tx_packets = 0; + tx_bytes = 0; + rx_packets = 0; +@@ -1018,10 +1012,6 @@ static void octep_get_stats64(struct net_device *netdev, + stats->tx_bytes = tx_bytes; + stats->rx_packets = rx_packets; + stats->rx_bytes = rx_bytes; +- stats->multicast = oct->iface_rx_stats.mcast_pkts; +- stats->rx_errors = oct->iface_rx_stats.err_pkts; +- stats->collisions = oct->iface_tx_stats.xscol; +- stats->tx_fifo_errors = oct->iface_tx_stats.undflw; + } + + /** +-- +2.39.5 + diff --git a/queue-6.12/octeon_ep_vf-remove-firmware-stats-fetch-in-ndo_get_.patch b/queue-6.12/octeon_ep_vf-remove-firmware-stats-fetch-in-ndo_get_.patch new file mode 100644 index 0000000000..996b53e813 --- /dev/null +++ b/queue-6.12/octeon_ep_vf-remove-firmware-stats-fetch-in-ndo_get_.patch @@ -0,0 +1,73 @@ +From 57f9c4bf2f2afe94f6508beff60c8c51bbe03572 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jan 2025 01:46:52 -0800 +Subject: octeon_ep_vf: remove firmware stats fetch in ndo_get_stats64 + +From: Shinas Rasheed + +[ Upstream commit cc0e510cc89fe0a6479203bc20cd964962dc6a43 ] + +The firmware stats fetch call that happens in ndo_get_stats64() +is currently not required, and causes a warning to issue. + +The corresponding warn log for the PF is given below: + +[ 123.316837] ------------[ cut here ]------------ +[ 123.316840] Voluntary context switch within RCU read-side critical section! +[ 123.316917] pc : rcu_note_context_switch+0x2e4/0x300 +[ 123.316919] lr : rcu_note_context_switch+0x2e4/0x300 +[ 123.316947] Call trace: +[ 123.316949] rcu_note_context_switch+0x2e4/0x300 +[ 123.316952] __schedule+0x84/0x584 +[ 123.316955] schedule+0x38/0x90 +[ 123.316956] schedule_timeout+0xa0/0x1d4 +[ 123.316959] octep_send_mbox_req+0x190/0x230 [octeon_ep] +[ 123.316966] octep_ctrl_net_get_if_stats+0x78/0x100 [octeon_ep] +[ 123.316970] octep_get_stats64+0xd4/0xf0 [octeon_ep] +[ 123.316975] dev_get_stats+0x4c/0x114 +[ 123.316977] dev_seq_printf_stats+0x3c/0x11c +[ 123.316980] dev_seq_show+0x1c/0x40 +[ 123.316982] seq_read_iter+0x3cc/0x4e0 +[ 123.316985] seq_read+0xc8/0x110 +[ 123.316987] proc_reg_read+0x9c/0xec +[ 123.316990] vfs_read+0xc8/0x2ec +[ 123.316993] ksys_read+0x70/0x100 +[ 123.316995] __arm64_sys_read+0x20/0x30 +[ 123.316997] invoke_syscall.constprop.0+0x7c/0xd0 +[ 123.317000] do_el0_svc+0xb4/0xd0 +[ 123.317002] el0_svc+0xe8/0x1f4 +[ 123.317005] el0t_64_sync_handler+0x134/0x150 +[ 123.317006] el0t_64_sync+0x17c/0x180 +[ 123.317008] ---[ end trace 63399811432ab69b ]--- + +Fixes: c3fad23cdc06 ("octeon_ep_vf: add support for ndo ops") +Signed-off-by: Shinas Rasheed +Link: https://patch.msgid.link/20250117094653.2588578-4-srasheed@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.c | 8 -------- + 1 file changed, 8 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.c b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.c +index 7e6771c9cdbba..4c699514fd57a 100644 +--- a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.c ++++ b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.c +@@ -799,14 +799,6 @@ static void octep_vf_get_stats64(struct net_device *netdev, + stats->tx_bytes = tx_bytes; + stats->rx_packets = rx_packets; + stats->rx_bytes = rx_bytes; +- if (!octep_vf_get_if_stats(oct)) { +- stats->multicast = oct->iface_rx_stats.mcast_pkts; +- stats->rx_errors = oct->iface_rx_stats.err_pkts; +- stats->rx_dropped = oct->iface_rx_stats.dropped_pkts_fifo_full + +- oct->iface_rx_stats.err_pkts; +- stats->rx_missed_errors = oct->iface_rx_stats.dropped_pkts_fifo_full; +- stats->tx_dropped = oct->iface_tx_stats.dropped; +- } + } + + /** +-- +2.39.5 + diff --git a/queue-6.12/of-fdt-restore-possibility-to-use-both-acpi-and-fdt-.patch b/queue-6.12/of-fdt-restore-possibility-to-use-both-acpi-and-fdt-.patch new file mode 100644 index 0000000000..7c59720737 --- /dev/null +++ b/queue-6.12/of-fdt-restore-possibility-to-use-both-acpi-and-fdt-.patch @@ -0,0 +1,68 @@ +From 232ce0542cbcb7030414373b65f273cc2f7c5410 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Jan 2025 17:27:41 +0000 +Subject: of/fdt: Restore possibility to use both ACPI and FDT from bootloader + +From: Dmytro Maluka + +[ Upstream commit 14bce187d1600710623d81888da3501bbc470ba2 ] + +There are cases when the bootloader provides information to the kernel +in both ACPI and DTB, not interchangeably. One such use case is virtual +machines in Android. When running on x86, the Android Virtualization +Framework (AVF) boots VMs with ACPI like it is usually done on x86 (i.e. +the virtual LAPIC, IOAPIC, HPET, PCI MMCONFIG etc are described in ACPI) +but also passes various AVF-specific boot parameters in DTB. This allows +reusing the same implementations of various AVF components on both +arm64 and x86. + +Commit 7b937cc243e5 ("of: Create of_root if no dtb provided by firmware") +removed the possibility to do that, since among other things +it introduced forcing emptying the bootloader-provided DTB if ACPI is +enabled (probably assuming that if ACPI is available, a DTB can only be +useful for applying overlays to it afterwards, for testing purposes). + +So restore this possibility. Instead of completely preventing using ACPI +and DT together, rely on arch-specific setup code to prevent using both +to set up the same things (see various acpi_disabled checks under arch/). + +Fixes: 7b937cc243e5 ("of: Create of_root if no dtb provided by firmware") +Signed-off-by: Dmytro Maluka +Link: https://lore.kernel.org/r/20250105172741.3476758-3-dmaluka@chromium.org +Signed-off-by: Rob Herring (Arm) +Signed-off-by: Sasha Levin +--- + drivers/of/fdt.c | 10 +--------- + 1 file changed, 1 insertion(+), 9 deletions(-) + +diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c +index d3ecf2bdd2023..8c80f4dc8b3fa 100644 +--- a/drivers/of/fdt.c ++++ b/drivers/of/fdt.c +@@ -8,7 +8,6 @@ + + #define pr_fmt(fmt) "OF: fdt: " fmt + +-#include + #include + #include + #include +@@ -1215,14 +1214,7 @@ void __init unflatten_device_tree(void) + /* Save the statically-placed regions in the reserved_mem array */ + fdt_scan_reserved_mem_reg_nodes(); + +- /* Don't use the bootloader provided DTB if ACPI is enabled */ +- if (!acpi_disabled) +- fdt = NULL; +- +- /* +- * Populate an empty root node when ACPI is enabled or bootloader +- * doesn't provide one. +- */ ++ /* Populate an empty root node when bootloader doesn't provide one */ + if (!fdt) { + fdt = (void *) __dtb_empty_root_begin; + /* fdt_totalsize() will be used for copy size */ +-- +2.39.5 + diff --git a/queue-6.12/of-property-avoiding-using-uninitialized-variable-im.patch b/queue-6.12/of-property-avoiding-using-uninitialized-variable-im.patch new file mode 100644 index 0000000000..20c3126e69 --- /dev/null +++ b/queue-6.12/of-property-avoiding-using-uninitialized-variable-im.patch @@ -0,0 +1,43 @@ +From 1c1c8a53a2ce1e49322ff3c91665a42573b2c63d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jan 2025 21:26:57 +0800 +Subject: of: property: Avoiding using uninitialized variable @imaplen in + parse_interrupt_map() + +From: Zijun Hu + +[ Upstream commit f73780e772c06901e99b2ad114b7f0f3fbe73ad4 ] + +parse_interrupt_map() will use uninitialized variable @imaplen if fails +to get property 'interrupt-map'. + +Fix by using the variable after successfully getting the property. + +Fixes: e7985f43609c ("of: property: Fix fw_devlink handling of interrupt-map") +Signed-off-by: Zijun Hu +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20250109-of_core_fix-v4-6-db8a72415b8c@quicinc.com +Signed-off-by: Rob Herring (Arm) +Signed-off-by: Sasha Levin +--- + drivers/of/property.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/of/property.c b/drivers/of/property.c +index 7bd8390f2fba5..906a33ae717f7 100644 +--- a/drivers/of/property.c ++++ b/drivers/of/property.c +@@ -1317,9 +1317,9 @@ static struct device_node *parse_interrupt_map(struct device_node *np, + addrcells = of_bus_n_addr_cells(np); + + imap = of_get_property(np, "interrupt-map", &imaplen); +- imaplen /= sizeof(*imap); + if (!imap) + return NULL; ++ imaplen /= sizeof(*imap); + + imap_end = imap + imaplen; + +-- +2.39.5 + diff --git a/queue-6.12/of-reserved-memory-do-not-make-kmemleak-ignore-freed.patch b/queue-6.12/of-reserved-memory-do-not-make-kmemleak-ignore-freed.patch new file mode 100644 index 0000000000..87e8607a54 --- /dev/null +++ b/queue-6.12/of-reserved-memory-do-not-make-kmemleak-ignore-freed.patch @@ -0,0 +1,48 @@ +From cc40f6bdcad07c959a0251308ff2257baa381e67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jan 2025 21:27:01 +0800 +Subject: of: reserved-memory: Do not make kmemleak ignore freed address + +From: Zijun Hu + +[ Upstream commit 29091a52562bca4d6e678dd8f0085dac119d6a21 ] + +early_init_dt_alloc_reserved_memory_arch() will free address @base when +suffers memblock_mark_nomap() error, but it still makes kmemleak ignore +the freed address @base via kmemleak_ignore_phys(). + +That is unnecessary, besides, also causes unnecessary warning messages: + +kmemleak_ignore_phys() + -> make_black_object() + -> paint_ptr() + -> kmemleak_warn() // warning message here. + +Fix by avoiding kmemleak_ignore_phys() when suffer the error. + +Fixes: 658aafc8139c ("memblock: exclude MEMBLOCK_NOMAP regions from kmemleak") +Signed-off-by: Zijun Hu +Link: https://lore.kernel.org/r/20250109-of_core_fix-v4-10-db8a72415b8c@quicinc.com +Signed-off-by: Rob Herring (Arm) +Signed-off-by: Sasha Levin +--- + drivers/of/of_reserved_mem.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c +index 46e1c3fbc7692..fa5ecac0b6e98 100644 +--- a/drivers/of/of_reserved_mem.c ++++ b/drivers/of/of_reserved_mem.c +@@ -51,7 +51,8 @@ static int __init early_init_dt_alloc_reserved_memory_arch(phys_addr_t size, + memblock_phys_free(base, size); + } + +- kmemleak_ignore_phys(base); ++ if (!err) ++ kmemleak_ignore_phys(base); + + return err; + } +-- +2.39.5 + diff --git a/queue-6.12/of-reserved_mem-restructure-how-the-reserved-memory-.patch b/queue-6.12/of-reserved_mem-restructure-how-the-reserved-memory-.patch new file mode 100644 index 0000000000..0fae2913d1 --- /dev/null +++ b/queue-6.12/of-reserved_mem-restructure-how-the-reserved-memory-.patch @@ -0,0 +1,428 @@ +From 613c02e456f1ce55da187913b557f33ce02d394d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 15:06:23 -0700 +Subject: of: reserved_mem: Restructure how the reserved memory regions are + processed + +From: Oreoluwa Babatunde + +[ Upstream commit 8a6e02d0c00e7b62e6acb74146878bb91e9e7e31 ] + +Reserved memory regions defined in the devicetree can be broken up into +two groups: +i) Statically-placed reserved memory regions +i.e. regions defined with a static start address and size using the + "reg" property. +ii) Dynamically-placed reserved memory regions. +i.e. regions defined by specifying an address range where they can be + placed in memory using the "alloc_ranges" and "size" properties. + +These regions are processed and set aside at boot time. +This is done in two stages as seen below: + +Stage 1: +At this stage, fdt_scan_reserved_mem() scans through the child nodes of +the reserved_memory node using the flattened devicetree and does the +following: + +1) If the node represents a statically-placed reserved memory region, + i.e. if it is defined using the "reg" property: + - Call memblock_reserve() or memblock_mark_nomap() as needed. + - Add the information for that region into the reserved_mem array + using fdt_reserved_mem_save_node(). + i.e. fdt_reserved_mem_save_node(node, name, base, size). + +2) If the node represents a dynamically-placed reserved memory region, + i.e. if it is defined using "alloc-ranges" and "size" properties: + - Add the information for that region to the reserved_mem array with + the starting address and size set to 0. + i.e. fdt_reserved_mem_save_node(node, name, 0, 0). + Note: This region is saved to the array with a starting address of 0 + because a starting address is not yet allocated for it. + +Stage 2: +After iterating through all the reserved memory nodes and storing their +relevant information in the reserved_mem array,fdt_init_reserved_mem() is +called and does the following: + +1) For statically-placed reserved memory regions: + - Call the region specific init function using + __reserved_mem_init_node(). +2) For dynamically-placed reserved memory regions: + - Call __reserved_mem_alloc_size() which is used to allocate memory + for each of these regions, and mark them as nomap if they have the + nomap property specified in the DT. + - Call the region specific init function. + +The current size of the resvered_mem array is 64 as is defined by +MAX_RESERVED_REGIONS. This means that there is a limitation of 64 for +how many reserved memory regions can be specified on a system. +As systems continue to grow more and more complex, the number of +reserved memory regions needed are also growing and are starting to hit +this 64 count limit, hence the need to make the reserved_mem array +dynamically sized (i.e. dynamically allocating memory for the +reserved_mem array using membock_alloc_*). + +On architectures such as arm64, memory allocated using memblock is +writable only after the page tables have been setup. This means that if +the reserved_mem array is going to be dynamically allocated, it needs to +happen after the page tables have been setup, not before. + +Since the reserved memory regions are currently being processed and +added to the array before the page tables are setup, there is a need to +change the order in which some of the processing is done to allow for +the reserved_mem array to be dynamically sized. + +It is possible to process the statically-placed reserved memory regions +without needing to store them in the reserved_mem array until after the +page tables have been setup because all the information stored in the +array is readily available in the devicetree and can be referenced at +any time. +Dynamically-placed reserved memory regions on the other hand get +assigned a start address only at runtime, and hence need a place to be +stored once they are allocated since there is no other referrence to the +start address for these regions. + +Hence this patch changes the processing order of the reserved memory +regions in the following ways: + +Step 1: +fdt_scan_reserved_mem() scans through the child nodes of +the reserved_memory node using the flattened devicetree and does the +following: + +1) If the node represents a statically-placed reserved memory region, + i.e. if it is defined using the "reg" property: + - Call memblock_reserve() or memblock_mark_nomap() as needed. + +2) If the node represents a dynamically-placed reserved memory region, + i.e. if it is defined using "alloc-ranges" and "size" properties: + - Call __reserved_mem_alloc_size() which will: + i) Allocate memory for the reserved region and call + memblock_mark_nomap() as needed. + ii) Call the region specific initialization function using + fdt_init_reserved_mem_node(). + iii) Save the region information in the reserved_mem array using + fdt_reserved_mem_save_node(). + +Step 2: +1) This stage of the reserved memory processing is now only used to add + the statically-placed reserved memory regions into the reserved_mem + array using fdt_scan_reserved_mem_reg_nodes(), as well as call their + region specific initialization functions. + +2) This step has also been moved to be after the page tables are + setup. Moving this will allow us to replace the reserved_mem + array with a dynamically sized array before storing the rest of + these regions. + +Signed-off-by: Oreoluwa Babatunde +Link: https://lore.kernel.org/r/20241008220624.551309-2-quic_obabatun@quicinc.com +Signed-off-by: Rob Herring (Arm) +Stable-dep-of: 14bce187d160 ("of/fdt: Restore possibility to use both ACPI and FDT from bootloader") +Signed-off-by: Sasha Levin +--- + drivers/of/fdt.c | 5 +- + drivers/of/of_private.h | 3 +- + drivers/of/of_reserved_mem.c | 168 ++++++++++++++++++++++++----------- + 3 files changed, 122 insertions(+), 54 deletions(-) + +diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c +index 546e76ac407cf..d3ecf2bdd2023 100644 +--- a/drivers/of/fdt.c ++++ b/drivers/of/fdt.c +@@ -512,8 +512,6 @@ void __init early_init_fdt_scan_reserved_mem(void) + break; + memblock_reserve(base, size); + } +- +- fdt_init_reserved_mem(); + } + + /** +@@ -1214,6 +1212,9 @@ void __init unflatten_device_tree(void) + { + void *fdt = initial_boot_params; + ++ /* Save the statically-placed regions in the reserved_mem array */ ++ fdt_scan_reserved_mem_reg_nodes(); ++ + /* Don't use the bootloader provided DTB if ACPI is enabled */ + if (!acpi_disabled) + fdt = NULL; +diff --git a/drivers/of/of_private.h b/drivers/of/of_private.h +index c235d6c909a16..1069886225257 100644 +--- a/drivers/of/of_private.h ++++ b/drivers/of/of_private.h +@@ -9,6 +9,7 @@ + */ + + #define FDT_ALIGN_SIZE 8 ++#define MAX_RESERVED_REGIONS 64 + + /** + * struct alias_prop - Alias property in 'aliases' node +@@ -183,7 +184,7 @@ static inline struct device_node *__of_get_dma_parent(const struct device_node * + #endif + + int fdt_scan_reserved_mem(void); +-void fdt_init_reserved_mem(void); ++void __init fdt_scan_reserved_mem_reg_nodes(void); + + bool of_fdt_device_is_available(const void *blob, unsigned long node); + +diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c +index fa5ecac0b6e98..70d6d727c91a6 100644 +--- a/drivers/of/of_reserved_mem.c ++++ b/drivers/of/of_reserved_mem.c +@@ -27,7 +27,6 @@ + + #include "of_private.h" + +-#define MAX_RESERVED_REGIONS 64 + static struct reserved_mem reserved_mem[MAX_RESERVED_REGIONS]; + static int reserved_mem_count; + +@@ -57,6 +56,7 @@ static int __init early_init_dt_alloc_reserved_memory_arch(phys_addr_t size, + return err; + } + ++static void __init fdt_init_reserved_mem_node(struct reserved_mem *rmem); + /* + * fdt_reserved_mem_save_node() - save fdt node for second pass initialization + */ +@@ -75,6 +75,9 @@ static void __init fdt_reserved_mem_save_node(unsigned long node, const char *un + rmem->base = base; + rmem->size = size; + ++ /* Call the region specific initialization function */ ++ fdt_init_reserved_mem_node(rmem); ++ + reserved_mem_count++; + return; + } +@@ -107,7 +110,6 @@ static int __init __reserved_mem_reserve_reg(unsigned long node, + phys_addr_t base, size; + int len; + const __be32 *prop; +- int first = 1; + bool nomap; + + prop = of_get_flat_dt_prop(node, "reg", &len); +@@ -135,10 +137,6 @@ static int __init __reserved_mem_reserve_reg(unsigned long node, + uname, &base, (unsigned long)(size / SZ_1M)); + + len -= t_len; +- if (first) { +- fdt_reserved_mem_save_node(node, uname, base, size); +- first = 0; +- } + } + return 0; + } +@@ -166,12 +164,77 @@ static int __init __reserved_mem_check_root(unsigned long node) + return 0; + } + ++static void __init __rmem_check_for_overlap(void); ++ ++/** ++ * fdt_scan_reserved_mem_reg_nodes() - Store info for the "reg" defined ++ * reserved memory regions. ++ * ++ * This function is used to scan through the DT and store the ++ * information for the reserved memory regions that are defined using ++ * the "reg" property. The region node number, name, base address, and ++ * size are all stored in the reserved_mem array by calling the ++ * fdt_reserved_mem_save_node() function. ++ */ ++void __init fdt_scan_reserved_mem_reg_nodes(void) ++{ ++ int t_len = (dt_root_addr_cells + dt_root_size_cells) * sizeof(__be32); ++ const void *fdt = initial_boot_params; ++ phys_addr_t base, size; ++ const __be32 *prop; ++ int node, child; ++ int len; ++ ++ if (!fdt) ++ return; ++ ++ node = fdt_path_offset(fdt, "/reserved-memory"); ++ if (node < 0) { ++ pr_info("Reserved memory: No reserved-memory node in the DT\n"); ++ return; ++ } ++ ++ if (__reserved_mem_check_root(node)) { ++ pr_err("Reserved memory: unsupported node format, ignoring\n"); ++ return; ++ } ++ ++ fdt_for_each_subnode(child, fdt, node) { ++ const char *uname; ++ ++ prop = of_get_flat_dt_prop(child, "reg", &len); ++ if (!prop) ++ continue; ++ if (!of_fdt_device_is_available(fdt, child)) ++ continue; ++ ++ uname = fdt_get_name(fdt, child, NULL); ++ if (len && len % t_len != 0) { ++ pr_err("Reserved memory: invalid reg property in '%s', skipping node.\n", ++ uname); ++ continue; ++ } ++ base = dt_mem_next_cell(dt_root_addr_cells, &prop); ++ size = dt_mem_next_cell(dt_root_size_cells, &prop); ++ ++ if (size) ++ fdt_reserved_mem_save_node(child, uname, base, size); ++ } ++ ++ /* check for overlapping reserved regions */ ++ __rmem_check_for_overlap(); ++} ++ ++static int __init __reserved_mem_alloc_size(unsigned long node, const char *uname); ++ + /* + * fdt_scan_reserved_mem() - scan a single FDT node for reserved memory + */ + int __init fdt_scan_reserved_mem(void) + { + int node, child; ++ int dynamic_nodes_cnt = 0; ++ int dynamic_nodes[MAX_RESERVED_REGIONS]; + const void *fdt = initial_boot_params; + + node = fdt_path_offset(fdt, "/reserved-memory"); +@@ -193,8 +256,24 @@ int __init fdt_scan_reserved_mem(void) + uname = fdt_get_name(fdt, child, NULL); + + err = __reserved_mem_reserve_reg(child, uname); +- if (err == -ENOENT && of_get_flat_dt_prop(child, "size", NULL)) +- fdt_reserved_mem_save_node(child, uname, 0, 0); ++ /* ++ * Save the nodes for the dynamically-placed regions ++ * into an array which will be used for allocation right ++ * after all the statically-placed regions are reserved ++ * or marked as no-map. This is done to avoid dynamically ++ * allocating from one of the statically-placed regions. ++ */ ++ if (err == -ENOENT && of_get_flat_dt_prop(child, "size", NULL)) { ++ dynamic_nodes[dynamic_nodes_cnt] = child; ++ dynamic_nodes_cnt++; ++ } ++ } ++ for (int i = 0; i < dynamic_nodes_cnt; i++) { ++ const char *uname; ++ ++ child = dynamic_nodes[i]; ++ uname = fdt_get_name(fdt, child, NULL); ++ __reserved_mem_alloc_size(child, uname); + } + return 0; + } +@@ -254,8 +333,7 @@ static int __init __reserved_mem_alloc_in_range(phys_addr_t size, + * __reserved_mem_alloc_size() - allocate reserved memory described by + * 'size', 'alignment' and 'alloc-ranges' properties. + */ +-static int __init __reserved_mem_alloc_size(unsigned long node, +- const char *uname, phys_addr_t *res_base, phys_addr_t *res_size) ++static int __init __reserved_mem_alloc_size(unsigned long node, const char *uname) + { + int t_len = (dt_root_addr_cells + dt_root_size_cells) * sizeof(__be32); + phys_addr_t start = 0, end = 0; +@@ -335,9 +413,8 @@ static int __init __reserved_mem_alloc_size(unsigned long node, + return -ENOMEM; + } + +- *res_base = base; +- *res_size = size; +- ++ /* Save region in the reserved_mem array */ ++ fdt_reserved_mem_save_node(node, uname, base, size); + return 0; + } + +@@ -426,48 +503,37 @@ static void __init __rmem_check_for_overlap(void) + } + + /** +- * fdt_init_reserved_mem() - allocate and init all saved reserved memory regions ++ * fdt_init_reserved_mem_node() - Initialize a reserved memory region ++ * @rmem: reserved_mem struct of the memory region to be initialized. ++ * ++ * This function is used to call the region specific initialization ++ * function for a reserved memory region. + */ +-void __init fdt_init_reserved_mem(void) ++static void __init fdt_init_reserved_mem_node(struct reserved_mem *rmem) + { +- int i; +- +- /* check for overlapping reserved regions */ +- __rmem_check_for_overlap(); +- +- for (i = 0; i < reserved_mem_count; i++) { +- struct reserved_mem *rmem = &reserved_mem[i]; +- unsigned long node = rmem->fdt_node; +- int err = 0; +- bool nomap; ++ unsigned long node = rmem->fdt_node; ++ int err = 0; ++ bool nomap; + +- nomap = of_get_flat_dt_prop(node, "no-map", NULL) != NULL; ++ nomap = of_get_flat_dt_prop(node, "no-map", NULL) != NULL; + +- if (rmem->size == 0) +- err = __reserved_mem_alloc_size(node, rmem->name, +- &rmem->base, &rmem->size); +- if (err == 0) { +- err = __reserved_mem_init_node(rmem); +- if (err != 0 && err != -ENOENT) { +- pr_info("node %s compatible matching fail\n", +- rmem->name); +- if (nomap) +- memblock_clear_nomap(rmem->base, rmem->size); +- else +- memblock_phys_free(rmem->base, +- rmem->size); +- } else { +- phys_addr_t end = rmem->base + rmem->size - 1; +- bool reusable = +- (of_get_flat_dt_prop(node, "reusable", NULL)) != NULL; +- +- pr_info("%pa..%pa (%lu KiB) %s %s %s\n", +- &rmem->base, &end, (unsigned long)(rmem->size / SZ_1K), +- nomap ? "nomap" : "map", +- reusable ? "reusable" : "non-reusable", +- rmem->name ? rmem->name : "unknown"); +- } +- } ++ err = __reserved_mem_init_node(rmem); ++ if (err != 0 && err != -ENOENT) { ++ pr_info("node %s compatible matching fail\n", rmem->name); ++ if (nomap) ++ memblock_clear_nomap(rmem->base, rmem->size); ++ else ++ memblock_phys_free(rmem->base, rmem->size); ++ } else { ++ phys_addr_t end = rmem->base + rmem->size - 1; ++ bool reusable = ++ (of_get_flat_dt_prop(node, "reusable", NULL)) != NULL; ++ ++ pr_info("%pa..%pa (%lu KiB) %s %s %s\n", ++ &rmem->base, &end, (unsigned long)(rmem->size / SZ_1K), ++ nomap ? "nomap" : "map", ++ reusable ? "reusable" : "non-reusable", ++ rmem->name ? rmem->name : "unknown"); + } + } + +-- +2.39.5 + diff --git a/queue-6.12/opp-add-index-check-to-assert-to-avoid-buffer-overfl.patch b/queue-6.12/opp-add-index-check-to-assert-to-avoid-buffer-overfl.patch new file mode 100644 index 0000000000..169d064fef --- /dev/null +++ b/queue-6.12/opp-add-index-check-to-assert-to-avoid-buffer-overfl.patch @@ -0,0 +1,185 @@ +From 1176e4c27d07c095e4c386525630eab34d8a2dd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Dec 2024 09:12:59 +0100 +Subject: OPP: add index check to assert to avoid buffer overflow in + _read_freq() + +From: Neil Armstrong + +[ Upstream commit d659bc68ed489022ea33342cfbda2911a81e7a0d ] + +Pass the freq index to the assert function to make sure +we do not read a freq out of the opp->rates[] table when called +from the indexed variants: +dev_pm_opp_find_freq_exact_indexed() or +dev_pm_opp_find_freq_ceil/floor_indexed(). + +Add a secondary parameter to the assert function, unused +for assert_single_clk() then add assert_clk_index() which +will check for the clock index when called from the _indexed() +find functions. + +Fixes: 142e17c1c2b4 ("OPP: Introduce dev_pm_opp_find_freq_{ceil/floor}_indexed() APIs") +Fixes: a5893928bb17 ("OPP: Add dev_pm_opp_find_freq_exact_indexed()") +Signed-off-by: Neil Armstrong +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/opp/core.c | 42 +++++++++++++++++++++++++++--------------- + 1 file changed, 27 insertions(+), 15 deletions(-) + +diff --git a/drivers/opp/core.c b/drivers/opp/core.c +index 3aa18737470fa..1efb819c91b63 100644 +--- a/drivers/opp/core.c ++++ b/drivers/opp/core.c +@@ -101,11 +101,21 @@ struct opp_table *_find_opp_table(struct device *dev) + * representation in the OPP table and manage the clock configuration themselves + * in an platform specific way. + */ +-static bool assert_single_clk(struct opp_table *opp_table) ++static bool assert_single_clk(struct opp_table *opp_table, ++ unsigned int __always_unused index) + { + return !WARN_ON(opp_table->clk_count > 1); + } + ++/* ++ * Returns true if clock table is large enough to contain the clock index. ++ */ ++static bool assert_clk_index(struct opp_table *opp_table, ++ unsigned int index) ++{ ++ return opp_table->clk_count > index; ++} ++ + /** + * dev_pm_opp_get_voltage() - Gets the voltage corresponding to an opp + * @opp: opp for which voltage has to be returned for +@@ -499,12 +509,12 @@ static struct dev_pm_opp *_opp_table_find_key(struct opp_table *opp_table, + unsigned long (*read)(struct dev_pm_opp *opp, int index), + bool (*compare)(struct dev_pm_opp **opp, struct dev_pm_opp *temp_opp, + unsigned long opp_key, unsigned long key), +- bool (*assert)(struct opp_table *opp_table)) ++ bool (*assert)(struct opp_table *opp_table, unsigned int index)) + { + struct dev_pm_opp *temp_opp, *opp = ERR_PTR(-ERANGE); + + /* Assert that the requirement is met */ +- if (assert && !assert(opp_table)) ++ if (assert && !assert(opp_table, index)) + return ERR_PTR(-EINVAL); + + mutex_lock(&opp_table->lock); +@@ -532,7 +542,7 @@ _find_key(struct device *dev, unsigned long *key, int index, bool available, + unsigned long (*read)(struct dev_pm_opp *opp, int index), + bool (*compare)(struct dev_pm_opp **opp, struct dev_pm_opp *temp_opp, + unsigned long opp_key, unsigned long key), +- bool (*assert)(struct opp_table *opp_table)) ++ bool (*assert)(struct opp_table *opp_table, unsigned int index)) + { + struct opp_table *opp_table; + struct dev_pm_opp *opp; +@@ -555,7 +565,7 @@ _find_key(struct device *dev, unsigned long *key, int index, bool available, + static struct dev_pm_opp *_find_key_exact(struct device *dev, + unsigned long key, int index, bool available, + unsigned long (*read)(struct dev_pm_opp *opp, int index), +- bool (*assert)(struct opp_table *opp_table)) ++ bool (*assert)(struct opp_table *opp_table, unsigned int index)) + { + /* + * The value of key will be updated here, but will be ignored as the +@@ -568,7 +578,7 @@ static struct dev_pm_opp *_find_key_exact(struct device *dev, + static struct dev_pm_opp *_opp_table_find_key_ceil(struct opp_table *opp_table, + unsigned long *key, int index, bool available, + unsigned long (*read)(struct dev_pm_opp *opp, int index), +- bool (*assert)(struct opp_table *opp_table)) ++ bool (*assert)(struct opp_table *opp_table, unsigned int index)) + { + return _opp_table_find_key(opp_table, key, index, available, read, + _compare_ceil, assert); +@@ -577,7 +587,7 @@ static struct dev_pm_opp *_opp_table_find_key_ceil(struct opp_table *opp_table, + static struct dev_pm_opp *_find_key_ceil(struct device *dev, unsigned long *key, + int index, bool available, + unsigned long (*read)(struct dev_pm_opp *opp, int index), +- bool (*assert)(struct opp_table *opp_table)) ++ bool (*assert)(struct opp_table *opp_table, unsigned int index)) + { + return _find_key(dev, key, index, available, read, _compare_ceil, + assert); +@@ -586,7 +596,7 @@ static struct dev_pm_opp *_find_key_ceil(struct device *dev, unsigned long *key, + static struct dev_pm_opp *_find_key_floor(struct device *dev, + unsigned long *key, int index, bool available, + unsigned long (*read)(struct dev_pm_opp *opp, int index), +- bool (*assert)(struct opp_table *opp_table)) ++ bool (*assert)(struct opp_table *opp_table, unsigned int index)) + { + return _find_key(dev, key, index, available, read, _compare_floor, + assert); +@@ -647,7 +657,8 @@ struct dev_pm_opp * + dev_pm_opp_find_freq_exact_indexed(struct device *dev, unsigned long freq, + u32 index, bool available) + { +- return _find_key_exact(dev, freq, index, available, _read_freq, NULL); ++ return _find_key_exact(dev, freq, index, available, _read_freq, ++ assert_clk_index); + } + EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_exact_indexed); + +@@ -707,7 +718,8 @@ struct dev_pm_opp * + dev_pm_opp_find_freq_ceil_indexed(struct device *dev, unsigned long *freq, + u32 index) + { +- return _find_key_ceil(dev, freq, index, true, _read_freq, NULL); ++ return _find_key_ceil(dev, freq, index, true, _read_freq, ++ assert_clk_index); + } + EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_ceil_indexed); + +@@ -760,7 +772,7 @@ struct dev_pm_opp * + dev_pm_opp_find_freq_floor_indexed(struct device *dev, unsigned long *freq, + u32 index) + { +- return _find_key_floor(dev, freq, index, true, _read_freq, NULL); ++ return _find_key_floor(dev, freq, index, true, _read_freq, assert_clk_index); + } + EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_floor_indexed); + +@@ -1702,7 +1714,7 @@ void dev_pm_opp_remove(struct device *dev, unsigned long freq) + if (IS_ERR(opp_table)) + return; + +- if (!assert_single_clk(opp_table)) ++ if (!assert_single_clk(opp_table, 0)) + goto put_table; + + mutex_lock(&opp_table->lock); +@@ -2054,7 +2066,7 @@ int _opp_add_v1(struct opp_table *opp_table, struct device *dev, + unsigned long tol, u_volt = data->u_volt; + int ret; + +- if (!assert_single_clk(opp_table)) ++ if (!assert_single_clk(opp_table, 0)) + return -EINVAL; + + new_opp = _opp_allocate(opp_table); +@@ -2911,7 +2923,7 @@ static int _opp_set_availability(struct device *dev, unsigned long freq, + return r; + } + +- if (!assert_single_clk(opp_table)) { ++ if (!assert_single_clk(opp_table, 0)) { + r = -EINVAL; + goto put_table; + } +@@ -2987,7 +2999,7 @@ int dev_pm_opp_adjust_voltage(struct device *dev, unsigned long freq, + return r; + } + +- if (!assert_single_clk(opp_table)) { ++ if (!assert_single_clk(opp_table, 0)) { + r = -EINVAL; + goto put_table; + } +-- +2.39.5 + diff --git a/queue-6.12/opp-fix-dev_pm_opp_find_bw_-when-bandwidth-table-not.patch b/queue-6.12/opp-fix-dev_pm_opp_find_bw_-when-bandwidth-table-not.patch new file mode 100644 index 0000000000..7f516de9f6 --- /dev/null +++ b/queue-6.12/opp-fix-dev_pm_opp_find_bw_-when-bandwidth-table-not.patch @@ -0,0 +1,81 @@ +From f63c9ed55df050dd9ed4003a42e25f4cda73772a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Dec 2024 09:13:00 +0100 +Subject: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized + +From: Neil Armstrong + +[ Upstream commit b44b9bc7cab2967c3d6a791b1cd542c89fc07f0e ] + +If a driver calls dev_pm_opp_find_bw_ceil/floor() the retrieve bandwidth +from the OPP table but the bandwidth table was not created because the +interconnect properties were missing in the OPP consumer node, the +kernel will crash with: + +Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 +... +pc : _read_bw+0x8/0x10 +lr : _opp_table_find_key+0x9c/0x174 +... +Call trace: + _read_bw+0x8/0x10 (P) + _opp_table_find_key+0x9c/0x174 (L) + _find_key+0x98/0x168 + dev_pm_opp_find_bw_ceil+0x50/0x88 +... + +In order to fix the crash, create an assert function to check +if the bandwidth table was created before trying to get a +bandwidth with _read_bw(). + +Fixes: add1dc094a74 ("OPP: Use generic key finding helpers for bandwidth key") +Signed-off-by: Neil Armstrong +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/opp/core.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/opp/core.c b/drivers/opp/core.c +index 1efb819c91b63..5ac209472c0cf 100644 +--- a/drivers/opp/core.c ++++ b/drivers/opp/core.c +@@ -116,6 +116,15 @@ static bool assert_clk_index(struct opp_table *opp_table, + return opp_table->clk_count > index; + } + ++/* ++ * Returns true if bandwidth table is large enough to contain the bandwidth index. ++ */ ++static bool assert_bandwidth_index(struct opp_table *opp_table, ++ unsigned int index) ++{ ++ return opp_table->path_count > index; ++} ++ + /** + * dev_pm_opp_get_voltage() - Gets the voltage corresponding to an opp + * @opp: opp for which voltage has to be returned for +@@ -890,7 +899,8 @@ struct dev_pm_opp *dev_pm_opp_find_bw_ceil(struct device *dev, unsigned int *bw, + unsigned long temp = *bw; + struct dev_pm_opp *opp; + +- opp = _find_key_ceil(dev, &temp, index, true, _read_bw, NULL); ++ opp = _find_key_ceil(dev, &temp, index, true, _read_bw, ++ assert_bandwidth_index); + *bw = temp; + return opp; + } +@@ -921,7 +931,8 @@ struct dev_pm_opp *dev_pm_opp_find_bw_floor(struct device *dev, + unsigned long temp = *bw; + struct dev_pm_opp *opp; + +- opp = _find_key_floor(dev, &temp, index, true, _read_bw, NULL); ++ opp = _find_key_floor(dev, &temp, index, true, _read_bw, ++ assert_bandwidth_index); + *bw = temp; + return opp; + } +-- +2.39.5 + diff --git a/queue-6.12/opp-of-fix-an-of-node-leak-in-_opp_add_static_v2.patch b/queue-6.12/opp-of-fix-an-of-node-leak-in-_opp_add_static_v2.patch new file mode 100644 index 0000000000..47b648390c --- /dev/null +++ b/queue-6.12/opp-of-fix-an-of-node-leak-in-_opp_add_static_v2.patch @@ -0,0 +1,46 @@ +From af6703fe2d3b3ee29832d565b6cd2d2f925848c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jan 2025 14:44:53 +0900 +Subject: OPP: OF: Fix an OF node leak in _opp_add_static_v2() + +From: Joe Hattori + +[ Upstream commit 1d38eb7f7b26261a0b642f6e0923269c7c000a97 ] + +_opp_add_static_v2() leaks the obtained OF node reference when +_of_opp_alloc_required_opps() fails. Add an of_node_put() call in the +error path. + +Fixes: 3466ea2cd6b6 ("OPP: Don't drop opp->np reference while it is still in use") +Signed-off-by: Joe Hattori +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/opp/of.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/opp/of.c b/drivers/opp/of.c +index 55c8cfef97d48..dcab0e7ace106 100644 +--- a/drivers/opp/of.c ++++ b/drivers/opp/of.c +@@ -959,7 +959,7 @@ static struct dev_pm_opp *_opp_add_static_v2(struct opp_table *opp_table, + + ret = _of_opp_alloc_required_opps(opp_table, new_opp); + if (ret) +- goto free_opp; ++ goto put_node; + + if (!of_property_read_u32(np, "clock-latency-ns", &val)) + new_opp->clock_latency_ns = val; +@@ -1009,6 +1009,8 @@ static struct dev_pm_opp *_opp_add_static_v2(struct opp_table *opp_table, + + free_required_opps: + _of_opp_free_required_opps(opp_table, new_opp); ++put_node: ++ of_node_put(np); + free_opp: + _opp_free(new_opp); + +-- +2.39.5 + diff --git a/queue-6.12/padata-add-pd-get-put-refcnt-helper.patch b/queue-6.12/padata-add-pd-get-put-refcnt-helper.patch new file mode 100644 index 0000000000..185f9a8d69 --- /dev/null +++ b/queue-6.12/padata-add-pd-get-put-refcnt-helper.patch @@ -0,0 +1,89 @@ +From fdd3b61e315c62f767e914c7287aaca51ed3e844 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 06:16:37 +0000 +Subject: padata: add pd get/put refcnt helper + +From: Chen Ridong + +[ Upstream commit ae154202cc6a189b035359f3c4e143d5c24d5352 ] + +Add helpers for pd to get/put refcnt to make code consice. + +Signed-off-by: Chen Ridong +Acked-by: Daniel Jordan +Signed-off-by: Herbert Xu +Stable-dep-of: dd7d37ccf6b1 ("padata: avoid UAF for reorder_work") +Signed-off-by: Sasha Levin +--- + kernel/padata.c | 27 ++++++++++++++++++++------- + 1 file changed, 20 insertions(+), 7 deletions(-) + +diff --git a/kernel/padata.c b/kernel/padata.c +index e2ae2c3747a85..a4c7a6eefe10e 100644 +--- a/kernel/padata.c ++++ b/kernel/padata.c +@@ -47,6 +47,22 @@ struct padata_mt_job_state { + static void padata_free_pd(struct parallel_data *pd); + static void __init padata_mt_helper(struct work_struct *work); + ++static inline void padata_get_pd(struct parallel_data *pd) ++{ ++ refcount_inc(&pd->refcnt); ++} ++ ++static inline void padata_put_pd_cnt(struct parallel_data *pd, int cnt) ++{ ++ if (refcount_sub_and_test(cnt, &pd->refcnt)) ++ padata_free_pd(pd); ++} ++ ++static inline void padata_put_pd(struct parallel_data *pd) ++{ ++ padata_put_pd_cnt(pd, 1); ++} ++ + static int padata_index_to_cpu(struct parallel_data *pd, int cpu_index) + { + int cpu, target_cpu; +@@ -206,7 +222,7 @@ int padata_do_parallel(struct padata_shell *ps, + if ((pinst->flags & PADATA_RESET)) + goto out; + +- refcount_inc(&pd->refcnt); ++ padata_get_pd(pd); + padata->pd = pd; + padata->cb_cpu = *cb_cpu; + +@@ -380,8 +396,7 @@ static void padata_serial_worker(struct work_struct *serial_work) + } + local_bh_enable(); + +- if (refcount_sub_and_test(cnt, &pd->refcnt)) +- padata_free_pd(pd); ++ padata_put_pd_cnt(pd, cnt); + } + + /** +@@ -688,8 +703,7 @@ static int padata_replace(struct padata_instance *pinst) + synchronize_rcu(); + + list_for_each_entry_continue_reverse(ps, &pinst->pslist, list) +- if (refcount_dec_and_test(&ps->opd->refcnt)) +- padata_free_pd(ps->opd); ++ padata_put_pd(ps->opd); + + pinst->flags &= ~PADATA_RESET; + +@@ -1137,8 +1151,7 @@ void padata_free_shell(struct padata_shell *ps) + mutex_lock(&ps->pinst->lock); + list_del(&ps->list); + pd = rcu_dereference_protected(ps->pd, 1); +- if (refcount_dec_and_test(&pd->refcnt)) +- padata_free_pd(pd); ++ padata_put_pd(pd); + mutex_unlock(&ps->pinst->lock); + + kfree(ps); +-- +2.39.5 + diff --git a/queue-6.12/padata-avoid-uaf-for-reorder_work.patch b/queue-6.12/padata-avoid-uaf-for-reorder_work.patch new file mode 100644 index 0000000000..91c0f9b01e --- /dev/null +++ b/queue-6.12/padata-avoid-uaf-for-reorder_work.patch @@ -0,0 +1,91 @@ +From 68ac1b07090cf3e8fac6f7880040f5200a3e66b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 06:16:39 +0000 +Subject: padata: avoid UAF for reorder_work + +From: Chen Ridong + +[ Upstream commit dd7d37ccf6b11f3d95e797ebe4e9e886d0332600 ] + +Although the previous patch can avoid ps and ps UAF for _do_serial, it +can not avoid potential UAF issue for reorder_work. This issue can +happen just as below: + +crypto_request crypto_request crypto_del_alg +padata_do_serial + ... + padata_reorder + // processes all remaining + // requests then breaks + while (1) { + if (!padata) + break; + ... + } + + padata_do_serial + // new request added + list_add + // sees the new request + queue_work(reorder_work) + padata_reorder + queue_work_on(squeue->work) +... + + + padata_serial_worker + // completes new request, + // no more outstanding + // requests + + crypto_del_alg + // free pd + + +invoke_padata_reorder + // UAF of pd + +To avoid UAF for 'reorder_work', get 'pd' ref before put 'reorder_work' +into the 'serial_wq' and put 'pd' ref until the 'serial_wq' finish. + +Fixes: bbefa1dd6a6d ("crypto: pcrypt - Avoid deadlock by using per-instance padata queues") +Signed-off-by: Chen Ridong +Acked-by: Daniel Jordan +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + kernel/padata.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/kernel/padata.c b/kernel/padata.c +index a4c7a6eefe10e..22770372bdf32 100644 +--- a/kernel/padata.c ++++ b/kernel/padata.c +@@ -352,8 +352,14 @@ static void padata_reorder(struct parallel_data *pd) + smp_mb(); + + reorder = per_cpu_ptr(pd->reorder_list, pd->cpu); +- if (!list_empty(&reorder->list) && padata_find_next(pd, false)) ++ if (!list_empty(&reorder->list) && padata_find_next(pd, false)) { ++ /* ++ * Other context(eg. the padata_serial_worker) can finish the request. ++ * To avoid UAF issue, add pd ref here, and put pd ref after reorder_work finish. ++ */ ++ padata_get_pd(pd); + queue_work(pinst->serial_wq, &pd->reorder_work); ++ } + } + + static void invoke_padata_reorder(struct work_struct *work) +@@ -364,6 +370,8 @@ static void invoke_padata_reorder(struct work_struct *work) + pd = container_of(work, struct parallel_data, reorder_work); + padata_reorder(pd); + local_bh_enable(); ++ /* Pairs with putting the reorder_work in the serial_wq */ ++ padata_put_pd(pd); + } + + static void padata_serial_worker(struct work_struct *serial_work) +-- +2.39.5 + diff --git a/queue-6.12/padata-fix-sysfs-store-callback-check.patch b/queue-6.12/padata-fix-sysfs-store-callback-check.patch new file mode 100644 index 0000000000..1438bd4cf0 --- /dev/null +++ b/queue-6.12/padata-fix-sysfs-store-callback-check.patch @@ -0,0 +1,40 @@ +From be563152bdbbaa3c4dec0e15a04946878cdc435e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Dec 2024 23:32:01 +0100 +Subject: padata: fix sysfs store callback check +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 9ff6e943bce67d125781fe4780a5d6f072dc44c0 ] + +padata_sysfs_store() was copied from padata_sysfs_show() but this check +was not adapted. Today there is no attribute which can fail this +check, but if there is one it may as well be correct. + +Fixes: 5e017dc3f8bc ("padata: Added sysfs primitives to padata subsystem") +Signed-off-by: Thomas Weißschuh +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + kernel/padata.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/padata.c b/kernel/padata.c +index d899f34558afc..ada4a0d137d9b 100644 +--- a/kernel/padata.c ++++ b/kernel/padata.c +@@ -977,7 +977,7 @@ static ssize_t padata_sysfs_store(struct kobject *kobj, struct attribute *attr, + + pinst = kobj2pinst(kobj); + pentry = attr2pentry(attr); +- if (pentry->show) ++ if (pentry->store) + ret = pentry->store(pinst, attr, buf, count); + + return ret; +-- +2.39.5 + diff --git a/queue-6.12/padata-fix-uaf-in-padata_reorder.patch b/queue-6.12/padata-fix-uaf-in-padata_reorder.patch new file mode 100644 index 0000000000..5761591ee6 --- /dev/null +++ b/queue-6.12/padata-fix-uaf-in-padata_reorder.patch @@ -0,0 +1,94 @@ +From e9f536ec8a56bc810bf4067eb1fca9adf5510ad1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 06:16:38 +0000 +Subject: padata: fix UAF in padata_reorder + +From: Chen Ridong + +[ Upstream commit e01780ea4661172734118d2a5f41bc9720765668 ] + +A bug was found when run ltp test: + +BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0 +Read of size 4 at addr ffff88bbfe003524 by task kworker/u113:2/3039206 + +CPU: 0 PID: 3039206 Comm: kworker/u113:2 Kdump: loaded Not tainted 6.6.0+ +Workqueue: pdecrypt_parallel padata_parallel_worker +Call Trace: + +dump_stack_lvl+0x32/0x50 +print_address_description.constprop.0+0x6b/0x3d0 +print_report+0xdd/0x2c0 +kasan_report+0xa5/0xd0 +padata_find_next+0x29/0x1a0 +padata_reorder+0x131/0x220 +padata_parallel_worker+0x3d/0xc0 +process_one_work+0x2ec/0x5a0 + +If 'mdelay(10)' is added before calling 'padata_find_next' in the +'padata_reorder' function, this issue could be reproduced easily with +ltp test (pcrypt_aead01). + +This can be explained as bellow: + +pcrypt_aead_encrypt +... +padata_do_parallel +refcount_inc(&pd->refcnt); // add refcnt +... +padata_do_serial +padata_reorder // pd +while (1) { +padata_find_next(pd, true); // using pd +queue_work_on +... +padata_serial_worker crypto_del_alg +padata_put_pd_cnt // sub refcnt + padata_free_shell + padata_put_pd(ps->pd); + // pd is freed +// loop again, but pd is freed +// call padata_find_next, UAF +} + +In the padata_reorder function, when it loops in 'while', if the alg is +deleted, the refcnt may be decreased to 0 before entering +'padata_find_next', which leads to UAF. + +As mentioned in [1], do_serial is supposed to be called with BHs disabled +and always happen under RCU protection, to address this issue, add +synchronize_rcu() in 'padata_free_shell' wait for all _do_serial calls +to finish. + +[1] https://lore.kernel.org/all/20221028160401.cccypv4euxikusiq@parnassus.localdomain/ +[2] https://lore.kernel.org/linux-kernel/jfjz5d7zwbytztackem7ibzalm5lnxldi2eofeiczqmqs2m7o6@fq426cwnjtkm/ +Fixes: b128a3040935 ("padata: allocate workqueue internally") +Signed-off-by: Chen Ridong +Signed-off-by: Qu Zicheng +Acked-by: Daniel Jordan +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + kernel/padata.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/kernel/padata.c b/kernel/padata.c +index ada4a0d137d9b..e2ae2c3747a85 100644 +--- a/kernel/padata.c ++++ b/kernel/padata.c +@@ -1128,6 +1128,12 @@ void padata_free_shell(struct padata_shell *ps) + if (!ps) + return; + ++ /* ++ * Wait for all _do_serial calls to finish to avoid touching ++ * freed pd's and ps's. ++ */ ++ synchronize_rcu(); ++ + mutex_lock(&ps->pinst->lock); + list_del(&ps->list); + pd = rcu_dereference_protected(ps->pd, 1); +-- +2.39.5 + diff --git a/queue-6.12/partitions-ldm-remove-the-initial-kernel-doc-notatio.patch b/queue-6.12/partitions-ldm-remove-the-initial-kernel-doc-notatio.patch new file mode 100644 index 0000000000..fddb529295 --- /dev/null +++ b/queue-6.12/partitions-ldm-remove-the-initial-kernel-doc-notatio.patch @@ -0,0 +1,41 @@ +From 3b173066c09139527b84a6270d0cb5512ad2f9a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 22:27:58 -0800 +Subject: partitions: ldm: remove the initial kernel-doc notation + +From: Randy Dunlap + +[ Upstream commit e494e451611a3de6ae95f99e8339210c157d70fb ] + +Remove the file's first comment describing what the file is. +This comment is not in kernel-doc format so it causes a kernel-doc +warning. + +ldm.h:13: warning: expecting prototype for ldm(). Prototype was for _FS_PT_LDM_H_() instead + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Randy Dunlap +Cc: Richard Russon (FlatCap) +Cc: linux-ntfs-dev@lists.sourceforge.net +Cc: Jens Axboe +Link: https://lore.kernel.org/r/20250111062758.910458-1-rdunlap@infradead.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/partitions/ldm.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/block/partitions/ldm.h b/block/partitions/ldm.h +index e259180c89148..aa3bd050d8cdd 100644 +--- a/block/partitions/ldm.h ++++ b/block/partitions/ldm.h +@@ -1,5 +1,5 @@ + // SPDX-License-Identifier: GPL-2.0-or-later +-/** ++/* + * ldm - Part of the Linux-NTFS project. + * + * Copyright (C) 2001,2002 Richard Russon +-- +2.39.5 + diff --git a/queue-6.12/pci-aspm-save-parent-l1ss-config-in-pci_save_aspm_l1.patch b/queue-6.12/pci-aspm-save-parent-l1ss-config-in-pci_save_aspm_l1.patch new file mode 100644 index 0000000000..a3db9100c3 --- /dev/null +++ b/queue-6.12/pci-aspm-save-parent-l1ss-config-in-pci_save_aspm_l1.patch @@ -0,0 +1,100 @@ +From 2889b7a13a41b8018ce6f8f40145b9430f95170e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Nov 2024 15:22:02 +0800 +Subject: PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jian-Hong Pan + +[ Upstream commit 1db806ec06b7c6e08e8af57088da067963ddf117 ] + +After 17423360a27a ("PCI/ASPM: Save L1 PM Substates Capability for +suspend/resume"), pci_save_aspm_l1ss_state(dev) saves the L1SS state for +"dev", and pci_restore_aspm_l1ss_state(dev) restores the state for both +"dev" and its parent. + +The problem is that unless pci_save_state() has been used in some other +path and has already saved the parent L1SS state, we will restore junk to +the parent, which means the L1 Substates likely won't work correctly. + +Save the L1SS config for both the device and its parent in +pci_save_aspm_l1ss_state(). When restoring, we need both because L1SS must +be enabled at the parent (the Downstream Port) before being enabled at the +child (the Upstream Port). + +Link: https://lore.kernel.org/r/20241115072200.37509-3-jhp@endlessos.org +Fixes: 17423360a27a ("PCI/ASPM: Save L1 PM Substates Capability for suspend/resume") +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218394 +Suggested-by: Ilpo Järvinen +Signed-off-by: Jian-Hong Pan +[bhelgaas: parallel save/restore structure, simplify commit log, patch at +https://lore.kernel.org/r/20241212230340.GA3267194@bhelgaas] +Signed-off-by: Bjorn Helgaas +Tested-by: Jian-Hong Pan # Asus B1400CEAE +Signed-off-by: Sasha Levin +--- + drivers/pci/pcie/aspm.c | 33 ++++++++++++++++++++++++++++----- + 1 file changed, 28 insertions(+), 5 deletions(-) + +diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c +index cee2365e54b8b..9bbcfc91a491e 100644 +--- a/drivers/pci/pcie/aspm.c ++++ b/drivers/pci/pcie/aspm.c +@@ -81,24 +81,47 @@ void pci_configure_aspm_l1ss(struct pci_dev *pdev) + + void pci_save_aspm_l1ss_state(struct pci_dev *pdev) + { ++ struct pci_dev *parent = pdev->bus->self; + struct pci_cap_saved_state *save_state; +- u16 l1ss = pdev->l1ss; + u32 *cap; + ++ /* ++ * If this is a Downstream Port, we never restore the L1SS state ++ * directly; we only restore it when we restore the state of the ++ * Upstream Port below it. ++ */ ++ if (pcie_downstream_port(pdev) || !parent) ++ return; ++ ++ if (!pdev->l1ss || !parent->l1ss) ++ return; ++ + /* + * Save L1 substate configuration. The ASPM L0s/L1 configuration + * in PCI_EXP_LNKCTL_ASPMC is saved by pci_save_pcie_state(). + */ +- if (!l1ss) ++ save_state = pci_find_saved_ext_cap(pdev, PCI_EXT_CAP_ID_L1SS); ++ if (!save_state) + return; + +- save_state = pci_find_saved_ext_cap(pdev, PCI_EXT_CAP_ID_L1SS); ++ cap = &save_state->cap.data[0]; ++ pci_read_config_dword(pdev, pdev->l1ss + PCI_L1SS_CTL2, cap++); ++ pci_read_config_dword(pdev, pdev->l1ss + PCI_L1SS_CTL1, cap++); ++ ++ if (parent->state_saved) ++ return; ++ ++ /* ++ * Save parent's L1 substate configuration so we have it for ++ * pci_restore_aspm_l1ss_state(pdev) to restore. ++ */ ++ save_state = pci_find_saved_ext_cap(parent, PCI_EXT_CAP_ID_L1SS); + if (!save_state) + return; + + cap = &save_state->cap.data[0]; +- pci_read_config_dword(pdev, l1ss + PCI_L1SS_CTL2, cap++); +- pci_read_config_dword(pdev, l1ss + PCI_L1SS_CTL1, cap++); ++ pci_read_config_dword(parent, parent->l1ss + PCI_L1SS_CTL2, cap++); ++ pci_read_config_dword(parent, parent->l1ss + PCI_L1SS_CTL1, cap++); + } + + void pci_restore_aspm_l1ss_state(struct pci_dev *pdev) +-- +2.39.5 + diff --git a/queue-6.12/pci-dwc-always-stop-link-in-the-dw_pcie_suspend_noir.patch b/queue-6.12/pci-dwc-always-stop-link-in-the-dw_pcie_suspend_noir.patch new file mode 100644 index 0000000000..cc73ba5366 --- /dev/null +++ b/queue-6.12/pci-dwc-always-stop-link-in-the-dw_pcie_suspend_noir.patch @@ -0,0 +1,47 @@ +From 5bf14033141e3d5abcacb3294e0ad8ca11ad8ca2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 16:15:56 +0800 +Subject: PCI: dwc: Always stop link in the dw_pcie_suspend_noirq +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Richard Zhu + +[ Upstream commit 86a016e278b78cc2281edd4ffaddbc011c87a593 ] + +On the i.MX8QM, PCIe link can't be re-established again in +dw_pcie_resume_noirq(), if the LTSSM_EN bit is not cleared +properly in dw_pcie_suspend_noirq(). + +So, add dw_pcie_stop_link() to dw_pcie_suspend_noirq() to fix +this issue and to align the suspend/resume functions since there +is dw_pcie_start_link() in dw_pcie_resume_noirq() already. + +Fixes: 4774faf854f5 ("PCI: dwc: Implement generic suspend/resume functionality") +Link: https://lore.kernel.org/r/20241210081557.163555-2-hongxing.zhu@nxp.com +Signed-off-by: Richard Zhu +[kwilczynski: commit log] +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-designware-host.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c +index 3e41865c72904..120e2aca5164a 100644 +--- a/drivers/pci/controller/dwc/pcie-designware-host.c ++++ b/drivers/pci/controller/dwc/pcie-designware-host.c +@@ -946,6 +946,7 @@ int dw_pcie_suspend_noirq(struct dw_pcie *pci) + return ret; + } + ++ dw_pcie_stop_link(pci); + if (pci->pp.ops->deinit) + pci->pp.ops->deinit(&pci->pp); + +-- +2.39.5 + diff --git a/queue-6.12/pci-endpoint-destroy-the-epc-device-in-devm_pci_epc_.patch b/queue-6.12/pci-endpoint-destroy-the-epc-device-in-devm_pci_epc_.patch new file mode 100644 index 0000000000..ecafa52cd4 --- /dev/null +++ b/queue-6.12/pci-endpoint-destroy-the-epc-device-in-devm_pci_epc_.patch @@ -0,0 +1,43 @@ +From 4cc7aff9da04e7dde555a85c048b64b02ae97a5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 22:00:18 +0800 +Subject: PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy() + +From: Zijun Hu + +[ Upstream commit d4929755e4d02bd3de3ae5569dab69cb9502c54f ] + +The devm_pci_epc_destroy() comment says destroys the EPC device, but it +does not actually do that since devres_destroy() does not call +devm_pci_epc_release(), and it also can not fully undo what the API +devm_pci_epc_create() does, so it is faulty. + +Fortunately, the faulty API has not been used by current kernel tree. Use +devres_release() instead of devres_destroy() so the EPC device will be +released. + +Link: https://lore.kernel.org/r/20241210-pci-epc-core_fix-v3-1-4d86dd573e4b@quicinc.com +Fixes: 5e8cb4033807 ("PCI: endpoint: Add EP core layer to enable EP controller and EP functions") +Signed-off-by: Zijun Hu +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/endpoint/pci-epc-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/endpoint/pci-epc-core.c b/drivers/pci/endpoint/pci-epc-core.c +index 62f7dff437309..de665342dc16d 100644 +--- a/drivers/pci/endpoint/pci-epc-core.c ++++ b/drivers/pci/endpoint/pci-epc-core.c +@@ -856,7 +856,7 @@ void devm_pci_epc_destroy(struct device *dev, struct pci_epc *epc) + { + int r; + +- r = devres_destroy(dev, devm_pci_epc_release, devm_pci_epc_match, ++ r = devres_release(dev, devm_pci_epc_release, devm_pci_epc_match, + epc); + dev_WARN_ONCE(dev, r, "couldn't find PCI EPC resource\n"); + } +-- +2.39.5 + diff --git a/queue-6.12/pci-endpoint-pci-epf-test-fix-check-for-dma-memcpy-t.patch b/queue-6.12/pci-endpoint-pci-epf-test-fix-check-for-dma-memcpy-t.patch new file mode 100644 index 0000000000..b91999c215 --- /dev/null +++ b/queue-6.12/pci-endpoint-pci-epf-test-fix-check-for-dma-memcpy-t.patch @@ -0,0 +1,47 @@ +From 79b93ccb21434878ce14935b5a07d6497fd6d39b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jan 2025 22:46:47 +0530 +Subject: PCI: endpoint: pci-epf-test: Fix check for DMA MEMCPY test + +From: Manivannan Sadhasivam + +[ Upstream commit 235c2b197a8de2887f13990094a3343d2392155b ] + +Currently, if DMA MEMCPY test is requested by the host, and if the endpoint +DMA controller supports DMA_PRIVATE, the test will fail. This is not +correct since there is no check for DMA_MEMCPY capability and the DMA +controller can support both DMA_PRIVATE and DMA_MEMCPY. + +Fix the check and also reword the error message. + +Link: https://lore.kernel.org/r/20250116171650.33585-2-manivannan.sadhasivam@linaro.org +Fixes: 8353813c88ef ("PCI: endpoint: Enable DMA tests for endpoints with DMA capabilities") +Reported-by: Niklas Cassel +Closes: https://lore.kernel.org/linux-pci/Z3QtEihbiKIGogWA@ryzen +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Helgaas +Tested-by: Niklas Cassel +Reviewed-by: Niklas Cassel +Signed-off-by: Sasha Levin +--- + drivers/pci/endpoint/functions/pci-epf-test.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c +index f51ebd6b45c9b..14b4c68ab4e1a 100644 +--- a/drivers/pci/endpoint/functions/pci-epf-test.c ++++ b/drivers/pci/endpoint/functions/pci-epf-test.c +@@ -361,8 +361,8 @@ static void pci_epf_test_copy(struct pci_epf_test *epf_test, + + ktime_get_ts64(&start); + if (reg->flags & FLAG_USE_DMA) { +- if (epf_test->dma_private) { +- dev_err(dev, "Cannot transfer data using DMA\n"); ++ if (!dma_has_cap(DMA_MEMCPY, epf_test->dma_chan_tx->device->cap_mask)) { ++ dev_err(dev, "DMA controller doesn't support MEMCPY\n"); + ret = -EINVAL; + goto err_map_addr; + } +-- +2.39.5 + diff --git a/queue-6.12/pci-endpoint-pci-epf-test-set-dma_chan_rx-pointer-to.patch b/queue-6.12/pci-endpoint-pci-epf-test-set-dma_chan_rx-pointer-to.patch new file mode 100644 index 0000000000..e84695a9e9 --- /dev/null +++ b/queue-6.12/pci-endpoint-pci-epf-test-set-dma_chan_rx-pointer-to.patch @@ -0,0 +1,44 @@ +From f5168174a62c0d471fd26faa5e7b7067ff6c1631 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Dec 2024 08:08:41 -0800 +Subject: PCI: endpoint: pci-epf-test: Set dma_chan_rx pointer to NULL on error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mohamed Khalfella + +[ Upstream commit b1b1f4b12969130c0a6ec0cf0299460cb01e799c ] + +If dma_chan_tx allocation fails, set dma_chan_rx to NULL after it is +freed. + +Link: https://lore.kernel.org/r/20241227160841.92382-1-khalfella@gmail.com +Fixes: 8353813c88ef ("PCI: endpoint: Enable DMA tests for endpoints with DMA capabilities") +Signed-off-by: Mohamed Khalfella +[kwilczynski: commit log] +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Reviewed-by: Niklas Cassel +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Sasha Levin +--- + drivers/pci/endpoint/functions/pci-epf-test.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c +index 7c2ed6eae53ad..f51ebd6b45c9b 100644 +--- a/drivers/pci/endpoint/functions/pci-epf-test.c ++++ b/drivers/pci/endpoint/functions/pci-epf-test.c +@@ -251,7 +251,7 @@ static int pci_epf_test_init_dma_chan(struct pci_epf_test *epf_test) + + fail_back_rx: + dma_release_channel(epf_test->dma_chan_rx); +- epf_test->dma_chan_tx = NULL; ++ epf_test->dma_chan_rx = NULL; + + fail_back_tx: + dma_cap_zero(mask); +-- +2.39.5 + diff --git a/queue-6.12/pci-imx6-add-missing-reference-clock-disable-logic.patch b/queue-6.12/pci-imx6-add-missing-reference-clock-disable-logic.patch new file mode 100644 index 0000000000..18d75c7b89 --- /dev/null +++ b/queue-6.12/pci-imx6-add-missing-reference-clock-disable-logic.patch @@ -0,0 +1,77 @@ +From a3d46b090ce9fbb11b27b171c8ab113cfa67f6f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Nov 2024 15:56:58 +0800 +Subject: PCI: imx6: Add missing reference clock disable logic +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Richard Zhu + +[ Upstream commit 93d883f89063744a92006fc356b1c767eb62d950 ] + +Ensure the *_enable_ref_clk() function is symmetric by addressing missing +disable parts on some platforms. + +Fixes: d0a75c791f98 ("PCI: imx6: Factor out ref clock disable to match enable") +Link: https://lore.kernel.org/r/20241126075702.4099164-7-hongxing.zhu@nxp.com +Signed-off-by: Richard Zhu +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Reviewed-by: Frank Li +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pci-imx6.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c +index 94f5246b3a720..ad3028b755d16 100644 +--- a/drivers/pci/controller/dwc/pci-imx6.c ++++ b/drivers/pci/controller/dwc/pci-imx6.c +@@ -598,10 +598,9 @@ static int imx_pcie_attach_pd(struct device *dev) + + static int imx6sx_pcie_enable_ref_clk(struct imx_pcie *imx_pcie, bool enable) + { +- if (enable) +- regmap_clear_bits(imx_pcie->iomuxc_gpr, IOMUXC_GPR12, +- IMX6SX_GPR12_PCIE_TEST_POWERDOWN); +- ++ regmap_update_bits(imx_pcie->iomuxc_gpr, IOMUXC_GPR12, ++ IMX6SX_GPR12_PCIE_TEST_POWERDOWN, ++ enable ? 0 : IMX6SX_GPR12_PCIE_TEST_POWERDOWN); + return 0; + } + +@@ -630,19 +629,20 @@ static int imx8mm_pcie_enable_ref_clk(struct imx_pcie *imx_pcie, bool enable) + { + int offset = imx_pcie_grp_offset(imx_pcie); + +- if (enable) { +- regmap_clear_bits(imx_pcie->iomuxc_gpr, offset, IMX8MQ_GPR_PCIE_CLK_REQ_OVERRIDE); +- regmap_set_bits(imx_pcie->iomuxc_gpr, offset, IMX8MQ_GPR_PCIE_CLK_REQ_OVERRIDE_EN); +- } +- ++ regmap_update_bits(imx_pcie->iomuxc_gpr, offset, ++ IMX8MQ_GPR_PCIE_CLK_REQ_OVERRIDE, ++ enable ? 0 : IMX8MQ_GPR_PCIE_CLK_REQ_OVERRIDE); ++ regmap_update_bits(imx_pcie->iomuxc_gpr, offset, ++ IMX8MQ_GPR_PCIE_CLK_REQ_OVERRIDE_EN, ++ enable ? IMX8MQ_GPR_PCIE_CLK_REQ_OVERRIDE_EN : 0); + return 0; + } + + static int imx7d_pcie_enable_ref_clk(struct imx_pcie *imx_pcie, bool enable) + { +- if (!enable) +- regmap_set_bits(imx_pcie->iomuxc_gpr, IOMUXC_GPR12, +- IMX7D_GPR12_PCIE_PHY_REFCLK_SEL); ++ regmap_update_bits(imx_pcie->iomuxc_gpr, IOMUXC_GPR12, ++ IMX7D_GPR12_PCIE_PHY_REFCLK_SEL, ++ enable ? 0 : IMX7D_GPR12_PCIE_PHY_REFCLK_SEL); + return 0; + } + +-- +2.39.5 + diff --git a/queue-6.12/pci-imx6-configure-phy-based-on-root-complex-or-endp.patch b/queue-6.12/pci-imx6-configure-phy-based-on-root-complex-or-endp.patch new file mode 100644 index 0000000000..99cae383d5 --- /dev/null +++ b/queue-6.12/pci-imx6-configure-phy-based-on-root-complex-or-endp.patch @@ -0,0 +1,47 @@ +From 04feb9f04b9ec50c2d50ee348c2e04f9fbfef4e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Nov 2024 14:44:24 -0500 +Subject: PCI: imx6: Configure PHY based on Root Complex or Endpoint mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Frank Li + +[ Upstream commit de22e20589b79f35f92543119c33051f8179dba0 ] + +Pass PHY_MODE_PCIE_EP if the PCI controller operates in Endpoint (EP) mode, +and fix the Root Complex (RC) mode being hardcoded using a drvdata mode +check. + +Fixes: 8026f2d8e8a9 ("PCI: imx6: Call common PHY API to set mode, speed, and submode") +Link: https://lore.kernel.org/r/20241119-pci_fixup_addr-v8-6-c4bfa5193288@nxp.com +Signed-off-by: Frank Li +[kwilczynski: commit log] +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Reviewed-by: Richard Zhu +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pci-imx6.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c +index c8d5c90aa4d45..9d61e7c472082 100644 +--- a/drivers/pci/controller/dwc/pci-imx6.c ++++ b/drivers/pci/controller/dwc/pci-imx6.c +@@ -966,7 +966,9 @@ static int imx_pcie_host_init(struct dw_pcie_rp *pp) + goto err_clk_disable; + } + +- ret = phy_set_mode_ext(imx_pcie->phy, PHY_MODE_PCIE, PHY_MODE_PCIE_RC); ++ ret = phy_set_mode_ext(imx_pcie->phy, PHY_MODE_PCIE, ++ imx_pcie->drvdata->mode == DW_PCIE_EP_TYPE ? ++ PHY_MODE_PCIE_EP : PHY_MODE_PCIE_RC); + if (ret) { + dev_err(dev, "unable to set PCIe PHY mode\n"); + goto err_phy_exit; +-- +2.39.5 + diff --git a/queue-6.12/pci-imx6-deassert-apps_reset-in-imx_pcie_deassert_co.patch b/queue-6.12/pci-imx6-deassert-apps_reset-in-imx_pcie_deassert_co.patch new file mode 100644 index 0000000000..dd823bbbd7 --- /dev/null +++ b/queue-6.12/pci-imx6-deassert-apps_reset-in-imx_pcie_deassert_co.patch @@ -0,0 +1,42 @@ +From 6181dcad6529560869360b6c84d148d5aba1b65e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Nov 2024 15:56:57 +0800 +Subject: PCI: imx6: Deassert apps_reset in imx_pcie_deassert_core_reset() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Richard Zhu + +[ Upstream commit ef61c7d8d032adb467f99d03ccfaa293b417ac75 ] + +Since the apps_reset is asserted in imx_pcie_assert_core_reset(), it should +be deasserted in imx_pcie_deassert_core_reset(). + +Fixes: 9b3fe6796d7c ("PCI: imx6: Add code to support i.MX7D") +Link: https://lore.kernel.org/r/20241126075702.4099164-6-hongxing.zhu@nxp.com +Signed-off-by: Richard Zhu +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Reviewed-by: Frank Li +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pci-imx6.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c +index 22bf21846b79d..94f5246b3a720 100644 +--- a/drivers/pci/controller/dwc/pci-imx6.c ++++ b/drivers/pci/controller/dwc/pci-imx6.c +@@ -775,6 +775,7 @@ static void imx_pcie_assert_core_reset(struct imx_pcie *imx_pcie) + static int imx_pcie_deassert_core_reset(struct imx_pcie *imx_pcie) + { + reset_control_deassert(imx_pcie->pciephy_reset); ++ reset_control_deassert(imx_pcie->apps_reset); + + if (imx_pcie->drvdata->core_reset) + imx_pcie->drvdata->core_reset(imx_pcie, false); +-- +2.39.5 + diff --git a/queue-6.12/pci-imx6-skip-controller_id-generation-logic-for-i.m.patch b/queue-6.12/pci-imx6-skip-controller_id-generation-logic-for-i.m.patch new file mode 100644 index 0000000000..f3cd51a0a6 --- /dev/null +++ b/queue-6.12/pci-imx6-skip-controller_id-generation-logic-for-i.m.patch @@ -0,0 +1,44 @@ +From 06874aa0e5d719e55a4a017d476be42e102e7a7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Nov 2024 15:56:56 +0800 +Subject: PCI: imx6: Skip controller_id generation logic for i.MX7D +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Richard Zhu + +[ Upstream commit f068ffdd034c93f0c768acdc87d4d2d7023c1379 ] + +The i.MX7D only has one PCIe controller, so controller_id should always be +0. The previous code is incorrect although yielding the correct result. + +Fix by removing "IMX7D" from the switch case branch. + +Fixes: 2d8ed461dbc9 ("PCI: imx6: Add support for i.MX8MQ") +Link: https://lore.kernel.org/r/20241126075702.4099164-5-hongxing.zhu@nxp.com +Signed-off-by: Richard Zhu +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Reviewed-by: Frank Li +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pci-imx6.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c +index 9d61e7c472082..22bf21846b79d 100644 +--- a/drivers/pci/controller/dwc/pci-imx6.c ++++ b/drivers/pci/controller/dwc/pci-imx6.c +@@ -1393,7 +1393,6 @@ static int imx_pcie_probe(struct platform_device *pdev) + switch (imx_pcie->drvdata->variant) { + case IMX8MQ: + case IMX8MQ_EP: +- case IMX7D: + if (dbi_base->start == IMX8MQ_PCIE2_BASE_ADDR) + imx_pcie->controller_id = 1; + break; +-- +2.39.5 + diff --git a/queue-6.12/pci-microchip-add-support-for-using-either-root-port.patch b/queue-6.12/pci-microchip-add-support-for-using-either-root-port.patch new file mode 100644 index 0000000000..9b0749ae71 --- /dev/null +++ b/queue-6.12/pci-microchip-add-support-for-using-either-root-port.patch @@ -0,0 +1,347 @@ +From 42c25b386c2403fba121ac844039b35f51c67c1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 10:59:35 +0000 +Subject: PCI: microchip: Add support for using either Root Port 1 or 2 + +From: Conor Dooley + +[ Upstream commit ac7f53b7e7283fee35ad12de8359f20989a47eb5 ] + +The PCI host controller on PolarFire SoC has multiple Root Port instances, +each with their own bridge and ctrl address spaces. The original binding +has an "apb" register region, and it is expected to be set to the base +address of the Root Complex register space. Some defines in the Linux +driver were used to compute the addresses of the bridge and ctrl address +ranges corresponding to Root Port instance 1. Some customers want to use +Root Port instance 2 however, which requires changing the defines in the +driver, which is clearly not a portable solution. + +The binding has been changed from a single register region to a pair, +corresponding to the bridge and ctrl regions respectively, so modify the +driver to read these regions directly from the devicetree rather than +compute them from the base address of the abp region. + +To maintain backwards compatibility with the existing binding, the driver +retains code to handle the "abp" reg and computes the base address of the +bridge and ctrl regions using the defines if it is present. reg-names has +always been a required property, so this is safe to do. + +Link: https://lore.kernel.org/r/20241107-surrender-brisket-287d563a5de1@spud +Signed-off-by: Conor Dooley +[bhelgaas: Capitalize PCIe spec terms] +Signed-off-by: Bjorn Helgaas +Stable-dep-of: 1390a33b3d04 ("PCI: microchip: Set inbound address translation for coherent or non-coherent mode") +Signed-off-by: Sasha Levin +--- + .../pci/controller/plda/pcie-microchip-host.c | 126 ++++++++++-------- + 1 file changed, 67 insertions(+), 59 deletions(-) + +diff --git a/drivers/pci/controller/plda/pcie-microchip-host.c b/drivers/pci/controller/plda/pcie-microchip-host.c +index 48f60a04b740b..6630cacef3010 100644 +--- a/drivers/pci/controller/plda/pcie-microchip-host.c ++++ b/drivers/pci/controller/plda/pcie-microchip-host.c +@@ -25,9 +25,6 @@ + #define MC_PCIE1_BRIDGE_ADDR 0x00008000u + #define MC_PCIE1_CTRL_ADDR 0x0000a000u + +-#define MC_PCIE_BRIDGE_ADDR (MC_PCIE1_BRIDGE_ADDR) +-#define MC_PCIE_CTRL_ADDR (MC_PCIE1_CTRL_ADDR) +- + /* PCIe Controller Phy Regs */ + #define SEC_ERROR_EVENT_CNT 0x20 + #define DED_ERROR_EVENT_CNT 0x24 +@@ -128,7 +125,6 @@ + [EVENT_LOCAL_ ## x] = { __stringify(x), s } + + #define PCIE_EVENT(x) \ +- .base = MC_PCIE_CTRL_ADDR, \ + .offset = PCIE_EVENT_INT, \ + .mask_offset = PCIE_EVENT_INT, \ + .mask_high = 1, \ +@@ -136,7 +132,6 @@ + .enb_mask = PCIE_EVENT_INT_ENB_MASK + + #define SEC_EVENT(x) \ +- .base = MC_PCIE_CTRL_ADDR, \ + .offset = SEC_ERROR_INT, \ + .mask_offset = SEC_ERROR_INT_MASK, \ + .mask = SEC_ERROR_INT_ ## x ## _INT, \ +@@ -144,7 +139,6 @@ + .enb_mask = 0 + + #define DED_EVENT(x) \ +- .base = MC_PCIE_CTRL_ADDR, \ + .offset = DED_ERROR_INT, \ + .mask_offset = DED_ERROR_INT_MASK, \ + .mask_high = 1, \ +@@ -152,7 +146,6 @@ + .enb_mask = 0 + + #define LOCAL_EVENT(x) \ +- .base = MC_PCIE_BRIDGE_ADDR, \ + .offset = ISTATUS_LOCAL, \ + .mask_offset = IMASK_LOCAL, \ + .mask_high = 0, \ +@@ -179,7 +172,8 @@ struct event_map { + + struct mc_pcie { + struct plda_pcie_rp plda; +- void __iomem *axi_base_addr; ++ void __iomem *bridge_base_addr; ++ void __iomem *ctrl_base_addr; + }; + + struct cause { +@@ -253,7 +247,6 @@ static struct event_map local_status_to_event[] = { + }; + + static struct { +- u32 base; + u32 offset; + u32 mask; + u32 shift; +@@ -325,8 +318,7 @@ static inline u32 reg_to_event(u32 reg, struct event_map field) + + static u32 pcie_events(struct mc_pcie *port) + { +- void __iomem *ctrl_base_addr = port->axi_base_addr + MC_PCIE_CTRL_ADDR; +- u32 reg = readl_relaxed(ctrl_base_addr + PCIE_EVENT_INT); ++ u32 reg = readl_relaxed(port->ctrl_base_addr + PCIE_EVENT_INT); + u32 val = 0; + int i; + +@@ -338,8 +330,7 @@ static u32 pcie_events(struct mc_pcie *port) + + static u32 sec_errors(struct mc_pcie *port) + { +- void __iomem *ctrl_base_addr = port->axi_base_addr + MC_PCIE_CTRL_ADDR; +- u32 reg = readl_relaxed(ctrl_base_addr + SEC_ERROR_INT); ++ u32 reg = readl_relaxed(port->ctrl_base_addr + SEC_ERROR_INT); + u32 val = 0; + int i; + +@@ -351,8 +342,7 @@ static u32 sec_errors(struct mc_pcie *port) + + static u32 ded_errors(struct mc_pcie *port) + { +- void __iomem *ctrl_base_addr = port->axi_base_addr + MC_PCIE_CTRL_ADDR; +- u32 reg = readl_relaxed(ctrl_base_addr + DED_ERROR_INT); ++ u32 reg = readl_relaxed(port->ctrl_base_addr + DED_ERROR_INT); + u32 val = 0; + int i; + +@@ -364,8 +354,7 @@ static u32 ded_errors(struct mc_pcie *port) + + static u32 local_events(struct mc_pcie *port) + { +- void __iomem *bridge_base_addr = port->axi_base_addr + MC_PCIE_BRIDGE_ADDR; +- u32 reg = readl_relaxed(bridge_base_addr + ISTATUS_LOCAL); ++ u32 reg = readl_relaxed(port->bridge_base_addr + ISTATUS_LOCAL); + u32 val = 0; + int i; + +@@ -412,8 +401,12 @@ static void mc_ack_event_irq(struct irq_data *data) + void __iomem *addr; + u32 mask; + +- addr = mc_port->axi_base_addr + event_descs[event].base + +- event_descs[event].offset; ++ if (event_descs[event].offset == ISTATUS_LOCAL) ++ addr = mc_port->bridge_base_addr; ++ else ++ addr = mc_port->ctrl_base_addr; ++ ++ addr += event_descs[event].offset; + mask = event_descs[event].mask; + mask |= event_descs[event].enb_mask; + +@@ -429,8 +422,12 @@ static void mc_mask_event_irq(struct irq_data *data) + u32 mask; + u32 val; + +- addr = mc_port->axi_base_addr + event_descs[event].base + +- event_descs[event].mask_offset; ++ if (event_descs[event].offset == ISTATUS_LOCAL) ++ addr = mc_port->bridge_base_addr; ++ else ++ addr = mc_port->ctrl_base_addr; ++ ++ addr += event_descs[event].mask_offset; + mask = event_descs[event].mask; + if (event_descs[event].enb_mask) { + mask <<= PCIE_EVENT_INT_ENB_SHIFT; +@@ -460,8 +457,12 @@ static void mc_unmask_event_irq(struct irq_data *data) + u32 mask; + u32 val; + +- addr = mc_port->axi_base_addr + event_descs[event].base + +- event_descs[event].mask_offset; ++ if (event_descs[event].offset == ISTATUS_LOCAL) ++ addr = mc_port->bridge_base_addr; ++ else ++ addr = mc_port->ctrl_base_addr; ++ ++ addr += event_descs[event].mask_offset; + mask = event_descs[event].mask; + + if (event_descs[event].enb_mask) +@@ -554,26 +555,20 @@ static const struct plda_event mc_event = { + + static inline void mc_clear_secs(struct mc_pcie *port) + { +- void __iomem *ctrl_base_addr = port->axi_base_addr + MC_PCIE_CTRL_ADDR; +- +- writel_relaxed(SEC_ERROR_INT_ALL_RAM_SEC_ERR_INT, ctrl_base_addr + +- SEC_ERROR_INT); +- writel_relaxed(0, ctrl_base_addr + SEC_ERROR_EVENT_CNT); ++ writel_relaxed(SEC_ERROR_INT_ALL_RAM_SEC_ERR_INT, ++ port->ctrl_base_addr + SEC_ERROR_INT); ++ writel_relaxed(0, port->ctrl_base_addr + SEC_ERROR_EVENT_CNT); + } + + static inline void mc_clear_deds(struct mc_pcie *port) + { +- void __iomem *ctrl_base_addr = port->axi_base_addr + MC_PCIE_CTRL_ADDR; +- +- writel_relaxed(DED_ERROR_INT_ALL_RAM_DED_ERR_INT, ctrl_base_addr + +- DED_ERROR_INT); +- writel_relaxed(0, ctrl_base_addr + DED_ERROR_EVENT_CNT); ++ writel_relaxed(DED_ERROR_INT_ALL_RAM_DED_ERR_INT, ++ port->ctrl_base_addr + DED_ERROR_INT); ++ writel_relaxed(0, port->ctrl_base_addr + DED_ERROR_EVENT_CNT); + } + + static void mc_disable_interrupts(struct mc_pcie *port) + { +- void __iomem *bridge_base_addr = port->axi_base_addr + MC_PCIE_BRIDGE_ADDR; +- void __iomem *ctrl_base_addr = port->axi_base_addr + MC_PCIE_CTRL_ADDR; + u32 val; + + /* Ensure ECC bypass is enabled */ +@@ -581,22 +576,22 @@ static void mc_disable_interrupts(struct mc_pcie *port) + ECC_CONTROL_RX_RAM_ECC_BYPASS | + ECC_CONTROL_PCIE2AXI_RAM_ECC_BYPASS | + ECC_CONTROL_AXI2PCIE_RAM_ECC_BYPASS; +- writel_relaxed(val, ctrl_base_addr + ECC_CONTROL); ++ writel_relaxed(val, port->ctrl_base_addr + ECC_CONTROL); + + /* Disable SEC errors and clear any outstanding */ +- writel_relaxed(SEC_ERROR_INT_ALL_RAM_SEC_ERR_INT, ctrl_base_addr + +- SEC_ERROR_INT_MASK); ++ writel_relaxed(SEC_ERROR_INT_ALL_RAM_SEC_ERR_INT, ++ port->ctrl_base_addr + SEC_ERROR_INT_MASK); + mc_clear_secs(port); + + /* Disable DED errors and clear any outstanding */ +- writel_relaxed(DED_ERROR_INT_ALL_RAM_DED_ERR_INT, ctrl_base_addr + +- DED_ERROR_INT_MASK); ++ writel_relaxed(DED_ERROR_INT_ALL_RAM_DED_ERR_INT, ++ port->ctrl_base_addr + DED_ERROR_INT_MASK); + mc_clear_deds(port); + + /* Disable local interrupts and clear any outstanding */ +- writel_relaxed(0, bridge_base_addr + IMASK_LOCAL); +- writel_relaxed(GENMASK(31, 0), bridge_base_addr + ISTATUS_LOCAL); +- writel_relaxed(GENMASK(31, 0), bridge_base_addr + ISTATUS_MSI); ++ writel_relaxed(0, port->bridge_base_addr + IMASK_LOCAL); ++ writel_relaxed(GENMASK(31, 0), port->bridge_base_addr + ISTATUS_LOCAL); ++ writel_relaxed(GENMASK(31, 0), port->bridge_base_addr + ISTATUS_MSI); + + /* Disable PCIe events and clear any outstanding */ + val = PCIE_EVENT_INT_L2_EXIT_INT | +@@ -605,11 +600,11 @@ static void mc_disable_interrupts(struct mc_pcie *port) + PCIE_EVENT_INT_L2_EXIT_INT_MASK | + PCIE_EVENT_INT_HOTRST_EXIT_INT_MASK | + PCIE_EVENT_INT_DLUP_EXIT_INT_MASK; +- writel_relaxed(val, ctrl_base_addr + PCIE_EVENT_INT); ++ writel_relaxed(val, port->ctrl_base_addr + PCIE_EVENT_INT); + + /* Disable host interrupts and clear any outstanding */ +- writel_relaxed(0, bridge_base_addr + IMASK_HOST); +- writel_relaxed(GENMASK(31, 0), bridge_base_addr + ISTATUS_HOST); ++ writel_relaxed(0, port->bridge_base_addr + IMASK_HOST); ++ writel_relaxed(GENMASK(31, 0), port->bridge_base_addr + ISTATUS_HOST); + } + + static int mc_platform_init(struct pci_config_window *cfg) +@@ -617,12 +612,10 @@ static int mc_platform_init(struct pci_config_window *cfg) + struct device *dev = cfg->parent; + struct platform_device *pdev = to_platform_device(dev); + struct pci_host_bridge *bridge = platform_get_drvdata(pdev); +- void __iomem *bridge_base_addr = +- port->axi_base_addr + MC_PCIE_BRIDGE_ADDR; + int ret; + + /* Configure address translation table 0 for PCIe config space */ +- plda_pcie_setup_window(bridge_base_addr, 0, cfg->res.start, ++ plda_pcie_setup_window(port->bridge_base_addr, 0, cfg->res.start, + cfg->res.start, + resource_size(&cfg->res)); + +@@ -649,7 +642,7 @@ static int mc_platform_init(struct pci_config_window *cfg) + static int mc_host_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; +- void __iomem *bridge_base_addr; ++ void __iomem *apb_base_addr; + struct plda_pcie_rp *plda; + int ret; + u32 val; +@@ -661,30 +654,45 @@ static int mc_host_probe(struct platform_device *pdev) + plda = &port->plda; + plda->dev = dev; + +- port->axi_base_addr = devm_platform_ioremap_resource(pdev, 1); +- if (IS_ERR(port->axi_base_addr)) +- return PTR_ERR(port->axi_base_addr); ++ port->bridge_base_addr = devm_platform_ioremap_resource_byname(pdev, ++ "bridge"); ++ port->ctrl_base_addr = devm_platform_ioremap_resource_byname(pdev, ++ "ctrl"); ++ if (!IS_ERR(port->bridge_base_addr) && !IS_ERR(port->ctrl_base_addr)) ++ goto addrs_set; ++ ++ /* ++ * The original, incorrect, binding that lumped the control and ++ * bridge addresses together still needs to be handled by the driver. ++ */ ++ apb_base_addr = devm_platform_ioremap_resource_byname(pdev, "apb"); ++ if (IS_ERR(apb_base_addr)) ++ return dev_err_probe(dev, PTR_ERR(apb_base_addr), ++ "both legacy apb register and ctrl/bridge regions missing"); ++ ++ port->bridge_base_addr = apb_base_addr + MC_PCIE1_BRIDGE_ADDR; ++ port->ctrl_base_addr = apb_base_addr + MC_PCIE1_CTRL_ADDR; + ++addrs_set: + mc_disable_interrupts(port); + +- bridge_base_addr = port->axi_base_addr + MC_PCIE_BRIDGE_ADDR; +- plda->bridge_addr = bridge_base_addr; ++ plda->bridge_addr = port->bridge_base_addr; + plda->num_events = NUM_EVENTS; + + /* Allow enabling MSI by disabling MSI-X */ +- val = readl(bridge_base_addr + PCIE_PCI_IRQ_DW0); ++ val = readl(port->bridge_base_addr + PCIE_PCI_IRQ_DW0); + val &= ~MSIX_CAP_MASK; +- writel(val, bridge_base_addr + PCIE_PCI_IRQ_DW0); ++ writel(val, port->bridge_base_addr + PCIE_PCI_IRQ_DW0); + + /* Pick num vectors from bitfile programmed onto FPGA fabric */ +- val = readl(bridge_base_addr + PCIE_PCI_IRQ_DW0); ++ val = readl(port->bridge_base_addr + PCIE_PCI_IRQ_DW0); + val &= NUM_MSI_MSGS_MASK; + val >>= NUM_MSI_MSGS_SHIFT; + + plda->msi.num_vectors = 1 << val; + + /* Pick vector address from design */ +- plda->msi.vector_phy = readl_relaxed(bridge_base_addr + IMSI_ADDR); ++ plda->msi.vector_phy = readl_relaxed(port->bridge_base_addr + IMSI_ADDR); + + ret = mc_pcie_init_clks(dev); + if (ret) { +-- +2.39.5 + diff --git a/queue-6.12/pci-microchip-set-inbound-address-translation-for-co.patch b/queue-6.12/pci-microchip-set-inbound-address-translation-for-co.patch new file mode 100644 index 0000000000..fc9344272f --- /dev/null +++ b/queue-6.12/pci-microchip-set-inbound-address-translation-for-co.patch @@ -0,0 +1,263 @@ +From 58e22b8cf681cc7dba9e217fb3f0ea3bc15c7155 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Oct 2024 15:00:42 +0100 +Subject: PCI: microchip: Set inbound address translation for coherent or + non-coherent mode + +From: Daire McNamara + +[ Upstream commit 1390a33b3d04fdf6ba4e3e7082107a12027fc188 ] + +On Microchip PolarFire SoC the PCIe Root Port can be behind one of three +general purpose Fabric Interface Controller (FIC) buses that encapsulates +an AXI-S bus. Depending on which FIC(s) the Root Port is connected through +to CPU space, and what address translation is done by that FIC, the Root +Port driver's inbound address translation may vary. + +For all current supported designs and all future expected designs, inbound +address translation done by a FIC on PolarFire SoC varies depending on +whether PolarFire SoC is operating in coherent DMA mode or noncoherent DMA +mode. + +The setup of the outbound address translation tables in the Root Port +driver only needs to handle these two cases. + +Setup the inbound address translation tables to one of two address +translations, depending on whether the Root Port is being used with +coherent DMA or noncoherent DMA. + +Link: https://lore.kernel.org/r/20241011140043.1250030-3-daire.mcnamara@microchip.com +Fixes: 6f15a9c9f941 ("PCI: microchip: Add Microchip PolarFire PCIe controller driver") +Signed-off-by: Daire McNamara +[bhelgaas: adapt for ac7f53b7e728 ("PCI: microchip: Add support for using +either Root Port 1 or 2")] +Signed-off-by: Bjorn Helgaas +Acked-by: Conor Dooley +Signed-off-by: Sasha Levin +--- + .../pci/controller/plda/pcie-microchip-host.c | 96 +++++++++++++++++++ + drivers/pci/controller/plda/pcie-plda-host.c | 17 +++- + drivers/pci/controller/plda/pcie-plda.h | 6 +- + 3 files changed, 114 insertions(+), 5 deletions(-) + +diff --git a/drivers/pci/controller/plda/pcie-microchip-host.c b/drivers/pci/controller/plda/pcie-microchip-host.c +index 6630cacef3010..3fdfffdf02700 100644 +--- a/drivers/pci/controller/plda/pcie-microchip-host.c ++++ b/drivers/pci/controller/plda/pcie-microchip-host.c +@@ -7,20 +7,27 @@ + * Author: Daire McNamara + */ + ++#include ++#include + #include + #include + #include + #include ++#include + #include + #include + #include + #include + #include + #include ++#include + + #include "../../pci.h" + #include "pcie-plda.h" + ++#define MC_MAX_NUM_INBOUND_WINDOWS 8 ++#define MPFS_NC_BOUNCE_ADDR 0x80000000 ++ + /* PCIe Bridge Phy and Controller Phy offsets */ + #define MC_PCIE1_BRIDGE_ADDR 0x00008000u + #define MC_PCIE1_CTRL_ADDR 0x0000a000u +@@ -607,6 +614,91 @@ static void mc_disable_interrupts(struct mc_pcie *port) + writel_relaxed(GENMASK(31, 0), port->bridge_base_addr + ISTATUS_HOST); + } + ++static void mc_pcie_setup_inbound_atr(struct mc_pcie *port, int window_index, ++ u64 axi_addr, u64 pcie_addr, u64 size) ++{ ++ u32 table_offset = window_index * ATR_ENTRY_SIZE; ++ void __iomem *table_addr = port->bridge_base_addr + table_offset; ++ u32 atr_sz; ++ u32 val; ++ ++ atr_sz = ilog2(size) - 1; ++ ++ val = ALIGN_DOWN(lower_32_bits(pcie_addr), SZ_4K); ++ val |= FIELD_PREP(ATR_SIZE_MASK, atr_sz); ++ val |= ATR_IMPL_ENABLE; ++ ++ writel(val, table_addr + ATR0_PCIE_WIN0_SRCADDR_PARAM); ++ ++ writel(upper_32_bits(pcie_addr), table_addr + ATR0_PCIE_WIN0_SRC_ADDR); ++ ++ writel(lower_32_bits(axi_addr), table_addr + ATR0_PCIE_WIN0_TRSL_ADDR_LSB); ++ writel(upper_32_bits(axi_addr), table_addr + ATR0_PCIE_WIN0_TRSL_ADDR_UDW); ++ ++ writel(TRSL_ID_AXI4_MASTER_0, table_addr + ATR0_PCIE_WIN0_TRSL_PARAM); ++} ++ ++static int mc_pcie_setup_inbound_ranges(struct platform_device *pdev, ++ struct mc_pcie *port) ++{ ++ struct device *dev = &pdev->dev; ++ struct device_node *dn = dev->of_node; ++ struct of_range_parser parser; ++ struct of_range range; ++ int atr_index = 0; ++ ++ /* ++ * MPFS PCIe Root Port is 32-bit only, behind a Fabric Interface ++ * Controller FPGA logic block which contains the AXI-S interface. ++ * ++ * From the point of view of the PCIe Root Port, there are only two ++ * supported Root Port configurations: ++ * ++ * Configuration 1: for use with fully coherent designs; supports a ++ * window from 0x0 (CPU space) to specified PCIe space. ++ * ++ * Configuration 2: for use with non-coherent designs; supports two ++ * 1 GB windows to CPU space; one mapping CPU space 0 to PCIe space ++ * 0x80000000 and a second mapping CPU space 0x40000000 to PCIe ++ * space 0xc0000000. This cfg needs two windows because of how the ++ * MSI space is allocated in the AXI-S range on MPFS. ++ * ++ * The FIC interface outside the PCIe block *must* complete the ++ * inbound address translation as per MCHP MPFS FPGA design ++ * guidelines. ++ */ ++ if (device_property_read_bool(dev, "dma-noncoherent")) { ++ /* ++ * Always need same two tables in this case. Need two tables ++ * due to hardware interactions between address and size. ++ */ ++ mc_pcie_setup_inbound_atr(port, 0, 0, ++ MPFS_NC_BOUNCE_ADDR, SZ_1G); ++ mc_pcie_setup_inbound_atr(port, 1, SZ_1G, ++ MPFS_NC_BOUNCE_ADDR + SZ_1G, SZ_1G); ++ } else { ++ /* Find any DMA ranges */ ++ if (of_pci_dma_range_parser_init(&parser, dn)) { ++ /* No DMA range property - setup default */ ++ mc_pcie_setup_inbound_atr(port, 0, 0, 0, SZ_4G); ++ return 0; ++ } ++ ++ for_each_of_range(&parser, &range) { ++ if (atr_index >= MC_MAX_NUM_INBOUND_WINDOWS) { ++ dev_err(dev, "too many inbound ranges; %d available tables\n", ++ MC_MAX_NUM_INBOUND_WINDOWS); ++ return -EINVAL; ++ } ++ mc_pcie_setup_inbound_atr(port, atr_index, 0, ++ range.pci_addr, range.size); ++ atr_index++; ++ } ++ } ++ ++ return 0; ++} ++ + static int mc_platform_init(struct pci_config_window *cfg) + { + struct device *dev = cfg->parent; +@@ -627,6 +719,10 @@ static int mc_platform_init(struct pci_config_window *cfg) + if (ret) + return ret; + ++ ret = mc_pcie_setup_inbound_ranges(pdev, port); ++ if (ret) ++ return ret; ++ + port->plda.event_ops = &mc_event_ops; + port->plda.event_irq_chip = &mc_event_irq_chip; + port->plda.events_bitmap = GENMASK(NUM_EVENTS - 1, 0); +diff --git a/drivers/pci/controller/plda/pcie-plda-host.c b/drivers/pci/controller/plda/pcie-plda-host.c +index 8533dc618d45f..4153214ca4103 100644 +--- a/drivers/pci/controller/plda/pcie-plda-host.c ++++ b/drivers/pci/controller/plda/pcie-plda-host.c +@@ -8,11 +8,14 @@ + * Author: Daire McNamara + */ + ++#include ++#include + #include + #include + #include + #include + #include ++#include + + #include "pcie-plda.h" + +@@ -502,8 +505,9 @@ void plda_pcie_setup_window(void __iomem *bridge_base_addr, u32 index, + writel(val, bridge_base_addr + (index * ATR_ENTRY_SIZE) + + ATR0_AXI4_SLV0_TRSL_PARAM); + +- val = lower_32_bits(axi_addr) | (atr_sz << ATR_SIZE_SHIFT) | +- ATR_IMPL_ENABLE; ++ val = ALIGN_DOWN(lower_32_bits(axi_addr), SZ_4K); ++ val |= FIELD_PREP(ATR_SIZE_MASK, atr_sz); ++ val |= ATR_IMPL_ENABLE; + writel(val, bridge_base_addr + (index * ATR_ENTRY_SIZE) + + ATR0_AXI4_SLV0_SRCADDR_PARAM); + +@@ -518,13 +522,20 @@ void plda_pcie_setup_window(void __iomem *bridge_base_addr, u32 index, + val = upper_32_bits(pci_addr); + writel(val, bridge_base_addr + (index * ATR_ENTRY_SIZE) + + ATR0_AXI4_SLV0_TRSL_ADDR_UDW); ++} ++EXPORT_SYMBOL_GPL(plda_pcie_setup_window); ++ ++void plda_pcie_setup_inbound_address_translation(struct plda_pcie_rp *port) ++{ ++ void __iomem *bridge_base_addr = port->bridge_addr; ++ u32 val; + + val = readl(bridge_base_addr + ATR0_PCIE_WIN0_SRCADDR_PARAM); + val |= (ATR0_PCIE_ATR_SIZE << ATR0_PCIE_ATR_SIZE_SHIFT); + writel(val, bridge_base_addr + ATR0_PCIE_WIN0_SRCADDR_PARAM); + writel(0, bridge_base_addr + ATR0_PCIE_WIN0_SRC_ADDR); + } +-EXPORT_SYMBOL_GPL(plda_pcie_setup_window); ++EXPORT_SYMBOL_GPL(plda_pcie_setup_inbound_address_translation); + + int plda_pcie_setup_iomems(struct pci_host_bridge *bridge, + struct plda_pcie_rp *port) +diff --git a/drivers/pci/controller/plda/pcie-plda.h b/drivers/pci/controller/plda/pcie-plda.h +index 0e7dc0d8e5ba1..61ece26065ea0 100644 +--- a/drivers/pci/controller/plda/pcie-plda.h ++++ b/drivers/pci/controller/plda/pcie-plda.h +@@ -89,14 +89,15 @@ + + /* PCIe AXI slave table init defines */ + #define ATR0_AXI4_SLV0_SRCADDR_PARAM 0x800u +-#define ATR_SIZE_SHIFT 1 +-#define ATR_IMPL_ENABLE 1 ++#define ATR_SIZE_MASK GENMASK(6, 1) ++#define ATR_IMPL_ENABLE BIT(0) + #define ATR0_AXI4_SLV0_SRC_ADDR 0x804u + #define ATR0_AXI4_SLV0_TRSL_ADDR_LSB 0x808u + #define ATR0_AXI4_SLV0_TRSL_ADDR_UDW 0x80cu + #define ATR0_AXI4_SLV0_TRSL_PARAM 0x810u + #define PCIE_TX_RX_INTERFACE 0x00000000u + #define PCIE_CONFIG_INTERFACE 0x00000001u ++#define TRSL_ID_AXI4_MASTER_0 0x00000004u + + #define CONFIG_SPACE_ADDR_OFFSET 0x1000u + +@@ -204,6 +205,7 @@ int plda_init_interrupts(struct platform_device *pdev, + void plda_pcie_setup_window(void __iomem *bridge_base_addr, u32 index, + phys_addr_t axi_addr, phys_addr_t pci_addr, + size_t size); ++void plda_pcie_setup_inbound_address_translation(struct plda_pcie_rp *port); + int plda_pcie_setup_iomems(struct pci_host_bridge *bridge, + struct plda_pcie_rp *port); + int plda_pcie_host_init(struct plda_pcie_rp *port, struct pci_ops *ops, +-- +2.39.5 + diff --git a/queue-6.12/pci-qcom-update-icc-and-opp-values-after-link-up-eve.patch b/queue-6.12/pci-qcom-update-icc-and-opp-values-after-link-up-eve.patch new file mode 100644 index 0000000000..80f2ed859b --- /dev/null +++ b/queue-6.12/pci-qcom-update-icc-and-opp-values-after-link-up-eve.patch @@ -0,0 +1,53 @@ +From ac4c966928f56e7fe55ba1be3b6c272b4111df15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Nov 2024 00:40:01 +0530 +Subject: PCI: qcom: Update ICC and OPP values after Link Up event +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Krishna chaitanya chundru + +[ Upstream commit f0639013d340580b72df95d012a93f35eeb0da64 ] + +4581403f6792 ("PCI: qcom: Enumerate endpoints based on Link up event in +'global_irq' interrupt") added the Link Up-based enumeration support, but +did not update the ICC/OPP vote once link is up. Before that, the update +happened during probe and the endpoints may or may not be enumerated at +that time, so the ICC/OPP vote was not guaranteed to be accurate. + +With Link Up-based enumeration support, the driver can request the accurate +vote based on the PCIe link. + +Call qcom_pcie_icc_opp_update() in qcom_pcie_global_irq_thread() after +enumerating the endpoints. + +Fixes: 4581403f6792 ("PCI: qcom: Enumerate endpoints based on Link up event in 'global_irq' interrupt") +Link: https://lore.kernel.org/r/20241123-remove_wait2-v5-3-b5f9e6b794c2@quicinc.com +Signed-off-by: Krishna chaitanya chundru +[kwilczynski: commit log] +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Reviewed-by: Niklas Cassel +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-qcom.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c +index 6483e1874477e..4c141e05f84e9 100644 +--- a/drivers/pci/controller/dwc/pcie-qcom.c ++++ b/drivers/pci/controller/dwc/pcie-qcom.c +@@ -1559,6 +1559,8 @@ static irqreturn_t qcom_pcie_global_irq_thread(int irq, void *data) + pci_lock_rescan_remove(); + pci_rescan_bus(pp->bridge->bus); + pci_unlock_rescan_remove(); ++ ++ qcom_pcie_icc_opp_update(pcie); + } else { + dev_WARN_ONCE(dev, 1, "Received unknown event. INT_STATUS: 0x%08x\n", + status); +-- +2.39.5 + diff --git a/queue-6.12/pci-rcar-ep-fix-incorrect-variable-used-when-calling.patch b/queue-6.12/pci-rcar-ep-fix-incorrect-variable-used-when-calling.patch new file mode 100644 index 0000000000..0fa2814945 --- /dev/null +++ b/queue-6.12/pci-rcar-ep-fix-incorrect-variable-used-when-calling.patch @@ -0,0 +1,69 @@ +From 3a0803d1d712397438eecde2cbd469d4d692f9f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jan 2025 08:50:18 +0800 +Subject: PCI: rcar-ep: Fix incorrect variable used when calling + devm_request_mem_region() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: King Dix + +[ Upstream commit 2d2da5a4c1b4509f6f7e5a8db015cd420144beb4 ] + +The rcar_pcie_parse_outbound_ranges() uses the devm_request_mem_region() +macro to request a needed resource. A string variable that lives on the +stack is then used to store a dynamically computed resource name, which +is then passed on as one of the macro arguments. This can lead to +undefined behavior. + +Depending on the current contents of the memory, the manifestations of +errors may vary. One possible output may be as follows: + + $ cat /proc/iomem + 30000000-37ffffff : + 38000000-3fffffff : + +Sometimes, garbage may appear after the colon. + +In very rare cases, if no NULL-terminator is found in memory, the system +might crash because the string iterator will overrun which can lead to +access of unmapped memory above the stack. + +Thus, fix this by replacing outbound_name with the name of the previously +requested resource. With the changes applied, the output will be as +follows: + + $ cat /proc/iomem + 30000000-37ffffff : memory2 + 38000000-3fffffff : memory3 + +Fixes: 2a6d0d63d999 ("PCI: rcar: Add endpoint mode support") +Link: https://lore.kernel.org/r/tencent_DBDCC19D60F361119E76919ADAB25EC13C06@qq.com +Tested-by: Lad Prabhakar +Signed-off-by: King Dix +[kwilczynski: commit log] +Signed-off-by: Krzysztof Wilczyński +Reviewed-by: Lad Prabhakar +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pcie-rcar-ep.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/pcie-rcar-ep.c b/drivers/pci/controller/pcie-rcar-ep.c +index 047e2cef5afcd..c5e0d025bc435 100644 +--- a/drivers/pci/controller/pcie-rcar-ep.c ++++ b/drivers/pci/controller/pcie-rcar-ep.c +@@ -107,7 +107,7 @@ static int rcar_pcie_parse_outbound_ranges(struct rcar_pcie_endpoint *ep, + } + if (!devm_request_mem_region(&pdev->dev, res->start, + resource_size(res), +- outbound_name)) { ++ res->name)) { + dev_err(pcie->dev, "Cannot request memory region %s.\n", + outbound_name); + return -EIO; +-- +2.39.5 + diff --git a/queue-6.12/perf-bpf-fix-two-memory-leakages-when-calling-perf_e.patch b/queue-6.12/perf-bpf-fix-two-memory-leakages-when-calling-perf_e.patch new file mode 100644 index 0000000000..4483d286fb --- /dev/null +++ b/queue-6.12/perf-bpf-fix-two-memory-leakages-when-calling-perf_e.patch @@ -0,0 +1,105 @@ +From 71921abc38b269464d1b33255c9ba2c42e815335 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 16:45:00 +0800 +Subject: perf bpf: Fix two memory leakages when calling + perf_env__insert_bpf_prog_info() + +From: Zhongqiu Han + +[ Upstream commit 03edb7020bb920f1935c3f30acad0bb27fdb99af ] + +If perf_env__insert_bpf_prog_info() returns false due to a duplicate bpf +prog info node insertion, the temporary info_node and info_linear memory +will leak. Add a check to ensure the memory is freed if the function +returns false. + +Fixes: d56354dc49091e33 ("perf tools: Save bpf_prog_info and BTF of new BPF programs") +Reviewed-by: Namhyung Kim +Signed-off-by: Zhongqiu Han +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Peter Zijlstra +Cc: Song Liu +Cc: Yicong Yang +Link: https://lore.kernel.org/r/20241205084500.823660-4-quic_zhonhan@quicinc.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/bpf-event.c | 10 ++++++++-- + tools/perf/util/env.c | 8 ++++++-- + tools/perf/util/env.h | 2 +- + 3 files changed, 15 insertions(+), 5 deletions(-) + +diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c +index 13608237c50e0..c81444059ad07 100644 +--- a/tools/perf/util/bpf-event.c ++++ b/tools/perf/util/bpf-event.c +@@ -289,7 +289,10 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_session *session, + } + + info_node->info_linear = info_linear; +- perf_env__insert_bpf_prog_info(env, info_node); ++ if (!perf_env__insert_bpf_prog_info(env, info_node)) { ++ free(info_linear); ++ free(info_node); ++ } + info_linear = NULL; + + /* +@@ -480,7 +483,10 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id) + info_node = malloc(sizeof(struct bpf_prog_info_node)); + if (info_node) { + info_node->info_linear = info_linear; +- perf_env__insert_bpf_prog_info(env, info_node); ++ if (!perf_env__insert_bpf_prog_info(env, info_node)) { ++ free(info_linear); ++ free(info_node); ++ } + } else + free(info_linear); + +diff --git a/tools/perf/util/env.c b/tools/perf/util/env.c +index 3260eaf267387..d981b6f4bc5ea 100644 +--- a/tools/perf/util/env.c ++++ b/tools/perf/util/env.c +@@ -22,12 +22,16 @@ struct perf_env perf_env; + #include "bpf-utils.h" + #include + +-void perf_env__insert_bpf_prog_info(struct perf_env *env, ++bool perf_env__insert_bpf_prog_info(struct perf_env *env, + struct bpf_prog_info_node *info_node) + { ++ bool ret; ++ + down_write(&env->bpf_progs.lock); +- __perf_env__insert_bpf_prog_info(env, info_node); ++ ret = __perf_env__insert_bpf_prog_info(env, info_node); + up_write(&env->bpf_progs.lock); ++ ++ return ret; + } + + bool __perf_env__insert_bpf_prog_info(struct perf_env *env, struct bpf_prog_info_node *info_node) +diff --git a/tools/perf/util/env.h b/tools/perf/util/env.h +index f170a1fb0c8c2..38de0af2a6808 100644 +--- a/tools/perf/util/env.h ++++ b/tools/perf/util/env.h +@@ -178,7 +178,7 @@ int perf_env__nr_cpus_avail(struct perf_env *env); + void perf_env__init(struct perf_env *env); + bool __perf_env__insert_bpf_prog_info(struct perf_env *env, + struct bpf_prog_info_node *info_node); +-void perf_env__insert_bpf_prog_info(struct perf_env *env, ++bool perf_env__insert_bpf_prog_info(struct perf_env *env, + struct bpf_prog_info_node *info_node); + struct bpf_prog_info_node *perf_env__find_bpf_prog_info(struct perf_env *env, + __u32 prog_id); +-- +2.39.5 + diff --git a/queue-6.12/perf-core-save-raw-sample-data-conditionally-based-o.patch b/queue-6.12/perf-core-save-raw-sample-data-conditionally-based-o.patch new file mode 100644 index 0000000000..a65cb27c3d --- /dev/null +++ b/queue-6.12/perf-core-save-raw-sample-data-conditionally-based-o.patch @@ -0,0 +1,274 @@ +From 77408005db9b08c2a01de1319312d84b996aefc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 12:36:07 -0700 +Subject: perf/core: Save raw sample data conditionally based on sample type + +From: Yabin Cui + +[ Upstream commit b9c44b91476b67327a521568a854babecc4070ab ] + +Currently, space for raw sample data is always allocated within sample +records for both BPF output and tracepoint events. This leads to unused +space in sample records when raw sample data is not requested. + +This patch enforces checking sample type of an event in +perf_sample_save_raw_data(). So raw sample data will only be saved if +explicitly requested, reducing overhead when it is not needed. + +Fixes: 0a9081cf0a11 ("perf/core: Add perf_sample_save_raw_data() helper") +Signed-off-by: Yabin Cui +Signed-off-by: Ingo Molnar +Reviewed-by: Ian Rogers +Acked-by: Namhyung Kim +Link: https://lore.kernel.org/r/20240515193610.2350456-2-yabinc@google.com +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/perf_cpum_cf.c | 2 +- + arch/s390/kernel/perf_pai_crypto.c | 2 +- + arch/s390/kernel/perf_pai_ext.c | 2 +- + arch/x86/events/amd/ibs.c | 2 +- + include/linux/perf_event.h | 6 +++++ + kernel/events/core.c | 35 +++++++++++++++--------------- + kernel/trace/bpf_trace.c | 11 +++++----- + 7 files changed, 34 insertions(+), 26 deletions(-) + +diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c +index e2e0aa463fbd1..c3075e4a8efc3 100644 +--- a/arch/s390/kernel/perf_cpum_cf.c ++++ b/arch/s390/kernel/perf_cpum_cf.c +@@ -981,7 +981,7 @@ static int cfdiag_push_sample(struct perf_event *event, + if (event->attr.sample_type & PERF_SAMPLE_RAW) { + raw.frag.size = cpuhw->usedss; + raw.frag.data = cpuhw->stop; +- perf_sample_save_raw_data(&data, &raw); ++ perf_sample_save_raw_data(&data, event, &raw); + } + + overflow = perf_event_overflow(event, &data, ®s); +diff --git a/arch/s390/kernel/perf_pai_crypto.c b/arch/s390/kernel/perf_pai_crypto.c +index fa73254542661..10725f5a6f0fd 100644 +--- a/arch/s390/kernel/perf_pai_crypto.c ++++ b/arch/s390/kernel/perf_pai_crypto.c +@@ -478,7 +478,7 @@ static int paicrypt_push_sample(size_t rawsize, struct paicrypt_map *cpump, + if (event->attr.sample_type & PERF_SAMPLE_RAW) { + raw.frag.size = rawsize; + raw.frag.data = cpump->save; +- perf_sample_save_raw_data(&data, &raw); ++ perf_sample_save_raw_data(&data, event, &raw); + } + + overflow = perf_event_overflow(event, &data, ®s); +diff --git a/arch/s390/kernel/perf_pai_ext.c b/arch/s390/kernel/perf_pai_ext.c +index 7f462bef1fc07..a8f0bad99cf04 100644 +--- a/arch/s390/kernel/perf_pai_ext.c ++++ b/arch/s390/kernel/perf_pai_ext.c +@@ -503,7 +503,7 @@ static int paiext_push_sample(size_t rawsize, struct paiext_map *cpump, + if (event->attr.sample_type & PERF_SAMPLE_RAW) { + raw.frag.size = rawsize; + raw.frag.data = cpump->save; +- perf_sample_save_raw_data(&data, &raw); ++ perf_sample_save_raw_data(&data, event, &raw); + } + + overflow = perf_event_overflow(event, &data, ®s); +diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c +index e91970b01d624..c3a2f6f57770a 100644 +--- a/arch/x86/events/amd/ibs.c ++++ b/arch/x86/events/amd/ibs.c +@@ -1118,7 +1118,7 @@ static int perf_ibs_handle_irq(struct perf_ibs *perf_ibs, struct pt_regs *iregs) + .data = ibs_data.data, + }, + }; +- perf_sample_save_raw_data(&data, &raw); ++ perf_sample_save_raw_data(&data, event, &raw); + } + + if (perf_ibs == &perf_ibs_op) +diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h +index fb908843f2092..347901525a46a 100644 +--- a/include/linux/perf_event.h ++++ b/include/linux/perf_event.h +@@ -1266,12 +1266,18 @@ static inline void perf_sample_save_callchain(struct perf_sample_data *data, + } + + static inline void perf_sample_save_raw_data(struct perf_sample_data *data, ++ struct perf_event *event, + struct perf_raw_record *raw) + { + struct perf_raw_frag *frag = &raw->frag; + u32 sum = 0; + int size; + ++ if (!(event->attr.sample_type & PERF_SAMPLE_RAW)) ++ return; ++ if (WARN_ON_ONCE(data->sample_flags & PERF_SAMPLE_RAW)) ++ return; ++ + do { + sum += frag->size; + if (perf_raw_frag_last(frag)) +diff --git a/kernel/events/core.c b/kernel/events/core.c +index df27d08a72326..501d8c2fedff4 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -10375,9 +10375,9 @@ static struct pmu perf_tracepoint = { + }; + + static int perf_tp_filter_match(struct perf_event *event, +- struct perf_sample_data *data) ++ struct perf_raw_record *raw) + { +- void *record = data->raw->frag.data; ++ void *record = raw->frag.data; + + /* only top level events have filters set */ + if (event->parent) +@@ -10389,7 +10389,7 @@ static int perf_tp_filter_match(struct perf_event *event, + } + + static int perf_tp_event_match(struct perf_event *event, +- struct perf_sample_data *data, ++ struct perf_raw_record *raw, + struct pt_regs *regs) + { + if (event->hw.state & PERF_HES_STOPPED) +@@ -10400,7 +10400,7 @@ static int perf_tp_event_match(struct perf_event *event, + if (event->attr.exclude_kernel && !user_mode(regs)) + return 0; + +- if (!perf_tp_filter_match(event, data)) ++ if (!perf_tp_filter_match(event, raw)) + return 0; + + return 1; +@@ -10426,6 +10426,7 @@ EXPORT_SYMBOL_GPL(perf_trace_run_bpf_submit); + static void __perf_tp_event_target_task(u64 count, void *record, + struct pt_regs *regs, + struct perf_sample_data *data, ++ struct perf_raw_record *raw, + struct perf_event *event) + { + struct trace_entry *entry = record; +@@ -10435,13 +10436,17 @@ static void __perf_tp_event_target_task(u64 count, void *record, + /* Cannot deliver synchronous signal to other task. */ + if (event->attr.sigtrap) + return; +- if (perf_tp_event_match(event, data, regs)) ++ if (perf_tp_event_match(event, raw, regs)) { ++ perf_sample_data_init(data, 0, 0); ++ perf_sample_save_raw_data(data, event, raw); + perf_swevent_event(event, count, data, regs); ++ } + } + + static void perf_tp_event_target_task(u64 count, void *record, + struct pt_regs *regs, + struct perf_sample_data *data, ++ struct perf_raw_record *raw, + struct perf_event_context *ctx) + { + unsigned int cpu = smp_processor_id(); +@@ -10449,15 +10454,15 @@ static void perf_tp_event_target_task(u64 count, void *record, + struct perf_event *event, *sibling; + + perf_event_groups_for_cpu_pmu(event, &ctx->pinned_groups, cpu, pmu) { +- __perf_tp_event_target_task(count, record, regs, data, event); ++ __perf_tp_event_target_task(count, record, regs, data, raw, event); + for_each_sibling_event(sibling, event) +- __perf_tp_event_target_task(count, record, regs, data, sibling); ++ __perf_tp_event_target_task(count, record, regs, data, raw, sibling); + } + + perf_event_groups_for_cpu_pmu(event, &ctx->flexible_groups, cpu, pmu) { +- __perf_tp_event_target_task(count, record, regs, data, event); ++ __perf_tp_event_target_task(count, record, regs, data, raw, event); + for_each_sibling_event(sibling, event) +- __perf_tp_event_target_task(count, record, regs, data, sibling); ++ __perf_tp_event_target_task(count, record, regs, data, raw, sibling); + } + } + +@@ -10475,15 +10480,10 @@ void perf_tp_event(u16 event_type, u64 count, void *record, int entry_size, + }, + }; + +- perf_sample_data_init(&data, 0, 0); +- perf_sample_save_raw_data(&data, &raw); +- + perf_trace_buf_update(record, event_type); + + hlist_for_each_entry_rcu(event, head, hlist_entry) { +- if (perf_tp_event_match(event, &data, regs)) { +- perf_swevent_event(event, count, &data, regs); +- ++ if (perf_tp_event_match(event, &raw, regs)) { + /* + * Here use the same on-stack perf_sample_data, + * some members in data are event-specific and +@@ -10493,7 +10493,8 @@ void perf_tp_event(u16 event_type, u64 count, void *record, int entry_size, + * because data->sample_flags is set. + */ + perf_sample_data_init(&data, 0, 0); +- perf_sample_save_raw_data(&data, &raw); ++ perf_sample_save_raw_data(&data, event, &raw); ++ perf_swevent_event(event, count, &data, regs); + } + } + +@@ -10510,7 +10511,7 @@ void perf_tp_event(u16 event_type, u64 count, void *record, int entry_size, + goto unlock; + + raw_spin_lock(&ctx->lock); +- perf_tp_event_target_task(count, record, regs, &data, ctx); ++ perf_tp_event_target_task(count, record, regs, &data, &raw, ctx); + raw_spin_unlock(&ctx->lock); + unlock: + rcu_read_unlock(); +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index 50881898e758d..b5cf605fb0e60 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -619,7 +619,8 @@ static const struct bpf_func_proto bpf_perf_event_read_value_proto = { + + static __always_inline u64 + __bpf_perf_event_output(struct pt_regs *regs, struct bpf_map *map, +- u64 flags, struct perf_sample_data *sd) ++ u64 flags, struct perf_raw_record *raw, ++ struct perf_sample_data *sd) + { + struct bpf_array *array = container_of(map, struct bpf_array, map); + unsigned int cpu = smp_processor_id(); +@@ -644,6 +645,8 @@ __bpf_perf_event_output(struct pt_regs *regs, struct bpf_map *map, + if (unlikely(event->oncpu != cpu)) + return -EOPNOTSUPP; + ++ perf_sample_save_raw_data(sd, event, raw); ++ + return perf_event_output(event, sd, regs); + } + +@@ -687,9 +690,8 @@ BPF_CALL_5(bpf_perf_event_output, struct pt_regs *, regs, struct bpf_map *, map, + } + + perf_sample_data_init(sd, 0, 0); +- perf_sample_save_raw_data(sd, &raw); + +- err = __bpf_perf_event_output(regs, map, flags, sd); ++ err = __bpf_perf_event_output(regs, map, flags, &raw, sd); + out: + this_cpu_dec(bpf_trace_nest_level); + preempt_enable(); +@@ -748,9 +750,8 @@ u64 bpf_event_output(struct bpf_map *map, u64 flags, void *meta, u64 meta_size, + + perf_fetch_caller_regs(regs); + perf_sample_data_init(sd, 0, 0); +- perf_sample_save_raw_data(sd, &raw); + +- ret = __bpf_perf_event_output(regs, map, flags, sd); ++ ret = __bpf_perf_event_output(regs, map, flags, &raw, sd); + out: + this_cpu_dec(bpf_event_output_nest_level); + preempt_enable(); +-- +2.39.5 + diff --git a/queue-6.12/perf-expr-initialize-is_test-value-in-expr__ctx_new.patch b/queue-6.12/perf-expr-initialize-is_test-value-in-expr__ctx_new.patch new file mode 100644 index 0000000000..3579d2135a --- /dev/null +++ b/queue-6.12/perf-expr-initialize-is_test-value-in-expr__ctx_new.patch @@ -0,0 +1,55 @@ +From 4e2df0c82741b51ef4a31afef51524ea6bee9c55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Nov 2024 14:34:25 +0000 +Subject: perf expr: Initialize is_test value in expr__ctx_new() + +From: Levi Yun + +[ Upstream commit 1d18ebcfd302a2005b83ae5f13df223894d19902 ] + +When expr_parse_ctx is allocated by expr_ctx_new(), +expr_scanner_ctx->is_test isn't initialize, so it has garbage value. +this can affects the result of expr__parse() return when it parses +non-exist event literal according to garbage value. + +Use calloc instead of malloc in expr_ctx_new() to fix this. + +Fixes: 3340a08354ac286e ("perf pmu-events: Fix testing with JEVENTS_ARCH=all") +Reviewed-by: Ian Rogers +Reviewed-by: James Clark +Signed-off-by: Levi Yun +Cc: Mark Rutland +Cc: Namhyung Kim +Link: https://lore.kernel.org/r/20241108143424.819126-1-yeoreum.yun@arm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/expr.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/tools/perf/util/expr.c b/tools/perf/util/expr.c +index b2536a59c44e6..90c6ce2212e4f 100644 +--- a/tools/perf/util/expr.c ++++ b/tools/perf/util/expr.c +@@ -288,7 +288,7 @@ struct expr_parse_ctx *expr__ctx_new(void) + { + struct expr_parse_ctx *ctx; + +- ctx = malloc(sizeof(struct expr_parse_ctx)); ++ ctx = calloc(1, sizeof(struct expr_parse_ctx)); + if (!ctx) + return NULL; + +@@ -297,9 +297,6 @@ struct expr_parse_ctx *expr__ctx_new(void) + free(ctx); + return NULL; + } +- ctx->sctx.user_requested_cpu_list = NULL; +- ctx->sctx.runtime = 0; +- ctx->sctx.system_wide = false; + + return ctx; + } +-- +2.39.5 + diff --git a/queue-6.12/perf-header-fix-one-memory-leakage-in-process_bpf_bt.patch b/queue-6.12/perf-header-fix-one-memory-leakage-in-process_bpf_bt.patch new file mode 100644 index 0000000000..91f50048ae --- /dev/null +++ b/queue-6.12/perf-header-fix-one-memory-leakage-in-process_bpf_bt.patch @@ -0,0 +1,51 @@ +From 1e3fe02434ec34e17278d0f20425f3a13554dc27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 16:44:58 +0800 +Subject: perf header: Fix one memory leakage in process_bpf_btf() + +From: Zhongqiu Han + +[ Upstream commit 875d22980a062521beed7b5df71fb13a1af15d83 ] + +If __perf_env__insert_btf() returns false due to a duplicate btf node +insertion, the temporary node will leak. Add a check to ensure the memory +is freed if the function returns false. + +Fixes: a70a1123174ab592 ("perf bpf: Save BTF information as headers to perf.data") +Reviewed-by: Namhyung Kim +Signed-off-by: Zhongqiu Han +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Peter Zijlstra +Cc: Song Liu +Cc: Yicong Yang +Link: https://lore.kernel.org/r/20241205084500.823660-2-quic_zhonhan@quicinc.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/header.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c +index a6386d12afd72..fd66042ecb030 100644 +--- a/tools/perf/util/header.c ++++ b/tools/perf/util/header.c +@@ -3235,7 +3235,8 @@ static int process_bpf_btf(struct feat_fd *ff, void *data __maybe_unused) + if (__do_read(ff, node->data, data_size)) + goto out; + +- __perf_env__insert_btf(env, node); ++ if (!__perf_env__insert_btf(env, node)) ++ free(node); + node = NULL; + } + +-- +2.39.5 + diff --git a/queue-6.12/perf-header-fix-one-memory-leakage-in-process_bpf_pr.patch b/queue-6.12/perf-header-fix-one-memory-leakage-in-process_bpf_pr.patch new file mode 100644 index 0000000000..77f58c1fbf --- /dev/null +++ b/queue-6.12/perf-header-fix-one-memory-leakage-in-process_bpf_pr.patch @@ -0,0 +1,99 @@ +From 718b0ef0c252f52d68d670318116d738cb93c482 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 16:44:59 +0800 +Subject: perf header: Fix one memory leakage in process_bpf_prog_info() + +From: Zhongqiu Han + +[ Upstream commit a7da6c7030e1aec32f0a41c7b4fa70ec96042019 ] + +Function __perf_env__insert_bpf_prog_info() will return without inserting +bpf prog info node into perf env again due to a duplicate bpf prog info +node insertion, causing the temporary info_linear and info_node memory to +leak. Modify the return type of this function to bool and add a check to +ensure the memory is freed if the function returns false. + +Fixes: 606f972b1361f477 ("perf bpf: Save bpf_prog_info information as headers to perf.data") +Reviewed-by: Namhyung Kim +Signed-off-by: Zhongqiu Han +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Peter Zijlstra +Cc: Song Liu +Cc: Yicong Yang +Link: https://lore.kernel.org/r/20241205084500.823660-3-quic_zhonhan@quicinc.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/env.c | 5 +++-- + tools/perf/util/env.h | 2 +- + tools/perf/util/header.c | 5 ++++- + 3 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/tools/perf/util/env.c b/tools/perf/util/env.c +index 1edbccfc3281d..3260eaf267387 100644 +--- a/tools/perf/util/env.c ++++ b/tools/perf/util/env.c +@@ -30,7 +30,7 @@ void perf_env__insert_bpf_prog_info(struct perf_env *env, + up_write(&env->bpf_progs.lock); + } + +-void __perf_env__insert_bpf_prog_info(struct perf_env *env, struct bpf_prog_info_node *info_node) ++bool __perf_env__insert_bpf_prog_info(struct perf_env *env, struct bpf_prog_info_node *info_node) + { + __u32 prog_id = info_node->info_linear->info.id; + struct bpf_prog_info_node *node; +@@ -48,13 +48,14 @@ void __perf_env__insert_bpf_prog_info(struct perf_env *env, struct bpf_prog_info + p = &(*p)->rb_right; + } else { + pr_debug("duplicated bpf prog info %u\n", prog_id); +- return; ++ return false; + } + } + + rb_link_node(&info_node->rb_node, parent, p); + rb_insert_color(&info_node->rb_node, &env->bpf_progs.infos); + env->bpf_progs.infos_cnt++; ++ return true; + } + + struct bpf_prog_info_node *perf_env__find_bpf_prog_info(struct perf_env *env, +diff --git a/tools/perf/util/env.h b/tools/perf/util/env.h +index 51b36c36019be..f170a1fb0c8c2 100644 +--- a/tools/perf/util/env.h ++++ b/tools/perf/util/env.h +@@ -176,7 +176,7 @@ const char *perf_env__raw_arch(struct perf_env *env); + int perf_env__nr_cpus_avail(struct perf_env *env); + + void perf_env__init(struct perf_env *env); +-void __perf_env__insert_bpf_prog_info(struct perf_env *env, ++bool __perf_env__insert_bpf_prog_info(struct perf_env *env, + struct bpf_prog_info_node *info_node); + void perf_env__insert_bpf_prog_info(struct perf_env *env, + struct bpf_prog_info_node *info_node); +diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c +index fd66042ecb030..7b99f58f7bf26 100644 +--- a/tools/perf/util/header.c ++++ b/tools/perf/util/header.c +@@ -3188,7 +3188,10 @@ static int process_bpf_prog_info(struct feat_fd *ff, void *data __maybe_unused) + /* after reading from file, translate offset to address */ + bpil_offs_to_addr(info_linear); + info_node->info_linear = info_linear; +- __perf_env__insert_bpf_prog_info(env, info_node); ++ if (!__perf_env__insert_bpf_prog_info(env, info_node)) { ++ free(info_linear); ++ free(info_node); ++ } + } + + up_write(&env->bpf_progs.lock); +-- +2.39.5 + diff --git a/queue-6.12/perf-inject-fix-use-without-initialization-of-local-.patch b/queue-6.12/perf-inject-fix-use-without-initialization-of-local-.patch new file mode 100644 index 0000000000..43213bdbe9 --- /dev/null +++ b/queue-6.12/perf-inject-fix-use-without-initialization-of-local-.patch @@ -0,0 +1,52 @@ +From ddb8f2785a6bc1078616ac123ab15ff1569a2010 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 22:08:31 -0800 +Subject: perf inject: Fix use without initialization of local variables + +From: Ian Rogers + +[ Upstream commit 8e246a1b2a75e187c7d22c9aec4299057f87d19e ] + +Local variables were missing initialization and command line +processing didn't provide default values. + +Fixes: 64eed019f3fce124 ("perf inject: Lazy build-id mmap2 event insertion") +Reviewed-by: James Clark +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20241211060831.806539-1-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-inject.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tools/perf/builtin-inject.c b/tools/perf/builtin-inject.c +index d6989195a061f..11e49cafa3af9 100644 +--- a/tools/perf/builtin-inject.c ++++ b/tools/perf/builtin-inject.c +@@ -2367,10 +2367,10 @@ int cmd_inject(int argc, const char **argv) + }; + int ret; + const char *known_build_ids = NULL; +- bool build_ids; +- bool build_id_all; +- bool mmap2_build_ids; +- bool mmap2_build_id_all; ++ bool build_ids = false; ++ bool build_id_all = false; ++ bool mmap2_build_ids = false; ++ bool mmap2_build_id_all = false; + + struct option options[] = { + OPT_BOOLEAN('b', "build-ids", &build_ids, +-- +2.39.5 + diff --git a/queue-6.12/perf-lock-fix-parse_lock_type-which-only-retrieve-on.patch b/queue-6.12/perf-lock-fix-parse_lock_type-which-only-retrieve-on.patch new file mode 100644 index 0000000000..45ff33807a --- /dev/null +++ b/queue-6.12/perf-lock-fix-parse_lock_type-which-only-retrieve-on.patch @@ -0,0 +1,163 @@ +From e7eaf3bb2e9b2d87bcad4734e764862dcce1f79d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jan 2025 15:58:14 -0800 +Subject: perf lock: Fix parse_lock_type which only retrieve one lock flag + +From: Chun-Tse Shao + +[ Upstream commit 1be9264158ef4818393e5d8144887a1a5d3cc480 ] + +`parse_lock_type` can only add the first lock flag in `lock_type_table` +given input `str`. For example, for `Y rwlock`, it only adds `rwlock:R` +into this perf session. Another example is for `-Y mutex`, it only adds +the mutex without `LCB_F_SPIN` flag. The patch fixes this issue, makes +sure both `rwlock:R` and `rwlock:W` will be added with `-Y rwlock`, and +so on. + +Testing: + $ ./perf lock con -ab -Y mutex,rwlock -- perf bench sched pipe + # Running 'sched/pipe' benchmark: + # Executed 1000000 pipe operations between two processes + + Total time: 9.313 [sec] + + 9.313976 usecs/op + 107365 ops/sec + contended total wait max wait avg wait type caller + + 176 1.65 ms 19.43 us 9.38 us mutex pipe_read+0x57 + 34 180.14 us 10.93 us 5.30 us mutex pipe_write+0x50 + 7 77.48 us 16.09 us 11.07 us mutex do_epoll_wait+0x24d + 7 74.70 us 13.50 us 10.67 us mutex do_epoll_wait+0x24d + 3 35.97 us 14.44 us 11.99 us rwlock:W ep_done_scan+0x2d + 3 35.00 us 12.23 us 11.66 us rwlock:W do_epoll_wait+0x255 + 2 15.88 us 11.96 us 7.94 us rwlock:W do_epoll_wait+0x47c + 1 15.23 us 15.23 us 15.23 us rwlock:W do_epoll_wait+0x4d0 + 1 14.26 us 14.26 us 14.26 us rwlock:W ep_done_scan+0x2d + 2 14.00 us 7.99 us 7.00 us mutex pipe_read+0x282 + 1 12.29 us 12.29 us 12.29 us rwlock:R ep_poll_callback+0x35 + 1 12.02 us 12.02 us 12.02 us rwlock:W do_epoll_ctl+0xb65 + 1 10.25 us 10.25 us 10.25 us rwlock:R ep_poll_callback+0x35 + 1 7.86 us 7.86 us 7.86 us mutex do_epoll_ctl+0x6c1 + 1 5.04 us 5.04 us 5.04 us mutex do_epoll_ctl+0x3d4 + +[namhyung: Add a comment and rename to 'mutex:spin' for consistency + +Fixes: d783ea8f62c4 ("perf lock contention: Simplify parse_lock_type()") +Reviewed-by: Namhyung Kim +Signed-off-by: Chun-Tse Shao +Cc: nick.forrington@arm.com +Link: https://lore.kernel.org/r/20250116235838.2769691-1-ctshao@google.com +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-lock.c | 66 ++++++++++++++++++++++++--------------- + 1 file changed, 41 insertions(+), 25 deletions(-) + +diff --git a/tools/perf/builtin-lock.c b/tools/perf/builtin-lock.c +index 062e2b56a2ab5..33a456980664a 100644 +--- a/tools/perf/builtin-lock.c ++++ b/tools/perf/builtin-lock.c +@@ -1591,8 +1591,8 @@ static const struct { + { LCB_F_PERCPU | LCB_F_WRITE, "pcpu-sem:W", "percpu-rwsem" }, + { LCB_F_MUTEX, "mutex", "mutex" }, + { LCB_F_MUTEX | LCB_F_SPIN, "mutex", "mutex" }, +- /* alias for get_type_flag() */ +- { LCB_F_MUTEX | LCB_F_SPIN, "mutex-spin", "mutex" }, ++ /* alias for optimistic spinning only */ ++ { LCB_F_MUTEX | LCB_F_SPIN, "mutex:spin", "mutex-spin" }, + }; + + static const char *get_type_str(unsigned int flags) +@@ -1617,19 +1617,6 @@ static const char *get_type_name(unsigned int flags) + return "unknown"; + } + +-static unsigned int get_type_flag(const char *str) +-{ +- for (unsigned int i = 0; i < ARRAY_SIZE(lock_type_table); i++) { +- if (!strcmp(lock_type_table[i].name, str)) +- return lock_type_table[i].flags; +- } +- for (unsigned int i = 0; i < ARRAY_SIZE(lock_type_table); i++) { +- if (!strcmp(lock_type_table[i].str, str)) +- return lock_type_table[i].flags; +- } +- return UINT_MAX; +-} +- + static void lock_filter_finish(void) + { + zfree(&filters.types); +@@ -2350,29 +2337,58 @@ static int parse_lock_type(const struct option *opt __maybe_unused, const char * + int unset __maybe_unused) + { + char *s, *tmp, *tok; +- int ret = 0; + + s = strdup(str); + if (s == NULL) + return -1; + + for (tok = strtok_r(s, ", ", &tmp); tok; tok = strtok_r(NULL, ", ", &tmp)) { +- unsigned int flags = get_type_flag(tok); ++ bool found = false; + +- if (flags == -1U) { +- pr_err("Unknown lock flags: %s\n", tok); +- ret = -1; +- break; ++ /* `tok` is `str` in `lock_type_table` if it contains ':'. */ ++ if (strchr(tok, ':')) { ++ for (unsigned int i = 0; i < ARRAY_SIZE(lock_type_table); i++) { ++ if (!strcmp(lock_type_table[i].str, tok) && ++ add_lock_type(lock_type_table[i].flags)) { ++ found = true; ++ break; ++ } ++ } ++ ++ if (!found) { ++ pr_err("Unknown lock flags name: %s\n", tok); ++ free(s); ++ return -1; ++ } ++ ++ continue; + } + +- if (!add_lock_type(flags)) { +- ret = -1; +- break; ++ /* ++ * Otherwise `tok` is `name` in `lock_type_table`. ++ * Single lock name could contain multiple flags. ++ */ ++ for (unsigned int i = 0; i < ARRAY_SIZE(lock_type_table); i++) { ++ if (!strcmp(lock_type_table[i].name, tok)) { ++ if (add_lock_type(lock_type_table[i].flags)) { ++ found = true; ++ } else { ++ free(s); ++ return -1; ++ } ++ } + } ++ ++ if (!found) { ++ pr_err("Unknown lock name: %s\n", tok); ++ free(s); ++ return -1; ++ } ++ + } + + free(s); +- return ret; ++ return 0; + } + + static bool add_lock_addr(unsigned long addr) +-- +2.39.5 + diff --git a/queue-6.12/perf-machine-don-t-ignore-_etext-when-not-a-text-sym.patch b/queue-6.12/perf-machine-don-t-ignore-_etext-when-not-a-text-sym.patch new file mode 100644 index 0000000000..3508f2b8f0 --- /dev/null +++ b/queue-6.12/perf-machine-don-t-ignore-_etext-when-not-a-text-sym.patch @@ -0,0 +1,68 @@ +From 386c84bc8e410cb885b56dd98ad52260cd82a707 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 10:15:24 +0100 +Subject: perf machine: Don't ignore _etext when not a text symbol + +From: Christophe Leroy + +[ Upstream commit 7a93786c306296f15e728b1dbd949a319e4e3d19 ] + +Depending on how vmlinux.lds is written, _etext might be the very first +data symbol instead of the very last text symbol. + +Don't require it to be a text symbol, accept any symbol type. + +Comitter notes: + +See the first Link for further discussion, but it all boils down to +this: + + --- + # grep -e _stext -e _etext -e _edata /proc/kallsyms + c0000000 T _stext + c08b8000 D _etext + + So there is no _edata and _etext is not text + + $ ppc-linux-objdump -x vmlinux | grep -e _stext -e _etext -e _edata + c0000000 g .head.text 00000000 _stext + c08b8000 g .rodata 00000000 _etext + c1378000 g .sbss 00000000 _edata + --- + +Fixes: ed9adb2035b5be58 ("perf machine: Read also the end of the kernel") +Signed-off-by: Christophe Leroy +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kan Liang +Cc: linuxppc-dev@lists.ozlabs.org +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Song Liu +Link: https://lore.kernel.org/r/b3ee1994d95257cb7f2de037c5030ba7d1bed404.1736327613.git.christophe.leroy@csgroup.eu +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/machine.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c +index 27d5345d2b307..9be2f4479f525 100644 +--- a/tools/perf/util/machine.c ++++ b/tools/perf/util/machine.c +@@ -1003,7 +1003,7 @@ static int machine__get_running_kernel_start(struct machine *machine, + + err = kallsyms__get_symbol_start(filename, "_edata", &addr); + if (err) +- err = kallsyms__get_function_start(filename, "_etext", &addr); ++ err = kallsyms__get_symbol_start(filename, "_etext", &addr); + if (!err) + *end = addr; + +-- +2.39.5 + diff --git a/queue-6.12/perf-manifest-add-arch-include-uapi-asm-bpf_perf_eve.patch b/queue-6.12/perf-manifest-add-arch-include-uapi-asm-bpf_perf_eve.patch new file mode 100644 index 0000000000..809de5dc77 --- /dev/null +++ b/queue-6.12/perf-manifest-add-arch-include-uapi-asm-bpf_perf_eve.patch @@ -0,0 +1,92 @@ +From a9969eb18d9b3c940b4a293050005ea2cabc5ae3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Nov 2024 17:43:18 -0300 +Subject: perf MANIFEST: Add arch/*/include/uapi/asm/bpf_perf_event.h to the + perf tarball + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 74c033b6aa650ea7280221a9e57b7318a120978c ] + +Needed to build tools/lib/bpf/ on various arches other than x86_64, +notably arm64 when using the perf tarballs generated by: + + $ make help | grep perf- + perf-tar-src-pkg - Build the perf source tarball with no compression + perf-targz-src-pkg - Build the perf source tarball with gzip compression + perf-tarbz2-src-pkg - Build the perf source tarball with bz2 compression + perf-tarxz-src-pkg - Build the perf source tarball with xz compression + perf-tarzst-src-pkg - Build the perf source tarball with zst compression + $ + +Building with BPF support was opt-in in perf for a long time, and +testing it via the tarball main kernel Makefile targets in an +architecture other than x86_64 was an odd case. + +I had noticed this at some point earlier this year while cross building +perf to some arches, including arm64, but it fell thru the cracks, see +the Link tag below. + +Fix it now by adding those arch/*/include/uapi/asm/bpf_perf_event.h +files to the MANIFEST file used in building the perf source tarball. + +Tested with: + + perfbuilder@number:~$ time dm debian:experimental-x-arm64 + 1 21.60 debian:experimental-x-arm64 : Ok aarch64-linux-gnu-gcc (Debian 14.1.0-5) 14.1.0 flex 2.6.4 + BUILD_TARBALL_HEAD=d31a974f6edc576f84c35be9526fec549a3b3520 + $ + $ git log --oneline -1 d31a974f6edc576f84c35be9526fec549a3b3520 + d31a974f6edc576f (HEAD -> perf-tools-next) perf MANIFEST: Add arch/*/include/uapi/asm/bpf_perf_event.h to the perf tarball + $ + +That was previously failing: + + perfbuilder@number:~$ grep debian:experimental-x-arm64 dm.log.old/summary + 19 4.80 debian:experimental-x-arm64 : FAIL gcc version 14.1.0 (Debian 14.1.0-5) + $ + perfbuilder@number:~$ grep -B6 'Error 1' dm.log.old/debian:experimental-x-arm64 + In file included from /git/perf-6.12.0-rc6/tools/include/uapi/linux/bpf_perf_event.h:11, + from libbpf.c:36: + /git/perf-6.12.0-rc6/tools/include/uapi/asm/bpf_perf_event.h:2:10: fatal error: ../../arch/arm64/include/uapi/asm/bpf_perf_event.h: No such file or directory + 2 | #include "../../arch/arm64/include/uapi/asm/bpf_perf_event.h" + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + compilation terminated. + make[4]: *** [/git/perf-6.12.0-rc6/tools/build/Makefile.build:105: /tmp/build/perf/libbpf/staticobjs/libbpf.o] Error 1 + perfbuilder@number:~$ + +Closes: https://lore.kernel.org/all/Z0UNRCRYKunbDYxP@hyperscale.parallels +Fixes: 9eea8fafe33eb708 ("libbpf: fix __arg_ctx type enforcement for perf_event programs") +Reported-by: Michel Lind +Tested-by: Michel Lind +Cc: Adrian Hunter +Cc: Alexei Starovoitov +Cc: Andrii Nakryiko +Cc: Ian Rogers +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Namhyung Kim +Link: 317c11923cf676437456e44a7f408d4ce589a9c0.camel@michel-slm.name +Link: https://lore.kernel.org/bpf/ZfyEgoG3JFiOs2Fs@x1/ +Link: https://lore.kernel.org/r/Z0Yy5u42Q1hWoEzz@x1 +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/MANIFEST | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/perf/MANIFEST b/tools/perf/MANIFEST +index dc42de1785cee..908165fcec7de 100644 +--- a/tools/perf/MANIFEST ++++ b/tools/perf/MANIFEST +@@ -1,5 +1,6 @@ + arch/arm64/tools/gen-sysreg.awk + arch/arm64/tools/sysreg ++arch/*/include/uapi/asm/bpf_perf_event.h + tools/perf + tools/arch + tools/scripts +-- +2.39.5 + diff --git a/queue-6.12/perf-maps-fix-display-of-kernel-symbols.patch b/queue-6.12/perf-maps-fix-display-of-kernel-symbols.patch new file mode 100644 index 0000000000..062d96c4fe --- /dev/null +++ b/queue-6.12/perf-maps-fix-display-of-kernel-symbols.patch @@ -0,0 +1,73 @@ +From ebfa81dcae12b3384ffc6373c7959891af3e0617 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 10:54:20 +0100 +Subject: perf maps: Fix display of kernel symbols + +From: Christophe Leroy + +[ Upstream commit dae29277fddaaf6670d17dfcbb916a2ca29c912f ] + +Since commit 659ad3492b913c90 ("perf maps: Switch from rbtree to lazily +sorted array for addresses"), perf doesn't display anymore kernel +symbols on powerpc, allthough it still detects them as kernel addresses. + + # Overhead Command Shared Object Symbol + # ........ .......... ............. ...................................... + # + 80.49% Coeur main [unknown] [k] 0xc005f0f8 + 3.91% Coeur main gau [.] engine_loop.constprop.0.isra.0 + 1.72% Coeur main [unknown] [k] 0xc005f11c + 1.09% Coeur main [unknown] [k] 0xc01f82c8 + 0.44% Coeur main libc.so.6 [.] epoll_wait + 0.38% Coeur main [unknown] [k] 0xc0011718 + 0.36% Coeur main [unknown] [k] 0xc01f45c0 + +This is because function maps__find_next_entry() now returns current +entry instead of next entry, leading to kernel map end address getting +mis-configured with its own start address instead of the start address +of the following map. + +Fix it by really taking the next entry, also make sure that entry +follows current one by making sure entries are sorted. + +Fixes: 659ad3492b913c90 ("perf maps: Switch from rbtree to lazily sorted array for addresses") +Reviewed-by: Arnaldo Carvalho de Melo +Reviewed-by: Ian Rogers +Signed-off-by: Christophe Leroy +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/2ea4501209d5363bac71a6757fe91c0747558a42.1736329923.git.christophe.leroy@csgroup.eu +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/maps.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/maps.c b/tools/perf/util/maps.c +index 432399cbe5dd3..09c9cc326c08d 100644 +--- a/tools/perf/util/maps.c ++++ b/tools/perf/util/maps.c +@@ -1136,8 +1136,13 @@ struct map *maps__find_next_entry(struct maps *maps, struct map *map) + struct map *result = NULL; + + down_read(maps__lock(maps)); ++ while (!maps__maps_by_address_sorted(maps)) { ++ up_read(maps__lock(maps)); ++ maps__sort_by_address(maps); ++ down_read(maps__lock(maps)); ++ } + i = maps__by_address_index(maps, map); +- if (i < maps__nr_maps(maps)) ++ if (++i < maps__nr_maps(maps)) + result = map__get(maps__maps_by_address(maps)[i]); + + up_read(maps__lock(maps)); +-- +2.39.5 + diff --git a/queue-6.12/perf-namespaces-fixup-the-nsinfo__in_pidns-return-ty.patch b/queue-6.12/perf-namespaces-fixup-the-nsinfo__in_pidns-return-ty.patch new file mode 100644 index 0000000000..121b652008 --- /dev/null +++ b/queue-6.12/perf-namespaces-fixup-the-nsinfo__in_pidns-return-ty.patch @@ -0,0 +1,64 @@ +From 53a9037cb338d7773a6b3350e3e90877afc72a32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 17:48:28 -0300 +Subject: perf namespaces: Fixup the nsinfo__in_pidns() return type, its bool + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 64a7617efd5ae1d57a75e464d7134eec947c3fe3 ] + +When adding support for refconunt checking a cut'n'paste made this +function, that is just an accessor to a bool member of 'struct nsinfo', +return a pid_t, when that member is a boolean, fix it. + +Fixes: bcaf0a97858de7ab ("perf namespaces: Add functions to access nsinfo") +Reported-by: Francesco Nigro +Reported-by: Ilan Green +Cc: Adrian Hunter +Cc: Clark Williams +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Namhyung Kim +Cc: Stephane Eranian +Cc: Thomas Gleixner +Cc: Yonatan Goldschmidt +Link: https://lore.kernel.org/r/20241206204828.507527-6-acme@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/namespaces.c | 2 +- + tools/perf/util/namespaces.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/namespaces.c b/tools/perf/util/namespaces.c +index 36047184d76e2..68f5de2d79c72 100644 +--- a/tools/perf/util/namespaces.c ++++ b/tools/perf/util/namespaces.c +@@ -266,7 +266,7 @@ pid_t nsinfo__pid(const struct nsinfo *nsi) + return RC_CHK_ACCESS(nsi)->pid; + } + +-pid_t nsinfo__in_pidns(const struct nsinfo *nsi) ++bool nsinfo__in_pidns(const struct nsinfo *nsi) + { + return RC_CHK_ACCESS(nsi)->in_pidns; + } +diff --git a/tools/perf/util/namespaces.h b/tools/perf/util/namespaces.h +index e014becb9cd8e..e95c79b80e27c 100644 +--- a/tools/perf/util/namespaces.h ++++ b/tools/perf/util/namespaces.h +@@ -58,7 +58,7 @@ void nsinfo__clear_need_setns(struct nsinfo *nsi); + pid_t nsinfo__tgid(const struct nsinfo *nsi); + pid_t nsinfo__nstgid(const struct nsinfo *nsi); + pid_t nsinfo__pid(const struct nsinfo *nsi); +-pid_t nsinfo__in_pidns(const struct nsinfo *nsi); ++bool nsinfo__in_pidns(const struct nsinfo *nsi); + void nsinfo__set_in_pidns(struct nsinfo *nsi); + + void nsinfo__mountns_enter(struct nsinfo *nsi, struct nscookie *nc); +-- +2.39.5 + diff --git a/queue-6.12/perf-namespaces-introduce-nsinfo__set_in_pidns.patch b/queue-6.12/perf-namespaces-introduce-nsinfo__set_in_pidns.patch new file mode 100644 index 0000000000..b3b0ae18be --- /dev/null +++ b/queue-6.12/perf-namespaces-introduce-nsinfo__set_in_pidns.patch @@ -0,0 +1,86 @@ +From 1a171af853fbc8f35d5b35c5de679d867cc9b0f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 17:48:26 -0300 +Subject: perf namespaces: Introduce nsinfo__set_in_pidns() + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 9c6a585d257f6845731f4e36b45fe42b5c3162f5 ] + +When we're processing a perf.data file we will, for every thread in that +file do a machine__findnew_thread(machine, pid, tid) that when that pid +is seen for the first time will create a 'struct thread' representing +it. + +That in turn will call nsinfo__new() -> nsinfo__init() and there it will +assume we're running live, which is wrong and will need to be addressed +in a followup patch. + +The nsinfo__new() assumes that if we can't access that thread it has +already finished and will ignore the -1 return from nsinfo__init(), just +taking notes to avoid trying to enter in that namespace, since it isn't +there anymore, a race. + +When doing this from 'perf inject', tho, we can fill in parts of that +nsinfo from what we get from the PERF_RECORD_MMAP2 (pid, tid) and in the +jitdump file name, that has the form of jit-.dump. + +So if the pid in the jitdump file name is not the one in the +PERF_RECORD_MMAP2, we can assume that its the pid of the process +_inside_ the namespace, and that perf was runing outside that namespace. + +This will be done in the following patch. + +Reported-by: Francesco Nigro +Reported-by: Ilan Green +Cc: Adrian Hunter +Cc: Clark Williams +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Namhyung Kim +Cc: Stephane Eranian +Cc: Thomas Gleixner +Cc: Yonatan Goldschmidt +Link: https://lore.kernel.org/r/20241206204828.507527-4-acme@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Stable-dep-of: 64a7617efd5a ("perf namespaces: Fixup the nsinfo__in_pidns() return type, its bool") +Signed-off-by: Sasha Levin +--- + tools/perf/util/namespaces.c | 5 +++++ + tools/perf/util/namespaces.h | 1 + + 2 files changed, 6 insertions(+) + +diff --git a/tools/perf/util/namespaces.c b/tools/perf/util/namespaces.c +index cb185c5659d6b..36047184d76e2 100644 +--- a/tools/perf/util/namespaces.c ++++ b/tools/perf/util/namespaces.c +@@ -271,6 +271,11 @@ pid_t nsinfo__in_pidns(const struct nsinfo *nsi) + return RC_CHK_ACCESS(nsi)->in_pidns; + } + ++void nsinfo__set_in_pidns(struct nsinfo *nsi) ++{ ++ RC_CHK_ACCESS(nsi)->in_pidns = true; ++} ++ + void nsinfo__mountns_enter(struct nsinfo *nsi, + struct nscookie *nc) + { +diff --git a/tools/perf/util/namespaces.h b/tools/perf/util/namespaces.h +index 8c0731c6cbb7e..e014becb9cd8e 100644 +--- a/tools/perf/util/namespaces.h ++++ b/tools/perf/util/namespaces.h +@@ -59,6 +59,7 @@ pid_t nsinfo__tgid(const struct nsinfo *nsi); + pid_t nsinfo__nstgid(const struct nsinfo *nsi); + pid_t nsinfo__pid(const struct nsinfo *nsi); + pid_t nsinfo__in_pidns(const struct nsinfo *nsi); ++void nsinfo__set_in_pidns(struct nsinfo *nsi); + + void nsinfo__mountns_enter(struct nsinfo *nsi, struct nscookie *nc); + void nsinfo__mountns_exit(struct nscookie *nc); +-- +2.39.5 + diff --git a/queue-6.12/perf-report-fix-misleading-help-message-about-demang.patch b/queue-6.12/perf-report-fix-misleading-help-message-about-demang.patch new file mode 100644 index 0000000000..8e9cd2acc3 --- /dev/null +++ b/queue-6.12/perf-report-fix-misleading-help-message-about-demang.patch @@ -0,0 +1,46 @@ +From 18781e2a3f318fca26d01fe0876f9953650b3d94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jan 2025 23:22:19 +0800 +Subject: perf report: Fix misleading help message about --demangle + +From: Jiachen Zhang + +[ Upstream commit ac0ac75189a4d6a29a2765a7adbb62bc6cc650c7 ] + +The wrong help message may mislead users. This commit fixes it. + +Fixes: 328ccdace8855289 ("perf report: Add --no-demangle option") +Reviewed-by: Namhyung Kim +Signed-off-by: Jiachen Zhang +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20250109152220.1869581-1-me@jcix.top +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-report.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c +index 5dc17ffee27a2..645deec294c84 100644 +--- a/tools/perf/builtin-report.c ++++ b/tools/perf/builtin-report.c +@@ -1418,7 +1418,7 @@ int cmd_report(int argc, const char **argv) + OPT_STRING(0, "addr2line", &addr2line_path, "path", + "addr2line binary to use for line numbers"), + OPT_BOOLEAN(0, "demangle", &symbol_conf.demangle, +- "Disable symbol demangling"), ++ "Symbol demangling. Enabled by default, use --no-demangle to disable."), + OPT_BOOLEAN(0, "demangle-kernel", &symbol_conf.demangle_kernel, + "Enable kernel symbol demangling"), + OPT_BOOLEAN(0, "mem-mode", &report.mem_mode, "mem access profile"), +-- +2.39.5 + diff --git a/queue-6.12/perf-test-skip-syscall-enum-test-if-no-landlock-sysc.patch b/queue-6.12/perf-test-skip-syscall-enum-test-if-no-landlock-sysc.patch new file mode 100644 index 0000000000..2164be0f1f --- /dev/null +++ b/queue-6.12/perf-test-skip-syscall-enum-test-if-no-landlock-sysc.patch @@ -0,0 +1,49 @@ +From 17fb90b0ffee59c47dee2273464173fefe60043b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jan 2025 09:06:29 -0800 +Subject: perf test: Skip syscall enum test if no landlock syscall + +From: Namhyung Kim + +[ Upstream commit 72d81e10628be6a948463259cbb6d3b670b20054 ] + +The perf trace enum augmentation test specifically targets landlock_ +add_rule syscall but IIUC it's an optional and can be opt-out by a +kernel config. + +Currently trace_landlock() runs `perf test -w landlock` before the +actual testing to check the availability but it's not enough since the +workload always returns 0. Instead it could check if perf trace output +has 'landlock' string. + +Fixes: d66763fed30f0bd8c ("perf test trace_btf_enum: Add regression test for the BTF augmentation of enums in 'perf trace'") +Reviewed-by: Howard Chu +Link: https://lore.kernel.org/r/20250128170629.1251574-1-namhyung@kernel.org +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/trace_btf_enum.sh | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/tests/shell/trace_btf_enum.sh b/tools/perf/tests/shell/trace_btf_enum.sh +index 5a3b8a5a9b5cf..8d1e6bbeac906 100755 +--- a/tools/perf/tests/shell/trace_btf_enum.sh ++++ b/tools/perf/tests/shell/trace_btf_enum.sh +@@ -26,8 +26,12 @@ check_vmlinux() { + trace_landlock() { + echo "Tracing syscall ${syscall}" + +- # test flight just to see if landlock_add_rule and libbpf are available +- $TESTPROG ++ # test flight just to see if landlock_add_rule is available ++ if ! perf trace $TESTPROG 2>&1 | grep -q landlock ++ then ++ echo "No landlock system call found, skipping to non-syscall tracing." ++ return ++ fi + + if perf trace -e $syscall $TESTPROG 2>&1 | \ + grep -q -E ".*landlock_add_rule\(ruleset_fd: 11, rule_type: (LANDLOCK_RULE_PATH_BENEATH|LANDLOCK_RULE_NET_PORT), rule_attr: 0x[a-f0-9]+, flags: 45\) = -1.*" +-- +2.39.5 + diff --git a/queue-6.12/perf-top-don-t-complain-about-lack-of-vmlinux-when-n.patch b/queue-6.12/perf-top-don-t-complain-about-lack-of-vmlinux-when-n.patch new file mode 100644 index 0000000000..b6036a479a --- /dev/null +++ b/queue-6.12/perf-top-don-t-complain-about-lack-of-vmlinux-when-n.patch @@ -0,0 +1,64 @@ +From f8868d6a0d8ff462117e103fd4cbbaf94cd77322 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jan 2025 16:50:39 -0300 +Subject: perf top: Don't complain about lack of vmlinux when not resolving + some kernel samples + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 058b38ccd2af9e5c95590b018e8425fa148d7aca ] + +Recently we got a case where a kernel sample wasn't being resolved due +to a bug that was not setting the end address on kernel functions +implemented in assembly (see Link: tag), and then those were not being +found by machine__resolve() -> map__find_symbol(). + +So we ended up with: + + # perf top --stdio + PerfTop: 0 irqs/s kernel: 0% exact: 0% lost: 0/0 drop: 0/0 [cycles/P] + ----------------------------------------------------------------------- + + Warning: + A vmlinux file was not found. + Kernel samples will not be resolved. + ^Z + [1]+ Stopped perf top --stdio + # + +But then resolving all other kernel symbols. + +So just fixup the logic to only print that warning when there are no +symbols in the kernel map. + +Fixes: d88205db9caa0e9d ("perf dso: Add dso__has_symbols() method") +Reviewed-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Christophe Leroy +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Link: https://lore.kernel.org/lkml/Z3buKhcCsZi3_aGb@x1 +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-top.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c +index 724a793863212..ca3e8eca6610e 100644 +--- a/tools/perf/builtin-top.c ++++ b/tools/perf/builtin-top.c +@@ -809,7 +809,7 @@ static void perf_event__process_sample(const struct perf_tool *tool, + * invalid --vmlinux ;-) + */ + if (!machine->kptr_restrict_warned && !top->vmlinux_warned && +- __map__is_kernel(al.map) && map__has_symbols(al.map)) { ++ __map__is_kernel(al.map) && !map__has_symbols(al.map)) { + if (symbol_conf.vmlinux_name) { + char serr[256]; + +-- +2.39.5 + diff --git a/queue-6.12/perf-trace-fix-bpf-loading-failure-e2big.patch b/queue-6.12/perf-trace-fix-bpf-loading-failure-e2big.patch new file mode 100644 index 0000000000..0c461aafb3 --- /dev/null +++ b/queue-6.12/perf-trace-fix-bpf-loading-failure-e2big.patch @@ -0,0 +1,92 @@ +From 68aac4f1cd93766fdc11bd84cb4ae20e645722d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Dec 2024 18:30:47 -0800 +Subject: perf trace: Fix BPF loading failure (-E2BIG) + +From: Howard Chu + +[ Upstream commit 013eb043f37bd87c4d60d51034401a5a6d105bcf ] + +As reported by Namhyung Kim and acknowledged by Qiao Zhao (link: +https://lore.kernel.org/linux-perf-users/20241206001436.1947528-1-namhyung@kernel.org/), +on certain machines, perf trace failed to load the BPF program into the +kernel. The verifier runs perf trace's BPF program for up to 1 million +instructions, returning an E2BIG error, whereas the perf trace BPF +program should be much less complex than that. This patch aims to fix +the issue described above. + +The E2BIG problem from clang-15 to clang-16 is cause by this line: + } else if (size < 0 && size >= -6) { /* buffer */ + +Specifically this check: size < 0. seems like clang generates a cool +optimization to this sign check that breaks things. + +Making 'size' s64, and use + } else if ((int)size < 0 && size >= -6) { /* buffer */ + +Solves the problem. This is some Hogwarts magic. + +And the unbounded access of clang-12 and clang-14 (clang-13 works this +time) is fixed by making variable 'aug_size' s64. + +As for this: +-if (aug_size > TRACE_AUG_MAX_BUF) +- aug_size = TRACE_AUG_MAX_BUF; ++aug_size = args->args[index] > TRACE_AUG_MAX_BUF ? TRACE_AUG_MAX_BUF : args->args[index]; + +This makes the BPF skel generated by clang-18 work. Yes, new clangs +introduce problems too. + +Sorry, I only know that it works, but I don't know how it works. I'm not +an expert in the BPF verifier. I really hope this is not a kernel +version issue, as that would make the test case (kernel_nr) * +(clang_nr), a true horror story. I will test it on more kernel versions +in the future. + +Fixes: 395d38419f18: ("perf trace augmented_raw_syscalls: Add more check s to pass the verifier") +Reported-by: Namhyung Kim +Signed-off-by: Howard Chu +Tested-by: Namhyung Kim +Link: https://lore.kernel.org/r/20241213023047.541218-1-howardchu95@gmail.com +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c +index 4a62ed593e84e..e4352881e3faa 100644 +--- a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c ++++ b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c +@@ -431,9 +431,9 @@ static bool pid_filter__has(struct pids_filtered *pids, pid_t pid) + static int augment_sys_enter(void *ctx, struct syscall_enter_args *args) + { + bool augmented, do_output = false; +- int zero = 0, size, aug_size, index, +- value_size = sizeof(struct augmented_arg) - offsetof(struct augmented_arg, value); ++ int zero = 0, index, value_size = sizeof(struct augmented_arg) - offsetof(struct augmented_arg, value); + u64 output = 0; /* has to be u64, otherwise it won't pass the verifier */ ++ s64 aug_size, size; + unsigned int nr, *beauty_map; + struct beauty_payload_enter *payload; + void *arg, *payload_offset; +@@ -484,14 +484,11 @@ static int augment_sys_enter(void *ctx, struct syscall_enter_args *args) + } else if (size > 0 && size <= value_size) { /* struct */ + if (!bpf_probe_read_user(((struct augmented_arg *)payload_offset)->value, size, arg)) + augmented = true; +- } else if (size < 0 && size >= -6) { /* buffer */ ++ } else if ((int)size < 0 && size >= -6) { /* buffer */ + index = -(size + 1); + barrier_var(index); // Prevent clang (noticed with v18) from removing the &= 7 trick. + index &= 7; // Satisfy the bounds checking with the verifier in some kernels. +- aug_size = args->args[index]; +- +- if (aug_size > TRACE_AUG_MAX_BUF) +- aug_size = TRACE_AUG_MAX_BUF; ++ aug_size = args->args[index] > TRACE_AUG_MAX_BUF ? TRACE_AUG_MAX_BUF : args->args[index]; + + if (aug_size > 0) { + if (!bpf_probe_read_user(((struct augmented_arg *)payload_offset)->value, aug_size, arg)) +-- +2.39.5 + diff --git a/queue-6.12/perf-trace-fix-runtime-error-of-index-out-of-bounds.patch b/queue-6.12/perf-trace-fix-runtime-error-of-index-out-of-bounds.patch new file mode 100644 index 0000000000..b709676e4b --- /dev/null +++ b/queue-6.12/perf-trace-fix-runtime-error-of-index-out-of-bounds.patch @@ -0,0 +1,63 @@ +From e56244448aafcc9957c747a79188250d40a41b75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jan 2025 18:55:19 -0800 +Subject: perf trace: Fix runtime error of index out of bounds + +From: Howard Chu + +[ Upstream commit c7b87ce0dd10b64b68a0b22cb83bbd556e28fe81 ] + +libtraceevent parses and returns an array of argument fields, sometimes +larger than RAW_SYSCALL_ARGS_NUM (6) because it includes "__syscall_nr", +idx will traverse to index 6 (7th element) whereas sc->fmt->arg holds 6 +elements max, creating an out-of-bounds access. This runtime error is +found by UBsan. The error message: + + $ sudo UBSAN_OPTIONS=print_stacktrace=1 ./perf trace -a --max-events=1 + builtin-trace.c:1966:35: runtime error: index 6 out of bounds for type 'syscall_arg_fmt [6]' + #0 0x5c04956be5fe in syscall__alloc_arg_fmts /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:1966 + #1 0x5c04956c0510 in trace__read_syscall_info /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:2110 + #2 0x5c04956c372b in trace__syscall_info /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:2436 + #3 0x5c04956d2f39 in trace__init_syscalls_bpf_prog_array_maps /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:3897 + #4 0x5c04956d6d25 in trace__run /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:4335 + #5 0x5c04956e112e in cmd_trace /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:5502 + #6 0x5c04956eda7d in run_builtin /home/howard/hw/linux-perf/tools/perf/perf.c:351 + #7 0x5c04956ee0a8 in handle_internal_command /home/howard/hw/linux-perf/tools/perf/perf.c:404 + #8 0x5c04956ee37f in run_argv /home/howard/hw/linux-perf/tools/perf/perf.c:448 + #9 0x5c04956ee8e9 in main /home/howard/hw/linux-perf/tools/perf/perf.c:556 + #10 0x79eb3622a3b7 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 + #11 0x79eb3622a47a in __libc_start_main_impl ../csu/libc-start.c:360 + #12 0x5c04955422d4 in _start (/home/howard/hw/linux-perf/tools/perf/perf+0x4e02d4) (BuildId: 5b6cab2d59e96a4341741765ad6914a4d784dbc6) + + 0.000 ( 0.014 ms): Chrome_ChildIO/117244 write(fd: 238, buf: !, count: 1) = 1 + +Fixes: 5e58fcfaf4c6 ("perf trace: Allow allocating sc->arg_fmt even without the syscall tracepoint") +Signed-off-by: Howard Chu +Link: https://lore.kernel.org/r/20250122025519.361873-1-howardchu95@gmail.com +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-trace.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c +index ffa1295273099..ecd26e058baf6 100644 +--- a/tools/perf/builtin-trace.c ++++ b/tools/perf/builtin-trace.c +@@ -2122,8 +2122,12 @@ static int trace__read_syscall_info(struct trace *trace, int id) + return PTR_ERR(sc->tp_format); + } + ++ /* ++ * The tracepoint format contains __syscall_nr field, so it's one more ++ * than the actual number of syscall arguments. ++ */ + if (syscall__alloc_arg_fmts(sc, IS_ERR(sc->tp_format) ? +- RAW_SYSCALL_ARGS_NUM : sc->tp_format->format.nr_fields)) ++ RAW_SYSCALL_ARGS_NUM : sc->tp_format->format.nr_fields - 1)) + return -ENOMEM; + + sc->args = sc->tp_format->format.fields; +-- +2.39.5 + diff --git a/queue-6.12/phy-freescale-fsl-samsung-hdmi-clean-up-fld_tg_code-.patch b/queue-6.12/phy-freescale-fsl-samsung-hdmi-clean-up-fld_tg_code-.patch new file mode 100644 index 0000000000..cd86875c65 --- /dev/null +++ b/queue-6.12/phy-freescale-fsl-samsung-hdmi-clean-up-fld_tg_code-.patch @@ -0,0 +1,86 @@ +From 1cb49b3434942402a93ff0673e84efad996194f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Oct 2024 08:19:59 -0500 +Subject: phy: freescale: fsl-samsung-hdmi: Clean up fld_tg_code calculation + +From: Adam Ford + +[ Upstream commit d567679f2b6a8bcea20589bbea6488c0236886cd ] + +Currently, the calcuation for fld_tg_code is based on a lookup table, +but there are gaps in the lookup table, and frequencies in these +gaps may not properly use the correct divider. Based on the description +of FLD_CK_DIV, the internal PLL frequency should be less than 50 MHz, +so directly calcuate the value of FLD_CK_DIV from pixclk. +This allow for proper calcuation of any pixel clock and eliminates a +few gaps in the LUT. + +Since the value of the int_pllclk is in Hz, do the fixed-point +math in Hz to achieve a more accurate value and reduces the complexity +of the caluation to 24MHz * (256 / int_pllclk). + +Fixes: 6ad082bee902 ("phy: freescale: add Samsung HDMI PHY") +Signed-off-by: Adam Ford +Reviewed-by: Frieder Schrempf +Link: https://lore.kernel.org/r/20241026132014.73050-3-aford173@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/freescale/phy-fsl-samsung-hdmi.c | 32 +++++++------------- + 1 file changed, 11 insertions(+), 21 deletions(-) + +diff --git a/drivers/phy/freescale/phy-fsl-samsung-hdmi.c b/drivers/phy/freescale/phy-fsl-samsung-hdmi.c +index 029de69fbeaf4..6801a09c86a77 100644 +--- a/drivers/phy/freescale/phy-fsl-samsung-hdmi.c ++++ b/drivers/phy/freescale/phy-fsl-samsung-hdmi.c +@@ -388,25 +388,17 @@ fsl_samsung_hdmi_phy_configure_pll_lock_det(struct fsl_samsung_hdmi_phy *phy, + { + u32 pclk = cfg->pixclk; + u32 fld_tg_code; +- u32 pclk_khz; +- u8 div = 1; +- +- switch (cfg->pixclk) { +- case 22250000 ... 47500000: +- div = 1; +- break; +- case 50349650 ... 99000000: +- div = 2; +- break; +- case 100699300 ... 198000000: +- div = 4; +- break; +- case 205000000 ... 297000000: +- div = 8; +- break; ++ u32 int_pllclk; ++ u8 div; ++ ++ /* Find int_pllclk speed */ ++ for (div = 0; div < 4; div++) { ++ int_pllclk = pclk / (1 << div); ++ if (int_pllclk < (50 * MHZ)) ++ break; + } + +- writeb(FIELD_PREP(REG12_CK_DIV_MASK, ilog2(div)), phy->regs + PHY_REG(12)); ++ writeb(FIELD_PREP(REG12_CK_DIV_MASK, div), phy->regs + PHY_REG(12)); + + /* + * Calculation for the frequency lock detector target code (fld_tg_code) +@@ -419,10 +411,8 @@ fsl_samsung_hdmi_phy_configure_pll_lock_det(struct fsl_samsung_hdmi_phy *phy, + * settings rounding up always too. TODO: Check if that is + * correct. + */ +- pclk /= div; +- pclk_khz = pclk / 1000; +- fld_tg_code = 256 * 1000 * 1000 / pclk_khz * 24; +- fld_tg_code = DIV_ROUND_UP(fld_tg_code, 1000); ++ ++ fld_tg_code = DIV_ROUND_UP(24 * MHZ * 256, int_pllclk); + + /* FLD_TOL and FLD_RP_CODE taken from downstream driver */ + writeb(FIELD_PREP(REG13_TG_CODE_LOW_MASK, fld_tg_code), +-- +2.39.5 + diff --git a/queue-6.12/phy-freescale-fsl-samsung-hdmi-replace-register-defi.patch b/queue-6.12/phy-freescale-fsl-samsung-hdmi-replace-register-defi.patch new file mode 100644 index 0000000000..d6cbd638ba --- /dev/null +++ b/queue-6.12/phy-freescale-fsl-samsung-hdmi-replace-register-defi.patch @@ -0,0 +1,235 @@ +From 19dfeda621a2d96990c81bf73dd7541cd2491ed8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Sep 2024 06:27:45 -0500 +Subject: phy: freescale: fsl-samsung-hdmi: Replace register defines with macro + +From: Adam Ford + +[ Upstream commit 4a5a9e2577d61a4ee3e9788e0c2b0c1cbc5ba7b3 ] + +There are 47 registers defined as PHY_REG_xx were xx goes from 00 to +47. Simplify this by replacing them all with a macro which is passed +the register number to return the proper register offset. + +Signed-off-by: Adam Ford +Reviewed-by: Marco Felsch +Reviewed-by: Frieder Schrempf +Tested-by: Frieder Schrempf +Reviewed-by: Dominique Martinet +Tested-by: Dominique Martinet +Link: https://lore.kernel.org/r/20240914112816.520224-2-aford173@gmail.com +Signed-off-by: Vinod Koul +Stable-dep-of: d567679f2b6a ("phy: freescale: fsl-samsung-hdmi: Clean up fld_tg_code calculation") +Signed-off-by: Sasha Levin +--- + drivers/phy/freescale/phy-fsl-samsung-hdmi.c | 133 ++++++------------- + 1 file changed, 43 insertions(+), 90 deletions(-) + +diff --git a/drivers/phy/freescale/phy-fsl-samsung-hdmi.c b/drivers/phy/freescale/phy-fsl-samsung-hdmi.c +index 9048cdc760c21..acea7008aefc5 100644 +--- a/drivers/phy/freescale/phy-fsl-samsung-hdmi.c ++++ b/drivers/phy/freescale/phy-fsl-samsung-hdmi.c +@@ -14,76 +14,29 @@ + #include + #include + +-#define PHY_REG_00 0x00 +-#define PHY_REG_01 0x04 +-#define PHY_REG_02 0x08 +-#define PHY_REG_08 0x20 +-#define PHY_REG_09 0x24 +-#define PHY_REG_10 0x28 +-#define PHY_REG_11 0x2c +- +-#define PHY_REG_12 0x30 +-#define REG12_CK_DIV_MASK GENMASK(5, 4) +- +-#define PHY_REG_13 0x34 +-#define REG13_TG_CODE_LOW_MASK GENMASK(7, 0) +- +-#define PHY_REG_14 0x38 +-#define REG14_TOL_MASK GENMASK(7, 4) +-#define REG14_RP_CODE_MASK GENMASK(3, 1) +-#define REG14_TG_CODE_HIGH_MASK GENMASK(0, 0) +- +-#define PHY_REG_15 0x3c +-#define PHY_REG_16 0x40 +-#define PHY_REG_17 0x44 +-#define PHY_REG_18 0x48 +-#define PHY_REG_19 0x4c +-#define PHY_REG_20 0x50 +- +-#define PHY_REG_21 0x54 +-#define REG21_SEL_TX_CK_INV BIT(7) +-#define REG21_PMS_S_MASK GENMASK(3, 0) +- +-#define PHY_REG_22 0x58 +-#define PHY_REG_23 0x5c +-#define PHY_REG_24 0x60 +-#define PHY_REG_25 0x64 +-#define PHY_REG_26 0x68 +-#define PHY_REG_27 0x6c +-#define PHY_REG_28 0x70 +-#define PHY_REG_29 0x74 +-#define PHY_REG_30 0x78 +-#define PHY_REG_31 0x7c +-#define PHY_REG_32 0x80 ++#define PHY_REG(reg) (reg * 4) + ++#define REG12_CK_DIV_MASK GENMASK(5, 4) ++ ++#define REG13_TG_CODE_LOW_MASK GENMASK(7, 0) ++ ++#define REG14_TOL_MASK GENMASK(7, 4) ++#define REG14_RP_CODE_MASK GENMASK(3, 1) ++#define REG14_TG_CODE_HIGH_MASK GENMASK(0, 0) ++ ++#define REG21_SEL_TX_CK_INV BIT(7) ++#define REG21_PMS_S_MASK GENMASK(3, 0) + /* + * REG33 does not match the ref manual. According to Sandor Yu from NXP, + * "There is a doc issue on the i.MX8MP latest RM" + * REG33 is being used per guidance from Sandor + */ ++#define REG33_MODE_SET_DONE BIT(7) ++#define REG33_FIX_DA BIT(1) + +-#define PHY_REG_33 0x84 +-#define REG33_MODE_SET_DONE BIT(7) +-#define REG33_FIX_DA BIT(1) +- +-#define PHY_REG_34 0x88 +-#define REG34_PHY_READY BIT(7) +-#define REG34_PLL_LOCK BIT(6) +-#define REG34_PHY_CLK_READY BIT(5) +- +-#define PHY_REG_35 0x8c +-#define PHY_REG_36 0x90 +-#define PHY_REG_37 0x94 +-#define PHY_REG_38 0x98 +-#define PHY_REG_39 0x9c +-#define PHY_REG_40 0xa0 +-#define PHY_REG_41 0xa4 +-#define PHY_REG_42 0xa8 +-#define PHY_REG_43 0xac +-#define PHY_REG_44 0xb0 +-#define PHY_REG_45 0xb4 +-#define PHY_REG_46 0xb8 +-#define PHY_REG_47 0xbc ++#define REG34_PHY_READY BIT(7) ++#define REG34_PLL_LOCK BIT(6) ++#define REG34_PHY_CLK_READY BIT(5) + + #define PHY_PLL_DIV_REGS_NUM 6 + +@@ -369,29 +322,29 @@ struct reg_settings { + }; + + static const struct reg_settings common_phy_cfg[] = { +- { PHY_REG_00, 0x00 }, { PHY_REG_01, 0xd1 }, +- { PHY_REG_08, 0x4f }, { PHY_REG_09, 0x30 }, +- { PHY_REG_10, 0x33 }, { PHY_REG_11, 0x65 }, ++ { PHY_REG(0), 0x00 }, { PHY_REG(1), 0xd1 }, ++ { PHY_REG(8), 0x4f }, { PHY_REG(9), 0x30 }, ++ { PHY_REG(10), 0x33 }, { PHY_REG(11), 0x65 }, + /* REG12 pixclk specific */ + /* REG13 pixclk specific */ + /* REG14 pixclk specific */ +- { PHY_REG_15, 0x80 }, { PHY_REG_16, 0x6c }, +- { PHY_REG_17, 0xf2 }, { PHY_REG_18, 0x67 }, +- { PHY_REG_19, 0x00 }, { PHY_REG_20, 0x10 }, ++ { PHY_REG(15), 0x80 }, { PHY_REG(16), 0x6c }, ++ { PHY_REG(17), 0xf2 }, { PHY_REG(18), 0x67 }, ++ { PHY_REG(19), 0x00 }, { PHY_REG(20), 0x10 }, + /* REG21 pixclk specific */ +- { PHY_REG_22, 0x30 }, { PHY_REG_23, 0x32 }, +- { PHY_REG_24, 0x60 }, { PHY_REG_25, 0x8f }, +- { PHY_REG_26, 0x00 }, { PHY_REG_27, 0x00 }, +- { PHY_REG_28, 0x08 }, { PHY_REG_29, 0x00 }, +- { PHY_REG_30, 0x00 }, { PHY_REG_31, 0x00 }, +- { PHY_REG_32, 0x00 }, { PHY_REG_33, 0x80 }, +- { PHY_REG_34, 0x00 }, { PHY_REG_35, 0x00 }, +- { PHY_REG_36, 0x00 }, { PHY_REG_37, 0x00 }, +- { PHY_REG_38, 0x00 }, { PHY_REG_39, 0x00 }, +- { PHY_REG_40, 0x00 }, { PHY_REG_41, 0xe0 }, +- { PHY_REG_42, 0x83 }, { PHY_REG_43, 0x0f }, +- { PHY_REG_44, 0x3E }, { PHY_REG_45, 0xf8 }, +- { PHY_REG_46, 0x00 }, { PHY_REG_47, 0x00 } ++ { PHY_REG(22), 0x30 }, { PHY_REG(23), 0x32 }, ++ { PHY_REG(24), 0x60 }, { PHY_REG(25), 0x8f }, ++ { PHY_REG(26), 0x00 }, { PHY_REG(27), 0x00 }, ++ { PHY_REG(28), 0x08 }, { PHY_REG(29), 0x00 }, ++ { PHY_REG(30), 0x00 }, { PHY_REG(31), 0x00 }, ++ { PHY_REG(32), 0x00 }, { PHY_REG(33), 0x80 }, ++ { PHY_REG(34), 0x00 }, { PHY_REG(35), 0x00 }, ++ { PHY_REG(36), 0x00 }, { PHY_REG(37), 0x00 }, ++ { PHY_REG(38), 0x00 }, { PHY_REG(39), 0x00 }, ++ { PHY_REG(40), 0x00 }, { PHY_REG(41), 0xe0 }, ++ { PHY_REG(42), 0x83 }, { PHY_REG(43), 0x0f }, ++ { PHY_REG(44), 0x3E }, { PHY_REG(45), 0xf8 }, ++ { PHY_REG(46), 0x00 }, { PHY_REG(47), 0x00 } + }; + + struct fsl_samsung_hdmi_phy { +@@ -442,7 +395,7 @@ fsl_samsung_hdmi_phy_configure_pixclk(struct fsl_samsung_hdmi_phy *phy, + } + + writeb(REG21_SEL_TX_CK_INV | FIELD_PREP(REG21_PMS_S_MASK, div), +- phy->regs + PHY_REG_21); ++ phy->regs + PHY_REG(21)); + } + + static void +@@ -469,7 +422,7 @@ fsl_samsung_hdmi_phy_configure_pll_lock_det(struct fsl_samsung_hdmi_phy *phy, + break; + } + +- writeb(FIELD_PREP(REG12_CK_DIV_MASK, ilog2(div)), phy->regs + PHY_REG_12); ++ writeb(FIELD_PREP(REG12_CK_DIV_MASK, ilog2(div)), phy->regs + PHY_REG(12)); + + /* + * Calculation for the frequency lock detector target code (fld_tg_code) +@@ -489,11 +442,11 @@ fsl_samsung_hdmi_phy_configure_pll_lock_det(struct fsl_samsung_hdmi_phy *phy, + + /* FLD_TOL and FLD_RP_CODE taken from downstream driver */ + writeb(FIELD_PREP(REG13_TG_CODE_LOW_MASK, fld_tg_code), +- phy->regs + PHY_REG_13); ++ phy->regs + PHY_REG(13)); + writeb(FIELD_PREP(REG14_TOL_MASK, 2) | + FIELD_PREP(REG14_RP_CODE_MASK, 2) | + FIELD_PREP(REG14_TG_CODE_HIGH_MASK, fld_tg_code >> 8), +- phy->regs + PHY_REG_14); ++ phy->regs + PHY_REG(14)); + } + + static int fsl_samsung_hdmi_phy_configure(struct fsl_samsung_hdmi_phy *phy, +@@ -503,7 +456,7 @@ static int fsl_samsung_hdmi_phy_configure(struct fsl_samsung_hdmi_phy *phy, + u8 val; + + /* HDMI PHY init */ +- writeb(REG33_FIX_DA, phy->regs + PHY_REG_33); ++ writeb(REG33_FIX_DA, phy->regs + PHY_REG(33)); + + /* common PHY registers */ + for (i = 0; i < ARRAY_SIZE(common_phy_cfg); i++) +@@ -511,14 +464,14 @@ static int fsl_samsung_hdmi_phy_configure(struct fsl_samsung_hdmi_phy *phy, + + /* set individual PLL registers PHY_REG2 ... PHY_REG7 */ + for (i = 0; i < PHY_PLL_DIV_REGS_NUM; i++) +- writeb(cfg->pll_div_regs[i], phy->regs + PHY_REG_02 + i * 4); ++ writeb(cfg->pll_div_regs[i], phy->regs + PHY_REG(2) + i * 4); + + fsl_samsung_hdmi_phy_configure_pixclk(phy, cfg); + fsl_samsung_hdmi_phy_configure_pll_lock_det(phy, cfg); + +- writeb(REG33_FIX_DA | REG33_MODE_SET_DONE, phy->regs + PHY_REG_33); ++ writeb(REG33_FIX_DA | REG33_MODE_SET_DONE, phy->regs + PHY_REG(33)); + +- ret = readb_poll_timeout(phy->regs + PHY_REG_34, val, ++ ret = readb_poll_timeout(phy->regs + PHY_REG(34), val, + val & REG34_PLL_LOCK, 50, 20000); + if (ret) + dev_err(phy->dev, "PLL failed to lock\n"); +-- +2.39.5 + diff --git a/queue-6.12/phy-freescale-fsl-samsung-hdmi-simplify-reg21_pms_s_.patch b/queue-6.12/phy-freescale-fsl-samsung-hdmi-simplify-reg21_pms_s_.patch new file mode 100644 index 0000000000..8bb3366e4b --- /dev/null +++ b/queue-6.12/phy-freescale-fsl-samsung-hdmi-simplify-reg21_pms_s_.patch @@ -0,0 +1,90 @@ +From 568cf4e942f5ca79973de9e877e675c334a6683d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Sep 2024 06:27:46 -0500 +Subject: phy: freescale: fsl-samsung-hdmi: Simplify REG21_PMS_S_MASK lookup + +From: Adam Ford + +[ Upstream commit 375ee44adb3640099508c5c0c01d86f0bdb16e97 ] + +The value of 'S' is writen to two places, PHY_REG3[7:4] and +PHY_REG21[3:0]. There is a lookup table which contains +the value of PHY_REG3. Rather than using a switch statement +based on the pixel clock to search for the value of 'S' again, +just shift the contents of PHY_REG3[7:4] >> 4 and place the value +in PHY_REG21[3:0]. Doing this can eliminate an entire function. + +Signed-off-by: Adam Ford +Reviewed-by: Marco Felsch +Reviewed-by: Frieder Schrempf +Tested-by: Frieder Schrempf +Reviewed-by: Dominique Martinet +Tested-by: Dominique Martinet +Link: https://lore.kernel.org/r/20240914112816.520224-3-aford173@gmail.com +Signed-off-by: Vinod Koul +Stable-dep-of: d567679f2b6a ("phy: freescale: fsl-samsung-hdmi: Clean up fld_tg_code calculation") +Signed-off-by: Sasha Levin +--- + drivers/phy/freescale/phy-fsl-samsung-hdmi.c | 39 ++------------------ + 1 file changed, 4 insertions(+), 35 deletions(-) + +diff --git a/drivers/phy/freescale/phy-fsl-samsung-hdmi.c b/drivers/phy/freescale/phy-fsl-samsung-hdmi.c +index acea7008aefc5..4f6874226f9ab 100644 +--- a/drivers/phy/freescale/phy-fsl-samsung-hdmi.c ++++ b/drivers/phy/freescale/phy-fsl-samsung-hdmi.c +@@ -364,40 +364,6 @@ to_fsl_samsung_hdmi_phy(struct clk_hw *hw) + return container_of(hw, struct fsl_samsung_hdmi_phy, hw); + } + +-static void +-fsl_samsung_hdmi_phy_configure_pixclk(struct fsl_samsung_hdmi_phy *phy, +- const struct phy_config *cfg) +-{ +- u8 div = 0x1; +- +- switch (cfg->pixclk) { +- case 22250000 ... 33750000: +- div = 0xf; +- break; +- case 35000000 ... 40000000: +- div = 0xb; +- break; +- case 43200000 ... 47500000: +- div = 0x9; +- break; +- case 50349650 ... 63500000: +- div = 0x7; +- break; +- case 67500000 ... 90000000: +- div = 0x5; +- break; +- case 94000000 ... 148500000: +- div = 0x3; +- break; +- case 154000000 ... 297000000: +- div = 0x1; +- break; +- } +- +- writeb(REG21_SEL_TX_CK_INV | FIELD_PREP(REG21_PMS_S_MASK, div), +- phy->regs + PHY_REG(21)); +-} +- + static void + fsl_samsung_hdmi_phy_configure_pll_lock_det(struct fsl_samsung_hdmi_phy *phy, + const struct phy_config *cfg) +@@ -466,7 +432,10 @@ static int fsl_samsung_hdmi_phy_configure(struct fsl_samsung_hdmi_phy *phy, + for (i = 0; i < PHY_PLL_DIV_REGS_NUM; i++) + writeb(cfg->pll_div_regs[i], phy->regs + PHY_REG(2) + i * 4); + +- fsl_samsung_hdmi_phy_configure_pixclk(phy, cfg); ++ /* High nibble of pll_div_regs[1] contains S which also gets written to REG21 */ ++ writeb(REG21_SEL_TX_CK_INV | FIELD_PREP(REG21_PMS_S_MASK, ++ cfg->pll_div_regs[1] >> 4), phy->regs + PHY_REG(21)); ++ + fsl_samsung_hdmi_phy_configure_pll_lock_det(phy, cfg); + + writeb(REG33_FIX_DA | REG33_MODE_SET_DONE, phy->regs + PHY_REG(33)); +-- +2.39.5 + diff --git a/queue-6.12/phy-freescale-fsl-samsung-hdmi-support-dynamic-integ.patch b/queue-6.12/phy-freescale-fsl-samsung-hdmi-support-dynamic-integ.patch new file mode 100644 index 0000000000..6febfadb7a --- /dev/null +++ b/queue-6.12/phy-freescale-fsl-samsung-hdmi-support-dynamic-integ.patch @@ -0,0 +1,666 @@ +From af4a21b2e7c7923f662065d94fed5af5dc932509 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Sep 2024 06:27:47 -0500 +Subject: phy: freescale: fsl-samsung-hdmi: Support dynamic integer + +From: Adam Ford + +[ Upstream commit 1951dbb41d1dff7c135eed4fa1a6330df6971549 ] + +There is currently a look-up table for a variety of resolutions. +Since the phy has the ability to dynamically calculate the values +necessary to use the intger divider which should allow more +resolutions without having to update the look-up-table. + +If the lookup table cannot find an exact match, fall back to the +dynamic calculator of the integer divider. + +Previously, the value of P was hard-coded to 1, this required an +update to the phy_pll_cfg table to add in the extra value into the +table, so if the value of P is calculated to be something else +by the PMS calculator, the calculated_phy_pll_cfg structure +can be used instead without having to keep track of which method +was used. + +Signed-off-by: Adam Ford +Reviewed-by: Dominique Martinet +Tested-by: Dominique Martinet +Reviewed-by: Frieder Schrempf +Link: https://lore.kernel.org/r/20240914112816.520224-4-aford173@gmail.com +Signed-off-by: Vinod Koul +Stable-dep-of: d567679f2b6a ("phy: freescale: fsl-samsung-hdmi: Clean up fld_tg_code calculation") +Signed-off-by: Sasha Levin +--- + drivers/phy/freescale/phy-fsl-samsung-hdmi.c | 377 +++++++++++++------ + 1 file changed, 270 insertions(+), 107 deletions(-) + +diff --git a/drivers/phy/freescale/phy-fsl-samsung-hdmi.c b/drivers/phy/freescale/phy-fsl-samsung-hdmi.c +index 4f6874226f9ab..029de69fbeaf4 100644 +--- a/drivers/phy/freescale/phy-fsl-samsung-hdmi.c ++++ b/drivers/phy/freescale/phy-fsl-samsung-hdmi.c +@@ -16,6 +16,8 @@ + + #define PHY_REG(reg) (reg * 4) + ++#define REG01_PMS_P_MASK GENMASK(3, 0) ++#define REG03_PMS_S_MASK GENMASK(7, 4) + #define REG12_CK_DIV_MASK GENMASK(5, 4) + + #define REG13_TG_CODE_LOW_MASK GENMASK(7, 0) +@@ -38,281 +40,296 @@ + #define REG34_PLL_LOCK BIT(6) + #define REG34_PHY_CLK_READY BIT(5) + +-#define PHY_PLL_DIV_REGS_NUM 6 ++#ifndef MHZ ++#define MHZ (1000UL * 1000UL) ++#endif ++ ++#define PHY_PLL_DIV_REGS_NUM 7 + + struct phy_config { + u32 pixclk; + u8 pll_div_regs[PHY_PLL_DIV_REGS_NUM]; + }; + ++/* ++ * The calculated_phy_pll_cfg only handles integer divider for PMS, ++ * meaning the last four entries will be fixed, but the first three will ++ * be calculated by the PMS calculator. ++ */ ++static struct phy_config calculated_phy_pll_cfg = { ++ .pixclk = 0, ++ .pll_div_regs = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00 }, ++}; ++ ++/* The lookup table contains values for which the fractional divder is used */ + static const struct phy_config phy_pll_cfg[] = { + { + .pixclk = 22250000, +- .pll_div_regs = { 0x4b, 0xf1, 0x89, 0x88, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x4b, 0xf1, 0x89, 0x88, 0x80, 0x40 }, + }, { + .pixclk = 23750000, +- .pll_div_regs = { 0x50, 0xf1, 0x86, 0x85, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x50, 0xf1, 0x86, 0x85, 0x80, 0x40 }, + }, { + .pixclk = 24000000, +- .pll_div_regs = { 0x50, 0xf0, 0x00, 0x00, 0x80, 0x00 }, ++ .pll_div_regs = { 0xd1, 0x50, 0xf0, 0x00, 0x00, 0x80, 0x00 }, + }, { + .pixclk = 24024000, +- .pll_div_regs = { 0x50, 0xf1, 0x99, 0x02, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x50, 0xf1, 0x99, 0x02, 0x80, 0x40 }, + }, { + .pixclk = 25175000, +- .pll_div_regs = { 0x54, 0xfc, 0xcc, 0x91, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x54, 0xfc, 0xcc, 0x91, 0x80, 0x40 }, + }, { + .pixclk = 25200000, +- .pll_div_regs = { 0x54, 0xf0, 0x00, 0x00, 0x80, 0x00 }, ++ .pll_div_regs = { 0xd1, 0x54, 0xf0, 0x00, 0x00, 0x80, 0x00 }, + }, { + .pixclk = 26750000, +- .pll_div_regs = { 0x5a, 0xf2, 0x89, 0x88, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x5a, 0xf2, 0x89, 0x88, 0x80, 0x40 }, + }, { + .pixclk = 27000000, +- .pll_div_regs = { 0x5a, 0xf0, 0x00, 0x00, 0x80, 0x00 }, ++ .pll_div_regs = { 0xd1, 0x5a, 0xf0, 0x00, 0x00, 0x80, 0x00 }, + }, { + .pixclk = 27027000, +- .pll_div_regs = { 0x5a, 0xf2, 0xfd, 0x0c, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x5a, 0xf2, 0xfd, 0x0c, 0x80, 0x40 }, + }, { + .pixclk = 29500000, +- .pll_div_regs = { 0x62, 0xf4, 0x95, 0x08, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x62, 0xf4, 0x95, 0x08, 0x80, 0x40 }, + }, { + .pixclk = 30750000, +- .pll_div_regs = { 0x66, 0xf4, 0x82, 0x01, 0x88, 0x45 }, ++ .pll_div_regs = { 0xd1, 0x66, 0xf4, 0x82, 0x01, 0x88, 0x45 }, + }, { + .pixclk = 30888000, +- .pll_div_regs = { 0x66, 0xf4, 0x99, 0x18, 0x88, 0x45 }, ++ .pll_div_regs = { 0xd1, 0x66, 0xf4, 0x99, 0x18, 0x88, 0x45 }, + }, { + .pixclk = 33750000, +- .pll_div_regs = { 0x70, 0xf4, 0x82, 0x01, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x70, 0xf4, 0x82, 0x01, 0x80, 0x40 }, + }, { + .pixclk = 35000000, +- .pll_div_regs = { 0x58, 0xb8, 0x8b, 0x88, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x58, 0xb8, 0x8b, 0x88, 0x80, 0x40 }, + }, { + .pixclk = 36000000, +- .pll_div_regs = { 0x5a, 0xb0, 0x00, 0x00, 0x80, 0x00 }, ++ .pll_div_regs = { 0xd1, 0x5a, 0xb0, 0x00, 0x00, 0x80, 0x00 }, + }, { + .pixclk = 36036000, +- .pll_div_regs = { 0x5a, 0xb2, 0xfd, 0x0c, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x5a, 0xb2, 0xfd, 0x0c, 0x80, 0x40 }, + }, { + .pixclk = 40000000, +- .pll_div_regs = { 0x64, 0xb0, 0x00, 0x00, 0x80, 0x00 }, ++ .pll_div_regs = { 0xd1, 0x64, 0xb0, 0x00, 0x00, 0x80, 0x00 }, + }, { + .pixclk = 43200000, +- .pll_div_regs = { 0x5a, 0x90, 0x00, 0x00, 0x80, 0x00 }, ++ .pll_div_regs = { 0xd1, 0x5a, 0x90, 0x00, 0x00, 0x80, 0x00 }, + }, { + .pixclk = 43243200, +- .pll_div_regs = { 0x5a, 0x92, 0xfd, 0x0c, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x5a, 0x92, 0xfd, 0x0c, 0x80, 0x40 }, + }, { + .pixclk = 44500000, +- .pll_div_regs = { 0x5c, 0x92, 0x98, 0x11, 0x84, 0x41 }, ++ .pll_div_regs = { 0xd1, 0x5c, 0x92, 0x98, 0x11, 0x84, 0x41 }, + }, { + .pixclk = 47000000, +- .pll_div_regs = { 0x62, 0x94, 0x95, 0x82, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x62, 0x94, 0x95, 0x82, 0x80, 0x40 }, + }, { + .pixclk = 47500000, +- .pll_div_regs = { 0x63, 0x96, 0xa1, 0x82, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x63, 0x96, 0xa1, 0x82, 0x80, 0x40 }, + }, { + .pixclk = 50349650, +- .pll_div_regs = { 0x54, 0x7c, 0xc3, 0x8f, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x54, 0x7c, 0xc3, 0x8f, 0x80, 0x40 }, + }, { + .pixclk = 50400000, +- .pll_div_regs = { 0x54, 0x70, 0x00, 0x00, 0x80, 0x00 }, ++ .pll_div_regs = { 0xd1, 0x54, 0x70, 0x00, 0x00, 0x80, 0x00 }, + }, { + .pixclk = 53250000, +- .pll_div_regs = { 0x58, 0x72, 0x84, 0x03, 0x82, 0x41 }, ++ .pll_div_regs = { 0xd1, 0x58, 0x72, 0x84, 0x03, 0x82, 0x41 }, + }, { + .pixclk = 53500000, +- .pll_div_regs = { 0x5a, 0x72, 0x89, 0x88, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x5a, 0x72, 0x89, 0x88, 0x80, 0x40 }, + }, { + .pixclk = 54000000, +- .pll_div_regs = { 0x5a, 0x70, 0x00, 0x00, 0x80, 0x00 }, ++ .pll_div_regs = { 0xd1, 0x5a, 0x70, 0x00, 0x00, 0x80, 0x00 }, + }, { + .pixclk = 54054000, +- .pll_div_regs = { 0x5a, 0x72, 0xfd, 0x0c, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x5a, 0x72, 0xfd, 0x0c, 0x80, 0x40 }, + }, { + .pixclk = 59000000, +- .pll_div_regs = { 0x62, 0x74, 0x95, 0x08, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x62, 0x74, 0x95, 0x08, 0x80, 0x40 }, + }, { + .pixclk = 59340659, +- .pll_div_regs = { 0x62, 0x74, 0xdb, 0x52, 0x88, 0x47 }, ++ .pll_div_regs = { 0xd1, 0x62, 0x74, 0xdb, 0x52, 0x88, 0x47 }, + }, { + .pixclk = 59400000, +- .pll_div_regs = { 0x63, 0x70, 0x00, 0x00, 0x80, 0x00 }, ++ .pll_div_regs = { 0xd1, 0x63, 0x70, 0x00, 0x00, 0x80, 0x00 }, + }, { + .pixclk = 61500000, +- .pll_div_regs = { 0x66, 0x74, 0x82, 0x01, 0x88, 0x45 }, ++ .pll_div_regs = { 0xd1, 0x66, 0x74, 0x82, 0x01, 0x88, 0x45 }, + }, { + .pixclk = 63500000, +- .pll_div_regs = { 0x69, 0x74, 0x89, 0x08, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x69, 0x74, 0x89, 0x08, 0x80, 0x40 }, + }, { + .pixclk = 67500000, +- .pll_div_regs = { 0x54, 0x52, 0x87, 0x03, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x54, 0x52, 0x87, 0x03, 0x80, 0x40 }, + }, { + .pixclk = 70000000, +- .pll_div_regs = { 0x58, 0x58, 0x8b, 0x88, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x58, 0x58, 0x8b, 0x88, 0x80, 0x40 }, + }, { + .pixclk = 72000000, +- .pll_div_regs = { 0x5a, 0x50, 0x00, 0x00, 0x80, 0x00 }, ++ .pll_div_regs = { 0xd1, 0x5a, 0x50, 0x00, 0x00, 0x80, 0x00 }, + }, { + .pixclk = 72072000, +- .pll_div_regs = { 0x5a, 0x52, 0xfd, 0x0c, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x5a, 0x52, 0xfd, 0x0c, 0x80, 0x40 }, + }, { + .pixclk = 74176000, +- .pll_div_regs = { 0x5d, 0x58, 0xdb, 0xA2, 0x88, 0x41 }, ++ .pll_div_regs = { 0xd1, 0x5d, 0x58, 0xdb, 0xA2, 0x88, 0x41 }, + }, { + .pixclk = 74250000, +- .pll_div_regs = { 0x5c, 0x52, 0x90, 0x0d, 0x84, 0x41 }, ++ .pll_div_regs = { 0xd1, 0x5c, 0x52, 0x90, 0x0d, 0x84, 0x41 }, + }, { + .pixclk = 78500000, +- .pll_div_regs = { 0x62, 0x54, 0x87, 0x01, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x62, 0x54, 0x87, 0x01, 0x80, 0x40 }, + }, { + .pixclk = 80000000, +- .pll_div_regs = { 0x64, 0x50, 0x00, 0x00, 0x80, 0x00 }, ++ .pll_div_regs = { 0xd1, 0x64, 0x50, 0x00, 0x00, 0x80, 0x00 }, + }, { + .pixclk = 82000000, +- .pll_div_regs = { 0x66, 0x54, 0x82, 0x01, 0x88, 0x45 }, ++ .pll_div_regs = { 0xd1, 0x66, 0x54, 0x82, 0x01, 0x88, 0x45 }, + }, { + .pixclk = 82500000, +- .pll_div_regs = { 0x67, 0x54, 0x88, 0x01, 0x90, 0x49 }, ++ .pll_div_regs = { 0xd1, 0x67, 0x54, 0x88, 0x01, 0x90, 0x49 }, + }, { + .pixclk = 89000000, +- .pll_div_regs = { 0x70, 0x54, 0x84, 0x83, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x70, 0x54, 0x84, 0x83, 0x80, 0x40 }, + }, { + .pixclk = 90000000, +- .pll_div_regs = { 0x70, 0x54, 0x82, 0x01, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x70, 0x54, 0x82, 0x01, 0x80, 0x40 }, + }, { + .pixclk = 94000000, +- .pll_div_regs = { 0x4e, 0x32, 0xa7, 0x10, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x4e, 0x32, 0xa7, 0x10, 0x80, 0x40 }, + }, { + .pixclk = 95000000, +- .pll_div_regs = { 0x50, 0x31, 0x86, 0x85, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x50, 0x31, 0x86, 0x85, 0x80, 0x40 }, + }, { + .pixclk = 98901099, +- .pll_div_regs = { 0x52, 0x3a, 0xdb, 0x4c, 0x88, 0x47 }, ++ .pll_div_regs = { 0xd1, 0x52, 0x3a, 0xdb, 0x4c, 0x88, 0x47 }, + }, { + .pixclk = 99000000, +- .pll_div_regs = { 0x52, 0x32, 0x82, 0x01, 0x88, 0x47 }, ++ .pll_div_regs = { 0xd1, 0x52, 0x32, 0x82, 0x01, 0x88, 0x47 }, + }, { + .pixclk = 100699300, +- .pll_div_regs = { 0x54, 0x3c, 0xc3, 0x8f, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x54, 0x3c, 0xc3, 0x8f, 0x80, 0x40 }, + }, { + .pixclk = 100800000, +- .pll_div_regs = { 0x54, 0x30, 0x00, 0x00, 0x80, 0x00 }, ++ .pll_div_regs = { 0xd1, 0x54, 0x30, 0x00, 0x00, 0x80, 0x00 }, + }, { + .pixclk = 102500000, +- .pll_div_regs = { 0x55, 0x32, 0x8c, 0x05, 0x90, 0x4b }, ++ .pll_div_regs = { 0xd1, 0x55, 0x32, 0x8c, 0x05, 0x90, 0x4b }, + }, { + .pixclk = 104750000, +- .pll_div_regs = { 0x57, 0x32, 0x98, 0x07, 0x90, 0x49 }, ++ .pll_div_regs = { 0xd1, 0x57, 0x32, 0x98, 0x07, 0x90, 0x49 }, + }, { + .pixclk = 106500000, +- .pll_div_regs = { 0x58, 0x32, 0x84, 0x03, 0x82, 0x41 }, ++ .pll_div_regs = { 0xd1, 0x58, 0x32, 0x84, 0x03, 0x82, 0x41 }, + }, { + .pixclk = 107000000, +- .pll_div_regs = { 0x5a, 0x32, 0x89, 0x88, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x5a, 0x32, 0x89, 0x88, 0x80, 0x40 }, + }, { + .pixclk = 108000000, +- .pll_div_regs = { 0x5a, 0x30, 0x00, 0x00, 0x80, 0x00 }, ++ .pll_div_regs = { 0xd1, 0x5a, 0x30, 0x00, 0x00, 0x80, 0x00 }, + }, { + .pixclk = 108108000, +- .pll_div_regs = { 0x5a, 0x32, 0xfd, 0x0c, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x5a, 0x32, 0xfd, 0x0c, 0x80, 0x40 }, + }, { + .pixclk = 118000000, +- .pll_div_regs = { 0x62, 0x34, 0x95, 0x08, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x62, 0x34, 0x95, 0x08, 0x80, 0x40 }, + }, { + .pixclk = 118800000, +- .pll_div_regs = { 0x63, 0x30, 0x00, 0x00, 0x80, 0x00 }, ++ .pll_div_regs = { 0xd1, 0x63, 0x30, 0x00, 0x00, 0x80, 0x00 }, + }, { + .pixclk = 123000000, +- .pll_div_regs = { 0x66, 0x34, 0x82, 0x01, 0x88, 0x45 }, ++ .pll_div_regs = { 0xd1, 0x66, 0x34, 0x82, 0x01, 0x88, 0x45 }, + }, { + .pixclk = 127000000, +- .pll_div_regs = { 0x69, 0x34, 0x89, 0x08, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x69, 0x34, 0x89, 0x08, 0x80, 0x40 }, + }, { + .pixclk = 135000000, +- .pll_div_regs = { 0x70, 0x34, 0x82, 0x01, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x70, 0x34, 0x82, 0x01, 0x80, 0x40 }, + }, { + .pixclk = 135580000, +- .pll_div_regs = { 0x71, 0x39, 0xe9, 0x82, 0x9c, 0x5b }, ++ .pll_div_regs = { 0xd1, 0x71, 0x39, 0xe9, 0x82, 0x9c, 0x5b }, + }, { + .pixclk = 137520000, +- .pll_div_regs = { 0x72, 0x38, 0x99, 0x10, 0x85, 0x41 }, ++ .pll_div_regs = { 0xd1, 0x72, 0x38, 0x99, 0x10, 0x85, 0x41 }, + }, { + .pixclk = 138750000, +- .pll_div_regs = { 0x73, 0x35, 0x88, 0x05, 0x90, 0x4d }, ++ .pll_div_regs = { 0xd1, 0x73, 0x35, 0x88, 0x05, 0x90, 0x4d }, + }, { + .pixclk = 140000000, +- .pll_div_regs = { 0x75, 0x36, 0xa7, 0x90, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x75, 0x36, 0xa7, 0x90, 0x80, 0x40 }, + }, { + .pixclk = 144000000, +- .pll_div_regs = { 0x78, 0x30, 0x00, 0x00, 0x80, 0x00 }, ++ .pll_div_regs = { 0xd1, 0x78, 0x30, 0x00, 0x00, 0x80, 0x00 }, + }, { + .pixclk = 148352000, +- .pll_div_regs = { 0x7b, 0x35, 0xdb, 0x39, 0x90, 0x45 }, ++ .pll_div_regs = { 0xd1, 0x7b, 0x35, 0xdb, 0x39, 0x90, 0x45 }, + }, { + .pixclk = 148500000, +- .pll_div_regs = { 0x7b, 0x35, 0x84, 0x03, 0x90, 0x45 }, ++ .pll_div_regs = { 0xd1, 0x7b, 0x35, 0x84, 0x03, 0x90, 0x45 }, + }, { + .pixclk = 154000000, +- .pll_div_regs = { 0x40, 0x18, 0x83, 0x01, 0x00, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x40, 0x18, 0x83, 0x01, 0x00, 0x40 }, + }, { + .pixclk = 157000000, +- .pll_div_regs = { 0x41, 0x11, 0xa7, 0x14, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x41, 0x11, 0xa7, 0x14, 0x80, 0x40 }, + }, { + .pixclk = 160000000, +- .pll_div_regs = { 0x42, 0x12, 0xa1, 0x20, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x42, 0x12, 0xa1, 0x20, 0x80, 0x40 }, + }, { + .pixclk = 162000000, +- .pll_div_regs = { 0x43, 0x18, 0x8b, 0x08, 0x96, 0x55 }, ++ .pll_div_regs = { 0xd1, 0x43, 0x18, 0x8b, 0x08, 0x96, 0x55 }, + }, { + .pixclk = 164000000, +- .pll_div_regs = { 0x45, 0x11, 0x83, 0x82, 0x90, 0x4b }, ++ .pll_div_regs = { 0xd1, 0x45, 0x11, 0x83, 0x82, 0x90, 0x4b }, + }, { + .pixclk = 165000000, +- .pll_div_regs = { 0x45, 0x11, 0x84, 0x81, 0x90, 0x4b }, ++ .pll_div_regs = { 0xd1, 0x45, 0x11, 0x84, 0x81, 0x90, 0x4b }, + }, { + .pixclk = 180000000, +- .pll_div_regs = { 0x4b, 0x10, 0x00, 0x00, 0x80, 0x00 }, ++ .pll_div_regs = { 0xd1, 0x4b, 0x10, 0x00, 0x00, 0x80, 0x00 }, + }, { + .pixclk = 185625000, +- .pll_div_regs = { 0x4e, 0x12, 0x9a, 0x95, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x4e, 0x12, 0x9a, 0x95, 0x80, 0x40 }, + }, { + .pixclk = 188000000, +- .pll_div_regs = { 0x4e, 0x12, 0xa7, 0x10, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x4e, 0x12, 0xa7, 0x10, 0x80, 0x40 }, + }, { + .pixclk = 198000000, +- .pll_div_regs = { 0x52, 0x12, 0x82, 0x01, 0x88, 0x47 }, ++ .pll_div_regs = { 0xd1, 0x52, 0x12, 0x82, 0x01, 0x88, 0x47 }, + }, { + .pixclk = 205000000, +- .pll_div_regs = { 0x55, 0x12, 0x8c, 0x05, 0x90, 0x4b }, ++ .pll_div_regs = { 0xd1, 0x55, 0x12, 0x8c, 0x05, 0x90, 0x4b }, + }, { + .pixclk = 209500000, +- .pll_div_regs = { 0x57, 0x12, 0x98, 0x07, 0x90, 0x49 }, ++ .pll_div_regs = { 0xd1, 0x57, 0x12, 0x98, 0x07, 0x90, 0x49 }, + }, { + .pixclk = 213000000, +- .pll_div_regs = { 0x58, 0x12, 0x84, 0x03, 0x82, 0x41 }, ++ .pll_div_regs = { 0xd1, 0x58, 0x12, 0x84, 0x03, 0x82, 0x41 }, + }, { + .pixclk = 216000000, +- .pll_div_regs = { 0x5a, 0x10, 0x00, 0x00, 0x80, 0x00 }, ++ .pll_div_regs = { 0xd1, 0x5a, 0x10, 0x00, 0x00, 0x80, 0x00 }, + }, { + .pixclk = 216216000, +- .pll_div_regs = { 0x5a, 0x12, 0xfd, 0x0c, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x5a, 0x12, 0xfd, 0x0c, 0x80, 0x40 }, + }, { + .pixclk = 237600000, +- .pll_div_regs = { 0x63, 0x10, 0x00, 0x00, 0x80, 0x00 }, ++ .pll_div_regs = { 0xd1, 0x63, 0x10, 0x00, 0x00, 0x80, 0x00 }, + }, { + .pixclk = 254000000, +- .pll_div_regs = { 0x69, 0x14, 0x89, 0x08, 0x80, 0x40 }, ++ .pll_div_regs = { 0xd1, 0x69, 0x14, 0x89, 0x08, 0x80, 0x40 }, + }, { + .pixclk = 277500000, +- .pll_div_regs = { 0x73, 0x15, 0x88, 0x05, 0x90, 0x4d }, ++ .pll_div_regs = { 0xd1, 0x73, 0x15, 0x88, 0x05, 0x90, 0x4d }, + }, { + .pixclk = 288000000, +- .pll_div_regs = { 0x78, 0x10, 0x00, 0x00, 0x80, 0x00 }, ++ .pll_div_regs = { 0xd1, 0x78, 0x10, 0x00, 0x00, 0x80, 0x00 }, + }, { + .pixclk = 297000000, +- .pll_div_regs = { 0x7b, 0x15, 0x84, 0x03, 0x90, 0x45 }, ++ .pll_div_regs = { 0xd1, 0x7b, 0x15, 0x84, 0x03, 0x90, 0x45 }, + }, + }; + +@@ -322,7 +339,8 @@ struct reg_settings { + }; + + static const struct reg_settings common_phy_cfg[] = { +- { PHY_REG(0), 0x00 }, { PHY_REG(1), 0xd1 }, ++ { PHY_REG(0), 0x00 }, ++ /* PHY_REG(1-7) pix clk specific */ + { PHY_REG(8), 0x4f }, { PHY_REG(9), 0x30 }, + { PHY_REG(10), 0x33 }, { PHY_REG(11), 0x65 }, + /* REG12 pixclk specific */ +@@ -415,6 +433,83 @@ fsl_samsung_hdmi_phy_configure_pll_lock_det(struct fsl_samsung_hdmi_phy *phy, + phy->regs + PHY_REG(14)); + } + ++static unsigned long fsl_samsung_hdmi_phy_find_pms(unsigned long fout, u8 *p, u16 *m, u8 *s) ++{ ++ unsigned long best_freq = 0; ++ u32 min_delta = 0xffffffff; ++ u8 _p, best_p; ++ u16 _m, best_m; ++ u8 _s, best_s; ++ ++ /* ++ * Figure 13-78 of the reference manual states the PLL should be TMDS x 5 ++ * while the TMDS_CLKO should be the PLL / 5. So to calculate the PLL, ++ * take the pix clock x 5, then return the value of the PLL / 5. ++ */ ++ fout *= 5; ++ ++ /* The ref manual states the values of 'P' range from 1 to 11 */ ++ for (_p = 1; _p <= 11; ++_p) { ++ for (_s = 1; _s <= 16; ++_s) { ++ u64 tmp; ++ u32 delta; ++ ++ /* s must be one or even */ ++ if (_s > 1 && (_s & 0x01) == 1) ++ _s++; ++ ++ /* _s cannot be 14 per the TRM */ ++ if (_s == 14) ++ continue; ++ ++ /* ++ * TODO: Ref Manual doesn't state the range of _m ++ * so this should be further refined if possible. ++ * This range was set based on the original values ++ * in the lookup table ++ */ ++ tmp = (u64)fout * (_p * _s); ++ do_div(tmp, 24 * MHZ); ++ _m = tmp; ++ if (_m < 0x30 || _m > 0x7b) ++ continue; ++ ++ /* ++ * Rev 2 of the Ref Manual states the ++ * VCO can range between 750MHz and ++ * 3GHz. The VCO is assumed to be ++ * Fvco = (M * f_ref) / P, ++ * where f_ref is 24MHz. ++ */ ++ tmp = (u64)_m * 24 * MHZ; ++ do_div(tmp, _p); ++ if (tmp < 750 * MHZ || ++ tmp > 3000 * MHZ) ++ continue; ++ ++ /* Final frequency after post-divider */ ++ do_div(tmp, _s); ++ ++ delta = abs(fout - tmp); ++ if (delta < min_delta) { ++ best_p = _p; ++ best_s = _s; ++ best_m = _m; ++ min_delta = delta; ++ best_freq = tmp; ++ } ++ } ++ } ++ ++ if (best_freq) { ++ *p = best_p; ++ *m = best_m; ++ *s = best_s; ++ } ++ ++ return best_freq / 5; ++} ++ + static int fsl_samsung_hdmi_phy_configure(struct fsl_samsung_hdmi_phy *phy, + const struct phy_config *cfg) + { +@@ -428,13 +523,13 @@ static int fsl_samsung_hdmi_phy_configure(struct fsl_samsung_hdmi_phy *phy, + for (i = 0; i < ARRAY_SIZE(common_phy_cfg); i++) + writeb(common_phy_cfg[i].val, phy->regs + common_phy_cfg[i].reg); + +- /* set individual PLL registers PHY_REG2 ... PHY_REG7 */ ++ /* set individual PLL registers PHY_REG1 ... PHY_REG7 */ + for (i = 0; i < PHY_PLL_DIV_REGS_NUM; i++) +- writeb(cfg->pll_div_regs[i], phy->regs + PHY_REG(2) + i * 4); ++ writeb(cfg->pll_div_regs[i], phy->regs + PHY_REG(1) + i * 4); + +- /* High nibble of pll_div_regs[1] contains S which also gets written to REG21 */ ++ /* High nibble of PHY_REG3 and low nibble of PHY_REG21 both contain 'S' */ + writeb(REG21_SEL_TX_CK_INV | FIELD_PREP(REG21_PMS_S_MASK, +- cfg->pll_div_regs[1] >> 4), phy->regs + PHY_REG(21)); ++ cfg->pll_div_regs[2] >> 4), phy->regs + PHY_REG(21)); + + fsl_samsung_hdmi_phy_configure_pll_lock_det(phy, cfg); + +@@ -459,34 +554,102 @@ static unsigned long phy_clk_recalc_rate(struct clk_hw *hw, + return phy->cur_cfg->pixclk; + } + +-static long phy_clk_round_rate(struct clk_hw *hw, +- unsigned long rate, unsigned long *parent_rate) ++/* Helper function to lookup the available fractional-divider rate */ ++static const struct phy_config *fsl_samsung_hdmi_phy_lookup_rate(unsigned long rate) + { + int i; + ++ /* Search the lookup table */ + for (i = ARRAY_SIZE(phy_pll_cfg) - 1; i >= 0; i--) + if (phy_pll_cfg[i].pixclk <= rate) +- return phy_pll_cfg[i].pixclk; ++ break; ++ ++ return &phy_pll_cfg[i]; ++} ++ ++static void fsl_samsung_hdmi_calculate_phy(struct phy_config *cal_phy, unsigned long rate, ++ u8 p, u16 m, u8 s) ++{ ++ cal_phy->pixclk = rate; ++ cal_phy->pll_div_regs[0] = FIELD_PREP(REG01_PMS_P_MASK, p); ++ cal_phy->pll_div_regs[1] = m; ++ cal_phy->pll_div_regs[2] = FIELD_PREP(REG03_PMS_S_MASK, s-1); ++ /* pll_div_regs 3-6 are fixed and pre-defined already */ ++} ++ ++static long phy_clk_round_rate(struct clk_hw *hw, ++ unsigned long rate, unsigned long *parent_rate) ++{ ++ const struct phy_config *fract_div_phy; ++ u32 int_div_clk; ++ u16 m; ++ u8 p, s; ++ ++ /* If the clock is out of range return error instead of searching */ ++ if (rate > 297000000 || rate < 22250000) ++ return -EINVAL; ++ ++ /* Search the fractional divider lookup table */ ++ fract_div_phy = fsl_samsung_hdmi_phy_lookup_rate(rate); + +- return -EINVAL; ++ /* If the rate is an exact match, return that value */ ++ if (rate == fract_div_phy->pixclk) ++ return fract_div_phy->pixclk; ++ ++ /* If the exact match isn't found, calculate the integer divider */ ++ int_div_clk = fsl_samsung_hdmi_phy_find_pms(rate, &p, &m, &s); ++ ++ /* If the int_div_clk rate is an exact match, return that value */ ++ if (int_div_clk == rate) ++ return int_div_clk; ++ ++ /* If neither rate is an exact match, use the value from the LUT */ ++ return fract_div_phy->pixclk; ++} ++ ++static int phy_use_fract_div(struct fsl_samsung_hdmi_phy *phy, const struct phy_config *fract_div_phy) ++{ ++ phy->cur_cfg = fract_div_phy; ++ dev_dbg(phy->dev, "fsl_samsung_hdmi_phy: using fractional divider rate = %u\n", ++ phy->cur_cfg->pixclk); ++ return fsl_samsung_hdmi_phy_configure(phy, phy->cur_cfg); + } + + static int phy_clk_set_rate(struct clk_hw *hw, + unsigned long rate, unsigned long parent_rate) + { + struct fsl_samsung_hdmi_phy *phy = to_fsl_samsung_hdmi_phy(hw); +- int i; ++ const struct phy_config *fract_div_phy; ++ u32 int_div_clk; ++ u16 m; ++ u8 p, s; + +- for (i = ARRAY_SIZE(phy_pll_cfg) - 1; i >= 0; i--) +- if (phy_pll_cfg[i].pixclk <= rate) +- break; ++ /* Search the fractional divider lookup table */ ++ fract_div_phy = fsl_samsung_hdmi_phy_lookup_rate(rate); + +- if (i < 0) +- return -EINVAL; ++ /* If the rate is an exact match, use that value */ ++ if (fract_div_phy->pixclk == rate) ++ return phy_use_fract_div(phy, fract_div_phy); + +- phy->cur_cfg = &phy_pll_cfg[i]; ++ /* ++ * If the rate from the fractional divider is not exact, check the integer divider, ++ * and use it if that value is an exact match. ++ */ ++ int_div_clk = fsl_samsung_hdmi_phy_find_pms(rate, &p, &m, &s); ++ if (int_div_clk == rate) { ++ dev_dbg(phy->dev, "fsl_samsung_hdmi_phy: integer divider rate = %u\n", ++ int_div_clk); ++ ++ fsl_samsung_hdmi_calculate_phy(&calculated_phy_pll_cfg, int_div_clk, p, m, s); ++ phy->cur_cfg = &calculated_phy_pll_cfg; ++ return fsl_samsung_hdmi_phy_configure(phy, phy->cur_cfg); ++ } + +- return fsl_samsung_hdmi_phy_configure(phy, phy->cur_cfg); ++ /* ++ * If neither the fractional divider nor the integer divider can find an exact value ++ * fall back to using the fractional divider ++ */ ++ return phy_use_fract_div(phy, fract_div_phy); + } + + static const struct clk_ops phy_clk_ops = { +-- +2.39.5 + diff --git a/queue-6.12/pinctrl-amd-take-suspend-type-into-consideration-whi.patch b/queue-6.12/pinctrl-amd-take-suspend-type-into-consideration-whi.patch new file mode 100644 index 0000000000..9af9c1e74a --- /dev/null +++ b/queue-6.12/pinctrl-amd-take-suspend-type-into-consideration-whi.patch @@ -0,0 +1,126 @@ +From 76cbf17b739dc1e0dd449e787083b7d430752167 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jan 2025 18:41:15 +0100 +Subject: pinctrl: amd: Take suspend type into consideration which pins are + non-wake + +From: Maciej S. Szmigiero + +[ Upstream commit f31f33dbb3bab572bad9fe7b849ab0dcbe6fd279 ] + +Some laptops have pins which are a wake source for S0i3/S3 but which +aren't a wake source for S4/S5 and which cause issues when left unmasked +during hibernation (S4). + +For example HP EliteBook 855 G7 has pin #24 that causes instant wakeup +(hibernation failure) if left unmasked (it is a wake source only for +S0i3/S3). +GPIO pin #24 on this platform is likely dedicated to WWAN XMM7360 +modem since this pin triggers wake notify to WWAN modem's parent PCIe +port. + +Fix this by considering a pin a wake source only if it is marked as one +for the current suspend type (S0i3/S3 vs S4/S5). + +Since Z-wake pins only make sense at runtime these were excluded from +both of suspend categories, so pins with only the Z-wake flag set are +effectively treated as non-wake pins. + +Fixes: 2fff0b5e1a6b ("pinctrl: amd: Mask non-wake source pins with interrupt enabled at suspend") +Signed-off-by: Maciej S. Szmigiero +Reviewed-by: Mario Limonciello +Link: https://lore.kernel.org/d4b2d076366fdd08a0c1cd9b7ecd91dc95e07269.1736184752.git.mail@maciej.szmigiero.name +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-amd.c | 27 +++++++++++++++++++++------ + drivers/pinctrl/pinctrl-amd.h | 7 +++---- + 2 files changed, 24 insertions(+), 10 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c +index 7f66ec73199a9..a12766b3bc8a7 100644 +--- a/drivers/pinctrl/pinctrl-amd.c ++++ b/drivers/pinctrl/pinctrl-amd.c +@@ -908,12 +908,13 @@ static bool amd_gpio_should_save(struct amd_gpio *gpio_dev, unsigned int pin) + return false; + } + +-static int amd_gpio_suspend(struct device *dev) ++static int amd_gpio_suspend_hibernate_common(struct device *dev, bool is_suspend) + { + struct amd_gpio *gpio_dev = dev_get_drvdata(dev); + struct pinctrl_desc *desc = gpio_dev->pctrl->desc; + unsigned long flags; + int i; ++ u32 wake_mask = is_suspend ? WAKE_SOURCE_SUSPEND : WAKE_SOURCE_HIBERNATE; + + for (i = 0; i < desc->npins; i++) { + int pin = desc->pins[i].number; +@@ -925,11 +926,11 @@ static int amd_gpio_suspend(struct device *dev) + gpio_dev->saved_regs[i] = readl(gpio_dev->base + pin * 4) & ~PIN_IRQ_PENDING; + + /* mask any interrupts not intended to be a wake source */ +- if (!(gpio_dev->saved_regs[i] & WAKE_SOURCE)) { ++ if (!(gpio_dev->saved_regs[i] & wake_mask)) { + writel(gpio_dev->saved_regs[i] & ~BIT(INTERRUPT_MASK_OFF), + gpio_dev->base + pin * 4); +- pm_pr_dbg("Disabling GPIO #%d interrupt for suspend.\n", +- pin); ++ pm_pr_dbg("Disabling GPIO #%d interrupt for %s.\n", ++ pin, is_suspend ? "suspend" : "hibernate"); + } + + raw_spin_unlock_irqrestore(&gpio_dev->lock, flags); +@@ -938,6 +939,16 @@ static int amd_gpio_suspend(struct device *dev) + return 0; + } + ++static int amd_gpio_suspend(struct device *dev) ++{ ++ return amd_gpio_suspend_hibernate_common(dev, true); ++} ++ ++static int amd_gpio_hibernate(struct device *dev) ++{ ++ return amd_gpio_suspend_hibernate_common(dev, false); ++} ++ + static int amd_gpio_resume(struct device *dev) + { + struct amd_gpio *gpio_dev = dev_get_drvdata(dev); +@@ -961,8 +972,12 @@ static int amd_gpio_resume(struct device *dev) + } + + static const struct dev_pm_ops amd_gpio_pm_ops = { +- SET_LATE_SYSTEM_SLEEP_PM_OPS(amd_gpio_suspend, +- amd_gpio_resume) ++ .suspend_late = amd_gpio_suspend, ++ .resume_early = amd_gpio_resume, ++ .freeze_late = amd_gpio_hibernate, ++ .thaw_early = amd_gpio_resume, ++ .poweroff_late = amd_gpio_hibernate, ++ .restore_early = amd_gpio_resume, + }; + #endif + +diff --git a/drivers/pinctrl/pinctrl-amd.h b/drivers/pinctrl/pinctrl-amd.h +index cf59089f27763..c9522c62d7910 100644 +--- a/drivers/pinctrl/pinctrl-amd.h ++++ b/drivers/pinctrl/pinctrl-amd.h +@@ -80,10 +80,9 @@ + #define FUNCTION_MASK GENMASK(1, 0) + #define FUNCTION_INVALID GENMASK(7, 0) + +-#define WAKE_SOURCE (BIT(WAKE_CNTRL_OFF_S0I3) | \ +- BIT(WAKE_CNTRL_OFF_S3) | \ +- BIT(WAKE_CNTRL_OFF_S4) | \ +- BIT(WAKECNTRL_Z_OFF)) ++#define WAKE_SOURCE_SUSPEND (BIT(WAKE_CNTRL_OFF_S0I3) | \ ++ BIT(WAKE_CNTRL_OFF_S3)) ++#define WAKE_SOURCE_HIBERNATE BIT(WAKE_CNTRL_OFF_S4) + + struct amd_function { + const char *name; +-- +2.39.5 + diff --git a/queue-6.12/pinctrl-nomadik-add-check-for-clk_enable.patch b/queue-6.12/pinctrl-nomadik-add-check-for-clk_enable.patch new file mode 100644 index 0000000000..571f114dc5 --- /dev/null +++ b/queue-6.12/pinctrl-nomadik-add-check-for-clk_enable.patch @@ -0,0 +1,127 @@ +From f3f2c83b934e0ffba425dfb5493debefb2faa78f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 17:16:18 -0500 +Subject: pinctrl: nomadik: Add check for clk_enable() + +From: Mingwei Zheng + +[ Upstream commit 5c4bfbb21dedf5d56a55cb0e129ccb1fd5083d14 ] + +Add check for the return value of clk_enable() to catch the potential +error. +Disable success clks in the error handling. +Change return type of nmk_gpio_glitch_slpm_init casade. + +Fixes: 3a19805920f1 ("pinctrl: nomadik: move all Nomadik drivers to subdir") +Signed-off-by: Mingwei Zheng +Signed-off-by: Jiasheng Jiang +Link: https://lore.kernel.org/20241206221618.3453159-1-zmw12306@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/nomadik/pinctrl-nomadik.c | 35 ++++++++++++++++++----- + 1 file changed, 28 insertions(+), 7 deletions(-) + +diff --git a/drivers/pinctrl/nomadik/pinctrl-nomadik.c b/drivers/pinctrl/nomadik/pinctrl-nomadik.c +index f4f10c60c1d23..dcc662be08000 100644 +--- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c ++++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c +@@ -438,9 +438,9 @@ static void nmk_prcm_altcx_set_mode(struct nmk_pinctrl *npct, + * - Any spurious wake up event during switch sequence to be ignored and + * cleared + */ +-static void nmk_gpio_glitch_slpm_init(unsigned int *slpm) ++static int nmk_gpio_glitch_slpm_init(unsigned int *slpm) + { +- int i; ++ int i, j, ret; + + for (i = 0; i < NMK_MAX_BANKS; i++) { + struct nmk_gpio_chip *chip = nmk_gpio_chips[i]; +@@ -449,11 +449,21 @@ static void nmk_gpio_glitch_slpm_init(unsigned int *slpm) + if (!chip) + break; + +- clk_enable(chip->clk); ++ ret = clk_enable(chip->clk); ++ if (ret) { ++ for (j = 0; j < i; j++) { ++ chip = nmk_gpio_chips[j]; ++ clk_disable(chip->clk); ++ } ++ ++ return ret; ++ } + + slpm[i] = readl(chip->addr + NMK_GPIO_SLPC); + writel(temp, chip->addr + NMK_GPIO_SLPC); + } ++ ++ return 0; + } + + static void nmk_gpio_glitch_slpm_restore(unsigned int *slpm) +@@ -923,7 +933,9 @@ static int nmk_pmx_set(struct pinctrl_dev *pctldev, unsigned int function, + + slpm[nmk_chip->bank] &= ~BIT(bit); + } +- nmk_gpio_glitch_slpm_init(slpm); ++ ret = nmk_gpio_glitch_slpm_init(slpm); ++ if (ret) ++ goto out_pre_slpm_init; + } + + for (i = 0; i < g->grp.npins; i++) { +@@ -940,7 +952,10 @@ static int nmk_pmx_set(struct pinctrl_dev *pctldev, unsigned int function, + dev_dbg(npct->dev, "setting pin %d to altsetting %d\n", + g->grp.pins[i], g->altsetting); + +- clk_enable(nmk_chip->clk); ++ ret = clk_enable(nmk_chip->clk); ++ if (ret) ++ goto out_glitch; ++ + /* + * If the pin is switching to altfunc, and there was an + * interrupt installed on it which has been lazy disabled, +@@ -988,6 +1003,7 @@ static int nmk_gpio_request_enable(struct pinctrl_dev *pctldev, + struct nmk_gpio_chip *nmk_chip; + struct gpio_chip *chip; + unsigned int bit; ++ int ret; + + if (!range) { + dev_err(npct->dev, "invalid range\n"); +@@ -1004,7 +1020,9 @@ static int nmk_gpio_request_enable(struct pinctrl_dev *pctldev, + + find_nmk_gpio_from_pin(pin, &bit); + +- clk_enable(nmk_chip->clk); ++ ret = clk_enable(nmk_chip->clk); ++ if (ret) ++ return ret; + /* There is no glitch when converting any pin to GPIO */ + __nmk_gpio_set_mode(nmk_chip, bit, NMK_GPIO_ALT_GPIO); + clk_disable(nmk_chip->clk); +@@ -1058,6 +1076,7 @@ static int nmk_pin_config_set(struct pinctrl_dev *pctldev, unsigned int pin, + unsigned long cfg; + int pull, slpm, output, val, i; + bool lowemi, gpiomode, sleep; ++ int ret; + + nmk_chip = find_nmk_gpio_from_pin(pin, &bit); + if (!nmk_chip) { +@@ -1116,7 +1135,9 @@ static int nmk_pin_config_set(struct pinctrl_dev *pctldev, unsigned int pin, + output ? (val ? "high" : "low") : "", + lowemi ? "on" : "off"); + +- clk_enable(nmk_chip->clk); ++ ret = clk_enable(nmk_chip->clk); ++ if (ret) ++ return ret; + if (gpiomode) + /* No glitch when going to GPIO mode */ + __nmk_gpio_set_mode(nmk_chip, bit, NMK_GPIO_ALT_GPIO); +-- +2.39.5 + diff --git a/queue-6.12/pinctrl-samsung-fix-irq-handling-if-an-error-occurs-.patch b/queue-6.12/pinctrl-samsung-fix-irq-handling-if-an-error-occurs-.patch new file mode 100644 index 0000000000..0352e0715b --- /dev/null +++ b/queue-6.12/pinctrl-samsung-fix-irq-handling-if-an-error-occurs-.patch @@ -0,0 +1,55 @@ +From ebdc7585ff52c743de4ed191e10f271084991c6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Nov 2024 13:03:32 +0100 +Subject: pinctrl: samsung: Fix irq handling if an error occurs in + exynos_irq_demux_eint16_31() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christophe JAILLET + +[ Upstream commit f686a2b52e9d78cf401f1b7f446bf0c3a81ebcc0 ] + +chained_irq_enter(() should be paired with a corresponding +chained_irq_exit(). + +Here, if clk_enable() fails, a early return occurs and chained_irq_exit() +is not called. + +Add a new label and a goto for fix it. + +Fixes: f9c744747973 ("pinctrl: samsung: support a bus clock") +Signed-off-by: Christophe JAILLET +Reviewed-by: André Draszik +Link: https://lore.kernel.org/r/f148d823acfb3326a115bd49a0eed60f2345f909.1731844995.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/samsung/pinctrl-exynos.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/samsung/pinctrl-exynos.c b/drivers/pinctrl/samsung/pinctrl-exynos.c +index b79c211c03749..ac6dc22b37c98 100644 +--- a/drivers/pinctrl/samsung/pinctrl-exynos.c ++++ b/drivers/pinctrl/samsung/pinctrl-exynos.c +@@ -636,7 +636,7 @@ static void exynos_irq_demux_eint16_31(struct irq_desc *desc) + if (clk_enable(b->drvdata->pclk)) { + dev_err(b->gpio_chip.parent, + "unable to enable clock for pending IRQs\n"); +- return; ++ goto out; + } + } + +@@ -652,6 +652,7 @@ static void exynos_irq_demux_eint16_31(struct irq_desc *desc) + if (eintd->nr_banks) + clk_disable(eintd->banks[0]->drvdata->pclk); + ++out: + chained_irq_exit(chip, desc); + } + +-- +2.39.5 + diff --git a/queue-6.12/pinctrl-stm32-add-check-for-clk_enable.patch b/queue-6.12/pinctrl-stm32-add-check-for-clk_enable.patch new file mode 100644 index 0000000000..9ecb4c78e8 --- /dev/null +++ b/queue-6.12/pinctrl-stm32-add-check-for-clk_enable.patch @@ -0,0 +1,201 @@ +From 7fdc7a76d6436b9e250046368eeb4ad94d064ae0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jan 2025 17:06:59 -0500 +Subject: pinctrl: stm32: Add check for clk_enable() + +From: Mingwei Zheng + +[ Upstream commit 451bc9aea9a1a6fe53969e81a5cb1bd785c0d989 ] + +Convert the driver to clk_bulk*() API. +Add check for the return value of clk_bulk_enable() to catch +the potential error. + +Fixes: 05d8af449d93 ("pinctrl: stm32: Keep pinctrl block clock enabled when LEVEL IRQ requested") +Signed-off-by: Mingwei Zheng +Signed-off-by: Jiasheng Jiang +Reviewed-by: Antonio Borneo +Link: https://lore.kernel.org/20250106220659.2640365-1-zmw12306@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/stm32/pinctrl-stm32.c | 76 +++++++++++++-------------- + 1 file changed, 38 insertions(+), 38 deletions(-) + +diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c +index 5b7fa77c11843..03f3f707d2755 100644 +--- a/drivers/pinctrl/stm32/pinctrl-stm32.c ++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c +@@ -86,7 +86,6 @@ struct stm32_pinctrl_group { + + struct stm32_gpio_bank { + void __iomem *base; +- struct clk *clk; + struct reset_control *rstc; + spinlock_t lock; + struct gpio_chip gpio_chip; +@@ -108,6 +107,7 @@ struct stm32_pinctrl { + unsigned ngroups; + const char **grp_names; + struct stm32_gpio_bank *banks; ++ struct clk_bulk_data *clks; + unsigned nbanks; + const struct stm32_pinctrl_match_data *match_data; + struct irq_domain *domain; +@@ -1308,12 +1308,6 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, struct fwnode + if (IS_ERR(bank->base)) + return PTR_ERR(bank->base); + +- err = clk_prepare_enable(bank->clk); +- if (err) { +- dev_err(dev, "failed to prepare_enable clk (%d)\n", err); +- return err; +- } +- + bank->gpio_chip = stm32_gpio_template; + + fwnode_property_read_string(fwnode, "st,bank-name", &bank->gpio_chip.label); +@@ -1360,26 +1354,20 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, struct fwnode + bank->fwnode, &stm32_gpio_domain_ops, + bank); + +- if (!bank->domain) { +- err = -ENODEV; +- goto err_clk; +- } ++ if (!bank->domain) ++ return -ENODEV; + } + + names = devm_kcalloc(dev, npins, sizeof(char *), GFP_KERNEL); +- if (!names) { +- err = -ENOMEM; +- goto err_clk; +- } ++ if (!names) ++ return -ENOMEM; + + for (i = 0; i < npins; i++) { + stm32_pin = stm32_pctrl_get_desc_pin_from_gpio(pctl, bank, i); + if (stm32_pin && stm32_pin->pin.name) { + names[i] = devm_kasprintf(dev, GFP_KERNEL, "%s", stm32_pin->pin.name); +- if (!names[i]) { +- err = -ENOMEM; +- goto err_clk; +- } ++ if (!names[i]) ++ return -ENOMEM; + } else { + names[i] = NULL; + } +@@ -1390,15 +1378,11 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, struct fwnode + err = gpiochip_add_data(&bank->gpio_chip, bank); + if (err) { + dev_err(dev, "Failed to add gpiochip(%d)!\n", bank_nr); +- goto err_clk; ++ return err; + } + + dev_info(dev, "%s bank added\n", bank->gpio_chip.label); + return 0; +- +-err_clk: +- clk_disable_unprepare(bank->clk); +- return err; + } + + static struct irq_domain *stm32_pctrl_get_irq_domain(struct platform_device *pdev) +@@ -1621,6 +1605,11 @@ int stm32_pctl_probe(struct platform_device *pdev) + if (!pctl->banks) + return -ENOMEM; + ++ pctl->clks = devm_kcalloc(dev, banks, sizeof(*pctl->clks), ++ GFP_KERNEL); ++ if (!pctl->clks) ++ return -ENOMEM; ++ + i = 0; + for_each_gpiochip_node(dev, child) { + struct stm32_gpio_bank *bank = &pctl->banks[i]; +@@ -1632,24 +1621,27 @@ int stm32_pctl_probe(struct platform_device *pdev) + return -EPROBE_DEFER; + } + +- bank->clk = of_clk_get_by_name(np, NULL); +- if (IS_ERR(bank->clk)) { ++ pctl->clks[i].clk = of_clk_get_by_name(np, NULL); ++ if (IS_ERR(pctl->clks[i].clk)) { + fwnode_handle_put(child); +- return dev_err_probe(dev, PTR_ERR(bank->clk), ++ return dev_err_probe(dev, PTR_ERR(pctl->clks[i].clk), + "failed to get clk\n"); + } ++ pctl->clks[i].id = "pctl"; + i++; + } + ++ ret = clk_bulk_prepare_enable(banks, pctl->clks); ++ if (ret) { ++ dev_err(dev, "failed to prepare_enable clk (%d)\n", ret); ++ return ret; ++ } ++ + for_each_gpiochip_node(dev, child) { + ret = stm32_gpiolib_register_bank(pctl, child); + if (ret) { + fwnode_handle_put(child); +- +- for (i = 0; i < pctl->nbanks; i++) +- clk_disable_unprepare(pctl->banks[i].clk); +- +- return ret; ++ goto err_register; + } + + pctl->nbanks++; +@@ -1658,6 +1650,15 @@ int stm32_pctl_probe(struct platform_device *pdev) + dev_info(dev, "Pinctrl STM32 initialized\n"); + + return 0; ++err_register: ++ for (i = 0; i < pctl->nbanks; i++) { ++ struct stm32_gpio_bank *bank = &pctl->banks[i]; ++ ++ gpiochip_remove(&bank->gpio_chip); ++ } ++ ++ clk_bulk_disable_unprepare(banks, pctl->clks); ++ return ret; + } + + static int __maybe_unused stm32_pinctrl_restore_gpio_regs( +@@ -1726,10 +1727,8 @@ static int __maybe_unused stm32_pinctrl_restore_gpio_regs( + int __maybe_unused stm32_pinctrl_suspend(struct device *dev) + { + struct stm32_pinctrl *pctl = dev_get_drvdata(dev); +- int i; + +- for (i = 0; i < pctl->nbanks; i++) +- clk_disable(pctl->banks[i].clk); ++ clk_bulk_disable(pctl->nbanks, pctl->clks); + + return 0; + } +@@ -1738,10 +1737,11 @@ int __maybe_unused stm32_pinctrl_resume(struct device *dev) + { + struct stm32_pinctrl *pctl = dev_get_drvdata(dev); + struct stm32_pinctrl_group *g = pctl->groups; +- int i; ++ int i, ret; + +- for (i = 0; i < pctl->nbanks; i++) +- clk_enable(pctl->banks[i].clk); ++ ret = clk_bulk_enable(pctl->nbanks, pctl->clks); ++ if (ret) ++ return ret; + + for (i = 0; i < pctl->ngroups; i++, g++) + stm32_pinctrl_restore_gpio_regs(pctl, g->pin); +-- +2.39.5 + diff --git a/queue-6.12/platform-mellanox-mlxbf-pmc-incorrect-type-in-assign.patch b/queue-6.12/platform-mellanox-mlxbf-pmc-incorrect-type-in-assign.patch new file mode 100644 index 0000000000..c5d53a9e92 --- /dev/null +++ b/queue-6.12/platform-mellanox-mlxbf-pmc-incorrect-type-in-assign.patch @@ -0,0 +1,62 @@ +From 32db356fcfb2f9006fb4d74e9d25dc7b30e82968 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Nov 2024 15:51:39 +0800 +Subject: platform/mellanox: mlxbf-pmc: incorrect type in assignment +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pei Xiao + +[ Upstream commit b5dbb8e23cb334460acdb37910ce3784926e1cf1 ] + +Fix sparse warnings: +expected 'void __iomem *addr', but got 'void *addr' + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202411121935.cgFcEMO4-lkp@intel.com/ +Fixes: 423c3361855c ("platform/mellanox: mlxbf-pmc: Add support for BlueField-3") +Signed-off-by: Pei Xiao +Reviewed-by: David Thompson +Link: https://lore.kernel.org/r/fece26ad40620b1e0beb733b9bba3de3ce325761.1732088929.git.xiaopei01@kylinos.cn +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/mlxbf-pmc.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c +index 9d18dfca6a673..9ff7b487dc489 100644 +--- a/drivers/platform/mellanox/mlxbf-pmc.c ++++ b/drivers/platform/mellanox/mlxbf-pmc.c +@@ -1168,7 +1168,7 @@ static int mlxbf_pmc_program_l3_counter(unsigned int blk_num, u32 cnt_num, u32 e + /* Method to handle crspace counter programming */ + static int mlxbf_pmc_program_crspace_counter(unsigned int blk_num, u32 cnt_num, u32 evt) + { +- void *addr; ++ void __iomem *addr; + u32 word; + int ret; + +@@ -1192,7 +1192,7 @@ static int mlxbf_pmc_program_crspace_counter(unsigned int blk_num, u32 cnt_num, + /* Method to clear crspace counter value */ + static int mlxbf_pmc_clear_crspace_counter(unsigned int blk_num, u32 cnt_num) + { +- void *addr; ++ void __iomem *addr; + + addr = pmc->block[blk_num].mmio_base + + MLXBF_PMC_CRSPACE_PERFMON_VAL0(pmc->block[blk_num].counters) + +@@ -1405,7 +1405,7 @@ static int mlxbf_pmc_read_l3_event(unsigned int blk_num, u32 cnt_num, u64 *resul + static int mlxbf_pmc_read_crspace_event(unsigned int blk_num, u32 cnt_num, u64 *result) + { + u32 word, evt; +- void *addr; ++ void __iomem *addr; + int ret; + + addr = pmc->block[blk_num].mmio_base + +-- +2.39.5 + diff --git a/queue-6.12/platform-x86-x86-android-tablets-make-platform-data-.patch b/queue-6.12/platform-x86-x86-android-tablets-make-platform-data-.patch new file mode 100644 index 0000000000..0f5c0518bf --- /dev/null +++ b/queue-6.12/platform-x86-x86-android-tablets-make-platform-data-.patch @@ -0,0 +1,53 @@ +From 685deb18af1febeb496a4470ea11d8577c8d29bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Nov 2024 11:55:34 +0800 +Subject: platform/x86: x86-android-tablets: make platform data be static +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pei Xiao + +[ Upstream commit 6e0fb1bdb71cf8078c8532617e565e3db22c0d3c ] + +make lenovo_yoga_tab2_1380_bq24190_pdata and lenovo_yoga_tab2_1380_modules +to be static + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202410160432.oJAPbrW9-lkp@intel.com/ +Fixes: 3eee73ad42c3 ("platform/x86: x86-android-tablets: Add Lenovo Yoga Tablet 2 Pro 1380F/L data") +Signed-off-by: Pei Xiao +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/daafd1371e7e9946217712ce8720e29cd5c52f7a.1732161310.git.xiaopei01@kylinos.cn +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/x86-android-tablets/lenovo.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/x86-android-tablets/lenovo.c b/drivers/platform/x86/x86-android-tablets/lenovo.c +index ae087f1471c17..a60efbaf4817f 100644 +--- a/drivers/platform/x86/x86-android-tablets/lenovo.c ++++ b/drivers/platform/x86/x86-android-tablets/lenovo.c +@@ -601,7 +601,7 @@ static const struct regulator_init_data lenovo_yoga_tab2_1380_bq24190_vbus_init_ + .num_consumer_supplies = 1, + }; + +-struct bq24190_platform_data lenovo_yoga_tab2_1380_bq24190_pdata = { ++static struct bq24190_platform_data lenovo_yoga_tab2_1380_bq24190_pdata = { + .regulator_init_data = &lenovo_yoga_tab2_1380_bq24190_vbus_init_data, + }; + +@@ -726,7 +726,7 @@ static const struct platform_device_info lenovo_yoga_tab2_1380_pdevs[] __initcon + }, + }; + +-const char * const lenovo_yoga_tab2_1380_modules[] __initconst = { ++static const char * const lenovo_yoga_tab2_1380_modules[] __initconst = { + "bq24190_charger", /* For the Vbus regulator for lc824206xa */ + NULL + }; +-- +2.39.5 + diff --git a/queue-6.12/pm-hibernate-add-error-handling-for-syscore_suspend.patch b/queue-6.12/pm-hibernate-add-error-handling-for-syscore_suspend.patch new file mode 100644 index 0000000000..5b53eda52f --- /dev/null +++ b/queue-6.12/pm-hibernate-add-error-handling-for-syscore_suspend.patch @@ -0,0 +1,58 @@ +From 5e4f486c9e1a4bb4ce6841471175b4d3beafaa99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Jan 2025 22:32:05 +0800 +Subject: PM: hibernate: Add error handling for syscore_suspend() + +From: Wentao Liang + +[ Upstream commit e20a70c572539a486dbd91b225fa6a194a5e2122 ] + +In hibernation_platform_enter(), the code did not check the +return value of syscore_suspend(), potentially leading to a +situation where syscore_resume() would be called even if +syscore_suspend() failed. This could cause unpredictable +behavior or system instability. + +Modify the code sequence in question to properly handle errors returned +by syscore_suspend(). If an error occurs in the suspend path, the code +now jumps to label 'Enable_irqs' skipping the syscore_resume() call and +only enabling interrupts after setting the system state to SYSTEM_RUNNING. + +Fixes: 40dc166cb5dd ("PM / Core: Introduce struct syscore_ops for core subsystems PM") +Signed-off-by: Wentao Liang +Link: https://patch.msgid.link/20250119143205.2103-1-vulab@iscas.ac.cn +[ rjw: Changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + kernel/power/hibernate.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c +index e35829d360390..b483fcea811b1 100644 +--- a/kernel/power/hibernate.c ++++ b/kernel/power/hibernate.c +@@ -608,7 +608,11 @@ int hibernation_platform_enter(void) + + local_irq_disable(); + system_state = SYSTEM_SUSPEND; +- syscore_suspend(); ++ ++ error = syscore_suspend(); ++ if (error) ++ goto Enable_irqs; ++ + if (pm_wakeup_pending()) { + error = -EAGAIN; + goto Power_up; +@@ -620,6 +624,7 @@ int hibernation_platform_enter(void) + + Power_up: + syscore_resume(); ++ Enable_irqs: + system_state = SYSTEM_RUNNING; + local_irq_enable(); + +-- +2.39.5 + diff --git a/queue-6.12/pm-sleep-core-synchronize-runtime-pm-status-of-paren.patch b/queue-6.12/pm-sleep-core-synchronize-runtime-pm-status-of-paren.patch new file mode 100644 index 0000000000..d63cf4f007 --- /dev/null +++ b/queue-6.12/pm-sleep-core-synchronize-runtime-pm-status-of-paren.patch @@ -0,0 +1,119 @@ +From 0887934a9d3a42c18e6b039b265bb8d93cc24b1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jan 2025 20:24:41 +0100 +Subject: PM: sleep: core: Synchronize runtime PM status of parents and + children + +From: Rafael J. Wysocki + +[ Upstream commit 3775fc538f535a7c5adaf11990c7932a0bd1f9eb ] + +Commit 6e176bf8d461 ("PM: sleep: core: Do not skip callbacks in the +resume phase") overlooked the case in which the parent of a device with +DPM_FLAG_SMART_SUSPEND set did not use that flag and could be runtime- +suspended before a transition into a system-wide sleep state. In that +case, if the child is resumed during the subsequent transition from +that state into the working state, its runtime PM status will be set to +RPM_ACTIVE, but the runtime PM status of the parent will not be updated +accordingly, even though the parent will be resumed too, because of the +dev_pm_skip_suspend() check in device_resume_noirq(). + +Address this problem by tracking the need to set the runtime PM status +to RPM_ACTIVE during system-wide resume transitions for devices with +DPM_FLAG_SMART_SUSPEND set and all of the devices depended on by them. + +Fixes: 6e176bf8d461 ("PM: sleep: core: Do not skip callbacks in the resume phase") +Closes: https://lore.kernel.org/linux-pm/Z30p2Etwf3F2AUvD@hovoldconsulting.com/ +Reported-by: Johan Hovold +Tested-by: Manivannan Sadhasivam +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Johan Hovold +Tested-by: Johan Hovold +Link: https://patch.msgid.link/12619233.O9o76ZdvQC@rjwysocki.net +Signed-off-by: Sasha Levin +--- + drivers/base/power/main.c | 29 ++++++++++++++++++++--------- + include/linux/pm.h | 1 + + 2 files changed, 21 insertions(+), 9 deletions(-) + +diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c +index 4a67e83300e16..e1b44266497d3 100644 +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -642,13 +642,15 @@ static void device_resume_noirq(struct device *dev, pm_message_t state, bool asy + * so change its status accordingly. + * + * Otherwise, the device is going to be resumed, so set its PM-runtime +- * status to "active", but do that only if DPM_FLAG_SMART_SUSPEND is set +- * to avoid confusing drivers that don't use it. ++ * status to "active" unless its power.set_active flag is clear, in ++ * which case it is not necessary to update its PM-runtime status. + */ +- if (skip_resume) ++ if (skip_resume) { + pm_runtime_set_suspended(dev); +- else if (dev_pm_skip_suspend(dev)) ++ } else if (dev->power.set_active) { + pm_runtime_set_active(dev); ++ dev->power.set_active = false; ++ } + + if (dev->pm_domain) { + info = "noirq power domain "; +@@ -1175,18 +1177,24 @@ static pm_message_t resume_event(pm_message_t sleep_state) + return PMSG_ON; + } + +-static void dpm_superior_set_must_resume(struct device *dev) ++static void dpm_superior_set_must_resume(struct device *dev, bool set_active) + { + struct device_link *link; + int idx; + +- if (dev->parent) ++ if (dev->parent) { + dev->parent->power.must_resume = true; ++ if (set_active) ++ dev->parent->power.set_active = true; ++ } + + idx = device_links_read_lock(); + +- list_for_each_entry_rcu_locked(link, &dev->links.suppliers, c_node) ++ list_for_each_entry_rcu_locked(link, &dev->links.suppliers, c_node) { + link->supplier->power.must_resume = true; ++ if (set_active) ++ link->supplier->power.set_active = true; ++ } + + device_links_read_unlock(idx); + } +@@ -1264,8 +1272,11 @@ static int device_suspend_noirq(struct device *dev, pm_message_t state, bool asy + dev->power.may_skip_resume)) + dev->power.must_resume = true; + +- if (dev->power.must_resume) +- dpm_superior_set_must_resume(dev); ++ if (dev->power.must_resume) { ++ dev->power.set_active = dev->power.set_active || ++ dev_pm_test_driver_flags(dev, DPM_FLAG_SMART_SUSPEND); ++ dpm_superior_set_must_resume(dev, dev->power.set_active); ++ } + + Complete: + complete_all(&dev->power.completion); +diff --git a/include/linux/pm.h b/include/linux/pm.h +index 97b0e23363c82..a478737115cd9 100644 +--- a/include/linux/pm.h ++++ b/include/linux/pm.h +@@ -683,6 +683,7 @@ struct dev_pm_info { + bool no_pm_callbacks:1; /* Owned by the PM core */ + bool async_in_progress:1; /* Owned by the PM core */ + bool must_resume:1; /* Owned by the PM core */ ++ bool set_active:1; /* Owned by the PM core */ + bool may_skip_resume:1; /* Set by subsystems */ + #else + bool should_wakeup:1; +-- +2.39.5 + diff --git a/queue-6.12/powerpc-book3s64-hugetlb-fix-disabling-hugetlb-when-.patch b/queue-6.12/powerpc-book3s64-hugetlb-fix-disabling-hugetlb-when-.patch new file mode 100644 index 0000000000..762de7b885 --- /dev/null +++ b/queue-6.12/powerpc-book3s64-hugetlb-fix-disabling-hugetlb-when-.patch @@ -0,0 +1,55 @@ +From 8fa0eb046c88519ace67d0d5555b749b4f309ba4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Dec 2024 13:16:40 +0530 +Subject: powerpc/book3s64/hugetlb: Fix disabling hugetlb when fadump is active + +From: Sourabh Jain + +[ Upstream commit d629d7a8efc33d05d62f4805c0ffb44727e3d99f ] + +Commit 8597538712eb ("powerpc/fadump: Do not use hugepages when fadump +is active") disabled hugetlb support when fadump is active by returning +early from hugetlbpage_init():arch/powerpc/mm/hugetlbpage.c and not +populating hpage_shift/HPAGE_SHIFT. + +Later, commit 2354ad252b66 ("powerpc/mm: Update default hugetlb size +early") moved the allocation of hpage_shift/HPAGE_SHIFT to early boot, +which inadvertently re-enabled hugetlb support when fadump is active. + +Fix this by implementing hugepages_supported() on powerpc. This ensures +that disabling hugetlb for the fadump kernel is independent of +hpage_shift/HPAGE_SHIFT. + +Fixes: 2354ad252b66 ("powerpc/mm: Update default hugetlb size early") +Reviewed-by: Ritesh Harjani (IBM) +Signed-off-by: Sourabh Jain +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/20241217074640.1064510-1-sourabhjain@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/hugetlb.h | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/arch/powerpc/include/asm/hugetlb.h b/arch/powerpc/include/asm/hugetlb.h +index 18a3028ac3b6d..dad2e7980f245 100644 +--- a/arch/powerpc/include/asm/hugetlb.h ++++ b/arch/powerpc/include/asm/hugetlb.h +@@ -15,6 +15,15 @@ + + extern bool hugetlb_disabled; + ++static inline bool hugepages_supported(void) ++{ ++ if (hugetlb_disabled) ++ return false; ++ ++ return HPAGE_SHIFT != 0; ++} ++#define hugepages_supported hugepages_supported ++ + void __init hugetlbpage_init_defaultsize(void); + + int slice_is_hugepage_only_range(struct mm_struct *mm, unsigned long addr, +-- +2.39.5 + diff --git a/queue-6.12/powerpc-pseries-iommu-iommu-incorrectly-marks-mmio-r.patch b/queue-6.12/powerpc-pseries-iommu-iommu-incorrectly-marks-mmio-r.patch new file mode 100644 index 0000000000..9a6266b64f --- /dev/null +++ b/queue-6.12/powerpc-pseries-iommu-iommu-incorrectly-marks-mmio-r.patch @@ -0,0 +1,125 @@ +From 00a3f2987e898610d849009e98c22aecaae4dfe9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 15:00:39 -0600 +Subject: powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW + +From: Gaurav Batra + +[ Upstream commit 8f70caad82e9c088ed93b4fea48d941ab6441886 ] + +Power Hypervisor can possibily allocate MMIO window intersecting with +Dynamic DMA Window (DDW) range, which is over 32-bit addressing. + +These MMIO pages needs to be marked as reserved so that IOMMU doesn't map +DMA buffers in this range. + +The current code is not marking these pages correctly which is resulting +in LPAR to OOPS while booting. The stack is at below + +BUG: Unable to handle kernel data access on read at 0xc00800005cd40000 +Faulting instruction address: 0xc00000000005cdac +Oops: Kernel access of bad area, sig: 11 [#1] +LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries +Modules linked in: af_packet rfkill ibmveth(X) lpfc(+) nvmet_fc nvmet nvme_keyring crct10dif_vpmsum nvme_fc nvme_fabrics nvme_core be2net(+) nvme_auth rtc_generic nfsd auth_rpcgss nfs_acl lockd grace sunrpc fuse configfs ip_tables x_tables xfs libcrc32c dm_service_time ibmvfc(X) scsi_transport_fc vmx_crypto gf128mul crc32c_vpmsum dm_mirror dm_region_hash dm_log dm_multipath dm_mod sd_mod scsi_dh_emc scsi_dh_rdac scsi_dh_alua t10_pi crc64_rocksoft_generic crc64_rocksoft sg crc64 scsi_mod +Supported: Yes, External +CPU: 8 PID: 241 Comm: kworker/8:1 Kdump: loaded Not tainted 6.4.0-150600.23.14-default #1 SLE15-SP6 b44ee71c81261b9e4bab5e0cde1f2ed891d5359b +Hardware name: IBM,9080-M9S POWER9 (raw) 0x4e2103 0xf000005 of:IBM,FW950.B0 (VH950_149) hv:phyp pSeries +Workqueue: events work_for_cpu_fn +NIP: c00000000005cdac LR: c00000000005e830 CTR: 0000000000000000 +REGS: c00001400c9ff770 TRAP: 0300 Not tainted (6.4.0-150600.23.14-default) +MSR: 800000000280b033 CR: 24228448 XER: 00000001 +CFAR: c00000000005cdd4 DAR: c00800005cd40000 DSISR: 40000000 IRQMASK: 0 +GPR00: c00000000005e830 c00001400c9ffa10 c000000001987d00 c00001400c4fe800 +GPR04: 0000080000000000 0000000000000001 0000000004000000 0000000000800000 +GPR08: 0000000004000000 0000000000000001 c00800005cd40000 ffffffffffffffff +GPR12: 0000000084228882 c00000000a4c4f00 0000000000000010 0000080000000000 +GPR16: c00001400c4fe800 0000000004000000 0800000000000000 c00000006088b800 +GPR20: c00001401a7be980 c00001400eff3800 c000000002a2da68 000000000000002b +GPR24: c0000000026793a8 c000000002679368 000000000000002a c0000000026793c8 +GPR28: 000008007effffff 0000080000000000 0000000000800000 c00001400c4fe800 +NIP [c00000000005cdac] iommu_table_reserve_pages+0xac/0x100 +LR [c00000000005e830] iommu_init_table+0x80/0x1e0 +Call Trace: +[c00001400c9ffa10] [c00000000005e810] iommu_init_table+0x60/0x1e0 (unreliable) +[c00001400c9ffa90] [c00000000010356c] iommu_bypass_supported_pSeriesLP+0x9cc/0xe40 +[c00001400c9ffc30] [c00000000005c300] dma_iommu_dma_supported+0xf0/0x230 +[c00001400c9ffcb0] [c00000000024b0c4] dma_supported+0x44/0x90 +[c00001400c9ffcd0] [c00000000024b14c] dma_set_mask+0x3c/0x80 +[c00001400c9ffd00] [c0080000555b715c] be_probe+0xc4/0xb90 [be2net] +[c00001400c9ffdc0] [c000000000986f3c] local_pci_probe+0x6c/0x110 +[c00001400c9ffe40] [c000000000188f28] work_for_cpu_fn+0x38/0x60 +[c00001400c9ffe70] [c00000000018e454] process_one_work+0x314/0x620 +[c00001400c9fff10] [c00000000018f280] worker_thread+0x2b0/0x620 +[c00001400c9fff90] [c00000000019bb18] kthread+0x148/0x150 +[c00001400c9fffe0] [c00000000000ded8] start_kernel_thread+0x14/0x18 + +There are 2 issues in the code + +1. The index is "int" while the address is "unsigned long". This results in + negative value when setting the bitmap. + +2. The DMA offset is page shifted but the MMIO range is used as-is (64-bit + address). MMIO address needs to be page shifted as well. + +Fixes: 3c33066a2190 ("powerpc/kernel/iommu: Add new iommu_table_in_use() helper") + +Signed-off-by: Gaurav Batra +Reviewed-by: Nilay Shroff +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/20241206210039.93172-1-gbatra@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/iommu.c | 2 +- + arch/powerpc/platforms/pseries/iommu.c | 9 ++++++--- + 2 files changed, 7 insertions(+), 4 deletions(-) + +diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c +index 76381e14e800c..0ebae6e4c19dd 100644 +--- a/arch/powerpc/kernel/iommu.c ++++ b/arch/powerpc/kernel/iommu.c +@@ -687,7 +687,7 @@ void iommu_table_clear(struct iommu_table *tbl) + void iommu_table_reserve_pages(struct iommu_table *tbl, + unsigned long res_start, unsigned long res_end) + { +- int i; ++ unsigned long i; + + WARN_ON_ONCE(res_end < res_start); + /* +diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c +index 534cd159e9ab4..29f1a0cc59cd5 100644 +--- a/arch/powerpc/platforms/pseries/iommu.c ++++ b/arch/powerpc/platforms/pseries/iommu.c +@@ -1650,7 +1650,8 @@ static bool enable_ddw(struct pci_dev *dev, struct device_node *pdn) + iommu_table_setparms_common(newtbl, pci->phb->bus->number, create.liobn, + dynamic_addr, dynamic_len, page_shift, NULL, + &iommu_table_lpar_multi_ops); +- iommu_init_table(newtbl, pci->phb->node, start, end); ++ iommu_init_table(newtbl, pci->phb->node, ++ start >> page_shift, end >> page_shift); + + pci->table_group->tables[default_win_removed ? 0 : 1] = newtbl; + +@@ -2065,7 +2066,9 @@ static long spapr_tce_create_table(struct iommu_table_group *table_group, int nu + offset, 1UL << window_shift, + IOMMU_PAGE_SHIFT_4K, NULL, + &iommu_table_lpar_multi_ops); +- iommu_init_table(tbl, pci->phb->node, start, end); ++ iommu_init_table(tbl, pci->phb->node, ++ start >> IOMMU_PAGE_SHIFT_4K, ++ end >> IOMMU_PAGE_SHIFT_4K); + + table_group->tables[0] = tbl; + +@@ -2136,7 +2139,7 @@ static long spapr_tce_create_table(struct iommu_table_group *table_group, int nu + /* New table for using DDW instead of the default DMA window */ + iommu_table_setparms_common(tbl, pci->phb->bus->number, create.liobn, win_addr, + 1UL << len, page_shift, NULL, &iommu_table_lpar_multi_ops); +- iommu_init_table(tbl, pci->phb->node, start, end); ++ iommu_init_table(tbl, pci->phb->node, start >> page_shift, end >> page_shift); + + pci->table_group->tables[num] = tbl; + set_iommu_table_base(&pdev->dev, tbl); +-- +2.39.5 + diff --git a/queue-6.12/printk-defer-legacy-printing-when-holding-printk_cpu.patch b/queue-6.12/printk-defer-legacy-printing-when-holding-printk_cpu.patch new file mode 100644 index 0000000000..489145a5ad --- /dev/null +++ b/queue-6.12/printk-defer-legacy-printing-when-holding-printk_cpu.patch @@ -0,0 +1,88 @@ +From a5ba1301f49e51058910567a26f2c8d42d372092 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Dec 2024 12:23:46 +0106 +Subject: printk: Defer legacy printing when holding printk_cpu_sync + +From: John Ogness + +[ Upstream commit 0161e2d6950fe66cf6ac1c10d945bae971f33667 ] + +The documentation of printk_cpu_sync_get() clearly states +that the owner must never perform any activities where it waits +for a CPU. For legacy printing there can be spinning on the +console_lock and on the port lock. Therefore legacy printing +must be deferred when holding the printk_cpu_sync. + +Note that in the case of emergency states, atomic consoles +are not prevented from printing when printk is deferred. This +is appropriate because they do not spin-wait indefinitely for +other CPUs. + +Reported-by: Rik van Riel +Closes: https://lore.kernel.org/r/20240715232052.73eb7fb1@imladris.surriel.com +Signed-off-by: John Ogness +Fixes: 55d6af1d6688 ("lib/nmi_backtrace: explicitly serialize banner and regs") +Reviewed-by: Petr Mladek +Link: https://lore.kernel.org/r/20241209111746.192559-3-john.ogness@linutronix.de +Signed-off-by: Petr Mladek +Signed-off-by: Sasha Levin +--- + kernel/printk/internal.h | 6 ++++++ + kernel/printk/printk.c | 5 +++++ + kernel/printk/printk_safe.c | 7 ++++++- + 3 files changed, 17 insertions(+), 1 deletion(-) + +diff --git a/kernel/printk/internal.h b/kernel/printk/internal.h +index 3fcb48502adbd..5eef70000b439 100644 +--- a/kernel/printk/internal.h ++++ b/kernel/printk/internal.h +@@ -335,3 +335,9 @@ bool printk_get_next_message(struct printk_message *pmsg, u64 seq, + void console_prepend_dropped(struct printk_message *pmsg, unsigned long dropped); + void console_prepend_replay(struct printk_message *pmsg); + #endif ++ ++#ifdef CONFIG_SMP ++bool is_printk_cpu_sync_owner(void); ++#else ++static inline bool is_printk_cpu_sync_owner(void) { return false; } ++#endif +diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c +index beb808f4c367b..7530df62ff7cb 100644 +--- a/kernel/printk/printk.c ++++ b/kernel/printk/printk.c +@@ -4892,6 +4892,11 @@ void console_try_replay_all(void) + static atomic_t printk_cpu_sync_owner = ATOMIC_INIT(-1); + static atomic_t printk_cpu_sync_nested = ATOMIC_INIT(0); + ++bool is_printk_cpu_sync_owner(void) ++{ ++ return (atomic_read(&printk_cpu_sync_owner) == raw_smp_processor_id()); ++} ++ + /** + * __printk_cpu_sync_wait() - Busy wait until the printk cpu-reentrant + * spinning lock is not owned by any CPU. +diff --git a/kernel/printk/printk_safe.c b/kernel/printk/printk_safe.c +index 2b35a9d3919d8..e6198da7c7354 100644 +--- a/kernel/printk/printk_safe.c ++++ b/kernel/printk/printk_safe.c +@@ -43,10 +43,15 @@ bool is_printk_legacy_deferred(void) + /* + * The per-CPU variable @printk_context can be read safely in any + * context. CPU migration is always disabled when set. ++ * ++ * A context holding the printk_cpu_sync must not spin waiting for ++ * another CPU. For legacy printing, it could be the console_lock ++ * or the port lock. + */ + return (force_legacy_kthread() || + this_cpu_read(printk_context) || +- in_nmi()); ++ in_nmi() || ++ is_printk_cpu_sync_owner()); + } + + asmlinkage int vprintk(const char *fmt, va_list args) +-- +2.39.5 + diff --git a/queue-6.12/ps3disk-do-not-use-dev-bounce_size-before-it-is-set.patch b/queue-6.12/ps3disk-do-not-use-dev-bounce_size-before-it-is-set.patch new file mode 100644 index 0000000000..50039320f9 --- /dev/null +++ b/queue-6.12/ps3disk-do-not-use-dev-bounce_size-before-it-is-set.patch @@ -0,0 +1,43 @@ +From 80ad3f3a1a505f0429a391b85fb22dd5aeb366eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jan 2025 09:51:25 +0100 +Subject: ps3disk: Do not use dev->bounce_size before it is set + +From: Geert Uytterhoeven + +[ Upstream commit c2398e6d5f16e15598d3a37e17107fea477e3f91 ] + +dev->bounce_size is only initialized after it is used to set the queue +limits. Fix this by using BOUNCE_SIZE instead. + +Fixes: a7f18b74dbe17162 ("ps3disk: pass queue_limits to blk_mq_alloc_disk") +Reported-by: Philipp Hortmann +Closes: https://lore.kernel.org/39256db9-3d73-4e86-a49b-300dfd670212@gmail.com +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/06988f959ea6885b8bd7fb3b9059dd54bc6bbad7.1735894216.git.geert+renesas@glider.be +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/ps3disk.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/block/ps3disk.c b/drivers/block/ps3disk.c +index ff45ed7664695..226ffc743238e 100644 +--- a/drivers/block/ps3disk.c ++++ b/drivers/block/ps3disk.c +@@ -384,9 +384,9 @@ static int ps3disk_probe(struct ps3_system_bus_device *_dev) + unsigned int devidx; + struct queue_limits lim = { + .logical_block_size = dev->blk_size, +- .max_hw_sectors = dev->bounce_size >> 9, ++ .max_hw_sectors = BOUNCE_SIZE >> 9, + .max_segments = -1, +- .max_segment_size = dev->bounce_size, ++ .max_segment_size = BOUNCE_SIZE, + .dma_alignment = dev->blk_size - 1, + .features = BLK_FEAT_WRITE_CACHE | + BLK_FEAT_ROTATIONAL, +-- +2.39.5 + diff --git a/queue-6.12/psi-fix-race-when-task-wakes-up-before-psi_sched_swi.patch b/queue-6.12/psi-fix-race-when-task-wakes-up-before-psi_sched_swi.patch new file mode 100644 index 0000000000..b368696b15 --- /dev/null +++ b/queue-6.12/psi-fix-race-when-task-wakes-up-before-psi_sched_swi.patch @@ -0,0 +1,107 @@ +From 4cff6c07ae2da9c9c14d4e8b314efab0b993a292 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Dec 2024 06:19:41 +0000 +Subject: psi: Fix race when task wakes up before psi_sched_switch() adjusts + flags + +From: Chengming Zhou + +[ Upstream commit 7d9da040575b343085287686fa902a5b2d43c7ca ] + +When running hackbench in a cgroup with bandwidth throttling enabled, +following PSI splat was observed: + + psi: inconsistent task state! task=1831:hackbench cpu=8 psi_flags=14 clear=0 set=4 + +When investigating the series of events leading up to the splat, +following sequence was observed: + + [008] d..2.: sched_switch: ... ==> next_comm=hackbench next_pid=1831 next_prio=120 + ... + [008] dN.2.: dequeue_entity(task delayed): task=hackbench pid=1831 cfs_rq->throttled=0 + [008] dN.2.: pick_task_fair: check_cfs_rq_runtime() throttled cfs_rq on CPU8 + # CPU8 goes into newidle balance and releases the rq lock + ... + # CPU15 on same LLC Domain is trying to wakeup hackbench(pid=1831) + [015] d..4.: psi_flags_change: psi: task state: task=1831:hackbench cpu=8 psi_flags=14 clear=0 set=4 final=14 # Splat (cfs_rq->throttled=1) + [015] d..4.: sched_wakeup: comm=hackbench pid=1831 prio=120 target_cpu=008 # Task has woken on a throttled hierarchy + [008] d..2.: sched_switch: prev_comm=hackbench prev_pid=1831 prev_prio=120 prev_state=S ==> ... + +psi_dequeue() relies on psi_sched_switch() to set the correct PSI flags +for the blocked entity, however, with the introduction of DELAY_DEQUEUE, +the block task can wakeup when newidle balance drops the runqueue lock +during __schedule(). + +If a task wakes before psi_sched_switch() adjusts the PSI flags, skip +any modifications in psi_enqueue() which would still see the flags of a +running task and not a blocked one. Instead, rely on psi_sched_switch() +to do the right thing. + +Since the status returned by try_to_block_task() may no longer be true +by the time schedule reaches psi_sched_switch(), check if the task is +blocked or not using a combination of task_on_rq_queued() and +p->se.sched_delayed checks. + +[ prateek: Commit message, testing, early bailout in psi_enqueue() ] + +Fixes: 152e11f6df29 ("sched/fair: Implement delayed dequeue") # 1a6151017ee5 +Signed-off-by: Chengming Zhou +Signed-off-by: K Prateek Nayak +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Chengming Zhou +Link: https://lore.kernel.org/r/20241227061941.2315-1-kprateek.nayak@amd.com +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 6 +++--- + kernel/sched/stats.h | 4 ++++ + 2 files changed, 7 insertions(+), 3 deletions(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index c1d2d46feec50..aba41c69f09c4 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -6593,7 +6593,6 @@ static void __sched notrace __schedule(int sched_mode) + * as a preemption by schedule_debug() and RCU. + */ + bool preempt = sched_mode > SM_NONE; +- bool block = false; + unsigned long *switch_count; + unsigned long prev_state; + struct rq_flags rf; +@@ -6654,7 +6653,7 @@ static void __sched notrace __schedule(int sched_mode) + goto picked; + } + } else if (!preempt && prev_state) { +- block = try_to_block_task(rq, prev, prev_state); ++ try_to_block_task(rq, prev, prev_state); + switch_count = &prev->nvcsw; + } + +@@ -6699,7 +6698,8 @@ static void __sched notrace __schedule(int sched_mode) + + migrate_disable_switch(rq, prev); + psi_account_irqtime(rq, prev, next); +- psi_sched_switch(prev, next, block); ++ psi_sched_switch(prev, next, !task_on_rq_queued(prev) || ++ prev->se.sched_delayed); + + trace_sched_switch(preempt, prev, next, prev_state); + +diff --git a/kernel/sched/stats.h b/kernel/sched/stats.h +index 8ee0add5a48a8..6ade91bce63ee 100644 +--- a/kernel/sched/stats.h ++++ b/kernel/sched/stats.h +@@ -138,6 +138,10 @@ static inline void psi_enqueue(struct task_struct *p, int flags) + if (flags & ENQUEUE_RESTORE) + return; + ++ /* psi_sched_switch() will handle the flags */ ++ if (task_on_cpu(task_rq(p), p)) ++ return; ++ + if (p->se.sched_delayed) { + /* CPU migration of "sleeping" task */ + SCHED_WARN_ON(!(flags & ENQUEUE_MIGRATED)); +-- +2.39.5 + diff --git a/queue-6.12/pstore-blk-trivial-typo-fixes.patch b/queue-6.12/pstore-blk-trivial-typo-fixes.patch new file mode 100644 index 0000000000..60cd070bb9 --- /dev/null +++ b/queue-6.12/pstore-blk-trivial-typo-fixes.patch @@ -0,0 +1,46 @@ +From c62943d9fb186bd5c06ead199ed382c1f6f94275 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jan 2025 13:19:21 +0200 +Subject: pstore/blk: trivial typo fixes + +From: Eugen Hristev + +[ Upstream commit 542243af7182efaeaf6d0f4643f7de437541a9af ] + +Fix trivial typos in comments. + +Fixes: 2a03ddbde1e1 ("pstore/blk: Move verify_size() macro out of function") +Fixes: 17639f67c1d6 ("pstore/blk: Introduce backend for block devices") +Signed-off-by: Eugen Hristev +Link: https://lore.kernel.org/r/20250101111921.850406-1-eugen.hristev@linaro.org +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + fs/pstore/blk.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/pstore/blk.c b/fs/pstore/blk.c +index 65b2473e22ff9..fa6b8cb788a1f 100644 +--- a/fs/pstore/blk.c ++++ b/fs/pstore/blk.c +@@ -89,7 +89,7 @@ static struct pstore_device_info *pstore_device_info; + _##name_ = check_size(name, alignsize); \ + else \ + _##name_ = 0; \ +- /* Synchronize module parameters with resuls. */ \ ++ /* Synchronize module parameters with results. */ \ + name = _##name_ / 1024; \ + dev->zone.name = _##name_; \ + } +@@ -121,7 +121,7 @@ static int __register_pstore_device(struct pstore_device_info *dev) + if (pstore_device_info) + return -EBUSY; + +- /* zero means not limit on which backends to attempt to store. */ ++ /* zero means no limit on which backends attempt to store. */ + if (!dev->flags) + dev->flags = UINT_MAX; + +-- +2.39.5 + diff --git a/queue-6.12/ptp-properly-handle-compat-ioctls.patch b/queue-6.12/ptp-properly-handle-compat-ioctls.patch new file mode 100644 index 0000000000..fae795378b --- /dev/null +++ b/queue-6.12/ptp-properly-handle-compat-ioctls.patch @@ -0,0 +1,56 @@ +From 52bd16d660ee7804928a60572fe84609c29c7d4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Jan 2025 10:28:38 +0100 +Subject: ptp: Properly handle compat ioctls +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 19ae40f572a9ce1ade9954990af709a03fd37010 ] + +Pointer arguments passed to ioctls need to pass through compat_ptr() to +work correctly on s390; as explained in Documentation/driver-api/ioctl.rst. +Detect compat mode at runtime and call compat_ptr() for those commands +which do take pointer arguments. + +Suggested-by: Arnd Bergmann +Link: https://lore.kernel.org/lkml/1ba5d3a4-7931-455b-a3ce-85a968a7cb10@app.fastmail.com/ +Fixes: d94ba80ebbea ("ptp: Added a brand new class driver for ptp clocks.") +Signed-off-by: Thomas Weißschuh +Reviewed-by: Cyrill Gorcunov +Reviewed-by: Arnd Bergmann +Acked-by: Richard Cochran +Link: https://patch.msgid.link/20250125-posix-clock-compat_ioctl-v2-1-11c865c500eb@weissschuh.net +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/ptp/ptp_chardev.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c +index ea96a14d72d14..bf6468c56419c 100644 +--- a/drivers/ptp/ptp_chardev.c ++++ b/drivers/ptp/ptp_chardev.c +@@ -4,6 +4,7 @@ + * + * Copyright (C) 2010 OMICRON electronics GmbH + */ ++#include + #include + #include + #include +@@ -176,6 +177,9 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd, + struct timespec64 ts; + int enable, err = 0; + ++ if (in_compat_syscall() && cmd != PTP_ENABLE_PPS && cmd != PTP_ENABLE_PPS2) ++ arg = (unsigned long)compat_ptr(arg); ++ + tsevq = pccontext->private_clkdata; + + switch (cmd) { +-- +2.39.5 + diff --git a/queue-6.12/ptr_ring-do-not-block-hard-interrupts-in-ptr_ring_re.patch b/queue-6.12/ptr_ring-do-not-block-hard-interrupts-in-ptr_ring_re.patch new file mode 100644 index 0000000000..cfcd95cc0f --- /dev/null +++ b/queue-6.12/ptr_ring-do-not-block-hard-interrupts-in-ptr_ring_re.patch @@ -0,0 +1,212 @@ +From f569595802fab72689396ebc432832f416e2094b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Dec 2024 13:51:21 +0000 +Subject: ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() + +From: Eric Dumazet + +[ Upstream commit a126061c80d5efb4baef4bcf346094139cd81df6 ] + +Jakub added a lockdep_assert_no_hardirq() check in __page_pool_put_page() +to increase test coverage. + +syzbot found a splat caused by hard irq blocking in +ptr_ring_resize_multiple() [1] + +As current users of ptr_ring_resize_multiple() do not require +hard irqs being masked, replace it to only block BH. + +Rename helpers to better reflect they are safe against BH only. + +- ptr_ring_resize_multiple() to ptr_ring_resize_multiple_bh() +- skb_array_resize_multiple() to skb_array_resize_multiple_bh() + +[1] + +WARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 __page_pool_put_page net/core/page_pool.c:709 [inline] +WARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780 +Modules linked in: +CPU: 1 UID: 0 PID: 9150 Comm: syz.1.1052 Not tainted 6.11.0-rc3-syzkaller-00202-gf8669d7b5f5d #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 +RIP: 0010:__page_pool_put_page net/core/page_pool.c:709 [inline] +RIP: 0010:page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780 +Code: 74 0e e8 7c aa fb f7 eb 43 e8 75 aa fb f7 eb 3c 65 8b 1d 38 a8 6a 76 31 ff 89 de e8 a3 ae fb f7 85 db 74 0b e8 5a aa fb f7 90 <0f> 0b 90 eb 1d 65 8b 1d 15 a8 6a 76 31 ff 89 de e8 84 ae fb f7 85 +RSP: 0018:ffffc9000bda6b58 EFLAGS: 00010083 +RAX: ffffffff8997e523 RBX: 0000000000000000 RCX: 0000000000040000 +RDX: ffffc9000fbd0000 RSI: 0000000000001842 RDI: 0000000000001843 +RBP: 0000000000000000 R08: ffffffff8997df2c R09: 1ffffd40003a000d +R10: dffffc0000000000 R11: fffff940003a000e R12: ffffea0001d00040 +R13: ffff88802e8a4000 R14: dffffc0000000000 R15: 00000000ffffffff +FS: 00007fb7aaf716c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007fa15a0d4b72 CR3: 00000000561b0000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + tun_ptr_free drivers/net/tun.c:617 [inline] + __ptr_ring_swap_queue include/linux/ptr_ring.h:571 [inline] + ptr_ring_resize_multiple_noprof include/linux/ptr_ring.h:643 [inline] + tun_queue_resize drivers/net/tun.c:3694 [inline] + tun_device_event+0xaaf/0x1080 drivers/net/tun.c:3714 + notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93 + call_netdevice_notifiers_extack net/core/dev.c:2032 [inline] + call_netdevice_notifiers net/core/dev.c:2046 [inline] + dev_change_tx_queue_len+0x158/0x2a0 net/core/dev.c:9024 + do_setlink+0xff6/0x41f0 net/core/rtnetlink.c:2923 + rtnl_setlink+0x40d/0x5a0 net/core/rtnetlink.c:3201 + rtnetlink_rcv_msg+0x73f/0xcf0 net/core/rtnetlink.c:6647 + netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550 + +Fixes: ff4e538c8c3e ("page_pool: add a lockdep check for recycling in hardirq") +Reported-by: syzbot+f56a5c5eac2b28439810@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/671e10df.050a0220.2b8c0f.01cf.GAE@google.com/T/ +Signed-off-by: Eric Dumazet +Acked-by: Michael S. Tsirkin +Acked-by: Jason Wang +Link: https://patch.msgid.link/20241217135121.326370-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/tap.c | 6 +++--- + drivers/net/tun.c | 6 +++--- + include/linux/ptr_ring.h | 21 ++++++++++----------- + include/linux/skb_array.h | 17 +++++++++-------- + net/sched/sch_generic.c | 4 ++-- + 5 files changed, 27 insertions(+), 27 deletions(-) + +diff --git a/drivers/net/tap.c b/drivers/net/tap.c +index 5aa41d5f7765a..5ca6ecf0ce5fb 100644 +--- a/drivers/net/tap.c ++++ b/drivers/net/tap.c +@@ -1329,9 +1329,9 @@ int tap_queue_resize(struct tap_dev *tap) + list_for_each_entry(q, &tap->queue_list, next) + rings[i++] = &q->ring; + +- ret = ptr_ring_resize_multiple(rings, n, +- dev->tx_queue_len, GFP_KERNEL, +- __skb_array_destroy_skb); ++ ret = ptr_ring_resize_multiple_bh(rings, n, ++ dev->tx_queue_len, GFP_KERNEL, ++ __skb_array_destroy_skb); + + kfree(rings); + return ret; +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index 03fe9e3ee7af1..6fc60950100c7 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -3697,9 +3697,9 @@ static int tun_queue_resize(struct tun_struct *tun) + list_for_each_entry(tfile, &tun->disabled, next) + rings[i++] = &tfile->tx_ring; + +- ret = ptr_ring_resize_multiple(rings, n, +- dev->tx_queue_len, GFP_KERNEL, +- tun_ptr_free); ++ ret = ptr_ring_resize_multiple_bh(rings, n, ++ dev->tx_queue_len, GFP_KERNEL, ++ tun_ptr_free); + + kfree(rings); + return ret; +diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h +index fd037c127bb07..551329220e4f3 100644 +--- a/include/linux/ptr_ring.h ++++ b/include/linux/ptr_ring.h +@@ -615,15 +615,14 @@ static inline int ptr_ring_resize_noprof(struct ptr_ring *r, int size, gfp_t gfp + /* + * Note: producer lock is nested within consumer lock, so if you + * resize you must make sure all uses nest correctly. +- * In particular if you consume ring in interrupt or BH context, you must +- * disable interrupts/BH when doing so. ++ * In particular if you consume ring in BH context, you must ++ * disable BH when doing so. + */ +-static inline int ptr_ring_resize_multiple_noprof(struct ptr_ring **rings, +- unsigned int nrings, +- int size, +- gfp_t gfp, void (*destroy)(void *)) ++static inline int ptr_ring_resize_multiple_bh_noprof(struct ptr_ring **rings, ++ unsigned int nrings, ++ int size, gfp_t gfp, ++ void (*destroy)(void *)) + { +- unsigned long flags; + void ***queues; + int i; + +@@ -638,12 +637,12 @@ static inline int ptr_ring_resize_multiple_noprof(struct ptr_ring **rings, + } + + for (i = 0; i < nrings; ++i) { +- spin_lock_irqsave(&(rings[i])->consumer_lock, flags); ++ spin_lock_bh(&(rings[i])->consumer_lock); + spin_lock(&(rings[i])->producer_lock); + queues[i] = __ptr_ring_swap_queue(rings[i], queues[i], + size, gfp, destroy); + spin_unlock(&(rings[i])->producer_lock); +- spin_unlock_irqrestore(&(rings[i])->consumer_lock, flags); ++ spin_unlock_bh(&(rings[i])->consumer_lock); + } + + for (i = 0; i < nrings; ++i) +@@ -662,8 +661,8 @@ static inline int ptr_ring_resize_multiple_noprof(struct ptr_ring **rings, + noqueues: + return -ENOMEM; + } +-#define ptr_ring_resize_multiple(...) \ +- alloc_hooks(ptr_ring_resize_multiple_noprof(__VA_ARGS__)) ++#define ptr_ring_resize_multiple_bh(...) \ ++ alloc_hooks(ptr_ring_resize_multiple_bh_noprof(__VA_ARGS__)) + + static inline void ptr_ring_cleanup(struct ptr_ring *r, void (*destroy)(void *)) + { +diff --git a/include/linux/skb_array.h b/include/linux/skb_array.h +index 926496c9cc9c3..bf178238a3083 100644 +--- a/include/linux/skb_array.h ++++ b/include/linux/skb_array.h +@@ -199,17 +199,18 @@ static inline int skb_array_resize(struct skb_array *a, int size, gfp_t gfp) + return ptr_ring_resize(&a->ring, size, gfp, __skb_array_destroy_skb); + } + +-static inline int skb_array_resize_multiple_noprof(struct skb_array **rings, +- int nrings, unsigned int size, +- gfp_t gfp) ++static inline int skb_array_resize_multiple_bh_noprof(struct skb_array **rings, ++ int nrings, ++ unsigned int size, ++ gfp_t gfp) + { + BUILD_BUG_ON(offsetof(struct skb_array, ring)); +- return ptr_ring_resize_multiple_noprof((struct ptr_ring **)rings, +- nrings, size, gfp, +- __skb_array_destroy_skb); ++ return ptr_ring_resize_multiple_bh_noprof((struct ptr_ring **)rings, ++ nrings, size, gfp, ++ __skb_array_destroy_skb); + } +-#define skb_array_resize_multiple(...) \ +- alloc_hooks(skb_array_resize_multiple_noprof(__VA_ARGS__)) ++#define skb_array_resize_multiple_bh(...) \ ++ alloc_hooks(skb_array_resize_multiple_bh_noprof(__VA_ARGS__)) + + static inline void skb_array_cleanup(struct skb_array *a) + { +diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c +index 38ec18f73de43..8874ae6680952 100644 +--- a/net/sched/sch_generic.c ++++ b/net/sched/sch_generic.c +@@ -911,8 +911,8 @@ static int pfifo_fast_change_tx_queue_len(struct Qdisc *sch, + bands[prio] = q; + } + +- return skb_array_resize_multiple(bands, PFIFO_FAST_BANDS, new_len, +- GFP_KERNEL); ++ return skb_array_resize_multiple_bh(bands, PFIFO_FAST_BANDS, new_len, ++ GFP_KERNEL); + } + + struct Qdisc_ops pfifo_fast_ops __read_mostly = { +-- +2.39.5 + diff --git a/queue-6.12/pwm-stm32-add-check-for-clk_enable.patch b/queue-6.12/pwm-stm32-add-check-for-clk_enable.patch new file mode 100644 index 0000000000..f147f4d468 --- /dev/null +++ b/queue-6.12/pwm-stm32-add-check-for-clk_enable.patch @@ -0,0 +1,46 @@ +From cd1fe5e665922f38c90a65aecc07d7839f610ef4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Dec 2024 17:47:52 -0500 +Subject: pwm: stm32: Add check for clk_enable() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mingwei Zheng + +[ Upstream commit e8c59791ebb60790c74b2c3ab520f04a8a57219a ] + +Add check for the return value of clk_enable() to catch the potential +error. + +Fixes: 19f1016ea960 ("pwm: stm32: Fix enable count for clk in .probe()") +Signed-off-by: Mingwei Zheng +Signed-off-by: Jiasheng Jiang +Link: https://lore.kernel.org/r/20241215224752.220318-1-zmw12306@gmail.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-stm32.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/pwm/pwm-stm32.c b/drivers/pwm/pwm-stm32.c +index eb24054f97297..4f231f8aae7d4 100644 +--- a/drivers/pwm/pwm-stm32.c ++++ b/drivers/pwm/pwm-stm32.c +@@ -688,8 +688,11 @@ static int stm32_pwm_probe(struct platform_device *pdev) + chip->ops = &stm32pwm_ops; + + /* Initialize clock refcount to number of enabled PWM channels. */ +- for (i = 0; i < num_enabled; i++) +- clk_enable(priv->clk); ++ for (i = 0; i < num_enabled; i++) { ++ ret = clk_enable(priv->clk); ++ if (ret) ++ return ret; ++ } + + ret = devm_pwmchip_add(dev, chip); + if (ret < 0) +-- +2.39.5 + diff --git a/queue-6.12/pwm-stm32-lp-add-check-for-clk_enable.patch b/queue-6.12/pwm-stm32-lp-add-check-for-clk_enable.patch new file mode 100644 index 0000000000..995892ade1 --- /dev/null +++ b/queue-6.12/pwm-stm32-lp-add-check-for-clk_enable.patch @@ -0,0 +1,48 @@ +From 359c51b7fb8bac1d6b7d53b1cdc45511b4a91924 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 16:53:18 -0500 +Subject: pwm: stm32-lp: Add check for clk_enable() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mingwei Zheng + +[ Upstream commit cce16e7f6216227964cda25f5f23634bce2c500f ] + +Add check for the return value of clk_enable() to catch the potential +error. +We used APP-Miner to find it. + +Fixes: e70a540b4e02 ("pwm: Add STM32 LPTimer PWM driver") +Signed-off-by: Mingwei Zheng +Signed-off-by: Jiasheng Jiang +Link: https://lore.kernel.org/r/20241206215318.3402860-1-zmw12306@gmail.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-stm32-lp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/pwm/pwm-stm32-lp.c b/drivers/pwm/pwm-stm32-lp.c +index 989731256f503..5832dce8ed9d5 100644 +--- a/drivers/pwm/pwm-stm32-lp.c ++++ b/drivers/pwm/pwm-stm32-lp.c +@@ -167,8 +167,12 @@ static int stm32_pwm_lp_get_state(struct pwm_chip *chip, + regmap_read(priv->regmap, STM32_LPTIM_CR, &val); + state->enabled = !!FIELD_GET(STM32_LPTIM_ENABLE, val); + /* Keep PWM counter clock refcount in sync with PWM initial state */ +- if (state->enabled) +- clk_enable(priv->clk); ++ if (state->enabled) { ++ int ret = clk_enable(priv->clk); ++ ++ if (ret) ++ return ret; ++ } + + regmap_read(priv->regmap, STM32_LPTIM_CFGR, &val); + presc = FIELD_GET(STM32_LPTIM_PRESC, val); +-- +2.39.5 + diff --git a/queue-6.12/rdma-bnxt_re-fix-to-drop-reference-to-the-mmap-entry.patch b/queue-6.12/rdma-bnxt_re-fix-to-drop-reference-to-the-mmap-entry.patch new file mode 100644 index 0000000000..0290c3c14b --- /dev/null +++ b/queue-6.12/rdma-bnxt_re-fix-to-drop-reference-to-the-mmap-entry.patch @@ -0,0 +1,47 @@ +From 33ad93a99c63210609179646a428519cec62e8e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Jan 2025 11:45:19 +0530 +Subject: RDMA/bnxt_re: Fix to drop reference to the mmap entry in case of + error + +From: Kalesh AP + +[ Upstream commit c84f0f4f49d81645f49c3269fdcc3b84ce61e795 ] + +In the error handling path of bnxt_re_mmap(), driver should invoke +rdma_user_mmap_entry_put() to free the reference of mmap entry in case +the error happens after rdma_user_mmap_entry_get was called. + +Fixes: ea2224857882 ("RDMA/bnxt_re: Update alloc_page uapi for pacing") +Reviewed-by: Saravanan Vajravel +Reviewed-by: Kashyap Desai +Signed-off-by: Kalesh AP +Signed-off-by: Selvin Xavier +Link: https://patch.msgid.link/20250104061519.2540178-1-kalesh-anakkur.purayil@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index 14e434ff51ede..a7067c3c06797 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -4395,9 +4395,10 @@ int bnxt_re_mmap(struct ib_ucontext *ib_uctx, struct vm_area_struct *vma) + case BNXT_RE_MMAP_TOGGLE_PAGE: + /* Driver doesn't expect write access for user space */ + if (vma->vm_flags & VM_WRITE) +- return -EFAULT; +- ret = vm_insert_page(vma, vma->vm_start, +- virt_to_page((void *)bnxt_entry->mem_offset)); ++ ret = -EFAULT; ++ else ++ ret = vm_insert_page(vma, vma->vm_start, ++ virt_to_page((void *)bnxt_entry->mem_offset)); + break; + default: + ret = -EINVAL; +-- +2.39.5 + diff --git a/queue-6.12/rdma-cxgb4-notify-rdma-stack-for-ib_event_qp_last_wq.patch b/queue-6.12/rdma-cxgb4-notify-rdma-stack-for-ib_event_qp_last_wq.patch new file mode 100644 index 0000000000..db115e54e1 --- /dev/null +++ b/queue-6.12/rdma-cxgb4-notify-rdma-stack-for-ib_event_qp_last_wq.patch @@ -0,0 +1,54 @@ +From 7587f2361839755243eb7f1e7bfce34f481c10a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jan 2025 15:20:53 +0530 +Subject: RDMA/cxgb4: Notify rdma stack for IB_EVENT_QP_LAST_WQE_REACHED event + +From: Anumula Murali Mohan Reddy + +[ Upstream commit 42e6ddda4c17fa0d5120e3723d522649f8fc62fa ] + +This patch sends IB_EVENT_QP_LAST_WQE_REACHED event on a QP that is in +error state and associated with an SRQ. This behaviour is incorporated +in flush_qp() which is called when QP transitions to error state. +Supports SRQ drain functionality added by commit 844bc12e6da3 ("IB/core: +add support for draining Shared receive queues") + +Fixes: 844bc12e6da3 ("IB/core: add support for draining Shared receive queues") +Signed-off-by: Anumula Murali Mohan Reddy +Signed-off-by: Potnuri Bharat Teja +Link: https://patch.msgid.link/20250107095053.81007-1-anumula@chelsio.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/cxgb4/qp.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c +index 7b5c4522b426a..955f061a55e9a 100644 +--- a/drivers/infiniband/hw/cxgb4/qp.c ++++ b/drivers/infiniband/hw/cxgb4/qp.c +@@ -1599,6 +1599,7 @@ static void __flush_qp(struct c4iw_qp *qhp, struct c4iw_cq *rchp, + int count; + int rq_flushed = 0, sq_flushed; + unsigned long flag; ++ struct ib_event ev; + + pr_debug("qhp %p rchp %p schp %p\n", qhp, rchp, schp); + +@@ -1607,6 +1608,13 @@ static void __flush_qp(struct c4iw_qp *qhp, struct c4iw_cq *rchp, + if (schp != rchp) + spin_lock(&schp->lock); + spin_lock(&qhp->lock); ++ if (qhp->srq && qhp->attr.state == C4IW_QP_STATE_ERROR && ++ qhp->ibqp.event_handler) { ++ ev.device = qhp->ibqp.device; ++ ev.element.qp = &qhp->ibqp; ++ ev.event = IB_EVENT_QP_LAST_WQE_REACHED; ++ qhp->ibqp.event_handler(&ev, qhp->ibqp.qp_context); ++ } + + if (qhp->wq.flushed) { + spin_unlock(&qhp->lock); +-- +2.39.5 + diff --git a/queue-6.12/rdma-cxgb4-prevent-potential-integer-overflow-on-32b.patch b/queue-6.12/rdma-cxgb4-prevent-potential-integer-overflow-on-32b.patch new file mode 100644 index 0000000000..6244160aaa --- /dev/null +++ b/queue-6.12/rdma-cxgb4-prevent-potential-integer-overflow-on-32b.patch @@ -0,0 +1,43 @@ +From 6e1957fe494ea06a719393bf29ba0f6f9fdec842 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Nov 2024 13:01:37 +0300 +Subject: rdma/cxgb4: Prevent potential integer overflow on 32bit + +From: Dan Carpenter + +[ Upstream commit bd96a3935e89486304461a21752f824fc25e0f0b ] + +The "gl->tot_len" variable is controlled by the user. It comes from +process_responses(). On 32bit systems, the "gl->tot_len + sizeof(struct +cpl_pass_accept_req) + sizeof(struct rss_header)" addition could have an +integer wrapping bug. Use size_add() to prevent this. + +Fixes: 1cab775c3e75 ("RDMA/cxgb4: Fix LE hash collision bug for passive open connection") +Link: https://patch.msgid.link/r/86b404e1-4a75-4a35-a34e-e3054fa554c7@stanley.mountain +Signed-off-by: Dan Carpenter +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/cxgb4/device.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c +index 80970a1738f8a..034b85c422555 100644 +--- a/drivers/infiniband/hw/cxgb4/device.c ++++ b/drivers/infiniband/hw/cxgb4/device.c +@@ -1114,8 +1114,10 @@ static inline struct sk_buff *copy_gl_to_skb_pkt(const struct pkt_gl *gl, + * The math here assumes sizeof cpl_pass_accept_req >= sizeof + * cpl_rx_pkt. + */ +- skb = alloc_skb(gl->tot_len + sizeof(struct cpl_pass_accept_req) + +- sizeof(struct rss_header) - pktshift, GFP_ATOMIC); ++ skb = alloc_skb(size_add(gl->tot_len, ++ sizeof(struct cpl_pass_accept_req) + ++ sizeof(struct rss_header)) - pktshift, ++ GFP_ATOMIC); + if (unlikely(!skb)) + return NULL; + +-- +2.39.5 + diff --git a/queue-6.12/rdma-hns-clean-up-the-legacy-config_infiniband_hns.patch b/queue-6.12/rdma-hns-clean-up-the-legacy-config_infiniband_hns.patch new file mode 100644 index 0000000000..0ad2300b54 --- /dev/null +++ b/queue-6.12/rdma-hns-clean-up-the-legacy-config_infiniband_hns.patch @@ -0,0 +1,96 @@ +From 2a47aec7bab21262bdb25a1af1033935631ab76e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jan 2025 19:12:11 +0800 +Subject: RDMA/hns: Clean up the legacy CONFIG_INFINIBAND_HNS + +From: Junxian Huang + +[ Upstream commit 8977b561216c7e693d61c6442657e33f134bfeb5 ] + +hns driver used to support hip06 and hip08 devices with +CONFIG_INFINIBAND_HNS_HIP06 and CONFIG_INFINIBAND_HNS_HIP08 +respectively, which both depended on CONFIG_INFINIBAND_HNS. + +But we no longer provide support for hip06 and only support +hip08 and higher since the commit in fixes line, so there is +no need to have CONFIG_INFINIBAND_HNS any more. Remove it and +only keep CONFIG_INFINIBAND_HNS_HIP08. + +Fixes: 38d220882426 ("RDMA/hns: Remove support for HIP06") +Signed-off-by: Junxian Huang +Link: https://patch.msgid.link/20250106111211.3945051-1-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/Makefile | 2 +- + drivers/infiniband/hw/hns/Kconfig | 20 +++++--------------- + drivers/infiniband/hw/hns/Makefile | 9 +++------ + 3 files changed, 9 insertions(+), 22 deletions(-) + +diff --git a/drivers/infiniband/hw/Makefile b/drivers/infiniband/hw/Makefile +index 1211f4317a9f4..aba96ca9bce5d 100644 +--- a/drivers/infiniband/hw/Makefile ++++ b/drivers/infiniband/hw/Makefile +@@ -11,7 +11,7 @@ obj-$(CONFIG_INFINIBAND_OCRDMA) += ocrdma/ + obj-$(CONFIG_INFINIBAND_VMWARE_PVRDMA) += vmw_pvrdma/ + obj-$(CONFIG_INFINIBAND_USNIC) += usnic/ + obj-$(CONFIG_INFINIBAND_HFI1) += hfi1/ +-obj-$(CONFIG_INFINIBAND_HNS) += hns/ ++obj-$(CONFIG_INFINIBAND_HNS_HIP08) += hns/ + obj-$(CONFIG_INFINIBAND_QEDR) += qedr/ + obj-$(CONFIG_INFINIBAND_BNXT_RE) += bnxt_re/ + obj-$(CONFIG_INFINIBAND_ERDMA) += erdma/ +diff --git a/drivers/infiniband/hw/hns/Kconfig b/drivers/infiniband/hw/hns/Kconfig +index ab3fbba70789c..44cdb706fe276 100644 +--- a/drivers/infiniband/hw/hns/Kconfig ++++ b/drivers/infiniband/hw/hns/Kconfig +@@ -1,21 +1,11 @@ + # SPDX-License-Identifier: GPL-2.0-only +-config INFINIBAND_HNS +- tristate "HNS RoCE Driver" +- depends on NET_VENDOR_HISILICON +- depends on ARM64 || (COMPILE_TEST && 64BIT) +- depends on (HNS_DSAF && HNS_ENET) || HNS3 +- help +- This is a RoCE/RDMA driver for the Hisilicon RoCE engine. +- +- To compile HIP08 driver as module, choose M here. +- + config INFINIBAND_HNS_HIP08 +- bool "Hisilicon Hip08 Family RoCE support" +- depends on INFINIBAND_HNS && PCI && HNS3 +- depends on INFINIBAND_HNS=m || HNS3=y ++ tristate "Hisilicon Hip08 Family RoCE support" ++ depends on ARM64 || (COMPILE_TEST && 64BIT) ++ depends on PCI && HNS3 + help + RoCE driver support for Hisilicon RoCE engine in Hisilicon Hip08 SoC. + The RoCE engine is a PCI device. + +- To compile this driver, choose Y here: if INFINIBAND_HNS is m, this +- module will be called hns-roce-hw-v2. ++ To compile this driver, choose M here. This module will be called ++ hns-roce-hw-v2. +diff --git a/drivers/infiniband/hw/hns/Makefile b/drivers/infiniband/hw/hns/Makefile +index be1e1cdbcfa8a..7917af8e6380e 100644 +--- a/drivers/infiniband/hw/hns/Makefile ++++ b/drivers/infiniband/hw/hns/Makefile +@@ -5,12 +5,9 @@ + + ccflags-y := -I $(srctree)/drivers/net/ethernet/hisilicon/hns3 + +-hns-roce-objs := hns_roce_main.o hns_roce_cmd.o hns_roce_pd.o \ ++hns-roce-hw-v2-objs := hns_roce_main.o hns_roce_cmd.o hns_roce_pd.o \ + hns_roce_ah.o hns_roce_hem.o hns_roce_mr.o hns_roce_qp.o \ + hns_roce_cq.o hns_roce_alloc.o hns_roce_db.o hns_roce_srq.o hns_roce_restrack.o \ +- hns_roce_debugfs.o ++ hns_roce_debugfs.o hns_roce_hw_v2.o + +-ifdef CONFIG_INFINIBAND_HNS_HIP08 +-hns-roce-hw-v2-objs := hns_roce_hw_v2.o $(hns-roce-objs) +-obj-$(CONFIG_INFINIBAND_HNS) += hns-roce-hw-v2.o +-endif ++obj-$(CONFIG_INFINIBAND_HNS_HIP08) += hns-roce-hw-v2.o +-- +2.39.5 + diff --git a/queue-6.12/rdma-mlx4-avoid-false-error-about-access-to-uninitia.patch b/queue-6.12/rdma-mlx4-avoid-false-error-about-access-to-uninitia.patch new file mode 100644 index 0000000000..252d7439d6 --- /dev/null +++ b/queue-6.12/rdma-mlx4-avoid-false-error-about-access-to-uninitia.patch @@ -0,0 +1,54 @@ +From e07e9d8de5b59ef812115d24156d6d7381cfc8d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Dec 2024 15:44:25 +0200 +Subject: RDMA/mlx4: Avoid false error about access to uninitialized gids array + +From: Leon Romanovsky + +[ Upstream commit 1f53d88cbb0dcc7df235bf6611ae632b254fccd8 ] + +Smatch generates the following false error report: +drivers/infiniband/hw/mlx4/main.c:393 mlx4_ib_del_gid() error: uninitialized symbol 'gids'. + +Traditionally, we are not changing kernel code and asking people to fix +the tools. However in this case, the fix can be done by simply rearranging +the code to be more clear. + +Fixes: e26be1bfef81 ("IB/mlx4: Implement ib_device callbacks") +Link: https://patch.msgid.link/6a3a1577463da16962463fcf62883a87506e9b62.1733233426.git.leonro@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx4/main.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c +index 529db874d67c6..b1bbdcff631d5 100644 +--- a/drivers/infiniband/hw/mlx4/main.c ++++ b/drivers/infiniband/hw/mlx4/main.c +@@ -351,7 +351,7 @@ static int mlx4_ib_del_gid(const struct ib_gid_attr *attr, void **context) + struct mlx4_port_gid_table *port_gid_table; + int ret = 0; + int hw_update = 0; +- struct gid_entry *gids; ++ struct gid_entry *gids = NULL; + + if (!rdma_cap_roce_gid_table(attr->device, attr->port_num)) + return -EINVAL; +@@ -389,10 +389,10 @@ static int mlx4_ib_del_gid(const struct ib_gid_attr *attr, void **context) + } + spin_unlock_bh(&iboe->lock); + +- if (!ret && hw_update) { ++ if (gids) + ret = mlx4_ib_update_gids(gids, ibdev, attr->port_num); +- kfree(gids); +- } ++ ++ kfree(gids); + return ret; + } + +-- +2.39.5 + diff --git a/queue-6.12/rdma-mlx5-fix-indirect-mkey-odp-page-count.patch b/queue-6.12/rdma-mlx5-fix-indirect-mkey-odp-page-count.patch new file mode 100644 index 0000000000..609f849aaa --- /dev/null +++ b/queue-6.12/rdma-mlx5-fix-indirect-mkey-odp-page-count.patch @@ -0,0 +1,148 @@ +From ff2879781bda1f092e2c9e4673738a52bc1f37e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jan 2025 20:27:10 +0200 +Subject: RDMA/mlx5: Fix indirect mkey ODP page count + +From: Michael Guralnik + +[ Upstream commit 235f238402194a78ac5fb882a46717eac817e5d1 ] + +Restrict the check for the number of pages handled during an ODP page +fault to direct mkeys. +Perform the check right after handling the page fault and don't +propagate the number of handled pages to callers. + +Indirect mkeys and their associated direct mkeys can have different +start addresses. As a result, the calculation of the number of pages to +handle for an indirect mkey may not match the actual page fault +handling done on the direct mkey. + +For example: +A 4K sized page fault on a KSM mkey that has a start address that is not +aligned to a page will result a calculation that assumes the number of +pages required to handle are 2. +While the underlying MTT might be aligned will require fetching only a +single page. +Thus, do the calculation and compare number of pages handled only per +direct mkey. + +Fixes: db570d7deafb ("IB/mlx5: Add ODP support to MW") +Signed-off-by: Michael Guralnik +Reviewed-by: Artemy Kovalyov +Link: https://patch.msgid.link/86c483d9e75ce8fe14e9ff85b62df72b779f8ab1.1736187990.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/odp.c | 32 +++++++++++++++----------------- + 1 file changed, 15 insertions(+), 17 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c +index 4b37446758fd4..69ca2de33a80e 100644 +--- a/drivers/infiniband/hw/mlx5/odp.c ++++ b/drivers/infiniband/hw/mlx5/odp.c +@@ -944,8 +944,7 @@ static struct mlx5_ib_mkey *find_odp_mkey(struct mlx5_ib_dev *dev, u32 key) + /* + * Handle a single data segment in a page-fault WQE or RDMA region. + * +- * Returns number of OS pages retrieved on success. The caller may continue to +- * the next data segment. ++ * Returns zero on success. The caller may continue to the next data segment. + * Can return the following error codes: + * -EAGAIN to designate a temporary error. The caller will abort handling the + * page fault and resolve it. +@@ -958,7 +957,7 @@ static int pagefault_single_data_segment(struct mlx5_ib_dev *dev, + u32 *bytes_committed, + u32 *bytes_mapped) + { +- int npages = 0, ret, i, outlen, cur_outlen = 0, depth = 0; ++ int ret, i, outlen, cur_outlen = 0, depth = 0, pages_in_range; + struct pf_frame *head = NULL, *frame; + struct mlx5_ib_mkey *mmkey; + struct mlx5_ib_mr *mr; +@@ -993,13 +992,20 @@ static int pagefault_single_data_segment(struct mlx5_ib_dev *dev, + case MLX5_MKEY_MR: + mr = container_of(mmkey, struct mlx5_ib_mr, mmkey); + ++ pages_in_range = (ALIGN(io_virt + bcnt, PAGE_SIZE) - ++ (io_virt & PAGE_MASK)) >> ++ PAGE_SHIFT; + ret = pagefault_mr(mr, io_virt, bcnt, bytes_mapped, 0, false); + if (ret < 0) + goto end; + + mlx5_update_odp_stats(mr, faults, ret); + +- npages += ret; ++ if (ret < pages_in_range) { ++ ret = -EFAULT; ++ goto end; ++ } ++ + ret = 0; + break; + +@@ -1090,7 +1096,7 @@ static int pagefault_single_data_segment(struct mlx5_ib_dev *dev, + kfree(out); + + *bytes_committed = 0; +- return ret ? ret : npages; ++ return ret; + } + + /* +@@ -1109,8 +1115,7 @@ static int pagefault_single_data_segment(struct mlx5_ib_dev *dev, + * the committed bytes). + * @receive_queue: receive WQE end of sg list + * +- * Returns the number of pages loaded if positive, zero for an empty WQE, or a +- * negative error code. ++ * Returns zero for success or a negative error code. + */ + static int pagefault_data_segments(struct mlx5_ib_dev *dev, + struct mlx5_pagefault *pfault, +@@ -1118,7 +1123,7 @@ static int pagefault_data_segments(struct mlx5_ib_dev *dev, + void *wqe_end, u32 *bytes_mapped, + u32 *total_wqe_bytes, bool receive_queue) + { +- int ret = 0, npages = 0; ++ int ret = 0; + u64 io_virt; + __be32 key; + u32 byte_count; +@@ -1175,10 +1180,9 @@ static int pagefault_data_segments(struct mlx5_ib_dev *dev, + bytes_mapped); + if (ret < 0) + break; +- npages += ret; + } + +- return ret < 0 ? ret : npages; ++ return ret; + } + + /* +@@ -1414,12 +1418,6 @@ static void mlx5_ib_mr_wqe_pfault_handler(struct mlx5_ib_dev *dev, + free_page((unsigned long)wqe_start); + } + +-static int pages_in_range(u64 address, u32 length) +-{ +- return (ALIGN(address + length, PAGE_SIZE) - +- (address & PAGE_MASK)) >> PAGE_SHIFT; +-} +- + static void mlx5_ib_mr_rdma_pfault_handler(struct mlx5_ib_dev *dev, + struct mlx5_pagefault *pfault) + { +@@ -1458,7 +1456,7 @@ static void mlx5_ib_mr_rdma_pfault_handler(struct mlx5_ib_dev *dev, + if (ret == -EAGAIN) { + /* We're racing with an invalidation, don't prefetch */ + prefetch_activated = 0; +- } else if (ret < 0 || pages_in_range(address, length) > ret) { ++ } else if (ret < 0) { + mlx5_ib_page_fault_resume(dev, pfault, 1); + if (ret != -ENOENT) + mlx5_ib_dbg(dev, "PAGE FAULT error %d. QP 0x%llx, type: 0x%x\n", +-- +2.39.5 + diff --git a/queue-6.12/rdma-rtrs-add-missing-deinit-call.patch b/queue-6.12/rdma-rtrs-add-missing-deinit-call.patch new file mode 100644 index 0000000000..2713e4cdfd --- /dev/null +++ b/queue-6.12/rdma-rtrs-add-missing-deinit-call.patch @@ -0,0 +1,66 @@ +From 36410cafa830eab761192a03471cccdce7271c9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jan 2025 08:45:16 +0800 +Subject: RDMA/rtrs: Add missing deinit() call + +From: Li Zhijian + +[ Upstream commit 81468c4058a62e84e475433b83b3edc613294f5e ] + +A warning is triggered when repeatedly connecting and disconnecting the +rnbd: + list_add corruption. prev->next should be next (ffff88800b13e480), but was ffff88801ecd1338. (prev=ffff88801ecd1340). + WARNING: CPU: 1 PID: 36562 at lib/list_debug.c:32 __list_add_valid_or_report+0x7f/0xa0 + Workqueue: ib_cm cm_work_handler [ib_cm] + RIP: 0010:__list_add_valid_or_report+0x7f/0xa0 + ? __list_add_valid_or_report+0x7f/0xa0 + ib_register_event_handler+0x65/0x93 [ib_core] + rtrs_srv_ib_dev_init+0x29/0x30 [rtrs_server] + rtrs_ib_dev_find_or_add+0x124/0x1d0 [rtrs_core] + __alloc_path+0x46c/0x680 [rtrs_server] + ? rtrs_rdma_connect+0xa6/0x2d0 [rtrs_server] + ? rcu_is_watching+0xd/0x40 + ? __mutex_lock+0x312/0xcf0 + ? get_or_create_srv+0xad/0x310 [rtrs_server] + ? rtrs_rdma_connect+0xa6/0x2d0 [rtrs_server] + rtrs_rdma_connect+0x23c/0x2d0 [rtrs_server] + ? __lock_release+0x1b1/0x2d0 + cma_cm_event_handler+0x4a/0x1a0 [rdma_cm] + cma_ib_req_handler+0x3a0/0x7e0 [rdma_cm] + cm_process_work+0x28/0x1a0 [ib_cm] + ? _raw_spin_unlock_irq+0x2f/0x50 + cm_req_handler+0x618/0xa60 [ib_cm] + cm_work_handler+0x71/0x520 [ib_cm] + +Commit 667db86bcbe8 ("RDMA/rtrs: Register ib event handler") introduced a +new element .deinit but never used it at all. Fix it by invoking the +`deinit()` to appropriately unregister the IB event handler. + +Cc: Jinpu Wang +Fixes: 667db86bcbe8 ("RDMA/rtrs: Register ib event handler") +Signed-off-by: Li Zhijian +Link: https://patch.msgid.link/20250106004516.16611-1-lizhijian@fujitsu.com +Acked-by: Jack Wang +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs.c b/drivers/infiniband/ulp/rtrs/rtrs.c +index 4e17d546d4ccf..bf38ac6f87c47 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs.c +@@ -584,6 +584,9 @@ static void dev_free(struct kref *ref) + list_del(&dev->entry); + mutex_unlock(&pool->mutex); + ++ if (pool->ops && pool->ops->deinit) ++ pool->ops->deinit(dev); ++ + ib_dealloc_pd(dev->ib_pd); + kfree(dev); + } +-- +2.39.5 + diff --git a/queue-6.12/rdma-rxe-fix-mismatched-max_msg_sz.patch b/queue-6.12/rdma-rxe-fix-mismatched-max_msg_sz.patch new file mode 100644 index 0000000000..f1a6a5edc4 --- /dev/null +++ b/queue-6.12/rdma-rxe-fix-mismatched-max_msg_sz.patch @@ -0,0 +1,64 @@ +From 925f8fec84a3a9e6345de6c7c44b26efe97aa3a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Dec 2024 20:19:53 +0800 +Subject: RDMA/rxe: Fix mismatched max_msg_sz + +From: zhenwei pi + +[ Upstream commit db03b70969aab4ef111a3369cfd90ea4da3a6aa0 ] + +User mode queries max_msg_sz as 0x800000 by command 'ibv_devinfo -v', +however ibv_post_send/ibv_post_recv has a limit of 2^31. Fix this +mismatched information. + +Signed-off-by: zhenwei pi +Fixes: f605f26ea196 ("RDMA/rxe: Protect QP state with qp->state_lock") +Fixes: 5bf944f24129 ("RDMA/rxe: Add error messages") +Link: https://patch.msgid.link/20241216121953.765331-1-pizhenwei@bytedance.com +Review-by: Zhu Yanjun +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_param.h | 2 +- + drivers/infiniband/sw/rxe/rxe_verbs.c | 5 ++--- + 2 files changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_param.h b/drivers/infiniband/sw/rxe/rxe_param.h +index d2f57ead78ad1..003f681e5dc02 100644 +--- a/drivers/infiniband/sw/rxe/rxe_param.h ++++ b/drivers/infiniband/sw/rxe/rxe_param.h +@@ -129,7 +129,7 @@ enum rxe_device_param { + enum rxe_port_param { + RXE_PORT_GID_TBL_LEN = 1024, + RXE_PORT_PORT_CAP_FLAGS = IB_PORT_CM_SUP, +- RXE_PORT_MAX_MSG_SZ = 0x800000, ++ RXE_PORT_MAX_MSG_SZ = (1UL << 31), + RXE_PORT_BAD_PKEY_CNTR = 0, + RXE_PORT_QKEY_VIOL_CNTR = 0, + RXE_PORT_LID = 0, +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c +index 8a5fc20fd1869..589ac0d8489db 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.c ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c +@@ -696,7 +696,7 @@ static int validate_send_wr(struct rxe_qp *qp, const struct ib_send_wr *ibwr, + for (i = 0; i < ibwr->num_sge; i++) + length += ibwr->sg_list[i].length; + +- if (length > (1UL << 31)) { ++ if (length > RXE_PORT_MAX_MSG_SZ) { + rxe_err_qp(qp, "message length too long\n"); + break; + } +@@ -980,8 +980,7 @@ static int post_one_recv(struct rxe_rq *rq, const struct ib_recv_wr *ibwr) + for (i = 0; i < num_sge; i++) + length += ibwr->sg_list[i].length; + +- /* IBA max message size is 2^31 */ +- if (length >= (1UL<<31)) { ++ if (length > RXE_PORT_MAX_MSG_SZ) { + err = -EINVAL; + rxe_dbg("message length too long\n"); + goto err_out; +-- +2.39.5 + diff --git a/queue-6.12/rdma-rxe-fix-the-warning-__rxe_cleanup-0x12c-0x170-r.patch b/queue-6.12/rdma-rxe-fix-the-warning-__rxe_cleanup-0x12c-0x170-r.patch new file mode 100644 index 0000000000..eaca7ce98d --- /dev/null +++ b/queue-6.12/rdma-rxe-fix-the-warning-__rxe_cleanup-0x12c-0x170-r.patch @@ -0,0 +1,99 @@ +From 19ed5ba2f8b9ddf2e8b999566665759c7800db29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 17:09:27 +0100 +Subject: RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]" + +From: Zhu Yanjun + +[ Upstream commit edc4ef0e0154096d6c0cf5e06af6fc330dbad9d1 ] + +The Call Trace is as below: +" + + ? show_regs.cold+0x1a/0x1f + ? __rxe_cleanup+0x12c/0x170 [rdma_rxe] + ? __warn+0x84/0xd0 + ? __rxe_cleanup+0x12c/0x170 [rdma_rxe] + ? report_bug+0x105/0x180 + ? handle_bug+0x46/0x80 + ? exc_invalid_op+0x19/0x70 + ? asm_exc_invalid_op+0x1b/0x20 + ? __rxe_cleanup+0x12c/0x170 [rdma_rxe] + ? __rxe_cleanup+0x124/0x170 [rdma_rxe] + rxe_destroy_qp.cold+0x24/0x29 [rdma_rxe] + ib_destroy_qp_user+0x118/0x190 [ib_core] + rdma_destroy_qp.cold+0x43/0x5e [rdma_cm] + rtrs_cq_qp_destroy.cold+0x1d/0x2b [rtrs_core] + rtrs_srv_close_work.cold+0x1b/0x31 [rtrs_server] + process_one_work+0x21d/0x3f0 + worker_thread+0x4a/0x3c0 + ? process_one_work+0x3f0/0x3f0 + kthread+0xf0/0x120 + ? kthread_complete_and_exit+0x20/0x20 + ret_from_fork+0x22/0x30 + +" +When too many rdma resources are allocated, rxe needs more time to +handle these rdma resources. Sometimes with the current timeout, rxe +can not release the rdma resources correctly. + +Compared with other rdma drivers, a bigger timeout is used. + +Fixes: 215d0a755e1b ("RDMA/rxe: Stop lookup of partially built objects") +Signed-off-by: Zhu Yanjun +Link: https://patch.msgid.link/20250110160927.55014-1-yanjun.zhu@linux.dev +Tested-by: Joe Klein +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_pool.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c +index 67567d62195e8..d9cb682fd71f8 100644 +--- a/drivers/infiniband/sw/rxe/rxe_pool.c ++++ b/drivers/infiniband/sw/rxe/rxe_pool.c +@@ -178,7 +178,6 @@ int __rxe_cleanup(struct rxe_pool_elem *elem, bool sleepable) + { + struct rxe_pool *pool = elem->pool; + struct xarray *xa = &pool->xa; +- static int timeout = RXE_POOL_TIMEOUT; + int ret, err = 0; + void *xa_ret; + +@@ -202,19 +201,19 @@ int __rxe_cleanup(struct rxe_pool_elem *elem, bool sleepable) + * return to rdma-core + */ + if (sleepable) { +- if (!completion_done(&elem->complete) && timeout) { ++ if (!completion_done(&elem->complete)) { + ret = wait_for_completion_timeout(&elem->complete, +- timeout); ++ msecs_to_jiffies(50000)); + + /* Shouldn't happen. There are still references to + * the object but, rather than deadlock, free the + * object or pass back to rdma-core. + */ + if (WARN_ON(!ret)) +- err = -EINVAL; ++ err = -ETIMEDOUT; + } + } else { +- unsigned long until = jiffies + timeout; ++ unsigned long until = jiffies + RXE_POOL_TIMEOUT; + + /* AH objects are unique in that the destroy_ah verb + * can be called in atomic context. This delay +@@ -226,7 +225,7 @@ int __rxe_cleanup(struct rxe_pool_elem *elem, bool sleepable) + mdelay(1); + + if (WARN_ON(!completion_done(&elem->complete))) +- err = -EINVAL; ++ err = -ETIMEDOUT; + } + + if (pool->cleanup) +-- +2.39.5 + diff --git a/queue-6.12/rdma-srp-fix-error-handling-in-srp_add_port.patch b/queue-6.12/rdma-srp-fix-error-handling-in-srp_add_port.patch new file mode 100644 index 0000000000..5972e557d4 --- /dev/null +++ b/queue-6.12/rdma-srp-fix-error-handling-in-srp_add_port.patch @@ -0,0 +1,43 @@ +From 19e6dc528bfafd782b42a382256dda4f24cf3130 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Dec 2024 15:55:38 +0800 +Subject: RDMA/srp: Fix error handling in srp_add_port + +From: Ma Ke + +[ Upstream commit a3cbf68c69611188cd304229e346bffdabfd4277 ] + +As comment of device_add() says, if device_add() succeeds, you should +call device_del() when you want to get rid of it. If device_add() has +not succeeded, use only put_device() to drop the reference count. + +Add a put_device() call before returning from the function to decrement +reference count for cleanup. + +Found by code review. + +Fixes: c8e4c2397655 ("RDMA/srp: Rework the srp_add_port() error path") +Signed-off-by: Ma Ke +Link: https://patch.msgid.link/20241217075538.2909996-1-make_ruc2021@163.com +Signed-off-by: Bart Van Assche +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/srp/ib_srp.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c +index 2916e77f589b8..7289ae0b83ace 100644 +--- a/drivers/infiniband/ulp/srp/ib_srp.c ++++ b/drivers/infiniband/ulp/srp/ib_srp.c +@@ -3978,7 +3978,6 @@ static struct srp_host *srp_add_port(struct srp_device *device, u32 port) + return host; + + put_host: +- device_del(&host->dev); + put_device(&host->dev); + return NULL; + } +-- +2.39.5 + diff --git a/queue-6.12/regulator-core-add-missing-newline-character.patch b/queue-6.12/regulator-core-add-missing-newline-character.patch new file mode 100644 index 0000000000..7384cc2b04 --- /dev/null +++ b/queue-6.12/regulator-core-add-missing-newline-character.patch @@ -0,0 +1,36 @@ +From 7db759d69145c56144128c9b3b7cd7ccca301620 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jan 2025 08:20:19 +0100 +Subject: regulator: core: Add missing newline character + +From: Alexander Stein + +[ Upstream commit 155c569fa4c3b340fbf8571a0e42dd415c025377 ] + +dev_err_probe() error messages need newline character. + +Fixes: 6eabfc018e8d ("regulator: core: Allow specifying an initial load w/ the bulk API") +Signed-off-by: Alexander Stein +Link: https://patch.msgid.link/20250122072019.1926093-1-alexander.stein@ew.tq-group.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 1179766811f58..4bb2652740d00 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -4946,7 +4946,7 @@ int _regulator_bulk_get(struct device *dev, int num_consumers, + consumers[i].supply, get_type); + if (IS_ERR(consumers[i].consumer)) { + ret = dev_err_probe(dev, PTR_ERR(consumers[i].consumer), +- "Failed to get supply '%s'", ++ "Failed to get supply '%s'\n", + consumers[i].supply); + consumers[i].consumer = NULL; + goto err; +-- +2.39.5 + diff --git a/queue-6.12/regulator-dt-bindings-mt6315-drop-regulator-compatib.patch b/queue-6.12/regulator-dt-bindings-mt6315-drop-regulator-compatib.patch new file mode 100644 index 0000000000..1ea59f4518 --- /dev/null +++ b/queue-6.12/regulator-dt-bindings-mt6315-drop-regulator-compatib.patch @@ -0,0 +1,62 @@ +From a90d8f630e74be636763c5703ae835c91dae0bb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 13:24:19 +0800 +Subject: regulator: dt-bindings: mt6315: Drop regulator-compatible property + +From: Chen-Yu Tsai + +[ Upstream commit 08242719a8af603db54a2a79234a8fe600680105 ] + +The "regulator-compatible" property has been deprecated since 2012 in +commit 13511def87b9 ("regulator: deprecate regulator-compatible DT +property"), which is so old it's not even mentioned in the converted +regulator bindings YAML file. It should not have been used for new +submissions such as the MT6315. + +Drop the property from the MT6315 regulator binding and its examples. + +Fixes: 977fb5b58469 ("regulator: document binding for MT6315 regulator") +Fixes: 6d435a94ba5b ("regulator: mt6315: Enforce regulator-compatible, not name") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://patch.msgid.link/20241211052427.4178367-2-wenst@chromium.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + .../devicetree/bindings/regulator/mt6315-regulator.yaml | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/Documentation/devicetree/bindings/regulator/mt6315-regulator.yaml b/Documentation/devicetree/bindings/regulator/mt6315-regulator.yaml +index cd4aa27218a1b..fa6743bb269d4 100644 +--- a/Documentation/devicetree/bindings/regulator/mt6315-regulator.yaml ++++ b/Documentation/devicetree/bindings/regulator/mt6315-regulator.yaml +@@ -35,10 +35,6 @@ properties: + $ref: regulator.yaml# + unevaluatedProperties: false + +- properties: +- regulator-compatible: +- pattern: "^vbuck[1-4]$" +- + additionalProperties: false + + required: +@@ -56,7 +52,6 @@ examples: + + regulators { + vbuck1 { +- regulator-compatible = "vbuck1"; + regulator-min-microvolt = <300000>; + regulator-max-microvolt = <1193750>; + regulator-enable-ramp-delay = <256>; +@@ -64,7 +59,6 @@ examples: + }; + + vbuck3 { +- regulator-compatible = "vbuck3"; + regulator-min-microvolt = <300000>; + regulator-max-microvolt = <1193750>; + regulator-enable-ramp-delay = <256>; +-- +2.39.5 + diff --git a/queue-6.12/regulator-of-implement-the-unwind-path-of-of_regulat.patch b/queue-6.12/regulator-of-implement-the-unwind-path-of-of_regulat.patch new file mode 100644 index 0000000000..c4eba10e26 --- /dev/null +++ b/queue-6.12/regulator-of-implement-the-unwind-path-of-of_regulat.patch @@ -0,0 +1,66 @@ +From 340d4f962037575b403e731b52b562b1d1467c32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Jan 2025 17:04:53 +0900 +Subject: regulator: of: Implement the unwind path of of_regulator_match() + +From: Joe Hattori + +[ Upstream commit dddca3b2fc676113c58b04aaefe84bfb958ac83e ] + +of_regulator_match() does not release the OF node reference in the error +path, resulting in an OF node leak. Therefore, call of_node_put() on the +obtained nodes before returning the EINVAL error. + +Since it is possible that some drivers call this function and do not +exit on failure, such as s2mps11_pmic_driver, clear the init_data and +of_node in the error path. + +This was reported by an experimental verification tool that I am +developing. As I do not have access to actual devices nor the QEMU board +configuration to test drivers that call this function, no runtime test +was able to be performed. + +Fixes: 1c8fa58f4750 ("regulator: Add generic DT parsing for regulators") +Signed-off-by: Joe Hattori +Link: https://patch.msgid.link/20250104080453.2153592-1-joe@pf.is.s.u-tokyo.ac.jp +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/of_regulator.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c +index 3f490d81abc28..deab0b95b6637 100644 +--- a/drivers/regulator/of_regulator.c ++++ b/drivers/regulator/of_regulator.c +@@ -446,7 +446,7 @@ int of_regulator_match(struct device *dev, struct device_node *node, + "failed to parse DT for regulator %pOFn\n", + child); + of_node_put(child); +- return -EINVAL; ++ goto err_put; + } + match->of_node = of_node_get(child); + count++; +@@ -455,6 +455,18 @@ int of_regulator_match(struct device *dev, struct device_node *node, + } + + return count; ++ ++err_put: ++ for (i = 0; i < num_matches; i++) { ++ struct of_regulator_match *match = &matches[i]; ++ ++ match->init_data = NULL; ++ if (match->of_node) { ++ of_node_put(match->of_node); ++ match->of_node = NULL; ++ } ++ } ++ return -EINVAL; + } + EXPORT_SYMBOL_GPL(of_regulator_match); + +-- +2.39.5 + diff --git a/queue-6.12/remoteproc-mtk_scp-only-populate-devices-for-scp-cor.patch b/queue-6.12/remoteproc-mtk_scp-only-populate-devices-for-scp-cor.patch new file mode 100644 index 0000000000..b5f7e7768b --- /dev/null +++ b/queue-6.12/remoteproc-mtk_scp-only-populate-devices-for-scp-cor.patch @@ -0,0 +1,72 @@ +From 5db0c1f5c9bdc10bf90b86380c7d574915d85a64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 15:20:07 +0800 +Subject: remoteproc: mtk_scp: Only populate devices for SCP cores + +From: Chen-Yu Tsai + +[ Upstream commit dbb9c372555c0b2a5a9264418bfba6d017752808 ] + +When multi-core SCP support was added, the driver was made to populate +platform devices for all the sub-nodes. This ended up adding platform +devices for the rpmsg sub-nodes as well, which never actually get used, +since rpmsg devices are registered through the rpmsg interface. + +Limit of_platform_populate() to just populating the SCP cores with a +compatible string match list. + +Fixes: 1fdbf0cdde98 ("remoteproc: mediatek: Probe SCP cluster on multi-core SCP") +Cc: Tinghan Shen +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20241211072009.120511-1-wenst@chromium.org +Signed-off-by: Mathieu Poirier +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/mtk_scp.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c +index e744c07507eed..f98a11d4cf292 100644 +--- a/drivers/remoteproc/mtk_scp.c ++++ b/drivers/remoteproc/mtk_scp.c +@@ -1326,6 +1326,11 @@ static int scp_cluster_init(struct platform_device *pdev, struct mtk_scp_of_clus + return ret; + } + ++static const struct of_device_id scp_core_match[] = { ++ { .compatible = "mediatek,scp-core" }, ++ {} ++}; ++ + static int scp_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; +@@ -1357,13 +1362,15 @@ static int scp_probe(struct platform_device *pdev) + INIT_LIST_HEAD(&scp_cluster->mtk_scp_list); + mutex_init(&scp_cluster->cluster_lock); + +- ret = devm_of_platform_populate(dev); ++ ret = of_platform_populate(dev_of_node(dev), scp_core_match, NULL, dev); + if (ret) + return dev_err_probe(dev, ret, "Failed to populate platform devices\n"); + + ret = scp_cluster_init(pdev, scp_cluster); +- if (ret) ++ if (ret) { ++ of_platform_depopulate(dev); + return ret; ++ } + + return 0; + } +@@ -1379,6 +1386,7 @@ static void scp_remove(struct platform_device *pdev) + rproc_del(scp->rproc); + scp_free(scp); + } ++ of_platform_depopulate(&pdev->dev); + mutex_destroy(&scp_cluster->cluster_lock); + } + +-- +2.39.5 + diff --git a/queue-6.12/revert-drm-amdgpu-gfx9-put-queue-resets-behind-a-deb.patch b/queue-6.12/revert-drm-amdgpu-gfx9-put-queue-resets-behind-a-deb.patch new file mode 100644 index 0000000000..4a7bc2b0df --- /dev/null +++ b/queue-6.12/revert-drm-amdgpu-gfx9-put-queue-resets-behind-a-deb.patch @@ -0,0 +1,83 @@ +From d4ccdc2ce14607422f72614dd1dd6cb085906e40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Oct 2024 15:55:10 -0400 +Subject: Revert "drm/amdgpu/gfx9: put queue resets behind a debug option" + +From: Alex Deucher + +[ Upstream commit 32f00289698189b813942f37626218fd473e7302 ] + +This reverts commit 7c1a2d8aba6cadde0cc542b2d805edc0be667e79. + +Extended validation has completed successfully, so enable +these features by default. + +Acked-by: Jiadong Zhu +Signed-off-by: Alex Deucher +Cc: Jonathan Kim +Cc: Jiadong Zhu +Stable-dep-of: 86bde64cb795 ("drm/amdgpu: fix gpu recovery disable with per queue reset") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c | 4 ---- + drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 4 ---- + drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 6 ------ + 3 files changed, 14 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c +index 3bc0cbf45bc59..353ac458c834b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c +@@ -1133,10 +1133,6 @@ uint64_t kgd_gfx_v9_hqd_get_pq_addr(struct amdgpu_device *adev, + uint32_t low, high; + uint64_t queue_addr = 0; + +- if (!adev->debug_exp_resets && +- !adev->gfx.num_gfx_rings) +- return 0; +- + kgd_gfx_v9_acquire_queue(adev, pipe_id, queue_id, inst); + amdgpu_gfx_rlc_enter_safe_mode(adev, inst); + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +index e7cd51c95141e..e2501c98e107d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -7251,10 +7251,6 @@ static int gfx_v9_0_reset_kcq(struct amdgpu_ring *ring, + unsigned long flags; + int i, r; + +- if (!adev->debug_exp_resets && +- !adev->gfx.num_gfx_rings) +- return -EINVAL; +- + if (amdgpu_sriov_vf(adev)) + return -EINVAL; + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c +index ffdb966c4127e..5dc3454d7d361 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c +@@ -3062,9 +3062,6 @@ static void gfx_v9_4_3_ring_soft_recovery(struct amdgpu_ring *ring, + struct amdgpu_device *adev = ring->adev; + uint32_t value = 0; + +- if (!adev->debug_exp_resets) +- return; +- + value = REG_SET_FIELD(value, SQ_CMD, CMD, 0x03); + value = REG_SET_FIELD(value, SQ_CMD, MODE, 0x01); + value = REG_SET_FIELD(value, SQ_CMD, CHECK_VMID, 1); +@@ -3580,9 +3577,6 @@ static int gfx_v9_4_3_reset_kcq(struct amdgpu_ring *ring, + unsigned long flags; + int r; + +- if (!adev->debug_exp_resets) +- return -EINVAL; +- + if (amdgpu_sriov_vf(adev)) + return -EINVAL; + +-- +2.39.5 + diff --git a/queue-6.12/rhashtable-fix-potential-deadlock-by-moving-schedule.patch b/queue-6.12/rhashtable-fix-potential-deadlock-by-moving-schedule.patch new file mode 100644 index 0000000000..c3495cb955 --- /dev/null +++ b/queue-6.12/rhashtable-fix-potential-deadlock-by-moving-schedule.patch @@ -0,0 +1,71 @@ +From d9aa6b6952874597ed8fd9120434a3c5e9990952 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Nov 2024 04:16:25 -0800 +Subject: rhashtable: Fix potential deadlock by moving schedule_work outside + lock + +From: Breno Leitao + +[ Upstream commit e1d3422c95f003eba241c176adfe593c33e8a8f6 ] + +Move the hash table growth check and work scheduling outside the +rht lock to prevent a possible circular locking dependency. + +The original implementation could trigger a lockdep warning due to +a potential deadlock scenario involving nested locks between +rhashtable bucket, rq lock, and dsq lock. By relocating the +growth check and work scheduling after releasing the rth lock, we break +this potential deadlock chain. + +This change expands the flexibility of rhashtable by removing +restrictive locking that previously limited its use in scheduler +and workqueue contexts. + +Import to say that this calls rht_grow_above_75(), which reads from +struct rhashtable without holding the lock, if this is a problem, we can +move the check to the lock, and schedule the workqueue after the lock. + +Fixes: f0e1a0643a59 ("sched_ext: Implement BPF extensible scheduler class") +Suggested-by: Tejun Heo +Signed-off-by: Breno Leitao + +Modified so that atomic_inc is also moved outside of the bucket +lock along with the growth above 75% check. + +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + lib/rhashtable.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/lib/rhashtable.c b/lib/rhashtable.c +index 6c902639728b7..bf956b85455ab 100644 +--- a/lib/rhashtable.c ++++ b/lib/rhashtable.c +@@ -584,10 +584,6 @@ static struct bucket_table *rhashtable_insert_one( + */ + rht_assign_locked(bkt, obj); + +- atomic_inc(&ht->nelems); +- if (rht_grow_above_75(ht, tbl)) +- schedule_work(&ht->run_work); +- + return NULL; + } + +@@ -624,6 +620,12 @@ static void *rhashtable_try_insert(struct rhashtable *ht, const void *key, + data = ERR_CAST(new_tbl); + + rht_unlock(tbl, bkt, flags); ++ ++ if (PTR_ERR(data) == -ENOENT && !new_tbl) { ++ atomic_inc(&ht->nelems); ++ if (rht_grow_above_75(ht, tbl)) ++ schedule_work(&ht->run_work); ++ } + } + } while (!IS_ERR_OR_NULL(new_tbl)); + +-- +2.39.5 + diff --git a/queue-6.12/rhashtable-fix-rhashtable_try_insert-test.patch b/queue-6.12/rhashtable-fix-rhashtable_try_insert-test.patch new file mode 100644 index 0000000000..547b842852 --- /dev/null +++ b/queue-6.12/rhashtable-fix-rhashtable_try_insert-test.patch @@ -0,0 +1,68 @@ +From 28797f1052bdf6efcddb7d3d482b510756b08cfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jan 2025 11:15:19 +0800 +Subject: rhashtable: Fix rhashtable_try_insert test + +From: Herbert Xu + +[ Upstream commit 9d4f8e54cef2c42e23ef258833dbd06a1eaff89b ] + +The test on whether rhashtable_insert_one did an insertion relies +on the value returned by rhashtable_lookup_one. Unfortunately that +value is overwritten after rhashtable_insert_one returns. Fix this +by moving the test before data gets overwritten. + +Simplify the test as only data == NULL matters. + +Finally move atomic_inc back within the lock as otherwise it may +be reordered with the atomic_dec on the removal side, potentially +leading to an underflow. + +Reported-by: Michael Kelley +Fixes: e1d3422c95f0 ("rhashtable: Fix potential deadlock by moving schedule_work outside lock") +Signed-off-by: Herbert Xu +Tested-by: Michael Kelley +Reviewed-by: Breno Leitao +Tested-by: Mikhail Zaslonko +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + lib/rhashtable.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/lib/rhashtable.c b/lib/rhashtable.c +index bf956b85455ab..0e9a1d4cf89be 100644 +--- a/lib/rhashtable.c ++++ b/lib/rhashtable.c +@@ -611,21 +611,23 @@ static void *rhashtable_try_insert(struct rhashtable *ht, const void *key, + new_tbl = rht_dereference_rcu(tbl->future_tbl, ht); + data = ERR_PTR(-EAGAIN); + } else { ++ bool inserted; ++ + flags = rht_lock(tbl, bkt); + data = rhashtable_lookup_one(ht, bkt, tbl, + hash, key, obj); + new_tbl = rhashtable_insert_one(ht, bkt, tbl, + hash, obj, data); ++ inserted = data && !new_tbl; ++ if (inserted) ++ atomic_inc(&ht->nelems); + if (PTR_ERR(new_tbl) != -EEXIST) + data = ERR_CAST(new_tbl); + + rht_unlock(tbl, bkt, flags); + +- if (PTR_ERR(data) == -ENOENT && !new_tbl) { +- atomic_inc(&ht->nelems); +- if (rht_grow_above_75(ht, tbl)) +- schedule_work(&ht->run_work); +- } ++ if (inserted && rht_grow_above_75(ht, tbl)) ++ schedule_work(&ht->run_work); + } + } while (!IS_ERR_OR_NULL(new_tbl)); + +-- +2.39.5 + diff --git a/queue-6.12/rtc-loongson-clear-toy_match0_reg-in-loongson_rtc_is.patch b/queue-6.12/rtc-loongson-clear-toy_match0_reg-in-loongson_rtc_is.patch new file mode 100644 index 0000000000..794f3083db --- /dev/null +++ b/queue-6.12/rtc-loongson-clear-toy_match0_reg-in-loongson_rtc_is.patch @@ -0,0 +1,66 @@ +From b786921d16325e820207171b0e7784cace0d6d79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 19:43:07 +0800 +Subject: rtc: loongson: clear TOY_MATCH0_REG in loongson_rtc_isr() + +From: Ming Wang + +[ Upstream commit 09471d8f5b390883eaf21b917c4bf3ced1b8a1df ] + +The TOY_MATCH0_REG should be cleared to 0 in the RTC interrupt handler, +otherwise the interrupt cannot be cleared, which will cause the +loongson_rtc_isr() to be triggered multiple times. + +The previous code cleared TOY_MATCH0_REG in the loongson_rtc_handler(), +which is an ACPI interrupt. This did not prevent loongson_rtc_isr() +from being triggered multiple times. + +This commit moves the clearing of TOY_MATCH0_REG to the +loongson_rtc_isr() to ensure that the interrupt is properly cleared. + +Fixes: 1b733a9ebc3d ("rtc: Add rtc driver for the Loongson family chips") +Signed-off-by: Ming Wang +Reviewed-by: Huacai Chen +Reviewed-by: Keguang Zhang # on LS1B +Tested-by: Keguang Zhang +Link: https://lore.kernel.org/r/20241205114307.1891418-1-wangming01@loongson.cn +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-loongson.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/rtc/rtc-loongson.c b/drivers/rtc/rtc-loongson.c +index e8ffc1ab90b02..90e9d97a86b48 100644 +--- a/drivers/rtc/rtc-loongson.c ++++ b/drivers/rtc/rtc-loongson.c +@@ -114,6 +114,13 @@ static irqreturn_t loongson_rtc_isr(int irq, void *id) + struct loongson_rtc_priv *priv = (struct loongson_rtc_priv *)id; + + rtc_update_irq(priv->rtcdev, 1, RTC_AF | RTC_IRQF); ++ ++ /* ++ * The TOY_MATCH0_REG should be cleared 0 here, ++ * otherwise the interrupt cannot be cleared. ++ */ ++ regmap_write(priv->regmap, TOY_MATCH0_REG, 0); ++ + return IRQ_HANDLED; + } + +@@ -131,11 +138,7 @@ static u32 loongson_rtc_handler(void *id) + writel(RTC_STS, priv->pm_base + PM1_STS_REG); + spin_unlock(&priv->lock); + +- /* +- * The TOY_MATCH0_REG should be cleared 0 here, +- * otherwise the interrupt cannot be cleared. +- */ +- return regmap_write(priv->regmap, TOY_MATCH0_REG, 0); ++ return ACPI_INTERRUPT_HANDLED; + } + + static int loongson_rtc_set_enabled(struct device *dev) +-- +2.39.5 + diff --git a/queue-6.12/rtc-pcf85063-fix-potential-oob-write-in-pcf85063-nvm.patch b/queue-6.12/rtc-pcf85063-fix-potential-oob-write-in-pcf85063-nvm.patch new file mode 100644 index 0000000000..2430fe4199 --- /dev/null +++ b/queue-6.12/rtc-pcf85063-fix-potential-oob-write-in-pcf85063-nvm.patch @@ -0,0 +1,51 @@ +From 329112e47c4ce8ec563d771746820ae165c58f21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Dec 2024 20:34:58 +0100 +Subject: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read + +From: Oleksij Rempel + +[ Upstream commit 3ab8c5ed4f84fa20cd16794fe8dc31f633fbc70c ] + +The nvmem interface supports variable buffer sizes, while the regmap +interface operates with fixed-size storage. If an nvmem client uses a +buffer size less than 4 bytes, regmap_read will write out of bounds +as it expects the buffer to point at an unsigned int. + +Fix this by using an intermediary unsigned int to hold the value. + +Fixes: fadfd092ee91 ("rtc: pcf85063: add nvram support") +Signed-off-by: Oleksij Rempel +Signed-off-by: Ahmad Fatoum +Link: https://lore.kernel.org/r/20241218-rtc-pcf85063-stack-corruption-v1-1-12fd0ee0f046@pengutronix.de +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-pcf85063.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-pcf85063.c b/drivers/rtc/rtc-pcf85063.c +index fdbc07f14036a..905986c616559 100644 +--- a/drivers/rtc/rtc-pcf85063.c ++++ b/drivers/rtc/rtc-pcf85063.c +@@ -322,7 +322,16 @@ static const struct rtc_class_ops pcf85063_rtc_ops = { + static int pcf85063_nvmem_read(void *priv, unsigned int offset, + void *val, size_t bytes) + { +- return regmap_read(priv, PCF85063_REG_RAM, val); ++ unsigned int tmp; ++ int ret; ++ ++ ret = regmap_read(priv, PCF85063_REG_RAM, &tmp); ++ if (ret < 0) ++ return ret; ++ ++ *(u8 *)val = tmp; ++ ++ return 0; + } + + static int pcf85063_nvmem_write(void *priv, unsigned int offset, +-- +2.39.5 + diff --git a/queue-6.12/rtc-tps6594-fix-integer-overflow-on-32bit-systems.patch b/queue-6.12/rtc-tps6594-fix-integer-overflow-on-32bit-systems.patch new file mode 100644 index 0000000000..ca6ed5ef30 --- /dev/null +++ b/queue-6.12/rtc-tps6594-fix-integer-overflow-on-32bit-systems.patch @@ -0,0 +1,48 @@ +From fbfe6887844951dd12b2608005b0a35504fd8fad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 12:32:34 +0300 +Subject: rtc: tps6594: Fix integer overflow on 32bit systems + +From: Dan Carpenter + +[ Upstream commit 09c4a610153286cef54d4f0c85398f4e32fc227e ] + +The problem is this multiply in tps6594_rtc_set_offset() + + tmp = offset * TICKS_PER_HOUR; + +The "tmp" variable is an s64 but "offset" is a long in the +(-277774)-277774 range. On 32bit systems a long can hold numbers up to +approximately two billion. The number of TICKS_PER_HOUR is really large, +(32768 * 3600) or roughly a hundred million. When you start multiplying +by a hundred million it doesn't take long to overflow the two billion +mark. + +Probably the safest way to fix this is to change the type of +TICKS_PER_HOUR to long long because it's such a large number. + +Fixes: 9f67c1e63976 ("rtc: tps6594: Add driver for TPS6594 RTC") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/1074175e-5ecb-4e3d-b721-347d794caa90@stanley.mountain +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-tps6594.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-tps6594.c b/drivers/rtc/rtc-tps6594.c +index e696676341378..7c6246e3f0292 100644 +--- a/drivers/rtc/rtc-tps6594.c ++++ b/drivers/rtc/rtc-tps6594.c +@@ -37,7 +37,7 @@ + #define MAX_OFFSET (277774) + + // Number of ticks per hour +-#define TICKS_PER_HOUR (32768 * 3600) ++#define TICKS_PER_HOUR (32768 * 3600LL) + + // Multiplier for ppb conversions + #define PPB_MULT NANO +-- +2.39.5 + diff --git a/queue-6.12/rxrpc-afs-fix-peer-hash-locking-vs-rcu-callback.patch b/queue-6.12/rxrpc-afs-fix-peer-hash-locking-vs-rcu-callback.patch new file mode 100644 index 0000000000..57d469668f --- /dev/null +++ b/queue-6.12/rxrpc-afs-fix-peer-hash-locking-vs-rcu-callback.patch @@ -0,0 +1,213 @@ +From aaa0ba47faee99ee3a1813cb5fbdea7fc3b0b294 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jan 2025 08:59:12 +0000 +Subject: rxrpc, afs: Fix peer hash locking vs RCU callback + +From: David Howells + +[ Upstream commit 79d458c13056559d49b5e41fbc4b6890e68cf65b ] + +In its address list, afs now retains pointers to and refs on one or more +rxrpc_peer objects. The address list is freed under RCU and at this time, +it puts the refs on those peers. + +Now, when an rxrpc_peer object runs out of refs, it gets removed from the +peer hash table and, for that, rxrpc has to take a spinlock. However, it +is now being called from afs's RCU cleanup, which takes place in BH +context - but it is just taking an ordinary spinlock. + +The put may also be called from non-BH context, and so there exists the +possibility of deadlock if the BH-based RCU cleanup happens whilst the hash +spinlock is held. This led to the attached lockdep complaint. + +Fix this by changing spinlocks of rxnet->peer_hash_lock back to +BH-disabling locks. + + ================================ + WARNING: inconsistent lock state + 6.13.0-rc5-build2+ #1223 Tainted: G E + -------------------------------- + inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. + swapper/1/0 [HC0[0]:SC1[1]:HE1:SE0] takes: + ffff88810babe228 (&rxnet->peer_hash_lock){+.?.}-{3:3}, at: rxrpc_put_peer+0xcb/0x180 + {SOFTIRQ-ON-W} state was registered at: + mark_usage+0x164/0x180 + __lock_acquire+0x544/0x990 + lock_acquire.part.0+0x103/0x280 + _raw_spin_lock+0x2f/0x40 + rxrpc_peer_keepalive_worker+0x144/0x440 + process_one_work+0x486/0x7c0 + process_scheduled_works+0x73/0x90 + worker_thread+0x1c8/0x2a0 + kthread+0x19b/0x1b0 + ret_from_fork+0x24/0x40 + ret_from_fork_asm+0x1a/0x30 + irq event stamp: 972402 + hardirqs last enabled at (972402): [] _raw_spin_unlock_irqrestore+0x2e/0x50 + hardirqs last disabled at (972401): [] _raw_spin_lock_irqsave+0x18/0x60 + softirqs last enabled at (972300): [] handle_softirqs+0x3ee/0x430 + softirqs last disabled at (972313): [] __irq_exit_rcu+0x44/0x110 + + other info that might help us debug this: + Possible unsafe locking scenario: + CPU0 + ---- + lock(&rxnet->peer_hash_lock); + + lock(&rxnet->peer_hash_lock); + + *** DEADLOCK *** + 1 lock held by swapper/1/0: + #0: ffffffff83576be0 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire+0x7/0x30 + + stack backtrace: + CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G E 6.13.0-rc5-build2+ #1223 + Tainted: [E]=UNSIGNED_MODULE + Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014 + Call Trace: + + dump_stack_lvl+0x57/0x80 + print_usage_bug.part.0+0x227/0x240 + valid_state+0x53/0x70 + mark_lock_irq+0xa5/0x2f0 + mark_lock+0xf7/0x170 + mark_usage+0xe1/0x180 + __lock_acquire+0x544/0x990 + lock_acquire.part.0+0x103/0x280 + _raw_spin_lock+0x2f/0x40 + rxrpc_put_peer+0xcb/0x180 + afs_free_addrlist+0x46/0x90 [kafs] + rcu_do_batch+0x2d2/0x640 + rcu_core+0x2f7/0x350 + handle_softirqs+0x1ee/0x430 + __irq_exit_rcu+0x44/0x110 + irq_exit_rcu+0xa/0x30 + sysvec_apic_timer_interrupt+0x7f/0xa0 + + +Fixes: 72904d7b9bfb ("rxrpc, afs: Allow afs to pin rxrpc_peer objects") +Signed-off-by: David Howells +cc: Marc Dionne +cc: Simon Horman +cc: linux-afs@lists.infradead.org +Link: https://patch.msgid.link/2095618.1737622752@warthog.procyon.org.uk +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/rxrpc/peer_event.c | 16 ++++++++-------- + net/rxrpc/peer_object.c | 12 ++++++------ + 2 files changed, 14 insertions(+), 14 deletions(-) + +diff --git a/net/rxrpc/peer_event.c b/net/rxrpc/peer_event.c +index 552ba84a255c4..5d0842efde69f 100644 +--- a/net/rxrpc/peer_event.c ++++ b/net/rxrpc/peer_event.c +@@ -238,7 +238,7 @@ static void rxrpc_peer_keepalive_dispatch(struct rxrpc_net *rxnet, + bool use; + int slot; + +- spin_lock(&rxnet->peer_hash_lock); ++ spin_lock_bh(&rxnet->peer_hash_lock); + + while (!list_empty(collector)) { + peer = list_entry(collector->next, +@@ -249,7 +249,7 @@ static void rxrpc_peer_keepalive_dispatch(struct rxrpc_net *rxnet, + continue; + + use = __rxrpc_use_local(peer->local, rxrpc_local_use_peer_keepalive); +- spin_unlock(&rxnet->peer_hash_lock); ++ spin_unlock_bh(&rxnet->peer_hash_lock); + + if (use) { + keepalive_at = peer->last_tx_at + RXRPC_KEEPALIVE_TIME; +@@ -269,17 +269,17 @@ static void rxrpc_peer_keepalive_dispatch(struct rxrpc_net *rxnet, + */ + slot += cursor; + slot &= mask; +- spin_lock(&rxnet->peer_hash_lock); ++ spin_lock_bh(&rxnet->peer_hash_lock); + list_add_tail(&peer->keepalive_link, + &rxnet->peer_keepalive[slot & mask]); +- spin_unlock(&rxnet->peer_hash_lock); ++ spin_unlock_bh(&rxnet->peer_hash_lock); + rxrpc_unuse_local(peer->local, rxrpc_local_unuse_peer_keepalive); + } + rxrpc_put_peer(peer, rxrpc_peer_put_keepalive); +- spin_lock(&rxnet->peer_hash_lock); ++ spin_lock_bh(&rxnet->peer_hash_lock); + } + +- spin_unlock(&rxnet->peer_hash_lock); ++ spin_unlock_bh(&rxnet->peer_hash_lock); + } + + /* +@@ -309,7 +309,7 @@ void rxrpc_peer_keepalive_worker(struct work_struct *work) + * second; the bucket at cursor + 1 goes at now + 1s and so + * on... + */ +- spin_lock(&rxnet->peer_hash_lock); ++ spin_lock_bh(&rxnet->peer_hash_lock); + list_splice_init(&rxnet->peer_keepalive_new, &collector); + + stop = cursor + ARRAY_SIZE(rxnet->peer_keepalive); +@@ -321,7 +321,7 @@ void rxrpc_peer_keepalive_worker(struct work_struct *work) + } + + base = now; +- spin_unlock(&rxnet->peer_hash_lock); ++ spin_unlock_bh(&rxnet->peer_hash_lock); + + rxnet->peer_keepalive_base = base; + rxnet->peer_keepalive_cursor = cursor; +diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c +index 49dcda67a0d59..956fc7ea4b734 100644 +--- a/net/rxrpc/peer_object.c ++++ b/net/rxrpc/peer_object.c +@@ -313,10 +313,10 @@ void rxrpc_new_incoming_peer(struct rxrpc_local *local, struct rxrpc_peer *peer) + hash_key = rxrpc_peer_hash_key(local, &peer->srx); + rxrpc_init_peer(local, peer, hash_key); + +- spin_lock(&rxnet->peer_hash_lock); ++ spin_lock_bh(&rxnet->peer_hash_lock); + hash_add_rcu(rxnet->peer_hash, &peer->hash_link, hash_key); + list_add_tail(&peer->keepalive_link, &rxnet->peer_keepalive_new); +- spin_unlock(&rxnet->peer_hash_lock); ++ spin_unlock_bh(&rxnet->peer_hash_lock); + } + + /* +@@ -348,7 +348,7 @@ struct rxrpc_peer *rxrpc_lookup_peer(struct rxrpc_local *local, + return NULL; + } + +- spin_lock(&rxnet->peer_hash_lock); ++ spin_lock_bh(&rxnet->peer_hash_lock); + + /* Need to check that we aren't racing with someone else */ + peer = __rxrpc_lookup_peer_rcu(local, srx, hash_key); +@@ -361,7 +361,7 @@ struct rxrpc_peer *rxrpc_lookup_peer(struct rxrpc_local *local, + &rxnet->peer_keepalive_new); + } + +- spin_unlock(&rxnet->peer_hash_lock); ++ spin_unlock_bh(&rxnet->peer_hash_lock); + + if (peer) + rxrpc_free_peer(candidate); +@@ -411,10 +411,10 @@ static void __rxrpc_put_peer(struct rxrpc_peer *peer) + + ASSERT(hlist_empty(&peer->error_targets)); + +- spin_lock(&rxnet->peer_hash_lock); ++ spin_lock_bh(&rxnet->peer_hash_lock); + hash_del_rcu(&peer->hash_link); + list_del_init(&peer->keepalive_link); +- spin_unlock(&rxnet->peer_hash_lock); ++ spin_unlock_bh(&rxnet->peer_hash_lock); + + rxrpc_free_peer(peer); + } +-- +2.39.5 + diff --git a/queue-6.12/rxrpc-fix-handling-of-received-connection-abort.patch b/queue-6.12/rxrpc-fix-handling-of-received-connection-abort.patch new file mode 100644 index 0000000000..a6d7bd6880 --- /dev/null +++ b/queue-6.12/rxrpc-fix-handling-of-received-connection-abort.patch @@ -0,0 +1,118 @@ +From e0bf65ca3a751289184005d66c629ac152448005 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Dec 2024 07:46:30 +0000 +Subject: rxrpc: Fix handling of received connection abort + +From: David Howells + +[ Upstream commit 0e56ebde245e4799ce74d38419426f2a80d39950 ] + +Fix the handling of a connection abort that we've received. Though the +abort is at the connection level, it needs propagating to the calls on that +connection. Whilst the propagation bit is performed, the calls aren't then +woken up to go and process their termination, and as no further input is +forthcoming, they just hang. + +Also add some tracing for the logging of connection aborts. + +Fixes: 248f219cb8bc ("rxrpc: Rewrite the data and ack handling code") +Signed-off-by: David Howells +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +Link: https://patch.msgid.link/20241204074710.990092-3-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/trace/events/rxrpc.h | 25 +++++++++++++++++++++++++ + net/rxrpc/conn_event.c | 12 ++++++++---- + 2 files changed, 33 insertions(+), 4 deletions(-) + +diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h +index cc22596c7250c..666fe1779ccc6 100644 +--- a/include/trace/events/rxrpc.h ++++ b/include/trace/events/rxrpc.h +@@ -117,6 +117,7 @@ + #define rxrpc_call_poke_traces \ + EM(rxrpc_call_poke_abort, "Abort") \ + EM(rxrpc_call_poke_complete, "Compl") \ ++ EM(rxrpc_call_poke_conn_abort, "Conn-abort") \ + EM(rxrpc_call_poke_error, "Error") \ + EM(rxrpc_call_poke_idle, "Idle") \ + EM(rxrpc_call_poke_set_timeout, "Set-timo") \ +@@ -282,6 +283,7 @@ + EM(rxrpc_call_see_activate_client, "SEE act-clnt") \ + EM(rxrpc_call_see_connect_failed, "SEE con-fail") \ + EM(rxrpc_call_see_connected, "SEE connect ") \ ++ EM(rxrpc_call_see_conn_abort, "SEE conn-abt") \ + EM(rxrpc_call_see_disconnected, "SEE disconn ") \ + EM(rxrpc_call_see_distribute_error, "SEE dist-err") \ + EM(rxrpc_call_see_input, "SEE input ") \ +@@ -956,6 +958,29 @@ TRACE_EVENT(rxrpc_rx_abort, + __entry->abort_code) + ); + ++TRACE_EVENT(rxrpc_rx_conn_abort, ++ TP_PROTO(const struct rxrpc_connection *conn, const struct sk_buff *skb), ++ ++ TP_ARGS(conn, skb), ++ ++ TP_STRUCT__entry( ++ __field(unsigned int, conn) ++ __field(rxrpc_serial_t, serial) ++ __field(u32, abort_code) ++ ), ++ ++ TP_fast_assign( ++ __entry->conn = conn->debug_id; ++ __entry->serial = rxrpc_skb(skb)->hdr.serial; ++ __entry->abort_code = skb->priority; ++ ), ++ ++ TP_printk("C=%08x ABORT %08x ac=%d", ++ __entry->conn, ++ __entry->serial, ++ __entry->abort_code) ++ ); ++ + TRACE_EVENT(rxrpc_rx_challenge, + TP_PROTO(struct rxrpc_connection *conn, rxrpc_serial_t serial, + u32 version, u32 nonce, u32 min_level), +diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c +index 598b4ee389fc1..2a1396cd892f3 100644 +--- a/net/rxrpc/conn_event.c ++++ b/net/rxrpc/conn_event.c +@@ -63,11 +63,12 @@ int rxrpc_abort_conn(struct rxrpc_connection *conn, struct sk_buff *skb, + /* + * Mark a connection as being remotely aborted. + */ +-static bool rxrpc_input_conn_abort(struct rxrpc_connection *conn, ++static void rxrpc_input_conn_abort(struct rxrpc_connection *conn, + struct sk_buff *skb) + { +- return rxrpc_set_conn_aborted(conn, skb, skb->priority, -ECONNABORTED, +- RXRPC_CALL_REMOTELY_ABORTED); ++ trace_rxrpc_rx_conn_abort(conn, skb); ++ rxrpc_set_conn_aborted(conn, skb, skb->priority, -ECONNABORTED, ++ RXRPC_CALL_REMOTELY_ABORTED); + } + + /* +@@ -202,11 +203,14 @@ static void rxrpc_abort_calls(struct rxrpc_connection *conn) + + for (i = 0; i < RXRPC_MAXCALLS; i++) { + call = conn->channels[i].call; +- if (call) ++ if (call) { ++ rxrpc_see_call(call, rxrpc_call_see_conn_abort); + rxrpc_set_call_completion(call, + conn->completion, + conn->abort_code, + conn->error); ++ rxrpc_poke_call(call, rxrpc_call_poke_conn_abort); ++ } + } + + _leave(""); +-- +2.39.5 + diff --git a/queue-6.12/s390-mm-allow-large-pages-for-kasan-shadow-mapping.patch b/queue-6.12/s390-mm-allow-large-pages-for-kasan-shadow-mapping.patch new file mode 100644 index 0000000000..81ad342d2e --- /dev/null +++ b/queue-6.12/s390-mm-allow-large-pages-for-kasan-shadow-mapping.patch @@ -0,0 +1,57 @@ +From f4b3a3ad7f307e227e1dab54b6ad0065af98c7c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Nov 2024 13:41:33 +0100 +Subject: s390/mm: Allow large pages for KASAN shadow mapping + +From: Vasily Gorbik + +[ Upstream commit ff123eb7741638d55abf82fac090bb3a543c1e74 ] + +Commit c98d2ecae08f ("s390/mm: Uncouple physical vs virtual address +spaces") introduced a large_allowed() helper that restricts which mapping +modes can use large pages. This change unintentionally prevented KASAN +shadow mappings from using large pages, despite there being no reason +to avoid them. In fact, large pages are preferred for performance. + +Add POPULATE_KASAN_MAP_SHADOW to the allowed list in large_allowed() +to restore large page mappings for KASAN shadows. + +While large_allowed() isn't strictly necessary with current mapping +modes since disallowed modes either don't map anything or fail alignment +and size checks, keep it for clarity. + +Fixes: c98d2ecae08f ("s390/mm: Uncouple physical vs virtual address spaces") +Acked-by: Alexander Gordeev +Signed-off-by: Vasily Gorbik +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/boot/vmem.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/arch/s390/boot/vmem.c b/arch/s390/boot/vmem.c +index 3fa28db2fe59f..824690427b61a 100644 +--- a/arch/s390/boot/vmem.c ++++ b/arch/s390/boot/vmem.c +@@ -264,7 +264,17 @@ static unsigned long _pa(unsigned long addr, unsigned long size, enum populate_m + + static bool large_allowed(enum populate_mode mode) + { +- return (mode == POPULATE_DIRECT) || (mode == POPULATE_IDENTITY) || (mode == POPULATE_KERNEL); ++ switch (mode) { ++ case POPULATE_DIRECT: ++ case POPULATE_IDENTITY: ++ case POPULATE_KERNEL: ++#ifdef CONFIG_KASAN ++ case POPULATE_KASAN_MAP_SHADOW: ++#endif ++ return true; ++ default: ++ return false; ++ } + } + + static bool can_large_pud(pud_t *pu_dir, unsigned long addr, unsigned long end, +-- +2.39.5 + diff --git a/queue-6.12/s390-sclp-initialize-sclp-subsystem-via-arch_cpu_fin.patch b/queue-6.12/s390-sclp-initialize-sclp-subsystem-via-arch_cpu_fin.patch new file mode 100644 index 0000000000..d25df096bc --- /dev/null +++ b/queue-6.12/s390-sclp-initialize-sclp-subsystem-via-arch_cpu_fin.patch @@ -0,0 +1,113 @@ +From 9aa580d0b7010ae92c3213e67dabd4241e9b28e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jan 2025 11:53:42 +0100 +Subject: s390/sclp: Initialize sclp subsystem via arch_cpu_finalize_init() + +From: Heiko Carstens + +[ Upstream commit 3bcc8a1af581af152d43e42b53db3534018301b5 ] + +With the switch to GENERIC_CPU_DEVICES an early call to the sclp subsystem +was added to smp_prepare_cpus(). This will usually succeed since the sclp +subsystem is implicitly initialized early enough if an sclp based console +is present. + +If no such console is present the initialization happens with an +arch_initcall(); in such cases calls to the sclp subsystem will fail. +For CPU detection this means that the fallback sigp loop will be used +permanently to detect CPUs instead of the preferred READ_CPU_INFO sclp +request. + +Fix this by adding an explicit early sclp_init() call via +arch_cpu_finalize_init(). + +Reported-by: Sheshu Ramanandan +Fixes: 4a39f12e753d ("s390/smp: Switch to GENERIC_CPU_DEVICES") +Reviewed-by: Peter Oberparleiter +Signed-off-by: Heiko Carstens +Signed-off-by: Alexander Gordeev +Signed-off-by: Sasha Levin +--- + arch/s390/Kconfig | 1 + + arch/s390/include/asm/sclp.h | 1 + + arch/s390/kernel/setup.c | 5 +++++ + drivers/s390/char/sclp.c | 12 ++---------- + 4 files changed, 9 insertions(+), 10 deletions(-) + +diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig +index cc1f9cffe2a5f..62f2c9e8e05f7 100644 +--- a/arch/s390/Kconfig ++++ b/arch/s390/Kconfig +@@ -65,6 +65,7 @@ config S390 + select ARCH_ENABLE_MEMORY_HOTPLUG if SPARSEMEM + select ARCH_ENABLE_MEMORY_HOTREMOVE + select ARCH_ENABLE_SPLIT_PMD_PTLOCK if PGTABLE_LEVELS > 2 ++ select ARCH_HAS_CPU_FINALIZE_INIT + select ARCH_HAS_CURRENT_STACK_POINTER + select ARCH_HAS_DEBUG_VIRTUAL + select ARCH_HAS_DEBUG_VM_PGTABLE +diff --git a/arch/s390/include/asm/sclp.h b/arch/s390/include/asm/sclp.h +index eb00fa1771da0..ad17d91ad2e66 100644 +--- a/arch/s390/include/asm/sclp.h ++++ b/arch/s390/include/asm/sclp.h +@@ -137,6 +137,7 @@ void sclp_early_printk(const char *s); + void __sclp_early_printk(const char *s, unsigned int len); + void sclp_emergency_printk(const char *s); + ++int sclp_init(void); + int sclp_early_get_memsize(unsigned long *mem); + int sclp_early_get_hsa_size(unsigned long *hsa_size); + int _sclp_get_core_info(struct sclp_core_info *info); +diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c +index a3fea683b2270..99f165726ca9e 100644 +--- a/arch/s390/kernel/setup.c ++++ b/arch/s390/kernel/setup.c +@@ -1006,3 +1006,8 @@ void __init setup_arch(char **cmdline_p) + /* Add system specific data to the random pool */ + setup_randomness(); + } ++ ++void __init arch_cpu_finalize_init(void) ++{ ++ sclp_init(); ++} +diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c +index fbffd451031fd..45bd001206a2b 100644 +--- a/drivers/s390/char/sclp.c ++++ b/drivers/s390/char/sclp.c +@@ -245,7 +245,6 @@ static void sclp_request_timeout(bool force_restart); + static void sclp_process_queue(void); + static void __sclp_make_read_req(void); + static int sclp_init_mask(int calculate); +-static int sclp_init(void); + + static void + __sclp_queue_read_req(void) +@@ -1251,8 +1250,7 @@ static struct platform_driver sclp_pdrv = { + + /* Initialize SCLP driver. Return zero if driver is operational, non-zero + * otherwise. */ +-static int +-sclp_init(void) ++int sclp_init(void) + { + unsigned long flags; + int rc = 0; +@@ -1305,13 +1303,7 @@ sclp_init(void) + + static __init int sclp_initcall(void) + { +- int rc; +- +- rc = platform_driver_register(&sclp_pdrv); +- if (rc) +- return rc; +- +- return sclp_init(); ++ return platform_driver_register(&sclp_pdrv); + } + + arch_initcall(sclp_initcall); +-- +2.39.5 + diff --git a/queue-6.12/samples-landlock-fix-possible-null-dereference-in-pa.patch b/queue-6.12/samples-landlock-fix-possible-null-dereference-in-pa.patch new file mode 100644 index 0000000000..0c509ae2cb --- /dev/null +++ b/queue-6.12/samples-landlock-fix-possible-null-dereference-in-pa.patch @@ -0,0 +1,53 @@ +From 3eb1afce345c1aeeb475551a135951b2e9061729 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Nov 2024 21:29:56 -0600 +Subject: samples/landlock: Fix possible NULL dereference in parse_path() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zichen Xie + +[ Upstream commit 078bf9438a31567e2c0587159ccefde835fb1ced ] + +malloc() may return NULL, leading to NULL dereference. Add a NULL +check. + +Fixes: ba84b0bf5a16 ("samples/landlock: Add a sandbox manager example") +Signed-off-by: Zichen Xie +Link: https://lore.kernel.org/r/20241128032955.11711-1-zichenxie0106@gmail.com +[mic: Simplify fix] +Signed-off-by: Mickaël Salaün +Signed-off-by: Sasha Levin +--- + samples/landlock/sandboxer.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c +index 57565dfd74a26..07fab2ef534e8 100644 +--- a/samples/landlock/sandboxer.c ++++ b/samples/landlock/sandboxer.c +@@ -91,6 +91,9 @@ static int parse_path(char *env_path, const char ***const path_list) + } + } + *path_list = malloc(num_paths * sizeof(**path_list)); ++ if (!*path_list) ++ return -1; ++ + for (i = 0; i < num_paths; i++) + (*path_list)[i] = strsep(&env_path, ENV_DELIMITER); + +@@ -127,6 +130,10 @@ static int populate_ruleset_fs(const char *const env_var, const int ruleset_fd, + env_path_name = strdup(env_path_name); + unsetenv(env_var); + num_paths = parse_path(env_path_name, &path_list); ++ if (num_paths < 0) { ++ fprintf(stderr, "Failed to allocate memory\n"); ++ goto out_free_name; ++ } + if (num_paths == 1 && path_list[0][0] == '\0') { + /* + * Allows to not use all possible restrictions (e.g. use +-- +2.39.5 + diff --git a/queue-6.12/sched-fair-fix-value-reported-by-hot-tasks-pulled-in.patch b/queue-6.12/sched-fair-fix-value-reported-by-hot-tasks-pulled-in.patch new file mode 100644 index 0000000000..4f428217fa --- /dev/null +++ b/queue-6.12/sched-fair-fix-value-reported-by-hot-tasks-pulled-in.patch @@ -0,0 +1,97 @@ +From 55e5b5b2d83ec405ce05af043b858986d1d2a1ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2024 06:32:19 +0000 +Subject: sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat + +From: Peter Zijlstra + +[ Upstream commit a430d99e349026d53e2557b7b22bd2ebd61fe12a ] + +In /proc/schedstat, lb_hot_gained reports the number hot tasks pulled +during load balance. This value is incremented in can_migrate_task() +if the task is migratable and hot. After incrementing the value, +load balancer can still decide not to migrate this task leading to wrong +accounting. Fix this by incrementing stats when hot tasks are detached. +This issue only exists in detach_tasks() where we can decide to not +migrate hot task even if it is migratable. However, in detach_one_task(), +we migrate it unconditionally. + +[Swapnil: Handled the case where nr_failed_migrations_hot was not accounted properly and wrote commit log] + +Fixes: d31980846f96 ("sched: Move up affinity check to mitigate useless redoing overhead") +Signed-off-by: Peter Zijlstra (Intel) +Reported-by: "Gautham R. Shenoy" +Not-yet-signed-off-by: Peter Zijlstra +Signed-off-by: Swapnil Sapkal +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20241220063224.17767-2-swapnil.sapkal@amd.com +Signed-off-by: Sasha Levin +--- + include/linux/sched.h | 1 + + kernel/sched/fair.c | 17 +++++++++++++---- + 2 files changed, 14 insertions(+), 4 deletions(-) + +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 02eaf84c8626f..8982820dae213 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -944,6 +944,7 @@ struct task_struct { + unsigned sched_reset_on_fork:1; + unsigned sched_contributes_to_load:1; + unsigned sched_migrated:1; ++ unsigned sched_task_hot:1; + + /* Force alignment to the next boundary: */ + unsigned :0; +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index a21110b220b7b..65e7be6448720 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -9418,6 +9418,8 @@ int can_migrate_task(struct task_struct *p, struct lb_env *env) + int tsk_cache_hot; + + lockdep_assert_rq_held(env->src_rq); ++ if (p->sched_task_hot) ++ p->sched_task_hot = 0; + + /* + * We do not migrate tasks that are: +@@ -9490,10 +9492,8 @@ int can_migrate_task(struct task_struct *p, struct lb_env *env) + + if (tsk_cache_hot <= 0 || + env->sd->nr_balance_failed > env->sd->cache_nice_tries) { +- if (tsk_cache_hot == 1) { +- schedstat_inc(env->sd->lb_hot_gained[env->idle]); +- schedstat_inc(p->stats.nr_forced_migrations); +- } ++ if (tsk_cache_hot == 1) ++ p->sched_task_hot = 1; + return 1; + } + +@@ -9508,6 +9508,12 @@ static void detach_task(struct task_struct *p, struct lb_env *env) + { + lockdep_assert_rq_held(env->src_rq); + ++ if (p->sched_task_hot) { ++ p->sched_task_hot = 0; ++ schedstat_inc(env->sd->lb_hot_gained[env->idle]); ++ schedstat_inc(p->stats.nr_forced_migrations); ++ } ++ + deactivate_task(env->src_rq, p, DEQUEUE_NOCLOCK); + set_task_cpu(p, env->dst_cpu); + } +@@ -9668,6 +9674,9 @@ static int detach_tasks(struct lb_env *env) + + continue; + next: ++ if (p->sched_task_hot) ++ schedstat_inc(p->stats.nr_failed_migrations_hot); ++ + list_move(&p->se.group_node, tasks); + } + +-- +2.39.5 + diff --git a/queue-6.12/sched-fair-untangle-next_buddy-and-pick_next_task.patch b/queue-6.12/sched-fair-untangle-next_buddy-and-pick_next_task.patch new file mode 100644 index 0000000000..91a5cca8dd --- /dev/null +++ b/queue-6.12/sched-fair-untangle-next_buddy-and-pick_next_task.patch @@ -0,0 +1,66 @@ +From 97801350fdbd3d75665298936961c98bd9140e31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Nov 2024 11:15:41 +0100 +Subject: sched/fair: Untangle NEXT_BUDDY and pick_next_task() + +From: Peter Zijlstra + +[ Upstream commit 2a77e4be12cb58bbf774e7c717c8bb80e128b7a4 ] + +There are 3 sites using set_next_buddy() and only one is conditional +on NEXT_BUDDY, the other two sites are unconditional; to note: + + - yield_to_task() + - cgroup dequeue / pick optimization + +However, having NEXT_BUDDY control both the wakeup-preemption and the +picking side of things means its near useless. + +Fixes: 147f3efaa241 ("sched/fair: Implement an EEVDF-like scheduling policy") +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20241129101541.GA33464@noisy.programming.kicks-ass.net +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 4 ++-- + kernel/sched/features.h | 9 +++++++++ + 2 files changed, 11 insertions(+), 2 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 60be5f8bbe711..a21110b220b7b 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -5647,9 +5647,9 @@ static struct sched_entity * + pick_next_entity(struct rq *rq, struct cfs_rq *cfs_rq) + { + /* +- * Enabling NEXT_BUDDY will affect latency but not fairness. ++ * Picking the ->next buddy will affect latency but not fairness. + */ +- if (sched_feat(NEXT_BUDDY) && ++ if (sched_feat(PICK_BUDDY) && + cfs_rq->next && entity_eligible(cfs_rq, cfs_rq->next)) { + /* ->next will never be delayed */ + SCHED_WARN_ON(cfs_rq->next->sched_delayed); +diff --git a/kernel/sched/features.h b/kernel/sched/features.h +index 290874079f60d..050d7503064e3 100644 +--- a/kernel/sched/features.h ++++ b/kernel/sched/features.h +@@ -31,6 +31,15 @@ SCHED_FEAT(PREEMPT_SHORT, true) + */ + SCHED_FEAT(NEXT_BUDDY, false) + ++/* ++ * Allow completely ignoring cfs_rq->next; which can be set from various ++ * places: ++ * - NEXT_BUDDY (wakeup preemption) ++ * - yield_to_task() ++ * - cgroup dequeue / pick ++ */ ++SCHED_FEAT(PICK_BUDDY, true) ++ + /* + * Consider buddies to be cache hot, decreases the likeliness of a + * cache buddy being migrated away, increases cache locality. +-- +2.39.5 + diff --git a/queue-6.12/sched-fix-race-between-yield_to-and-try_to_wake_up.patch b/queue-6.12/sched-fix-race-between-yield_to-and-try_to_wake_up.patch new file mode 100644 index 0000000000..33deeb4336 --- /dev/null +++ b/queue-6.12/sched-fix-race-between-yield_to-and-try_to_wake_up.patch @@ -0,0 +1,58 @@ +From c5153f3a1555a9a0aacdb4d3e792a84ff32a6d02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Dec 2024 13:50:20 +0800 +Subject: sched: Fix race between yield_to() and try_to_wake_up() + +From: Tianchen Ding + +[ Upstream commit 5d808c78d97251af1d3a3e4f253e7d6c39fd871e ] + +We met a SCHED_WARN in set_next_buddy(): + __warn_printk + set_next_buddy + yield_to_task_fair + yield_to + kvm_vcpu_yield_to [kvm] + ... + +After a short dig, we found the rq_lock held by yield_to() may not +be exactly the rq that the target task belongs to. There is a race +window against try_to_wake_up(). + + CPU0 target_task + + blocking on CPU1 + lock rq0 & rq1 + double check task_rq == p_rq, ok + woken to CPU2 (lock task_pi & rq2) + task_rq = rq2 + yield_to_task_fair (w/o lock rq2) + +In this race window, yield_to() is operating the task w/o the correct +lock. Fix this by taking task pi_lock first. + +Fixes: d95f41220065 ("sched: Add yield_to(task, preempt) functionality") +Signed-off-by: Tianchen Ding +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20241231055020.6521-1-dtcccc@linux.alibaba.com +Signed-off-by: Sasha Levin +--- + kernel/sched/syscalls.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/sched/syscalls.c b/kernel/sched/syscalls.c +index 1784ed1fb3fe5..f9cb7896c1b96 100644 +--- a/kernel/sched/syscalls.c ++++ b/kernel/sched/syscalls.c +@@ -1471,7 +1471,7 @@ int __sched yield_to(struct task_struct *p, bool preempt) + struct rq *rq, *p_rq; + int yielded = 0; + +- scoped_guard (irqsave) { ++ scoped_guard (raw_spinlock_irqsave, &p->pi_lock) { + rq = this_rq(); + + again: +-- +2.39.5 + diff --git a/queue-6.12/sched-psi-pass-enqueue-dequeue-flags-to-psi-callback.patch b/queue-6.12/sched-psi-pass-enqueue-dequeue-flags-to-psi-callback.patch new file mode 100644 index 0000000000..52af843491 --- /dev/null +++ b/queue-6.12/sched-psi-pass-enqueue-dequeue-flags-to-psi-callback.patch @@ -0,0 +1,212 @@ +From 659ce67bfe8a6d5ff97a5a7061c3631f4eaf8c00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Oct 2024 10:43:58 -0400 +Subject: sched: psi: pass enqueue/dequeue flags to psi callbacks directly + +From: Johannes Weiner + +[ Upstream commit 1a6151017ee5a30cb2d959f110ab18fc49646467 ] + +What psi needs to do on each enqueue and dequeue has gotten more +subtle, and the generic sched code trying to distill this into a bool +for the callbacks is awkward. + +Pass the flags directly and let psi parse them. For that to work, the +#include "stats.h" (which has the psi callback implementations) needs +to be below the flag definitions in "sched.h". Move that section +further down, next to some of the other accounting stuff. + +This also puts the ENQUEUE_SAVE/RESTORE branch behind the psi jump +label, slightly reducing overhead when PSI=y but runtime disabled. + +Suggested-by: Peter Zijlstra +Signed-off-by: Johannes Weiner +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20241014144358.GB1021@cmpxchg.org +Stable-dep-of: 7d9da040575b ("psi: Fix race when task wakes up before psi_sched_switch() adjusts flags") +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 12 +++++----- + kernel/sched/sched.h | 56 ++++++++++++++++++++++---------------------- + kernel/sched/stats.h | 29 +++++++++++++++-------- + 3 files changed, 53 insertions(+), 44 deletions(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index d794d9bb429fd..c1d2d46feec50 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -2024,10 +2024,10 @@ void enqueue_task(struct rq *rq, struct task_struct *p, int flags) + */ + uclamp_rq_inc(rq, p); + +- if (!(flags & ENQUEUE_RESTORE)) { ++ psi_enqueue(p, flags); ++ ++ if (!(flags & ENQUEUE_RESTORE)) + sched_info_enqueue(rq, p); +- psi_enqueue(p, flags & ENQUEUE_MIGRATED); +- } + + if (sched_core_enabled(rq)) + sched_core_enqueue(rq, p); +@@ -2044,10 +2044,10 @@ inline bool dequeue_task(struct rq *rq, struct task_struct *p, int flags) + if (!(flags & DEQUEUE_NOCLOCK)) + update_rq_clock(rq); + +- if (!(flags & DEQUEUE_SAVE)) { ++ if (!(flags & DEQUEUE_SAVE)) + sched_info_dequeue(rq, p); +- psi_dequeue(p, !(flags & DEQUEUE_SLEEP)); +- } ++ ++ psi_dequeue(p, flags); + + /* + * Must be before ->dequeue_task() because ->dequeue_task() can 'fail' +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index f2ef520513c4a..5426969cf478a 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -2095,34 +2095,6 @@ static inline const struct cpumask *task_user_cpus(struct task_struct *p) + + #endif /* CONFIG_SMP */ + +-#include "stats.h" +- +-#if defined(CONFIG_SCHED_CORE) && defined(CONFIG_SCHEDSTATS) +- +-extern void __sched_core_account_forceidle(struct rq *rq); +- +-static inline void sched_core_account_forceidle(struct rq *rq) +-{ +- if (schedstat_enabled()) +- __sched_core_account_forceidle(rq); +-} +- +-extern void __sched_core_tick(struct rq *rq); +- +-static inline void sched_core_tick(struct rq *rq) +-{ +- if (sched_core_enabled(rq) && schedstat_enabled()) +- __sched_core_tick(rq); +-} +- +-#else /* !(CONFIG_SCHED_CORE && CONFIG_SCHEDSTATS): */ +- +-static inline void sched_core_account_forceidle(struct rq *rq) { } +- +-static inline void sched_core_tick(struct rq *rq) { } +- +-#endif /* !(CONFIG_SCHED_CORE && CONFIG_SCHEDSTATS) */ +- + #ifdef CONFIG_CGROUP_SCHED + + /* +@@ -3209,6 +3181,34 @@ extern void nohz_run_idle_balance(int cpu); + static inline void nohz_run_idle_balance(int cpu) { } + #endif + ++#include "stats.h" ++ ++#if defined(CONFIG_SCHED_CORE) && defined(CONFIG_SCHEDSTATS) ++ ++extern void __sched_core_account_forceidle(struct rq *rq); ++ ++static inline void sched_core_account_forceidle(struct rq *rq) ++{ ++ if (schedstat_enabled()) ++ __sched_core_account_forceidle(rq); ++} ++ ++extern void __sched_core_tick(struct rq *rq); ++ ++static inline void sched_core_tick(struct rq *rq) ++{ ++ if (sched_core_enabled(rq) && schedstat_enabled()) ++ __sched_core_tick(rq); ++} ++ ++#else /* !(CONFIG_SCHED_CORE && CONFIG_SCHEDSTATS): */ ++ ++static inline void sched_core_account_forceidle(struct rq *rq) { } ++ ++static inline void sched_core_tick(struct rq *rq) { } ++ ++#endif /* !(CONFIG_SCHED_CORE && CONFIG_SCHEDSTATS) */ ++ + #ifdef CONFIG_IRQ_TIME_ACCOUNTING + + struct irqtime { +diff --git a/kernel/sched/stats.h b/kernel/sched/stats.h +index 767e098a3bd13..8ee0add5a48a8 100644 +--- a/kernel/sched/stats.h ++++ b/kernel/sched/stats.h +@@ -127,21 +127,25 @@ static inline void psi_account_irqtime(struct rq *rq, struct task_struct *curr, + * go through migration requeues. In this case, *sleeping* states need + * to be transferred. + */ +-static inline void psi_enqueue(struct task_struct *p, bool migrate) ++static inline void psi_enqueue(struct task_struct *p, int flags) + { + int clear = 0, set = 0; + + if (static_branch_likely(&psi_disabled)) + return; + ++ /* Same runqueue, nothing changed for psi */ ++ if (flags & ENQUEUE_RESTORE) ++ return; ++ + if (p->se.sched_delayed) { + /* CPU migration of "sleeping" task */ +- SCHED_WARN_ON(!migrate); ++ SCHED_WARN_ON(!(flags & ENQUEUE_MIGRATED)); + if (p->in_memstall) + set |= TSK_MEMSTALL; + if (p->in_iowait) + set |= TSK_IOWAIT; +- } else if (migrate) { ++ } else if (flags & ENQUEUE_MIGRATED) { + /* CPU migration of runnable task */ + set = TSK_RUNNING; + if (p->in_memstall) +@@ -158,17 +162,14 @@ static inline void psi_enqueue(struct task_struct *p, bool migrate) + psi_task_change(p, clear, set); + } + +-static inline void psi_dequeue(struct task_struct *p, bool migrate) ++static inline void psi_dequeue(struct task_struct *p, int flags) + { + if (static_branch_likely(&psi_disabled)) + return; + +- /* +- * When migrating a task to another CPU, clear all psi +- * state. The enqueue callback above will work it out. +- */ +- if (migrate) +- psi_task_change(p, p->psi_flags, 0); ++ /* Same runqueue, nothing changed for psi */ ++ if (flags & DEQUEUE_SAVE) ++ return; + + /* + * A voluntary sleep is a dequeue followed by a task switch. To +@@ -176,6 +177,14 @@ static inline void psi_dequeue(struct task_struct *p, bool migrate) + * TSK_RUNNING and TSK_IOWAIT for us when it moves TSK_ONCPU. + * Do nothing here. + */ ++ if (flags & DEQUEUE_SLEEP) ++ return; ++ ++ /* ++ * When migrating a task to another CPU, clear all psi ++ * state. The enqueue callback above will work it out. ++ */ ++ psi_task_change(p, p->psi_flags, 0); + } + + static inline void psi_ttwu_dequeue(struct task_struct *p) +-- +2.39.5 + diff --git a/queue-6.12/sched-split-out-__schedule-deactivate-task-logic-int.patch b/queue-6.12/sched-split-out-__schedule-deactivate-task-logic-int.patch new file mode 100644 index 0000000000..1a72a6d312 --- /dev/null +++ b/queue-6.12/sched-split-out-__schedule-deactivate-task-logic-int.patch @@ -0,0 +1,113 @@ +From 6f338f38b1075ce5b946a5ae8ace08613137d522 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2024 16:53:39 -0700 +Subject: sched: Split out __schedule() deactivate task logic into a helper + +From: John Stultz + +[ Upstream commit 7b3d61f6578ab06f130ecc13cd2f3010a6c295bb ] + +As we're going to re-use the deactivation logic, +split it into a helper. + +Signed-off-by: John Stultz +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Metin Kaya +Reviewed-by: Qais Yousef +Tested-by: K Prateek Nayak +Tested-by: Metin Kaya +Link: https://lore.kernel.org/r/20241009235352.1614323-7-jstultz@google.com +Stable-dep-of: 7d9da040575b ("psi: Fix race when task wakes up before psi_sched_switch() adjusts flags") +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 67 +++++++++++++++++++++++++++------------------ + 1 file changed, 40 insertions(+), 27 deletions(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index d07dc87787dff..d794d9bb429fd 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -6507,6 +6507,45 @@ pick_next_task(struct rq *rq, struct task_struct *prev, struct rq_flags *rf) + #define SM_PREEMPT 1 + #define SM_RTLOCK_WAIT 2 + ++/* ++ * Helper function for __schedule() ++ * ++ * If a task does not have signals pending, deactivate it ++ * Otherwise marks the task's __state as RUNNING ++ */ ++static bool try_to_block_task(struct rq *rq, struct task_struct *p, ++ unsigned long task_state) ++{ ++ int flags = DEQUEUE_NOCLOCK; ++ ++ if (signal_pending_state(task_state, p)) { ++ WRITE_ONCE(p->__state, TASK_RUNNING); ++ return false; ++ } ++ ++ p->sched_contributes_to_load = ++ (task_state & TASK_UNINTERRUPTIBLE) && ++ !(task_state & TASK_NOLOAD) && ++ !(task_state & TASK_FROZEN); ++ ++ if (unlikely(is_special_task_state(task_state))) ++ flags |= DEQUEUE_SPECIAL; ++ ++ /* ++ * __schedule() ttwu() ++ * prev_state = prev->state; if (p->on_rq && ...) ++ * if (prev_state) goto out; ++ * p->on_rq = 0; smp_acquire__after_ctrl_dep(); ++ * p->state = TASK_WAKING ++ * ++ * Where __schedule() and ttwu() have matching control dependencies. ++ * ++ * After this, schedule() must not care about p->state any more. ++ */ ++ block_task(rq, p, flags); ++ return true; ++} ++ + /* + * __schedule() is the main scheduler function. + * +@@ -6615,33 +6654,7 @@ static void __sched notrace __schedule(int sched_mode) + goto picked; + } + } else if (!preempt && prev_state) { +- if (signal_pending_state(prev_state, prev)) { +- WRITE_ONCE(prev->__state, TASK_RUNNING); +- } else { +- int flags = DEQUEUE_NOCLOCK; +- +- prev->sched_contributes_to_load = +- (prev_state & TASK_UNINTERRUPTIBLE) && +- !(prev_state & TASK_NOLOAD) && +- !(prev_state & TASK_FROZEN); +- +- if (unlikely(is_special_task_state(prev_state))) +- flags |= DEQUEUE_SPECIAL; +- +- /* +- * __schedule() ttwu() +- * prev_state = prev->state; if (p->on_rq && ...) +- * if (prev_state) goto out; +- * p->on_rq = 0; smp_acquire__after_ctrl_dep(); +- * p->state = TASK_WAKING +- * +- * Where __schedule() and ttwu() have matching control dependencies. +- * +- * After this, schedule() must not care about p->state any more. +- */ +- block_task(rq, prev, flags); +- block = true; +- } ++ block = try_to_block_task(rq, prev, prev_state); + switch_count = &prev->nvcsw; + } + +-- +2.39.5 + diff --git a/queue-6.12/scsi-mpi3mr-fix-possible-crash-when-setting-up-bsg-f.patch b/queue-6.12/scsi-mpi3mr-fix-possible-crash-when-setting-up-bsg-f.patch new file mode 100644 index 0000000000..4ba00c22ba --- /dev/null +++ b/queue-6.12/scsi-mpi3mr-fix-possible-crash-when-setting-up-bsg-f.patch @@ -0,0 +1,73 @@ +From 8e74adcb744f00224fe616e6f75db93f167e7b46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jan 2025 10:20:32 +0800 +Subject: scsi: mpi3mr: Fix possible crash when setting up bsg fails + +From: Guixin Liu + +[ Upstream commit 295006f6e8c17212d3098811166e29627d19e05c ] + +If bsg_setup_queue() fails, the bsg_queue is assigned a non-NULL value. +Consequently, in mpi3mr_bsg_exit(), the condition "if(!mrioc->bsg_queue)" +will not be satisfied, preventing execution from entering +bsg_remove_queue(), which could lead to the following crash: + +BUG: kernel NULL pointer dereference, address: 000000000000041c +Call Trace: + + mpi3mr_bsg_exit+0x1f/0x50 [mpi3mr] + mpi3mr_remove+0x6f/0x340 [mpi3mr] + pci_device_remove+0x3f/0xb0 + device_release_driver_internal+0x19d/0x220 + unbind_store+0xa4/0xb0 + kernfs_fop_write_iter+0x11f/0x200 + vfs_write+0x1fc/0x3e0 + ksys_write+0x67/0xe0 + do_syscall_64+0x38/0x80 + entry_SYSCALL_64_after_hwframe+0x78/0xe2 + +Fixes: 4268fa751365 ("scsi: mpi3mr: Add bsg device support") +Signed-off-by: Guixin Liu +Link: https://lore.kernel.org/r/20250107022032.24006-1-kanie@linux.alibaba.com +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpi3mr/mpi3mr_app.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/mpi3mr/mpi3mr_app.c b/drivers/scsi/mpi3mr/mpi3mr_app.c +index 10b8e4dc64f8b..7589f48aebc80 100644 +--- a/drivers/scsi/mpi3mr/mpi3mr_app.c ++++ b/drivers/scsi/mpi3mr/mpi3mr_app.c +@@ -2951,6 +2951,7 @@ void mpi3mr_bsg_init(struct mpi3mr_ioc *mrioc) + .max_hw_sectors = MPI3MR_MAX_APP_XFER_SECTORS, + .max_segments = MPI3MR_MAX_APP_XFER_SEGMENTS, + }; ++ struct request_queue *q; + + device_initialize(bsg_dev); + +@@ -2966,14 +2967,17 @@ void mpi3mr_bsg_init(struct mpi3mr_ioc *mrioc) + return; + } + +- mrioc->bsg_queue = bsg_setup_queue(bsg_dev, dev_name(bsg_dev), &lim, ++ q = bsg_setup_queue(bsg_dev, dev_name(bsg_dev), &lim, + mpi3mr_bsg_request, NULL, 0); +- if (IS_ERR(mrioc->bsg_queue)) { ++ if (IS_ERR(q)) { + ioc_err(mrioc, "%s: bsg registration failed\n", + dev_name(bsg_dev)); + device_del(bsg_dev); + put_device(bsg_dev); ++ return; + } ++ ++ mrioc->bsg_queue = q; + } + + /** +-- +2.39.5 + diff --git a/queue-6.12/scsi-mpt3sas-set-ioc-manu_pg11.eedptagmode-directly-.patch b/queue-6.12/scsi-mpt3sas-set-ioc-manu_pg11.eedptagmode-directly-.patch new file mode 100644 index 0000000000..9c3cc83156 --- /dev/null +++ b/queue-6.12/scsi-mpt3sas-set-ioc-manu_pg11.eedptagmode-directly-.patch @@ -0,0 +1,46 @@ +From 689b03ada4fdace3dac5914cf23c58d5ec87f2c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Dec 2024 23:18:12 +0100 +Subject: scsi: mpt3sas: Set ioc->manu_pg11.EEDPTagMode directly to 1 + +From: Paul Menzel + +[ Upstream commit ad7c3c0cb8f61d6d5a48b83e62ca4a9fd2f26153 ] + +Currently, the code does: + + if (x == 0) { + x &= ~0x3; + x |= 0x1; + } + +Zeroing bits 0 and 1 of a variable that is 0 is not necessary. So directly +set the variable to 1. + +Cc: Sreekanth Reddy +Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") +Signed-off-by: Paul Menzel +Link: https://lore.kernel.org/r/20241212221817.78940-2-pmenzel@molgen.mpg.de +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index 16ac2267c71e1..c1d8f2c91a5e5 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -5629,8 +5629,7 @@ _base_static_config_pages(struct MPT3SAS_ADAPTER *ioc) + if (!ioc->is_gen35_ioc && ioc->manu_pg11.EEDPTagMode == 0) { + pr_err("%s: overriding NVDATA EEDPTagMode setting\n", + ioc->name); +- ioc->manu_pg11.EEDPTagMode &= ~0x3; +- ioc->manu_pg11.EEDPTagMode |= 0x1; ++ ioc->manu_pg11.EEDPTagMode = 0x1; + mpt3sas_config_set_manufacturing_pg11(ioc, &mpi_reply, + &ioc->manu_pg11); + } +-- +2.39.5 + diff --git a/queue-6.12/scsi-ufs-bsg-delete-bsg_dev-when-setting-up-bsg-fail.patch b/queue-6.12/scsi-ufs-bsg-delete-bsg_dev-when-setting-up-bsg-fail.patch new file mode 100644 index 0000000000..2ab8a27e0c --- /dev/null +++ b/queue-6.12/scsi-ufs-bsg-delete-bsg_dev-when-setting-up-bsg-fail.patch @@ -0,0 +1,37 @@ +From 1c2f9b83ba98c38c79ac45899bf3d0903b005f7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Dec 2024 09:42:13 +0800 +Subject: scsi: ufs: bsg: Delete bsg_dev when setting up bsg fails + +From: Guixin Liu + +[ Upstream commit fcf247deb3c3e1c6be5774e3fa03bbd018eff1a9 ] + +We should remove the bsg device when bsg_setup_queue() fails to release the +resources. + +Fixes: df032bf27a41 ("scsi: ufs: Add a bsg endpoint that supports UPIUs") +Signed-off-by: Guixin Liu +Link: https://lore.kernel.org/r/20241218014214.64533-2-kanie@linux.alibaba.com +Reviewed-by: Avri Altman +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufs_bsg.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c +index 6c09d97ae0065..58023f735c195 100644 +--- a/drivers/ufs/core/ufs_bsg.c ++++ b/drivers/ufs/core/ufs_bsg.c +@@ -257,6 +257,7 @@ int ufs_bsg_probe(struct ufs_hba *hba) + NULL, 0); + if (IS_ERR(q)) { + ret = PTR_ERR(q); ++ device_del(bsg_dev); + goto out; + } + +-- +2.39.5 + diff --git a/queue-6.12/select-fix-unbalanced-user_access_end.patch b/queue-6.12/select-fix-unbalanced-user_access_end.patch new file mode 100644 index 0000000000..c80a303eae --- /dev/null +++ b/queue-6.12/select-fix-unbalanced-user_access_end.patch @@ -0,0 +1,56 @@ +From be3ec9cfdaf1afbc09232ab15be19590208626c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 09:37:24 +0100 +Subject: select: Fix unbalanced user_access_end() + +From: Christophe Leroy + +[ Upstream commit 344af27715ddbf357cf76978d674428b88f8e92d ] + +While working on implementing user access validation on powerpc +I got the following warnings on a pmac32_defconfig build: + + CC fs/select.o + fs/select.o: warning: objtool: sys_pselect6+0x1bc: redundant UACCESS disable + fs/select.o: warning: objtool: sys_pselect6_time32+0x1bc: redundant UACCESS disable + +On powerpc/32s, user_read_access_begin/end() are no-ops, but the +failure path has a user_access_end() instead of user_read_access_end() +which means an access end without any prior access begin. + +Replace that user_access_end() by user_read_access_end(). + +Fixes: 7e71609f64ec ("pselect6() and friends: take handling the combined 6th/7th args into helper") +Signed-off-by: Christophe Leroy +Link: https://lore.kernel.org/r/a7139e28d767a13e667ee3c79599a8047222ef36.1736751221.git.christophe.leroy@csgroup.eu +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/select.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/select.c b/fs/select.c +index a77907faf2b45..834f438296e2b 100644 +--- a/fs/select.c ++++ b/fs/select.c +@@ -787,7 +787,7 @@ static inline int get_sigset_argpack(struct sigset_argpack *to, + } + return 0; + Efault: +- user_access_end(); ++ user_read_access_end(); + return -EFAULT; + } + +@@ -1361,7 +1361,7 @@ static inline int get_compat_sigset_argpack(struct compat_sigset_argpack *to, + } + return 0; + Efault: +- user_access_end(); ++ user_read_access_end(); + return -EFAULT; + } + +-- +2.39.5 + diff --git a/queue-6.12/selftests-bpf-actuate-tx_metadata_len-in-xdp_hw_meta.patch b/queue-6.12/selftests-bpf-actuate-tx_metadata_len-in-xdp_hw_meta.patch new file mode 100644 index 0000000000..eaebfeb8c4 --- /dev/null +++ b/queue-6.12/selftests-bpf-actuate-tx_metadata_len-in-xdp_hw_meta.patch @@ -0,0 +1,38 @@ +From 48941c98f117ffbdab8801aa6491d5a8b94e25b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 12:42:58 +0800 +Subject: selftests/bpf: Actuate tx_metadata_len in xdp_hw_metadata + +From: Song Yoong Siang + +[ Upstream commit 0bee36d1a51366fa57b731f8975f26f92943b43e ] + +set XDP_UMEM_TX_METADATA_LEN flag to reserve tx_metadata_len bytes of +per-chunk metadata. + +Fixes: d5e726d9143c ("xsk: Require XDP_UMEM_TX_METADATA_LEN to actuate tx_metadata_len") +Signed-off-by: Song Yoong Siang +Signed-off-by: Martin KaFai Lau +Acked-by: Stanislav Fomichev +Link: https://patch.msgid.link/20241205044258.3155799-1-yoong.siang.song@intel.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/xdp_hw_metadata.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/xdp_hw_metadata.c b/tools/testing/selftests/bpf/xdp_hw_metadata.c +index 6f9956eed797f..ad6c08dfd6c8c 100644 +--- a/tools/testing/selftests/bpf/xdp_hw_metadata.c ++++ b/tools/testing/selftests/bpf/xdp_hw_metadata.c +@@ -79,7 +79,7 @@ static int open_xsk(int ifindex, struct xsk *xsk, __u32 queue_id) + .fill_size = XSK_RING_PROD__DEFAULT_NUM_DESCS, + .comp_size = XSK_RING_CONS__DEFAULT_NUM_DESCS, + .frame_size = XSK_UMEM__DEFAULT_FRAME_SIZE, +- .flags = XSK_UMEM__DEFAULT_FLAGS, ++ .flags = XDP_UMEM_TX_METADATA_LEN, + .tx_metadata_len = sizeof(struct xsk_tx_metadata), + }; + __u32 idx = 0; +-- +2.39.5 + diff --git a/queue-6.12/selftests-bpf-avoid-generating-untracked-files-when-.patch b/queue-6.12/selftests-bpf-avoid-generating-untracked-files-when-.patch new file mode 100644 index 0000000000..393437cfdb --- /dev/null +++ b/queue-6.12/selftests-bpf-avoid-generating-untracked-files-when-.patch @@ -0,0 +1,77 @@ +From 489f53f7944ca418c0bee32d577e89f6c5ba9fba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 15:59:57 +0800 +Subject: selftests/bpf: Avoid generating untracked files when running bpf + selftests + +From: Jiayuan Chen + +[ Upstream commit 73b9075f334f5debf28646884a320b796b27768d ] + +Currently, when we run the BPF selftests with the following command: + + make -C tools/testing/selftests TARGETS=bpf SKIP_TARGETS="" + +The command generates untracked files and directories with make version +less than 4.4: + +''' +Untracked files: + (use "git add ..." to include in what will be committed) + tools/testing/selftests/bpfFEATURE-DUMP.selftests + tools/testing/selftests/bpffeature/ +''' + +We lost slash after word "bpf". The reason is slash appending code is as +follow: + +''' +OUTPUT := $(OUTPUT)/ +$(eval include ../../../build/Makefile.feature) +OUTPUT := $(patsubst %/,%,$(OUTPUT)) +''' + +This way of assigning values to OUTPUT will never be effective for the +variable OUTPUT provided via the command argument [1] and BPF makefile +is called from parent Makfile(tools/testing/selftests/Makefile) like: + +''' +all: + ... + $(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET +''' + +According to GNU make, we can use override Directive to fix this issue [2]. + + [1] https://www.gnu.org/software/make/manual/make.html#Overriding + [2] https://www.gnu.org/software/make/manual/make.html#Override-Directive + +Fixes: dc3a8804d790 ("selftests/bpf: Adapt OUTPUT appending logic to lower versions of Make") +Signed-off-by: Jiayuan Chen +Signed-off-by: Daniel Borkmann +Acked-by: Jiri Olsa +Link: https://lore.kernel.org/bpf/20241224075957.288018-1-mrpre@163.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile +index 43a0293184785..6fc29996ae293 100644 +--- a/tools/testing/selftests/bpf/Makefile ++++ b/tools/testing/selftests/bpf/Makefile +@@ -193,9 +193,9 @@ ifeq ($(shell expr $(MAKE_VERSION) \>= 4.4), 1) + $(let OUTPUT,$(OUTPUT)/,\ + $(eval include ../../../build/Makefile.feature)) + else +-OUTPUT := $(OUTPUT)/ ++override OUTPUT := $(OUTPUT)/ + $(eval include ../../../build/Makefile.feature) +-OUTPUT := $(patsubst %/,%,$(OUTPUT)) ++override OUTPUT := $(patsubst %/,%,$(OUTPUT)) + endif + endif + +-- +2.39.5 + diff --git a/queue-6.12/selftests-bpf-fix-btf-leak-on-new-btf-alloc-failure-.patch b/queue-6.12/selftests-bpf-fix-btf-leak-on-new-btf-alloc-failure-.patch new file mode 100644 index 0000000000..a35a77ae5e --- /dev/null +++ b/queue-6.12/selftests-bpf-fix-btf-leak-on-new-btf-alloc-failure-.patch @@ -0,0 +1,46 @@ +From e70a5c3c9e28336d43dfc62e8af173b86cc5ee28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 10:02:38 +0000 +Subject: selftests/bpf: Fix btf leak on new btf alloc failure in btf_distill + test + +From: Pu Lehui + +[ Upstream commit 4a04cb326a6c7f9a2c066f8c2ca78a5a9b87ddab ] + +Fix btf leak on new btf alloc failure in btf_distill test. + +Fixes: affdeb50616b ("selftests/bpf: Extend distilled BTF tests to cover BTF relocation") +Signed-off-by: Pu Lehui +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250115100241.4171581-1-pulehui@huaweicloud.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/btf_distill.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/btf_distill.c b/tools/testing/selftests/bpf/prog_tests/btf_distill.c +index ca84726d5ac1b..b72b966df77b9 100644 +--- a/tools/testing/selftests/bpf/prog_tests/btf_distill.c ++++ b/tools/testing/selftests/bpf/prog_tests/btf_distill.c +@@ -385,7 +385,7 @@ static void test_distilled_base_missing_err(void) + "[2] INT 'int' size=8 bits_offset=0 nr_bits=64 encoding=SIGNED"); + btf5 = btf__new_empty(); + if (!ASSERT_OK_PTR(btf5, "empty_reloc_btf")) +- return; ++ goto cleanup; + btf__add_int(btf5, "int", 4, BTF_INT_SIGNED); /* [1] int */ + VALIDATE_RAW_BTF( + btf5, +@@ -478,7 +478,7 @@ static void test_distilled_base_multi_err2(void) + "[1] INT 'int' size=4 bits_offset=0 nr_bits=32 encoding=SIGNED"); + btf5 = btf__new_empty(); + if (!ASSERT_OK_PTR(btf5, "empty_reloc_btf")) +- return; ++ goto cleanup; + btf__add_int(btf5, "int", 4, BTF_INT_SIGNED); /* [1] int */ + btf__add_int(btf5, "int", 4, BTF_INT_SIGNED); /* [2] int */ + VALIDATE_RAW_BTF( +-- +2.39.5 + diff --git a/queue-6.12/selftests-bpf-fix-fill_link_info-selftest-on-powerpc.patch b/queue-6.12/selftests-bpf-fix-fill_link_info-selftest-on-powerpc.patch new file mode 100644 index 0000000000..6e988bef91 --- /dev/null +++ b/queue-6.12/selftests-bpf-fix-fill_link_info-selftest-on-powerpc.patch @@ -0,0 +1,98 @@ +From 376d7364393db195303039d48ab233c78d92f63a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Dec 2024 12:27:20 +0530 +Subject: selftests/bpf: Fix fill_link_info selftest on powerpc + +From: Saket Kumar Bhaskar + +[ Upstream commit 4d33dc1bc31df80356c49e40dbd3ddff19500bcb ] + +With CONFIG_KPROBES_ON_FTRACE enabled on powerpc, ftrace_location_range +returns ftrace location for bpf_fentry_test1 at offset of 4 bytes from +function entry. This is because branch to _mcount function is at offset +of 4 bytes in function profile sequence. + +To fix this, add entry_offset of 4 bytes while verifying the address for +kprobe entry address of bpf_fentry_test1 in verify_perf_link_info in +selftest, when CONFIG_KPROBES_ON_FTRACE is enabled. + +Disassemble of bpf_fentry_test1: + +c000000000e4b080 : +c000000000e4b080: a6 02 08 7c mflr r0 +c000000000e4b084: b9 e2 22 4b bl c00000000007933c <_mcount> +c000000000e4b088: 01 00 63 38 addi r3,r3,1 +c000000000e4b08c: b4 07 63 7c extsw r3,r3 +c000000000e4b090: 20 00 80 4e blr + +When CONFIG_PPC_FTRACE_OUT_OF_LINE [1] is enabled, these function profile +sequence is moved out of line with an unconditional branch at offset 0. +So, the test works without altering the offset for +'CONFIG_KPROBES_ON_FTRACE && CONFIG_PPC_FTRACE_OUT_OF_LINE' case. + +Disassemble of bpf_fentry_test1: + +c000000000f95190 : +c000000000f95190: 00 00 00 60 nop +c000000000f95194: 01 00 63 38 addi r3,r3,1 +c000000000f95198: b4 07 63 7c extsw r3,r3 +c000000000f9519c: 20 00 80 4e blr + +[1] https://lore.kernel.org/all/20241030070850.1361304-13-hbathini@linux.ibm.com/ + +Fixes: 23cf7aa539dc ("selftests/bpf: Add selftest for fill_link_info") +Signed-off-by: Saket Kumar Bhaskar +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20241209065720.234344-1-skb99@linux.ibm.com +Signed-off-by: Sasha Levin +--- + .../selftests/bpf/prog_tests/fill_link_info.c | 4 ++++ + .../selftests/bpf/progs/test_fill_link_info.c | 13 ++++++++++--- + 2 files changed, 14 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/fill_link_info.c b/tools/testing/selftests/bpf/prog_tests/fill_link_info.c +index d50cbd8040d45..e59af2aa66016 100644 +--- a/tools/testing/selftests/bpf/prog_tests/fill_link_info.c ++++ b/tools/testing/selftests/bpf/prog_tests/fill_link_info.c +@@ -171,6 +171,10 @@ static void test_kprobe_fill_link_info(struct test_fill_link_info *skel, + /* See also arch_adjust_kprobe_addr(). */ + if (skel->kconfig->CONFIG_X86_KERNEL_IBT) + entry_offset = 4; ++ if (skel->kconfig->CONFIG_PPC64 && ++ skel->kconfig->CONFIG_KPROBES_ON_FTRACE && ++ !skel->kconfig->CONFIG_PPC_FTRACE_OUT_OF_LINE) ++ entry_offset = 4; + err = verify_perf_link_info(link_fd, type, kprobe_addr, 0, entry_offset); + ASSERT_OK(err, "verify_perf_link_info"); + } else { +diff --git a/tools/testing/selftests/bpf/progs/test_fill_link_info.c b/tools/testing/selftests/bpf/progs/test_fill_link_info.c +index 6afa834756e9f..fac33a14f2009 100644 +--- a/tools/testing/selftests/bpf/progs/test_fill_link_info.c ++++ b/tools/testing/selftests/bpf/progs/test_fill_link_info.c +@@ -6,13 +6,20 @@ + #include + + extern bool CONFIG_X86_KERNEL_IBT __kconfig __weak; ++extern bool CONFIG_PPC_FTRACE_OUT_OF_LINE __kconfig __weak; ++extern bool CONFIG_KPROBES_ON_FTRACE __kconfig __weak; ++extern bool CONFIG_PPC64 __kconfig __weak; + +-/* This function is here to have CONFIG_X86_KERNEL_IBT +- * used and added to object BTF. ++/* This function is here to have CONFIG_X86_KERNEL_IBT, ++ * CONFIG_PPC_FTRACE_OUT_OF_LINE, CONFIG_KPROBES_ON_FTRACE, ++ * CONFIG_PPC6 used and added to object BTF. + */ + int unused(void) + { +- return CONFIG_X86_KERNEL_IBT ? 0 : 1; ++ return CONFIG_X86_KERNEL_IBT || ++ CONFIG_PPC_FTRACE_OUT_OF_LINE || ++ CONFIG_KPROBES_ON_FTRACE || ++ CONFIG_PPC64 ? 0 : 1; + } + + SEC("kprobe") +-- +2.39.5 + diff --git a/queue-6.12/selftests-harness-fix-printing-of-mismatch-values-in.patch b/queue-6.12/selftests-harness-fix-printing-of-mismatch-values-in.patch new file mode 100644 index 0000000000..7fe5ffad74 --- /dev/null +++ b/queue-6.12/selftests-harness-fix-printing-of-mismatch-values-in.patch @@ -0,0 +1,83 @@ +From 86bbe8f62a6dc425a4177d9389841d5e22f588da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 19:07:57 +0200 +Subject: selftests: harness: fix printing of mismatch values in __EXPECT() + +From: Dmitry V. Levin + +[ Upstream commit 02bc220dc6dc7c56edc4859bc5dd2c08b95d5fb5 ] + +intptr_t and uintptr_t are not big enough types on 32-bit architectures +when printing 64-bit values, resulting to the following incorrect +diagnostic output: + + # get_syscall_info.c:209:get_syscall_info:Expected exp_args[2] (3134324433) == info.entry.args[1] (3134324433) + +Replace intptr_t and uintptr_t with intmax_t and uintmax_t, respectively. +With this fix, the same test produces more usable diagnostic output: + + # get_syscall_info.c:209:get_syscall_info:Expected exp_args[2] (3134324433) == info.entry.args[1] (18446744072548908753) + +Link: https://lore.kernel.org/r/20250108170757.GA6723@strace.io +Fixes: b5bb6d3068ea ("selftests/seccomp: fix 32-bit build warnings") +Signed-off-by: Dmitry V. Levin +Reviewed-by: Kees Cook +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kselftest_harness.h | 24 ++++++++++----------- + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/tools/testing/selftests/kselftest_harness.h b/tools/testing/selftests/kselftest_harness.h +index a5a72415e37b0..666c9fde76da9 100644 +--- a/tools/testing/selftests/kselftest_harness.h ++++ b/tools/testing/selftests/kselftest_harness.h +@@ -760,33 +760,33 @@ + /* Report with actual signedness to avoid weird output. */ \ + switch (is_signed_type(__exp) * 2 + is_signed_type(__seen)) { \ + case 0: { \ +- unsigned long long __exp_print = (uintptr_t)__exp; \ +- unsigned long long __seen_print = (uintptr_t)__seen; \ +- __TH_LOG("Expected %s (%llu) %s %s (%llu)", \ ++ uintmax_t __exp_print = (uintmax_t)__exp; \ ++ uintmax_t __seen_print = (uintmax_t)__seen; \ ++ __TH_LOG("Expected %s (%ju) %s %s (%ju)", \ + _expected_str, __exp_print, #_t, \ + _seen_str, __seen_print); \ + break; \ + } \ + case 1: { \ +- unsigned long long __exp_print = (uintptr_t)__exp; \ +- long long __seen_print = (intptr_t)__seen; \ +- __TH_LOG("Expected %s (%llu) %s %s (%lld)", \ ++ uintmax_t __exp_print = (uintmax_t)__exp; \ ++ intmax_t __seen_print = (intmax_t)__seen; \ ++ __TH_LOG("Expected %s (%ju) %s %s (%jd)", \ + _expected_str, __exp_print, #_t, \ + _seen_str, __seen_print); \ + break; \ + } \ + case 2: { \ +- long long __exp_print = (intptr_t)__exp; \ +- unsigned long long __seen_print = (uintptr_t)__seen; \ +- __TH_LOG("Expected %s (%lld) %s %s (%llu)", \ ++ intmax_t __exp_print = (intmax_t)__exp; \ ++ uintmax_t __seen_print = (uintmax_t)__seen; \ ++ __TH_LOG("Expected %s (%jd) %s %s (%ju)", \ + _expected_str, __exp_print, #_t, \ + _seen_str, __seen_print); \ + break; \ + } \ + case 3: { \ +- long long __exp_print = (intptr_t)__exp; \ +- long long __seen_print = (intptr_t)__seen; \ +- __TH_LOG("Expected %s (%lld) %s %s (%lld)", \ ++ intmax_t __exp_print = (intmax_t)__exp; \ ++ intmax_t __seen_print = (intmax_t)__seen; \ ++ __TH_LOG("Expected %s (%jd) %s %s (%jd)", \ + _expected_str, __exp_print, #_t, \ + _seen_str, __seen_print); \ + break; \ +-- +2.39.5 + diff --git a/queue-6.12/selftests-ktap_helpers-fix-uninitialized-variable.patch b/queue-6.12/selftests-ktap_helpers-fix-uninitialized-variable.patch new file mode 100644 index 0000000000..cbd77e31d2 --- /dev/null +++ b/queue-6.12/selftests-ktap_helpers-fix-uninitialized-variable.patch @@ -0,0 +1,50 @@ +From 99ae64fb1be6f869994963345bf43fe33893c066 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Dec 2024 18:42:21 +0100 +Subject: selftests: ktap_helpers: Fix uninitialized variable +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mickaël Salaün + +[ Upstream commit 3e707b07f582c12ed78fa5516a97bf701bf0634c ] + +__ktap_test() may be called without the optional third argument which is +an issue for scripts using `set -u` to detect uninitialized variables +and potential bugs. + +Fix this optional "directive" argument by either using the third +argument or an empty string. + +This is required for the next commit to properly test script execution +control. + +Cc: Kees Cook +Cc: Nícolas F. R. A. Prado +Cc: Shuah Khan +Fixes: 14571ab1ad21 ("kselftest: Add new test for detecting unprobed Devicetree devices") +Signed-off-by: Mickaël Salaün +Link: https://lore.kernel.org/r/20241212174223.389435-7-mic@digikod.net +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kselftest/ktap_helpers.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/kselftest/ktap_helpers.sh b/tools/testing/selftests/kselftest/ktap_helpers.sh +index 79a125eb24c2e..14e7f3ec3f84c 100644 +--- a/tools/testing/selftests/kselftest/ktap_helpers.sh ++++ b/tools/testing/selftests/kselftest/ktap_helpers.sh +@@ -40,7 +40,7 @@ ktap_skip_all() { + __ktap_test() { + result="$1" + description="$2" +- directive="$3" # optional ++ directive="${3:-}" # optional + + local directive_str= + [ ! -z "$directive" ] && directive_str="# $directive" +-- +2.39.5 + diff --git a/queue-6.12/selftests-landlock-fix-build-with-non-default-pthrea.patch b/queue-6.12/selftests-landlock-fix-build-with-non-default-pthrea.patch new file mode 100644 index 0000000000..c24f7479b9 --- /dev/null +++ b/queue-6.12/selftests-landlock-fix-build-with-non-default-pthrea.patch @@ -0,0 +1,46 @@ +From efc1590d172eac63d34e499e6df5c99cece57b4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 15:54:07 +0100 +Subject: selftests/landlock: Fix build with non-default pthread linking +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mickaël Salaün + +[ Upstream commit 0e4db4f843c2c0115b5981bd6f6b75dea62e7d60 ] + +Old toolchains require explicit -lpthread (e.g. on Debian 11). + +Cc: Nathan Chancellor +Cc: Tahera Fahimi +Fixes: c8994965013e ("selftests/landlock: Test signal scoping for threads") +Reviewed-by: Günther Noack +Link: https://lore.kernel.org/r/20250115145409.312226-1-mic@digikod.net +Signed-off-by: Mickaël Salaün +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/landlock/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/landlock/Makefile b/tools/testing/selftests/landlock/Makefile +index 348e2dbdb4e0b..480f13e77fcc4 100644 +--- a/tools/testing/selftests/landlock/Makefile ++++ b/tools/testing/selftests/landlock/Makefile +@@ -13,11 +13,11 @@ TEST_GEN_PROGS := $(src_test:.c=) + TEST_GEN_PROGS_EXTENDED := true + + # Short targets: +-$(TEST_GEN_PROGS): LDLIBS += -lcap ++$(TEST_GEN_PROGS): LDLIBS += -lcap -lpthread + $(TEST_GEN_PROGS_EXTENDED): LDFLAGS += -static + + include ../lib.mk + + # Targets with $(OUTPUT)/ prefix: +-$(TEST_GEN_PROGS): LDLIBS += -lcap ++$(TEST_GEN_PROGS): LDLIBS += -lcap -lpthread + $(TEST_GEN_PROGS_EXTENDED): LDFLAGS += -static +-- +2.39.5 + diff --git a/queue-6.12/selftests-landlock-fix-error-message.patch b/queue-6.12/selftests-landlock-fix-error-message.patch new file mode 100644 index 0000000000..b0b3862517 --- /dev/null +++ b/queue-6.12/selftests-landlock-fix-error-message.patch @@ -0,0 +1,41 @@ +From 442c09a67c1f05fe85be8c9f9809437e2b5cd4fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 16:43:28 +0100 +Subject: selftests/landlock: Fix error message +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mickaël Salaün + +[ Upstream commit 2107c35128ad751b201eb92fe91443450d9e5c37 ] + +The global variable errno may not be set in test_execute(). Do not use +it in related error message. + +Cc: Günther Noack +Fixes: e1199815b47b ("selftests/landlock: Add user space tests") +Link: https://lore.kernel.org/r/20250108154338.1129069-21-mic@digikod.net +Signed-off-by: Mickaël Salaün +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/landlock/fs_test.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c +index 6788762188fea..97d360eae4f69 100644 +--- a/tools/testing/selftests/landlock/fs_test.c ++++ b/tools/testing/selftests/landlock/fs_test.c +@@ -2003,8 +2003,7 @@ static void test_execute(struct __test_metadata *const _metadata, const int err, + ASSERT_EQ(1, WIFEXITED(status)); + ASSERT_EQ(err ? 2 : 0, WEXITSTATUS(status)) + { +- TH_LOG("Unexpected return code for \"%s\": %s", path, +- strerror(errno)); ++ TH_LOG("Unexpected return code for \"%s\"", path); + }; + } + +-- +2.39.5 + diff --git a/queue-6.12/selftests-mptcp-extend-cflags-to-keep-options-from-e.patch b/queue-6.12/selftests-mptcp-extend-cflags-to-keep-options-from-e.patch new file mode 100644 index 0000000000..e33b351aec --- /dev/null +++ b/queue-6.12/selftests-mptcp-extend-cflags-to-keep-options-from-e.patch @@ -0,0 +1,47 @@ +From b1cc33bb08cf3c1bd5a0ca34ba102b8c05047b18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jan 2025 09:35:42 +0100 +Subject: selftests: mptcp: extend CFLAGS to keep options from environment + +From: Jan Stancek + +[ Upstream commit 23b3a7c4a7583eac9e3976355928a832c87caa0f ] + +Package build environments like Fedora rpmbuild introduced hardening +options (e.g. -pie -Wl,-z,now) by passing a -spec option to CFLAGS +and LDFLAGS. + +mptcp Makefile currently overrides CFLAGS but not LDFLAGS, which leads +to a mismatch and build failure, for example: + make[1]: *** [../../lib.mk:222: tools/testing/selftests/net/mptcp/mptcp_sockopt] Error 1 + /usr/bin/ld: /tmp/ccqyMVdb.o: relocation R_X86_64_32 against `.rodata.str1.8' can not be used when making a PIE object; recompile with -fPIE + /usr/bin/ld: failed to set dynamic section sizes: bad value + collect2: error: ld returned 1 exit status + +Fixes: cc937dad85ae ("selftests: centralize -D_GNU_SOURCE= to CFLAGS in lib.mk") +Signed-off-by: Jan Stancek +Reviewed-by: Hangbin Liu +Reviewed-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/7abc701da9df39c2d6cd15bc3cf9e6cee445cb96.1737621162.git.jstancek@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/mptcp/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/net/mptcp/Makefile b/tools/testing/selftests/net/mptcp/Makefile +index 5d796622e7309..580610c46e5ae 100644 +--- a/tools/testing/selftests/net/mptcp/Makefile ++++ b/tools/testing/selftests/net/mptcp/Makefile +@@ -2,7 +2,7 @@ + + top_srcdir = ../../../../.. + +-CFLAGS = -Wall -Wl,--no-as-needed -O2 -g -I$(top_srcdir)/usr/include $(KHDR_INCLUDES) ++CFLAGS += -Wall -Wl,--no-as-needed -O2 -g -I$(top_srcdir)/usr/include $(KHDR_INCLUDES) + + TEST_PROGS := mptcp_connect.sh pm_netlink.sh mptcp_join.sh diag.sh \ + simult_flows.sh mptcp_sockopt.sh userspace_pm.sh +-- +2.39.5 + diff --git a/queue-6.12/selftests-net-lib-openvswitch-extend-cflags-to-keep-.patch b/queue-6.12/selftests-net-lib-openvswitch-extend-cflags-to-keep-.patch new file mode 100644 index 0000000000..d6a6493647 --- /dev/null +++ b/queue-6.12/selftests-net-lib-openvswitch-extend-cflags-to-keep-.patch @@ -0,0 +1,65 @@ +From cd1233638a90a93654149436c7c3a9ccc3d7e2e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jan 2025 13:38:51 +0100 +Subject: selftests: net/{lib,openvswitch}: extend CFLAGS to keep options from + environment + +From: Jan Stancek + +[ Upstream commit 9b06d5b956131bde535f5c045cf8c1ff6bfba76c ] + +Package build environments like Fedora rpmbuild introduced hardening +options (e.g. -pie -Wl,-z,now) by passing a -spec option to CFLAGS +and LDFLAGS. + +Some Makefiles currently override CFLAGS but not LDFLAGS, which leads +to a mismatch and build failure, for example: + /usr/bin/ld: /tmp/ccd2apay.o: relocation R_X86_64_32 against + `.rodata.str1.1' can not be used when making a PIE object; recompile with -fPIE + /usr/bin/ld: failed to set dynamic section sizes: bad value + collect2: error: ld returned 1 exit status + make[1]: *** [../../lib.mk:222: tools/testing/selftests/net/lib/csum] Error 1 + +openvswitch/Makefile CFLAGS currently do not appear to be used, but +fix it anyway for the case when new tests are introduced in future. + +Fixes: 1d0dc857b5d8 ("selftests: drv-net: add checksum tests") +Signed-off-by: Jan Stancek +Acked-by: Matthieu Baerts (NGI0) +Reviewed-by: Hangbin Liu +Link: https://patch.msgid.link/3d173603ee258f419d0403363765c9f9494ff79a.1737635092.git.jstancek@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/lib/Makefile | 2 +- + tools/testing/selftests/net/openvswitch/Makefile | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/net/lib/Makefile b/tools/testing/selftests/net/lib/Makefile +index 82c3264b115ee..704b88b6a8d2a 100644 +--- a/tools/testing/selftests/net/lib/Makefile ++++ b/tools/testing/selftests/net/lib/Makefile +@@ -1,6 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0 + +-CFLAGS = -Wall -Wl,--no-as-needed -O2 -g ++CFLAGS += -Wall -Wl,--no-as-needed -O2 -g + CFLAGS += -I../../../../../usr/include/ $(KHDR_INCLUDES) + # Additional include paths needed by kselftest.h + CFLAGS += -I../../ +diff --git a/tools/testing/selftests/net/openvswitch/Makefile b/tools/testing/selftests/net/openvswitch/Makefile +index 2f1508abc826b..3fd1da2ec07d5 100644 +--- a/tools/testing/selftests/net/openvswitch/Makefile ++++ b/tools/testing/selftests/net/openvswitch/Makefile +@@ -2,7 +2,7 @@ + + top_srcdir = ../../../../.. + +-CFLAGS = -Wall -Wl,--no-as-needed -O2 -g -I$(top_srcdir)/usr/include $(KHDR_INCLUDES) ++CFLAGS += -Wall -Wl,--no-as-needed -O2 -g -I$(top_srcdir)/usr/include $(KHDR_INCLUDES) + + TEST_PROGS := openvswitch.sh + +-- +2.39.5 + diff --git a/queue-6.12/selftests-powerpc-fix-argument-order-to-timer_sub.patch b/queue-6.12/selftests-powerpc-fix-argument-order-to-timer_sub.patch new file mode 100644 index 0000000000..ef1bd87717 --- /dev/null +++ b/queue-6.12/selftests-powerpc-fix-argument-order-to-timer_sub.patch @@ -0,0 +1,51 @@ +From 181f3f44431d7d91137e9ae1c9a0d088b8b6d1ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Dec 2024 22:43:47 +1100 +Subject: selftests/powerpc: Fix argument order to timer_sub() + +From: Michael Ellerman + +[ Upstream commit 2bf66e66d2e6feece6175ec09ec590a0a8563bdd ] + +Commit c814bf958926 ("powerpc/selftests: Use timersub() for +gettimeofday()"), got the order of arguments to timersub() wrong, +leading to a negative time delta being reported, eg: + + test: gettimeofday + tags: git_version:v6.12-rc5-409-gdddf291c3030 + time = -3.297781 + success: gettimeofday + +The correct order is minuend, subtrahend, which in this case is end, +start. Which gives: + + test: gettimeofday + tags: git_version:v6.12-rc5-409-gdddf291c3030-dirty + time = 3.300650 + success: gettimeofday + +Fixes: c814bf958926 ("powerpc/selftests: Use timersub() for gettimeofday()") +Signed-off-by: Michael Ellerman +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/20241218114347.428108-1-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/powerpc/benchmarks/gettimeofday.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/powerpc/benchmarks/gettimeofday.c b/tools/testing/selftests/powerpc/benchmarks/gettimeofday.c +index 580fcac0a09f3..b71ef8a493ed1 100644 +--- a/tools/testing/selftests/powerpc/benchmarks/gettimeofday.c ++++ b/tools/testing/selftests/powerpc/benchmarks/gettimeofday.c +@@ -20,7 +20,7 @@ static int test_gettimeofday(void) + gettimeofday(&tv_end, NULL); + } + +- timersub(&tv_start, &tv_end, &tv_diff); ++ timersub(&tv_end, &tv_start, &tv_diff); + + printf("time = %.6f\n", tv_diff.tv_sec + (tv_diff.tv_usec) * 1e-6); + +-- +2.39.5 + diff --git a/queue-6.12/selftests-timers-clocksource-switch-adapt-progress-t.patch b/queue-6.12/selftests-timers-clocksource-switch-adapt-progress-t.patch new file mode 100644 index 0000000000..bebc8280f1 --- /dev/null +++ b/queue-6.12/selftests-timers-clocksource-switch-adapt-progress-t.patch @@ -0,0 +1,52 @@ +From 5d62d6ed04c1ab947fda7db6117f8c6131dc6b34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Dec 2024 10:02:56 +0100 +Subject: selftests: timers: clocksource-switch: Adapt progress to kselftest + framework + +From: Geert Uytterhoeven + +[ Upstream commit 8694e6a7f7dba23d3abd9f5a96f64d161704c7b1 ] + +When adapting the test to the kselftest framework, a few printf() calls +indicating test progress were not updated. + +Fix this by replacing these printf() calls by ksft_print_msg() calls. + +Link: https://lore.kernel.org/r/7dd4b9ab6e43268846e250878ebf25ae6d3d01ce.1733994134.git.geert+renesas@glider.be +Fixes: ce7d101750ff ("selftests: timers: clocksource-switch: adapt to kselftest framework") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Thomas Gleixner +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/timers/clocksource-switch.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/timers/clocksource-switch.c b/tools/testing/selftests/timers/clocksource-switch.c +index c5264594064c8..83faa4e354e38 100644 +--- a/tools/testing/selftests/timers/clocksource-switch.c ++++ b/tools/testing/selftests/timers/clocksource-switch.c +@@ -156,8 +156,8 @@ int main(int argc, char **argv) + /* Check everything is sane before we start switching asynchronously */ + if (do_sanity_check) { + for (i = 0; i < count; i++) { +- printf("Validating clocksource %s\n", +- clocksource_list[i]); ++ ksft_print_msg("Validating clocksource %s\n", ++ clocksource_list[i]); + if (change_clocksource(clocksource_list[i])) { + status = -1; + goto out; +@@ -169,7 +169,7 @@ int main(int argc, char **argv) + } + } + +- printf("Running Asynchronous Switching Tests...\n"); ++ ksft_print_msg("Running Asynchronous Switching Tests...\n"); + pid = fork(); + if (!pid) + return run_tests(runtime); +-- +2.39.5 + diff --git a/queue-6.12/serial-8250-adjust-the-timeout-for-fifo-mode.patch b/queue-6.12/serial-8250-adjust-the-timeout-for-fifo-mode.patch new file mode 100644 index 0000000000..00b67bcb8a --- /dev/null +++ b/queue-6.12/serial-8250-adjust-the-timeout-for-fifo-mode.patch @@ -0,0 +1,122 @@ +From ebc97b069c46067d66e4204237184e2283096988 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jan 2025 22:32:57 +0106 +Subject: serial: 8250: Adjust the timeout for FIFO mode + +From: John Ogness + +[ Upstream commit d91f98be26510f5f81ec66425bb0306d1ccd571a ] + +After a console has written a record into UART_TX, it uses +wait_for_xmitr() to wait until the data has been sent out before +returning. However, wait_for_xmitr() will timeout after 10ms, +regardless if the data has been transmitted or not. + +For single bytes, this timeout is sufficient even at very slow +baud rates, such as 1200bps. However, when FIFO mode is used, +there may be 64 bytes pushed into the FIFO at once. At a baud +rate of 115200bps, the 10ms timeout is still sufficient. But +when using lower baud rates (such as 57600bps), the timeout +is _not_ sufficient. This causes longer lines to be cut off, +resulting in lost and horribly misformatted output on the +console. + +When using FIFO mode, take the number of bytes into account to +determine an appropriate maximum timeout. Increasing the timeout +does not affect performance since ideally the timeout never +occurs. + +Fixes: 8f3631f0f6eb ("serial/8250: Use fifo in 8250 console driver") +Signed-off-by: John Ogness +Reviewed-by: Andy Shevchenko +Reviewed-by: Wander Lairson Costa +Reviewed-by: Petr Mladek +Link: https://lore.kernel.org/r/20250107212702.169493-2-john.ogness@linutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_port.c | 32 +++++++++++++++++++++++------ + 1 file changed, 26 insertions(+), 6 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index 3509af7dc52b8..11519aa2598a0 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -2059,7 +2059,8 @@ static void serial8250_break_ctl(struct uart_port *port, int break_state) + serial8250_rpm_put(up); + } + +-static void wait_for_lsr(struct uart_8250_port *up, int bits) ++/* Returns true if @bits were set, false on timeout */ ++static bool wait_for_lsr(struct uart_8250_port *up, int bits) + { + unsigned int status, tmout = 10000; + +@@ -2074,11 +2075,11 @@ static void wait_for_lsr(struct uart_8250_port *up, int bits) + udelay(1); + touch_nmi_watchdog(); + } ++ ++ return (tmout != 0); + } + +-/* +- * Wait for transmitter & holding register to empty +- */ ++/* Wait for transmitter and holding register to empty with timeout */ + static void wait_for_xmitr(struct uart_8250_port *up, int bits) + { + unsigned int tmout; +@@ -3297,6 +3298,16 @@ static void serial8250_console_restore(struct uart_8250_port *up) + serial8250_out_MCR(up, up->mcr | UART_MCR_DTR | UART_MCR_RTS); + } + ++static void fifo_wait_for_lsr(struct uart_8250_port *up, unsigned int count) ++{ ++ unsigned int i; ++ ++ for (i = 0; i < count; i++) { ++ if (wait_for_lsr(up, UART_LSR_THRE)) ++ return; ++ } ++} ++ + /* + * Print a string to the serial port using the device FIFO + * +@@ -3306,13 +3317,15 @@ static void serial8250_console_restore(struct uart_8250_port *up) + static void serial8250_console_fifo_write(struct uart_8250_port *up, + const char *s, unsigned int count) + { +- int i; + const char *end = s + count; + unsigned int fifosize = up->tx_loadsz; ++ unsigned int tx_count = 0; + bool cr_sent = false; ++ unsigned int i; + + while (s != end) { +- wait_for_lsr(up, UART_LSR_THRE); ++ /* Allow timeout for each byte of a possibly full FIFO */ ++ fifo_wait_for_lsr(up, fifosize); + + for (i = 0; i < fifosize && s != end; ++i) { + if (*s == '\n' && !cr_sent) { +@@ -3323,7 +3336,14 @@ static void serial8250_console_fifo_write(struct uart_8250_port *up, + cr_sent = false; + } + } ++ tx_count = i; + } ++ ++ /* ++ * Allow timeout for each byte written since the caller will only wait ++ * for UART_LSR_BOTH_EMPTY using the timeout of a single character ++ */ ++ fifo_wait_for_lsr(up, tx_count); + } + + /* +-- +2.39.5 + diff --git a/queue-6.12/series b/queue-6.12/series new file mode 100644 index 0000000000..343a4f615b --- /dev/null +++ b/queue-6.12/series @@ -0,0 +1,523 @@ +coredump-do-not-lock-during-comm-reporting.patch +powerpc-book3s64-hugetlb-fix-disabling-hugetlb-when-.patch +dlm-fix-removal-of-rsb-struct-that-is-master-and-dir.patch +dlm-fix-srcu_read_lock-return-type-to-int.patch +afs-fix-eexist-error-returned-from-afs_rmdir-to-be-e.patch +afs-fix-directory-format-encoding-struct.patch +afs-fix-cleanup-of-immediately-failed-async-calls.patch +fs-fix-proc_handler-for-sysctl_nr_open.patch +block-copy-back-bounce-buffer-to-user-space-correctl.patch +block-retry-call-probe-after-request_module-in-blk_r.patch +ps3disk-do-not-use-dev-bounce_size-before-it-is-set.patch +nbd-don-t-allow-reconnect-after-disconnect.patch +pstore-blk-trivial-typo-fixes.patch +block-check-blk_feat_poll-under-q_usage_count.patch +block-don-t-update-blk_feat_poll-in-__blk_mq_update_.patch +nvme-tcp-fix-i-o-queue-cpu-spreading-for-multiple-co.patch +nvme-add-error-check-for-xa_store-in-nvme_get_effect.patch +powerpc-pseries-iommu-iommu-incorrectly-marks-mmio-r.patch +selftests-powerpc-fix-argument-order-to-timer_sub.patch +nvme-add-error-path-for-xa_store-in-nvme_init_effect.patch +btrfs-improve-the-warning-and-error-message-for-btrf.patch +partitions-ldm-remove-the-initial-kernel-doc-notatio.patch +btrfs-subpage-fix-the-bitmap-dump-of-the-locked-flag.patch +select-fix-unbalanced-user_access_end.patch +nvme-fix-bogus-kzalloc-return-check-in-nvme_init_eff.patch +afs-fix-the-fallback-handling-for-the-yfs.removefile.patch +perf-core-save-raw-sample-data-conditionally-based-o.patch +sched-fair-untangle-next_buddy-and-pick_next_task.patch +sched-fair-fix-value-reported-by-hot-tasks-pulled-in.patch +sched-fix-race-between-yield_to-and-try_to_wake_up.patch +x86-cpu-enable-sd_asym_packing-for-pkg-domain-on-amd.patch +x86-topology-use-x86_sched_itmt_flags-for-pkg-domain.patch +sched-split-out-__schedule-deactivate-task-logic-int.patch +sched-psi-pass-enqueue-dequeue-flags-to-psi-callback.patch +psi-fix-race-when-task-wakes-up-before-psi_sched_swi.patch +drm-v3d-fix-performance-counter-source-settings-on-v.patch +drm-ttm-add-ttm_bo_access.patch +drm-xe-use-ttm_bo_access-in-xe_vm_snapshot_capture_d.patch +drm-rockchip-vop2-fix-rk3588-dp-dsi-maxclk-verificat.patch +drm-msm-dp-set-safe_to_exit_level-before-printing-it.patch +drm-msm-hdmi-simplify-code-in-pll_get_integloop_gain.patch +drm-etnaviv-fix-page-property-being-used-for-non-wri.patch +drm-etnaviv-record-gpu-visible-size-of-gem-bo-separa.patch +drm-etnaviv-map-and-unmap-gpuva-range-with-respect-t.patch +drm-etnaviv-drop-the-offset-in-page-manipulation.patch +drm-amd-pm-fix-an-error-handling-path-in-vega10_enab.patch +drm-amdgpu-fix-potential-null-pointer-dereference-in.patch +drm-rockchip-vop2-fix-cluster-windows-alpha-ctrl-reg.patch +drm-rockchip-vop2-fix-the-mixer-alpha-setup-for-laye.patch +drm-panthor-preserve-the-result-returned-by-panthor_.patch +drm-rockchip-vop2-fix-the-windows-switch-between-dif.patch +printk-defer-legacy-printing-when-holding-printk_cpu.patch +drm-connector-allow-clearing-hdmi-infoframes.patch +drm-rockchip-vop2-set-axi-id-for-rk3588.patch +drm-rockchip-vop2-setup-delay-cycle-for-esmart2-3.patch +drm-rockchip-vop2-check-linear-format-for-cluster-wi.patch +drm-rockchip-vop2-add-check-for-32-bpp-format-for-rk.patch +drm-rockchip-vop2-include-rockchip_drm_drv.h.patch +drm-amdgpu-vcn-reset-fw_shared-under-sriov.patch +opp-add-index-check-to-assert-to-avoid-buffer-overfl.patch +opp-fix-dev_pm_opp_find_bw_-when-bandwidth-table-not.patch +drm-msm-dpu-provide-dspp-and-correct-lm-config-for-s.patch +drm-msm-dpu-link-dspp_2-_3-blocks-on-sm8150.patch +drm-msm-dpu-link-dspp_2-_3-blocks-on-sc8180x.patch +drm-msm-dpu-link-dspp_2-_3-blocks-on-sm8250.patch +drm-msm-dpu-link-dspp_2-_3-blocks-on-sm8350.patch +drm-msm-dpu-link-dspp_2-_3-blocks-on-sm8550.patch +drm-msm-dpu-link-dspp_2-_3-blocks-on-sm8650.patch +drm-msm-dpu-link-dspp_2-_3-blocks-on-x1e80100.patch +drm-msm-check-return-value-of-of_dma_configure.patch +drm-msm-don-t-clean-up-priv-kms-prematurely.patch +drm-msm-mdp4-correct-lcdc-regulator-name.patch +drm-bridge-it6505-change-definition-of-aux_fifo_max_.patch +drm-amdgpu-tear-down-ttm-range-manager-for-doorbell-.patch +revert-drm-amdgpu-gfx9-put-queue-resets-behind-a-deb.patch +drm-amdgpu-fix-gpu-recovery-disable-with-per-queue-r.patch +genirq-make-handle_enforce_irqctx-unconditionally-av.patch +ipmi-ipmb-add-check-devm_kasprintf-returned-value.patch +wifi-ath11k-fix-unexpected-return-buffer-manager-err.patch +wifi-rtlwifi-rtl8821ae-phy-restore-removed-code-to-f.patch +wifi-rtlwifi-do-not-complete-firmware-loading-needle.patch +wifi-rtlwifi-rtl8192se-rise-completion-of-firmware-l.patch +wifi-rtlwifi-wait-for-firmware-loading-before-releas.patch +wifi-rtlwifi-fix-init_sw_vars-leak-when-probe-fails.patch +wifi-rtlwifi-usb-fix-workqueue-leak-when-probe-fails.patch +wifi-wcn36xx-fix-channel-survey-memory-allocation-si.patch +clk-renesas-cpg-mssr-fix-soc-node-handling-in-cpg_ms.patch +wifi-cfg80211-tests-fix-potential-null-dereference-i.patch +selftests-bpf-actuate-tx_metadata_len-in-xdp_hw_meta.patch +net_sched-sch_sfq-handle-bigger-packets.patch +net_sched-sch_sfq-don-t-allow-1-packet-limit.patch +spi-zynq-qspi-add-check-for-clk_enable.patch +rxrpc-fix-handling-of-received-connection-abort.patch +dt-bindings-mmc-controller-clarify-the-address-cells.patch +clk-fix-an-of-node-reference-leak-in-of_clk_get_pare.patch +dt-bindings-leds-class-multicolor-fix-path-to-color-.patch +wifi-rtlwifi-remove-unused-check_buddy_priv.patch +wifi-rtlwifi-destroy-workqueue-at-rtl_deinit_core.patch +wifi-rtlwifi-fix-memory-leaks-and-invalid-access-at-.patch +wifi-rtlwifi-pci-wait-for-firmware-loading-before-re.patch +hid-multitouch-fix-support-for-goodix-pid-0x01e9.patch +regulator-dt-bindings-mt6315-drop-regulator-compatib.patch +wifi-brcmfmac-add-missing-header-include-for-brcmf_d.patch +module-convert-default-symbol-namespace-to-string-li.patch +hwmon-nct6775-actually-make-use-of-the-hwmon_nct6775.patch +acpi-fan-cleanup-resources-in-the-error-path-of-.pro.patch +cpupower-fix-tsc-mhz-calculation.patch +dt-bindings-mfd-bd71815-fix-rsense-and-typos.patch +leds-netxbig-fix-an-of-node-reference-leak-in-netxbi.patch +inetpeer-remove-create-argument-of-inet_getpeer_v-46.patch +inetpeer-remove-create-argument-of-inet_getpeer.patch +inetpeer-update-inetpeer-timestamp-in-inet_getpeer.patch +inetpeer-do-not-get-a-refcount-in-inet_getpeer.patch +pwm-stm32-lp-add-check-for-clk_enable.patch +cpufreq-schedutil-fix-superfluous-updates-caused-by-.patch +selftests-ktap_helpers-fix-uninitialized-variable.patch +ptr_ring-do-not-block-hard-interrupts-in-ptr_ring_re.patch +net-airoha-fix-error-path-in-airoha_probe.patch +gpio-pca953x-log-an-error-when-failing-to-get-the-re.patch +cpufreq-qcom-fix-qcom_cpufreq_hw_recalc_rate-to-quer.patch +cpufreq-qcom-implement-clk_ops-determine_rate-for-qc.patch +udp-deal-with-race-between-udp-socket-address-change.patch +clk-imx8mp-fix-clkout1-2-support.patch +dt-bindings-clock-imx93-drop-imx93_clk_end-macro-def.patch +dt-bindings-clock-add-i.mx91-clock-support.patch +dt-bindings-clock-imx93-add-spdif-ipg-clk.patch +clk-imx93-move-imx93_clk_end-macro-to-clk-driver.patch +clk-imx-add-i.mx91-clk.patch +clk-imx93-add-imx93_clk_spdif_ipg-clock.patch +arm64-dts-imx93-use-imx93_clk_spdif_ipg-as-spdif-ipg.patch +clk-imx-apply-some-clks-only-for-i.mx93.patch +clk-qcom-camcc-x1e80100-set-titan_top_gdsc-as-the-pa.patch +team-prevent-adding-a-device-which-is-already-a-team.patch +dt-bindings-clock-sunxi-export-pll_video_2x-and-pll_.patch +clk-sunxi-ng-a64-drop-redundant-clk_pll_video0_2x-an.patch +clk-sunxi-ng-a64-stop-force-selecting-pll-mipi-as-tc.patch +regulator-of-implement-the-unwind-path-of-of_regulat.patch +ax25-rcu-protect-dev-ax25_ptr.patch +net-mlx5-hws-fix-definer-s-hws_set32-macro-for-negat.patch +opp-of-fix-an-of-node-leak-in-_opp_add_static_v2.patch +ipmi-ssif_bmc-fix-new-request-loss-when-bmc-ready-fo.patch +wifi-ath12k-fix-tx-power-max-reg-power-update-to-fir.patch +clk-qcom-gcc-sdm845-do-not-use-shared-clk_ops-for-qu.patch +hid-hid-thrustmaster-fix-warning-in-thrustmaster_pro.patch +hid-fix-generic-desktop-d-pad-controls.patch +leds-cht-wcove-use-devm_led_classdev_register-to-avo.patch +mfd-syscon-fix-race-in-device_node_get_regmap.patch +samples-landlock-fix-possible-null-dereference-in-pa.patch +wifi-mt76-mt7996-fix-invalid-interface-combinations.patch +wifi-wlcore-fix-unbalanced-pm_runtime-calls.patch +wifi-rtw89-handle-entity-active-flag-per-phy.patch +wifi-rtw89-chan-manage-active-interfaces.patch +wifi-rtw89-tweak-setting-of-channel-and-tx-power-for.patch +wifi-rtw89-fix-proceeding-mcc-with-wrong-scanning-st.patch +wifi-rtw89-chan-fix-soft-lockup-in-rtw89_entity_reca.patch +wifi-rtw89-avoid-to-init-mgnt_entry-list-twice-when-.patch +wifi-rtw89-mcc-consider-time-limits-not-divisible-by.patch +wifi-rtw89-fix-race-between-cancel_hw_scan-and-hw_sc.patch +hwmon-fix-help-text-for-aspeed-g6-pwm-tach.patch +wifi-mt76-mt7925-fix-off-by-one-in-mt7925_load_clc.patch +wifi-mt76-mt7915-fix-mesh-scan-on-mt7916-dbdc.patch +wifi-iwlwifi-fw-read-step-table-from-correct-uefi-va.patch +wifi-iwlwifi-mvm-avoid-null-pointer-dereference.patch +wifi-iwlwifi-mvm-don-t-count-mgmt-frames-as-mpdu.patch +wifi-mac80211-prohibit-deactivating-all-links.patch +wifi-cfg80211-move-cfg80211_scan_req_add_chan-n_chan.patch +wifi-mac80211-fix-tid-removal-during-mesh-forwarding.patch +wifi-mac80211-fix-common-size-calculation-for-ml-ele.patch +wifi-mac80211-don-t-flush-non-uploaded-stas.patch +clk-ralink-mtmips-remove-duplicated-xtal-clock-for-r.patch +clk-thead-fix-clk-gate-registration-to-pass-flags.patch +clk-thead-add-clk_ignore_unused-to-fix-th1520-boot.patch +clk-thead-fix-cpu2vp_clk-for-th1520-ap_subsys-clocks.patch +net-smc-fix-data-error-when-recvmsg-with-msg_peek-fl.patch +landlock-handle-weird-files.patch +wifi-mt76-mt76u_vendor_request-do-not-print-error-me.patch +wifi-mt76-mt7921-fix-using-incorrect-group-cipher-af.patch +wifi-mt76-mt7915-fix-an-error-handling-path-in-mt791.patch +wifi-mt76-mt7925-fix-null-deref-check-in-mt7925_chan.patch +wifi-mt76-mt7925-fix-wrong-band_idx-setting-when-ena.patch +wifi-mt76-mt7925-fix-get-wrong-chip-cap-from-incorre.patch +wifi-mt76-mt7925-fix-the-invalid-ip-address-for-arp-.patch +wifi-mt76-mt7996-fix-overflows-seen-when-writing-lim.patch +wifi-mt76-mt7915-fix-overflows-seen-when-writing-lim.patch +wifi-mt76-connac-extend-mt76_connac_mcu_uni_add_dev-.patch +wifi-mt76-mt7925-fix-incorrect-mld-address-in-bss_ml.patch +wifi-mt76-mt7925-fix-incorrect-wcid-assignment-for-m.patch +wifi-mt76-mt7925-fix-incorrect-wcid-phy_idx-assignme.patch +wifi-mt76-mt7925-fix-wrong-parameter-for-related-cmd.patch +wifi-mt76-mt7925-fix-cnm-timeout-with-single-active-.patch +wifi-mt76-mt7925-enhance-mt7925_mac_link_bss_add-to-.patch +wifi-mt76-enhance-mt7925_mac_link_sta_add-to-support.patch +wifi-mt76-mt7925-update-mt7925_mcu_sta_update-for-bc.patch +wifi-mt76-mt7925-update-mt792x_rx_get_wcid-for-per-l.patch +wifi-mt76-mt7925-update-mt7925_unassign_vif_chanctx-.patch +wifi-mt76-mt7925-update-secondary-link-ps-flow.patch +wifi-mt76-mt7925-init-secondary-link-pm-state.patch +wifi-mt76-mt7925-update-mt7925_mcu_uni_-tx-rx-_ba-fo.patch +wifi-mt76-mt7925-cleanup-mlo-settings-post-disconnec.patch +wifi-mt76-mt7925-properly-handle-responses-for-comma.patch +wifi-mt76-mt7996-fix-rx-filter-setting-for-bfee-func.patch +wifi-mt76-only-enable-tx-worker-after-setting-the-ch.patch +wifi-mt76-mt7915-firmware-restart-on-devices-with-a-.patch +wifi-mt76-mt7915-fix-omac-index-assignment-after-har.patch +wifi-mt76-mt7915-fix-register-mapping.patch +wifi-mt76-mt7996-fix-register-mapping.patch +wifi-mt76-mt7996-add-max-mpdu-len-capability.patch +wifi-mt76-mt7996-fix-the-capability-of-reception-of-.patch +wifi-mt76-mt7996-fix-he-phy-capability.patch +wifi-mt76-mt7996-fix-incorrect-indexing-of-mib-fw-ev.patch +wifi-mt76-mt7996-fix-definition-of-tx-descriptor.patch +wifi-mt76-mt7996-fix-ldpc-setting.patch +i2c-designware-actually-make-use-of-the-i2c_dw_commo.patch +cpufreq-acpi-fix-max-frequency-computation.patch +selftests-timers-clocksource-switch-adapt-progress-t.patch +selftests-harness-fix-printing-of-mismatch-values-in.patch +wifi-cfg80211-adjust-allocation-of-colocated-ap-data.patch +bluetooth-btbcm-fix-null-deref-in-btbcm_get_board_na.patch +bluetooth-btrtl-check-for-null-in-btrtl_setup_realte.patch +inet-ipmr-fix-data-races.patch +clk-analogbits-fix-incorrect-calculation-of-vco-rate.patch +dev-acquire-netdev_rename_lock-before-restoring-dev-.patch +pwm-stm32-add-check-for-clk_enable.patch +selftests-landlock-fix-build-with-non-default-pthrea.patch +selftests-landlock-fix-error-message.patch +net-let-net.core.dev_weight-always-be-non-zero.patch +net-mlxfw-drop-hard-coded-max-fw-flash-image-size.patch +octeon_ep-remove-firmware-stats-fetch-in-ndo_get_sta.patch +octeon_ep_vf-remove-firmware-stats-fetch-in-ndo_get_.patch +net-avoid-race-between-device-unregistration-and-eth.patch +net-sched-disallow-replacing-of-child-qdisc-from-one.patch +netfilter-nf_tables-fix-set-size-with-rbtree-backend.patch +netfilter-nft_flow_offload-update-tcp-state-flags-un.patch +net-sched-refine-software-bypass-handling-in-tc_run.patch +net-ethernet-ti-am65-cpsw-fix-freeing-irq-in-am65_cp.patch +tcp_cubic-fix-incorrect-hystart-round-start-detectio.patch +net-rose-prevent-integer-overflows-in-rose_setsockop.patch +platform-mellanox-mlxbf-pmc-incorrect-type-in-assign.patch +platform-x86-x86-android-tablets-make-platform-data-.patch +pinctrl-samsung-fix-irq-handling-if-an-error-occurs-.patch +libbpf-don-t-adjust-usdt-semaphore-address-if-.staps.patch +asoc-cs40l50-use-y-for-makefile.patch +asoc-mediatek-mt8365-use-y-for-makefile.patch +asoc-wcd937x-use-y-for-makefile.patch +tools-testing-selftests-bpf-test_tc_tunnel.sh-fix-wa.patch +libbpf-fix-segfault-due-to-libelf-functions-not-sett.patch +asoc-intel-sof_sdw-correct-mach_params-dmic_num.patch +asoc-sun4i-spdif-add-clock-multiplier-settings.patch +selftests-bpf-fix-fill_link_info-selftest-on-powerpc.patch +iommu-arm-smmuv3-update-comments-about-ats-and-bypas.patch +crypto-tegra-do-not-transfer-req-when-tegra-init-fai.patch +crypto-api-fix-boot-up-self-test-race.patch +crypto-caam-use-jobr-s-space-to-access-page-0-regs.patch +perf-header-fix-one-memory-leakage-in-process_bpf_bt.patch +perf-header-fix-one-memory-leakage-in-process_bpf_pr.patch +perf-bpf-fix-two-memory-leakages-when-calling-perf_e.patch +asoc-renesas-rz-ssi-use-only-the-proper-amount-of-di.patch +perf-expr-initialize-is_test-value-in-expr__ctx_new.patch +pinctrl-nomadik-add-check-for-clk_enable.patch +ktest.pl-remove-unused-declarations-in-run_bisect_te.patch +bpf-bpf_local_storage-always-use-bpf_mem_alloc-in-pr.patch +rhashtable-fix-potential-deadlock-by-moving-schedule.patch +crypto-hisilicon-sec2-fix-for-aead-icv-error.patch +crypto-hisilicon-sec2-fix-for-aead-invalid-authsize.patch +crypto-ixp4xx-fix-of-node-reference-leaks-in-init_ix.patch +crypto-iaa-fix-iaa-disabling-that-occurs-when-sync_m.patch +bpf-use-refcount_t-instead-of-atomic_t-for-mmap_coun.patch +alsa-seq-make-dependency-on-ump-clearer.patch +bpf-reject-struct_ops-registration-that-uses-module-.patch +padata-fix-sysfs-store-callback-check.patch +selftests-bpf-avoid-generating-untracked-files-when-.patch +perf-top-don-t-complain-about-lack-of-vmlinux-when-n.patch +perf-maps-fix-display-of-kernel-symbols.patch +perf-machine-don-t-ignore-_etext-when-not-a-text-sym.patch +perf-namespaces-introduce-nsinfo__set_in_pidns.patch +perf-namespaces-fixup-the-nsinfo__in_pidns-return-ty.patch +asoc-intel-avs-do-not-readq-u32-registers.patch +asoc-intel-avs-fix-the-minimum-firmware-version-numb.patch +asoc-intel-avs-fix-theoretical-infinite-loop.patch +asoc-intel-avs-fix-init-config-parsing.patch +perf-manifest-add-arch-include-uapi-asm-bpf_perf_eve.patch +alsa-hda-fix-compilation-of-snd_hdac_adsp_xxx-helper.patch +perf-report-fix-misleading-help-message-about-demang.patch +pinctrl-stm32-add-check-for-clk_enable.patch +pinctrl-amd-take-suspend-type-into-consideration-whi.patch +perf-inject-fix-use-without-initialization-of-local-.patch +asoc-intel-sof_sdw-fix-dmi-match-for-lenovo-83lc.patch +asoc-intel-sof_sdw-fix-dmi-match-for-lenovo-83jx-83m.patch +bpf-send-signals-asynchronously-if-preemptible.patch +selftests-bpf-fix-btf-leak-on-new-btf-alloc-failure-.patch +libbpf-fix-return-zero-when-elf_begin-failed.patch +libbpf-fix-incorrect-traversal-end-type-id-when-mark.patch +bpf-tcp-mark-bpf_load_hdr_opt-arg2-as-read-write.patch +iommu-amd-remove-unused-amd_iommu_domain_update.patch +alsa-hda-realtek-fixed-headphone-distorted-sound-on-.patch +tools-sync-if_xdp.h-uapi-tooling-header.patch +perf-lock-fix-parse_lock_type-which-only-retrieve-on.patch +padata-fix-uaf-in-padata_reorder.patch +padata-add-pd-get-put-refcnt-helper.patch +padata-avoid-uaf-for-reorder_work.patch +rhashtable-fix-rhashtable_try_insert-test.patch +smb-client-fix-oops-due-to-unset-link-speed.patch +cifs-use-cifs_autodisable_serverino-for-disabling-ci.patch +bpf-cancel-the-running-bpf_timer-through-kworker-for.patch +soc-atmel-fix-device_node-release-in-atmel_soc_devic.patch +arm-at91-pm-change-bu-power-switch-to-automatic-mode.patch +arm-dts-imx7-tqma7-add-missing-vs-supply-for-lm75a-r.patch +arm64-dts-mediatek-mt8186-move-wakeup-to-mtu3-to-get.patch +arm64-dts-mt8183-set-dmic-one-wire-mode-on-damu.patch +arm64-dts-mediatek-mt8516-fix-gicv2-range.patch +arm64-dts-mediatek-mt8516-fix-wdt-irq-type.patch +arm64-dts-mediatek-mt8516-add-i2c-clock-div-property.patch +arm64-dts-mediatek-mt8516-reserve-192-kib-for-tf-a.patch +arm-dts-stm32-increase-cpu-core-voltage-on-stm32mp13.patch +arm-dts-stm32-fix-ipcc-exti-declaration-on-stm32mp15.patch +rdma-mlx4-avoid-false-error-about-access-to-uninitia.patch +arm64-dts-renesas-rzg3s-smarc-fix-the-debug-serial-a.patch +rdma-cxgb4-prevent-potential-integer-overflow-on-32b.patch +arm64-dts-mediatek-mt8173-evb-drop-regulator-compati.patch +arm64-dts-mediatek-mt8173-elm-drop-regulator-compati.patch +arm64-dts-mediatek-mt8192-asurada-drop-regulator-com.patch +arm64-dts-mediatek-mt8195-cherry-drop-regulator-comp.patch +arm64-dts-mediatek-mt8195-demo-drop-regulator-compat.patch +arm64-dts-medaitek-mt8395-nio-12l-drop-regulator-com.patch +arm64-dts-mediatek-mt8395-genio-1200-evk-drop-regula.patch +arm64-dts-mediatek-mt8173-elm-fix-mt6397-pmic-sub-no.patch +arm64-dts-mediatek-mt8173-evb-fix-mt6397-pmic-sub-no.patch +arm-dts-aspeed-yosemite4-correct-the-compatible-stri.patch +arm-dts-aspeed-yosemite4-add-required-properties-for.patch +arm-dts-aspeed-yosemite4-correct-the-compatible-stri.patch-32371 +arm-dts-socfpga-use-reset-name-stmmaceth-ocp-instead.patch +rdma-rxe-fix-mismatched-max_msg_sz.patch +arm64-dts-mediatek-mt8183-kenzo-support-second-sourc.patch +arm64-dts-mediatek-mt8183-willow-support-second-sour.patch +rdma-srp-fix-error-handling-in-srp_add_port.patch +arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch +arm-dts-stm32-deduplicate-serial-aliases-and-chosen-.patch +arm-dts-stm32-swap-usart3-and-uart8-alias-on-stm32mp.patch +memory-tegra20-emc-fix-an-of-node-reference-bug-in-t.patch +arm64-dts-mediatek-mt8183-kukui-jacuzzi-drop-pp3300_.patch +arm64-dts-qcom-msm8996-xiaomi-gemini-fix-lp5562-led1.patch +arm64-dts-qcom-sa8775p-update-sleep_clk-frequency.patch +arm64-defconfig-remove-obsolete-config_sm_dispcc_865.patch +arm64-dts-qcom-msm8996-fix-up-usb3-interrupts.patch +arm64-dts-qcom-msm8994-describe-usb-interrupts.patch +arm64-dts-qcom-sm7225-fairphone-fp4-drop-extra-qcom-.patch +arm64-dts-qcom-msm8916-correct-sleep-clock-frequency.patch +arm64-dts-qcom-msm8939-correct-sleep-clock-frequency.patch +arm64-dts-qcom-msm8994-correct-sleep-clock-frequency.patch +arm64-dts-qcom-qcs404-correct-sleep-clock-frequency.patch +arm64-dts-qcom-q-dr-u1000-correct-sleep-clock-freque.patch +arm64-dts-qcom-qrb4210-rb2-correct-sleep-clock-frequ.patch +arm64-dts-qcom-sc7280-correct-sleep-clock-frequency.patch +arm64-dts-qcom-sdx75-correct-sleep-clock-frequency.patch +arm64-dts-qcom-sm4450-correct-sleep-clock-frequency.patch +arm64-dts-qcom-sm6125-correct-sleep-clock-frequency.patch +arm64-dts-qcom-sm6375-correct-sleep-clock-frequency.patch +arm64-dts-qcom-sm8250-correct-sleep-clock-frequency.patch +arm64-dts-qcom-sm8350-correct-sleep-clock-frequency.patch +arm64-dts-qcom-sm8450-correct-sleep-clock-frequency.patch +arm64-dts-qcom-sm8550-correct-sleep-clock-frequency.patch +arm64-dts-qcom-sm8650-correct-sleep-clock-frequency.patch +arm64-dts-qcom-x1e80100-correct-sleep-clock-frequenc.patch +arm64-dts-qcom-sm8650-fix-cdsp-context-banks-unit-ad.patch +arm-dts-microchip-sama5d29_curiosity-add-no-1-8-v-pr.patch +arm-dts-microchip-sama5d27_wlsom1_ek-add-no-1-8-v-pr.patch +arm64-dts-ti-k3-am62-remove-duplicate-gicr-reg.patch +arm64-dts-ti-k3-am62a-remove-duplicate-gicr-reg.patch +arm64-dts-rockchip-fix-sdmmc-access-on-rk3308-rock-s.patch +arm64-dts-allwinner-a64-explicitly-assign-clock-pare.patch +rdma-bnxt_re-fix-to-drop-reference-to-the-mmap-entry.patch +rdma-rtrs-add-missing-deinit-call.patch +rdma-hns-clean-up-the-legacy-config_infiniband_hns.patch +arm-omap1-fix-up-the-retu-irq-on-nokia-770.patch +arm64-dts-qcom-qcm6490-shift-otter-remove-invalid-or.patch +arm64-dts-qcom-sdm845-db845c-navigation-mezzanine-co.patch +arm64-dts-qcom-sdm845-db845c-navigation-mezzanine-re.patch +arm64-dts-qcom-sc7180-trogdor-quackingstick-add-miss.patch +arm64-dts-qcom-sc7180-trogdor-pompom-rename-5v-choke.patch +arm64-dts-qcom-sc7180-change-labels-to-lower-case.patch +arm64-dts-qcom-sc7180-fix-psci-power-domain-node-nam.patch +arm64-dts-qcom-sm8150-microsoft-surface-duo-fix-typo.patch +arm64-dts-qcom-sc8280xp-fix-up-remoteproc-register-s.patch +firmware-qcom-scm-cleanup-global-__scm-on-probe-fail.patch +arm64-dts-mediatek-mt7988-add-missing-clock-div-prop.patch +dts-arm64-mediatek-mt8195-remove-mt8183-compatible-f.patch +arm64-dts-mediatek-add-per-soc-compatibles-for-keypa.patch +arm64-dts-qcom-sc8280xp-fix-interrupt-type-of-camss-.patch +arm64-dts-qcom-sdm845-fix-interrupt-types-of-camss-i.patch +arm64-dts-qcom-sm8250-fix-interrupt-types-of-camss-i.patch +arm64-dts-marvell-cn9131-cf-solidwan-fix-cp1-comphy-.patch +arm-dts-mediatek-mt7623-fix-ir-nodename.patch +arm64-dts-rockchip-fix-num-channels-property-of-wolf.patch +arm64-dts-ti-k3-am642-hummingboard-t-convert-overlay.patch +fbdev-omapfb-fix-an-of-node-leak-in-dss_of_port_get_.patch +arm64-tegra-fix-dma-id-for-spi2.patch +arm64-dts-qcom-x1e80100-romulus-update-firmware-node.patch +i3c-dw-fix-use-after-free-in-dw_i3c_master-driver-du.patch +rdma-mlx5-fix-indirect-mkey-odp-page-count.patch +of-property-avoiding-using-uninitialized-variable-im.patch +of-reserved-memory-do-not-make-kmemleak-ignore-freed.patch +efi-sysfb_efi-fix-w-1-warnings-when-efi-is-not-set.patch +rdma-cxgb4-notify-rdma-stack-for-ib_event_qp_last_wq.patch +rdma-rxe-fix-the-warning-__rxe_cleanup-0x12c-0x170-r.patch +iommu-iommufd-fix-warning-in-iommufd_device_unbind.patch +iommufd-iova_bitmap-fix-shift-out-of-bounds-in-iova_.patch +spi-omap2-mcspi-correctly-handle-devm_clk_get_option.patch +of-reserved_mem-restructure-how-the-reserved-memory-.patch +of-fdt-restore-possibility-to-use-both-acpi-and-fdt-.patch +media-rc-iguanair-handle-timeouts.patch +media-lmedm04-handle-errors-for-lme2510_int_read.patch +pci-endpoint-destroy-the-epc-device-in-devm_pci_epc_.patch +pci-aspm-save-parent-l1ss-config-in-pci_save_aspm_l1.patch +remoteproc-mtk_scp-only-populate-devices-for-scp-cor.patch +media-marvell-add-check-for-clk_enable.patch +media-i2c-imx290-register-0x3011-varies-between-imx3.patch +media-i2c-imx412-add-missing-newline-to-prints.patch +media-i2c-ov9282-correct-the-exposure-offset.patch +media-mipi-csis-add-check-for-clk_enable.patch +media-camif-core-add-check-for-clk_enable.patch +media-uvcvideo-propagate-buf-error-to-userspace.patch +mtd-rawnand-brcmnand-fix-status-read-of-brcmnand_wai.patch +mtd-hyperbus-hbmc-am654-fix-an-of-node-reference-lea.patch +media-nxp-imx8-isi-fix-v4l2-compliance-test-errors.patch +watchdog-rti_wdt-fix-an-of-node-leak-in-rti_wdt_prob.patch +staging-media-imx-fix-of-node-leak-in-imx_media_add_.patch +media-dvb-usb-v2-af9035-fix-iso-c90-compilation-erro.patch +pci-rcar-ep-fix-incorrect-variable-used-when-calling.patch +pci-imx6-configure-phy-based-on-root-complex-or-endp.patch +pci-imx6-skip-controller_id-generation-logic-for-i.m.patch +pci-imx6-deassert-apps_reset-in-imx_pcie_deassert_co.patch +pci-imx6-add-missing-reference-clock-disable-logic.patch +pci-qcom-update-icc-and-opp-values-after-link-up-eve.patch +pci-dwc-always-stop-link-in-the-dw_pcie_suspend_noir.patch +pci-endpoint-pci-epf-test-set-dma_chan_rx-pointer-to.patch +pci-endpoint-pci-epf-test-fix-check-for-dma-memcpy-t.patch +pci-microchip-add-support-for-using-either-root-port.patch +pci-microchip-set-inbound-address-translation-for-co.patch +scsi-mpt3sas-set-ioc-manu_pg11.eedptagmode-directly-.patch +scsi-ufs-bsg-delete-bsg_dev-when-setting-up-bsg-fail.patch +scsi-mpi3mr-fix-possible-crash-when-setting-up-bsg-f.patch +firewire-test-fix-potential-null-dereference-in-fire.patch +erofs-get-rid-of-erofs_-find-insert-_workgroup.patch +erofs-move-erofs_workgroup-operations-into-zdata.c.patch +erofs-sunset-struct-erofs_workgroup.patch +erofs-fix-potential-return-value-overflow-of-z_erofs.patch +ocfs2-mark-dquot-as-inactive-if-failed-to-start-tran.patch +nilfs2-do-not-force-clear-folio-if-buffer-is-referen.patch +nilfs2-protect-access-to-buffers-with-no-active-refe.patch +nilfs2-handle-errors-that-nilfs_prepare_chunk-may-re.patch +module-extend-the-preempt-disabled-section-in-derefe.patch +module-don-t-fail-module-loading-when-setting-ro_aft.patch +driver-core-class-fix-wild-pointer-dereferences-in-a.patch +tty-mips_ejtag_fdc-fix-one-more-u8-warning.patch +serial-8250-adjust-the-timeout-for-fifo-mode.patch +nfs-fix-incorrect-error-handling-in-localio.patch +nfsv4.2-fix-copy_notify-xdr-buf-size-calculation.patch +nfsv4.2-mark-offload_cancel-moveable.patch +loongarch-fix-warnings-during-s3-suspend.patch +tools-bootconfig-fix-the-wrong-format-specifier.patch +xfrm-replay-fix-the-update-of-replay_esn-oseq_hi-for.patch +xfrm-add-support-for-per-cpu-xfrm-state-handling.patch +xfrm-cache-used-outbound-xfrm-states-at-the-policy.patch +xfrm-add-an-inbound-percpu-state-cache.patch +xfrm-state-fix-out-of-bounds-read-during-lookup.patch +phy-freescale-fsl-samsung-hdmi-replace-register-defi.patch +phy-freescale-fsl-samsung-hdmi-simplify-reg21_pms_s_.patch +phy-freescale-fsl-samsung-hdmi-support-dynamic-integ.patch +phy-freescale-fsl-samsung-hdmi-clean-up-fld_tg_code-.patch +dmaengine-ti-edma-fix-of-node-reference-leaks-in-edm.patch +xfrm-delete-intermediate-secpath-entry-in-packet-off.patch +rtc-tps6594-fix-integer-overflow-on-32bit-systems.patch +rtc-pcf85063-fix-potential-oob-write-in-pcf85063-nvm.patch +rtc-loongson-clear-toy_match0_reg-in-loongson_rtc_is.patch +ubifs-skip-dumping-tnc-tree-when-zroot-is-null.patch +regulator-core-add-missing-newline-character.patch +net-airoha-fix-wrong-gdm4-register-definition.patch +net-hns3-fix-oops-when-unload-drivers-paralleling.patch +gpio-mxc-remove-dead-code-after-switch-to-dt-only.patch +net-phy-marvell-88q2xxx-fix-temperature-measurement-.patch +net-fec-implement-tso-descriptor-cleanup.patch +ipmr-do-not-call-mr_mfc_uses_dev-for-unres-entries.patch +pm-hibernate-add-error-handling-for-syscore_suspend.patch +perf-trace-fix-bpf-loading-failure-e2big.patch +xfrm-don-t-disable-preemption-while-looking-up-cache.patch +idpf-add-read-memory-barrier-when-checking-descripto.patch +idpf-fix-transaction-timeouts-on-reset.patch +idpf-acquire-the-lock-before-accessing-the-xn-salt.patch +idpf-convert-workqueues-to-unbound.patch +ice-fix-ice_parser_rt-bst_key-array-size.patch +ice-rework-of-dump-serdes-equalizer-values-feature.patch +ice-extend-dump-serdes-equalizer-values-feature.patch +ice-remove-invalid-parameter-of-equalizer.patch +iavf-allow-changing-vlan-state-without-calling-pf.patch +s390-mm-allow-large-pages-for-kasan-shadow-mapping.patch +net-ncsi-use-dev_set_mac_address-for-get-mc-mac-addr.patch +net-rose-fix-timer-races-against-user-threads.patch +net-netdevsim-try-to-close-udp-port-harness-races.patch +tools-ynl-c-correct-reverse-decode-of-empty-attrs.patch +selftests-mptcp-extend-cflags-to-keep-options-from-e.patch +selftests-net-lib-openvswitch-extend-cflags-to-keep-.patch +rxrpc-afs-fix-peer-hash-locking-vs-rcu-callback.patch +vxlan-fix-uninit-value-in-vxlan_vnifilter_dump.patch +net-davicom-fix-uaf-in-dm9000_drv_remove.patch +ptp-properly-handle-compat-ioctls.patch +net-ethtool-only-allow-set_rxnfc-with-rss-ring_cooki.patch +ethtool-fix-set-rxnfc-command-with-symmetric-rss-has.patch +net-stmmac-limit-the-number-of-mtl-queues-to-hardwar.patch +net-stmmac-limit-fifo-size-by-hardware-capability.patch +s390-sclp-initialize-sclp-subsystem-via-arch_cpu_fin.patch +perf-trace-fix-runtime-error-of-index-out-of-bounds.patch +perf-test-skip-syscall-enum-test-if-no-landlock-sysc.patch +pm-sleep-core-synchronize-runtime-pm-status-of-paren.patch +bluetooth-btusb-mediatek-add-locks-for-usb_driver_cl.patch +bluetooth-btnxpuart-fix-glitches-seen-in-dual-a2dp-s.patch +vsock-keep-the-binding-until-socket-destruction.patch +vsock-allow-retrying-on-connect-failure.patch +bgmac-reduce-max-frame-size-to-support-just-mtu-1500.patch +tcp-correct-handling-of-extreme-memory-squeeze.patch +net-xdp-disallow-attaching-device-bound-programs-in-.patch +net-ravb-fix-missing-rtnl-lock-in-suspend-resume-pat.patch +net-sh_eth-fix-missing-rtnl-lock-in-suspend-resume-p.patch +net-hsr-fix-fill_frame_info-regression-vs-vlan-packe.patch diff --git a/queue-6.12/smb-client-fix-oops-due-to-unset-link-speed.patch b/queue-6.12/smb-client-fix-oops-due-to-unset-link-speed.patch new file mode 100644 index 0000000000..ae1cff4e3a --- /dev/null +++ b/queue-6.12/smb-client-fix-oops-due-to-unset-link-speed.patch @@ -0,0 +1,104 @@ +From ce61853cdfbd4129d4a927cca992989c51a830ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jan 2025 14:29:03 -0300 +Subject: smb: client: fix oops due to unset link speed + +From: Paulo Alcantara + +[ Upstream commit be7a6a77669588bfa5022a470989702bbbb11e7f ] + +It isn't guaranteed that NETWORK_INTERFACE_INFO::LinkSpeed will always +be set by the server, so the client must handle any values and then +prevent oopses like below from happening: + +Oops: divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI +CPU: 0 UID: 0 PID: 1323 Comm: cat Not tainted 6.13.0-rc7 #2 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41 +04/01/2014 +RIP: 0010:cifs_debug_data_proc_show+0xa45/0x1460 [cifs] Code: 00 00 48 +89 df e8 3b cd 1b c1 41 f6 44 24 2c 04 0f 84 50 01 00 00 48 89 ef e8 +e7 d0 1b c1 49 8b 44 24 18 31 d2 49 8d 7c 24 28 <48> f7 74 24 18 48 89 +c3 e8 6e cf 1b c1 41 8b 6c 24 28 49 8d 7c 24 +RSP: 0018:ffffc90001817be0 EFLAGS: 00010246 +RAX: 0000000000000000 RBX: ffff88811230022c RCX: ffffffffc041bd99 +RDX: 0000000000000000 RSI: 0000000000000567 RDI: ffff888112300228 +RBP: ffff888112300218 R08: fffff52000302f5f R09: ffffed1022fa58ac +R10: ffff888117d2c566 R11: 00000000fffffffe R12: ffff888112300200 +R13: 000000012a15343f R14: 0000000000000001 R15: ffff888113f2db58 +FS: 00007fe27119e740(0000) GS:ffff888148600000(0000) +knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007fe2633c5000 CR3: 0000000124da0000 CR4: 0000000000750ef0 +PKRU: 55555554 +Call Trace: + + ? __die_body.cold+0x19/0x27 + ? die+0x2e/0x50 + ? do_trap+0x159/0x1b0 + ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs] + ? do_error_trap+0x90/0x130 + ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs] + ? exc_divide_error+0x39/0x50 + ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs] + ? asm_exc_divide_error+0x1a/0x20 + ? cifs_debug_data_proc_show+0xa39/0x1460 [cifs] + ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs] + ? seq_read_iter+0x42e/0x790 + seq_read_iter+0x19a/0x790 + proc_reg_read_iter+0xbe/0x110 + ? __pfx_proc_reg_read_iter+0x10/0x10 + vfs_read+0x469/0x570 + ? do_user_addr_fault+0x398/0x760 + ? __pfx_vfs_read+0x10/0x10 + ? find_held_lock+0x8a/0xa0 + ? __pfx_lock_release+0x10/0x10 + ksys_read+0xd3/0x170 + ? __pfx_ksys_read+0x10/0x10 + ? __rcu_read_unlock+0x50/0x270 + ? mark_held_locks+0x1a/0x90 + do_syscall_64+0xbb/0x1d0 + entry_SYSCALL_64_after_hwframe+0x77/0x7f +RIP: 0033:0x7fe271288911 +Code: 00 48 8b 15 01 25 10 00 f7 d8 64 89 02 b8 ff ff ff ff eb bd e8 +20 ad 01 00 f3 0f 1e fa 80 3d b5 a7 10 00 00 74 13 31 c0 0f 05 <48> 3d +00 f0 ff ff 77 4f c3 66 0f 1f 44 00 00 55 48 89 e5 48 83 ec +RSP: 002b:00007ffe87c079d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 +RAX: ffffffffffffffda RBX: 0000000000040000 RCX: 00007fe271288911 +RDX: 0000000000040000 RSI: 00007fe2633c6000 RDI: 0000000000000003 +RBP: 00007ffe87c07a00 R08: 0000000000000000 R09: 00007fe2713e6380 +R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000040000 +R13: 00007fe2633c6000 R14: 0000000000000003 R15: 0000000000000000 + + +Fix this by setting cifs_server_iface::speed to a sane value (1Gbps) +by default when link speed is unset. + +Cc: Shyam Prasad N +Cc: Tom Talpey +Fixes: a6d8fb54a515 ("cifs: distribute channels across interfaces based on speed") +Reported-by: Frank Sorenson +Reported-by: Jay Shin +Signed-off-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2ops.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index 7571fefeb83aa..6bacf754b57ef 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -658,7 +658,8 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, + + while (bytes_left >= (ssize_t)sizeof(*p)) { + memset(&tmp_iface, 0, sizeof(tmp_iface)); +- tmp_iface.speed = le64_to_cpu(p->LinkSpeed); ++ /* default to 1Gbps when link speed is unset */ ++ tmp_iface.speed = le64_to_cpu(p->LinkSpeed) ?: 1000000000; + tmp_iface.rdma_capable = le32_to_cpu(p->Capability & RDMA_CAPABLE) ? 1 : 0; + tmp_iface.rss_capable = le32_to_cpu(p->Capability & RSS_CAPABLE) ? 1 : 0; + +-- +2.39.5 + diff --git a/queue-6.12/soc-atmel-fix-device_node-release-in-atmel_soc_devic.patch b/queue-6.12/soc-atmel-fix-device_node-release-in-atmel_soc_devic.patch new file mode 100644 index 0000000000..15f6775044 --- /dev/null +++ b/queue-6.12/soc-atmel-fix-device_node-release-in-atmel_soc_devic.patch @@ -0,0 +1,43 @@ +From 4b0910b1a51eb37803f10e5cba223d2f18a7d164 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Oct 2024 13:33:36 +0100 +Subject: soc: atmel: fix device_node release in atmel_soc_device_init() + +From: Javier Carrasco + +[ Upstream commit d3455ab798100f40af77123e7c2443ec979c546b ] + +A device_node acquired via of_find_node_by_path() requires explicit +calls to of_node_put() when it is no longer needed to avoid leaking the +resource. + +Instead of adding the missing calls to of_node_put() in all execution +paths, use the cleanup attribute for 'np' by means of the __free() +macro, which automatically calls of_node_put() when the variable goes +out of scope. + +Fixes: 960ddf70cc11 ("drivers: soc: atmel: Avoid calling at91_soc_init on non AT91 SoCs") +Signed-off-by: Javier Carrasco +Link: https://lore.kernel.org/r/20241031-soc-atmel-soc-cleanup-v2-1-73f2d235fd98@gmail.com +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + drivers/soc/atmel/soc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/atmel/soc.c b/drivers/soc/atmel/soc.c +index 2a42b28931c96..298b542dd1c06 100644 +--- a/drivers/soc/atmel/soc.c ++++ b/drivers/soc/atmel/soc.c +@@ -399,7 +399,7 @@ static const struct of_device_id at91_soc_allowed_list[] __initconst = { + + static int __init atmel_soc_device_init(void) + { +- struct device_node *np = of_find_node_by_path("/"); ++ struct device_node *np __free(device_node) = of_find_node_by_path("/"); + + if (!of_match_node(at91_soc_allowed_list, np)) + return 0; +-- +2.39.5 + diff --git a/queue-6.12/spi-omap2-mcspi-correctly-handle-devm_clk_get_option.patch b/queue-6.12/spi-omap2-mcspi-correctly-handle-devm_clk_get_option.patch new file mode 100644 index 0000000000..7af34f6f48 --- /dev/null +++ b/queue-6.12/spi-omap2-mcspi-correctly-handle-devm_clk_get_option.patch @@ -0,0 +1,53 @@ +From 48de76b3c01670e75696a2e2a387f2f32a435e36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jan 2025 16:16:03 +0000 +Subject: spi: omap2-mcspi: Correctly handle devm_clk_get_optional() errors + +From: Mark Brown + +[ Upstream commit a07eb4f67ed085f32002a1af2b6073546d67de3f ] + +devm_clk_get_optional() returns NULL for missing clocks and a PTR_ERR() +if there is a clock but we fail to get it, but currently we only handle +the latter case and do so as though the clock was missing. If we get an +error back we should handle that as an error since the clock exists but +we failed to get it, if we get NULL then the clock doesn't exist and we +should handle that. + +Fixes: 4c6ac5446d06 ("spi: omap2-mcspi: Fix the IS_ERR() bug for devm_clk_get_optional_enabled()") +Reported-by: Lars Pedersen +Link: https://patch.msgid.link/20250117-spi-fix-omap2-optional-v1-1-e77d4ac6db6e@kernel.org +Signed-off-by: Mark Brown +Tested-by: Lars Pedersen +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-omap2-mcspi.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c +index 4a2f84c4d22e5..532b2e9c31d0d 100644 +--- a/drivers/spi/spi-omap2-mcspi.c ++++ b/drivers/spi/spi-omap2-mcspi.c +@@ -1561,10 +1561,15 @@ static int omap2_mcspi_probe(struct platform_device *pdev) + } + + mcspi->ref_clk = devm_clk_get_optional_enabled(&pdev->dev, NULL); +- if (IS_ERR(mcspi->ref_clk)) +- mcspi->ref_clk_hz = OMAP2_MCSPI_MAX_FREQ; +- else ++ if (IS_ERR(mcspi->ref_clk)) { ++ status = PTR_ERR(mcspi->ref_clk); ++ dev_err_probe(&pdev->dev, status, "Failed to get ref_clk"); ++ goto free_ctlr; ++ } ++ if (mcspi->ref_clk) + mcspi->ref_clk_hz = clk_get_rate(mcspi->ref_clk); ++ else ++ mcspi->ref_clk_hz = OMAP2_MCSPI_MAX_FREQ; + ctlr->max_speed_hz = mcspi->ref_clk_hz; + ctlr->min_speed_hz = mcspi->ref_clk_hz >> 15; + +-- +2.39.5 + diff --git a/queue-6.12/spi-zynq-qspi-add-check-for-clk_enable.patch b/queue-6.12/spi-zynq-qspi-add-check-for-clk_enable.patch new file mode 100644 index 0000000000..ebe728b948 --- /dev/null +++ b/queue-6.12/spi-zynq-qspi-add-check-for-clk_enable.patch @@ -0,0 +1,53 @@ +From 029022ede176b0e34b8c5fde2609a7dd52863b1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 20:52:06 -0500 +Subject: spi: zynq-qspi: Add check for clk_enable() + +From: Mingwei Zheng + +[ Upstream commit 8332e667099712e05ec87ba2058af394b51ebdc9 ] + +Add check for the return value of clk_enable() to catch the potential +error. + +Fixes: c618a90dcaf3 ("spi: zynq-qspi: Drop GPIO header") +Signed-off-by: Mingwei Zheng +Signed-off-by: Jiasheng Jiang +Link: https://patch.msgid.link/20241207015206.3689364-1-zmw12306@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-zynq-qspi.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-zynq-qspi.c b/drivers/spi/spi-zynq-qspi.c +index b67455bda972b..de4c182474329 100644 +--- a/drivers/spi/spi-zynq-qspi.c ++++ b/drivers/spi/spi-zynq-qspi.c +@@ -379,12 +379,21 @@ static int zynq_qspi_setup_op(struct spi_device *spi) + { + struct spi_controller *ctlr = spi->controller; + struct zynq_qspi *qspi = spi_controller_get_devdata(ctlr); ++ int ret; + + if (ctlr->busy) + return -EBUSY; + +- clk_enable(qspi->refclk); +- clk_enable(qspi->pclk); ++ ret = clk_enable(qspi->refclk); ++ if (ret) ++ return ret; ++ ++ ret = clk_enable(qspi->pclk); ++ if (ret) { ++ clk_disable(qspi->refclk); ++ return ret; ++ } ++ + zynq_qspi_write(qspi, ZYNQ_QSPI_ENABLE_OFFSET, + ZYNQ_QSPI_ENABLE_ENABLE_MASK); + +-- +2.39.5 + diff --git a/queue-6.12/staging-media-imx-fix-of-node-leak-in-imx_media_add_.patch b/queue-6.12/staging-media-imx-fix-of-node-leak-in-imx_media_add_.patch new file mode 100644 index 0000000000..b79cbc16c2 --- /dev/null +++ b/queue-6.12/staging-media-imx-fix-of-node-leak-in-imx_media_add_.patch @@ -0,0 +1,58 @@ +From 41f59efd0872fb731252a03ef7847b567df9a1ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:54:11 +0900 +Subject: staging: media: imx: fix OF node leak in imx_media_add_of_subdevs() + +From: Joe Hattori + +[ Upstream commit 094f5c315f756b19198e6c401aa821ac0e868750 ] + +imx_media_add_of_subdevs() calls of_parse_phandle() and passes the +obtained node to imx_media_of_add_csi(). The passed node is used in +v4l2_async_nf_add_fwnode(), which increments the refcount of the node. +Therefore, while the current implementation only releases the node when +imx_media_of_add_csi() fails, but should always release it. Call +of_node_put() right after imx_media_of_add_csi(). + +Fixes: dee747f88167 ("media: imx: Don't register IPU subdevs/links if CSI port missing") +Signed-off-by: Joe Hattori +Reviewed-by: Vladimir Zapolskiy +Reviewed-by: Philipp Zabel +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/staging/media/imx/imx-media-of.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/staging/media/imx/imx-media-of.c b/drivers/staging/media/imx/imx-media-of.c +index 118bff988bc7e..bb28daa4d7133 100644 +--- a/drivers/staging/media/imx/imx-media-of.c ++++ b/drivers/staging/media/imx/imx-media-of.c +@@ -54,22 +54,18 @@ int imx_media_add_of_subdevs(struct imx_media_dev *imxmd, + break; + + ret = imx_media_of_add_csi(imxmd, csi_np); ++ of_node_put(csi_np); + if (ret) { + /* unavailable or already added is not an error */ + if (ret == -ENODEV || ret == -EEXIST) { +- of_node_put(csi_np); + continue; + } + + /* other error, can't continue */ +- goto err_out; ++ return ret; + } + } + + return 0; +- +-err_out: +- of_node_put(csi_np); +- return ret; + } + EXPORT_SYMBOL_GPL(imx_media_add_of_subdevs); +-- +2.39.5 + diff --git a/queue-6.12/tcp-correct-handling-of-extreme-memory-squeeze.patch b/queue-6.12/tcp-correct-handling-of-extreme-memory-squeeze.patch new file mode 100644 index 0000000000..75a9a90c57 --- /dev/null +++ b/queue-6.12/tcp-correct-handling-of-extreme-memory-squeeze.patch @@ -0,0 +1,167 @@ +From 6b55d532f48160114a364f2cab3d5e7a7b0f64f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Jan 2025 18:13:04 -0500 +Subject: tcp: correct handling of extreme memory squeeze +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jon Maloy + +[ Upstream commit 8c670bdfa58e48abad1d5b6ca1ee843ca91f7303 ] + +Testing with iperf3 using the "pasta" protocol splicer has revealed +a problem in the way tcp handles window advertising in extreme memory +squeeze situations. + +Under memory pressure, a socket endpoint may temporarily advertise +a zero-sized window, but this is not stored as part of the socket data. +The reasoning behind this is that it is considered a temporary setting +which shouldn't influence any further calculations. + +However, if we happen to stall at an unfortunate value of the current +window size, the algorithm selecting a new value will consistently fail +to advertise a non-zero window once we have freed up enough memory. +This means that this side's notion of the current window size is +different from the one last advertised to the peer, causing the latter +to not send any data to resolve the sitution. + +The problem occurs on the iperf3 server side, and the socket in question +is a completely regular socket with the default settings for the +fedora40 kernel. We do not use SO_PEEK or SO_RCVBUF on the socket. + +The following excerpt of a logging session, with own comments added, +shows more in detail what is happening: + +// tcp_v4_rcv(->) +// tcp_rcv_established(->) +[5201<->39222]: ==== Activating log @ net/ipv4/tcp_input.c/tcp_data_queue()/5257 ==== +[5201<->39222]: tcp_data_queue(->) +[5201<->39222]: DROPPING skb [265600160..265665640], reason: SKB_DROP_REASON_PROTO_MEM + [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184] + [copied_seq 259909392->260034360 (124968), unread 5565800, qlen 85, ofoq 0] + [OFO queue: gap: 65480, len: 0] +[5201<->39222]: tcp_data_queue(<-) +[5201<->39222]: __tcp_transmit_skb(->) + [tp->rcv_wup: 265469200, tp->rcv_wnd: 262144, tp->rcv_nxt 265600160] +[5201<->39222]: tcp_select_window(->) +[5201<->39222]: (inet_csk(sk)->icsk_ack.pending & ICSK_ACK_NOMEM) ? --> TRUE + [tp->rcv_wup: 265469200, tp->rcv_wnd: 262144, tp->rcv_nxt 265600160] + returning 0 +[5201<->39222]: tcp_select_window(<-) +[5201<->39222]: ADVERTISING WIN 0, ACK_SEQ: 265600160 +[5201<->39222]: [__tcp_transmit_skb(<-) +[5201<->39222]: tcp_rcv_established(<-) +[5201<->39222]: tcp_v4_rcv(<-) + +// Receive queue is at 85 buffers and we are out of memory. +// We drop the incoming buffer, although it is in sequence, and decide +// to send an advertisement with a window of zero. +// We don't update tp->rcv_wnd and tp->rcv_wup accordingly, which means +// we unconditionally shrink the window. + +[5201<->39222]: tcp_recvmsg_locked(->) +[5201<->39222]: __tcp_cleanup_rbuf(->) tp->rcv_wup: 265469200, tp->rcv_wnd: 262144, tp->rcv_nxt 265600160 +[5201<->39222]: [new_win = 0, win_now = 131184, 2 * win_now = 262368] +[5201<->39222]: [new_win >= (2 * win_now) ? --> time_to_ack = 0] +[5201<->39222]: NOT calling tcp_send_ack() + [tp->rcv_wup: 265469200, tp->rcv_wnd: 262144, tp->rcv_nxt 265600160] +[5201<->39222]: __tcp_cleanup_rbuf(<-) + [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184] + [copied_seq 260040464->260040464 (0), unread 5559696, qlen 85, ofoq 0] + returning 6104 bytes +[5201<->39222]: tcp_recvmsg_locked(<-) + +// After each read, the algorithm for calculating the new receive +// window in __tcp_cleanup_rbuf() finds it is too small to advertise +// or to update tp->rcv_wnd. +// Meanwhile, the peer thinks the window is zero, and will not send +// any more data to trigger an update from the interrupt mode side. + +[5201<->39222]: tcp_recvmsg_locked(->) +[5201<->39222]: __tcp_cleanup_rbuf(->) tp->rcv_wup: 265469200, tp->rcv_wnd: 262144, tp->rcv_nxt 265600160 +[5201<->39222]: [new_win = 262144, win_now = 131184, 2 * win_now = 262368] +[5201<->39222]: [new_win >= (2 * win_now) ? --> time_to_ack = 0] +[5201<->39222]: NOT calling tcp_send_ack() + [tp->rcv_wup: 265469200, tp->rcv_wnd: 262144, tp->rcv_nxt 265600160] +[5201<->39222]: __tcp_cleanup_rbuf(<-) + [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184] + [copied_seq 260099840->260171536 (71696), unread 5428624, qlen 83, ofoq 0] + returning 131072 bytes +[5201<->39222]: tcp_recvmsg_locked(<-) + +// The above pattern repeats again and again, since nothing changes +// between the reads. + +[...] + +[5201<->39222]: tcp_recvmsg_locked(->) +[5201<->39222]: __tcp_cleanup_rbuf(->) tp->rcv_wup: 265469200, tp->rcv_wnd: 262144, tp->rcv_nxt 265600160 +[5201<->39222]: [new_win = 262144, win_now = 131184, 2 * win_now = 262368] +[5201<->39222]: [new_win >= (2 * win_now) ? --> time_to_ack = 0] +[5201<->39222]: NOT calling tcp_send_ack() + [tp->rcv_wup: 265469200, tp->rcv_wnd: 262144, tp->rcv_nxt 265600160] +[5201<->39222]: __tcp_cleanup_rbuf(<-) + [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184] + [copied_seq 265600160->265600160 (0), unread 0, qlen 0, ofoq 0] + returning 54672 bytes +[5201<->39222]: tcp_recvmsg_locked(<-) + +// The receive queue is empty, but no new advertisement has been sent. +// The peer still thinks the receive window is zero, and sends nothing. +// We have ended up in a deadlock situation. + +Note that well behaved endpoints will send win0 probes, so the problem +will not occur. + +Furthermore, we have observed that in these situations this side may +send out an updated 'th->ack_seq´ which is not stored in tp->rcv_wup +as it should be. Backing ack_seq seems to be harmless, but is of +course still wrong from a protocol viewpoint. + +We fix this by updating the socket state correctly when a packet has +been dropped because of memory exhaustion and we have to advertize +a zero window. + +Further testing shows that the connection recovers neatly from the +squeeze situation, and traffic can continue indefinitely. + +Fixes: e2142825c120 ("net: tcp: send zero-window ACK when no memory") +Cc: Menglong Dong +Reviewed-by: Stefano Brivio +Signed-off-by: Jon Maloy +Reviewed-by: Jason Xing +Reviewed-by: Eric Dumazet +Reviewed-by: Neal Cardwell +Link: https://patch.msgid.link/20250127231304.1465565-1-jmaloy@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_output.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 8efc58716ce96..6d5387811c32a 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -265,11 +265,14 @@ static u16 tcp_select_window(struct sock *sk) + u32 cur_win, new_win; + + /* Make the window 0 if we failed to queue the data because we +- * are out of memory. The window is temporary, so we don't store +- * it on the socket. ++ * are out of memory. + */ +- if (unlikely(inet_csk(sk)->icsk_ack.pending & ICSK_ACK_NOMEM)) ++ if (unlikely(inet_csk(sk)->icsk_ack.pending & ICSK_ACK_NOMEM)) { ++ tp->pred_flags = 0; ++ tp->rcv_wnd = 0; ++ tp->rcv_wup = tp->rcv_nxt; + return 0; ++ } + + cur_win = tcp_receive_window(tp); + new_win = __tcp_select_window(sk); +-- +2.39.5 + diff --git a/queue-6.12/tcp_cubic-fix-incorrect-hystart-round-start-detectio.patch b/queue-6.12/tcp_cubic-fix-incorrect-hystart-round-start-detectio.patch new file mode 100644 index 0000000000..7c97c6ab08 --- /dev/null +++ b/queue-6.12/tcp_cubic-fix-incorrect-hystart-round-start-detectio.patch @@ -0,0 +1,83 @@ +From 567d7d61a1401ec96b40c5ca00146e5efc0fe26f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jan 2025 21:37:51 +0000 +Subject: tcp_cubic: fix incorrect HyStart round start detection + +From: Mahdi Arghavani + +[ Upstream commit 25c1a9ca53db5780757e7f53e688b8f916821baa ] + +I noticed that HyStart incorrectly marks the start of rounds, +leading to inaccurate measurements of ACK train lengths and +resetting the `ca->sample_cnt` variable. This inaccuracy can impact +HyStart's functionality in terminating exponential cwnd growth during +Slow-Start, potentially degrading TCP performance. + +The issue arises because the changes introduced in commit 4e1fddc98d25 +("tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited flows") +moved the caller of the `bictcp_hystart_reset` function inside the `hystart_update` function. +This modification added an additional condition for triggering the caller, +requiring that (tcp_snd_cwnd(tp) >= hystart_low_window) must also +be satisfied before invoking `bictcp_hystart_reset`. + +This fix ensures that `bictcp_hystart_reset` is correctly called +at the start of a new round, regardless of the congestion window size. +This is achieved by moving the condition +(tcp_snd_cwnd(tp) >= hystart_low_window) +from before calling `bictcp_hystart_reset` to after it. + +I tested with a client and a server connected through two Linux software routers. +In this setup, the minimum RTT was 150 ms, the bottleneck bandwidth was 50 Mbps, +and the bottleneck buffer size was 1 BDP, calculated as (50M / 1514 / 8) * 0.150 = 619 packets. +I conducted the test twice, transferring data from the server to the client for 1.5 seconds. +Before the patch was applied, HYSTART-DELAY stopped the exponential growth of cwnd when +cwnd = 516, and the bottleneck link was not yet saturated (516 < 619). +After the patch was applied, HYSTART-ACK-TRAIN stopped the exponential growth of cwnd when +cwnd = 632, and the bottleneck link was saturated (632 > 619). +In this test, applying the patch resulted in 300 KB more data delivered. + +Fixes: 4e1fddc98d25 ("tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited flows") +Signed-off-by: Mahdi Arghavani +Reviewed-by: Jason Xing +Cc: Neal Cardwell +Cc: Eric Dumazet +Cc: Haibo Zhang +Cc: David Eyers +Cc: Abbas Arghavani +Reviewed-by: Neal Cardwell +Tested-by: Neal Cardwell +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_cubic.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c +index 5dbed91c61782..76c23675ae50a 100644 +--- a/net/ipv4/tcp_cubic.c ++++ b/net/ipv4/tcp_cubic.c +@@ -392,6 +392,10 @@ static void hystart_update(struct sock *sk, u32 delay) + if (after(tp->snd_una, ca->end_seq)) + bictcp_hystart_reset(sk); + ++ /* hystart triggers when cwnd is larger than some threshold */ ++ if (tcp_snd_cwnd(tp) < hystart_low_window) ++ return; ++ + if (hystart_detect & HYSTART_ACK_TRAIN) { + u32 now = bictcp_clock_us(sk); + +@@ -467,9 +471,7 @@ __bpf_kfunc static void cubictcp_acked(struct sock *sk, const struct ack_sample + if (ca->delay_min == 0 || ca->delay_min > delay) + ca->delay_min = delay; + +- /* hystart triggers when cwnd is larger than some threshold */ +- if (!ca->found && tcp_in_slow_start(tp) && hystart && +- tcp_snd_cwnd(tp) >= hystart_low_window) ++ if (!ca->found && tcp_in_slow_start(tp) && hystart) + hystart_update(sk, delay); + } + +-- +2.39.5 + diff --git a/queue-6.12/team-prevent-adding-a-device-which-is-already-a-team.patch b/queue-6.12/team-prevent-adding-a-device-which-is-already-a-team.patch new file mode 100644 index 0000000000..3a35b093c4 --- /dev/null +++ b/queue-6.12/team-prevent-adding-a-device-which-is-already-a-team.patch @@ -0,0 +1,118 @@ +From bdf893471c60c33828601d896d58a1e598e25a00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 12:56:47 -0800 +Subject: team: prevent adding a device which is already a team device lower + +From: Octavian Purdila + +[ Upstream commit 3fff5da4ca2164bb4d0f1e6cd33f6eb8a0e73e50 ] + +Prevent adding a device which is already a team device lower, +e.g. adding veth0 if vlan1 was already added and veth0 is a lower of +vlan1. + +This is not useful in practice and can lead to recursive locking: + +$ ip link add veth0 type veth peer name veth1 +$ ip link set veth0 up +$ ip link set veth1 up +$ ip link add link veth0 name veth0.1 type vlan protocol 802.1Q id 1 +$ ip link add team0 type team +$ ip link set veth0.1 down +$ ip link set veth0.1 master team0 +team0: Port device veth0.1 added +$ ip link set veth0 down +$ ip link set veth0 master team0 + +============================================ +WARNING: possible recursive locking detected +6.13.0-rc2-virtme-00441-ga14a429069bb #46 Not tainted +-------------------------------------------- +ip/7684 is trying to acquire lock: +ffff888016848e00 (team->team_lock_key){+.+.}-{4:4}, at: team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) + +but task is already holding lock: +ffff888016848e00 (team->team_lock_key){+.+.}-{4:4}, at: team_add_slave (drivers/net/team/team_core.c:1147 drivers/net/team/team_core.c:1977) + +other info that might help us debug this: +Possible unsafe locking scenario: + +CPU0 +---- +lock(team->team_lock_key); +lock(team->team_lock_key); + +*** DEADLOCK *** + +May be due to missing lock nesting notation + +2 locks held by ip/7684: + +stack backtrace: +CPU: 3 UID: 0 PID: 7684 Comm: ip Not tainted 6.13.0-rc2-virtme-00441-ga14a429069bb #46 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 +Call Trace: + +dump_stack_lvl (lib/dump_stack.c:122) +print_deadlock_bug.cold (kernel/locking/lockdep.c:3040) +__lock_acquire (kernel/locking/lockdep.c:3893 kernel/locking/lockdep.c:5226) +? netlink_broadcast_filtered (net/netlink/af_netlink.c:1548) +lock_acquire.part.0 (kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5851) +? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) +? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 2)) +? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) +? lock_acquire (kernel/locking/lockdep.c:5822) +? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) +__mutex_lock (kernel/locking/mutex.c:587 kernel/locking/mutex.c:735) +? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) +? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) +? fib_sync_up (net/ipv4/fib_semantics.c:2167) +? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) +team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) +notifier_call_chain (kernel/notifier.c:85) +call_netdevice_notifiers_info (net/core/dev.c:1996) +__dev_notify_flags (net/core/dev.c:8993) +? __dev_change_flags (net/core/dev.c:8975) +dev_change_flags (net/core/dev.c:9027) +vlan_device_event (net/8021q/vlan.c:85 net/8021q/vlan.c:470) +? br_device_event (net/bridge/br.c:143) +notifier_call_chain (kernel/notifier.c:85) +call_netdevice_notifiers_info (net/core/dev.c:1996) +dev_open (net/core/dev.c:1519 net/core/dev.c:1505) +team_add_slave (drivers/net/team/team_core.c:1219 drivers/net/team/team_core.c:1977) +? __pfx_team_add_slave (drivers/net/team/team_core.c:1972) +do_set_master (net/core/rtnetlink.c:2917) +do_setlink.isra.0 (net/core/rtnetlink.c:3117) + +Reported-by: syzbot+3c47b5843403a45aef57@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=3c47b5843403a45aef57 +Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device") +Signed-off-by: Octavian Purdila +Reviewed-by: Hangbin Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/team/team_core.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c +index 1c85dda83825d..7f4ef219eee44 100644 +--- a/drivers/net/team/team_core.c ++++ b/drivers/net/team/team_core.c +@@ -1175,6 +1175,13 @@ static int team_port_add(struct team *team, struct net_device *port_dev, + return -EBUSY; + } + ++ if (netdev_has_upper_dev(port_dev, dev)) { ++ NL_SET_ERR_MSG(extack, "Device is already a lower device of the team interface"); ++ netdev_err(dev, "Device %s is already a lower device of the team interface\n", ++ portname); ++ return -EBUSY; ++ } ++ + if (port_dev->features & NETIF_F_VLAN_CHALLENGED && + vlan_uses_dev(dev)) { + NL_SET_ERR_MSG(extack, "Device is VLAN challenged and team device has VLAN set up"); +-- +2.39.5 + diff --git a/queue-6.12/tools-bootconfig-fix-the-wrong-format-specifier.patch b/queue-6.12/tools-bootconfig-fix-the-wrong-format-specifier.patch new file mode 100644 index 0000000000..0048341efe --- /dev/null +++ b/queue-6.12/tools-bootconfig-fix-the-wrong-format-specifier.patch @@ -0,0 +1,46 @@ +From 0f9efb6f1c24945604fad9e7266a304ac3304bbf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jan 2025 23:27:01 +0900 +Subject: tools/bootconfig: Fix the wrong format specifier + +From: Luo Yifan + +[ Upstream commit f6ab7384d554ba80ff4793259d75535874b366f5 ] + +Use '%u' instead of '%d' for unsigned int. + +Link: https://lore.kernel.org/all/20241105011048.201629-1-luoyifan@cmss.chinamobile.com/ + +Fixes: 973780011106 ("tools/bootconfig: Suppress non-error messages") +Signed-off-by: Luo Yifan +Signed-off-by: Masami Hiramatsu (Google) +Signed-off-by: Sasha Levin +--- + tools/bootconfig/main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/bootconfig/main.c b/tools/bootconfig/main.c +index 156b62a163c5a..8a48cc2536f56 100644 +--- a/tools/bootconfig/main.c ++++ b/tools/bootconfig/main.c +@@ -226,7 +226,7 @@ static int load_xbc_from_initrd(int fd, char **buf) + /* Wrong Checksum */ + rcsum = xbc_calc_checksum(*buf, size); + if (csum != rcsum) { +- pr_err("checksum error: %d != %d\n", csum, rcsum); ++ pr_err("checksum error: %u != %u\n", csum, rcsum); + return -EINVAL; + } + +@@ -395,7 +395,7 @@ static int apply_xbc(const char *path, const char *xbc_path) + xbc_get_info(&ret, NULL); + printf("\tNumber of nodes: %d\n", ret); + printf("\tSize: %u bytes\n", (unsigned int)size); +- printf("\tChecksum: %d\n", (unsigned int)csum); ++ printf("\tChecksum: %u\n", (unsigned int)csum); + + /* TODO: Check the options by schema */ + xbc_exit(); +-- +2.39.5 + diff --git a/queue-6.12/tools-sync-if_xdp.h-uapi-tooling-header.patch b/queue-6.12/tools-sync-if_xdp.h-uapi-tooling-header.patch new file mode 100644 index 0000000000..d8a048edbf --- /dev/null +++ b/queue-6.12/tools-sync-if_xdp.h-uapi-tooling-header.patch @@ -0,0 +1,46 @@ +From 332dfe181c564c8e85a85fd711cbc6a9cbb70bb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jan 2025 15:42:59 +0100 +Subject: tools: Sync if_xdp.h uapi tooling header + +From: Vishal Chourasia + +[ Upstream commit 01f3ce5328c405179b2c69ea047c423dad2bfa6d ] + +Sync if_xdp.h uapi header to remove following warning: + + Warning: Kernel ABI header at 'tools/include/uapi/linux/if_xdp.h' + differs from latest version at 'include/uapi/linux/if_xdp.h' + +Fixes: 48eb03dd2630 ("xsk: Add TX timestamp and TX checksum offload support") +Signed-off-by: Vishal Chourasia +Signed-off-by: Song Yoong Siang +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20250115032248.125742-1-yoong.siang.song@intel.com +Signed-off-by: Sasha Levin +--- + tools/include/uapi/linux/if_xdp.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/include/uapi/linux/if_xdp.h b/tools/include/uapi/linux/if_xdp.h +index 2f082b01ff228..42ec5ddaab8dc 100644 +--- a/tools/include/uapi/linux/if_xdp.h ++++ b/tools/include/uapi/linux/if_xdp.h +@@ -117,12 +117,12 @@ struct xdp_options { + ((1ULL << XSK_UNALIGNED_BUF_OFFSET_SHIFT) - 1) + + /* Request transmit timestamp. Upon completion, put it into tx_timestamp +- * field of union xsk_tx_metadata. ++ * field of struct xsk_tx_metadata. + */ + #define XDP_TXMD_FLAGS_TIMESTAMP (1 << 0) + + /* Request transmit checksum offload. Checksum start position and offset +- * are communicated via csum_start and csum_offset fields of union ++ * are communicated via csum_start and csum_offset fields of struct + * xsk_tx_metadata. + */ + #define XDP_TXMD_FLAGS_CHECKSUM (1 << 1) +-- +2.39.5 + diff --git a/queue-6.12/tools-testing-selftests-bpf-test_tc_tunnel.sh-fix-wa.patch b/queue-6.12/tools-testing-selftests-bpf-test_tc_tunnel.sh-fix-wa.patch new file mode 100644 index 0000000000..5db05fa168 --- /dev/null +++ b/queue-6.12/tools-testing-selftests-bpf-test_tc_tunnel.sh-fix-wa.patch @@ -0,0 +1,43 @@ +From fd649d9aeac5166bb478b5d34918104a0f5609ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Dec 2024 12:45:30 -0800 +Subject: tools/testing/selftests/bpf/test_tc_tunnel.sh: Fix wait for server + bind + +From: Marco Leogrande + +[ Upstream commit e2f0791124a1b6ca8d570110cbd487969d9d41ef ] + +Commit f803bcf9208a ("selftests/bpf: Prevent client connect before +server bind in test_tc_tunnel.sh") added code that waits for the +netcat server to start before the netcat client attempts to connect to +it. However, not all calls to 'server_listen' were guarded. + +This patch adds the existing 'wait_for_port' guard after the remaining +call to 'server_listen'. + +Fixes: f803bcf9208a ("selftests/bpf: Prevent client connect before server bind in test_tc_tunnel.sh") +Signed-off-by: Marco Leogrande +Acked-by: Stanislav Fomichev +Link: https://lore.kernel.org/r/20241202204530.1143448-1-leogrande@google.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_tc_tunnel.sh | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/bpf/test_tc_tunnel.sh b/tools/testing/selftests/bpf/test_tc_tunnel.sh +index 7989ec6084545..cb55a908bb0d7 100755 +--- a/tools/testing/selftests/bpf/test_tc_tunnel.sh ++++ b/tools/testing/selftests/bpf/test_tc_tunnel.sh +@@ -305,6 +305,7 @@ else + client_connect + verify_data + server_listen ++ wait_for_port ${port} ${netcat_opt} + fi + + # serverside, use BPF for decap +-- +2.39.5 + diff --git a/queue-6.12/tools-ynl-c-correct-reverse-decode-of-empty-attrs.patch b/queue-6.12/tools-ynl-c-correct-reverse-decode-of-empty-attrs.patch new file mode 100644 index 0000000000..a8433b551b --- /dev/null +++ b/queue-6.12/tools-ynl-c-correct-reverse-decode-of-empty-attrs.patch @@ -0,0 +1,56 @@ +From e59006fdce9c5ba3c09f08a699666b01130a3379 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jan 2025 17:21:30 -0800 +Subject: tools: ynl: c: correct reverse decode of empty attrs + +From: Jakub Kicinski + +[ Upstream commit 964417a5d4a06614ef7fb3ae69bb17c91a2dc016 ] + +netlink reports which attribute was incorrect by sending back +an attribute offset. Offset points to the address of struct nlattr, +but to interpret the type we also need the nesting path. +Attribute IDs have different meaning in different nests +of the same message. + +Correct the condition for "is the offset within current attribute". +ynl_attr_data_len() does not include the attribute header, +so the end offset was off by 4 bytes. + +This means that we'd always skip over flags and empty nests. + +The devmem tests, for example, issues an invalid request with +empty queue nests, resulting in the following error: + + YNL failed: Kernel error: missing attribute: .queues.ifindex + +The message is incorrect, "queues" nest does not have an "ifindex" +attribute defined. With this fix we decend correctly into the nest: + + YNL failed: Kernel error: missing attribute: .queues.id + +Fixes: 86878f14d71a ("tools: ynl: user space helpers") +Reviewed-by: Donald Hunter +Link: https://patch.msgid.link/20250124012130.1121227-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/net/ynl/lib/ynl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/net/ynl/lib/ynl.c b/tools/net/ynl/lib/ynl.c +index e16cef160bc2c..ce32cb35007d6 100644 +--- a/tools/net/ynl/lib/ynl.c ++++ b/tools/net/ynl/lib/ynl.c +@@ -95,7 +95,7 @@ ynl_err_walk(struct ynl_sock *ys, void *start, void *end, unsigned int off, + + ynl_attr_for_each_payload(start, data_len, attr) { + astart_off = (char *)attr - (char *)start; +- aend_off = astart_off + ynl_attr_data_len(attr); ++ aend_off = (char *)ynl_attr_data_end(attr) - (char *)start; + if (aend_off <= off) + continue; + +-- +2.39.5 + diff --git a/queue-6.12/tty-mips_ejtag_fdc-fix-one-more-u8-warning.patch b/queue-6.12/tty-mips_ejtag_fdc-fix-one-more-u8-warning.patch new file mode 100644 index 0000000000..1d232efc0a --- /dev/null +++ b/queue-6.12/tty-mips_ejtag_fdc-fix-one-more-u8-warning.patch @@ -0,0 +1,52 @@ +From 6dfd86a79c9a195d747cdd0a0a314a6f72a0b098 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 12:52:28 +0100 +Subject: tty: mips_ejtag_fdc: fix one more u8 warning + +From: Jiri Slaby (SUSE) + +[ Upstream commit 6dd1de91e7a62bfd3878992c1db6e1d443022c76 ] + +The LKP robot complains about: + drivers/tty/mips_ejtag_fdc.c:1224:31: error: incompatible pointer types passing 'const char *[1]' to parameter of type 'const u8 **' (aka 'const unsigned char **') + +Fix this by turning the missing pieces (fetch from kgdbfdc_wbuf) to u8 +too. Note the filling part (kgdbfdc_write_char()) already receives and +stores u8 to kgdbfdc_wbuf. + +Fixes: ce7cbd9a6c81 ("tty: mips_ejtag_fdc: use u8 for character pointers") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202501101327.oGdWbmuk-lkp@intel.com/ +Signed-off-by: Jiri Slaby (SUSE) +Link: https://lore.kernel.org/r/20250110115228.603980-1-jirislaby@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/mips_ejtag_fdc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/mips_ejtag_fdc.c b/drivers/tty/mips_ejtag_fdc.c +index afbf7738c7c47..58b28be63c79b 100644 +--- a/drivers/tty/mips_ejtag_fdc.c ++++ b/drivers/tty/mips_ejtag_fdc.c +@@ -1154,7 +1154,7 @@ static char kgdbfdc_rbuf[4]; + + /* write buffer to allow compaction */ + static unsigned int kgdbfdc_wbuflen; +-static char kgdbfdc_wbuf[4]; ++static u8 kgdbfdc_wbuf[4]; + + static void __iomem *kgdbfdc_setup(void) + { +@@ -1215,7 +1215,7 @@ static int kgdbfdc_read_char(void) + /* push an FDC word from write buffer to TX FIFO */ + static void kgdbfdc_push_one(void) + { +- const char *bufs[1] = { kgdbfdc_wbuf }; ++ const u8 *bufs[1] = { kgdbfdc_wbuf }; + struct fdc_word word; + void __iomem *regs; + unsigned int i; +-- +2.39.5 + diff --git a/queue-6.12/ubifs-skip-dumping-tnc-tree-when-zroot-is-null.patch b/queue-6.12/ubifs-skip-dumping-tnc-tree-when-zroot-is-null.patch new file mode 100644 index 0000000000..f5c3c0bb65 --- /dev/null +++ b/queue-6.12/ubifs-skip-dumping-tnc-tree-when-zroot-is-null.patch @@ -0,0 +1,60 @@ +From 2ae4a4e61c8c17f4d6de623072443f89720f1912 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 16:18:23 +0800 +Subject: ubifs: skip dumping tnc tree when zroot is null + +From: pangliyuan + +[ Upstream commit bdb0ca39e0acccf6771db49c3f94ed787d05f2d7 ] + +Clearing slab cache will free all znode in memory and make +c->zroot.znode = NULL, then dumping tnc tree will access +c->zroot.znode which cause null pointer dereference. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=219624#c0 +Fixes: 1e51764a3c2a ("UBIFS: add new flash file system") +Signed-off-by: pangliyuan +Reviewed-by: Zhihao Cheng +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + fs/ubifs/debug.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c +index 5cc69beaa62ec..10a86c02a8b32 100644 +--- a/fs/ubifs/debug.c ++++ b/fs/ubifs/debug.c +@@ -946,16 +946,20 @@ void ubifs_dump_tnc(struct ubifs_info *c) + + pr_err("\n"); + pr_err("(pid %d) start dumping TNC tree\n", current->pid); +- znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, NULL); +- level = znode->level; +- pr_err("== Level %d ==\n", level); +- while (znode) { +- if (level != znode->level) { +- level = znode->level; +- pr_err("== Level %d ==\n", level); ++ if (c->zroot.znode) { ++ znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, NULL); ++ level = znode->level; ++ pr_err("== Level %d ==\n", level); ++ while (znode) { ++ if (level != znode->level) { ++ level = znode->level; ++ pr_err("== Level %d ==\n", level); ++ } ++ ubifs_dump_znode(c, znode); ++ znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, znode); + } +- ubifs_dump_znode(c, znode); +- znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, znode); ++ } else { ++ pr_err("empty TNC tree in memory\n"); + } + pr_err("(pid %d) finish dumping TNC tree\n", current->pid); + } +-- +2.39.5 + diff --git a/queue-6.12/udp-deal-with-race-between-udp-socket-address-change.patch b/queue-6.12/udp-deal-with-race-between-udp-socket-address-change.patch new file mode 100644 index 0000000000..5a5b3b76a7 --- /dev/null +++ b/queue-6.12/udp-deal-with-race-between-udp-socket-address-change.patch @@ -0,0 +1,301 @@ +From 42a1f9601fd8e0f9093b9fd222bcb0cc20700b68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Dec 2024 17:21:16 +0100 +Subject: udp: Deal with race between UDP socket address change and rehash + +From: Stefano Brivio + +[ Upstream commit a502ea6fa94b1f7be72a24bcf9e3f5f6b7e6e90c ] + +If a UDP socket changes its local address while it's receiving +datagrams, as a result of connect(), there is a period during which +a lookup operation might fail to find it, after the address is changed +but before the secondary hash (port and address) and the four-tuple +hash (local and remote ports and addresses) are updated. + +Secondary hash chains were introduced by commit 30fff9231fad ("udp: +bind() optimisation") and, as a result, a rehash operation became +needed to make a bound socket reachable again after a connect(). + +This operation was introduced by commit 719f835853a9 ("udp: add +rehash on connect()") which isn't however a complete fix: the +socket will be found once the rehashing completes, but not while +it's pending. + +This is noticeable with a socat(1) server in UDP4-LISTEN mode, and a +client sending datagrams to it. After the server receives the first +datagram (cf. _xioopen_ipdgram_listen()), it issues a connect() to +the address of the sender, in order to set up a directed flow. + +Now, if the client, running on a different CPU thread, happens to +send a (subsequent) datagram while the server's socket changes its +address, but is not rehashed yet, this will result in a failed +lookup and a port unreachable error delivered to the client, as +apparent from the following reproducer: + + LEN=$(($(cat /proc/sys/net/core/wmem_default) / 4)) + dd if=/dev/urandom bs=1 count=${LEN} of=tmp.in + + while :; do + taskset -c 1 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc & + sleep 0.1 || sleep 1 + taskset -c 2 socat OPEN:tmp.in UDP4:localhost:1337,shut-null + wait + done + +where the client will eventually get ECONNREFUSED on a write() +(typically the second or third one of a given iteration): + + 2024/11/13 21:28:23 socat[46901] E write(6, 0x556db2e3c000, 8192): Connection refused + +This issue was first observed as a seldom failure in Podman's tests +checking UDP functionality while using pasta(1) to connect the +container's network namespace, which leads us to a reproducer with +the lookup error resulting in an ICMP packet on a tap device: + + LOCAL_ADDR="$(ip -j -4 addr show|jq -rM '.[] | .addr_info[0] | select(.scope == "global").local')" + + while :; do + ./pasta --config-net -p pasta.pcap -u 1337 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc & + sleep 0.2 || sleep 1 + socat OPEN:tmp.in UDP4:${LOCAL_ADDR}:1337,shut-null + wait + cmp tmp.in tmp.out + done + +Once this fails: + + tmp.in tmp.out differ: char 8193, line 29 + +we can finally have a look at what's going on: + + $ tshark -r pasta.pcap + 1 0.000000 :: ? ff02::16 ICMPv6 110 Multicast Listener Report Message v2 + 2 0.168690 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 + 3 0.168767 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 + 4 0.168806 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 + 5 0.168827 c6:47:05:8d:dc:04 ? Broadcast ARP 42 Who has 88.198.0.161? Tell 88.198.0.164 + 6 0.168851 9a:55:9a:55:9a:55 ? c6:47:05:8d:dc:04 ARP 42 88.198.0.161 is at 9a:55:9a:55:9a:55 + 7 0.168875 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 + 8 0.168896 88.198.0.164 ? 88.198.0.161 ICMP 590 Destination unreachable (Port unreachable) + 9 0.168926 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 + 10 0.168959 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 + 11 0.168989 88.198.0.161 ? 88.198.0.164 UDP 4138 60260 ? 1337 Len=4096 + 12 0.169010 88.198.0.161 ? 88.198.0.164 UDP 42 60260 ? 1337 Len=0 + +On the third datagram received, the network namespace of the container +initiates an ARP lookup to deliver the ICMP message. + +In another variant of this reproducer, starting the client with: + + strace -f pasta --config-net -u 1337 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc 2>strace.log & + +and connecting to the socat server using a loopback address: + + socat OPEN:tmp.in UDP4:localhost:1337,shut-null + +we can more clearly observe a sendmmsg() call failing after the +first datagram is delivered: + + [pid 278012] connect(173, 0x7fff96c95fc0, 16) = 0 + [...] + [pid 278012] recvmmsg(173, 0x7fff96c96020, 1024, MSG_DONTWAIT, NULL) = -1 EAGAIN (Resource temporarily unavailable) + [pid 278012] sendmmsg(173, 0x561c5ad0a720, 1, MSG_NOSIGNAL) = 1 + [...] + [pid 278012] sendmmsg(173, 0x561c5ad0a720, 1, MSG_NOSIGNAL) = -1 ECONNREFUSED (Connection refused) + +and, somewhat confusingly, after a connect() on the same socket +succeeded. + +Until commit 4cdeeee9252a ("net: udp: prefer listeners bound to an +address"), the race between receive address change and lookup didn't +actually cause visible issues, because, once the lookup based on the +secondary hash chain failed, we would still attempt a lookup based on +the primary hash (destination port only), and find the socket with the +outdated secondary hash. + +That change, however, dropped port-only lookups altogether, as side +effect, making the race visible. + +To fix this, while avoiding the need to make address changes and +rehash atomic against lookups, reintroduce primary hash lookups as +fallback, if lookups based on four-tuple and secondary hashes fail. + +To this end, introduce a simplified lookup implementation, which +doesn't take care of SO_REUSEPORT groups: if we have one, there are +multiple sockets that would match the four-tuple or secondary hash, +meaning that we can't run into this race at all. + +v2: + - instead of synchronising lookup operations against address change + plus rehash, reintroduce a simplified version of the original + primary hash lookup as fallback + +v1: + - fix build with CONFIG_IPV6=n: add ifdef around sk_v6_rcv_saddr + usage (Kuniyuki Iwashima) + - directly use sk_rcv_saddr for IPv4 receive addresses instead of + fetching inet_rcv_saddr (Kuniyuki Iwashima) + - move inet_update_saddr() to inet_hashtables.h and use that + to set IPv4/IPv6 addresses as suitable (Kuniyuki Iwashima) + - rebase onto net-next, update commit message accordingly + +Reported-by: Ed Santiago +Link: https://github.com/containers/podman/issues/24147 +Analysed-by: David Gibson +Fixes: 30fff9231fad ("udp: bind() optimisation") +Signed-off-by: Stefano Brivio +Reviewed-by: Eric Dumazet +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/udp.c | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++ + net/ipv6/udp.c | 50 ++++++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 106 insertions(+) + +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index ff85242720a0a..d2eeb6fc49b38 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -420,6 +420,49 @@ u32 udp_ehashfn(const struct net *net, const __be32 laddr, const __u16 lport, + udp_ehash_secret + net_hash_mix(net)); + } + ++/** ++ * udp4_lib_lookup1() - Simplified lookup using primary hash (destination port) ++ * @net: Network namespace ++ * @saddr: Source address, network order ++ * @sport: Source port, network order ++ * @daddr: Destination address, network order ++ * @hnum: Destination port, host order ++ * @dif: Destination interface index ++ * @sdif: Destination bridge port index, if relevant ++ * @udptable: Set of UDP hash tables ++ * ++ * Simplified lookup to be used as fallback if no sockets are found due to a ++ * potential race between (receive) address change, and lookup happening before ++ * the rehash operation. This function ignores SO_REUSEPORT groups while scoring ++ * result sockets, because if we have one, we don't need the fallback at all. ++ * ++ * Called under rcu_read_lock(). ++ * ++ * Return: socket with highest matching score if any, NULL if none ++ */ ++static struct sock *udp4_lib_lookup1(const struct net *net, ++ __be32 saddr, __be16 sport, ++ __be32 daddr, unsigned int hnum, ++ int dif, int sdif, ++ const struct udp_table *udptable) ++{ ++ unsigned int slot = udp_hashfn(net, hnum, udptable->mask); ++ struct udp_hslot *hslot = &udptable->hash[slot]; ++ struct sock *sk, *result = NULL; ++ int score, badness = 0; ++ ++ sk_for_each_rcu(sk, &hslot->head) { ++ score = compute_score(sk, net, ++ saddr, sport, daddr, hnum, dif, sdif); ++ if (score > badness) { ++ result = sk; ++ badness = score; ++ } ++ } ++ ++ return result; ++} ++ + /* called with rcu_read_lock() */ + static struct sock *udp4_lib_lookup2(const struct net *net, + __be32 saddr, __be16 sport, +@@ -525,6 +568,19 @@ struct sock *__udp4_lib_lookup(const struct net *net, __be32 saddr, + result = udp4_lib_lookup2(net, saddr, sport, + htonl(INADDR_ANY), hnum, dif, sdif, + hslot2, skb); ++ if (!IS_ERR_OR_NULL(result)) ++ goto done; ++ ++ /* Primary hash (destination port) lookup as fallback for this race: ++ * 1. __ip4_datagram_connect() sets sk_rcv_saddr ++ * 2. lookup (this function): new sk_rcv_saddr, hashes not updated yet ++ * 3. rehash operation updating _secondary and four-tuple_ hashes ++ * The primary hash doesn't need an update after 1., so, thanks to this ++ * further step, 1. and 3. don't need to be atomic against the lookup. ++ */ ++ result = udp4_lib_lookup1(net, saddr, sport, daddr, hnum, dif, sdif, ++ udptable); ++ + done: + if (IS_ERR(result)) + return NULL; +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 0cef8ae5d1ea1..896c9c827a288 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -159,6 +159,49 @@ static int compute_score(struct sock *sk, const struct net *net, + return score; + } + ++/** ++ * udp6_lib_lookup1() - Simplified lookup using primary hash (destination port) ++ * @net: Network namespace ++ * @saddr: Source address, network order ++ * @sport: Source port, network order ++ * @daddr: Destination address, network order ++ * @hnum: Destination port, host order ++ * @dif: Destination interface index ++ * @sdif: Destination bridge port index, if relevant ++ * @udptable: Set of UDP hash tables ++ * ++ * Simplified lookup to be used as fallback if no sockets are found due to a ++ * potential race between (receive) address change, and lookup happening before ++ * the rehash operation. This function ignores SO_REUSEPORT groups while scoring ++ * result sockets, because if we have one, we don't need the fallback at all. ++ * ++ * Called under rcu_read_lock(). ++ * ++ * Return: socket with highest matching score if any, NULL if none ++ */ ++static struct sock *udp6_lib_lookup1(const struct net *net, ++ const struct in6_addr *saddr, __be16 sport, ++ const struct in6_addr *daddr, ++ unsigned int hnum, int dif, int sdif, ++ const struct udp_table *udptable) ++{ ++ unsigned int slot = udp_hashfn(net, hnum, udptable->mask); ++ struct udp_hslot *hslot = &udptable->hash[slot]; ++ struct sock *sk, *result = NULL; ++ int score, badness = 0; ++ ++ sk_for_each_rcu(sk, &hslot->head) { ++ score = compute_score(sk, net, ++ saddr, sport, daddr, hnum, dif, sdif); ++ if (score > badness) { ++ result = sk; ++ badness = score; ++ } ++ } ++ ++ return result; ++} ++ + /* called with rcu_read_lock() */ + static struct sock *udp6_lib_lookup2(const struct net *net, + const struct in6_addr *saddr, __be16 sport, +@@ -263,6 +306,13 @@ struct sock *__udp6_lib_lookup(const struct net *net, + result = udp6_lib_lookup2(net, saddr, sport, + &in6addr_any, hnum, dif, sdif, + hslot2, skb); ++ if (!IS_ERR_OR_NULL(result)) ++ goto done; ++ ++ /* Cover address change/lookup/rehash race: see __udp4_lib_lookup() */ ++ result = udp6_lib_lookup1(net, saddr, sport, daddr, hnum, dif, sdif, ++ udptable); ++ + done: + if (IS_ERR(result)) + return NULL; +-- +2.39.5 + diff --git a/queue-6.12/vsock-allow-retrying-on-connect-failure.patch b/queue-6.12/vsock-allow-retrying-on-connect-failure.patch new file mode 100644 index 0000000000..7c6f9ad0e3 --- /dev/null +++ b/queue-6.12/vsock-allow-retrying-on-connect-failure.patch @@ -0,0 +1,45 @@ +From 23b3ed440c1a28a4792568fc3736c1023a03b834 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jan 2025 14:15:28 +0100 +Subject: vsock: Allow retrying on connect() failure + +From: Michal Luczaj + +[ Upstream commit aa388c72113b7458127b709bdd7d3628af26e9b4 ] + +sk_err is set when a (connectible) connect() fails. Effectively, this makes +an otherwise still healthy SS_UNCONNECTED socket impossible to use for any +subsequent connection attempts. + +Clear sk_err upon trying to establish a connection. + +Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") +Reviewed-by: Stefano Garzarella +Reviewed-by: Luigi Leonardi +Signed-off-by: Michal Luczaj +Link: https://patch.msgid.link/20250128-vsock-transport-vs-autobind-v3-2-1cf57065b770@rbox.co +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/vmw_vsock/af_vsock.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c +index 98315d9d07528..ec4c1fbbcec74 100644 +--- a/net/vmw_vsock/af_vsock.c ++++ b/net/vmw_vsock/af_vsock.c +@@ -1523,6 +1523,11 @@ static int vsock_connect(struct socket *sock, struct sockaddr *addr, + if (err < 0) + goto out; + ++ /* sk_err might have been set as a result of an earlier ++ * (failed) connect attempt. ++ */ ++ sk->sk_err = 0; ++ + /* Mark sock as connecting and set the error code to in + * progress in case this is a non-blocking connect. + */ +-- +2.39.5 + diff --git a/queue-6.12/vsock-keep-the-binding-until-socket-destruction.patch b/queue-6.12/vsock-keep-the-binding-until-socket-destruction.patch new file mode 100644 index 0000000000..2a3a633e80 --- /dev/null +++ b/queue-6.12/vsock-keep-the-binding-until-socket-destruction.patch @@ -0,0 +1,136 @@ +From ee6855bca8cf3c6f172db6654df92ee8da388de3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jan 2025 14:15:27 +0100 +Subject: vsock: Keep the binding until socket destruction + +From: Michal Luczaj + +[ Upstream commit fcdd2242c0231032fc84e1404315c245ae56322a ] + +Preserve sockets bindings; this includes both resulting from an explicit +bind() and those implicitly bound through autobind during connect(). + +Prevents socket unbinding during a transport reassignment, which fixes a +use-after-free: + + 1. vsock_create() (refcnt=1) calls vsock_insert_unbound() (refcnt=2) + 2. transport->release() calls vsock_remove_bound() without checking if + sk was bound and moved to bound list (refcnt=1) + 3. vsock_bind() assumes sk is in unbound list and before + __vsock_insert_bound(vsock_bound_sockets()) calls + __vsock_remove_bound() which does: + list_del_init(&vsk->bound_table); // nop + sock_put(&vsk->sk); // refcnt=0 + +BUG: KASAN: slab-use-after-free in __vsock_bind+0x62e/0x730 +Read of size 4 at addr ffff88816b46a74c by task a.out/2057 + dump_stack_lvl+0x68/0x90 + print_report+0x174/0x4f6 + kasan_report+0xb9/0x190 + __vsock_bind+0x62e/0x730 + vsock_bind+0x97/0xe0 + __sys_bind+0x154/0x1f0 + __x64_sys_bind+0x6e/0xb0 + do_syscall_64+0x93/0x1b0 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +Allocated by task 2057: + kasan_save_stack+0x1e/0x40 + kasan_save_track+0x10/0x30 + __kasan_slab_alloc+0x85/0x90 + kmem_cache_alloc_noprof+0x131/0x450 + sk_prot_alloc+0x5b/0x220 + sk_alloc+0x2c/0x870 + __vsock_create.constprop.0+0x2e/0xb60 + vsock_create+0xe4/0x420 + __sock_create+0x241/0x650 + __sys_socket+0xf2/0x1a0 + __x64_sys_socket+0x6e/0xb0 + do_syscall_64+0x93/0x1b0 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +Freed by task 2057: + kasan_save_stack+0x1e/0x40 + kasan_save_track+0x10/0x30 + kasan_save_free_info+0x37/0x60 + __kasan_slab_free+0x4b/0x70 + kmem_cache_free+0x1a1/0x590 + __sk_destruct+0x388/0x5a0 + __vsock_bind+0x5e1/0x730 + vsock_bind+0x97/0xe0 + __sys_bind+0x154/0x1f0 + __x64_sys_bind+0x6e/0xb0 + do_syscall_64+0x93/0x1b0 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +refcount_t: addition on 0; use-after-free. +WARNING: CPU: 7 PID: 2057 at lib/refcount.c:25 refcount_warn_saturate+0xce/0x150 +RIP: 0010:refcount_warn_saturate+0xce/0x150 + __vsock_bind+0x66d/0x730 + vsock_bind+0x97/0xe0 + __sys_bind+0x154/0x1f0 + __x64_sys_bind+0x6e/0xb0 + do_syscall_64+0x93/0x1b0 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +refcount_t: underflow; use-after-free. +WARNING: CPU: 7 PID: 2057 at lib/refcount.c:28 refcount_warn_saturate+0xee/0x150 +RIP: 0010:refcount_warn_saturate+0xee/0x150 + vsock_remove_bound+0x187/0x1e0 + __vsock_release+0x383/0x4a0 + vsock_release+0x90/0x120 + __sock_release+0xa3/0x250 + sock_close+0x14/0x20 + __fput+0x359/0xa80 + task_work_run+0x107/0x1d0 + do_exit+0x847/0x2560 + do_group_exit+0xb8/0x250 + __x64_sys_exit_group+0x3a/0x50 + x64_sys_call+0xfec/0x14f0 + do_syscall_64+0x93/0x1b0 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +Fixes: c0cfa2d8a788 ("vsock: add multi-transports support") +Reviewed-by: Stefano Garzarella +Signed-off-by: Michal Luczaj +Link: https://patch.msgid.link/20250128-vsock-transport-vs-autobind-v3-1-1cf57065b770@rbox.co +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/vmw_vsock/af_vsock.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c +index 15724f171b0f9..98315d9d07528 100644 +--- a/net/vmw_vsock/af_vsock.c ++++ b/net/vmw_vsock/af_vsock.c +@@ -337,7 +337,10 @@ EXPORT_SYMBOL_GPL(vsock_find_connected_socket); + + void vsock_remove_sock(struct vsock_sock *vsk) + { +- vsock_remove_bound(vsk); ++ /* Transport reassignment must not remove the binding. */ ++ if (sock_flag(sk_vsock(vsk), SOCK_DEAD)) ++ vsock_remove_bound(vsk); ++ + vsock_remove_connected(vsk); + } + EXPORT_SYMBOL_GPL(vsock_remove_sock); +@@ -821,12 +824,13 @@ static void __vsock_release(struct sock *sk, int level) + */ + lock_sock_nested(sk, level); + ++ sock_orphan(sk); ++ + if (vsk->transport) + vsk->transport->release(vsk); + else if (sock_type_connectible(sk->sk_type)) + vsock_remove_sock(vsk); + +- sock_orphan(sk); + sk->sk_shutdown = SHUTDOWN_MASK; + + skb_queue_purge(&sk->sk_receive_queue); +-- +2.39.5 + diff --git a/queue-6.12/vxlan-fix-uninit-value-in-vxlan_vnifilter_dump.patch b/queue-6.12/vxlan-fix-uninit-value-in-vxlan_vnifilter_dump.patch new file mode 100644 index 0000000000..c56e9aeda7 --- /dev/null +++ b/queue-6.12/vxlan-fix-uninit-value-in-vxlan_vnifilter_dump.patch @@ -0,0 +1,98 @@ +From bda5057e75185d0e109c4d734c3724adf854612d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jan 2025 23:57:46 +0900 +Subject: vxlan: Fix uninit-value in vxlan_vnifilter_dump() + +From: Shigeru Yoshida + +[ Upstream commit 5066293b9b7046a906eff60e3949a887ae185a43 ] + +KMSAN reported an uninit-value access in vxlan_vnifilter_dump() [1]. + +If the length of the netlink message payload is less than +sizeof(struct tunnel_msg), vxlan_vnifilter_dump() accesses bytes +beyond the message. This can lead to uninit-value access. Fix this by +returning an error in such situations. + +[1] +BUG: KMSAN: uninit-value in vxlan_vnifilter_dump+0x328/0x920 drivers/net/vxlan/vxlan_vnifilter.c:422 + vxlan_vnifilter_dump+0x328/0x920 drivers/net/vxlan/vxlan_vnifilter.c:422 + rtnl_dumpit+0xd5/0x2f0 net/core/rtnetlink.c:6786 + netlink_dump+0x93e/0x15f0 net/netlink/af_netlink.c:2317 + __netlink_dump_start+0x716/0xd60 net/netlink/af_netlink.c:2432 + netlink_dump_start include/linux/netlink.h:340 [inline] + rtnetlink_dump_start net/core/rtnetlink.c:6815 [inline] + rtnetlink_rcv_msg+0x1256/0x14a0 net/core/rtnetlink.c:6882 + netlink_rcv_skb+0x467/0x660 net/netlink/af_netlink.c:2542 + rtnetlink_rcv+0x35/0x40 net/core/rtnetlink.c:6944 + netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] + netlink_unicast+0xed6/0x1290 net/netlink/af_netlink.c:1347 + netlink_sendmsg+0x1092/0x1230 net/netlink/af_netlink.c:1891 + sock_sendmsg_nosec net/socket.c:711 [inline] + __sock_sendmsg+0x330/0x3d0 net/socket.c:726 + ____sys_sendmsg+0x7f4/0xb50 net/socket.c:2583 + ___sys_sendmsg+0x271/0x3b0 net/socket.c:2637 + __sys_sendmsg net/socket.c:2669 [inline] + __do_sys_sendmsg net/socket.c:2674 [inline] + __se_sys_sendmsg net/socket.c:2672 [inline] + __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2672 + x64_sys_call+0x3878/0x3d90 arch/x86/include/generated/asm/syscalls_64.h:47 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xd9/0x1d0 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +Uninit was created at: + slab_post_alloc_hook mm/slub.c:4110 [inline] + slab_alloc_node mm/slub.c:4153 [inline] + kmem_cache_alloc_node_noprof+0x800/0xe80 mm/slub.c:4205 + kmalloc_reserve+0x13b/0x4b0 net/core/skbuff.c:587 + __alloc_skb+0x347/0x7d0 net/core/skbuff.c:678 + alloc_skb include/linux/skbuff.h:1323 [inline] + netlink_alloc_large_skb+0xa5/0x280 net/netlink/af_netlink.c:1196 + netlink_sendmsg+0xac9/0x1230 net/netlink/af_netlink.c:1866 + sock_sendmsg_nosec net/socket.c:711 [inline] + __sock_sendmsg+0x330/0x3d0 net/socket.c:726 + ____sys_sendmsg+0x7f4/0xb50 net/socket.c:2583 + ___sys_sendmsg+0x271/0x3b0 net/socket.c:2637 + __sys_sendmsg net/socket.c:2669 [inline] + __do_sys_sendmsg net/socket.c:2674 [inline] + __se_sys_sendmsg net/socket.c:2672 [inline] + __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2672 + x64_sys_call+0x3878/0x3d90 arch/x86/include/generated/asm/syscalls_64.h:47 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xd9/0x1d0 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +CPU: 0 UID: 0 PID: 30991 Comm: syz.4.10630 Not tainted 6.12.0-10694-gc44daa7e3c73 #29 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 + +Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata device") +Reported-by: syzkaller +Signed-off-by: Shigeru Yoshida +Reviewed-by: Ido Schimmel +Link: https://patch.msgid.link/20250123145746.785768-1-syoshida@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/vxlan/vxlan_vnifilter.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/vxlan/vxlan_vnifilter.c b/drivers/net/vxlan/vxlan_vnifilter.c +index d2023e7131bd4..6e6e9f05509ab 100644 +--- a/drivers/net/vxlan/vxlan_vnifilter.c ++++ b/drivers/net/vxlan/vxlan_vnifilter.c +@@ -411,6 +411,11 @@ static int vxlan_vnifilter_dump(struct sk_buff *skb, struct netlink_callback *cb + struct tunnel_msg *tmsg; + struct net_device *dev; + ++ if (cb->nlh->nlmsg_len < nlmsg_msg_size(sizeof(struct tunnel_msg))) { ++ NL_SET_ERR_MSG(cb->extack, "Invalid msg length"); ++ return -EINVAL; ++ } ++ + tmsg = nlmsg_data(cb->nlh); + + if (tmsg->flags & ~TUNNEL_MSG_VALID_USER_FLAGS) { +-- +2.39.5 + diff --git a/queue-6.12/watchdog-rti_wdt-fix-an-of-node-leak-in-rti_wdt_prob.patch b/queue-6.12/watchdog-rti_wdt-fix-an-of-node-leak-in-rti_wdt_prob.patch new file mode 100644 index 0000000000..379c42cdd0 --- /dev/null +++ b/queue-6.12/watchdog-rti_wdt-fix-an-of-node-leak-in-rti_wdt_prob.patch @@ -0,0 +1,42 @@ +From 904c1fa95432f9c9976efd9540a6090d62c49f2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Jan 2025 20:17:18 +0900 +Subject: watchdog: rti_wdt: Fix an OF node leak in rti_wdt_probe() + +From: Joe Hattori + +[ Upstream commit 143981aa63f33d469a55a55fd9fb81cd90109672 ] + +rti_wdt_probe() does not release the OF node reference obtained by +of_parse_phandle(). Add a of_node_put() call. + +This was found by an experimental verification tool that I am +developing. Due to the lack of the actual device, no runtime test was +able to be performed. + +Fixes: f20ca595ae23 ("watchdog:rit_wdt: Add support for WDIOF_CARDRESET") +Signed-off-by: Joe Hattori +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20250105111718.4184192-1-joe@pf.is.s.u-tokyo.ac.jp +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/rti_wdt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/watchdog/rti_wdt.c b/drivers/watchdog/rti_wdt.c +index 563d842014dfb..cc239251e1938 100644 +--- a/drivers/watchdog/rti_wdt.c ++++ b/drivers/watchdog/rti_wdt.c +@@ -301,6 +301,7 @@ static int rti_wdt_probe(struct platform_device *pdev) + node = of_parse_phandle(pdev->dev.of_node, "memory-region", 0); + if (node) { + ret = of_address_to_resource(node, 0, &res); ++ of_node_put(node); + if (ret) { + dev_err(dev, "No memory address assigned to the region.\n"); + goto err_iomap; +-- +2.39.5 + diff --git a/queue-6.12/wifi-ath11k-fix-unexpected-return-buffer-manager-err.patch b/queue-6.12/wifi-ath11k-fix-unexpected-return-buffer-manager-err.patch new file mode 100644 index 0000000000..59aa3d7997 --- /dev/null +++ b/queue-6.12/wifi-ath11k-fix-unexpected-return-buffer-manager-err.patch @@ -0,0 +1,69 @@ +From 4936716a56222652257d459b97f1b3cc52827f0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Oct 2024 17:16:25 +0530 +Subject: wifi: ath11k: Fix unexpected return buffer manager error for + WCN6750/WCN6855 + +From: Balaji Pothunoori + +[ Upstream commit 78e154d42f2c72905fe66a400847e1b2b101b7b2 ] + +The following error messages were encountered while parsing fragmented RX +packets for WCN6750/WCN6855: + +ath11k 17a10040.wifi: invalid return buffer manager 4 + +This issue arose due to a hardcoded check for HAL_RX_BUF_RBM_SW3_BM +introduced in 'commit 71c748b5e01e ("ath11k: Fix unexpected return buffer +manager error for QCA6390")' + +For WCN6750 and WCN6855, the return buffer manager ID should be +HAL_RX_BUF_RBM_SW1_BM. The incorrect conditional check caused fragmented +packets to be dropped, resulting in the above error log. + +Fix this by adding a check for HAL_RX_BUF_RBM_SW1_BM. + +Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.2.0.c2-00258-QCAMSLSWPL-1 +Tested-on: WCN6855 hw2.1 WLAN.HSP.1.1-04479-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 + +Fixes: 71c748b5e01e ("ath11k: Fix unexpected return buffer manager error for QCA6390") +Signed-off-by: Balaji Pothunoori +Acked-by: Jeff Johnson +Acked-by: Kalle Valo +Link: https://patch.msgid.link/20241030114625.2416942-1-quic_bpothuno@quicinc.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/dp_rx.c | 1 + + drivers/net/wireless/ath/ath11k/hal_rx.c | 3 ++- + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c +index 40088e62572e1..40b52d12b4323 100644 +--- a/drivers/net/wireless/ath/ath11k/dp_rx.c ++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c +@@ -3872,6 +3872,7 @@ int ath11k_dp_process_rx_err(struct ath11k_base *ab, struct napi_struct *napi, + ath11k_hal_rx_msdu_link_info_get(link_desc_va, &num_msdus, msdu_cookies, + &rbm); + if (rbm != HAL_RX_BUF_RBM_WBM_IDLE_DESC_LIST && ++ rbm != HAL_RX_BUF_RBM_SW1_BM && + rbm != HAL_RX_BUF_RBM_SW3_BM) { + ab->soc_stats.invalid_rbm++; + ath11k_warn(ab, "invalid return buffer manager %d\n", rbm); +diff --git a/drivers/net/wireless/ath/ath11k/hal_rx.c b/drivers/net/wireless/ath/ath11k/hal_rx.c +index 8f7dd43dc1bd8..753bd93f02123 100644 +--- a/drivers/net/wireless/ath/ath11k/hal_rx.c ++++ b/drivers/net/wireless/ath/ath11k/hal_rx.c +@@ -372,7 +372,8 @@ int ath11k_hal_wbm_desc_parse_err(struct ath11k_base *ab, void *desc, + + ret_buf_mgr = FIELD_GET(BUFFER_ADDR_INFO1_RET_BUF_MGR, + wbm_desc->buf_addr_info.info1); +- if (ret_buf_mgr != HAL_RX_BUF_RBM_SW3_BM) { ++ if (ret_buf_mgr != HAL_RX_BUF_RBM_SW1_BM && ++ ret_buf_mgr != HAL_RX_BUF_RBM_SW3_BM) { + ab->soc_stats.invalid_rbm++; + return -EINVAL; + } +-- +2.39.5 + diff --git a/queue-6.12/wifi-ath12k-fix-tx-power-max-reg-power-update-to-fir.patch b/queue-6.12/wifi-ath12k-fix-tx-power-max-reg-power-update-to-fir.patch new file mode 100644 index 0000000000..2431ed7b9d --- /dev/null +++ b/queue-6.12/wifi-ath12k-fix-tx-power-max-reg-power-update-to-fir.patch @@ -0,0 +1,56 @@ +From cb9613e552c11ea5632392211132d99012ce6d0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Sep 2024 13:00:49 +0530 +Subject: wifi: ath12k: fix tx power, max reg power update to firmware + +From: Sathishkumar Muruganandam + +[ Upstream commit 3540bba855b4b422e8b977d11aa8173ccb4f089d ] + +Currently, when the vdev start WMI cmd is sent from host, vdev related +parameters such as max_reg_power, max_power, and max_antenna_gain are +multiplied by 2 before being sent to the firmware. This is incorrect +because the firmware uses 1 dBm steps for power calculations. + +This leads to incorrect power values being used in the firmware and +radio, potentially causing incorrect behavior. + +Fix the update of max_reg_power, max_power, and max_antenna_gain values +in the ath12k_mac_vdev_start_restart function, ensuring accurate +power settings in the firmware by sending these values as-is, +without multiplication. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00214-QCAHKSWPL_SILICONZ-1 +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 + +Signed-off-by: Sathishkumar Muruganandam +Signed-off-by: Santhosh Ramesh +Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") +Acked-by: Kalle Valo +Link: https://patch.msgid.link/20240909073049.3423035-1-quic_santrame@quicinc.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/mac.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c +index 8946141aa0dce..fbf5d57283576 100644 +--- a/drivers/net/wireless/ath/ath12k/mac.c ++++ b/drivers/net/wireless/ath/ath12k/mac.c +@@ -7220,9 +7220,9 @@ ath12k_mac_vdev_start_restart(struct ath12k_vif *arvif, + chandef->chan->band, + arvif->vif->type); + arg.min_power = 0; +- arg.max_power = chandef->chan->max_power * 2; +- arg.max_reg_power = chandef->chan->max_reg_power * 2; +- arg.max_antenna_gain = chandef->chan->max_antenna_gain * 2; ++ arg.max_power = chandef->chan->max_power; ++ arg.max_reg_power = chandef->chan->max_reg_power; ++ arg.max_antenna_gain = chandef->chan->max_antenna_gain; + + arg.pref_tx_streams = ar->num_tx_chains; + arg.pref_rx_streams = ar->num_rx_chains; +-- +2.39.5 + diff --git a/queue-6.12/wifi-brcmfmac-add-missing-header-include-for-brcmf_d.patch b/queue-6.12/wifi-brcmfmac-add-missing-header-include-for-brcmf_d.patch new file mode 100644 index 0000000000..4b05a00254 --- /dev/null +++ b/queue-6.12/wifi-brcmfmac-add-missing-header-include-for-brcmf_d.patch @@ -0,0 +1,53 @@ +From b5174d521fa17abbf5254d6c041fad087e5ec6b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 14:36:18 +0100 +Subject: wifi: brcmfmac: add missing header include for brcmf_dbg +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marcel Hamer + +[ Upstream commit b05d30c2b6df7e2172b18bf1baee9b202f9c6b53 ] + +Including the fwil.h header file can lead to a build error: + +drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h: \ + In function ‘brcmf_fil_cmd_int_set’: +drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h:90:9: error: implicit \ + declaration of function ‘brcmf_dbg’ [-Werror=implicit-function-declaration] + 90 | brcmf_dbg(FIL, "ifidx=%d, cmd=%d, value=%d\n", ifp->ifidx, cmd, data); + | ^~~~~~~~~ + +The error is often avoided because the debug.h header file is included +before the fwil.h header file. + +This makes sure the header include order is irrelevant by explicitly adding the +debug.h header. + +Fixes: 31343230abb1 ("wifi: brcmfmac: export firmware interface functions") +Signed-off-by: Marcel Hamer +Acked-by: Arend van Spriel +Signed-off-by: Kalle Valo +Link: https://patch.msgid.link/20241211133618.2014083-1-marcel.hamer@windriver.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h +index 31e080e4da669..ab3d6cfcb02bd 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h +@@ -6,6 +6,8 @@ + #ifndef _fwil_h_ + #define _fwil_h_ + ++#include "debug.h" ++ + /******************************************************************************* + * Dongle command codes that are interpreted by firmware + ******************************************************************************/ +-- +2.39.5 + diff --git a/queue-6.12/wifi-cfg80211-adjust-allocation-of-colocated-ap-data.patch b/queue-6.12/wifi-cfg80211-adjust-allocation-of-colocated-ap-data.patch new file mode 100644 index 0000000000..d485b4c32c --- /dev/null +++ b/queue-6.12/wifi-cfg80211-adjust-allocation-of-colocated-ap-data.patch @@ -0,0 +1,41 @@ +From 8e353f5d4aee6ec96c30be9379bf7eb60d32f844 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 18:54:17 +0300 +Subject: wifi: cfg80211: adjust allocation of colocated AP data + +From: Dmitry Antipov + +[ Upstream commit 1a0d24775cdee2b8dc14bfa4f4418c930ab1ac57 ] + +In 'cfg80211_scan_6ghz()', an instances of 'struct cfg80211_colocated_ap' +are allocated as if they would have 'ssid' as trailing VLA member. Since +this is not so, extra IEEE80211_MAX_SSID_LEN bytes are not needed. +Briefly tested with KUnit. + +Fixes: c8cb5b854b40 ("nl80211/cfg80211: support 6 GHz scanning") +Signed-off-by: Dmitry Antipov +Link: https://patch.msgid.link/20250113155417.552587-1-dmantipov@yandex.ru +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/scan.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/net/wireless/scan.c b/net/wireless/scan.c +index 21bc057fd8c29..18e132cdea72a 100644 +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -857,9 +857,7 @@ static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev) + if (ret) + continue; + +- entry = kzalloc(sizeof(*entry) + IEEE80211_MAX_SSID_LEN, +- GFP_ATOMIC); +- ++ entry = kzalloc(sizeof(*entry), GFP_ATOMIC); + if (!entry) + continue; + +-- +2.39.5 + diff --git a/queue-6.12/wifi-cfg80211-move-cfg80211_scan_req_add_chan-n_chan.patch b/queue-6.12/wifi-cfg80211-move-cfg80211_scan_req_add_chan-n_chan.patch new file mode 100644 index 0000000000..423f5d8041 --- /dev/null +++ b/queue-6.12/wifi-cfg80211-move-cfg80211_scan_req_add_chan-n_chan.patch @@ -0,0 +1,47 @@ +From a8b857b9b3d2c631254e9f023dd2a0674031cdd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 10:36:14 -0800 +Subject: wifi: cfg80211: Move cfg80211_scan_req_add_chan() n_channels + increment earlier + +From: Kees Cook + +[ Upstream commit 3a0168626c138734490bc52c4105ce8e79d2f923 ] + +Since adding __counted_by(n_channels) to struct cfg80211_scan_request, +anything adding to the channels array must increment n_channels first. +Move n_channels increment earlier. + +Reported-by: John Rowley +Closes: https://lore.kernel.org/stable/1815535c709ba9d9.156c6a5c9cdf6e59.b249b6b6a5ee4634@localhost.localdomain/ +Fixes: aa4ec06c455d ("wifi: cfg80211: use __counted_by where appropriate") +Signed-off-by: Kees Cook +Reviewed-by: Gustavo A. R. Silva +Link: https://patch.msgid.link/20241230183610.work.680-kees@kernel.org +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/scan.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/wireless/scan.c b/net/wireless/scan.c +index d0aed41ded2f1..21bc057fd8c29 100644 +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -763,12 +763,11 @@ static void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request, + } + } + ++ request->n_channels++; + request->channels[n_channels] = chan; + if (add_to_6ghz) + request->scan_6ghz_params[request->n_6ghz_params].channel_idx = + n_channels; +- +- request->n_channels++; + } + + static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap, +-- +2.39.5 + diff --git a/queue-6.12/wifi-cfg80211-tests-fix-potential-null-dereference-i.patch b/queue-6.12/wifi-cfg80211-tests-fix-potential-null-dereference-i.patch new file mode 100644 index 0000000000..77d9128a65 --- /dev/null +++ b/queue-6.12/wifi-cfg80211-tests-fix-potential-null-dereference-i.patch @@ -0,0 +1,39 @@ +From 7860b7d40a5d9327a368c4ce6ba678336279cbbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Nov 2024 00:38:36 -0600 +Subject: wifi: cfg80211: tests: Fix potential NULL dereference in + test_cfg80211_parse_colocated_ap() + +From: Zichen Xie + +[ Upstream commit 13c4f7714c6a1ecf748a2f22099447c14fe6ed8c ] + +kunit_kzalloc() may return NULL, dereferencing it without NULL check may +lead to NULL dereference. +Add a NULL check for ies. + +Fixes: 45d43937a44c ("wifi: cfg80211: add a kunit test for 6 GHz colocated AP parsing") +Signed-off-by: Zichen Xie +Link: https://patch.msgid.link/20241115063835.5888-1-zichenxie0106@gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/tests/scan.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/wireless/tests/scan.c b/net/wireless/tests/scan.c +index 9f458be716595..79a99cf5e8922 100644 +--- a/net/wireless/tests/scan.c ++++ b/net/wireless/tests/scan.c +@@ -810,6 +810,8 @@ static void test_cfg80211_parse_colocated_ap(struct kunit *test) + skb_put_data(input, "123", 3); + + ies = kunit_kzalloc(test, struct_size(ies, data, input->len), GFP_KERNEL); ++ KUNIT_ASSERT_NOT_NULL(test, ies); ++ + ies->len = input->len; + memcpy(ies->data, input->data, input->len); + +-- +2.39.5 + diff --git a/queue-6.12/wifi-iwlwifi-fw-read-step-table-from-correct-uefi-va.patch b/queue-6.12/wifi-iwlwifi-fw-read-step-table-from-correct-uefi-va.patch new file mode 100644 index 0000000000..4d77503ba8 --- /dev/null +++ b/queue-6.12/wifi-iwlwifi-fw-read-step-table-from-correct-uefi-va.patch @@ -0,0 +1,117 @@ +From caefa83aba966e3b7b6a8077097650a4cad8cd66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Dec 2024 10:01:01 +0200 +Subject: wifi: iwlwifi: fw: read STEP table from correct UEFI var + +From: Johannes Berg + +[ Upstream commit 80c2b651fe7fc82e1d1b3e4f9651095896a095f0 ] + +This variable exists for the "common" (WiFi/BT) GUID, not the +WiFi-only GUID. Fix that by passing the GUID to the function. +A short-cut for the wifi-only version remains so not all code +must be updated. + +However, rename the GUID defines to be clearer. + +Fixes: 09b4c35d73a5 ("wifi: iwlwifi: mvm: Support STEP equalizer settings from BIOS.") +Signed-off-by: Johannes Berg +Reviewed-by: Daniel Gabay +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20241227095718.89a5ad921b6d.Idae95a70ff69d2ba1b610e8eced826961ce7de98@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/fw/uefi.c | 44 +++++++++++++------- + 1 file changed, 30 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/uefi.c b/drivers/net/wireless/intel/iwlwifi/fw/uefi.c +index 091fb6fd7c787..834f7c9bb9e92 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/uefi.c ++++ b/drivers/net/wireless/intel/iwlwifi/fw/uefi.c +@@ -13,9 +13,12 @@ + #include + #include "fw/runtime.h" + +-#define IWL_EFI_VAR_GUID EFI_GUID(0x92daaf2f, 0xc02b, 0x455b, \ +- 0xb2, 0xec, 0xf5, 0xa3, \ +- 0x59, 0x4f, 0x4a, 0xea) ++#define IWL_EFI_WIFI_GUID EFI_GUID(0x92daaf2f, 0xc02b, 0x455b, \ ++ 0xb2, 0xec, 0xf5, 0xa3, \ ++ 0x59, 0x4f, 0x4a, 0xea) ++#define IWL_EFI_WIFI_BT_GUID EFI_GUID(0xe65d8884, 0xd4af, 0x4b20, \ ++ 0x8d, 0x03, 0x77, 0x2e, \ ++ 0xcc, 0x3d, 0xa5, 0x31) + + struct iwl_uefi_pnvm_mem_desc { + __le32 addr; +@@ -61,7 +64,7 @@ void *iwl_uefi_get_pnvm(struct iwl_trans *trans, size_t *len) + + *len = 0; + +- data = iwl_uefi_get_variable(IWL_UEFI_OEM_PNVM_NAME, &IWL_EFI_VAR_GUID, ++ data = iwl_uefi_get_variable(IWL_UEFI_OEM_PNVM_NAME, &IWL_EFI_WIFI_GUID, + &package_size); + if (IS_ERR(data)) { + IWL_DEBUG_FW(trans, +@@ -76,18 +79,18 @@ void *iwl_uefi_get_pnvm(struct iwl_trans *trans, size_t *len) + return data; + } + +-static +-void *iwl_uefi_get_verified_variable(struct iwl_trans *trans, +- efi_char16_t *uefi_var_name, +- char *var_name, +- unsigned int expected_size, +- unsigned long *size) ++static void * ++iwl_uefi_get_verified_variable_guid(struct iwl_trans *trans, ++ efi_guid_t *guid, ++ efi_char16_t *uefi_var_name, ++ char *var_name, ++ unsigned int expected_size, ++ unsigned long *size) + { + void *var; + unsigned long var_size; + +- var = iwl_uefi_get_variable(uefi_var_name, &IWL_EFI_VAR_GUID, +- &var_size); ++ var = iwl_uefi_get_variable(uefi_var_name, guid, &var_size); + + if (IS_ERR(var)) { + IWL_DEBUG_RADIO(trans, +@@ -112,6 +115,18 @@ void *iwl_uefi_get_verified_variable(struct iwl_trans *trans, + return var; + } + ++static void * ++iwl_uefi_get_verified_variable(struct iwl_trans *trans, ++ efi_char16_t *uefi_var_name, ++ char *var_name, ++ unsigned int expected_size, ++ unsigned long *size) ++{ ++ return iwl_uefi_get_verified_variable_guid(trans, &IWL_EFI_WIFI_GUID, ++ uefi_var_name, var_name, ++ expected_size, size); ++} ++ + int iwl_uefi_handle_tlv_mem_desc(struct iwl_trans *trans, const u8 *data, + u32 tlv_len, struct iwl_pnvm_image *pnvm_data) + { +@@ -311,8 +326,9 @@ void iwl_uefi_get_step_table(struct iwl_trans *trans) + if (trans->trans_cfg->device_family < IWL_DEVICE_FAMILY_AX210) + return; + +- data = iwl_uefi_get_verified_variable(trans, IWL_UEFI_STEP_NAME, +- "STEP", sizeof(*data), NULL); ++ data = iwl_uefi_get_verified_variable_guid(trans, &IWL_EFI_WIFI_BT_GUID, ++ IWL_UEFI_STEP_NAME, ++ "STEP", sizeof(*data), NULL); + if (IS_ERR(data)) + return; + +-- +2.39.5 + diff --git a/queue-6.12/wifi-iwlwifi-mvm-avoid-null-pointer-dereference.patch b/queue-6.12/wifi-iwlwifi-mvm-avoid-null-pointer-dereference.patch new file mode 100644 index 0000000000..b1f4a51aac --- /dev/null +++ b/queue-6.12/wifi-iwlwifi-mvm-avoid-null-pointer-dereference.patch @@ -0,0 +1,53 @@ +From d20cd138bf9ca0bdf20812bce6b25de407a7afee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Dec 2024 16:44:36 +0200 +Subject: wifi: iwlwifi: mvm: avoid NULL pointer dereference + +From: Miri Korenblit + +[ Upstream commit cf704a7624f99eb2ffca1a16c69183e85544a613 ] + +When iterating over the links of a vif, we need to make sure that the +pointer is valid (in other words - that the link exists) before +dereferncing it. +Use for_each_vif_active_link that also does the check. + +Fixes: 2b7ee1a10a72 ("wifi: iwlwiif: mvm: handle the new BT notif") +Signed-off-by: Miri Korenblit +Reviewed-by: Emmanuel Grumbach +Link: https://patch.msgid.link/20241229164246.31d41f7d3eab.I7fb7036a0b187c1636b01970207259cb2327952c@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/coex.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/coex.c b/drivers/net/wireless/intel/iwlwifi/mvm/coex.c +index b607961970e97..9b8624304fa30 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/coex.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/coex.c +@@ -530,18 +530,15 @@ static void iwl_mvm_bt_coex_notif_iterator(void *_data, u8 *mac, + struct ieee80211_vif *vif) + { + struct iwl_mvm *mvm = _data; ++ struct ieee80211_bss_conf *link_conf; ++ unsigned int link_id; + + lockdep_assert_held(&mvm->mutex); + + if (vif->type != NL80211_IFTYPE_STATION) + return; + +- for (int link_id = 0; +- link_id < IEEE80211_MLD_MAX_NUM_LINKS; +- link_id++) { +- struct ieee80211_bss_conf *link_conf = +- rcu_dereference_check(vif->link_conf[link_id], +- lockdep_is_held(&mvm->mutex)); ++ for_each_vif_active_link(vif, link_conf, link_id) { + struct ieee80211_chanctx_conf *chanctx_conf = + rcu_dereference_check(link_conf->chanctx_conf, + lockdep_is_held(&mvm->mutex)); +-- +2.39.5 + diff --git a/queue-6.12/wifi-iwlwifi-mvm-don-t-count-mgmt-frames-as-mpdu.patch b/queue-6.12/wifi-iwlwifi-mvm-don-t-count-mgmt-frames-as-mpdu.patch new file mode 100644 index 0000000000..297f307859 --- /dev/null +++ b/queue-6.12/wifi-iwlwifi-mvm-don-t-count-mgmt-frames-as-mpdu.patch @@ -0,0 +1,41 @@ +From 0ec8bd2f6df586ae53003b2f726b1b0ab0d15783 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Dec 2024 16:44:38 +0200 +Subject: wifi: iwlwifi: mvm: don't count mgmt frames as MPDU + +From: Daniel Gabay + +[ Upstream commit 76260267ba26a6e513acefa5e7de1200fbeb5b5d ] + +When handling TX_CMD notification, for mgmt frames tid is equal +to IWL_MAX_TID_COUNT, so with the current logic we'll count +that as MPDU, fix that. + +Fixes: ec0d43d26f2c ("wifi: iwlwifi: mvm: Activate EMLSR based on traffic volume") +Signed-off-by: Daniel Gabay +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20241229164246.80b119bb5d08.I31b1e8ba25cce15819225e5ac80332e4eaa20c13@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +index ca026b5256ce3..5f4942f6cc68e 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +@@ -1880,7 +1880,9 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm, + IWL_DEBUG_TX_REPLY(mvm, + "Next reclaimed packet:%d\n", + next_reclaimed); +- iwl_mvm_count_mpdu(mvmsta, sta_id, 1, true, 0); ++ if (tid < IWL_MAX_TID_COUNT) ++ iwl_mvm_count_mpdu(mvmsta, sta_id, 1, ++ true, 0); + } else { + IWL_DEBUG_TX_REPLY(mvm, + "NDP - don't update next_reclaimed\n"); +-- +2.39.5 + diff --git a/queue-6.12/wifi-mac80211-don-t-flush-non-uploaded-stas.patch b/queue-6.12/wifi-mac80211-don-t-flush-non-uploaded-stas.patch new file mode 100644 index 0000000000..5612f0726c --- /dev/null +++ b/queue-6.12/wifi-mac80211-don-t-flush-non-uploaded-stas.patch @@ -0,0 +1,44 @@ +From 1f6c147c921028af7b1fb8fabaec16e70da0f8b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jan 2025 16:20:06 +0200 +Subject: wifi: mac80211: don't flush non-uploaded STAs + +From: Johannes Berg + +[ Upstream commit aa3ce3f8fafa0b8fb062f28024855ea8cb3f3450 ] + +If STA state is pre-moved to AUTHORIZED (such as in IBSS +scenarios) and insertion fails, the station is freed. +In this case, the driver never knew about the station, +so trying to flush it is unexpected and may crash. + +Check if the sta was uploaded to the driver before and +fix this. + +Fixes: d00800a289c9 ("wifi: mac80211: add flush_sta method") +Signed-off-by: Johannes Berg +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20250102161730.e3d10970a7c7.I491bbcccc46f835ade07df0640a75f6ed92f20a3@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/driver-ops.h | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h +index d382d9729e853..a06644084d15d 100644 +--- a/net/mac80211/driver-ops.h ++++ b/net/mac80211/driver-ops.h +@@ -724,6 +724,9 @@ static inline void drv_flush_sta(struct ieee80211_local *local, + if (sdata && !check_sdata_in_driver(sdata)) + return; + ++ if (!sta->uploaded) ++ return; ++ + trace_drv_flush_sta(local, sdata, &sta->sta); + if (local->ops->flush_sta) + local->ops->flush_sta(&local->hw, &sdata->vif, &sta->sta); +-- +2.39.5 + diff --git a/queue-6.12/wifi-mac80211-fix-common-size-calculation-for-ml-ele.patch b/queue-6.12/wifi-mac80211-fix-common-size-calculation-for-ml-ele.patch new file mode 100644 index 0000000000..570cbf79b6 --- /dev/null +++ b/queue-6.12/wifi-mac80211-fix-common-size-calculation-for-ml-ele.patch @@ -0,0 +1,71 @@ +From 0c579fc29820071bc5ce2014a315473b264cb9a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jan 2025 16:20:00 +0200 +Subject: wifi: mac80211: Fix common size calculation for ML element + +From: Ilan Peer + +[ Upstream commit 19aa842dcbb5860509b7e1b7745dbae0b791f6c4 ] + +When the ML type is EPCS the control bitmap is reserved, the length +is always 7 and is captured by the 1st octet after the control. + +Fixes: 0f48b8b88aa9 ("wifi: ieee80211: add definitions for multi-link element") +Signed-off-by: Ilan Peer +Reviewed-by: Johannes Berg +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20250102161730.5790376754a7.I381208cbb72b1be2a88239509294099e9337e254@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + include/linux/ieee80211.h | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h +index 456bca45ff052..3750e56bfcbb3 100644 +--- a/include/linux/ieee80211.h ++++ b/include/linux/ieee80211.h +@@ -5053,28 +5053,24 @@ static inline u8 ieee80211_mle_common_size(const u8 *data) + { + const struct ieee80211_multi_link_elem *mle = (const void *)data; + u16 control = le16_to_cpu(mle->control); +- u8 common = 0; + + switch (u16_get_bits(control, IEEE80211_ML_CONTROL_TYPE)) { + case IEEE80211_ML_CONTROL_TYPE_BASIC: + case IEEE80211_ML_CONTROL_TYPE_PREQ: + case IEEE80211_ML_CONTROL_TYPE_TDLS: + case IEEE80211_ML_CONTROL_TYPE_RECONF: ++ case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS: + /* + * The length is the first octet pointed by mle->variable so no + * need to add anything + */ + break; +- case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS: +- if (control & IEEE80211_MLC_PRIO_ACCESS_PRES_AP_MLD_MAC_ADDR) +- common += ETH_ALEN; +- return common; + default: + WARN_ON(1); + return 0; + } + +- return sizeof(*mle) + common + mle->variable[0]; ++ return sizeof(*mle) + mle->variable[0]; + } + + /** +@@ -5312,8 +5308,7 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len) + check_common_len = true; + break; + case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS: +- if (control & IEEE80211_MLC_PRIO_ACCESS_PRES_AP_MLD_MAC_ADDR) +- common += ETH_ALEN; ++ common = ETH_ALEN + 1; + break; + default: + /* we don't know this type */ +-- +2.39.5 + diff --git a/queue-6.12/wifi-mac80211-fix-tid-removal-during-mesh-forwarding.patch b/queue-6.12/wifi-mac80211-fix-tid-removal-during-mesh-forwarding.patch new file mode 100644 index 0000000000..73fcf3c27e --- /dev/null +++ b/queue-6.12/wifi-mac80211-fix-tid-removal-during-mesh-forwarding.patch @@ -0,0 +1,78 @@ +From 19b8a3ca9ded2bfba91e6995237fb8049e9f130f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jan 2025 10:44:31 +0000 +Subject: wifi: mac80211: fix tid removal during mesh forwarding + +From: Andy Strohman + +[ Upstream commit 3aaa1a5a9a2ceeb32afa6ea4110a92338a863c33 ] + +With change (wifi: mac80211: fix receiving A-MSDU +frames on mesh interfaces), a non-zero TID assignment +is lost during slow path mesh forwarding. + +Prior to this change, ieee80211_rx_h_mesh_fwding() +left the TID intact in the header. + +As a result of this header corruption, packets belonging +to non-zero TIDs will get treating as belonging +TID 0 by functions such as ieee80211_get_tid(). +While this miscategorization by itself is an +issue, there are additional ramifications +due to the fact that skb->priority still reflects +the mesh forwarded packet's ingress (correct) TID. + +The mt7915 driver inspects the TID recorded within +skb->priority and relays this to the +hardware/radio during TX. The radio firmware appears to +react to this by changing the sequence control +header, but it does not also ensure/correct the TID in +the QoS control header. As a result, the receiver +will see packets with sequence numbers corresponding +to the wrong TID. The receiver of the forwarded +packet will see TID 0 in QoS control but a sequence number +corresponding to the correct (different) TID in sequence +control. This causes data stalls for TID 0 until +the TID 0 sequence number advances past what the receiver +believes it should be due to this bug. + +Mesh routing mpath changes cause a brief transition +from fast path forwarding to slow path forwarding. +Since this bug only affects the slow path forwarding, +mpath changes bring opportunity for the bug to be triggered. +In the author's case, he was experiencing TID 0 data stalls +after mpath changes on an intermediate mesh node. + +These observed stalls may be specific +to mediatek radios. But the inconsistency between +the packet header and skb->priority may cause problems +for other drivers as well. Regardless if this causes +connectivity issues on other radios, this change is +necessary in order transmit (forward) the packet on the +correct TID and to have a consistent view a packet's TID +within mac80211. + +Fixes: 986e43b19ae9 ("wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces") +Signed-off-by: Andy Strohman +Link: https://patch.msgid.link/20250107104431.446775-1-andrew@andrewstrohman.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/rx.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 694b43091fec6..6f3a86040cfcd 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2994,6 +2994,7 @@ ieee80211_rx_mesh_data(struct ieee80211_sub_if_data *sdata, struct sta_info *sta + } + + IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames); ++ ieee80211_set_qos_hdr(sdata, fwd_skb); + ieee80211_add_pending_skb(local, fwd_skb); + + rx_accept: +-- +2.39.5 + diff --git a/queue-6.12/wifi-mac80211-prohibit-deactivating-all-links.patch b/queue-6.12/wifi-mac80211-prohibit-deactivating-all-links.patch new file mode 100644 index 0000000000..e53386a9b8 --- /dev/null +++ b/queue-6.12/wifi-mac80211-prohibit-deactivating-all-links.patch @@ -0,0 +1,40 @@ +From d663126fc0879adb066587501b83a2a3140040ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 09:14:07 +0100 +Subject: wifi: mac80211: prohibit deactivating all links + +From: Johannes Berg + +[ Upstream commit 7553477cbfd784b128297f9ed43751688415bbaa ] + +In the internal API this calls this is a WARN_ON, but that +should remain since internally we want to know about bugs +that may cause this. Prevent deactivating all links in the +debugfs write directly. + +Reported-by: syzbot+0c5d8e65f23569a8ffec@syzkaller.appspotmail.com +Fixes: 3d9011029227 ("wifi: mac80211: implement link switching") +Signed-off-by: Johannes Berg +Link: https://patch.msgid.link/20241230091408.505bd125c35a.Ic3c1f9572b980a952a444cad62b09b9c6721732b@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/debugfs_netdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c +index 68596ef78b15e..d0b145888e139 100644 +--- a/net/mac80211/debugfs_netdev.c ++++ b/net/mac80211/debugfs_netdev.c +@@ -728,7 +728,7 @@ static ssize_t ieee80211_if_parse_active_links(struct ieee80211_sub_if_data *sda + { + u16 active_links; + +- if (kstrtou16(buf, 0, &active_links)) ++ if (kstrtou16(buf, 0, &active_links) || !active_links) + return -EINVAL; + + return ieee80211_set_active_links(&sdata->vif, active_links) ?: buflen; +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-connac-extend-mt76_connac_mcu_uni_add_dev-.patch b/queue-6.12/wifi-mt76-connac-extend-mt76_connac_mcu_uni_add_dev-.patch new file mode 100644 index 0000000000..f8665013e3 --- /dev/null +++ b/queue-6.12/wifi-mt76-connac-extend-mt76_connac_mcu_uni_add_dev-.patch @@ -0,0 +1,148 @@ +From e85130e8c1973f761fee7205a97c3bba111b60d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 17:19:10 -0800 +Subject: wifi: mt76: connac: Extend mt76_connac_mcu_uni_add_dev for MLO + +From: Sean Wang + +[ Upstream commit 9e4c3a007f01f567f2a8af35decd1e3c1c151c0f ] + +This commit extends the `mt76_connac_mcu_uni_add_dev` function to include +support for Multi-Link Operation (MLO). Additionally, backward +compatibility for MT7921 is preserved, enabling seamless integration with +existing setups. + +Fixes: 86c051f2c418 ("wifi: mt76: mt7925: enabling MLO when the firmware supports it") +Signed-off-by: Sean Wang +Link: https://patch.msgid.link/20241211011926.5002-1-sean.wang@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 2 +- + drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 +- + drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h | 1 + + drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 1 + + drivers/net/wireless/mediatek/mt76/mt7921/main.c | 1 + + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 4 +++- + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 2 +- + drivers/net/wireless/mediatek/mt76/mt792x_core.c | 3 ++- + 8 files changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c +index 96e34277fece9..1cc8fc8fefe74 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c +@@ -1113,7 +1113,7 @@ mt7615_mcu_uni_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif, + { + struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv; + +- return mt76_connac_mcu_uni_add_dev(phy->mt76, &vif->bss_conf, ++ return mt76_connac_mcu_uni_add_dev(phy->mt76, &vif->bss_conf, &mvif->mt76, + &mvif->sta.wcid, enable); + } + +diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c +index 864246f940889..7d07e720e4ec1 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c +@@ -1137,10 +1137,10 @@ EXPORT_SYMBOL_GPL(mt76_connac_mcu_wtbl_ba_tlv); + + int mt76_connac_mcu_uni_add_dev(struct mt76_phy *phy, + struct ieee80211_bss_conf *bss_conf, ++ struct mt76_vif *mvif, + struct mt76_wcid *wcid, + bool enable) + { +- struct mt76_vif *mvif = (struct mt76_vif *)bss_conf->vif->drv_priv; + struct mt76_dev *dev = phy->dev; + struct { + struct { +diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h +index 1b0e80dfc346b..57a8340fa7009 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h ++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h +@@ -1938,6 +1938,7 @@ void mt76_connac_mcu_sta_ba_tlv(struct sk_buff *skb, + bool enable, bool tx); + int mt76_connac_mcu_uni_add_dev(struct mt76_phy *phy, + struct ieee80211_bss_conf *bss_conf, ++ struct mt76_vif *mvif, + struct mt76_wcid *wcid, + bool enable); + int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif, +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c +index 047106b65d2bc..bd1455698ebe5 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c +@@ -647,6 +647,7 @@ mt7921_vif_connect_iter(void *priv, u8 *mac, + ieee80211_disconnect(vif, true); + + mt76_connac_mcu_uni_add_dev(&dev->mphy, &vif->bss_conf, ++ &mvif->bss_conf.mt76, + &mvif->sta.deflink.wcid, true); + mt7921_mcu_set_tx(dev, vif); + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c +index 0641538968e6f..e2dfd3670c4c9 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c +@@ -308,6 +308,7 @@ mt7921_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif) + mvif->bss_conf.mt76.wmm_idx = mvif->bss_conf.mt76.idx % MT76_CONNAC_MAX_WMM_SETS; + + ret = mt76_connac_mcu_uni_add_dev(&dev->mphy, &vif->bss_conf, ++ &mvif->bss_conf.mt76, + &mvif->sta.deflink.wcid, true); + if (ret) + goto out; +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mac.c b/drivers/net/wireless/mediatek/mt76/mt7925/mac.c +index 634c42bbf23f6..ddd406969061e 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mac.c +@@ -1271,6 +1271,7 @@ mt7925_vif_connect_iter(void *priv, u8 *mac, + struct mt792x_dev *dev = mvif->phy->dev; + struct ieee80211_hw *hw = mt76_hw(dev); + struct ieee80211_bss_conf *bss_conf; ++ struct mt792x_bss_conf *mconf; + int i; + + if (vif->type == NL80211_IFTYPE_STATION) +@@ -1278,8 +1279,9 @@ mt7925_vif_connect_iter(void *priv, u8 *mac, + + for_each_set_bit(i, &valid, IEEE80211_MLD_MAX_NUM_LINKS) { + bss_conf = mt792x_vif_to_bss_conf(vif, i); ++ mconf = mt792x_vif_to_link(mvif, i); + +- mt76_connac_mcu_uni_add_dev(&dev->mphy, bss_conf, ++ mt76_connac_mcu_uni_add_dev(&dev->mphy, bss_conf, &mconf->mt76, + &mvif->sta.deflink.wcid, true); + mt7925_mcu_set_tx(dev, bss_conf); + } +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +index a5110f8485e52..c45396b17a8af 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +@@ -372,7 +372,7 @@ static int mt7925_mac_link_bss_add(struct mt792x_dev *dev, + else + mconf->mt76.basic_rates_idx = MT792x_BASIC_RATES_TBL; + +- ret = mt76_connac_mcu_uni_add_dev(&dev->mphy, link_conf, ++ ret = mt76_connac_mcu_uni_add_dev(&dev->mphy, link_conf, &mconf->mt76, + &mlink->wcid, true); + if (ret) + goto out; +diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_core.c b/drivers/net/wireless/mediatek/mt76/mt792x_core.c +index 78fe37c2e07b5..b87eed4d168df 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt792x_core.c ++++ b/drivers/net/wireless/mediatek/mt76/mt792x_core.c +@@ -147,7 +147,8 @@ void mt792x_mac_link_bss_remove(struct mt792x_dev *dev, + link_conf = mt792x_vif_to_bss_conf(vif, mconf->link_id); + + mt76_connac_free_pending_tx_skbs(&dev->pm, &mlink->wcid); +- mt76_connac_mcu_uni_add_dev(&dev->mphy, link_conf, &mlink->wcid, false); ++ mt76_connac_mcu_uni_add_dev(&dev->mphy, link_conf, &mconf->mt76, ++ &mlink->wcid, false); + + rcu_assign_pointer(dev->mt76.wcid[idx], NULL); + +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-enhance-mt7925_mac_link_sta_add-to-support.patch b/queue-6.12/wifi-mt76-enhance-mt7925_mac_link_sta_add-to-support.patch new file mode 100644 index 0000000000..1f8cec8c6a --- /dev/null +++ b/queue-6.12/wifi-mt76-enhance-mt7925_mac_link_sta_add-to-support.patch @@ -0,0 +1,46 @@ +From 838324bef1a2eec1e24b58a67aec9faf5cd98da8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 17:19:18 -0800 +Subject: wifi: mt76: Enhance mt7925_mac_link_sta_add to support MLO + +From: Ming Yen Hsieh + +[ Upstream commit e6803d39a8aa59e557402a541a97ee04b06c49b2 ] + +Enhance mt7925_mac_link_sta_add to support MLO. + +Fixes: 86c051f2c418 ("wifi: mt76: mt7925: enabling MLO when the firmware supports it") +Signed-off-by: Ming Yen Hsieh +Signed-off-by: Sean Wang +Link: https://patch.msgid.link/20241211011926.5002-9-sean.wang@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +index 3cd3c3e289e72..1140af6577937 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +@@ -878,9 +878,14 @@ static int mt7925_mac_link_sta_add(struct mt76_dev *mdev, + link_conf = mt792x_vif_to_bss_conf(vif, link_id); + + /* should update bss info before STA add */ +- if (vif->type == NL80211_IFTYPE_STATION && !link_sta->sta->tdls) +- mt7925_mcu_add_bss_info(&dev->phy, mconf->mt76.ctx, +- link_conf, link_sta, false); ++ if (vif->type == NL80211_IFTYPE_STATION && !link_sta->sta->tdls) { ++ if (ieee80211_vif_is_mld(vif)) ++ mt7925_mcu_add_bss_info(&dev->phy, mconf->mt76.ctx, ++ link_conf, link_sta, link_sta != mlink->pri_link); ++ else ++ mt7925_mcu_add_bss_info(&dev->phy, mconf->mt76.ctx, ++ link_conf, link_sta, false); ++ } + + if (ieee80211_vif_is_mld(vif) && + link_sta == mlink->pri_link) { +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt76u_vendor_request-do-not-print-error-me.patch b/queue-6.12/wifi-mt76-mt76u_vendor_request-do-not-print-error-me.patch new file mode 100644 index 0000000000..8fad195de4 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt76u_vendor_request-do-not-print-error-me.patch @@ -0,0 +1,72 @@ +From cd8bd16b793ddb7e1141fd6a575de77751b3dbf7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 15:02:41 +0800 +Subject: wifi: mt76: mt76u_vendor_request: Do not print error messages when + -EPROTO +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: WangYuli + +[ Upstream commit f1b1e133a770fcdbd89551651232b034d2f7a27a ] + +When initializing the network card, unplugging the device will +trigger an -EPROTO error, resulting in a flood of error messages +being printed frantically. + +The exception is printed as follows： + + mt76x2u 2-2.4:1.0: vendor request req:47 off:9018 failed:-71 + mt76x2u 2-2.4:1.0: vendor request req:47 off:9018 failed:-71 + ... + +It will continue to print more than 2000 times for about 5 minutes, +causing the usb device to be unable to be disconnected. During this +period, the usb port cannot recognize the new device because the old +device has not disconnected. + +There may be other operating methods that cause -EPROTO, but -EPROTO is +a low-level hardware error. It is unwise to repeat vendor requests +expecting to read correct data. It is a better choice to treat -EPROTO +and -ENODEV the same way. + +Similar to commit 9b0f100c1970 ("mt76: usb: process URBs with status +EPROTO properly") do no schedule rx_worker for urb marked with status +set -EPROTO. I also reproduced this situation when plugging and +unplugging the device, and this patch is effective. + +Just do not vendor request again for urb marked with status set -EPROTO. + +Link: https://lore.kernel.org/all/531681bd-30f5-4a70-a156-bf8754b8e072@intel.com/ +Link: https://lore.kernel.org/all/D4B9CC1FFC0CBAC3+20250105040607.154706-1-wangyuli@uniontech.com/ +Fixes: b40b15e1521f ("mt76: add usb support to mt76 layer") +Co-developed-by: Xu Rao +Signed-off-by: Xu Rao +Signed-off-by: WangYuli +Link: https://patch.msgid.link/9DD7DE7AAB497CB7+20250113070241.63590-1-wangyuli@uniontech.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/usb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c +index 58ff068233894..f9e67b8c3b3c8 100644 +--- a/drivers/net/wireless/mediatek/mt76/usb.c ++++ b/drivers/net/wireless/mediatek/mt76/usb.c +@@ -33,9 +33,9 @@ int __mt76u_vendor_request(struct mt76_dev *dev, u8 req, u8 req_type, + + ret = usb_control_msg(udev, pipe, req, req_type, val, + offset, buf, len, MT_VEND_REQ_TOUT_MS); +- if (ret == -ENODEV) ++ if (ret == -ENODEV || ret == -EPROTO) + set_bit(MT76_REMOVED, &dev->phy.state); +- if (ret >= 0 || ret == -ENODEV) ++ if (ret >= 0 || ret == -ENODEV || ret == -EPROTO) + return ret; + usleep_range(5000, 10000); + } +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7915-firmware-restart-on-devices-with-a-.patch b/queue-6.12/wifi-mt76-mt7915-firmware-restart-on-devices-with-a-.patch new file mode 100644 index 0000000000..8d8eaab8c3 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7915-firmware-restart-on-devices-with-a-.patch @@ -0,0 +1,65 @@ +From 21d685cede7724930b4f2e51b0c7b40301864a49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 20:41:59 +0100 +Subject: wifi: mt76: mt7915: firmware restart on devices with a second pcie + link + +From: Felix Fietkau + +[ Upstream commit 9b60e2ae511c959024ecf6578b3fbe85cd06d7cc ] + +It seems that the firmware checks the register used for detecting matching +PCIe links in order to figure out if a secondary PCIe link is enabled. +Write the register again just before starting the firmware on hw reset, +in order to fix an issue that left the second band unusable after restart. + +Fixes: 9093cfff72e3 ("mt76: mt7915: add support for using a secondary PCIe link for gen1") +Link: https://patch.msgid.link/20241230194202.95065-11-nbd@nbd.name +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 2 ++ + drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h | 1 + + drivers/net/wireless/mediatek/mt76/mt7915/pci.c | 1 + + 3 files changed, 4 insertions(+) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +index cf77ce0c87599..b890a58d37300 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +@@ -1388,6 +1388,8 @@ mt7915_mac_restart(struct mt7915_dev *dev) + if (dev_is_pci(mdev->dev)) { + mt76_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0xff); + if (dev->hif2) { ++ mt76_wr(dev, MT_PCIE_RECOG_ID, ++ dev->hif2->index | MT_PCIE_RECOG_ID_SEM); + if (is_mt7915(mdev)) + mt76_wr(dev, MT_PCIE1_MAC_INT_ENABLE, 0xff); + else +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h +index ac0b1f0eb27c1..5fe872ef2e939 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h +@@ -191,6 +191,7 @@ struct mt7915_hif { + struct device *dev; + void __iomem *regs; + int irq; ++ u32 index; + }; + + struct mt7915_phy { +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/pci.c b/drivers/net/wireless/mediatek/mt76/mt7915/pci.c +index 39132894e8ea2..07b0a5766eab7 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/pci.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/pci.c +@@ -42,6 +42,7 @@ static struct mt7915_hif *mt7915_pci_get_hif2(u32 idx) + continue; + + get_device(hif->dev); ++ hif->index = idx; + goto out; + } + hif = NULL; +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7915-fix-an-error-handling-path-in-mt791.patch b/queue-6.12/wifi-mt76-mt7915-fix-an-error-handling-path-in-mt791.patch new file mode 100644 index 0000000000..c493a959f3 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7915-fix-an-error-handling-path-in-mt791.patch @@ -0,0 +1,42 @@ +From 1d8fdb384c175ad10ef109da65015e03051e644b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Sep 2024 21:53:40 +0200 +Subject: wifi: mt76: mt7915: Fix an error handling path in + mt7915_add_interface() + +From: Christophe JAILLET + +[ Upstream commit 126a516fe30639708e759678bcb10178938cc718 ] + +If mt76_wcid_alloc() fails, the "mt76.mutex" mutex needs to be released as +done in the other error handling paths of mt7915_add_interface(). + +Fixes: f3049b88b2b3 ("wifi: mt76: mt7915: allocate vif wcid in the same range as stations") +Signed-off-by: Christophe JAILLET +Link: https://patch.msgid.link/b9d8fbfc19360bfe60b9cea1cb0f735ab3b4bc26.1727639596.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7915/main.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c +index b7884772e2f40..8c0d63cebf3e1 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c +@@ -246,8 +246,10 @@ static int mt7915_add_interface(struct ieee80211_hw *hw, + phy->omac_mask |= BIT_ULL(mvif->mt76.omac_idx); + + idx = mt76_wcid_alloc(dev->mt76.wcid_mask, mt7915_wtbl_size(dev)); +- if (idx < 0) +- return -ENOSPC; ++ if (idx < 0) { ++ ret = -ENOSPC; ++ goto out; ++ } + + INIT_LIST_HEAD(&mvif->sta.rc_list); + INIT_LIST_HEAD(&mvif->sta.wcid.poll_list); +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7915-fix-mesh-scan-on-mt7916-dbdc.patch b/queue-6.12/wifi-mt76-mt7915-fix-mesh-scan-on-mt7916-dbdc.patch new file mode 100644 index 0000000000..54b73abf56 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7915-fix-mesh-scan-on-mt7916-dbdc.patch @@ -0,0 +1,46 @@ +From 16ad8120ca99e88b50a195cd2ddbdd866604fafe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Sep 2024 10:53:17 +0200 +Subject: wifi: mt76: mt7915: Fix mesh scan on MT7916 DBDC + +From: Nicolas Cavallari + +[ Upstream commit f21b77cb556296116b1cce1d62295d13e35da574 ] + +commit c4f075582304 ("wifi: mt76: mt7915: fix command timeout in AP stop +period") changes the behavior of mt7915_bss_info_changed() in mesh mode +when enable_beacon becomes false: it calls mt7915_mcu_add_bss_info(..., +false) and mt7915_mcu_add_sta(..., false) while the previous code +didn't. These sends mcu commands that apparently confuse the firmware. + +This breaks scanning while in mesh mode on AsiaRF MT7916 DBDC-based cards: +scanning works but no mesh frames get sent afterwards and the firmware +seems to be hosed. It breaks on MT7916 DBDC but not on MT7915 DBDC. + +Fixes: c4f075582304 ("wifi: mt76: mt7915: fix command timeout in AP stop period") +Signed-off-by: Nicolas Cavallari +Link: https://patch.msgid.link/20240927085350.4594-1-nicolas.cavallari@green-communications.fr +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7915/main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c +index d75e8dea1fbdc..b7884772e2f40 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c +@@ -619,8 +619,9 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw, + if (changed & BSS_CHANGED_ASSOC) + set_bss_info = vif->cfg.assoc; + if (changed & BSS_CHANGED_BEACON_ENABLED && ++ info->enable_beacon && + vif->type != NL80211_IFTYPE_AP) +- set_bss_info = set_sta = info->enable_beacon; ++ set_bss_info = set_sta = 1; + + if (set_bss_info == 1) + mt7915_mcu_add_bss_info(phy, vif, true); +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7915-fix-omac-index-assignment-after-har.patch b/queue-6.12/wifi-mt76-mt7915-fix-omac-index-assignment-after-har.patch new file mode 100644 index 0000000000..8ea22640d2 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7915-fix-omac-index-assignment-after-har.patch @@ -0,0 +1,48 @@ +From cfb475c2a1c480b32f465817510531c534475b29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 20:42:00 +0100 +Subject: wifi: mt76: mt7915: fix omac index assignment after hardware reset + +From: Felix Fietkau + +[ Upstream commit cd043bbba6f9b71ebe0781d1bd2107565363c4b9 ] + +Reset per-phy mac address slot mask in order to avoid leaking entries. + +Fixes: 8a55712d124f ("wifi: mt76: mt7915: enable full system reset support") +Link: https://patch.msgid.link/20241230194202.95065-12-nbd@nbd.name +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +index b890a58d37300..799e8d2cc7e6e 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +@@ -1444,9 +1444,11 @@ static void + mt7915_mac_full_reset(struct mt7915_dev *dev) + { + struct mt76_phy *ext_phy; ++ struct mt7915_phy *phy2; + int i; + + ext_phy = dev->mt76.phys[MT_BAND1]; ++ phy2 = ext_phy ? ext_phy->priv : NULL; + + dev->recovery.hw_full_reset = true; + +@@ -1476,6 +1478,9 @@ mt7915_mac_full_reset(struct mt7915_dev *dev) + + memset(dev->mt76.wcid_mask, 0, sizeof(dev->mt76.wcid_mask)); + dev->mt76.vif_mask = 0; ++ dev->phy.omac_mask = 0; ++ if (phy2) ++ phy2->omac_mask = 0; + + i = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA); + dev->mt76.global_wcid.idx = i; +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7915-fix-overflows-seen-when-writing-lim.patch b/queue-6.12/wifi-mt76-mt7915-fix-overflows-seen-when-writing-lim.patch new file mode 100644 index 0000000000..34b2b029ed --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7915-fix-overflows-seen-when-writing-lim.patch @@ -0,0 +1,39 @@ +From 1107bfb8de6a2be1d90111f095af374b8b2733ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Dec 2024 11:19:17 +0800 +Subject: wifi: mt76: mt7915: fix overflows seen when writing limit attributes + +From: xueqin Luo + +[ Upstream commit 64d571742b0ae44eee5efd51e2d4a09d7f6782fc ] + +DIV_ROUND_CLOSEST() after kstrtoul() results in an overflow if a large +number such as 18446744073709551615 is provided by the user. +Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations. +This commit was inspired by commit: 57ee12b6c514. + +Fixes: 02ee68b95d81 ("mt76: mt7915: add control knobs for thermal throttling") +Signed-off-by: xueqin Luo +Link: https://patch.msgid.link/20241202031917.23741-3-luoxueqin@kylinos.cn +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7915/init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c +index 6bef96e3d2a3d..77d82ccd73079 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c +@@ -82,7 +82,7 @@ static ssize_t mt7915_thermal_temp_store(struct device *dev, + return ret; + + mutex_lock(&phy->dev->mt76.mutex); +- val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 60, 130); ++ val = DIV_ROUND_CLOSEST(clamp_val(val, 60 * 1000, 130 * 1000), 1000); + + if ((i - 1 == MT7915_CRIT_TEMP_IDX && + val > phy->throttle_temp[MT7915_MAX_TEMP_IDX]) || +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7915-fix-register-mapping.patch b/queue-6.12/wifi-mt76-mt7915-fix-register-mapping.patch new file mode 100644 index 0000000000..91c8320e00 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7915-fix-register-mapping.patch @@ -0,0 +1,39 @@ +From 2d5195b00c1b8f5c291e5ce0ecaa1799bc61ae6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jan 2025 19:04:35 +0800 +Subject: wifi: mt76: mt7915: fix register mapping + +From: Peter Chiu + +[ Upstream commit dd1649ef966bb87053c17385ea2cfd1758f5385b ] + +Bypass the entry when ofs is equal to dev->reg.map[i].size. +Without this patch, it would get incorrect register mapping when the CR +address is located at the boundary of an entry. + +Fixes: cd4c314a65d3 ("mt76: mt7915: refine register definition") +Signed-off-by: Peter Chiu +Signed-off-by: Shengyu Qu +Link: https://patch.msgid.link/OSZPR01MB843401EAA1DA6BD7AEF356F298132@OSZPR01MB8434.jpnprd01.prod.outlook.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7915/mmio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c +index 44e112b8b5b36..2e7604eed27b0 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c +@@ -484,7 +484,7 @@ static u32 __mt7915_reg_addr(struct mt7915_dev *dev, u32 addr) + continue; + + ofs = addr - dev->reg.map[i].phys; +- if (ofs > dev->reg.map[i].size) ++ if (ofs >= dev->reg.map[i].size) + continue; + + return dev->reg.map[i].maps + ofs; +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7921-fix-using-incorrect-group-cipher-af.patch b/queue-6.12/wifi-mt76-mt7921-fix-using-incorrect-group-cipher-af.patch new file mode 100644 index 0000000000..a0887972ce --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7921-fix-using-incorrect-group-cipher-af.patch @@ -0,0 +1,47 @@ +From ff263ab26d5861446ec9a69858aef71056a4b01f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Aug 2024 10:43:35 +0800 +Subject: wifi: mt76: mt7921: fix using incorrect group cipher after + disconnection. + +From: Michael Lo + +[ Upstream commit aa566ac6b7272e7ea5359cb682bdca36d2fc7e73 ] + +To avoid incorrect cipher after disconnection, we should +do the key deletion process in this case. + +Fixes: e6db67fa871d ("wifi: mt76: ignore key disable commands") +Signed-off-by: Michael Lo +Signed-off-by: Ming Yen Hsieh +Tested-by: David Ruth +Reviewed-by: David Ruth +Link: https://patch.msgid.link/20240801024335.12981-1-mingyen.hsieh@mediatek.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7921/main.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c +index a7f5bfbc02ed1..0641538968e6f 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c +@@ -531,7 +531,13 @@ static int mt7921_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + } else { + if (idx == *wcid_keyidx) + *wcid_keyidx = -1; +- goto out; ++ ++ /* For security issue we don't trigger the key deletion when ++ * reassociating. But we should trigger the deletion process ++ * to avoid using incorrect cipher after disconnection, ++ */ ++ if (vif->type != NL80211_IFTYPE_STATION || vif->cfg.assoc) ++ goto out; + } + + mt76_wcid_key_setup(&dev->mt76, wcid, key); +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7925-cleanup-mlo-settings-post-disconnec.patch b/queue-6.12/wifi-mt76-mt7925-cleanup-mlo-settings-post-disconnec.patch new file mode 100644 index 0000000000..aafe77d9d8 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7925-cleanup-mlo-settings-post-disconnec.patch @@ -0,0 +1,122 @@ +From 0285e75c2d3687334ddb950bd43339f5a5c40dce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 17:19:25 -0800 +Subject: wifi: mt76: mt7925: Cleanup MLO settings post-disconnection + +From: Ming Yen Hsieh + +[ Upstream commit 816161051a039eeb1226fc85e2b38389f508906c ] + +Clean up MLO settings after disconnection. + +Fixes: 86c051f2c418 ("wifi: mt76: mt7925: enabling MLO when the firmware supports it") +Signed-off-by: Ming Yen Hsieh +Signed-off-by: Sean Wang +Link: https://patch.msgid.link/20241211011926.5002-16-sean.wang@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7925/main.c | 37 ++++++++++++++++++- + .../net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- + .../net/wireless/mediatek/mt76/mt7925/mcu.h | 2 +- + 3 files changed, 38 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +index a4ffa34d58a41..116b6980c7335 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +@@ -1149,8 +1149,7 @@ static void mt7925_mac_link_sta_remove(struct mt76_dev *mdev, + struct mt792x_bss_conf *mconf; + + mconf = mt792x_link_conf_to_mconf(link_conf); +- mt7925_mcu_add_bss_info(&dev->phy, mconf->mt76.ctx, link_conf, +- link_sta, false); ++ mt792x_mac_link_bss_remove(dev, mconf, mlink); + } + + spin_lock_bh(&mdev->sta_poll_lock); +@@ -1208,12 +1207,46 @@ void mt7925_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif, + { + struct mt792x_dev *dev = container_of(mdev, struct mt792x_dev, mt76); + struct mt792x_sta *msta = (struct mt792x_sta *)sta->drv_priv; ++ struct { ++ struct { ++ u8 omac_idx; ++ u8 band_idx; ++ __le16 pad; ++ } __packed hdr; ++ struct req_tlv { ++ __le16 tag; ++ __le16 len; ++ u8 active; ++ u8 link_idx; /* hw link idx */ ++ u8 omac_addr[ETH_ALEN]; ++ } __packed tlv; ++ } dev_req = { ++ .hdr = { ++ .omac_idx = 0, ++ .band_idx = 0, ++ }, ++ .tlv = { ++ .tag = cpu_to_le16(DEV_INFO_ACTIVE), ++ .len = cpu_to_le16(sizeof(struct req_tlv)), ++ .active = true, ++ }, ++ }; + unsigned long rem; + + rem = ieee80211_vif_is_mld(vif) ? msta->valid_links : BIT(0); + + mt7925_mac_sta_remove_links(dev, vif, sta, rem); + ++ if (ieee80211_vif_is_mld(vif)) { ++ mt7925_mcu_set_dbdc(&dev->mphy, false); ++ ++ /* recovery omac address for the legacy interface */ ++ memcpy(dev_req.tlv.omac_addr, vif->addr, ETH_ALEN); ++ mt76_mcu_send_msg(mdev, MCU_UNI_CMD(DEV_INFO_UPDATE), ++ &dev_req, sizeof(dev_req), true); ++ ++ } ++ + if (vif->type == NL80211_IFTYPE_STATION) { + struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv; + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +index e4c0f234aeed2..c7dd263446c9e 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +@@ -2660,7 +2660,7 @@ int mt7925_mcu_add_bss_info(struct mt792x_phy *phy, + MCU_UNI_CMD(BSS_INFO_UPDATE), true); + } + +-int mt7925_mcu_set_dbdc(struct mt76_phy *phy) ++int mt7925_mcu_set_dbdc(struct mt76_phy *phy, bool enable) + { + struct mt76_dev *mdev = phy->dev; + +@@ -2680,7 +2680,7 @@ int mt7925_mcu_set_dbdc(struct mt76_phy *phy) + tlv = mt76_connac_mcu_add_tlv(skb, UNI_MBMC_SETTING, sizeof(*conf)); + conf = (struct mbmc_conf_tlv *)tlv; + +- conf->mbmc_en = 1; ++ conf->mbmc_en = enable; + conf->band = 0; /* unused */ + + err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SET_DBDC_PARMS), +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h +index 31bb8ed2ec513..fe6a613ba0088 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h +@@ -616,7 +616,7 @@ mt7925_mcu_get_cipher(int cipher) + } + } + +-int mt7925_mcu_set_dbdc(struct mt76_phy *phy); ++int mt7925_mcu_set_dbdc(struct mt76_phy *phy, bool enable); + int mt7925_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif, + struct ieee80211_scan_request *scan_req); + int mt7925_mcu_cancel_hw_scan(struct mt76_phy *phy, +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7925-enhance-mt7925_mac_link_bss_add-to-.patch b/queue-6.12/wifi-mt76-mt7925-enhance-mt7925_mac_link_bss_add-to-.patch new file mode 100644 index 0000000000..2ac2720bf9 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7925-enhance-mt7925_mac_link_bss_add-to-.patch @@ -0,0 +1,63 @@ +From 3aac931e0a8381f5cecd73d8bf3d475216e49485 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 17:19:17 -0800 +Subject: wifi: mt76: mt7925: Enhance mt7925_mac_link_bss_add to support MLO + +From: Ming Yen Hsieh + +[ Upstream commit ac03e5b82bc6b44e8ea3e7c7c624ee1445ff4e4b ] + +In mt7925_mac_link_bss_add(), the mt76_connac_mcu_uni_add_dev() function +must be executed only after all parameters have been properly initialized. + +Fixes: 86c051f2c418 ("wifi: mt76: mt7925: enabling MLO when the firmware supports it") +Signed-off-by: Ming Yen Hsieh +Signed-off-by: Sean Wang +Link: https://patch.msgid.link/20241211011926.5002-8-sean.wang@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +index 268d216f09e20..3cd3c3e289e72 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +@@ -365,18 +365,14 @@ static int mt7925_mac_link_bss_add(struct mt792x_dev *dev, + mconf->mt76.omac_idx = ieee80211_vif_is_mld(vif) ? + 0 : mconf->mt76.idx; + mconf->mt76.band_idx = 0xff; +- mconf->mt76.wmm_idx = mconf->mt76.idx % MT76_CONNAC_MAX_WMM_SETS; ++ mconf->mt76.wmm_idx = ieee80211_vif_is_mld(vif) ? ++ 0 : mconf->mt76.idx % MT76_CONNAC_MAX_WMM_SETS; + + if (mvif->phy->mt76->chandef.chan->band != NL80211_BAND_2GHZ) + mconf->mt76.basic_rates_idx = MT792x_BASIC_RATES_TBL + 4; + else + mconf->mt76.basic_rates_idx = MT792x_BASIC_RATES_TBL; + +- ret = mt76_connac_mcu_uni_add_dev(&dev->mphy, link_conf, &mconf->mt76, +- &mlink->wcid, true); +- if (ret) +- goto out; +- + dev->mt76.vif_mask |= BIT_ULL(mconf->mt76.idx); + mvif->phy->omac_mask |= BIT_ULL(mconf->mt76.omac_idx); + +@@ -395,6 +391,12 @@ static int mt7925_mac_link_bss_add(struct mt792x_dev *dev, + ewma_rssi_init(&mconf->rssi); + + rcu_assign_pointer(dev->mt76.wcid[idx], &mlink->wcid); ++ ++ ret = mt76_connac_mcu_uni_add_dev(&dev->mphy, link_conf, &mconf->mt76, ++ &mlink->wcid, true); ++ if (ret) ++ goto out; ++ + if (vif->txq) { + mtxq = (struct mt76_txq *)vif->txq->drv_priv; + mtxq->wcid = idx; +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7925-fix-cnm-timeout-with-single-active-.patch b/queue-6.12/wifi-mt76-mt7925-fix-cnm-timeout-with-single-active-.patch new file mode 100644 index 0000000000..0d1ca0a118 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7925-fix-cnm-timeout-with-single-active-.patch @@ -0,0 +1,56 @@ +From 82305c1b8f1c744c80982e3badf1477f9813ced3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 17:19:16 -0800 +Subject: wifi: mt76: mt7925: Fix CNM Timeout with Single Active Link in MLO + +From: Leon Yen + +[ Upstream commit 4a596010b246816d7589d8d775b83833a59e63f9 ] + +Fix CNM command timeout issue when only a single active link is available +during MLO connection to fix the following kernel log error. + +[ 741.931030] wlan0: [link 1] local address be:90:e0:22:c4:22, AP link address 08:0c:43:7a:19:2a +[ 741.931042] wlan0: [link 1] determined AP 08:0c:43:7a:19:2a to be EHT +[ 741.931052] wlan0: [link 1] connecting with EHT mode, max bandwidth 160 MHz +[ 741.931071] wlan0: WMM AC=0 acm=0 aifs=2 cWmin=3 cWmax=7 txop=47 uapsd=0, downgraded=0 +[ 741.931076] wlan0: WMM AC=1 acm=0 aifs=2 cWmin=7 cWmax=15 txop=94 uapsd=0, downgraded=0 +[ 741.931080] wlan0: WMM AC=2 acm=0 aifs=3 cWmin=15 cWmax=1023 txop=0 uapsd=0, downgraded=0 +[ 741.931085] wlan0: WMM AC=3 acm=0 aifs=7 cWmin=15 cWmax=1023 txop=0 uapsd=0, downgraded=0 +[ 741.931095] wlan0: moving STA 22:0c:43:7a:19:2a to state 3 +[ 749.090928] mt7925e 0000:2b:00.0: Message 00020002 (seq 15) timeout +[ 752.162972] mt7925e 0000:2b:00.0: Message 00020003 (seq 1) timeout +[ 755.234975] mt7925e 0000:2b:00.0: Message 00020002 (seq 2) timeout +[ 758.306971] mt7925e 0000:2b:00.0: Message 00020004 (seq 3) timeout + +Fixes: 86c051f2c418 ("wifi: mt76: mt7925: enabling MLO when the firmware supports it") +Signed-off-by: Leon Yen +Signed-off-by: Sean Wang +Link: https://patch.msgid.link/20241211011926.5002-7-sean.wang@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +index 23d0b1d97956e..60a12b0e45ee6 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +@@ -1151,7 +1151,12 @@ int mt7925_mcu_set_mlo_roc(struct mt792x_bss_conf *mconf, u16 sel_links, + u8 rsv[4]; + } __packed hdr; + struct roc_acquire_tlv roc[2]; +- } __packed req; ++ } __packed req = { ++ .roc[0].tag = cpu_to_le16(UNI_ROC_NUM), ++ .roc[0].len = cpu_to_le16(sizeof(struct roc_acquire_tlv)), ++ .roc[1].tag = cpu_to_le16(UNI_ROC_NUM), ++ .roc[1].len = cpu_to_le16(sizeof(struct roc_acquire_tlv)) ++ }; + + if (!mconf || hweight16(vif->valid_links) < 2 || + hweight16(sel_links) != 2) +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7925-fix-get-wrong-chip-cap-from-incorre.patch b/queue-6.12/wifi-mt76-mt7925-fix-get-wrong-chip-cap-from-incorre.patch new file mode 100644 index 0000000000..b797fc69dd --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7925-fix-get-wrong-chip-cap-from-incorre.patch @@ -0,0 +1,37 @@ +From 1a155439609181f196b98879b437e3decb91c09c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Nov 2024 13:14:47 +0800 +Subject: wifi: mt76: mt7925: fix get wrong chip cap from incorrect pointer + +From: Ming Yen Hsieh + +[ Upstream commit 4d264f31b3074d361f65702dd7969861bcf1c158 ] + +Use tlv instead of skb, because using skb will get valid data +with wrong offset. + +Fixes: 86c051f2c418 ("wifi: mt76: mt7925: enabling MLO when the firmware supports it") +Signed-off-by: Ming Yen Hsieh +Link: https://patch.msgid.link/20241104051447.4286-1-mingyen.hsieh@mediatek.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +index a78883d4d6df0..b43617dbd5fde 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +@@ -823,7 +823,7 @@ mt7925_mcu_get_nic_capability(struct mt792x_dev *dev) + mt7925_mcu_parse_phy_cap(dev, tlv->data); + break; + case MT_NIC_CAP_CHIP_CAP: +- memcpy(&dev->phy.chip_cap, (void *)skb->data, sizeof(u64)); ++ dev->phy.chip_cap = le64_to_cpu(*(__le64 *)tlv->data); + break; + case MT_NIC_CAP_EML_CAP: + mt7925_mcu_parse_eml_cap(dev, tlv->data); +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7925-fix-incorrect-mld-address-in-bss_ml.patch b/queue-6.12/wifi-mt76-mt7925-fix-incorrect-mld-address-in-bss_ml.patch new file mode 100644 index 0000000000..9fd1356d96 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7925-fix-incorrect-mld-address-in-bss_ml.patch @@ -0,0 +1,47 @@ +From 70dc19d642f18338561c278a30cf93a1033e829c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 17:19:11 -0800 +Subject: wifi: mt76: mt7925: Fix incorrect MLD address in bss_mld_tlv for MLO + support + +From: Ming Yen Hsieh + +[ Upstream commit 4d5427443595439c6cf5edfd9fb7224589f65b27 ] + +For this TLV, the address should be set to the MLD address rather than +the link address. + +Fixes: 86c051f2c418 ("wifi: mt76: mt7925: enabling MLO when the firmware supports it") +Signed-off-by: Ming Yen Hsieh +Signed-off-by: Sean Wang +Link: https://patch.msgid.link/20241211011926.5002-2-sean.wang@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +index 123a585098e3b..7105705113baa 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +@@ -2459,6 +2459,7 @@ static void + mt7925_mcu_bss_mld_tlv(struct sk_buff *skb, + struct ieee80211_bss_conf *link_conf) + { ++ struct ieee80211_vif *vif = link_conf->vif; + struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf); + struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv; + struct bss_mld_tlv *mld; +@@ -2479,7 +2480,7 @@ mt7925_mcu_bss_mld_tlv(struct sk_buff *skb, + mld->eml_enable = !!(link_conf->vif->cfg.eml_cap & + IEEE80211_EML_CAP_EMLSR_SUPP); + +- memcpy(mld->mac_addr, link_conf->addr, ETH_ALEN); ++ memcpy(mld->mac_addr, vif->addr, ETH_ALEN); + } + + static void +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7925-fix-incorrect-wcid-assignment-for-m.patch b/queue-6.12/wifi-mt76-mt7925-fix-incorrect-wcid-assignment-for-m.patch new file mode 100644 index 0000000000..475274d552 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7925-fix-incorrect-wcid-assignment-for-m.patch @@ -0,0 +1,89 @@ +From 9ae3bc48c4de628d9aa70f2465cece070f5d86d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 17:19:12 -0800 +Subject: wifi: mt76: mt7925: Fix incorrect WCID assignment for MLO + +From: Ming Yen Hsieh + +[ Upstream commit 4911e4cb157cf87d5bdb3fa8e0c200032443371e ] + +For MLO, each link must have a corresponding WCID. + +Fixes: 86c051f2c418 ("wifi: mt76: mt7925: enabling MLO when the firmware supports it") +Signed-off-by: Ming Yen Hsieh +Signed-off-by: Sean Wang +Link: https://patch.msgid.link/20241211011926.5002-3-sean.wang@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7925/mac.c | 2 +- + .../net/wireless/mediatek/mt76/mt7925/main.c | 19 ++++++++++--------- + 2 files changed, 11 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mac.c b/drivers/net/wireless/mediatek/mt76/mt7925/mac.c +index ddd406969061e..a095fb31e391a 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mac.c +@@ -49,7 +49,7 @@ static void mt7925_mac_sta_poll(struct mt792x_dev *dev) + break; + mlink = list_first_entry(&sta_poll_list, + struct mt792x_link_sta, wcid.poll_list); +- msta = container_of(mlink, struct mt792x_sta, deflink); ++ msta = mlink->sta; + spin_lock_bh(&dev->mt76.sta_poll_lock); + list_del_init(&mlink->wcid.poll_list); + spin_unlock_bh(&dev->mt76.sta_poll_lock); +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +index c45396b17a8af..cbc7a50810256 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +@@ -837,6 +837,7 @@ static int mt7925_mac_link_sta_add(struct mt76_dev *mdev, + u8 link_id = link_sta->link_id; + struct mt792x_link_sta *mlink; + struct mt792x_sta *msta; ++ struct mt76_wcid *wcid; + int ret, idx; + + msta = (struct mt792x_sta *)link_sta->sta->drv_priv; +@@ -855,6 +856,15 @@ static int mt7925_mac_link_sta_add(struct mt76_dev *mdev, + mlink->last_txs = jiffies; + mlink->wcid.link_id = link_sta->link_id; + mlink->wcid.link_valid = !!link_sta->sta->valid_links; ++ mlink->sta = msta; ++ ++ wcid = &mlink->wcid; ++ ewma_signal_init(&wcid->rssi); ++ rcu_assign_pointer(dev->mt76.wcid[wcid->idx], wcid); ++ mt76_wcid_init(wcid); ++ ewma_avg_signal_init(&mlink->avg_ack_signal); ++ memset(mlink->airtime_ac, 0, ++ sizeof(msta->deflink.airtime_ac)); + + ret = mt76_connac_pm_wake(&dev->mphy, &dev->pm); + if (ret) +@@ -904,7 +914,6 @@ mt7925_mac_sta_add_links(struct mt792x_dev *dev, struct ieee80211_vif *vif, + struct ieee80211_sta *sta, unsigned long new_links) + { + struct mt792x_sta *msta = (struct mt792x_sta *)sta->drv_priv; +- struct mt76_wcid *wcid; + unsigned int link_id; + int err = 0; + +@@ -921,14 +930,6 @@ mt7925_mac_sta_add_links(struct mt792x_dev *dev, struct ieee80211_vif *vif, + err = -ENOMEM; + break; + } +- +- wcid = &mlink->wcid; +- ewma_signal_init(&wcid->rssi); +- rcu_assign_pointer(dev->mt76.wcid[wcid->idx], wcid); +- mt76_wcid_init(wcid); +- ewma_avg_signal_init(&mlink->avg_ack_signal); +- memset(mlink->airtime_ac, 0, +- sizeof(msta->deflink.airtime_ac)); + } + + msta->valid_links |= BIT(link_id); +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7925-fix-incorrect-wcid-phy_idx-assignme.patch b/queue-6.12/wifi-mt76-mt7925-fix-incorrect-wcid-phy_idx-assignme.patch new file mode 100644 index 0000000000..9a4b61ce7c --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7925-fix-incorrect-wcid-phy_idx-assignme.patch @@ -0,0 +1,46 @@ +From 1ad34c486707d1782302b67b3cff4f65cb65d46c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 17:19:14 -0800 +Subject: wifi: mt76: mt7925: Fix incorrect WCID phy_idx assignment + +From: allan.wang + +[ Upstream commit 4f741a2378b27a6be5e63b829cae4eb9cf2484e7 ] + +Fix incorrect WCID phy_idx assignment. + +Fixes: 86c051f2c418 ("wifi: mt76: mt7925: enabling MLO when the firmware supports it") +Signed-off-by: allan.wang +Signed-off-by: Sean Wang +Link: https://patch.msgid.link/20241211011926.5002-5-sean.wang@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +index cbc7a50810256..268d216f09e20 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +@@ -384,7 +384,7 @@ static int mt7925_mac_link_bss_add(struct mt792x_dev *dev, + + INIT_LIST_HEAD(&mlink->wcid.poll_list); + mlink->wcid.idx = idx; +- mlink->wcid.phy_idx = mconf->mt76.band_idx; ++ mlink->wcid.phy_idx = 0; + mlink->wcid.hw_key_idx = -1; + mlink->wcid.tx_info |= MT_WCID_TX_INFO_SET; + mt76_wcid_init(&mlink->wcid); +@@ -851,7 +851,7 @@ static int mt7925_mac_link_sta_add(struct mt76_dev *mdev, + INIT_LIST_HEAD(&mlink->wcid.poll_list); + mlink->wcid.sta = 1; + mlink->wcid.idx = idx; +- mlink->wcid.phy_idx = mconf->mt76.band_idx; ++ mlink->wcid.phy_idx = 0; + mlink->wcid.tx_info |= MT_WCID_TX_INFO_SET; + mlink->last_txs = jiffies; + mlink->wcid.link_id = link_sta->link_id; +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7925-fix-null-deref-check-in-mt7925_chan.patch b/queue-6.12/wifi-mt76-mt7925-fix-null-deref-check-in-mt7925_chan.patch new file mode 100644 index 0000000000..42fe21b7c3 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7925-fix-null-deref-check-in-mt7925_chan.patch @@ -0,0 +1,37 @@ +From fa6148b8392ce06fdcd27fc99a28c881b01a984c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2024 15:55:54 +0800 +Subject: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links + +From: Charles Han + +[ Upstream commit 5cd0bd815c8a48862a296df9b30e0ea0da14acd3 ] + +In mt7925_change_vif_links() devm_kzalloc() may return NULL but this +returned value is not checked. + +Fixes: 69acd6d910b0 ("wifi: mt76: mt7925: add mt7925_change_vif_links") +Signed-off-by: Charles Han +Link: https://patch.msgid.link/20241025075554.181572-1-hanchunchao@inspur.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +index 791c8b00e1126..a5110f8485e52 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +@@ -1946,6 +1946,8 @@ mt7925_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif, + GFP_KERNEL); + mlink = devm_kzalloc(dev->mt76.dev, sizeof(*mlink), + GFP_KERNEL); ++ if (!mconf || !mlink) ++ return -ENOMEM; + } + + mconfs[link_id] = mconf; +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7925-fix-off-by-one-in-mt7925_load_clc.patch b/queue-6.12/wifi-mt76-mt7925-fix-off-by-one-in-mt7925_load_clc.patch new file mode 100644 index 0000000000..1cbca6a386 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7925-fix-off-by-one-in-mt7925_load_clc.patch @@ -0,0 +1,37 @@ +From 114a1461fd49a1910c79df6939eecddd371b9510 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Sep 2024 10:43:03 +0300 +Subject: wifi: mt76: mt7925: fix off by one in mt7925_load_clc() + +From: Dan Carpenter + +[ Upstream commit 08fa656c91fd5fdf47ba393795b9c0d1e97539ed ] + +This comparison should be >= instead of > to prevent an out of bounds +read and write. + +Fixes: 9679ca7326e5 ("wifi: mt76: mt7925: fix a potential array-index-out-of-bounds issue for clc") +Signed-off-by: Dan Carpenter +Link: https://patch.msgid.link/84bf5dd2-2fe3-4410-a7af-ae841e41082a@stanley.mountain +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +index 748ea6adbc6b3..0c2a2337c313d 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +@@ -638,7 +638,7 @@ static int mt7925_load_clc(struct mt792x_dev *dev, const char *fw_name) + for (offset = 0; offset < len; offset += le32_to_cpu(clc->len)) { + clc = (const struct mt7925_clc *)(clc_base + offset); + +- if (clc->idx > ARRAY_SIZE(phy->clc)) ++ if (clc->idx >= ARRAY_SIZE(phy->clc)) + break; + + /* do not init buf again if chip reset triggered */ +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7925-fix-the-invalid-ip-address-for-arp-.patch b/queue-6.12/wifi-mt76-mt7925-fix-the-invalid-ip-address-for-arp-.patch new file mode 100644 index 0000000000..af40f6642e --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7925-fix-the-invalid-ip-address-for-arp-.patch @@ -0,0 +1,40 @@ +From 380b8af4dafa5d1f56eaf27da47ad057647dfac4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 13:30:05 +0800 +Subject: wifi: mt76: mt7925: fix the invalid ip address for arp offload + +From: Ming Yen Hsieh + +[ Upstream commit 113d469e7e23579a64b0fbb2eadf9228763092be ] + +The wrong ieee80211_vif will lead to get invalid ip address and +the correct ieee80211_vif can be obtained from ieee80211_bss_conf. + +Fixes: 147324292979 ("wifi: mt76: mt7925: add link handling in the BSS_CHANGED_ARP_FILTER handler") +Signed-off-by: Ming Yen Hsieh +Link: https://patch.msgid.link/20241107053005.10558-1-mingyen.hsieh@mediatek.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +index b43617dbd5fde..123a585098e3b 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +@@ -123,10 +123,8 @@ EXPORT_SYMBOL_GPL(mt7925_mcu_regval); + int mt7925_mcu_update_arp_filter(struct mt76_dev *dev, + struct ieee80211_bss_conf *link_conf) + { +- struct ieee80211_vif *mvif = container_of((void *)link_conf->vif, +- struct ieee80211_vif, +- drv_priv); + struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf); ++ struct ieee80211_vif *mvif = link_conf->vif; + struct sk_buff *skb; + int i, len = min_t(int, mvif->cfg.arp_addr_cnt, + IEEE80211_BSS_ARP_ADDR_LIST_LEN); +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7925-fix-wrong-band_idx-setting-when-ena.patch b/queue-6.12/wifi-mt76-mt7925-fix-wrong-band_idx-setting-when-ena.patch new file mode 100644 index 0000000000..277e8176d2 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7925-fix-wrong-band_idx-setting-when-ena.patch @@ -0,0 +1,57 @@ +From fdb592c5e7c172576c352bf53b59372786e1620f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Nov 2024 15:43:40 +0800 +Subject: wifi: mt76: mt7925: fix wrong band_idx setting when enable sniffer + mode + +From: Eric-SY Chang + +[ Upstream commit 85bb7c10c1a013ab29d4be07559105dd843c6f7d ] + +Currently, sniffer mode does not support band auto, +so set band_idx to the default 0. + +Fixes: 0cb349d742d1 ("wifi: mt76: mt7925: update mt7925_mac_link_bss_add for MLO") +Signed-off-by: Eric-SY Chang +Signed-off-by: Ming Yen Hsieh +Link: https://patch.msgid.link/20241101074340.26176-1-mingyen.hsieh@mediatek.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +index 0c2a2337c313d..a78883d4d6df0 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +@@ -1976,8 +1976,6 @@ int mt7925_get_txpwr_info(struct mt792x_dev *dev, u8 band_idx, struct mt7925_txp + int mt7925_mcu_set_sniffer(struct mt792x_dev *dev, struct ieee80211_vif *vif, + bool enable) + { +- struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv; +- + struct { + struct { + u8 band_idx; +@@ -1991,7 +1989,7 @@ int mt7925_mcu_set_sniffer(struct mt792x_dev *dev, struct ieee80211_vif *vif, + } __packed enable; + } __packed req = { + .hdr = { +- .band_idx = mvif->bss_conf.mt76.band_idx, ++ .band_idx = 0, + }, + .enable = { + .tag = cpu_to_le16(UNI_SNIFFER_ENABLE), +@@ -2050,7 +2048,7 @@ int mt7925_mcu_config_sniffer(struct mt792x_vif *vif, + } __packed tlv; + } __packed req = { + .hdr = { +- .band_idx = vif->bss_conf.mt76.band_idx, ++ .band_idx = 0, + }, + .tlv = { + .tag = cpu_to_le16(UNI_SNIFFER_CONFIG), +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7925-fix-wrong-parameter-for-related-cmd.patch b/queue-6.12/wifi-mt76-mt7925-fix-wrong-parameter-for-related-cmd.patch new file mode 100644 index 0000000000..dc64b88769 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7925-fix-wrong-parameter-for-related-cmd.patch @@ -0,0 +1,75 @@ +From 72b79d85dd25f545dda19b373439838ad679abbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 17:19:15 -0800 +Subject: wifi: mt76: mt7925: fix wrong parameter for related cmd of chan info + +From: Ming Yen Hsieh + +[ Upstream commit 3f0d2178aaf1ed1c017e61cde9ce8a4432c804d1 ] + +Fix incorrect parameters for the related channel information command. + +Fixes: 86c051f2c418 ("wifi: mt76: mt7925: enabling MLO when the firmware supports it") +Signed-off-by: Ming Yen Hsieh +Signed-off-by: Sean Wang +Link: https://patch.msgid.link/20241211011926.5002-6-sean.wang@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7925/mcu.c | 23 +++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +index 7105705113baa..23d0b1d97956e 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +@@ -1198,6 +1198,8 @@ int mt7925_mcu_set_mlo_roc(struct mt792x_bss_conf *mconf, u16 sel_links, + req.roc[i].bw_from_ap = CMD_CBW_20MHZ; + req.roc[i].center_chan = center_ch; + req.roc[i].center_chan_from_ap = center_ch; ++ req.roc[i].center_chan2 = 0; ++ req.roc[i].center_chan2_from_ap = 0; + + /* STR : 0xfe indicates BAND_ALL with enabling DBDC + * EMLSR : 0xff indicates (BAND_AUTO) without DBDC +@@ -2175,11 +2177,27 @@ void mt7925_mcu_bss_rlm_tlv(struct sk_buff *skb, struct mt76_phy *phy, + req = (struct bss_rlm_tlv *)tlv; + req->control_channel = chandef->chan->hw_value; + req->center_chan = ieee80211_frequency_to_channel(freq1); +- req->center_chan2 = ieee80211_frequency_to_channel(freq2); ++ req->center_chan2 = 0; + req->tx_streams = hweight8(phy->antenna_mask); + req->ht_op_info = 4; /* set HT 40M allowed */ + req->rx_streams = hweight8(phy->antenna_mask); +- req->band = band; ++ req->center_chan2 = 0; ++ req->sco = 0; ++ req->band = 1; ++ ++ switch (band) { ++ case NL80211_BAND_2GHZ: ++ req->band = 1; ++ break; ++ case NL80211_BAND_5GHZ: ++ req->band = 2; ++ break; ++ case NL80211_BAND_6GHZ: ++ req->band = 3; ++ break; ++ default: ++ break; ++ } + + switch (chandef->width) { + case NL80211_CHAN_WIDTH_40: +@@ -2190,6 +2208,7 @@ void mt7925_mcu_bss_rlm_tlv(struct sk_buff *skb, struct mt76_phy *phy, + break; + case NL80211_CHAN_WIDTH_80P80: + req->bw = CMD_CBW_8080MHZ; ++ req->center_chan2 = ieee80211_frequency_to_channel(freq2); + break; + case NL80211_CHAN_WIDTH_160: + req->bw = CMD_CBW_160MHZ; +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7925-init-secondary-link-pm-state.patch b/queue-6.12/wifi-mt76-mt7925-init-secondary-link-pm-state.patch new file mode 100644 index 0000000000..6fe31857a9 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7925-init-secondary-link-pm-state.patch @@ -0,0 +1,37 @@ +From 53c6990eb84b0e3ecc38dac70cf81949b3ab85bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 17:19:23 -0800 +Subject: wifi: mt76: mt7925: Init secondary link PM state + +From: Ming Yen Hsieh + +[ Upstream commit 28045ef2bc5bbeec4717da98bf31aca0faaccf02 ] + +Initialize secondary link PM state. + +Fixes: 86c051f2c418 ("wifi: mt76: mt7925: enabling MLO when the firmware supports it") +Signed-off-by: Ming Yen Hsieh +Signed-off-by: Sean Wang +Link: https://patch.msgid.link/20241211011926.5002-14-sean.wang@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +index dcdb9bcff3c40..a2d1c43098d3c 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +@@ -1991,6 +1991,8 @@ mt7925_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif, + goto free; + + if (mconf != &mvif->bss_conf) { ++ mt7925_mcu_set_bss_pm(dev, link_conf, true); ++ + err = mt7925_set_mlo_roc(phy, &mvif->bss_conf, + vif->active_links); + if (err < 0) +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7925-properly-handle-responses-for-comma.patch b/queue-6.12/wifi-mt76-mt7925-properly-handle-responses-for-comma.patch new file mode 100644 index 0000000000..a11fc84924 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7925-properly-handle-responses-for-comma.patch @@ -0,0 +1,85 @@ +From 812ba2c046741a820fb61919c0048e24003b0d3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 17:19:26 -0800 +Subject: wifi: mt76: mt7925: Properly handle responses for commands with + events + +From: Ming Yen Hsieh + +[ Upstream commit 349460913a4d029cc37c9e3817b1903233b4a627 ] + +Properly retrieve the response for commands with events. Ensure accurate +handling of event-driven commands. + +Fixes: 86c051f2c418 ("wifi: mt76: mt7925: enabling MLO when the firmware supports it") +Signed-off-by: Ming Yen Hsieh +Signed-off-by: Sean Wang +Link: https://patch.msgid.link/20241211011926.5002-17-sean.wang@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 1 - + drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 10 +++++----- + 2 files changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +index 116b6980c7335..ddc67423efe2c 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +@@ -1244,7 +1244,6 @@ void mt7925_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif, + memcpy(dev_req.tlv.omac_addr, vif->addr, ETH_ALEN); + mt76_mcu_send_msg(mdev, MCU_UNI_CMD(DEV_INFO_UPDATE), + &dev_req, sizeof(dev_req), true); +- + } + + if (vif->type == NL80211_IFTYPE_STATION) { +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +index c7dd263446c9e..ce3d8197b026a 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +@@ -1252,7 +1252,7 @@ int mt7925_mcu_set_mlo_roc(struct mt792x_bss_conf *mconf, u16 sel_links, + } + + return mt76_mcu_send_msg(&mvif->phy->dev->mt76, MCU_UNI_CMD(ROC), +- &req, sizeof(req), false); ++ &req, sizeof(req), true); + } + + int mt7925_mcu_set_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf, +@@ -1301,7 +1301,7 @@ int mt7925_mcu_set_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf, + } + + return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC), +- &req, sizeof(req), false); ++ &req, sizeof(req), true); + } + + int mt7925_mcu_abort_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf, +@@ -1331,7 +1331,7 @@ int mt7925_mcu_abort_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf, + }; + + return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC), +- &req, sizeof(req), false); ++ &req, sizeof(req), true); + } + + int mt7925_mcu_set_eeprom(struct mt792x_dev *dev) +@@ -1484,12 +1484,12 @@ mt7925_mcu_set_bss_pm(struct mt792x_dev *dev, + int err; + + err = mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE), +- &req1, sizeof(req1), false); ++ &req1, sizeof(req1), true); + if (err < 0 || !enable) + return err; + + return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE), +- &req, sizeof(req), false); ++ &req, sizeof(req), true); + } + + static void +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7925-update-mt7925_mcu_sta_update-for-bc.patch b/queue-6.12/wifi-mt76-mt7925-update-mt7925_mcu_sta_update-for-bc.patch new file mode 100644 index 0000000000..2dbd8f7cc4 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7925-update-mt7925_mcu_sta_update-for-bc.patch @@ -0,0 +1,42 @@ +From 7d9fd8f41b4dda7e6b0d415f006bf0cf1a51020e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 17:19:19 -0800 +Subject: wifi: mt76: mt7925: Update mt7925_mcu_sta_update for BC in ASSOC + state + +From: Ming Yen Hsieh + +[ Upstream commit 0e02f6ed6a49577e29e0b1f7900fad3ed8ae870c ] + +Update mt7925_mcu_sta_update for broadcast (BC) in the ASSOC state. + +Fixes: 86c051f2c418 ("wifi: mt76: mt7925: enabling MLO when the firmware supports it") +Signed-off-by: Ming Yen Hsieh +Signed-off-by: Sean Wang +Link: https://patch.msgid.link/20241211011926.5002-10-sean.wang@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +index 60a12b0e45ee6..4577e838f5872 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +@@ -1903,7 +1903,11 @@ int mt7925_mcu_sta_update(struct mt792x_dev *dev, + mlink = mt792x_sta_to_link(msta, link_sta->link_id); + } + info.wcid = link_sta ? &mlink->wcid : &mvif->sta.deflink.wcid; +- info.newly = link_sta ? state != MT76_STA_INFO_STATE_ASSOC : true; ++ ++ if (link_sta) ++ info.newly = state != MT76_STA_INFO_STATE_ASSOC; ++ else ++ info.newly = state == MT76_STA_INFO_STATE_ASSOC ? false : true; + + if (ieee80211_vif_is_mld(vif)) + err = mt7925_mcu_mlo_sta_cmd(&dev->mphy, &info); +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7925-update-mt7925_mcu_uni_-tx-rx-_ba-fo.patch b/queue-6.12/wifi-mt76-mt7925-update-mt7925_mcu_uni_-tx-rx-_ba-fo.patch new file mode 100644 index 0000000000..6eddf9dc20 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7925-update-mt7925_mcu_uni_-tx-rx-_ba-fo.patch @@ -0,0 +1,167 @@ +From 004584b4b332039b3327a03e302ba139566c366a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 17:19:24 -0800 +Subject: wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO + +From: Ming Yen Hsieh + +[ Upstream commit eb2a9a12c6092a26f632468d6610497d4f0e40da ] + +Update mt7925_mcu_uni_[tx,rx]_ba for MLO support in firmware. + +Fixes: 86c051f2c418 ("wifi: mt76: mt7925: enabling MLO when the firmware supports it") +Signed-off-by: Ming Yen Hsieh +Signed-off-by: Sean Wang +Link: https://patch.msgid.link/20241211011926.5002-15-sean.wang@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7925/main.c | 10 ++-- + .../net/wireless/mediatek/mt76/mt7925/mcu.c | 50 +++++++++++++++---- + .../wireless/mediatek/mt76/mt7925/mt7925.h | 2 + + 3 files changed, 48 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +index a2d1c43098d3c..a4ffa34d58a41 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +@@ -1258,22 +1258,22 @@ mt7925_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif, + case IEEE80211_AMPDU_RX_START: + mt76_rx_aggr_start(&dev->mt76, &msta->deflink.wcid, tid, ssn, + params->buf_size); +- mt7925_mcu_uni_rx_ba(dev, params, true); ++ mt7925_mcu_uni_rx_ba(dev, vif, params, true); + break; + case IEEE80211_AMPDU_RX_STOP: + mt76_rx_aggr_stop(&dev->mt76, &msta->deflink.wcid, tid); +- mt7925_mcu_uni_rx_ba(dev, params, false); ++ mt7925_mcu_uni_rx_ba(dev, vif, params, false); + break; + case IEEE80211_AMPDU_TX_OPERATIONAL: + mtxq->aggr = true; + mtxq->send_bar = false; +- mt7925_mcu_uni_tx_ba(dev, params, true); ++ mt7925_mcu_uni_tx_ba(dev, vif, params, true); + break; + case IEEE80211_AMPDU_TX_STOP_FLUSH: + case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT: + mtxq->aggr = false; + clear_bit(tid, &msta->deflink.wcid.ampdu_state); +- mt7925_mcu_uni_tx_ba(dev, params, false); ++ mt7925_mcu_uni_tx_ba(dev, vif, params, false); + break; + case IEEE80211_AMPDU_TX_START: + set_bit(tid, &msta->deflink.wcid.ampdu_state); +@@ -1282,7 +1282,7 @@ mt7925_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif, + case IEEE80211_AMPDU_TX_STOP_CONT: + mtxq->aggr = false; + clear_bit(tid, &msta->deflink.wcid.ampdu_state); +- mt7925_mcu_uni_tx_ba(dev, params, false); ++ mt7925_mcu_uni_tx_ba(dev, vif, params, false); + ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid); + break; + } +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +index 0976f3dffbe46..e4c0f234aeed2 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +@@ -529,10 +529,10 @@ void mt7925_mcu_rx_event(struct mt792x_dev *dev, struct sk_buff *skb) + + static int + mt7925_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif, ++ struct mt76_wcid *wcid, + struct ieee80211_ampdu_params *params, + bool enable, bool tx) + { +- struct mt76_wcid *wcid = (struct mt76_wcid *)params->sta->drv_priv; + struct sta_rec_ba_uni *ba; + struct sk_buff *skb; + struct tlv *tlv; +@@ -560,28 +560,60 @@ mt7925_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif, + + /** starec & wtbl **/ + int mt7925_mcu_uni_tx_ba(struct mt792x_dev *dev, ++ struct ieee80211_vif *vif, + struct ieee80211_ampdu_params *params, + bool enable) + { + struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv; +- struct mt792x_vif *mvif = msta->vif; ++ struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv; ++ struct mt792x_link_sta *mlink; ++ struct mt792x_bss_conf *mconf; ++ unsigned long usable_links = ieee80211_vif_usable_links(vif); ++ struct mt76_wcid *wcid; ++ u8 link_id, ret; + +- if (enable && !params->amsdu) +- msta->deflink.wcid.amsdu = false; ++ for_each_set_bit(link_id, &usable_links, IEEE80211_MLD_MAX_NUM_LINKS) { ++ mconf = mt792x_vif_to_link(mvif, link_id); ++ mlink = mt792x_sta_to_link(msta, link_id); ++ wcid = &mlink->wcid; + +- return mt7925_mcu_sta_ba(&dev->mt76, &mvif->bss_conf.mt76, params, +- enable, true); ++ if (enable && !params->amsdu) ++ mlink->wcid.amsdu = false; ++ ++ ret = mt7925_mcu_sta_ba(&dev->mt76, &mconf->mt76, wcid, params, ++ enable, true); ++ if (ret < 0) ++ break; ++ } ++ ++ return ret; + } + + int mt7925_mcu_uni_rx_ba(struct mt792x_dev *dev, ++ struct ieee80211_vif *vif, + struct ieee80211_ampdu_params *params, + bool enable) + { + struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv; +- struct mt792x_vif *mvif = msta->vif; ++ struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv; ++ struct mt792x_link_sta *mlink; ++ struct mt792x_bss_conf *mconf; ++ unsigned long usable_links = ieee80211_vif_usable_links(vif); ++ struct mt76_wcid *wcid; ++ u8 link_id, ret; + +- return mt7925_mcu_sta_ba(&dev->mt76, &mvif->bss_conf.mt76, params, +- enable, false); ++ for_each_set_bit(link_id, &usable_links, IEEE80211_MLD_MAX_NUM_LINKS) { ++ mconf = mt792x_vif_to_link(mvif, link_id); ++ mlink = mt792x_sta_to_link(msta, link_id); ++ wcid = &mlink->wcid; ++ ++ ret = mt7925_mcu_sta_ba(&dev->mt76, &mconf->mt76, wcid, params, ++ enable, false); ++ if (ret < 0) ++ break; ++ } ++ ++ return ret; + } + + static int mt7925_load_clc(struct mt792x_dev *dev, const char *fw_name) +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mt7925.h b/drivers/net/wireless/mediatek/mt76/mt7925/mt7925.h +index f5c02e5f50663..df3c705d1cb3f 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/mt7925.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mt7925.h +@@ -242,9 +242,11 @@ int mt7925_mcu_set_beacon_filter(struct mt792x_dev *dev, + struct ieee80211_vif *vif, + bool enable); + int mt7925_mcu_uni_tx_ba(struct mt792x_dev *dev, ++ struct ieee80211_vif *vif, + struct ieee80211_ampdu_params *params, + bool enable); + int mt7925_mcu_uni_rx_ba(struct mt792x_dev *dev, ++ struct ieee80211_vif *vif, + struct ieee80211_ampdu_params *params, + bool enable); + void mt7925_scan_work(struct work_struct *work); +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7925-update-mt7925_unassign_vif_chanctx-.patch b/queue-6.12/wifi-mt76-mt7925-update-mt7925_unassign_vif_chanctx-.patch new file mode 100644 index 0000000000..02b162b0e2 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7925-update-mt7925_unassign_vif_chanctx-.patch @@ -0,0 +1,49 @@ +From d4e11a82c8badb93e47a9dfd888b23f63b095a95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 17:19:21 -0800 +Subject: wifi: mt76: mt7925: Update mt7925_unassign_vif_chanctx for per-link + BSS + +From: Ming Yen Hsieh + +[ Upstream commit 30b721467c9c2510e26af6e78e92d7cc08a14bc4 ] + +Update mt7925_unassign_vif_chanctx to support per-link BSS. + +Fixes: 86c051f2c418 ("wifi: mt76: mt7925: enabling MLO when the firmware supports it") +Signed-off-by: Ming Yen Hsieh +Signed-off-by: Sean Wang +Link: https://patch.msgid.link/20241211011926.5002-12-sean.wang@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +index 1140af6577937..a78aae7d10886 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +@@ -2081,18 +2081,16 @@ static void mt7925_unassign_vif_chanctx(struct ieee80211_hw *hw, + struct mt792x_chanctx *mctx = (struct mt792x_chanctx *)ctx->drv_priv; + struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv; + struct mt792x_dev *dev = mt792x_hw_dev(hw); +- struct ieee80211_bss_conf *pri_link_conf; + struct mt792x_bss_conf *mconf; + + mutex_lock(&dev->mt76.mutex); + + if (ieee80211_vif_is_mld(vif)) { + mconf = mt792x_vif_to_link(mvif, link_conf->link_id); +- pri_link_conf = mt792x_vif_to_bss_conf(vif, mvif->deflink_id); + + if (vif->type == NL80211_IFTYPE_STATION && + mconf == &mvif->bss_conf) +- mt7925_mcu_add_bss_info(&dev->phy, NULL, pri_link_conf, ++ mt7925_mcu_add_bss_info(&dev->phy, NULL, link_conf, + NULL, false); + } else { + mconf = &mvif->bss_conf; +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7925-update-mt792x_rx_get_wcid-for-per-l.patch b/queue-6.12/wifi-mt76-mt7925-update-mt792x_rx_get_wcid-for-per-l.patch new file mode 100644 index 0000000000..7fafa4e747 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7925-update-mt792x_rx_get_wcid-for-per-l.patch @@ -0,0 +1,37 @@ +From 2378432a3ebe0591c393ebde7dc3e42cd0d31ad3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 17:19:20 -0800 +Subject: wifi: mt76: mt7925: Update mt792x_rx_get_wcid for per-link STA + +From: Ming Yen Hsieh + +[ Upstream commit 90c10286b176421068b136da51ed83059a68e322 ] + +Update mt792x_rx_get_wcid to support per-link STA. + +Fixes: 86c051f2c418 ("wifi: mt76: mt7925: enabling MLO when the firmware supports it") +Signed-off-by: Ming Yen Hsieh +Signed-off-by: Sean Wang +Link: https://patch.msgid.link/20241211011926.5002-11-sean.wang@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt792x_mac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_mac.c b/drivers/net/wireless/mediatek/mt76/mt792x_mac.c +index 106273935b267..05978d9c7b916 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt792x_mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt792x_mac.c +@@ -153,7 +153,7 @@ struct mt76_wcid *mt792x_rx_get_wcid(struct mt792x_dev *dev, u16 idx, + return NULL; + + link = container_of(wcid, struct mt792x_link_sta, wcid); +- sta = container_of(link, struct mt792x_sta, deflink); ++ sta = link->sta; + if (!sta->vif) + return NULL; + +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7925-update-secondary-link-ps-flow.patch b/queue-6.12/wifi-mt76-mt7925-update-secondary-link-ps-flow.patch new file mode 100644 index 0000000000..893b9b0988 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7925-update-secondary-link-ps-flow.patch @@ -0,0 +1,134 @@ +From 021c5b5cf166eccf9a227259564182a70814ff05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 17:19:22 -0800 +Subject: wifi: mt76: mt7925: Update secondary link PS flow + +From: Ming Yen Hsieh + +[ Upstream commit 8dafab9c4116a6a4fd870be03a3d9b66771dc5a8 ] + +Update the power-saving flow for secondary links. + +Fixes: 86c051f2c418 ("wifi: mt76: mt7925: enabling MLO when the firmware supports it") +Signed-off-by: Ming Yen Hsieh +Signed-off-by: Sean Wang +Link: https://patch.msgid.link/20241211011926.5002-13-sean.wang@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7925/main.c | 7 ++++++ + .../net/wireless/mediatek/mt76/mt7925/mcu.c | 25 ++++++------------- + .../net/wireless/mediatek/mt76/mt7925/mcu.h | 3 +++ + drivers/net/wireless/mediatek/mt76/mt792x.h | 7 ++++-- + 4 files changed, 22 insertions(+), 20 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +index a78aae7d10886..dcdb9bcff3c40 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c +@@ -1903,6 +1903,13 @@ static void mt7925_link_info_changed(struct ieee80211_hw *hw, + if (changed & (BSS_CHANGED_QOS | BSS_CHANGED_BEACON_ENABLED)) + mt7925_mcu_set_tx(dev, info); + ++ if (changed & BSS_CHANGED_BSSID) { ++ if (ieee80211_vif_is_mld(vif) && ++ hweight16(mvif->valid_links) == 2) ++ /* Indicate the secondary setup done */ ++ mt7925_mcu_uni_bss_bcnft(dev, info, true); ++ } ++ + mt792x_mutex_release(dev); + } + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +index 4577e838f5872..0976f3dffbe46 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +@@ -1362,7 +1362,7 @@ int mt7925_mcu_uni_bss_ps(struct mt792x_dev *dev, + &ps_req, sizeof(ps_req), true); + } + +-static int ++int + mt7925_mcu_uni_bss_bcnft(struct mt792x_dev *dev, + struct ieee80211_bss_conf *link_conf, bool enable) + { +@@ -1923,32 +1923,21 @@ int mt7925_mcu_set_beacon_filter(struct mt792x_dev *dev, + { + #define MT7925_FIF_BIT_CLR BIT(1) + #define MT7925_FIF_BIT_SET BIT(0) +- struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv; +- unsigned long valid = ieee80211_vif_is_mld(vif) ? +- mvif->valid_links : BIT(0); +- struct ieee80211_bss_conf *bss_conf; + int err = 0; +- int i; + + if (enable) { +- for_each_set_bit(i, &valid, IEEE80211_MLD_MAX_NUM_LINKS) { +- bss_conf = mt792x_vif_to_bss_conf(vif, i); +- err = mt7925_mcu_uni_bss_bcnft(dev, bss_conf, true); +- if (err < 0) +- return err; +- } ++ err = mt7925_mcu_uni_bss_bcnft(dev, &vif->bss_conf, true); ++ if (err < 0) ++ return err; + + return mt7925_mcu_set_rxfilter(dev, 0, + MT7925_FIF_BIT_SET, + MT_WF_RFCR_DROP_OTHER_BEACON); + } + +- for_each_set_bit(i, &valid, IEEE80211_MLD_MAX_NUM_LINKS) { +- bss_conf = mt792x_vif_to_bss_conf(vif, i); +- err = mt7925_mcu_set_bss_pm(dev, bss_conf, false); +- if (err) +- return err; +- } ++ err = mt7925_mcu_set_bss_pm(dev, &vif->bss_conf, false); ++ if (err < 0) ++ return err; + + return mt7925_mcu_set_rxfilter(dev, 0, + MT7925_FIF_BIT_CLR, +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h +index ac53bdc993322..31bb8ed2ec513 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h +@@ -643,4 +643,7 @@ int mt7925_mcu_set_chctx(struct mt76_phy *phy, struct mt76_vif *mvif, + int mt7925_mcu_set_rate_txpower(struct mt76_phy *phy); + int mt7925_mcu_update_arp_filter(struct mt76_dev *dev, + struct ieee80211_bss_conf *link_conf); ++int ++mt7925_mcu_uni_bss_bcnft(struct mt792x_dev *dev, ++ struct ieee80211_bss_conf *link_conf, bool enable); + #endif +diff --git a/drivers/net/wireless/mediatek/mt76/mt792x.h b/drivers/net/wireless/mediatek/mt76/mt792x.h +index ab12616ec2b87..2b8b9b2977f74 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt792x.h ++++ b/drivers/net/wireless/mediatek/mt76/mt792x.h +@@ -241,6 +241,7 @@ static inline struct mt792x_bss_conf * + mt792x_vif_to_link(struct mt792x_vif *mvif, u8 link_id) + { + struct ieee80211_vif *vif; ++ struct mt792x_bss_conf *bss_conf; + + vif = container_of((void *)mvif, struct ieee80211_vif, drv_priv); + +@@ -248,8 +249,10 @@ mt792x_vif_to_link(struct mt792x_vif *mvif, u8 link_id) + link_id >= IEEE80211_LINK_UNSPECIFIED) + return &mvif->bss_conf; + +- return rcu_dereference_protected(mvif->link_conf[link_id], +- lockdep_is_held(&mvif->phy->dev->mt76.mutex)); ++ bss_conf = rcu_dereference_protected(mvif->link_conf[link_id], ++ lockdep_is_held(&mvif->phy->dev->mt76.mutex)); ++ ++ return bss_conf ? bss_conf : &mvif->bss_conf; + } + + static inline struct mt792x_link_sta * +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7996-add-max-mpdu-len-capability.patch b/queue-6.12/wifi-mt76-mt7996-add-max-mpdu-len-capability.patch new file mode 100644 index 0000000000..2dc9e7c8d1 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7996-add-max-mpdu-len-capability.patch @@ -0,0 +1,41 @@ +From a977e9684760c3447deed74915dee91e8a633400 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jan 2025 18:10:18 +0800 +Subject: wifi: mt76: mt7996: add max mpdu len capability + +From: Peter Chiu + +[ Upstream commit 1816ad9381e0c150e4c44ce6dd6ee2c52008a052 ] + +Set max mpdu len to 11454 according to hardware capability. +Without this patch, the max ampdu length would be 3895 and count not get +expected performance. + +Fixes: 348533eb968d ("wifi: mt76: mt7996: add EHT capability init") +Signed-off-by: Peter Chiu +Signed-off-by: Shayne Chen +Link: https://patch.msgid.link/20250114101026.3587702-1-shayne.chen@mediatek.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/init.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c +index d5f53abc4dcb4..50ee1e443dfa4 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c +@@ -1187,7 +1187,9 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band, + + eht_cap_elem->mac_cap_info[0] = + IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS | +- IEEE80211_EHT_MAC_CAP0_OM_CONTROL; ++ IEEE80211_EHT_MAC_CAP0_OM_CONTROL | ++ u8_encode_bits(IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_11454, ++ IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_MASK); + + eht_cap_elem->phy_cap_info[0] = + IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI | +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7996-fix-definition-of-tx-descriptor.patch b/queue-6.12/wifi-mt76-mt7996-fix-definition-of-tx-descriptor.patch new file mode 100644 index 0000000000..d1a17d75cc --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7996-fix-definition-of-tx-descriptor.patch @@ -0,0 +1,58 @@ +From 9789057a41c81eb2975a7379e6c11d35fb09334e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jan 2025 18:10:23 +0800 +Subject: wifi: mt76: mt7996: fix definition of tx descriptor + +From: Benjamin Lin + +[ Upstream commit 14749fe2ed360c92c1a2a76dac0b77f759234981 ] + +For mt7992 chipsets, the definition of TXD.DW6.BIT10~15 has different +interpretations on different frame types. Driver only needs to fill +MSDU_CNT for non-management frames. + +Fixes: 408566db8cad ("wifi: mt76: connac: add new definition of tx descriptor") +Co-developed-by: Shayne Chen +Signed-off-by: Shayne Chen +Signed-off-by: Benjamin Lin +Link: https://patch.msgid.link/20250114101026.3587702-6-shayne.chen@mediatek.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +index 0d21414e2c884..f590902fdeea3 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +@@ -819,6 +819,7 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi, + struct ieee80211_key_conf *key, int pid, + enum mt76_txq_id qid, u32 changed) + { ++ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); + struct ieee80211_vif *vif = info->control.vif; + u8 band_idx = (info->hw_queue & MT_TX_HW_QUEUE_PHY) >> 2; +@@ -886,8 +887,9 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi, + val = MT_TXD6_DIS_MAT | MT_TXD6_DAS; + if (is_mt7996(&dev->mt76)) + val |= FIELD_PREP(MT_TXD6_MSDU_CNT, 1); +- else ++ else if (is_8023 || !ieee80211_is_mgmt(hdr->frame_control)) + val |= FIELD_PREP(MT_TXD6_MSDU_CNT_V2, 1); ++ + txwi[6] = cpu_to_le32(val); + txwi[7] = 0; + +@@ -897,7 +899,6 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi, + mt7996_mac_write_txwi_80211(dev, txwi, skb, key); + + if (txwi[1] & cpu_to_le32(MT_TXD1_FIXED_RATE)) { +- struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; + bool mcast = ieee80211_is_data(hdr->frame_control) && + is_multicast_ether_addr(hdr->addr1); + u8 idx = MT7996_BASIC_RATES_TBL; +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7996-fix-he-phy-capability.patch b/queue-6.12/wifi-mt76-mt7996-fix-he-phy-capability.patch new file mode 100644 index 0000000000..bfb15de0c2 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7996-fix-he-phy-capability.patch @@ -0,0 +1,49 @@ +From d6ad0c7cb3deb1e16ac42c69159e321d9d3de278 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jan 2025 18:10:20 +0800 +Subject: wifi: mt76: mt7996: fix HE Phy capability + +From: Howard Hsu + +[ Upstream commit 7e3aef59a403ade5dd4ea02edc2d7138a66d74b6 ] + +Set HE SU PPDU And HE MU PPDU With 4x HE-LTF And 0.8 us GI within HE PHY +Capabilities element as 1 since hardware can support. + +Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Signed-off-by: Howard Hsu +Signed-off-by: Shayne Chen +Link: https://patch.msgid.link/20250114101026.3587702-3-shayne.chen@mediatek.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/init.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c +index e04abd57b3b3a..d8a013812d1e3 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c +@@ -1077,6 +1077,9 @@ mt7996_init_he_caps(struct mt7996_phy *phy, enum nl80211_band band, + he_cap_elem->phy_cap_info[2] = IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ | + IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ; + ++ he_cap_elem->phy_cap_info[7] = ++ IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI; ++ + switch (iftype) { + case NL80211_IFTYPE_AP: + he_cap_elem->mac_cap_info[0] |= IEEE80211_HE_MAC_CAP0_TWT_RES; +@@ -1116,8 +1119,7 @@ mt7996_init_he_caps(struct mt7996_phy *phy, enum nl80211_band band, + IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE | + IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT; + he_cap_elem->phy_cap_info[7] |= +- IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP | +- IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI; ++ IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP; + he_cap_elem->phy_cap_info[8] |= + IEEE80211_HE_PHY_CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G | + IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU | +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7996-fix-incorrect-indexing-of-mib-fw-ev.patch b/queue-6.12/wifi-mt76-mt7996-fix-incorrect-indexing-of-mib-fw-ev.patch new file mode 100644 index 0000000000..8ba847334d --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7996-fix-incorrect-indexing-of-mib-fw-ev.patch @@ -0,0 +1,108 @@ +From fb22c96c12e5c29ae0b405bb88e47e6daf721fee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jan 2025 18:10:21 +0800 +Subject: wifi: mt76: mt7996: fix incorrect indexing of MIB FW event + +From: Benjamin Lin + +[ Upstream commit 5c2a25a1ab76a2976dddc5ffd58498866f3ef7c2 ] + +Fix wrong calculation of the channel times due to incorrect +interpretation from the FW event. + +Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Signed-off-by: Benjamin Lin +Signed-off-by: Shayne Chen +Link: https://patch.msgid.link/20250114101026.3587702-4-shayne.chen@mediatek.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7996/mcu.c | 45 ++++++++++++------- + 1 file changed, 29 insertions(+), 16 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +index 6c445a9dbc03d..d6d80b1b2d697 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +@@ -3666,6 +3666,13 @@ int mt7996_mcu_get_chip_config(struct mt7996_dev *dev, u32 *cap) + + int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch) + { ++ enum { ++ IDX_TX_TIME, ++ IDX_RX_TIME, ++ IDX_OBSS_AIRTIME, ++ IDX_NON_WIFI_TIME, ++ IDX_NUM ++ }; + struct { + struct { + u8 band; +@@ -3675,16 +3682,15 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch) + __le16 tag; + __le16 len; + __le32 offs; +- } data[4]; ++ } data[IDX_NUM]; + } __packed req = { + .hdr.band = phy->mt76->band_idx, + }; +- /* strict order */ + static const u32 offs[] = { +- UNI_MIB_TX_TIME, +- UNI_MIB_RX_TIME, +- UNI_MIB_OBSS_AIRTIME, +- UNI_MIB_NON_WIFI_TIME, ++ [IDX_TX_TIME] = UNI_MIB_TX_TIME, ++ [IDX_RX_TIME] = UNI_MIB_RX_TIME, ++ [IDX_OBSS_AIRTIME] = UNI_MIB_OBSS_AIRTIME, ++ [IDX_NON_WIFI_TIME] = UNI_MIB_NON_WIFI_TIME, + }; + struct mt76_channel_state *state = phy->mt76->chan_state; + struct mt76_channel_state *state_ts = &phy->state_ts; +@@ -3693,7 +3699,7 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch) + struct sk_buff *skb; + int i, ret; + +- for (i = 0; i < 4; i++) { ++ for (i = 0; i < IDX_NUM; i++) { + req.data[i].tag = cpu_to_le16(UNI_CMD_MIB_DATA); + req.data[i].len = cpu_to_le16(sizeof(req.data[i])); + req.data[i].offs = cpu_to_le32(offs[i]); +@@ -3712,17 +3718,24 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch) + goto out; + + #define __res_u64(s) le64_to_cpu(res[s].data) +- state->cc_tx += __res_u64(1) - state_ts->cc_tx; +- state->cc_bss_rx += __res_u64(2) - state_ts->cc_bss_rx; +- state->cc_rx += __res_u64(2) + __res_u64(3) - state_ts->cc_rx; +- state->cc_busy += __res_u64(0) + __res_u64(1) + __res_u64(2) + __res_u64(3) - ++ state->cc_tx += __res_u64(IDX_TX_TIME) - state_ts->cc_tx; ++ state->cc_bss_rx += __res_u64(IDX_RX_TIME) - state_ts->cc_bss_rx; ++ state->cc_rx += __res_u64(IDX_RX_TIME) + ++ __res_u64(IDX_OBSS_AIRTIME) - ++ state_ts->cc_rx; ++ state->cc_busy += __res_u64(IDX_TX_TIME) + ++ __res_u64(IDX_RX_TIME) + ++ __res_u64(IDX_OBSS_AIRTIME) + ++ __res_u64(IDX_NON_WIFI_TIME) - + state_ts->cc_busy; +- + out: +- state_ts->cc_tx = __res_u64(1); +- state_ts->cc_bss_rx = __res_u64(2); +- state_ts->cc_rx = __res_u64(2) + __res_u64(3); +- state_ts->cc_busy = __res_u64(0) + __res_u64(1) + __res_u64(2) + __res_u64(3); ++ state_ts->cc_tx = __res_u64(IDX_TX_TIME); ++ state_ts->cc_bss_rx = __res_u64(IDX_RX_TIME); ++ state_ts->cc_rx = __res_u64(IDX_RX_TIME) + __res_u64(IDX_OBSS_AIRTIME); ++ state_ts->cc_busy = __res_u64(IDX_TX_TIME) + ++ __res_u64(IDX_RX_TIME) + ++ __res_u64(IDX_OBSS_AIRTIME) + ++ __res_u64(IDX_NON_WIFI_TIME); + #undef __res_u64 + + dev_kfree_skb(skb); +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7996-fix-invalid-interface-combinations.patch b/queue-6.12/wifi-mt76-mt7996-fix-invalid-interface-combinations.patch new file mode 100644 index 0000000000..bad920f923 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7996-fix-invalid-interface-combinations.patch @@ -0,0 +1,49 @@ +From 105e698a59dbf672a8b6324f069c25f057bea8d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2024 21:51:33 +0800 +Subject: wifi: mt76: mt7996: fix invalid interface combinations + +From: Shayne Chen + +[ Upstream commit 89aca45f26879dfbbf8374c425c4811f69cfc2df ] + +Setting beacon_int_min_gcd and NL80211_IFTYPE_ADHOC in the same interface +combination is invalid, which will trigger the following warning trace +and get error returned from wiphy_register(). + +[ 10.080325] Call trace: +[ 10.082761] wiphy_register+0xc4/0x76c [cfg80211] +[ 10.087465] ieee80211_register_hw+0x800/0xac4 [mac80211] +[ 10.092868] mt76_register_device+0x16c/0x2c0 [mt76] +[ 10.097829] mt7996_register_device+0x740/0x844 [mt7996e] + +Fix this by removing unused adhoc iftype. + +Fixes: 948f65249868 ("wifi: mt76: mt7996: advertize beacon_int_min_gcd") +Reported-by: Frank Wunderlich +Signed-off-by: Shayne Chen +Tested-By: Frank Wunderlich +Signed-off-by: Kalle Valo +Link: https://patch.msgid.link/20241007135133.5336-1-shayne.chen@mediatek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/init.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c +index 5e96973226bbb..efa7b0697a406 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c +@@ -16,9 +16,6 @@ + + static const struct ieee80211_iface_limit if_limits[] = { + { +- .max = 1, +- .types = BIT(NL80211_IFTYPE_ADHOC) +- }, { + .max = 16, + .types = BIT(NL80211_IFTYPE_AP) + #ifdef CONFIG_MAC80211_MESH +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7996-fix-ldpc-setting.patch b/queue-6.12/wifi-mt76-mt7996-fix-ldpc-setting.patch new file mode 100644 index 0000000000..1a7e0d5746 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7996-fix-ldpc-setting.patch @@ -0,0 +1,41 @@ +From 26f474f677571568fd09c09e9e0f643bf5a02728 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jan 2025 18:10:24 +0800 +Subject: wifi: mt76: mt7996: fix ldpc setting + +From: Peter Chiu + +[ Upstream commit da8352da1e4f476fdbf549a4efce4f3c618fde3b ] + +The non-AP interfaces would not use conf->vht_ldpc so they never set +STA_CAP_VHT_LDPC even if peer-station support LDPC. +Check conf->vht_ldpc only for AP interface. + +Without this patch, station only uses BCC to transmit packet in VHT mode. + +Fixes: dda423dd65c3 ("wifi: mt76: mt7996: remove mt7996_mcu_beacon_check_caps()") +Signed-off-by: Peter Chiu +Signed-off-by: Shayne Chen +Link: https://patch.msgid.link/20250114101026.3587702-7-shayne.chen@mediatek.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +index d6d80b1b2d697..265958f7b7871 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +@@ -2070,7 +2070,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev, + cap |= STA_CAP_VHT_TX_STBC; + if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1) + cap |= STA_CAP_VHT_RX_STBC; +- if (vif->bss_conf.vht_ldpc && ++ if ((vif->type != NL80211_IFTYPE_AP || vif->bss_conf.vht_ldpc) && + (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC)) + cap |= STA_CAP_VHT_LDPC; + +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7996-fix-overflows-seen-when-writing-lim.patch b/queue-6.12/wifi-mt76-mt7996-fix-overflows-seen-when-writing-lim.patch new file mode 100644 index 0000000000..0fc5b1193d --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7996-fix-overflows-seen-when-writing-lim.patch @@ -0,0 +1,39 @@ +From 1954d42100ebfc4556d9d0823e087d85cd7f178d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Dec 2024 11:19:16 +0800 +Subject: wifi: mt76: mt7996: fix overflows seen when writing limit attributes + +From: xueqin Luo + +[ Upstream commit 5adbc8ce5bbe7e311e2600b7d7d998a958873e98 ] + +DIV_ROUND_CLOSEST() after kstrtoul() results in an overflow if a large +number such as 18446744073709551615 is provided by the user. +Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations. +This commit was inspired by commit: 57ee12b6c514. + +Fixes: 6879b2e94172 ("wifi: mt76: mt7996: add thermal sensor device support") +Signed-off-by: xueqin Luo +Link: https://patch.msgid.link/20241202031917.23741-2-luoxueqin@kylinos.cn +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c +index efa7b0697a406..d5f53abc4dcb4 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c +@@ -82,7 +82,7 @@ static ssize_t mt7996_thermal_temp_store(struct device *dev, + return ret; + + mutex_lock(&phy->dev->mt76.mutex); +- val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 40, 130); ++ val = DIV_ROUND_CLOSEST(clamp_val(val, 40 * 1000, 130 * 1000), 1000); + + /* add a safety margin ~10 */ + if ((i - 1 == MT7996_CRIT_TEMP_IDX && +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7996-fix-register-mapping.patch b/queue-6.12/wifi-mt76-mt7996-fix-register-mapping.patch new file mode 100644 index 0000000000..fd61aa68f7 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7996-fix-register-mapping.patch @@ -0,0 +1,39 @@ +From e6354548c99c8dc0a5e356aa94c8ca10fd8b232d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jan 2025 19:04:36 +0800 +Subject: wifi: mt76: mt7996: fix register mapping + +From: Peter Chiu + +[ Upstream commit d07ecb4f7070e84de49e8fa4e5a83dd52716d805 ] + +Bypass the entry when ofs is equal to dev->reg.map[i].size. +Without this patch, it would get incorrect register mapping when the CR +address is located at the boundary of an entry. + +Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Signed-off-by: Peter Chiu +Signed-off-by: Shengyu Qu +Link: https://patch.msgid.link/OSZPR01MB84344FEFF53004B5CF40BCC198132@OSZPR01MB8434.jpnprd01.prod.outlook.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/mmio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c +index 40e45fb2b6260..442f72450352b 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c +@@ -177,7 +177,7 @@ static u32 __mt7996_reg_addr(struct mt7996_dev *dev, u32 addr) + continue; + + ofs = addr - dev->reg.map[i].phys; +- if (ofs > dev->reg.map[i].size) ++ if (ofs >= dev->reg.map[i].size) + continue; + + return dev->reg.map[i].mapped + ofs; +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7996-fix-rx-filter-setting-for-bfee-func.patch b/queue-6.12/wifi-mt76-mt7996-fix-rx-filter-setting-for-bfee-func.patch new file mode 100644 index 0000000000..b1f6d1505e --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7996-fix-rx-filter-setting-for-bfee-func.patch @@ -0,0 +1,37 @@ +From fb09c7b12a8eb726264494df95d263751e406867 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 20:41:53 +0100 +Subject: wifi: mt76: mt7996: fix rx filter setting for bfee functionality + +From: Felix Fietkau + +[ Upstream commit 858fd2a53877b2e8b1d991a5a861ac34a0f55ef8 ] + +Fix rx filter setting to prevent dropping NDPA frames. Without this +change, bfee functionality may behave abnormally. + +Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Link: https://patch.msgid.link/20241230194202.95065-5-nbd@nbd.name +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/main.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c +index 39f071ece35e6..4d11083b86c09 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c +@@ -496,8 +496,7 @@ static void mt7996_configure_filter(struct ieee80211_hw *hw, + + MT76_FILTER(CONTROL, MT_WF_RFCR_DROP_CTS | + MT_WF_RFCR_DROP_RTS | +- MT_WF_RFCR_DROP_CTL_RSV | +- MT_WF_RFCR_DROP_NDPA); ++ MT_WF_RFCR_DROP_CTL_RSV); + + *total_flags = flags; + mt76_wr(dev, MT_WF_RFCR(phy->mt76->band_idx), phy->rxfilter); +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-mt7996-fix-the-capability-of-reception-of-.patch b/queue-6.12/wifi-mt76-mt7996-fix-the-capability-of-reception-of-.patch new file mode 100644 index 0000000000..c95dde0c3d --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7996-fix-the-capability-of-reception-of-.patch @@ -0,0 +1,56 @@ +From ad6b6bf5e60f30636a2202617124e644ebb7e482 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jan 2025 18:10:19 +0800 +Subject: wifi: mt76: mt7996: fix the capability of reception of EHT MU PPDU + +From: Howard Hsu + +[ Upstream commit 2ffbdfc1bd78ba944c5754791c84f32232b513c6 ] + +This commit includes two changes. First, enable "EHT MU PPDU With 4x +EHT-LTF And 0.8us GI" in EHT Phy capabilities element since hardware +can support. Second, fix the value of "Maximum number of supported +EHT LTFs" in the same element, where the previous setting of 3 in +Bit 3-4 was incorrect. + +Fixes: 348533eb968d ("wifi: mt76: mt7996: add EHT capability init") +Signed-off-by: Howard Hsu +Signed-off-by: Shayne Chen +Link: https://patch.msgid.link/20250114101026.3587702-2-shayne.chen@mediatek.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/init.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c +index 50ee1e443dfa4..e04abd57b3b3a 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c +@@ -1232,21 +1232,20 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band, + IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK; + + eht_cap_elem->phy_cap_info[4] = ++ IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI | + u8_encode_bits(min_t(int, sts - 1, 2), + IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK); + + eht_cap_elem->phy_cap_info[5] = + u8_encode_bits(IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_16US, + IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK) | +- u8_encode_bits(u8_get_bits(0x11, GENMASK(1, 0)), ++ u8_encode_bits(u8_get_bits(1, GENMASK(1, 0)), + IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK); + + val = width == NL80211_CHAN_WIDTH_320 ? 0xf : + width == NL80211_CHAN_WIDTH_160 ? 0x7 : + width == NL80211_CHAN_WIDTH_80 ? 0x3 : 0x1; + eht_cap_elem->phy_cap_info[6] = +- u8_encode_bits(u8_get_bits(0x11, GENMASK(4, 2)), +- IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK) | + u8_encode_bits(val, IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK); + + val = u8_encode_bits(nss, IEEE80211_EHT_MCS_NSS_RX) | +-- +2.39.5 + diff --git a/queue-6.12/wifi-mt76-only-enable-tx-worker-after-setting-the-ch.patch b/queue-6.12/wifi-mt76-only-enable-tx-worker-after-setting-the-ch.patch new file mode 100644 index 0000000000..34e981a579 --- /dev/null +++ b/queue-6.12/wifi-mt76-only-enable-tx-worker-after-setting-the-ch.patch @@ -0,0 +1,39 @@ +From e4a51cb709939bfa299d5e2d39521fe2951a507a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 20:41:56 +0100 +Subject: wifi: mt76: only enable tx worker after setting the channel + +From: Felix Fietkau + +[ Upstream commit 228bc0e79c85269d36cc81e0288e95f2f9ba7ae1 ] + +Avoids sending packets too early + +Fixes: 0b3be9d1d34e ("wifi: mt76: add separate tx scheduling queue for off-channel tx") +Link: https://patch.msgid.link/20241230194202.95065-8-nbd@nbd.name +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mac80211.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c +index 9d5561f441347..0ca83f1a3e3ea 100644 +--- a/drivers/net/wireless/mediatek/mt76/mac80211.c ++++ b/drivers/net/wireless/mediatek/mt76/mac80211.c +@@ -958,11 +958,11 @@ int mt76_set_channel(struct mt76_phy *phy, struct cfg80211_chan_def *chandef, + + if (chandef->chan != phy->main_chan) + memset(phy->chan_state, 0, sizeof(*phy->chan_state)); +- mt76_worker_enable(&dev->tx_worker); + + ret = dev->drv->set_channel(phy); + + clear_bit(MT76_RESET, &phy->state); ++ mt76_worker_enable(&dev->tx_worker); + mt76_worker_schedule(&dev->tx_worker); + + mutex_unlock(&dev->mutex); +-- +2.39.5 + diff --git a/queue-6.12/wifi-rtlwifi-destroy-workqueue-at-rtl_deinit_core.patch b/queue-6.12/wifi-rtlwifi-destroy-workqueue-at-rtl_deinit_core.patch new file mode 100644 index 0000000000..2f97f292c8 --- /dev/null +++ b/queue-6.12/wifi-rtlwifi-destroy-workqueue-at-rtl_deinit_core.patch @@ -0,0 +1,88 @@ +From 558a77322f7e893ec9e79b97c79fb91d252e7bb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 14:37:11 -0300 +Subject: wifi: rtlwifi: destroy workqueue at rtl_deinit_core + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit d8ece6fc3694657e4886191b32ca1690af11adda ] + +rtl_wq is allocated at rtl_init_core, so it makes more sense to destroy it +at rtl_deinit_core. In the case of USB, where _rtl_usb_init does not +require anything to be undone, that is fine. But for PCI, rtl_pci_init, +which is called after rtl_init_core, needs to deallocate data, but only if +it has been called. + +That means that destroying the workqueue needs to be done whether +rtl_pci_init has been called or not. And since rtl_pci_deinit was doing it, +it has to be moved out of there. + +It makes more sense to move it to rtl_deinit_core and have it done in both +cases, USB and PCI. + +Since this is a requirement for a followup memory leak fix, mark this as +fixing such memory leak. + +Fixes: 0c8173385e54 ("rtl8192ce: Add new driver") +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241206173713.3222187-3-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/base.c | 6 ++++++ + drivers/net/wireless/realtek/rtlwifi/pci.c | 2 -- + drivers/net/wireless/realtek/rtlwifi/usb.c | 5 ----- + 3 files changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c +index fd28c7a722d89..ff61867d142fa 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.c ++++ b/drivers/net/wireless/realtek/rtlwifi/base.c +@@ -575,9 +575,15 @@ static void rtl_free_entries_from_ack_queue(struct ieee80211_hw *hw, + + void rtl_deinit_core(struct ieee80211_hw *hw) + { ++ struct rtl_priv *rtlpriv = rtl_priv(hw); ++ + rtl_c2hcmd_launcher(hw, 0); + rtl_free_entries_from_scan_list(hw); + rtl_free_entries_from_ack_queue(hw, false); ++ if (rtlpriv->works.rtl_wq) { ++ destroy_workqueue(rtlpriv->works.rtl_wq); ++ rtlpriv->works.rtl_wq = NULL; ++ } + } + EXPORT_SYMBOL_GPL(rtl_deinit_core); + +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index 4388066eb9e27..e60ac910e750b 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -1656,8 +1656,6 @@ static void rtl_pci_deinit(struct ieee80211_hw *hw) + synchronize_irq(rtlpci->pdev->irq); + tasklet_kill(&rtlpriv->works.irq_tasklet); + cancel_work_sync(&rtlpriv->works.lps_change_work); +- +- destroy_workqueue(rtlpriv->works.rtl_wq); + } + + static int rtl_pci_init(struct ieee80211_hw *hw, struct pci_dev *pdev) +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c +index 0368ecea2e817..f5718e570011e 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -629,11 +629,6 @@ static void _rtl_usb_cleanup_rx(struct ieee80211_hw *hw) + tasklet_kill(&rtlusb->rx_work_tasklet); + cancel_work_sync(&rtlpriv->works.lps_change_work); + +- if (rtlpriv->works.rtl_wq) { +- destroy_workqueue(rtlpriv->works.rtl_wq); +- rtlpriv->works.rtl_wq = NULL; +- } +- + skb_queue_purge(&rtlusb->rx_queue); + + while ((urb = usb_get_from_anchor(&rtlusb->rx_cleanup_urbs))) { +-- +2.39.5 + diff --git a/queue-6.12/wifi-rtlwifi-do-not-complete-firmware-loading-needle.patch b/queue-6.12/wifi-rtlwifi-do-not-complete-firmware-loading-needle.patch new file mode 100644 index 0000000000..9fc7a99c5a --- /dev/null +++ b/queue-6.12/wifi-rtlwifi-do-not-complete-firmware-loading-needle.patch @@ -0,0 +1,50 @@ +From 97170dd0c4b3359024fff0bdca8de4a1c146474f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 10:33:18 -0300 +Subject: wifi: rtlwifi: do not complete firmware loading needlessly + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit e73e11d303940119e41850a0452a0deda2cc4eb5 ] + +The only code waiting for completion is driver removal, which will not be +called when probe returns a failure. So this completion is unnecessary. + +Fixes: b0302aba812b ("rtlwifi: Convert to asynchronous firmware load") +Signed-off-by: Thadeu Lima de Souza Cascardo +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241107133322.855112-2-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/pci.c | 1 - + drivers/net/wireless/realtek/rtlwifi/usb.c | 1 - + 2 files changed, 2 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index 11709b6c83f1a..40fc3c297a8ac 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -2266,7 +2266,6 @@ int rtl_pci_probe(struct pci_dev *pdev, + pci_iounmap(pdev, (void __iomem *)rtlpriv->io.pci_mem_start); + + pci_release_regions(pdev); +- complete(&rtlpriv->firmware_loading_complete); + + fail1: + if (hw) +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c +index d37a017b2b814..c3aa0cd9ff211 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -1040,7 +1040,6 @@ int rtl_usb_probe(struct usb_interface *intf, + error_out2: + _rtl_usb_io_handler_release(hw); + usb_put_dev(udev); +- complete(&rtlpriv->firmware_loading_complete); + kfree(rtlpriv->usb_data); + ieee80211_free_hw(hw); + return -ENODEV; +-- +2.39.5 + diff --git a/queue-6.12/wifi-rtlwifi-fix-init_sw_vars-leak-when-probe-fails.patch b/queue-6.12/wifi-rtlwifi-fix-init_sw_vars-leak-when-probe-fails.patch new file mode 100644 index 0000000000..3a6ef49ffe --- /dev/null +++ b/queue-6.12/wifi-rtlwifi-fix-init_sw_vars-leak-when-probe-fails.patch @@ -0,0 +1,37 @@ +From 10f71a7d2532e7d0f282553f1e8d0d5e7ee322f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 10:33:21 -0300 +Subject: wifi: rtlwifi: fix init_sw_vars leak when probe fails + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit 00260350aed80c002df270c805ca443ec9a719a6 ] + +If ieee80211_register_hw fails, the memory allocated for the firmware will +not be released. Call deinit_sw_vars as the function that undoes the +allocationes done by init_sw_vars. + +Fixes: cefe3dfdb9f5 ("rtl8192cu: Call ieee80211_register_hw from rtl_usb_probe") +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241107133322.855112-5-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/usb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c +index c27b116ccdff5..8ec687fab5721 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -1037,6 +1037,7 @@ int rtl_usb_probe(struct usb_interface *intf, + + error_init_vars: + wait_for_completion(&rtlpriv->firmware_loading_complete); ++ rtlpriv->cfg->ops->deinit_sw_vars(hw); + error_out: + rtl_deinit_core(hw); + error_out2: +-- +2.39.5 + diff --git a/queue-6.12/wifi-rtlwifi-fix-memory-leaks-and-invalid-access-at-.patch b/queue-6.12/wifi-rtlwifi-fix-memory-leaks-and-invalid-access-at-.patch new file mode 100644 index 0000000000..b8e1ea7bc3 --- /dev/null +++ b/queue-6.12/wifi-rtlwifi-fix-memory-leaks-and-invalid-access-at-.patch @@ -0,0 +1,80 @@ +From 1b1082f87a820d320f1a149b7fda29fcdc03cf1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 14:37:12 -0300 +Subject: wifi: rtlwifi: fix memory leaks and invalid access at probe error + path + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit e7ceefbfd8d447abc8aca8ab993a942803522c06 ] + +Deinitialize at reverse order when probe fails. + +When init_sw_vars fails, rtl_deinit_core should not be called, specially +now that it destroys the rtl_wq workqueue. + +And call rtl_pci_deinit and deinit_sw_vars, otherwise, memory will be +leaked. + +Remove pci_set_drvdata call as it will already be cleaned up by the core +driver code and could lead to memory leaks too. cf. commit 8d450935ae7f +("wireless: rtlwifi: remove unnecessary pci_set_drvdata()") and +commit 3d86b93064c7 ("rtlwifi: Fix PCI probe error path orphaned memory"). + +Fixes: 0c8173385e54 ("rtl8192ce: Add new driver") +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241206173713.3222187-4-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/pci.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index e60ac910e750b..a870117cf12af 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -2165,7 +2165,7 @@ int rtl_pci_probe(struct pci_dev *pdev, + if (rtlpriv->cfg->ops->init_sw_vars(hw)) { + pr_err("Can't init_sw_vars\n"); + err = -ENODEV; +- goto fail3; ++ goto fail2; + } + rtl_init_sw_leds(hw); + +@@ -2183,14 +2183,14 @@ int rtl_pci_probe(struct pci_dev *pdev, + err = rtl_pci_init(hw, pdev); + if (err) { + pr_err("Failed to init PCI\n"); +- goto fail3; ++ goto fail4; + } + + err = ieee80211_register_hw(hw); + if (err) { + pr_err("Can't register mac80211 hw.\n"); + err = -ENODEV; +- goto fail3; ++ goto fail5; + } + rtlpriv->mac80211.mac80211_registered = 1; + +@@ -2213,9 +2213,12 @@ int rtl_pci_probe(struct pci_dev *pdev, + set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status); + return 0; + +-fail3: +- pci_set_drvdata(pdev, NULL); ++fail5: ++ rtl_pci_deinit(hw); ++fail4: + rtl_deinit_core(hw); ++fail3: ++ rtlpriv->cfg->ops->deinit_sw_vars(hw); + + fail2: + if (rtlpriv->io.pci_mem_start != 0) +-- +2.39.5 + diff --git a/queue-6.12/wifi-rtlwifi-pci-wait-for-firmware-loading-before-re.patch b/queue-6.12/wifi-rtlwifi-pci-wait-for-firmware-loading-before-re.patch new file mode 100644 index 0000000000..f3e7b1fa1d --- /dev/null +++ b/queue-6.12/wifi-rtlwifi-pci-wait-for-firmware-loading-before-re.patch @@ -0,0 +1,38 @@ +From 7b4505e9dd55df3fa5e06664be2ffb5d41d27978 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 14:37:13 -0300 +Subject: wifi: rtlwifi: pci: wait for firmware loading before releasing memory + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit b59b86c5d08be7d761c04affcbcec8184738c200 ] + +At probe error path, the firmware loading work may have already been +queued. In such a case, it will try to access memory allocated by the probe +function, which is about to be released. In such paths, wait for the +firmware worker to finish before releasing memory. + +Fixes: 3d86b93064c7 ("rtlwifi: Fix PCI probe error path orphaned memory") +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241206173713.3222187-5-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index a870117cf12af..0eafc4d125f91 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -2218,6 +2218,7 @@ int rtl_pci_probe(struct pci_dev *pdev, + fail4: + rtl_deinit_core(hw); + fail3: ++ wait_for_completion(&rtlpriv->firmware_loading_complete); + rtlpriv->cfg->ops->deinit_sw_vars(hw); + + fail2: +-- +2.39.5 + diff --git a/queue-6.12/wifi-rtlwifi-remove-unused-check_buddy_priv.patch b/queue-6.12/wifi-rtlwifi-remove-unused-check_buddy_priv.patch new file mode 100644 index 0000000000..81bd45b067 --- /dev/null +++ b/queue-6.12/wifi-rtlwifi-remove-unused-check_buddy_priv.patch @@ -0,0 +1,200 @@ +From 205262435156577b354e1bdcf730909ca17db2ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 14:37:10 -0300 +Subject: wifi: rtlwifi: remove unused check_buddy_priv + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit 2fdac64c3c35858aa8ac5caa70b232e03456e120 ] + +Commit 2461c7d60f9f ("rtlwifi: Update header file") introduced a global +list of private data structures. + +Later on, commit 26634c4b1868 ("rtlwifi Modify existing bits to match +vendor version 2013.02.07") started adding the private data to that list at +probe time and added a hook, check_buddy_priv to find the private data from +a similar device. + +However, that function was never used. + +Besides, though there is a lock for that list, it is never used. And when +the probe fails, the private data is never removed from the list. This +would cause a second probe to access freed memory. + +Remove the unused hook, structures and members, which will prevent the +potential race condition on the list and its corruption during a second +probe when probe fails. + +Fixes: 26634c4b1868 ("rtlwifi Modify existing bits to match vendor version 2013.02.07") +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241206173713.3222187-2-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/base.c | 7 ---- + drivers/net/wireless/realtek/rtlwifi/base.h | 1 - + drivers/net/wireless/realtek/rtlwifi/pci.c | 44 --------------------- + drivers/net/wireless/realtek/rtlwifi/wifi.h | 12 ------ + 4 files changed, 64 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c +index aab4605de9c47..fd28c7a722d89 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.c ++++ b/drivers/net/wireless/realtek/rtlwifi/base.c +@@ -2696,9 +2696,6 @@ MODULE_AUTHOR("Larry Finger "); + MODULE_LICENSE("GPL"); + MODULE_DESCRIPTION("Realtek 802.11n PCI wireless core"); + +-struct rtl_global_var rtl_global_var = {}; +-EXPORT_SYMBOL_GPL(rtl_global_var); +- + static int __init rtl_core_module_init(void) + { + BUILD_BUG_ON(TX_PWR_BY_RATE_NUM_RATE < TX_PWR_BY_RATE_NUM_SECTION); +@@ -2712,10 +2709,6 @@ static int __init rtl_core_module_init(void) + /* add debugfs */ + rtl_debugfs_add_topdir(); + +- /* init some global vars */ +- INIT_LIST_HEAD(&rtl_global_var.glb_priv_list); +- spin_lock_init(&rtl_global_var.glb_list_lock); +- + return 0; + } + +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.h b/drivers/net/wireless/realtek/rtlwifi/base.h +index f081a9a90563f..f3a6a43a42eca 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.h ++++ b/drivers/net/wireless/realtek/rtlwifi/base.h +@@ -124,7 +124,6 @@ int rtl_send_smps_action(struct ieee80211_hw *hw, + u8 *rtl_find_ie(u8 *data, unsigned int len, u8 ie); + void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len); + u8 rtl_tid_to_ac(u8 tid); +-extern struct rtl_global_var rtl_global_var; + void rtl_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation); + + #endif +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index 40fc3c297a8ac..4388066eb9e27 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -295,46 +295,6 @@ static bool rtl_pci_get_amd_l1_patch(struct ieee80211_hw *hw) + return status; + } + +-static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw, +- struct rtl_priv **buddy_priv) +-{ +- struct rtl_priv *rtlpriv = rtl_priv(hw); +- struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw); +- struct rtl_priv *tpriv = NULL, *iter; +- struct rtl_pci_priv *tpcipriv = NULL; +- +- if (!list_empty(&rtlpriv->glb_var->glb_priv_list)) { +- list_for_each_entry(iter, &rtlpriv->glb_var->glb_priv_list, +- list) { +- tpcipriv = (struct rtl_pci_priv *)iter->priv; +- rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, +- "pcipriv->ndis_adapter.funcnumber %x\n", +- pcipriv->ndis_adapter.funcnumber); +- rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, +- "tpcipriv->ndis_adapter.funcnumber %x\n", +- tpcipriv->ndis_adapter.funcnumber); +- +- if (pcipriv->ndis_adapter.busnumber == +- tpcipriv->ndis_adapter.busnumber && +- pcipriv->ndis_adapter.devnumber == +- tpcipriv->ndis_adapter.devnumber && +- pcipriv->ndis_adapter.funcnumber != +- tpcipriv->ndis_adapter.funcnumber) { +- tpriv = iter; +- break; +- } +- } +- } +- +- rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, +- "find_buddy_priv %d\n", tpriv != NULL); +- +- if (tpriv) +- *buddy_priv = tpriv; +- +- return tpriv != NULL; +-} +- + static void rtl_pci_parse_configuration(struct pci_dev *pdev, + struct ieee80211_hw *hw) + { +@@ -2011,7 +1971,6 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev, + pcipriv->ndis_adapter.amd_l1_patch); + + rtl_pci_parse_configuration(pdev, hw); +- list_add_tail(&rtlpriv->list, &rtlpriv->glb_var->glb_priv_list); + + return true; + } +@@ -2158,7 +2117,6 @@ int rtl_pci_probe(struct pci_dev *pdev, + rtlpriv->rtlhal.interface = INTF_PCI; + rtlpriv->cfg = (struct rtl_hal_cfg *)(id->driver_data); + rtlpriv->intf_ops = &rtl_pci_ops; +- rtlpriv->glb_var = &rtl_global_var; + rtl_efuse_ops_init(hw); + + /* MEM map */ +@@ -2316,7 +2274,6 @@ void rtl_pci_disconnect(struct pci_dev *pdev) + if (rtlpci->using_msi) + pci_disable_msi(rtlpci->pdev); + +- list_del(&rtlpriv->list); + if (rtlpriv->io.pci_mem_start != 0) { + pci_iounmap(pdev, (void __iomem *)rtlpriv->io.pci_mem_start); + pci_release_regions(pdev); +@@ -2375,7 +2332,6 @@ EXPORT_SYMBOL(rtl_pci_resume); + const struct rtl_intf_ops rtl_pci_ops = { + .adapter_start = rtl_pci_start, + .adapter_stop = rtl_pci_stop, +- .check_buddy_priv = rtl_pci_check_buddy_priv, + .adapter_tx = rtl_pci_tx, + .flush = rtl_pci_flush, + .reset_trx_ring = rtl_pci_reset_trx_ring, +diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h +index ae6e351bc83c9..f1830ddcdd8c1 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h ++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h +@@ -2270,8 +2270,6 @@ struct rtl_intf_ops { + /*com */ + int (*adapter_start)(struct ieee80211_hw *hw); + void (*adapter_stop)(struct ieee80211_hw *hw); +- bool (*check_buddy_priv)(struct ieee80211_hw *hw, +- struct rtl_priv **buddy_priv); + + int (*adapter_tx)(struct ieee80211_hw *hw, + struct ieee80211_sta *sta, +@@ -2514,14 +2512,6 @@ struct dig_t { + u32 rssi_max; + }; + +-struct rtl_global_var { +- /* from this list we can get +- * other adapter's rtl_priv +- */ +- struct list_head glb_priv_list; +- spinlock_t glb_list_lock; +-}; +- + #define IN_4WAY_TIMEOUT_TIME (30 * MSEC_PER_SEC) /* 30 seconds */ + + struct rtl_btc_info { +@@ -2667,9 +2657,7 @@ struct rtl_scan_list { + struct rtl_priv { + struct ieee80211_hw *hw; + struct completion firmware_loading_complete; +- struct list_head list; + struct rtl_priv *buddy_priv; +- struct rtl_global_var *glb_var; + struct rtl_dmsp_ctl dmsp_ctl; + struct rtl_locks locks; + struct rtl_works works; +-- +2.39.5 + diff --git a/queue-6.12/wifi-rtlwifi-rtl8192se-rise-completion-of-firmware-l.patch b/queue-6.12/wifi-rtlwifi-rtl8192se-rise-completion-of-firmware-l.patch new file mode 100644 index 0000000000..406d8c4cdb --- /dev/null +++ b/queue-6.12/wifi-rtlwifi-rtl8192se-rise-completion-of-firmware-l.patch @@ -0,0 +1,59 @@ +From 07901cb7597c1ac3d833845e46236d10127844df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 10:33:19 -0300 +Subject: wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last + step + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit 8559a9e0c457729fe3edb3176bbf7c7874f482b0 ] + +Just like in commit 4dfde294b979 ("rtlwifi: rise completion at the last +step of firmware callback"), only signal completion once the function is +finished. Otherwise, the module removal waiting for the completion could +free the memory that the callback will still use before returning. + +Fixes: b0302aba812b ("rtlwifi: Convert to asynchronous firmware load") +Signed-off-by: Thadeu Lima de Souza Cascardo +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241107133322.855112-3-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c +index bbf8ff63dcedb..e63c67b1861b5 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c +@@ -64,22 +64,23 @@ static void rtl92se_fw_cb(const struct firmware *firmware, void *context) + + rtl_dbg(rtlpriv, COMP_ERR, DBG_LOUD, + "Firmware callback routine entered!\n"); +- complete(&rtlpriv->firmware_loading_complete); + if (!firmware) { + pr_err("Firmware %s not available\n", fw_name); + rtlpriv->max_fw_size = 0; +- return; ++ goto exit; + } + if (firmware->size > rtlpriv->max_fw_size) { + pr_err("Firmware is too big!\n"); + rtlpriv->max_fw_size = 0; + release_firmware(firmware); +- return; ++ goto exit; + } + pfirmware = (struct rt_firmware *)rtlpriv->rtlhal.pfirmware; + memcpy(pfirmware->sz_fw_tmpbuffer, firmware->data, firmware->size); + pfirmware->sz_fw_tmpbufferlen = firmware->size; + release_firmware(firmware); ++exit: ++ complete(&rtlpriv->firmware_loading_complete); + } + + static int rtl92s_init_sw_vars(struct ieee80211_hw *hw) +-- +2.39.5 + diff --git a/queue-6.12/wifi-rtlwifi-rtl8821ae-phy-restore-removed-code-to-f.patch b/queue-6.12/wifi-rtlwifi-rtl8821ae-phy-restore-removed-code-to-f.patch new file mode 100644 index 0000000000..0e330bc3b3 --- /dev/null +++ b/queue-6.12/wifi-rtlwifi-rtl8821ae-phy-restore-removed-code-to-f.patch @@ -0,0 +1,44 @@ +From 4c74ddf6eb4de7bcf7e067a8db18764e3d8ee175 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2024 15:46:42 +0000 +Subject: wifi: rtlwifi: rtl8821ae: phy: restore removed code to fix infinite + loop + +From: Colin Ian King + +[ Upstream commit 5e5903a442bb889a62a0f5d89ac33e53ab08592c ] + +A previous clean-up fix removed the assignment of v2 inside a while loop +that turned it into an infinite loop. Fix this by restoring the assignment +of v2 from array[] so that v2 is updated inside the loop. + +Fixes: cda37445718d ("wifi: rtlwifi: rtl8821ae: phy: remove some useless code") +Signed-off-by: Colin Ian King +Tested-by: Ping-Ke Shih +Reviewed-by: Su Hui +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241106154642.1627886-1-colin.i.king@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c +index 1be51ea3f3c82..9eddbada8af12 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c +@@ -2033,8 +2033,10 @@ static bool _rtl8821ae_phy_config_bb_with_pgheaderfile(struct ieee80211_hw *hw, + if (!_rtl8821ae_check_condition(hw, v1)) { + i += 2; /* skip the pair of expression*/ + v2 = array[i+1]; +- while (v2 != 0xDEAD) ++ while (v2 != 0xDEAD) { + i += 3; ++ v2 = array[i + 1]; ++ } + } + } + } +-- +2.39.5 + diff --git a/queue-6.12/wifi-rtlwifi-usb-fix-workqueue-leak-when-probe-fails.patch b/queue-6.12/wifi-rtlwifi-usb-fix-workqueue-leak-when-probe-fails.patch new file mode 100644 index 0000000000..f8bcd7d56e --- /dev/null +++ b/queue-6.12/wifi-rtlwifi-usb-fix-workqueue-leak-when-probe-fails.patch @@ -0,0 +1,38 @@ +From fb437085eb723a1fd1627634d74374316ae3f0eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 10:33:22 -0300 +Subject: wifi: rtlwifi: usb: fix workqueue leak when probe fails + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit f79bc5c67867c19ce2762e7934c20dbb835ed82c ] + +rtl_init_core creates a workqueue that is then assigned to rtl_wq. +rtl_deinit_core does not destroy it. It is left to rtl_usb_deinit, which +must be called in the probe error path. + +Fixes: 2ca20f79e0d8 ("rtlwifi: Add usb driver") +Fixes: 851639fdaeac ("rtlwifi: Modify some USB de-initialize code.") +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241107133322.855112-6-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/usb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c +index 8ec687fab5721..0368ecea2e817 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -1039,6 +1039,7 @@ int rtl_usb_probe(struct usb_interface *intf, + wait_for_completion(&rtlpriv->firmware_loading_complete); + rtlpriv->cfg->ops->deinit_sw_vars(hw); + error_out: ++ rtl_usb_deinit(hw); + rtl_deinit_core(hw); + error_out2: + _rtl_usb_io_handler_release(hw); +-- +2.39.5 + diff --git a/queue-6.12/wifi-rtlwifi-wait-for-firmware-loading-before-releas.patch b/queue-6.12/wifi-rtlwifi-wait-for-firmware-loading-before-releas.patch new file mode 100644 index 0000000000..5dc08e6cf0 --- /dev/null +++ b/queue-6.12/wifi-rtlwifi-wait-for-firmware-loading-before-releas.patch @@ -0,0 +1,47 @@ +From 965e912e2fe13f930bed73a1b4c5aa31458db05d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 10:33:20 -0300 +Subject: wifi: rtlwifi: wait for firmware loading before releasing memory + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit b4b26642b31ef282df6ff7ea8531985edfdef12a ] + +At probe error path, the firmware loading work may have already been +queued. In such a case, it will try to access memory allocated by the probe +function, which is about to be released. In such paths, wait for the +firmware worker to finish before releasing memory. + +Fixes: a7f7c15e945a ("rtlwifi: rtl8192cu: Free ieee80211_hw if probing fails") +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241107133322.855112-4-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/usb.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c +index c3aa0cd9ff211..c27b116ccdff5 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -1028,13 +1028,15 @@ int rtl_usb_probe(struct usb_interface *intf, + err = ieee80211_register_hw(hw); + if (err) { + pr_err("Can't register mac80211 hw.\n"); +- goto error_out; ++ goto error_init_vars; + } + rtlpriv->mac80211.mac80211_registered = 1; + + set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status); + return 0; + ++error_init_vars: ++ wait_for_completion(&rtlpriv->firmware_loading_complete); + error_out: + rtl_deinit_core(hw); + error_out2: +-- +2.39.5 + diff --git a/queue-6.12/wifi-rtw89-avoid-to-init-mgnt_entry-list-twice-when-.patch b/queue-6.12/wifi-rtw89-avoid-to-init-mgnt_entry-list-twice-when-.patch new file mode 100644 index 0000000000..8f19d0be49 --- /dev/null +++ b/queue-6.12/wifi-rtw89-avoid-to-init-mgnt_entry-list-twice-when-.patch @@ -0,0 +1,107 @@ +From b2de2a071967bdf3a29bbb1dc0bf35d5bf783e9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jan 2025 10:45:00 +0800 +Subject: wifi: rtw89: avoid to init mgnt_entry list twice when WoWLAN failed + +From: Chih-Kang Chang + +[ Upstream commit 2f7667675df1b40b73ecc53b4b8c3189b1e5f2c1 ] + +If WoWLAN failed in resume flow, the rtw89_ops_add_interface() triggered +without removing the interface first. Then the mgnt_entry list init again, +causing the list_empty() check in rtw89_chanctx_ops_assign_vif() +useless, and list_add_tail() again. Therefore, we have added a check to +prevent double adding of the list. + +rtw89_8852ce 0000:01:00.0: failed to check wow status disabled +rtw89_8852ce 0000:01:00.0: wow: failed to check disable fw ready +rtw89_8852ce 0000:01:00.0: wow: failed to swap to normal fw +rtw89_8852ce 0000:01:00.0: failed to disable wow +rtw89_8852ce 0000:01:00.0: failed to resume for wow -110 +rtw89_8852ce 0000:01:00.0: MAC has already powered on +i2c_hid_acpi i2c-ILTK0001:00: PM: acpi_subsys_resume+0x0/0x60 returned 0 after 284705 usecs +list_add corruption. prev->next should be next (ffff9d9719d82228), but was ffff9d9719f96030. (prev=ffff9d9719f96030). +------------[ cut here ]------------ +kernel BUG at lib/list_debug.c:34! +invalid opcode: 0000 [#1] PREEMPT SMP NOPTI +CPU: 2 PID: 6918 Comm: kworker/u8:19 Tainted: G U O +Hardware name: Google Anraggar/Anraggar, BIOS Google_Anraggar.15217.514.0 03/25/2024 +Workqueue: events_unbound async_run_entry_fn +RIP: 0010:__list_add_valid_or_report+0x9f/0xb0 +Code: e8 56 89 ff ff 0f 0b 48 c7 c7 3e fc e0 96 48 89 c6 e8 45 89 ff ... +RSP: 0018:ffffa51b42bbbaf0 EFLAGS: 00010246 +RAX: 0000000000000075 RBX: ffff9d9719d82ab0 RCX: 13acb86e047a4400 +RDX: 3fffffffffffffff RSI: 0000000000000000 RDI: 00000000ffffdfff +RBP: ffffa51b42bbbb28 R08: ffffffff9768e250 R09: 0000000000001fff +R10: ffffffff9765e250 R11: 0000000000005ffd R12: ffff9d9719f95c40 +R13: ffff9d9719f95be8 R14: ffff9d97081bfd78 R15: ffff9d9719d82060 +FS: 0000000000000000(0000) GS:ffff9d9a6fb00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007e7d029a4060 CR3: 0000000345e38000 CR4: 0000000000750ee0 +PKRU: 55555554 +Call Trace: + + ? __die_body+0x68/0xb0 + ? die+0xaa/0xd0 + ? do_trap+0x9f/0x170 + ? __list_add_valid_or_report+0x9f/0xb0 + ? __list_add_valid_or_report+0x9f/0xb0 + ? handle_invalid_op+0x69/0x90 + ? __list_add_valid_or_report+0x9f/0xb0 + ? exc_invalid_op+0x3c/0x50 + ? asm_exc_invalid_op+0x16/0x20 + ? __list_add_valid_or_report+0x9f/0xb0 + rtw89_chanctx_ops_assign_vif+0x1f9/0x210 [rtw89_core cbb375c44bf28564ce479002bff66617a25d9ac1] + ? __mutex_unlock_slowpath+0xa0/0xf0 + rtw89_ops_assign_vif_chanctx+0x4b/0x90 [rtw89_core cbb375c44bf28564ce479002bff66617a25d9ac1] + drv_assign_vif_chanctx+0xa7/0x1f0 [mac80211 6efaad16237edaaea0868b132d4f93ecf918a8b6] + ieee80211_reconfig+0x9cb/0x17b0 [mac80211 6efaad16237edaaea0868b132d4f93ecf918a8b6] + ? __pfx_wiphy_resume+0x10/0x10 [cfg80211 572d03acaaa933fe38251be7fce3b3675284b8ed] + ? dev_printk_emit+0x51/0x70 + ? _dev_info+0x6e/0x90 + wiphy_resume+0x89/0x180 [cfg80211 572d03acaaa933fe38251be7fce3b3675284b8ed] + ? __pfx_wiphy_resume+0x10/0x10 [cfg80211 572d03acaaa933fe38251be7fce3b3675284b8ed] + dpm_run_callback+0x37/0x1e0 + device_resume+0x26d/0x4b0 + ? __pfx_dpm_watchdog_handler+0x10/0x10 + async_resume+0x1d/0x30 + async_run_entry_fn+0x29/0xd0 + worker_thread+0x397/0x970 + kthread+0xed/0x110 + ? __pfx_worker_thread+0x10/0x10 + ? __pfx_kthread+0x10/0x10 + ret_from_fork+0x38/0x50 + ? __pfx_kthread+0x10/0x10 + ret_from_fork_asm+0x1b/0x30 + + +Fixes: 68ec751b2881 ("wifi: rtw89: chan: manage active interfaces") +Signed-off-by: Chih-Kang Chang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20250103024500.14990-1-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/mac80211.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/mac80211.c b/drivers/net/wireless/realtek/rtw89/mac80211.c +index 299566e2f612d..a04717b847a0f 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac80211.c ++++ b/drivers/net/wireless/realtek/rtw89/mac80211.c +@@ -189,10 +189,10 @@ static int rtw89_ops_add_interface(struct ieee80211_hw *hw, + + rtw89_core_txq_init(rtwdev, vif->txq); + +- if (!rtw89_rtwvif_in_list(rtwdev, rtwvif)) ++ if (!rtw89_rtwvif_in_list(rtwdev, rtwvif)) { + list_add_tail(&rtwvif->list, &rtwdev->rtwvifs_list); +- +- INIT_LIST_HEAD(&rtwvif->mgnt_entry); ++ INIT_LIST_HEAD(&rtwvif->mgnt_entry); ++ } + + ether_addr_copy(rtwvif->mac_addr, vif->addr); + +-- +2.39.5 + diff --git a/queue-6.12/wifi-rtw89-chan-fix-soft-lockup-in-rtw89_entity_reca.patch b/queue-6.12/wifi-rtw89-chan-fix-soft-lockup-in-rtw89_entity_reca.patch new file mode 100644 index 0000000000..c2dc4e1350 --- /dev/null +++ b/queue-6.12/wifi-rtw89-chan-fix-soft-lockup-in-rtw89_entity_reca.patch @@ -0,0 +1,57 @@ +From 53f70fc53bf767157cf8d59675190bf799c485a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Dec 2024 08:48:09 +0800 +Subject: wifi: rtw89: chan: fix soft lockup in + rtw89_entity_recalc_mgnt_roles() + +From: Zong-Zhe Yang + +[ Upstream commit e4790b3e314a4814f1680a5dc552031fb199b878 ] + +During rtw89_entity_recalc_mgnt_roles(), there is a normalizing process +which will re-order the list if an entry with target pattern is found. +And once one is found, should have aborted the list_for_each_entry. But, +`break` just aborted the inner for-loop. The outer list_for_each_entry +still continues. Normally, only the first entry will match the target +pattern, and the re-ordering will change nothing, so there won't be +soft lockup. However, in some special cases, soft lockup would happen. + +Fix it by `goto fill` to break from the list_for_each_entry. + +The following is a sample of kernel log for this problem. + +watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [wpa_supplicant:2055] +[...] +RIP: 0010:rtw89_entity_recalc ([...] chan.c:392 chan.c:479) rtw89_core +[...] + +Fixes: 68ec751b2881 ("wifi: rtw89: chan: manage active interfaces") +Signed-off-by: Zong-Zhe Yang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241231004811.8646-3-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/chan.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/chan.c b/drivers/net/wireless/realtek/rtw89/chan.c +index abc78716596d0..c06d305519df4 100644 +--- a/drivers/net/wireless/realtek/rtw89/chan.c ++++ b/drivers/net/wireless/realtek/rtw89/chan.c +@@ -391,11 +391,12 @@ static void rtw89_entity_recalc_mgnt_roles(struct rtw89_dev *rtwdev) + + list_del(&role->mgnt_entry); + list_add(&role->mgnt_entry, &mgnt->active_list); +- break; ++ goto fill; + } + } + } + ++fill: + list_for_each_entry(role, &mgnt->active_list, mgnt_entry) { + if (unlikely(pos >= RTW89_MAX_INTERFACE_NUM)) { + rtw89_warn(rtwdev, +-- +2.39.5 + diff --git a/queue-6.12/wifi-rtw89-chan-manage-active-interfaces.patch b/queue-6.12/wifi-rtw89-chan-manage-active-interfaces.patch new file mode 100644 index 0000000000..e3f30306b7 --- /dev/null +++ b/queue-6.12/wifi-rtw89-chan-manage-active-interfaces.patch @@ -0,0 +1,298 @@ +From f3a00b47abfb5da3ccd68c258c60f61077ac77aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Oct 2024 16:31:04 +0800 +Subject: wifi: rtw89: chan: manage active interfaces + +From: Zong-Zhe Yang + +[ Upstream commit 68ec751b288178de7d19b71ea61648269a35b8cd ] + +To set channel well for combination of MCC (multi-channel concurrency) and +impending MLO support, we need a method to manage relation between active +interfaces and channel contexts. If an interface owns at least one active +link, we call it an active interface. We add a list to manage active ones. + +Basically, the list follows the active order except for the below case. To +be compatible with legacy behavior, the first interface that owns the first +channel context will put at the first entry in the list when recalculating. + +Besides, MCC can also select and fill roles based on the above active list. + +Signed-off-by: Zong-Zhe Yang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241022083106.149252-4-pkshih@realtek.com +Stable-dep-of: e47f0a589854 ("wifi: rtw89: fix proceeding MCC with wrong scanning state after sequence changes") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/chan.c | 105 ++++++++++++++++-- + drivers/net/wireless/realtek/rtw89/core.c | 4 +- + drivers/net/wireless/realtek/rtw89/core.h | 10 ++ + drivers/net/wireless/realtek/rtw89/mac80211.c | 2 + + 4 files changed, 108 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/chan.c b/drivers/net/wireless/realtek/rtw89/chan.c +index ba6332da8019c..2b7e6921ff9c6 100644 +--- a/drivers/net/wireless/realtek/rtw89/chan.c ++++ b/drivers/net/wireless/realtek/rtw89/chan.c +@@ -10,6 +10,10 @@ + #include "ps.h" + #include "util.h" + ++static void rtw89_swap_chanctx(struct rtw89_dev *rtwdev, ++ enum rtw89_chanctx_idx idx1, ++ enum rtw89_chanctx_idx idx2); ++ + static enum rtw89_subband rtw89_get_subband_type(enum rtw89_band band, + u8 center_chan) + { +@@ -226,11 +230,15 @@ static void rtw89_config_default_chandef(struct rtw89_dev *rtwdev) + void rtw89_entity_init(struct rtw89_dev *rtwdev) + { + struct rtw89_hal *hal = &rtwdev->hal; ++ struct rtw89_entity_mgnt *mgnt = &hal->entity_mgnt; + + hal->entity_pause = false; + bitmap_zero(hal->entity_map, NUM_OF_RTW89_CHANCTX); + bitmap_zero(hal->changes, NUM_OF_RTW89_CHANCTX_CHANGES); + atomic_set(&hal->roc_chanctx_idx, RTW89_CHANCTX_IDLE); ++ ++ INIT_LIST_HEAD(&mgnt->active_list); ++ + rtw89_config_default_chandef(rtwdev); + } + +@@ -272,6 +280,71 @@ static void rtw89_entity_calculate_weight(struct rtw89_dev *rtwdev, + } + } + ++static void rtw89_normalize_link_chanctx(struct rtw89_dev *rtwdev, ++ struct rtw89_vif_link *rtwvif_link) ++{ ++ struct rtw89_vif *rtwvif = rtwvif_link->rtwvif; ++ struct rtw89_vif_link *cur; ++ ++ if (unlikely(!rtwvif_link->chanctx_assigned)) ++ return; ++ ++ cur = rtw89_vif_get_link_inst(rtwvif, 0); ++ if (!cur || !cur->chanctx_assigned) ++ return; ++ ++ if (cur == rtwvif_link) ++ return; ++ ++ rtw89_swap_chanctx(rtwdev, rtwvif_link->chanctx_idx, cur->chanctx_idx); ++} ++ ++static void rtw89_entity_recalc_mgnt_roles(struct rtw89_dev *rtwdev) ++{ ++ struct rtw89_hal *hal = &rtwdev->hal; ++ struct rtw89_entity_mgnt *mgnt = &hal->entity_mgnt; ++ struct rtw89_vif_link *link; ++ struct rtw89_vif *role; ++ u8 pos = 0; ++ int i; ++ ++ lockdep_assert_held(&rtwdev->mutex); ++ ++ for (i = 0; i < RTW89_MAX_INTERFACE_NUM; i++) ++ mgnt->active_roles[i] = NULL; ++ ++ /* To be consistent with legacy behavior, expect the first active role ++ * which uses RTW89_CHANCTX_0 to put at position 0, and make its first ++ * link instance take RTW89_CHANCTX_0. (normalizing) ++ */ ++ list_for_each_entry(role, &mgnt->active_list, mgnt_entry) { ++ for (i = 0; i < role->links_inst_valid_num; i++) { ++ link = rtw89_vif_get_link_inst(role, i); ++ if (!link || !link->chanctx_assigned) ++ continue; ++ ++ if (link->chanctx_idx == RTW89_CHANCTX_0) { ++ rtw89_normalize_link_chanctx(rtwdev, link); ++ ++ list_del(&role->mgnt_entry); ++ list_add(&role->mgnt_entry, &mgnt->active_list); ++ break; ++ } ++ } ++ } ++ ++ list_for_each_entry(role, &mgnt->active_list, mgnt_entry) { ++ if (unlikely(pos >= RTW89_MAX_INTERFACE_NUM)) { ++ rtw89_warn(rtwdev, ++ "%s: active roles are over max iface num\n", ++ __func__); ++ break; ++ } ++ ++ mgnt->active_roles[pos++] = role; ++ } ++} ++ + enum rtw89_entity_mode rtw89_entity_recalc(struct rtw89_dev *rtwdev) + { + DECLARE_BITMAP(recalc_map, NUM_OF_RTW89_CHANCTX) = {}; +@@ -327,6 +400,8 @@ enum rtw89_entity_mode rtw89_entity_recalc(struct rtw89_dev *rtwdev) + rtw89_assign_entity_chan(rtwdev, idx, &chan); + } + ++ rtw89_entity_recalc_mgnt_roles(rtwdev); ++ + if (hal->entity_pause) + return rtw89_get_entity_mode(rtwdev); + +@@ -716,6 +791,7 @@ struct rtw89_mcc_fill_role_selector { + }; + + static_assert((u8)NUM_OF_RTW89_CHANCTX >= NUM_OF_RTW89_MCC_ROLES); ++static_assert(RTW89_MAX_INTERFACE_NUM >= NUM_OF_RTW89_MCC_ROLES); + + static int rtw89_mcc_fill_role_iterator(struct rtw89_dev *rtwdev, + struct rtw89_mcc_role *mcc_role, +@@ -745,14 +821,18 @@ static int rtw89_mcc_fill_role_iterator(struct rtw89_dev *rtwdev, + + static int rtw89_mcc_fill_all_roles(struct rtw89_dev *rtwdev) + { ++ struct rtw89_hal *hal = &rtwdev->hal; ++ struct rtw89_entity_mgnt *mgnt = &hal->entity_mgnt; + struct rtw89_mcc_fill_role_selector sel = {}; + struct rtw89_vif_link *rtwvif_link; + struct rtw89_vif *rtwvif; + int ret; ++ int i; + +- rtw89_for_each_rtwvif(rtwdev, rtwvif) { +- if (!rtw89_vif_is_active_role(rtwvif)) +- continue; ++ for (i = 0; i < NUM_OF_RTW89_MCC_ROLES; i++) { ++ rtwvif = mgnt->active_roles[i]; ++ if (!rtwvif) ++ break; + + rtwvif_link = rtw89_vif_get_link_inst(rtwvif, 0); + if (unlikely(!rtwvif_link)) { +@@ -760,14 +840,7 @@ static int rtw89_mcc_fill_all_roles(struct rtw89_dev *rtwdev) + continue; + } + +- if (sel.bind_vif[rtwvif_link->chanctx_idx]) { +- rtw89_warn(rtwdev, +- "MCC skip extra vif on chanctx[%d]\n", +- rtwvif_link->mac_id, rtwvif_link->chanctx_idx); +- continue; +- } +- +- sel.bind_vif[rtwvif_link->chanctx_idx] = rtwvif_link; ++ sel.bind_vif[i] = rtwvif_link; + } + + ret = rtw89_iterate_mcc_roles(rtwdev, rtw89_mcc_fill_role_iterator, &sel); +@@ -2501,12 +2574,18 @@ int rtw89_chanctx_ops_assign_vif(struct rtw89_dev *rtwdev, + struct ieee80211_chanctx_conf *ctx) + { + struct rtw89_chanctx_cfg *cfg = (struct rtw89_chanctx_cfg *)ctx->drv_priv; ++ struct rtw89_vif *rtwvif = rtwvif_link->rtwvif; ++ struct rtw89_hal *hal = &rtwdev->hal; ++ struct rtw89_entity_mgnt *mgnt = &hal->entity_mgnt; + struct rtw89_entity_weight w = {}; + + rtwvif_link->chanctx_idx = cfg->idx; + rtwvif_link->chanctx_assigned = true; + cfg->ref_count++; + ++ if (list_empty(&rtwvif->mgnt_entry)) ++ list_add_tail(&rtwvif->mgnt_entry, &mgnt->active_list); ++ + if (cfg->idx == RTW89_CHANCTX_0) + goto out; + +@@ -2526,6 +2605,7 @@ void rtw89_chanctx_ops_unassign_vif(struct rtw89_dev *rtwdev, + struct ieee80211_chanctx_conf *ctx) + { + struct rtw89_chanctx_cfg *cfg = (struct rtw89_chanctx_cfg *)ctx->drv_priv; ++ struct rtw89_vif *rtwvif = rtwvif_link->rtwvif; + struct rtw89_hal *hal = &rtwdev->hal; + enum rtw89_chanctx_idx roll; + enum rtw89_entity_mode cur; +@@ -2536,6 +2616,9 @@ void rtw89_chanctx_ops_unassign_vif(struct rtw89_dev *rtwdev, + rtwvif_link->chanctx_assigned = false; + cfg->ref_count--; + ++ if (!rtw89_vif_is_active_role(rtwvif)) ++ list_del_init(&rtwvif->mgnt_entry); ++ + if (cfg->ref_count != 0) + goto out; + +diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c +index 37d2bcba1b315..e864da4d37519 100644 +--- a/drivers/net/wireless/realtek/rtw89/core.c ++++ b/drivers/net/wireless/realtek/rtw89/core.c +@@ -192,13 +192,13 @@ static const struct ieee80211_iface_combination rtw89_iface_combs[] = { + { + .limits = rtw89_iface_limits, + .n_limits = ARRAY_SIZE(rtw89_iface_limits), +- .max_interfaces = 2, ++ .max_interfaces = RTW89_MAX_INTERFACE_NUM, + .num_different_channels = 1, + }, + { + .limits = rtw89_iface_limits_mcc, + .n_limits = ARRAY_SIZE(rtw89_iface_limits_mcc), +- .max_interfaces = 2, ++ .max_interfaces = RTW89_MAX_INTERFACE_NUM, + .num_different_channels = 2, + }, + }; +diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h +index 0ed31b37d10fe..65ad3d03d0530 100644 +--- a/drivers/net/wireless/realtek/rtw89/core.h ++++ b/drivers/net/wireless/realtek/rtw89/core.h +@@ -4628,6 +4628,14 @@ enum rtw89_entity_mode { + RTW89_ENTITY_MODE_UNHANDLED = -ESRCH, + }; + ++#define RTW89_MAX_INTERFACE_NUM 2 ++ ++/* only valid when running with chanctx_ops */ ++struct rtw89_entity_mgnt { ++ struct list_head active_list; ++ struct rtw89_vif *active_roles[RTW89_MAX_INTERFACE_NUM]; ++}; ++ + struct rtw89_chanctx { + struct cfg80211_chan_def chandef; + struct rtw89_chan chan; +@@ -4671,6 +4679,7 @@ struct rtw89_hal { + bool entity_active[RTW89_PHY_MAX]; + bool entity_pause; + enum rtw89_entity_mode entity_mode; ++ struct rtw89_entity_mgnt entity_mgnt; + + struct rtw89_edcca_bak edcca_bak; + u32 disabled_dm_bitmap; /* bitmap of enum rtw89_dm_type */ +@@ -5607,6 +5616,7 @@ struct rtw89_dev { + struct rtw89_vif { + struct rtw89_dev *rtwdev; + struct list_head list; ++ struct list_head mgnt_entry; + + u8 mac_addr[ETH_ALEN]; + __be32 ip_addr; +diff --git a/drivers/net/wireless/realtek/rtw89/mac80211.c b/drivers/net/wireless/realtek/rtw89/mac80211.c +index 13fb3cac27016..299566e2f612d 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac80211.c ++++ b/drivers/net/wireless/realtek/rtw89/mac80211.c +@@ -192,6 +192,8 @@ static int rtw89_ops_add_interface(struct ieee80211_hw *hw, + if (!rtw89_rtwvif_in_list(rtwdev, rtwvif)) + list_add_tail(&rtwvif->list, &rtwdev->rtwvifs_list); + ++ INIT_LIST_HEAD(&rtwvif->mgnt_entry); ++ + ether_addr_copy(rtwvif->mac_addr, vif->addr); + + rtwvif->offchan = false; +-- +2.39.5 + diff --git a/queue-6.12/wifi-rtw89-fix-proceeding-mcc-with-wrong-scanning-st.patch b/queue-6.12/wifi-rtw89-fix-proceeding-mcc-with-wrong-scanning-st.patch new file mode 100644 index 0000000000..dd0229dff1 --- /dev/null +++ b/queue-6.12/wifi-rtw89-fix-proceeding-mcc-with-wrong-scanning-st.patch @@ -0,0 +1,261 @@ +From 27e842d154c03842306a41b4c85b2473616404d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Dec 2024 08:48:08 +0800 +Subject: wifi: rtw89: fix proceeding MCC with wrong scanning state after + sequence changes + +From: Zong-Zhe Yang + +[ Upstream commit e47f0a5898540eb19b953708707887d4b3020645 ] + +When starting/proceeding MCC, it will abort an ongoing hw scan process. +In the proceeding cases, it unexpectedly tries to abort a non-exist hw +scan process. Then, a trace shown at the bottom will happen. This problem +is caused by a previous commit which changed some call sequence inside +rtw89_hw_scan_complete() to fix some coex problems. These changes lead +to our scanning flag was not cleared when proceeding MCC. To keep the +fixes on coex, and resolve the problem here, re-consider the related +call sequence. + +The known sequence requirements are listed below. + +* the old sequence: + A. notify coex + B. clear scanning flag + C. proceed chanctx + C-1. set channel + C-2. proceed MCC +(the problem: A needs to be after C-1) + +* the current sequence: + C. proceed chanctx + C-1. set channel + C-2. proceed MCC + A. notify coex + B. clear scanning flag +(the problem: C-2 needs to be after B) + +So, now let hw scan caller pass a callback to proceed chanctx if needed. +Then, the new sequence will be like the below. + C-1. set channel + A. notify coex + B. clear scanning flag + C-2. proceed MCC + +The following is the kernel log for the problem in current sequence. + +rtw89_8852be 0000:04:00.0: rtw89_hw_scan_offload failed ret -110 +------------[ cut here ]------------ +[...] +CPU: 2 PID: 3991 Comm: kworker/u16:0 Tainted: G OE 6.6.17 #3 +Hardware name: LENOVO 2356AD1/2356AD1, BIOS G7ETB3WW (2.73 ) 11/28/2018 +Workqueue: events_unbound wiphy_work_cancel [cfg80211] +RIP: 0010:ieee80211_sched_scan_stopped+0xaea/0xd80 [mac80211] +Code: 9c 24 d0 11 00 00 49 39 dd 0f 85 46 ff ff ff 4c 89 e7 e8 09 2d +RSP: 0018:ffffb27783643d48 EFLAGS: 00010246 +RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 +RDX: ffff8a2280964bc0 RSI: 0000000000000000 RDI: ffff8a23df580900 +RBP: ffffb27783643d88 R08: 0000000000000001 R09: 0000000000000400 +R10: 0000000000000000 R11: 0000000000008268 R12: ffff8a23df580900 +R13: ffff8a23df581b00 R14: 0000000000000000 R15: 0000000000000000 +FS: 0000000000000000(0000) GS:ffff8a258e680000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f26a0654000 CR3: 000000002ea2e002 CR4: 00000000001706e0 +Call Trace: + + ? show_regs+0x68/0x70 + ? ieee80211_sched_scan_stopped+0xaea/0xd80 [mac80211] + ? __warn+0x8f/0x150 + ? ieee80211_sched_scan_stopped+0xaea/0xd80 [mac80211] + ? report_bug+0x1f5/0x200 + ? handle_bug+0x46/0x80 + ? exc_invalid_op+0x19/0x70 + ? asm_exc_invalid_op+0x1b/0x20 + ? ieee80211_sched_scan_stopped+0xaea/0xd80 [mac80211] + ieee80211_scan_work+0x14a/0x650 [mac80211] + ? __queue_work+0x10f/0x410 + wiphy_work_cancel+0x2fb/0x310 [cfg80211] + process_scheduled_works+0x9d/0x390 + ? __pfx_worker_thread+0x10/0x10 + worker_thread+0x15b/0x2d0 + ? __pfx_worker_thread+0x10/0x10 + kthread+0x108/0x140 + ? __pfx_kthread+0x10/0x10 + ret_from_fork+0x3c/0x60 + ? __pfx_kthread+0x10/0x10 + ret_from_fork_asm+0x1b/0x30 + +---[ end trace 0000000000000000 ]--- + +Fixes: f16c40acd319 ("wifi: rtw89: Fix TX fail with A2DP after scanning") +Signed-off-by: Zong-Zhe Yang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241231004811.8646-2-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/chan.c | 26 +++++++++++++-- + drivers/net/wireless/realtek/rtw89/chan.h | 9 ++++- + drivers/net/wireless/realtek/rtw89/core.c | 2 +- + drivers/net/wireless/realtek/rtw89/fw.c | 40 +++++++++++++++++++---- + 4 files changed, 66 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/chan.c b/drivers/net/wireless/realtek/rtw89/chan.c +index fb9449930c40a..abc78716596d0 100644 +--- a/drivers/net/wireless/realtek/rtw89/chan.c ++++ b/drivers/net/wireless/realtek/rtw89/chan.c +@@ -2530,7 +2530,25 @@ void rtw89_chanctx_pause(struct rtw89_dev *rtwdev, + hal->entity_pause = true; + } + +-void rtw89_chanctx_proceed(struct rtw89_dev *rtwdev) ++static void rtw89_chanctx_proceed_cb(struct rtw89_dev *rtwdev, ++ const struct rtw89_chanctx_cb_parm *parm) ++{ ++ int ret; ++ ++ if (!parm || !parm->cb) ++ return; ++ ++ ret = parm->cb(rtwdev, parm->data); ++ if (ret) ++ rtw89_warn(rtwdev, "%s (%s): cb failed: %d\n", __func__, ++ parm->caller ?: "unknown", ret); ++} ++ ++/* pass @cb_parm if there is a @cb_parm->cb which needs to invoke right after ++ * call rtw89_set_channel() and right before proceed entity according to mode. ++ */ ++void rtw89_chanctx_proceed(struct rtw89_dev *rtwdev, ++ const struct rtw89_chanctx_cb_parm *cb_parm) + { + struct rtw89_hal *hal = &rtwdev->hal; + enum rtw89_entity_mode mode; +@@ -2538,14 +2556,18 @@ void rtw89_chanctx_proceed(struct rtw89_dev *rtwdev) + + lockdep_assert_held(&rtwdev->mutex); + +- if (!hal->entity_pause) ++ if (unlikely(!hal->entity_pause)) { ++ rtw89_chanctx_proceed_cb(rtwdev, cb_parm); + return; ++ } + + rtw89_debug(rtwdev, RTW89_DBG_CHAN, "chanctx proceed\n"); + + hal->entity_pause = false; + rtw89_set_channel(rtwdev); + ++ rtw89_chanctx_proceed_cb(rtwdev, cb_parm); ++ + mode = rtw89_get_entity_mode(rtwdev); + switch (mode) { + case RTW89_ENTITY_MODE_MCC: +diff --git a/drivers/net/wireless/realtek/rtw89/chan.h b/drivers/net/wireless/realtek/rtw89/chan.h +index 2eb31dff20831..092a6f676894f 100644 +--- a/drivers/net/wireless/realtek/rtw89/chan.h ++++ b/drivers/net/wireless/realtek/rtw89/chan.h +@@ -38,6 +38,12 @@ enum rtw89_chanctx_pause_reasons { + RTW89_CHANCTX_PAUSE_REASON_ROC, + }; + ++struct rtw89_chanctx_cb_parm { ++ int (*cb)(struct rtw89_dev *rtwdev, void *data); ++ void *data; ++ const char *caller; ++}; ++ + struct rtw89_entity_weight { + unsigned int active_chanctxs; + unsigned int active_roles; +@@ -100,7 +106,8 @@ void rtw89_queue_chanctx_change(struct rtw89_dev *rtwdev, + void rtw89_chanctx_track(struct rtw89_dev *rtwdev); + void rtw89_chanctx_pause(struct rtw89_dev *rtwdev, + enum rtw89_chanctx_pause_reasons rsn); +-void rtw89_chanctx_proceed(struct rtw89_dev *rtwdev); ++void rtw89_chanctx_proceed(struct rtw89_dev *rtwdev, ++ const struct rtw89_chanctx_cb_parm *cb_parm); + + const struct rtw89_chan *__rtw89_mgnt_chan_get(struct rtw89_dev *rtwdev, + const char *caller_message, +diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c +index d35d066c0b123..f82a26be6fa82 100644 +--- a/drivers/net/wireless/realtek/rtw89/core.c ++++ b/drivers/net/wireless/realtek/rtw89/core.c +@@ -3212,7 +3212,7 @@ void rtw89_roc_end(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif) + + roc->state = RTW89_ROC_IDLE; + rtw89_config_roc_chandef(rtwdev, rtwvif_link->chanctx_idx, NULL); +- rtw89_chanctx_proceed(rtwdev); ++ rtw89_chanctx_proceed(rtwdev, NULL); + ret = rtw89_core_send_nullfunc(rtwdev, rtwvif_link, true, false); + if (ret) + rtw89_debug(rtwdev, RTW89_DBG_TXRX, +diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c +index e6bceef691e9b..620e076d1b597 100644 +--- a/drivers/net/wireless/realtek/rtw89/fw.c ++++ b/drivers/net/wireless/realtek/rtw89/fw.c +@@ -6637,21 +6637,24 @@ void rtw89_hw_scan_start(struct rtw89_dev *rtwdev, + rtw89_chanctx_pause(rtwdev, RTW89_CHANCTX_PAUSE_REASON_HW_SCAN); + } + +-void rtw89_hw_scan_complete(struct rtw89_dev *rtwdev, +- struct rtw89_vif_link *rtwvif_link, +- bool aborted) ++struct rtw89_hw_scan_complete_cb_data { ++ struct rtw89_vif_link *rtwvif_link; ++ bool aborted; ++}; ++ ++static int rtw89_hw_scan_complete_cb(struct rtw89_dev *rtwdev, void *data) + { + const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def; + struct rtw89_hw_scan_info *scan_info = &rtwdev->scan_info; ++ struct rtw89_hw_scan_complete_cb_data *cb_data = data; ++ struct rtw89_vif_link *rtwvif_link = cb_data->rtwvif_link; + struct cfg80211_scan_info info = { +- .aborted = aborted, ++ .aborted = cb_data->aborted, + }; + struct rtw89_vif *rtwvif; + + if (!rtwvif_link) +- return; +- +- rtw89_chanctx_proceed(rtwdev); ++ return -EINVAL; + + rtwvif = rtwvif_link->rtwvif; + +@@ -6672,6 +6675,29 @@ void rtw89_hw_scan_complete(struct rtw89_dev *rtwdev, + scan_info->last_chan_idx = 0; + scan_info->scanning_vif = NULL; + scan_info->abort = false; ++ ++ return 0; ++} ++ ++void rtw89_hw_scan_complete(struct rtw89_dev *rtwdev, ++ struct rtw89_vif_link *rtwvif_link, ++ bool aborted) ++{ ++ struct rtw89_hw_scan_complete_cb_data cb_data = { ++ .rtwvif_link = rtwvif_link, ++ .aborted = aborted, ++ }; ++ const struct rtw89_chanctx_cb_parm cb_parm = { ++ .cb = rtw89_hw_scan_complete_cb, ++ .data = &cb_data, ++ .caller = __func__, ++ }; ++ ++ /* The things here needs to be done after setting channel (for coex) ++ * and before proceeding entity mode (for MCC). So, pass a callback ++ * of them for the right sequence rather than doing them directly. ++ */ ++ rtw89_chanctx_proceed(rtwdev, &cb_parm); + } + + void rtw89_hw_scan_abort(struct rtw89_dev *rtwdev, +-- +2.39.5 + diff --git a/queue-6.12/wifi-rtw89-fix-race-between-cancel_hw_scan-and-hw_sc.patch b/queue-6.12/wifi-rtw89-fix-race-between-cancel_hw_scan-and-hw_sc.patch new file mode 100644 index 0000000000..de48926572 --- /dev/null +++ b/queue-6.12/wifi-rtw89-fix-race-between-cancel_hw_scan-and-hw_sc.patch @@ -0,0 +1,128 @@ +From a0796a116e2b723fbfcb2da446cb9e286ea6978e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jan 2025 19:42:54 +0800 +Subject: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion + +From: Ping-Ke Shih + +[ Upstream commit ba4bb0402c60e945c4c396c51f0acac3c3e3ea5c ] + +The rtwdev->scanning flag isn't protected by mutex originally, so +cancel_hw_scan can pass the condition, but suddenly hw_scan completion +unset the flag and calls ieee80211_scan_completed() that will free +local->hw_scan_req. Then, cancel_hw_scan raises null-ptr-deref and +use-after-free. Fix it by moving the check condition to where +protected by mutex. + + KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f] + CPU: 2 PID: 6922 Comm: kworker/2:2 Tainted: G OE + Hardware name: LENOVO 2356AD1/2356AD1, BIOS G7ETB6WW (2.76 ) 09/10/2019 + Workqueue: events cfg80211_conn_work [cfg80211] + RIP: 0010:rtw89_fw_h2c_scan_offload_be+0xc33/0x13c3 [rtw89_core] + Code: 00 45 89 6c 24 1c 0f 85 23 01 00 00 48 8b 85 20 ff ff ff 48 8d + RSP: 0018:ffff88811fd9f068 EFLAGS: 00010206 + RAX: dffffc0000000000 RBX: ffff88811fd9f258 RCX: 0000000000000001 + RDX: 0000000000000011 RSI: 0000000000000001 RDI: 0000000000000089 + RBP: ffff88811fd9f170 R08: 0000000000000000 R09: 0000000000000000 + R10: ffff88811fd9f108 R11: 0000000000000000 R12: ffff88810e47f960 + R13: 0000000000000000 R14: 000000000000ffff R15: 0000000000000000 + FS: 0000000000000000(0000) GS:ffff8881d6f00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007531dfca55b0 CR3: 00000001be296004 CR4: 00000000001706e0 + Call Trace: + + ? show_regs+0x61/0x73 + ? __die_body+0x20/0x73 + ? die_addr+0x4f/0x7b + ? exc_general_protection+0x191/0x1db + ? asm_exc_general_protection+0x27/0x30 + ? rtw89_fw_h2c_scan_offload_be+0xc33/0x13c3 [rtw89_core] + ? rtw89_fw_h2c_scan_offload_be+0x458/0x13c3 [rtw89_core] + ? __pfx_rtw89_fw_h2c_scan_offload_be+0x10/0x10 [rtw89_core] + ? do_raw_spin_lock+0x75/0xdb + ? __pfx_do_raw_spin_lock+0x10/0x10 + rtw89_hw_scan_offload+0xb5e/0xbf7 [rtw89_core] + ? _raw_spin_unlock+0xe/0x24 + ? __mutex_lock.constprop.0+0x40c/0x471 + ? __pfx_rtw89_hw_scan_offload+0x10/0x10 [rtw89_core] + ? __mutex_lock_slowpath+0x13/0x1f + ? mutex_lock+0xa2/0xdc + ? __pfx_mutex_lock+0x10/0x10 + rtw89_hw_scan_abort+0x58/0xb7 [rtw89_core] + rtw89_ops_cancel_hw_scan+0x120/0x13b [rtw89_core] + ieee80211_scan_cancel+0x468/0x4d0 [mac80211] + ieee80211_prep_connection+0x858/0x899 [mac80211] + ieee80211_mgd_auth+0xbea/0xdde [mac80211] + ? __pfx_ieee80211_mgd_auth+0x10/0x10 [mac80211] + ? cfg80211_find_elem+0x15/0x29 [cfg80211] + ? is_bss+0x1b7/0x1d7 [cfg80211] + ieee80211_auth+0x18/0x27 [mac80211] + cfg80211_mlme_auth+0x3bb/0x3e7 [cfg80211] + cfg80211_conn_do_work+0x410/0xb81 [cfg80211] + ? __pfx_cfg80211_conn_do_work+0x10/0x10 [cfg80211] + ? __kasan_check_read+0x11/0x1f + ? psi_group_change+0x8bc/0x944 + ? __kasan_check_write+0x14/0x22 + ? mutex_lock+0x8e/0xdc + ? __pfx_mutex_lock+0x10/0x10 + ? __pfx___radix_tree_lookup+0x10/0x10 + cfg80211_conn_work+0x245/0x34d [cfg80211] + ? __pfx_cfg80211_conn_work+0x10/0x10 [cfg80211] + ? update_cfs_rq_load_avg+0x3bc/0x3d7 + ? sched_clock_noinstr+0x9/0x1a + ? sched_clock+0x10/0x24 + ? sched_clock_cpu+0x7e/0x42e + ? newidle_balance+0x796/0x937 + ? __pfx_sched_clock_cpu+0x10/0x10 + ? __pfx_newidle_balance+0x10/0x10 + ? __kasan_check_read+0x11/0x1f + ? psi_group_change+0x8bc/0x944 + ? _raw_spin_unlock+0xe/0x24 + ? raw_spin_rq_unlock+0x47/0x54 + ? raw_spin_rq_unlock_irq+0x9/0x1f + ? finish_task_switch.isra.0+0x347/0x586 + ? __schedule+0x27bf/0x2892 + ? mutex_unlock+0x80/0xd0 + ? do_raw_spin_lock+0x75/0xdb + ? __pfx___schedule+0x10/0x10 + process_scheduled_works+0x58c/0x821 + worker_thread+0x4c7/0x586 + ? __kasan_check_read+0x11/0x1f + kthread+0x285/0x294 + ? __pfx_worker_thread+0x10/0x10 + ? __pfx_kthread+0x10/0x10 + ret_from_fork+0x29/0x6f + ? __pfx_kthread+0x10/0x10 + ret_from_fork_asm+0x1b/0x30 + + +Fixes: 895907779752 ("rtw89: 8852a: add ieee80211_ops::hw_scan") +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20250107114254.6769-1-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/mac80211.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/mac80211.c b/drivers/net/wireless/realtek/rtw89/mac80211.c +index a04717b847a0f..8351a70d325d4 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac80211.c ++++ b/drivers/net/wireless/realtek/rtw89/mac80211.c +@@ -1273,11 +1273,11 @@ static void rtw89_ops_cancel_hw_scan(struct ieee80211_hw *hw, + if (!RTW89_CHK_FW_FEATURE(SCAN_OFFLOAD, &rtwdev->fw)) + return; + +- if (!rtwdev->scanning) +- return; +- + mutex_lock(&rtwdev->mutex); + ++ if (!rtwdev->scanning) ++ goto out; ++ + rtwvif_link = rtw89_vif_get_link_inst(rtwvif, 0); + if (unlikely(!rtwvif_link)) { + rtw89_err(rtwdev, "cancel hw scan: find no link on HW-0\n"); +-- +2.39.5 + diff --git a/queue-6.12/wifi-rtw89-handle-entity-active-flag-per-phy.patch b/queue-6.12/wifi-rtw89-handle-entity-active-flag-per-phy.patch new file mode 100644 index 0000000000..e0a88b3d05 --- /dev/null +++ b/queue-6.12/wifi-rtw89-handle-entity-active-flag-per-phy.patch @@ -0,0 +1,140 @@ +From 4a7bd3a24bd1c09cdf0b726086437cf1b26c054e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Sep 2024 10:01:19 +0800 +Subject: wifi: rtw89: handle entity active flag per PHY + +From: Zong-Zhe Yang + +[ Upstream commit ad95bb3b92c65849a6101402197e2cbeb2910a4a ] + +Originally, we have an active flag to record whether we have set PHY once. +After impending MLO support, there will be dual-PHY and they can be set +individually on Wi-Fi 7 chips. So, we now have active flag per PHY and +handle them individually. + +Signed-off-by: Zong-Zhe Yang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20240925020119.13170-3-pkshih@realtek.com +Stable-dep-of: e47f0a589854 ("wifi: rtw89: fix proceeding MCC with wrong scanning state after sequence changes") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/chan.h | 11 +++++++---- + drivers/net/wireless/realtek/rtw89/core.c | 15 ++++++++------- + drivers/net/wireless/realtek/rtw89/core.h | 2 +- + drivers/net/wireless/realtek/rtw89/mac.c | 3 ++- + 4 files changed, 18 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/chan.h b/drivers/net/wireless/realtek/rtw89/chan.h +index 4ed777ea50648..74de13a2e7da9 100644 +--- a/drivers/net/wireless/realtek/rtw89/chan.h ++++ b/drivers/net/wireless/realtek/rtw89/chan.h +@@ -43,18 +43,21 @@ struct rtw89_entity_weight { + unsigned int active_roles; + }; + +-static inline bool rtw89_get_entity_state(struct rtw89_dev *rtwdev) ++static inline bool rtw89_get_entity_state(struct rtw89_dev *rtwdev, ++ enum rtw89_phy_idx phy_idx) + { + struct rtw89_hal *hal = &rtwdev->hal; + +- return READ_ONCE(hal->entity_active); ++ return READ_ONCE(hal->entity_active[phy_idx]); + } + +-static inline void rtw89_set_entity_state(struct rtw89_dev *rtwdev, bool active) ++static inline void rtw89_set_entity_state(struct rtw89_dev *rtwdev, ++ enum rtw89_phy_idx phy_idx, ++ bool active) + { + struct rtw89_hal *hal = &rtwdev->hal; + +- WRITE_ONCE(hal->entity_active, active); ++ WRITE_ONCE(hal->entity_active[phy_idx], active); + } + + static inline +diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c +index 5b8e65f6de6a4..37d2bcba1b315 100644 +--- a/drivers/net/wireless/realtek/rtw89/core.c ++++ b/drivers/net/wireless/realtek/rtw89/core.c +@@ -352,10 +352,6 @@ void rtw89_core_set_chip_txpwr(struct rtw89_dev *rtwdev) + enum rtw89_entity_mode mode; + bool entity_active; + +- entity_active = rtw89_get_entity_state(rtwdev); +- if (!entity_active) +- return; +- + mode = rtw89_get_entity_mode(rtwdev); + switch (mode) { + case RTW89_ENTITY_MODE_SCC: +@@ -375,6 +371,11 @@ void rtw89_core_set_chip_txpwr(struct rtw89_dev *rtwdev) + chanctx_idx = roc_idx; + + phy_idx = RTW89_PHY_0; ++ ++ entity_active = rtw89_get_entity_state(rtwdev, phy_idx); ++ if (!entity_active) ++ return; ++ + chan = rtw89_chan_get(rtwdev, chanctx_idx); + chip->ops->set_txpwr(rtwdev, chan, phy_idx); + } +@@ -393,8 +394,6 @@ int rtw89_set_channel(struct rtw89_dev *rtwdev) + enum rtw89_entity_mode mode; + bool entity_active; + +- entity_active = rtw89_get_entity_state(rtwdev); +- + mode = rtw89_entity_recalc(rtwdev); + switch (mode) { + case RTW89_ENTITY_MODE_SCC: +@@ -416,6 +415,8 @@ int rtw89_set_channel(struct rtw89_dev *rtwdev) + mac_idx = RTW89_MAC_0; + phy_idx = RTW89_PHY_0; + ++ entity_active = rtw89_get_entity_state(rtwdev, phy_idx); ++ + chan = rtw89_chan_get(rtwdev, chanctx_idx); + chan_rcd = rtw89_chan_rcd_get(rtwdev, chanctx_idx); + +@@ -432,7 +433,7 @@ int rtw89_set_channel(struct rtw89_dev *rtwdev) + rtw89_chip_rfk_band_changed(rtwdev, phy_idx, chan); + } + +- rtw89_set_entity_state(rtwdev, true); ++ rtw89_set_entity_state(rtwdev, phy_idx, true); + return 0; + } + +diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h +index de33320b1354c..0ed31b37d10fe 100644 +--- a/drivers/net/wireless/realtek/rtw89/core.h ++++ b/drivers/net/wireless/realtek/rtw89/core.h +@@ -4668,7 +4668,7 @@ struct rtw89_hal { + struct rtw89_chanctx chanctx[NUM_OF_RTW89_CHANCTX]; + struct cfg80211_chan_def roc_chandef; + +- bool entity_active; ++ bool entity_active[RTW89_PHY_MAX]; + bool entity_pause; + enum rtw89_entity_mode entity_mode; + +diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c +index 4e15d539e3d1c..4574aa62839b0 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac.c ++++ b/drivers/net/wireless/realtek/rtw89/mac.c +@@ -1483,7 +1483,8 @@ static int rtw89_mac_power_switch(struct rtw89_dev *rtwdev, bool on) + clear_bit(RTW89_FLAG_CMAC1_FUNC, rtwdev->flags); + clear_bit(RTW89_FLAG_FW_RDY, rtwdev->flags); + rtw89_write8(rtwdev, R_AX_SCOREBOARD + 3, MAC_AX_NOTIFY_PWR_MAJOR); +- rtw89_set_entity_state(rtwdev, false); ++ rtw89_set_entity_state(rtwdev, RTW89_PHY_0, false); ++ rtw89_set_entity_state(rtwdev, RTW89_PHY_1, false); + } + + return 0; +-- +2.39.5 + diff --git a/queue-6.12/wifi-rtw89-mcc-consider-time-limits-not-divisible-by.patch b/queue-6.12/wifi-rtw89-mcc-consider-time-limits-not-divisible-by.patch new file mode 100644 index 0000000000..1112081b0c --- /dev/null +++ b/queue-6.12/wifi-rtw89-mcc-consider-time-limits-not-divisible-by.patch @@ -0,0 +1,44 @@ +From 63202446a72d4c096e10a52c9cc9e4557ea373d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jan 2025 15:44:12 +0800 +Subject: wifi: rtw89: mcc: consider time limits not divisible by 1024 + +From: Zong-Zhe Yang + +[ Upstream commit 35642ba31dc4a1816a20191e90156a9e329beb10 ] + +For each MCC role, time limits, including max_tob_us, max_toa_us, and +mac_dur_us, are calculated if there are NoA attributes. The relation +between these time limits is "max_dur_us = max_tob_us + max_toa_us". +Then, the unit is converted from us to TU. However, originally, each +time limit was divided by 1024 independently. It missed to consider +the cases that max_tob_us or max_toa_us is not divisible by 1024. It +causes the result breaks "max_dur (TU) = max_tob (TU) + max_toa (TU)". +Finally, when MCC calculates pattern parameters based on these kinds +of time limits, it might not perform well. + +Fixes: b09df09b55fb ("wifi: rtw89: mcc: initialize start flow") +Signed-off-by: Zong-Zhe Yang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20250103074412.124066-1-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/chan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/chan.c b/drivers/net/wireless/realtek/rtw89/chan.c +index c06d305519df4..4df4e04c3e67d 100644 +--- a/drivers/net/wireless/realtek/rtw89/chan.c ++++ b/drivers/net/wireless/realtek/rtw89/chan.c +@@ -802,7 +802,7 @@ static void rtw89_mcc_fill_role_limit(struct rtw89_dev *rtwdev, + + mcc_role->limit.max_toa = max_toa_us / 1024; + mcc_role->limit.max_tob = max_tob_us / 1024; +- mcc_role->limit.max_dur = max_dur_us / 1024; ++ mcc_role->limit.max_dur = mcc_role->limit.max_toa + mcc_role->limit.max_tob; + mcc_role->limit.enable = true; + + rtw89_debug(rtwdev, RTW89_DBG_CHAN, +-- +2.39.5 + diff --git a/queue-6.12/wifi-rtw89-tweak-setting-of-channel-and-tx-power-for.patch b/queue-6.12/wifi-rtw89-tweak-setting-of-channel-and-tx-power-for.patch new file mode 100644 index 0000000000..4db1f6d68d --- /dev/null +++ b/queue-6.12/wifi-rtw89-tweak-setting-of-channel-and-tx-power-for.patch @@ -0,0 +1,383 @@ +From 26a79b84cf9c757ee25e5b15e2b77900b942d1f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Oct 2024 16:31:05 +0800 +Subject: wifi: rtw89: tweak setting of channel and TX power for MLO + +From: Zong-Zhe Yang + +[ Upstream commit 2305ebc1835b1ca921045b4f0941e82edde3249b ] + +Setting of channel and TX power depend on channel contexts, but original +code cannot handle combination of MCC (multi-channel concurrency) and MLO +well. So according to active interfaces, we generate a table for current +channel contexts. And then based on entity mode, we get the corresponding +channel context to apply during channel or TX power setting. When MLO is +supported, there will be dual-PHY and we will apply the channel context of +the 2nd link to the 2nd PHY. + +Signed-off-by: Zong-Zhe Yang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241022083106.149252-5-pkshih@realtek.com +Stable-dep-of: e47f0a589854 ("wifi: rtw89: fix proceeding MCC with wrong scanning state after sequence changes") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/chan.c | 80 +++++++++++++++- + drivers/net/wireless/realtek/rtw89/chan.h | 8 ++ + drivers/net/wireless/realtek/rtw89/core.c | 111 ++++++++++------------ + drivers/net/wireless/realtek/rtw89/core.h | 15 ++- + 4 files changed, 149 insertions(+), 65 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/chan.c b/drivers/net/wireless/realtek/rtw89/chan.c +index 2b7e6921ff9c6..fb9449930c40a 100644 +--- a/drivers/net/wireless/realtek/rtw89/chan.c ++++ b/drivers/net/wireless/realtek/rtw89/chan.c +@@ -299,6 +299,64 @@ static void rtw89_normalize_link_chanctx(struct rtw89_dev *rtwdev, + rtw89_swap_chanctx(rtwdev, rtwvif_link->chanctx_idx, cur->chanctx_idx); + } + ++const struct rtw89_chan *__rtw89_mgnt_chan_get(struct rtw89_dev *rtwdev, ++ const char *caller_message, ++ u8 link_index) ++{ ++ struct rtw89_hal *hal = &rtwdev->hal; ++ struct rtw89_entity_mgnt *mgnt = &hal->entity_mgnt; ++ enum rtw89_chanctx_idx chanctx_idx; ++ enum rtw89_chanctx_idx roc_idx; ++ enum rtw89_entity_mode mode; ++ u8 role_index; ++ ++ lockdep_assert_held(&rtwdev->mutex); ++ ++ if (unlikely(link_index >= __RTW89_MLD_MAX_LINK_NUM)) { ++ WARN(1, "link index %u is invalid (max link inst num: %d)\n", ++ link_index, __RTW89_MLD_MAX_LINK_NUM); ++ goto dflt; ++ } ++ ++ mode = rtw89_get_entity_mode(rtwdev); ++ switch (mode) { ++ case RTW89_ENTITY_MODE_SCC_OR_SMLD: ++ case RTW89_ENTITY_MODE_MCC: ++ role_index = 0; ++ break; ++ case RTW89_ENTITY_MODE_MCC_PREPARE: ++ role_index = 1; ++ break; ++ default: ++ WARN(1, "Invalid ent mode: %d\n", mode); ++ goto dflt; ++ } ++ ++ chanctx_idx = mgnt->chanctx_tbl[role_index][link_index]; ++ if (chanctx_idx == RTW89_CHANCTX_IDLE) ++ goto dflt; ++ ++ roc_idx = atomic_read(&hal->roc_chanctx_idx); ++ if (roc_idx != RTW89_CHANCTX_IDLE) { ++ /* ROC is ongoing (given ROC runs on RTW89_ROC_BY_LINK_INDEX). ++ * If @link_index is the same as RTW89_ROC_BY_LINK_INDEX, get ++ * the ongoing ROC chanctx. ++ */ ++ if (link_index == RTW89_ROC_BY_LINK_INDEX) ++ chanctx_idx = roc_idx; ++ } ++ ++ return rtw89_chan_get(rtwdev, chanctx_idx); ++ ++dflt: ++ rtw89_debug(rtwdev, RTW89_DBG_CHAN, ++ "%s (%s): prefetch NULL on link index %u\n", ++ __func__, caller_message ?: "", link_index); ++ ++ return rtw89_chan_get(rtwdev, RTW89_CHANCTX_0); ++} ++EXPORT_SYMBOL(__rtw89_mgnt_chan_get); ++ + static void rtw89_entity_recalc_mgnt_roles(struct rtw89_dev *rtwdev) + { + struct rtw89_hal *hal = &rtwdev->hal; +@@ -306,13 +364,18 @@ static void rtw89_entity_recalc_mgnt_roles(struct rtw89_dev *rtwdev) + struct rtw89_vif_link *link; + struct rtw89_vif *role; + u8 pos = 0; +- int i; ++ int i, j; + + lockdep_assert_held(&rtwdev->mutex); + + for (i = 0; i < RTW89_MAX_INTERFACE_NUM; i++) + mgnt->active_roles[i] = NULL; + ++ for (i = 0; i < RTW89_MAX_INTERFACE_NUM; i++) { ++ for (j = 0; j < __RTW89_MLD_MAX_LINK_NUM; j++) ++ mgnt->chanctx_tbl[i][j] = RTW89_CHANCTX_IDLE; ++ } ++ + /* To be consistent with legacy behavior, expect the first active role + * which uses RTW89_CHANCTX_0 to put at position 0, and make its first + * link instance take RTW89_CHANCTX_0. (normalizing) +@@ -341,6 +404,14 @@ static void rtw89_entity_recalc_mgnt_roles(struct rtw89_dev *rtwdev) + break; + } + ++ for (i = 0; i < role->links_inst_valid_num; i++) { ++ link = rtw89_vif_get_link_inst(role, i); ++ if (!link || !link->chanctx_assigned) ++ continue; ++ ++ mgnt->chanctx_tbl[pos][i] = link->chanctx_idx; ++ } ++ + mgnt->active_roles[pos++] = role; + } + } +@@ -371,9 +442,14 @@ enum rtw89_entity_mode rtw89_entity_recalc(struct rtw89_dev *rtwdev) + set_bit(RTW89_CHANCTX_0, recalc_map); + fallthrough; + case 1: +- mode = RTW89_ENTITY_MODE_SCC; ++ mode = RTW89_ENTITY_MODE_SCC_OR_SMLD; + break; + case 2 ... NUM_OF_RTW89_CHANCTX: ++ if (w.active_roles == 1) { ++ mode = RTW89_ENTITY_MODE_SCC_OR_SMLD; ++ break; ++ } ++ + if (w.active_roles != NUM_OF_RTW89_MCC_ROLES) { + rtw89_debug(rtwdev, RTW89_DBG_CHAN, + "unhandled ent: %d chanctxs %d roles\n", +diff --git a/drivers/net/wireless/realtek/rtw89/chan.h b/drivers/net/wireless/realtek/rtw89/chan.h +index 74de13a2e7da9..2eb31dff20831 100644 +--- a/drivers/net/wireless/realtek/rtw89/chan.h ++++ b/drivers/net/wireless/realtek/rtw89/chan.h +@@ -101,6 +101,14 @@ void rtw89_chanctx_track(struct rtw89_dev *rtwdev); + void rtw89_chanctx_pause(struct rtw89_dev *rtwdev, + enum rtw89_chanctx_pause_reasons rsn); + void rtw89_chanctx_proceed(struct rtw89_dev *rtwdev); ++ ++const struct rtw89_chan *__rtw89_mgnt_chan_get(struct rtw89_dev *rtwdev, ++ const char *caller_message, ++ u8 link_index); ++ ++#define rtw89_mgnt_chan_get(rtwdev, link_index) \ ++ __rtw89_mgnt_chan_get(rtwdev, __func__, link_index) ++ + int rtw89_chanctx_ops_add(struct rtw89_dev *rtwdev, + struct ieee80211_chanctx_conf *ctx); + void rtw89_chanctx_ops_remove(struct rtw89_dev *rtwdev, +diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c +index e864da4d37519..d35d066c0b123 100644 +--- a/drivers/net/wireless/realtek/rtw89/core.c ++++ b/drivers/net/wireless/realtek/rtw89/core.c +@@ -341,84 +341,47 @@ void rtw89_get_channel_params(const struct cfg80211_chan_def *chandef, + rtw89_chan_create(chan, center_chan, channel->hw_value, band, bandwidth); + } + +-void rtw89_core_set_chip_txpwr(struct rtw89_dev *rtwdev) ++static void __rtw89_core_set_chip_txpwr(struct rtw89_dev *rtwdev, ++ const struct rtw89_chan *chan, ++ enum rtw89_phy_idx phy_idx) + { +- struct rtw89_hal *hal = &rtwdev->hal; + const struct rtw89_chip_info *chip = rtwdev->chip; +- const struct rtw89_chan *chan; +- enum rtw89_chanctx_idx chanctx_idx; +- enum rtw89_chanctx_idx roc_idx; +- enum rtw89_phy_idx phy_idx; +- enum rtw89_entity_mode mode; + bool entity_active; + +- mode = rtw89_get_entity_mode(rtwdev); +- switch (mode) { +- case RTW89_ENTITY_MODE_SCC: +- case RTW89_ENTITY_MODE_MCC: +- chanctx_idx = RTW89_CHANCTX_0; +- break; +- case RTW89_ENTITY_MODE_MCC_PREPARE: +- chanctx_idx = RTW89_CHANCTX_1; +- break; +- default: +- WARN(1, "Invalid ent mode: %d\n", mode); ++ entity_active = rtw89_get_entity_state(rtwdev, phy_idx); ++ if (!entity_active) + return; +- } + +- roc_idx = atomic_read(&hal->roc_chanctx_idx); +- if (roc_idx != RTW89_CHANCTX_IDLE) +- chanctx_idx = roc_idx; ++ chip->ops->set_txpwr(rtwdev, chan, phy_idx); ++} + +- phy_idx = RTW89_PHY_0; ++void rtw89_core_set_chip_txpwr(struct rtw89_dev *rtwdev) ++{ ++ const struct rtw89_chan *chan; + +- entity_active = rtw89_get_entity_state(rtwdev, phy_idx); +- if (!entity_active) ++ chan = rtw89_mgnt_chan_get(rtwdev, 0); ++ __rtw89_core_set_chip_txpwr(rtwdev, chan, RTW89_PHY_0); ++ ++ if (!rtwdev->support_mlo) + return; + +- chan = rtw89_chan_get(rtwdev, chanctx_idx); +- chip->ops->set_txpwr(rtwdev, chan, phy_idx); ++ chan = rtw89_mgnt_chan_get(rtwdev, 1); ++ __rtw89_core_set_chip_txpwr(rtwdev, chan, RTW89_PHY_1); + } + +-int rtw89_set_channel(struct rtw89_dev *rtwdev) ++static void __rtw89_set_channel(struct rtw89_dev *rtwdev, ++ const struct rtw89_chan *chan, ++ enum rtw89_mac_idx mac_idx, ++ enum rtw89_phy_idx phy_idx) + { +- struct rtw89_hal *hal = &rtwdev->hal; + const struct rtw89_chip_info *chip = rtwdev->chip; + const struct rtw89_chan_rcd *chan_rcd; +- const struct rtw89_chan *chan; +- enum rtw89_chanctx_idx chanctx_idx; +- enum rtw89_chanctx_idx roc_idx; +- enum rtw89_mac_idx mac_idx; +- enum rtw89_phy_idx phy_idx; + struct rtw89_channel_help_params bak; +- enum rtw89_entity_mode mode; + bool entity_active; + +- mode = rtw89_entity_recalc(rtwdev); +- switch (mode) { +- case RTW89_ENTITY_MODE_SCC: +- case RTW89_ENTITY_MODE_MCC: +- chanctx_idx = RTW89_CHANCTX_0; +- break; +- case RTW89_ENTITY_MODE_MCC_PREPARE: +- chanctx_idx = RTW89_CHANCTX_1; +- break; +- default: +- WARN(1, "Invalid ent mode: %d\n", mode); +- return -EINVAL; +- } +- +- roc_idx = atomic_read(&hal->roc_chanctx_idx); +- if (roc_idx != RTW89_CHANCTX_IDLE) +- chanctx_idx = roc_idx; +- +- mac_idx = RTW89_MAC_0; +- phy_idx = RTW89_PHY_0; +- + entity_active = rtw89_get_entity_state(rtwdev, phy_idx); + +- chan = rtw89_chan_get(rtwdev, chanctx_idx); +- chan_rcd = rtw89_chan_rcd_get(rtwdev, chanctx_idx); ++ chan_rcd = rtw89_chan_rcd_get_by_chan(chan); + + rtw89_chip_set_channel_prepare(rtwdev, &bak, chan, mac_idx, phy_idx); + +@@ -434,6 +397,28 @@ int rtw89_set_channel(struct rtw89_dev *rtwdev) + } + + rtw89_set_entity_state(rtwdev, phy_idx, true); ++} ++ ++int rtw89_set_channel(struct rtw89_dev *rtwdev) ++{ ++ const struct rtw89_chan *chan; ++ enum rtw89_entity_mode mode; ++ ++ mode = rtw89_entity_recalc(rtwdev); ++ if (mode < 0 || mode >= NUM_OF_RTW89_ENTITY_MODE) { ++ WARN(1, "Invalid ent mode: %d\n", mode); ++ return -EINVAL; ++ } ++ ++ chan = rtw89_mgnt_chan_get(rtwdev, 0); ++ __rtw89_set_channel(rtwdev, chan, RTW89_MAC_0, RTW89_PHY_0); ++ ++ if (!rtwdev->support_mlo) ++ return 0; ++ ++ chan = rtw89_mgnt_chan_get(rtwdev, 1); ++ __rtw89_set_channel(rtwdev, chan, RTW89_MAC_1, RTW89_PHY_1); ++ + return 0; + } + +@@ -3158,9 +3143,10 @@ void rtw89_roc_start(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif) + rtw89_leave_ips_by_hwflags(rtwdev); + rtw89_leave_lps(rtwdev); + +- rtwvif_link = rtw89_vif_get_link_inst(rtwvif, 0); ++ rtwvif_link = rtw89_vif_get_link_inst(rtwvif, RTW89_ROC_BY_LINK_INDEX); + if (unlikely(!rtwvif_link)) { +- rtw89_err(rtwdev, "roc start: find no link on HW-0\n"); ++ rtw89_err(rtwdev, "roc start: find no link on HW-%u\n", ++ RTW89_ROC_BY_LINK_INDEX); + return; + } + +@@ -3212,9 +3198,10 @@ void rtw89_roc_end(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif) + rtw89_leave_ips_by_hwflags(rtwdev); + rtw89_leave_lps(rtwdev); + +- rtwvif_link = rtw89_vif_get_link_inst(rtwvif, 0); ++ rtwvif_link = rtw89_vif_get_link_inst(rtwvif, RTW89_ROC_BY_LINK_INDEX); + if (unlikely(!rtwvif_link)) { +- rtw89_err(rtwdev, "roc end: find no link on HW-0\n"); ++ rtw89_err(rtwdev, "roc end: find no link on HW-%u\n", ++ RTW89_ROC_BY_LINK_INDEX); + return; + } + +diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h +index 65ad3d03d0530..ff3048d2489f1 100644 +--- a/drivers/net/wireless/realtek/rtw89/core.h ++++ b/drivers/net/wireless/realtek/rtw89/core.h +@@ -3424,6 +3424,8 @@ enum rtw89_roc_state { + RTW89_ROC_MGMT, + }; + ++#define RTW89_ROC_BY_LINK_INDEX 0 ++ + struct rtw89_roc { + struct ieee80211_channel chan; + struct delayed_work roc_work; +@@ -4619,7 +4621,7 @@ enum rtw89_chanctx_changes { + }; + + enum rtw89_entity_mode { +- RTW89_ENTITY_MODE_SCC, ++ RTW89_ENTITY_MODE_SCC_OR_SMLD, + RTW89_ENTITY_MODE_MCC_PREPARE, + RTW89_ENTITY_MODE_MCC, + +@@ -4634,6 +4636,8 @@ enum rtw89_entity_mode { + struct rtw89_entity_mgnt { + struct list_head active_list; + struct rtw89_vif *active_roles[RTW89_MAX_INTERFACE_NUM]; ++ enum rtw89_chanctx_idx chanctx_tbl[RTW89_MAX_INTERFACE_NUM] ++ [__RTW89_MLD_MAX_LINK_NUM]; + }; + + struct rtw89_chanctx { +@@ -6371,6 +6375,15 @@ const struct rtw89_chan_rcd *rtw89_chan_rcd_get(struct rtw89_dev *rtwdev, + return &hal->chanctx[idx].rcd; + } + ++static inline ++const struct rtw89_chan_rcd *rtw89_chan_rcd_get_by_chan(const struct rtw89_chan *chan) ++{ ++ const struct rtw89_chanctx *chanctx = ++ container_of_const(chan, struct rtw89_chanctx, chan); ++ ++ return &chanctx->rcd; ++} ++ + static inline + const struct rtw89_chan *rtw89_scan_chan_get(struct rtw89_dev *rtwdev) + { +-- +2.39.5 + diff --git a/queue-6.12/wifi-wcn36xx-fix-channel-survey-memory-allocation-si.patch b/queue-6.12/wifi-wcn36xx-fix-channel-survey-memory-allocation-si.patch new file mode 100644 index 0000000000..67a14bd673 --- /dev/null +++ b/queue-6.12/wifi-wcn36xx-fix-channel-survey-memory-allocation-si.patch @@ -0,0 +1,48 @@ +From 9f0b7439798543c924feb56c754806d5d902e20a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Nov 2024 21:00:35 +0100 +Subject: wifi: wcn36xx: fix channel survey memory allocation size +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Barnabás Czémán + +[ Upstream commit 6200d947f050efdba4090dfefd8a01981363d954 ] + +KASAN reported a memory allocation issue in wcn->chan_survey +due to incorrect size calculation. +This commit uses kcalloc to allocate memory for wcn->chan_survey, +ensuring proper initialization and preventing the use of uninitialized +values when there are no frames on the channel. + +Fixes: 29696e0aa413 ("wcn36xx: Track SNR and RSSI for each RX frame") +Signed-off-by: Barnabás Czémán +Acked-by: Loic Poulain +Reviewed-by: Bryan O'Donoghue +Link: https://patch.msgid.link/20241104-wcn36xx-memory-allocation-v1-1-5ec901cf37b6@mainlining.org +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/wcn36xx/main.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c +index 408776562a7e5..cd36cab6db75d 100644 +--- a/drivers/net/wireless/ath/wcn36xx/main.c ++++ b/drivers/net/wireless/ath/wcn36xx/main.c +@@ -1590,7 +1590,10 @@ static int wcn36xx_probe(struct platform_device *pdev) + } + + n_channels = wcn_band_2ghz.n_channels + wcn_band_5ghz.n_channels; +- wcn->chan_survey = devm_kmalloc(wcn->dev, n_channels, GFP_KERNEL); ++ wcn->chan_survey = devm_kcalloc(wcn->dev, ++ n_channels, ++ sizeof(struct wcn36xx_chan_survey), ++ GFP_KERNEL); + if (!wcn->chan_survey) { + ret = -ENOMEM; + goto out_wq; +-- +2.39.5 + diff --git a/queue-6.12/wifi-wlcore-fix-unbalanced-pm_runtime-calls.patch b/queue-6.12/wifi-wlcore-fix-unbalanced-pm_runtime-calls.patch new file mode 100644 index 0000000000..2c3673eca5 --- /dev/null +++ b/queue-6.12/wifi-wlcore-fix-unbalanced-pm_runtime-calls.patch @@ -0,0 +1,70 @@ +From 6ebf055d817a4881a9a1f7c8d55f5ef6f0d85d54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Jan 2025 20:55:07 +0100 +Subject: wifi: wlcore: fix unbalanced pm_runtime calls + +From: Andreas Kemnade + +[ Upstream commit 996c934c8c196144af386c4385f61fcd5349af28 ] + +If firmware boot failes, runtime pm is put too often: +[12092.708099] wlcore: ERROR firmware boot failed despite 3 retries +[12092.708099] wl18xx_driver wl18xx.1.auto: Runtime PM usage count underflow! +Fix that by redirecting all error gotos before runtime_get so that runtime is +not put. + +Fixes: c40aad28a3cf ("wlcore: Make sure firmware is initialized in wl1271_op_add_interface()") +Signed-off-by: Andreas Kemnade +Reviewed-by: Michael Nemanov +Signed-off-by: Kalle Valo +Link: https://patch.msgid.link/20250104195507.402673-1-akemnade@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ti/wlcore/main.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c +index 0c77b8524160d..42805ed7ca120 100644 +--- a/drivers/net/wireless/ti/wlcore/main.c ++++ b/drivers/net/wireless/ti/wlcore/main.c +@@ -2612,24 +2612,24 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw, + if (test_bit(WL1271_FLAG_RECOVERY_IN_PROGRESS, &wl->flags) || + test_bit(WLVIF_FLAG_INITIALIZED, &wlvif->flags)) { + ret = -EBUSY; +- goto out; ++ goto out_unlock; + } + + + ret = wl12xx_init_vif_data(wl, vif); + if (ret < 0) +- goto out; ++ goto out_unlock; + + wlvif->wl = wl; + role_type = wl12xx_get_role_type(wl, wlvif); + if (role_type == WL12XX_INVALID_ROLE_TYPE) { + ret = -EINVAL; +- goto out; ++ goto out_unlock; + } + + ret = wlcore_allocate_hw_queue_base(wl, wlvif); + if (ret < 0) +- goto out; ++ goto out_unlock; + + /* + * TODO: after the nvs issue will be solved, move this block +@@ -2644,7 +2644,7 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw, + + ret = wl12xx_init_fw(wl); + if (ret < 0) +- goto out; ++ goto out_unlock; + } + + /* +-- +2.39.5 + diff --git a/queue-6.12/x86-cpu-enable-sd_asym_packing-for-pkg-domain-on-amd.patch b/queue-6.12/x86-cpu-enable-sd_asym_packing-for-pkg-domain-on-amd.patch new file mode 100644 index 0000000000..8a52aa22a1 --- /dev/null +++ b/queue-6.12/x86-cpu-enable-sd_asym_packing-for-pkg-domain-on-amd.patch @@ -0,0 +1,44 @@ +From 46ce7744bda94a732cc8e77013f77531e4a0afa8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2024 12:14:57 -0500 +Subject: x86/cpu: Enable SD_ASYM_PACKING for PKG domain on AMD + +From: Perry Yuan + +[ Upstream commit b0979e53645825a38f814ca5d3d09aed2745911d ] + +Enable the SD_ASYM_PACKING domain flag for the PKG domain on AMD heterogeneous +processors. This flag is beneficial for processors with one or more CCDs and +relies on x86_sched_itmt_flags(). + +Signed-off-by: Perry Yuan +Co-developed-by: Mario Limonciello +Signed-off-by: Mario Limonciello +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Gautham R. Shenoy +Link: https://lore.kernel.org/r/20241025171459.1093-4-mario.limonciello@amd.com +Stable-dep-of: e1bc02646527 ("x86/topology: Use x86_sched_itmt_flags for PKG domain unconditionally") +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/smpboot.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c +index 766f092dab80b..b5a8f0891135b 100644 +--- a/arch/x86/kernel/smpboot.c ++++ b/arch/x86/kernel/smpboot.c +@@ -497,8 +497,9 @@ static int x86_cluster_flags(void) + + static int x86_die_flags(void) + { +- if (cpu_feature_enabled(X86_FEATURE_HYBRID_CPU)) +- return x86_sched_itmt_flags(); ++ if (cpu_feature_enabled(X86_FEATURE_HYBRID_CPU) || ++ cpu_feature_enabled(X86_FEATURE_AMD_HETEROGENEOUS_CORES)) ++ return x86_sched_itmt_flags(); + + return 0; + } +-- +2.39.5 + diff --git a/queue-6.12/x86-topology-use-x86_sched_itmt_flags-for-pkg-domain.patch b/queue-6.12/x86-topology-use-x86_sched_itmt_flags-for-pkg-domain.patch new file mode 100644 index 0000000000..e5f90825a2 --- /dev/null +++ b/queue-6.12/x86-topology-use-x86_sched_itmt_flags-for-pkg-domain.patch @@ -0,0 +1,106 @@ +From e06117de4c0197d064453bf10eef7d9cf44a002f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Dec 2024 04:34:04 +0000 +Subject: x86/topology: Use x86_sched_itmt_flags for PKG domain unconditionally + +From: K Prateek Nayak + +[ Upstream commit e1bc02646527fc1ed74f00eb599b2b74d49671c7 ] + +x86_sched_itmt_flags() returns SD_ASYM_PACKING if ITMT support is +enabled by the system. Without ITMT support being enabled, it returns 0 +similar to current x86_die_flags() on non-Hybrid systems +(!X86_HYBRID_CPU and !X86_FEATURE_AMD_HETEROGENEOUS_CORES) + +On Intel systems that enable ITMT support, either the MC domain +coincides with the PKG domain, or in case of multiple MC groups +within a PKG domain, either Sub-NUMA Cluster (SNC) is enabled or the +processor features Hybrid core layout (X86_HYBRID_CPU) which leads to +three distinct possibilities: + +o If PKG and MC domains coincide, PKG domain is degenerated by + sd_parent_degenerate() when building sched domain topology. + +o If SNC is enabled, PKG domain is never added since + "x86_has_numa_in_package" is set and the topology will instead contain + NODE and NUMA domains. + +o On X86_HYBRID_CPU which contains multiple MC groups within the PKG, + the PKG domain requires x86_sched_itmt_flags(). + +Thus, on Intel systems that contains multiple MC groups within the PKG +and enables ITMT support, the PKG domain requires +x86_sched_itmt_flags(). In all other cases PKG domain is either never +added or is degenerated. Thus, returning x86_sched_itmt_flags() +unconditionally at PKG domain on Intel systems should not lead to any +functional changes. + +On AMD systems with multiple LLCs (MC groups) within a PKG domain, +enabling ITMT support requires setting SD_ASYM_PACKING to the PKG domain +since the core rankings are assigned PKG-wide. + +Core rankings on AMD processors is currently set by the amd-pstate +driver when Preferred Core feature is supported. A subset of systems that +support Preferred Core feature can be detected using +X86_FEATURE_AMD_HETEROGENEOUS_CORES however, this does not cover all the +systems that support Preferred Core ranking. + +Detecting Preferred Core support on AMD systems requires inspecting CPPC +Highest Perf on all present CPUs and checking if it differs on at least +one CPU. Previous suggestion to use a synthetic feature to detect +Preferred Core support [1] was found to be non-trivial to implement +since BSP alone cannot detect if Preferred Core is supported and by the +time AP comes up, alternatives are patched and setting a X86_FEATURE_* +then is not possible. + +Since x86 processors enabling ITMT support that consists multiple +non-NUMA MC groups within a PKG requires SD_ASYM_PACKING flag set at the +PKG domain, return x86_sched_itmt_flags unconditionally for the PKG +domain. + +Since x86_die_flags() would have just returned x86_sched_itmt_flags() +after the change, remove the unnecessary wrapper and pass +x86_sched_itmt_flags() directly as the flags function. + +Fixes: f3a052391822 ("cpufreq: amd-pstate: Enable amd-pstate preferred core support") +Signed-off-by: K Prateek Nayak +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Tim Chen +Link: https://lore.kernel.org/r/20241223043407.1611-6-kprateek.nayak@amd.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/smpboot.c | 11 +---------- + 1 file changed, 1 insertion(+), 10 deletions(-) + +diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c +index b5a8f0891135b..f1fac08fdef28 100644 +--- a/arch/x86/kernel/smpboot.c ++++ b/arch/x86/kernel/smpboot.c +@@ -495,15 +495,6 @@ static int x86_cluster_flags(void) + } + #endif + +-static int x86_die_flags(void) +-{ +- if (cpu_feature_enabled(X86_FEATURE_HYBRID_CPU) || +- cpu_feature_enabled(X86_FEATURE_AMD_HETEROGENEOUS_CORES)) +- return x86_sched_itmt_flags(); +- +- return 0; +-} +- + /* + * Set if a package/die has multiple NUMA nodes inside. + * AMD Magny-Cours, Intel Cluster-on-Die, and Intel +@@ -539,7 +530,7 @@ static void __init build_sched_topology(void) + */ + if (!x86_has_numa_in_package) { + x86_topology[i++] = (struct sched_domain_topology_level){ +- cpu_cpu_mask, x86_die_flags, SD_INIT_NAME(PKG) ++ cpu_cpu_mask, x86_sched_itmt_flags, SD_INIT_NAME(PKG) + }; + } + +-- +2.39.5 + diff --git a/queue-6.12/xfrm-add-an-inbound-percpu-state-cache.patch b/queue-6.12/xfrm-add-an-inbound-percpu-state-cache.patch new file mode 100644 index 0000000000..751837a585 --- /dev/null +++ b/queue-6.12/xfrm-add-an-inbound-percpu-state-cache.patch @@ -0,0 +1,208 @@ +From 078c43d92051bd38b03e0fef185c556c3e12cacc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Oct 2024 12:53:44 +0200 +Subject: xfrm: Add an inbound percpu state cache. + +From: Steffen Klassert + +[ Upstream commit 81a331a0e72ddc2f75092603d9577bd1a0ca23ad ] + +Now that we can have percpu xfrm states, the number of active +states might increase. To get a better lookup performance, +we add a percpu cache to cache the used inbound xfrm states. + +Signed-off-by: Steffen Klassert +Tested-by: Antony Antony +Tested-by: Tobias Brunner +Stable-dep-of: e952837f3ddb ("xfrm: state: fix out-of-bounds read during lookup") +Signed-off-by: Sasha Levin +--- + include/net/netns/xfrm.h | 1 + + include/net/xfrm.h | 5 ++++ + net/ipv4/esp4_offload.c | 6 ++--- + net/ipv6/esp6_offload.c | 6 ++--- + net/xfrm/xfrm_input.c | 2 +- + net/xfrm/xfrm_state.c | 57 ++++++++++++++++++++++++++++++++++++++++ + 6 files changed, 70 insertions(+), 7 deletions(-) + +diff --git a/include/net/netns/xfrm.h b/include/net/netns/xfrm.h +index ae60d66640954..23dd647fe0248 100644 +--- a/include/net/netns/xfrm.h ++++ b/include/net/netns/xfrm.h +@@ -43,6 +43,7 @@ struct netns_xfrm { + struct hlist_head __rcu *state_bysrc; + struct hlist_head __rcu *state_byspi; + struct hlist_head __rcu *state_byseq; ++ struct hlist_head __percpu *state_cache_input; + unsigned int state_hmask; + unsigned int state_num; + struct work_struct state_hash_work; +diff --git a/include/net/xfrm.h b/include/net/xfrm.h +index 0b394c5fb5f3a..2b87999bd5aae 100644 +--- a/include/net/xfrm.h ++++ b/include/net/xfrm.h +@@ -185,6 +185,7 @@ struct xfrm_state { + struct hlist_node byspi; + struct hlist_node byseq; + struct hlist_node state_cache; ++ struct hlist_node state_cache_input; + + refcount_t refcnt; + spinlock_t lock; +@@ -1650,6 +1651,10 @@ int xfrm_state_update(struct xfrm_state *x); + struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark, + const xfrm_address_t *daddr, __be32 spi, + u8 proto, unsigned short family); ++struct xfrm_state *xfrm_input_state_lookup(struct net *net, u32 mark, ++ const xfrm_address_t *daddr, ++ __be32 spi, u8 proto, ++ unsigned short family); + struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark, + const xfrm_address_t *daddr, + const xfrm_address_t *saddr, +diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c +index 80c4ea0e12f48..e0d94270da28a 100644 +--- a/net/ipv4/esp4_offload.c ++++ b/net/ipv4/esp4_offload.c +@@ -53,9 +53,9 @@ static struct sk_buff *esp4_gro_receive(struct list_head *head, + if (sp->len == XFRM_MAX_DEPTH) + goto out_reset; + +- x = xfrm_state_lookup(dev_net(skb->dev), skb->mark, +- (xfrm_address_t *)&ip_hdr(skb)->daddr, +- spi, IPPROTO_ESP, AF_INET); ++ x = xfrm_input_state_lookup(dev_net(skb->dev), skb->mark, ++ (xfrm_address_t *)&ip_hdr(skb)->daddr, ++ spi, IPPROTO_ESP, AF_INET); + + if (unlikely(x && x->dir && x->dir != XFRM_SA_DIR_IN)) { + /* non-offload path will record the error and audit log */ +diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c +index 919ebfabbe4ee..7b41fb4f00b58 100644 +--- a/net/ipv6/esp6_offload.c ++++ b/net/ipv6/esp6_offload.c +@@ -80,9 +80,9 @@ static struct sk_buff *esp6_gro_receive(struct list_head *head, + if (sp->len == XFRM_MAX_DEPTH) + goto out_reset; + +- x = xfrm_state_lookup(dev_net(skb->dev), skb->mark, +- (xfrm_address_t *)&ipv6_hdr(skb)->daddr, +- spi, IPPROTO_ESP, AF_INET6); ++ x = xfrm_input_state_lookup(dev_net(skb->dev), skb->mark, ++ (xfrm_address_t *)&ipv6_hdr(skb)->daddr, ++ spi, IPPROTO_ESP, AF_INET6); + + if (unlikely(x && x->dir && x->dir != XFRM_SA_DIR_IN)) { + /* non-offload path will record the error and audit log */ +diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c +index 749e7eea99e46..841a60a6fbfea 100644 +--- a/net/xfrm/xfrm_input.c ++++ b/net/xfrm/xfrm_input.c +@@ -572,7 +572,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) + goto drop; + } + +- x = xfrm_state_lookup(net, mark, daddr, spi, nexthdr, family); ++ x = xfrm_input_state_lookup(net, mark, daddr, spi, nexthdr, family); + if (x == NULL) { + secpath_reset(skb); + XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES); +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index a2047825f6c88..e3266a5d4f90d 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -754,6 +754,9 @@ int __xfrm_state_delete(struct xfrm_state *x) + hlist_del_rcu(&x->byseq); + if (!hlist_unhashed(&x->state_cache)) + hlist_del_rcu(&x->state_cache); ++ if (!hlist_unhashed(&x->state_cache_input)) ++ hlist_del_rcu(&x->state_cache_input); ++ + if (x->id.spi) + hlist_del_rcu(&x->byspi); + net->xfrm.state_num--; +@@ -1106,6 +1109,52 @@ static struct xfrm_state *__xfrm_state_lookup(struct net *net, u32 mark, + return NULL; + } + ++struct xfrm_state *xfrm_input_state_lookup(struct net *net, u32 mark, ++ const xfrm_address_t *daddr, ++ __be32 spi, u8 proto, ++ unsigned short family) ++{ ++ struct hlist_head *state_cache_input; ++ struct xfrm_state *x = NULL; ++ int cpu = get_cpu(); ++ ++ state_cache_input = per_cpu_ptr(net->xfrm.state_cache_input, cpu); ++ ++ rcu_read_lock(); ++ hlist_for_each_entry_rcu(x, state_cache_input, state_cache_input) { ++ if (x->props.family != family || ++ x->id.spi != spi || ++ x->id.proto != proto || ++ !xfrm_addr_equal(&x->id.daddr, daddr, family)) ++ continue; ++ ++ if ((mark & x->mark.m) != x->mark.v) ++ continue; ++ if (!xfrm_state_hold_rcu(x)) ++ continue; ++ goto out; ++ } ++ ++ x = __xfrm_state_lookup(net, mark, daddr, spi, proto, family); ++ ++ if (x && x->km.state == XFRM_STATE_VALID) { ++ spin_lock_bh(&net->xfrm.xfrm_state_lock); ++ if (hlist_unhashed(&x->state_cache_input)) { ++ hlist_add_head_rcu(&x->state_cache_input, state_cache_input); ++ } else { ++ hlist_del_rcu(&x->state_cache_input); ++ hlist_add_head_rcu(&x->state_cache_input, state_cache_input); ++ } ++ spin_unlock_bh(&net->xfrm.xfrm_state_lock); ++ } ++ ++out: ++ rcu_read_unlock(); ++ put_cpu(); ++ return x; ++} ++EXPORT_SYMBOL(xfrm_input_state_lookup); ++ + static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, u32 mark, + const xfrm_address_t *daddr, + const xfrm_address_t *saddr, +@@ -3079,6 +3128,11 @@ int __net_init xfrm_state_init(struct net *net) + net->xfrm.state_byseq = xfrm_hash_alloc(sz); + if (!net->xfrm.state_byseq) + goto out_byseq; ++ ++ net->xfrm.state_cache_input = alloc_percpu(struct hlist_head); ++ if (!net->xfrm.state_cache_input) ++ goto out_state_cache_input; ++ + net->xfrm.state_hmask = ((sz / sizeof(struct hlist_head)) - 1); + + net->xfrm.state_num = 0; +@@ -3088,6 +3142,8 @@ int __net_init xfrm_state_init(struct net *net) + &net->xfrm.xfrm_state_lock); + return 0; + ++out_state_cache_input: ++ xfrm_hash_free(net->xfrm.state_byseq, sz); + out_byseq: + xfrm_hash_free(net->xfrm.state_byspi, sz); + out_byspi: +@@ -3117,6 +3173,7 @@ void xfrm_state_fini(struct net *net) + xfrm_hash_free(net->xfrm.state_bysrc, sz); + WARN_ON(!hlist_empty(net->xfrm.state_bydst)); + xfrm_hash_free(net->xfrm.state_bydst, sz); ++ free_percpu(net->xfrm.state_cache_input); + } + + #ifdef CONFIG_AUDITSYSCALL +-- +2.39.5 + diff --git a/queue-6.12/xfrm-add-support-for-per-cpu-xfrm-state-handling.patch b/queue-6.12/xfrm-add-support-for-per-cpu-xfrm-state-handling.patch new file mode 100644 index 0000000000..4e0f6e05e3 --- /dev/null +++ b/queue-6.12/xfrm-add-support-for-per-cpu-xfrm-state-handling.patch @@ -0,0 +1,536 @@ +From 8f06480c243e4ec6154224a233d001639a8c8353 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Oct 2024 12:53:42 +0200 +Subject: xfrm: Add support for per cpu xfrm state handling. + +From: Steffen Klassert + +[ Upstream commit 1ddf9916ac09313128e40d6581cef889c0b4ce84 ] + +Currently all flows for a certain SA must be processed by the same +cpu to avoid packet reordering and lock contention of the xfrm +state lock. + +To get rid of this limitation, the IETF standardized per cpu SAs +in RFC 9611. This patch implements the xfrm part of it. + +We add the cpu as a lookup key for xfrm states and a config option +to generate acquire messages for each cpu. + +With that, we can have on each cpu a SA with identical traffic selector +so that flows can be processed in parallel on all cpus. + +Signed-off-by: Steffen Klassert +Tested-by: Antony Antony +Tested-by: Tobias Brunner +Stable-dep-of: e952837f3ddb ("xfrm: state: fix out-of-bounds read during lookup") +Signed-off-by: Sasha Levin +--- + include/net/xfrm.h | 5 ++-- + include/uapi/linux/xfrm.h | 2 ++ + net/key/af_key.c | 7 +++-- + net/xfrm/xfrm_compat.c | 6 ++-- + net/xfrm/xfrm_state.c | 58 +++++++++++++++++++++++++++++++-------- + net/xfrm/xfrm_user.c | 56 ++++++++++++++++++++++++++++++++++--- + 6 files changed, 112 insertions(+), 22 deletions(-) + +diff --git a/include/net/xfrm.h b/include/net/xfrm.h +index a0bdd58f401c0..f5275618e744e 100644 +--- a/include/net/xfrm.h ++++ b/include/net/xfrm.h +@@ -188,6 +188,7 @@ struct xfrm_state { + refcount_t refcnt; + spinlock_t lock; + ++ u32 pcpu_num; + struct xfrm_id id; + struct xfrm_selector sel; + struct xfrm_mark mark; +@@ -1684,7 +1685,7 @@ struct xfrmk_spdinfo { + u32 spdhmcnt; + }; + +-struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq); ++struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq, u32 pcpu_num); + int xfrm_state_delete(struct xfrm_state *x); + int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync); + int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid); +@@ -1796,7 +1797,7 @@ int verify_spi_info(u8 proto, u32 min, u32 max, struct netlink_ext_ack *extack); + int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi, + struct netlink_ext_ack *extack); + struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark, +- u8 mode, u32 reqid, u32 if_id, u8 proto, ++ u8 mode, u32 reqid, u32 if_id, u32 pcpu_num, u8 proto, + const xfrm_address_t *daddr, + const xfrm_address_t *saddr, int create, + unsigned short family); +diff --git a/include/uapi/linux/xfrm.h b/include/uapi/linux/xfrm.h +index f28701500714f..d73a97e3030a8 100644 +--- a/include/uapi/linux/xfrm.h ++++ b/include/uapi/linux/xfrm.h +@@ -322,6 +322,7 @@ enum xfrm_attr_type_t { + XFRMA_MTIMER_THRESH, /* __u32 in seconds for input SA */ + XFRMA_SA_DIR, /* __u8 */ + XFRMA_NAT_KEEPALIVE_INTERVAL, /* __u32 in seconds for NAT keepalive */ ++ XFRMA_SA_PCPU, /* __u32 */ + __XFRMA_MAX + + #define XFRMA_OUTPUT_MARK XFRMA_SET_MARK /* Compatibility */ +@@ -437,6 +438,7 @@ struct xfrm_userpolicy_info { + #define XFRM_POLICY_LOCALOK 1 /* Allow user to override global policy */ + /* Automatically expand selector to include matching ICMP payloads. */ + #define XFRM_POLICY_ICMP 2 ++#define XFRM_POLICY_CPU_ACQUIRE 4 + __u8 share; + }; + +diff --git a/net/key/af_key.c b/net/key/af_key.c +index f79fb99271ed8..c56bb4f451e6d 100644 +--- a/net/key/af_key.c ++++ b/net/key/af_key.c +@@ -1354,7 +1354,7 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, const struct sadb_ + } + + if (hdr->sadb_msg_seq) { +- x = xfrm_find_acq_byseq(net, DUMMY_MARK, hdr->sadb_msg_seq); ++ x = xfrm_find_acq_byseq(net, DUMMY_MARK, hdr->sadb_msg_seq, UINT_MAX); + if (x && !xfrm_addr_equal(&x->id.daddr, xdaddr, family)) { + xfrm_state_put(x); + x = NULL; +@@ -1362,7 +1362,8 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, const struct sadb_ + } + + if (!x) +- x = xfrm_find_acq(net, &dummy_mark, mode, reqid, 0, proto, xdaddr, xsaddr, 1, family); ++ x = xfrm_find_acq(net, &dummy_mark, mode, reqid, 0, UINT_MAX, ++ proto, xdaddr, xsaddr, 1, family); + + if (x == NULL) + return -ENOENT; +@@ -1417,7 +1418,7 @@ static int pfkey_acquire(struct sock *sk, struct sk_buff *skb, const struct sadb + if (hdr->sadb_msg_seq == 0 || hdr->sadb_msg_errno == 0) + return 0; + +- x = xfrm_find_acq_byseq(net, DUMMY_MARK, hdr->sadb_msg_seq); ++ x = xfrm_find_acq_byseq(net, DUMMY_MARK, hdr->sadb_msg_seq, UINT_MAX); + if (x == NULL) + return 0; + +diff --git a/net/xfrm/xfrm_compat.c b/net/xfrm/xfrm_compat.c +index 91357ccaf4afe..5b9ee63e30b69 100644 +--- a/net/xfrm/xfrm_compat.c ++++ b/net/xfrm/xfrm_compat.c +@@ -132,6 +132,7 @@ static const struct nla_policy compat_policy[XFRMA_MAX+1] = { + [XFRMA_MTIMER_THRESH] = { .type = NLA_U32 }, + [XFRMA_SA_DIR] = NLA_POLICY_RANGE(NLA_U8, XFRM_SA_DIR_IN, XFRM_SA_DIR_OUT), + [XFRMA_NAT_KEEPALIVE_INTERVAL] = { .type = NLA_U32 }, ++ [XFRMA_SA_PCPU] = { .type = NLA_U32 }, + }; + + static struct nlmsghdr *xfrm_nlmsg_put_compat(struct sk_buff *skb, +@@ -282,9 +283,10 @@ static int xfrm_xlate64_attr(struct sk_buff *dst, const struct nlattr *src) + case XFRMA_MTIMER_THRESH: + case XFRMA_SA_DIR: + case XFRMA_NAT_KEEPALIVE_INTERVAL: ++ case XFRMA_SA_PCPU: + return xfrm_nla_cpy(dst, src, nla_len(src)); + default: +- BUILD_BUG_ON(XFRMA_MAX != XFRMA_NAT_KEEPALIVE_INTERVAL); ++ BUILD_BUG_ON(XFRMA_MAX != XFRMA_SA_PCPU); + pr_warn_once("unsupported nla_type %d\n", src->nla_type); + return -EOPNOTSUPP; + } +@@ -439,7 +441,7 @@ static int xfrm_xlate32_attr(void *dst, const struct nlattr *nla, + int err; + + if (type > XFRMA_MAX) { +- BUILD_BUG_ON(XFRMA_MAX != XFRMA_NAT_KEEPALIVE_INTERVAL); ++ BUILD_BUG_ON(XFRMA_MAX != XFRMA_SA_PCPU); + NL_SET_ERR_MSG(extack, "Bad attribute"); + return -EOPNOTSUPP; + } +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index 37478d36a8dff..ebef07b80afad 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -679,6 +679,7 @@ struct xfrm_state *xfrm_state_alloc(struct net *net) + x->lft.hard_packet_limit = XFRM_INF; + x->replay_maxage = 0; + x->replay_maxdiff = 0; ++ x->pcpu_num = UINT_MAX; + spin_lock_init(&x->lock); + } + return x; +@@ -1155,6 +1156,12 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x, + struct xfrm_state **best, int *acq_in_progress, + int *error) + { ++ /* We need the cpu id just as a lookup key, ++ * we don't require it to be stable. ++ */ ++ unsigned int pcpu_id = get_cpu(); ++ put_cpu(); ++ + /* Resolution logic: + * 1. There is a valid state with matching selector. Done. + * 2. Valid state with inappropriate selector. Skip. +@@ -1174,13 +1181,18 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x, + &fl->u.__fl_common)) + return; + ++ if (x->pcpu_num != UINT_MAX && x->pcpu_num != pcpu_id) ++ return; ++ + if (!*best || ++ ((*best)->pcpu_num == UINT_MAX && x->pcpu_num == pcpu_id) || + (*best)->km.dying > x->km.dying || + ((*best)->km.dying == x->km.dying && + (*best)->curlft.add_time < x->curlft.add_time)) + *best = x; + } else if (x->km.state == XFRM_STATE_ACQ) { +- *acq_in_progress = 1; ++ if (!*best || x->pcpu_num == pcpu_id) ++ *acq_in_progress = 1; + } else if (x->km.state == XFRM_STATE_ERROR || + x->km.state == XFRM_STATE_EXPIRED) { + if ((!x->sel.family || +@@ -1209,6 +1221,13 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, + unsigned short encap_family = tmpl->encap_family; + unsigned int sequence; + struct km_event c; ++ unsigned int pcpu_id; ++ ++ /* We need the cpu id just as a lookup key, ++ * we don't require it to be stable. ++ */ ++ pcpu_id = get_cpu(); ++ put_cpu(); + + to_put = NULL; + +@@ -1282,7 +1301,10 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, + } + + found: +- x = best; ++ if (!(pol->flags & XFRM_POLICY_CPU_ACQUIRE) || ++ (best && (best->pcpu_num == pcpu_id))) ++ x = best; ++ + if (!x && !error && !acquire_in_progress) { + if (tmpl->id.spi && + (x0 = __xfrm_state_lookup_all(net, mark, daddr, +@@ -1314,6 +1336,8 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, + xfrm_init_tempstate(x, fl, tmpl, daddr, saddr, family); + memcpy(&x->mark, &pol->mark, sizeof(x->mark)); + x->if_id = if_id; ++ if ((pol->flags & XFRM_POLICY_CPU_ACQUIRE) && best) ++ x->pcpu_num = pcpu_id; + + error = security_xfrm_state_alloc_acquire(x, pol->security, fl->flowi_secid); + if (error) { +@@ -1392,6 +1416,11 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, + x = NULL; + error = -ESRCH; + } ++ ++ /* Use the already installed 'fallback' while the CPU-specific ++ * SA acquire is handled*/ ++ if (best) ++ x = best; + } + out: + if (x) { +@@ -1524,12 +1553,14 @@ static void __xfrm_state_bump_genids(struct xfrm_state *xnew) + unsigned int h; + u32 mark = xnew->mark.v & xnew->mark.m; + u32 if_id = xnew->if_id; ++ u32 cpu_id = xnew->pcpu_num; + + h = xfrm_dst_hash(net, &xnew->id.daddr, &xnew->props.saddr, reqid, family); + hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) { + if (x->props.family == family && + x->props.reqid == reqid && + x->if_id == if_id && ++ x->pcpu_num == cpu_id && + (mark & x->mark.m) == x->mark.v && + xfrm_addr_equal(&x->id.daddr, &xnew->id.daddr, family) && + xfrm_addr_equal(&x->props.saddr, &xnew->props.saddr, family)) +@@ -1552,7 +1583,7 @@ EXPORT_SYMBOL(xfrm_state_insert); + static struct xfrm_state *__find_acq_core(struct net *net, + const struct xfrm_mark *m, + unsigned short family, u8 mode, +- u32 reqid, u32 if_id, u8 proto, ++ u32 reqid, u32 if_id, u32 pcpu_num, u8 proto, + const xfrm_address_t *daddr, + const xfrm_address_t *saddr, + int create) +@@ -1569,6 +1600,7 @@ static struct xfrm_state *__find_acq_core(struct net *net, + x->id.spi != 0 || + x->id.proto != proto || + (mark & x->mark.m) != x->mark.v || ++ x->pcpu_num != pcpu_num || + !xfrm_addr_equal(&x->id.daddr, daddr, family) || + !xfrm_addr_equal(&x->props.saddr, saddr, family)) + continue; +@@ -1602,6 +1634,7 @@ static struct xfrm_state *__find_acq_core(struct net *net, + break; + } + ++ x->pcpu_num = pcpu_num; + x->km.state = XFRM_STATE_ACQ; + x->id.proto = proto; + x->props.family = family; +@@ -1630,7 +1663,7 @@ static struct xfrm_state *__find_acq_core(struct net *net, + return x; + } + +-static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq); ++static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq, u32 pcpu_num); + + int xfrm_state_add(struct xfrm_state *x) + { +@@ -1656,7 +1689,7 @@ int xfrm_state_add(struct xfrm_state *x) + } + + if (use_spi && x->km.seq) { +- x1 = __xfrm_find_acq_byseq(net, mark, x->km.seq); ++ x1 = __xfrm_find_acq_byseq(net, mark, x->km.seq, x->pcpu_num); + if (x1 && ((x1->id.proto != x->id.proto) || + !xfrm_addr_equal(&x1->id.daddr, &x->id.daddr, family))) { + to_put = x1; +@@ -1666,7 +1699,7 @@ int xfrm_state_add(struct xfrm_state *x) + + if (use_spi && !x1) + x1 = __find_acq_core(net, &x->mark, family, x->props.mode, +- x->props.reqid, x->if_id, x->id.proto, ++ x->props.reqid, x->if_id, x->pcpu_num, x->id.proto, + &x->id.daddr, &x->props.saddr, 0); + + __xfrm_state_bump_genids(x); +@@ -1791,6 +1824,7 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, + x->props.flags = orig->props.flags; + x->props.extra_flags = orig->props.extra_flags; + ++ x->pcpu_num = orig->pcpu_num; + x->if_id = orig->if_id; + x->tfcpad = orig->tfcpad; + x->replay_maxdiff = orig->replay_maxdiff; +@@ -2066,13 +2100,14 @@ EXPORT_SYMBOL(xfrm_state_lookup_byaddr); + + struct xfrm_state * + xfrm_find_acq(struct net *net, const struct xfrm_mark *mark, u8 mode, u32 reqid, +- u32 if_id, u8 proto, const xfrm_address_t *daddr, ++ u32 if_id, u32 pcpu_num, u8 proto, const xfrm_address_t *daddr, + const xfrm_address_t *saddr, int create, unsigned short family) + { + struct xfrm_state *x; + + spin_lock_bh(&net->xfrm.xfrm_state_lock); +- x = __find_acq_core(net, mark, family, mode, reqid, if_id, proto, daddr, saddr, create); ++ x = __find_acq_core(net, mark, family, mode, reqid, if_id, pcpu_num, ++ proto, daddr, saddr, create); + spin_unlock_bh(&net->xfrm.xfrm_state_lock); + + return x; +@@ -2207,7 +2242,7 @@ xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n, + + /* Silly enough, but I'm lazy to build resolution list */ + +-static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq) ++static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq, u32 pcpu_num) + { + unsigned int h = xfrm_seq_hash(net, seq); + struct xfrm_state *x; +@@ -2215,6 +2250,7 @@ static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 s + hlist_for_each_entry_rcu(x, net->xfrm.state_byseq + h, byseq) { + if (x->km.seq == seq && + (mark & x->mark.m) == x->mark.v && ++ x->pcpu_num == pcpu_num && + x->km.state == XFRM_STATE_ACQ) { + xfrm_state_hold(x); + return x; +@@ -2224,12 +2260,12 @@ static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 s + return NULL; + } + +-struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq) ++struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq, u32 pcpu_num) + { + struct xfrm_state *x; + + spin_lock_bh(&net->xfrm.xfrm_state_lock); +- x = __xfrm_find_acq_byseq(net, mark, seq); ++ x = __xfrm_find_acq_byseq(net, mark, seq, pcpu_num); + spin_unlock_bh(&net->xfrm.xfrm_state_lock); + return x; + } +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index e3b8ce89831ab..e4d448950d059 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -460,6 +460,12 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, + } + } + ++ if (!sa_dir && attrs[XFRMA_SA_PCPU]) { ++ NL_SET_ERR_MSG(extack, "SA_PCPU only supported with SA_DIR"); ++ err = -EINVAL; ++ goto out; ++ } ++ + out: + return err; + } +@@ -841,6 +847,12 @@ static struct xfrm_state *xfrm_state_construct(struct net *net, + x->nat_keepalive_interval = + nla_get_u32(attrs[XFRMA_NAT_KEEPALIVE_INTERVAL]); + ++ if (attrs[XFRMA_SA_PCPU]) { ++ x->pcpu_num = nla_get_u32(attrs[XFRMA_SA_PCPU]); ++ if (x->pcpu_num >= num_possible_cpus()) ++ goto error; ++ } ++ + err = __xfrm_init_state(x, false, attrs[XFRMA_OFFLOAD_DEV], extack); + if (err) + goto error; +@@ -1296,6 +1308,11 @@ static int copy_to_user_state_extra(struct xfrm_state *x, + if (ret) + goto out; + } ++ if (x->pcpu_num != UINT_MAX) { ++ ret = nla_put_u32(skb, XFRMA_SA_PCPU, x->pcpu_num); ++ if (ret) ++ goto out; ++ } + if (x->dir) + ret = nla_put_u8(skb, XFRMA_SA_DIR, x->dir); + +@@ -1700,6 +1717,7 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh, + u32 mark; + struct xfrm_mark m; + u32 if_id = 0; ++ u32 pcpu_num = UINT_MAX; + + p = nlmsg_data(nlh); + err = verify_spi_info(p->info.id.proto, p->min, p->max, extack); +@@ -1716,8 +1734,16 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh, + if (attrs[XFRMA_IF_ID]) + if_id = nla_get_u32(attrs[XFRMA_IF_ID]); + ++ if (attrs[XFRMA_SA_PCPU]) { ++ pcpu_num = nla_get_u32(attrs[XFRMA_SA_PCPU]); ++ if (pcpu_num >= num_possible_cpus()) { ++ err = -EINVAL; ++ goto out_noput; ++ } ++ } ++ + if (p->info.seq) { +- x = xfrm_find_acq_byseq(net, mark, p->info.seq); ++ x = xfrm_find_acq_byseq(net, mark, p->info.seq, pcpu_num); + if (x && !xfrm_addr_equal(&x->id.daddr, daddr, family)) { + xfrm_state_put(x); + x = NULL; +@@ -1726,7 +1752,7 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh, + + if (!x) + x = xfrm_find_acq(net, &m, p->info.mode, p->info.reqid, +- if_id, p->info.id.proto, daddr, ++ if_id, pcpu_num, p->info.id.proto, daddr, + &p->info.saddr, 1, + family); + err = -ENOENT; +@@ -2526,7 +2552,8 @@ static inline unsigned int xfrm_aevent_msgsize(struct xfrm_state *x) + + nla_total_size(sizeof(struct xfrm_mark)) + + nla_total_size(4) /* XFRM_AE_RTHR */ + + nla_total_size(4) /* XFRM_AE_ETHR */ +- + nla_total_size(sizeof(x->dir)); /* XFRMA_SA_DIR */ ++ + nla_total_size(sizeof(x->dir)) /* XFRMA_SA_DIR */ ++ + nla_total_size(4); /* XFRMA_SA_PCPU */ + } + + static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c) +@@ -2582,6 +2609,8 @@ static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, const struct + err = xfrm_if_id_put(skb, x->if_id); + if (err) + goto out_cancel; ++ if (x->pcpu_num != UINT_MAX) ++ err = nla_put_u32(skb, XFRMA_SA_PCPU, x->pcpu_num); + + if (x->dir) { + err = nla_put_u8(skb, XFRMA_SA_DIR, x->dir); +@@ -2852,6 +2881,13 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh, + + xfrm_mark_get(attrs, &mark); + ++ if (attrs[XFRMA_SA_PCPU]) { ++ x->pcpu_num = nla_get_u32(attrs[XFRMA_SA_PCPU]); ++ err = -EINVAL; ++ if (x->pcpu_num >= num_possible_cpus()) ++ goto free_state; ++ } ++ + err = verify_newpolicy_info(&ua->policy, extack); + if (err) + goto free_state; +@@ -3182,6 +3218,7 @@ const struct nla_policy xfrma_policy[XFRMA_MAX+1] = { + [XFRMA_MTIMER_THRESH] = { .type = NLA_U32 }, + [XFRMA_SA_DIR] = NLA_POLICY_RANGE(NLA_U8, XFRM_SA_DIR_IN, XFRM_SA_DIR_OUT), + [XFRMA_NAT_KEEPALIVE_INTERVAL] = { .type = NLA_U32 }, ++ [XFRMA_SA_PCPU] = { .type = NLA_U32 }, + }; + EXPORT_SYMBOL_GPL(xfrma_policy); + +@@ -3348,7 +3385,8 @@ static inline unsigned int xfrm_expire_msgsize(void) + { + return NLMSG_ALIGN(sizeof(struct xfrm_user_expire)) + + nla_total_size(sizeof(struct xfrm_mark)) + +- nla_total_size(sizeof_field(struct xfrm_state, dir)); ++ nla_total_size(sizeof_field(struct xfrm_state, dir)) + ++ nla_total_size(4); /* XFRMA_SA_PCPU */ + } + + static int build_expire(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c) +@@ -3374,6 +3412,11 @@ static int build_expire(struct sk_buff *skb, struct xfrm_state *x, const struct + err = xfrm_if_id_put(skb, x->if_id); + if (err) + return err; ++ if (x->pcpu_num != UINT_MAX) { ++ err = nla_put_u32(skb, XFRMA_SA_PCPU, x->pcpu_num); ++ if (err) ++ return err; ++ } + + if (x->dir) { + err = nla_put_u8(skb, XFRMA_SA_DIR, x->dir); +@@ -3481,6 +3524,8 @@ static inline unsigned int xfrm_sa_len(struct xfrm_state *x) + } + if (x->if_id) + l += nla_total_size(sizeof(x->if_id)); ++ if (x->pcpu_num) ++ l += nla_total_size(sizeof(x->pcpu_num)); + + /* Must count x->lastused as it may become non-zero behind our back. */ + l += nla_total_size_64bit(sizeof(u64)); +@@ -3587,6 +3632,7 @@ static inline unsigned int xfrm_acquire_msgsize(struct xfrm_state *x, + + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr) + + nla_total_size(sizeof(struct xfrm_mark)) + + nla_total_size(xfrm_user_sec_ctx_size(x->security)) ++ + nla_total_size(4) /* XFRMA_SA_PCPU */ + + userpolicy_type_attrsize(); + } + +@@ -3623,6 +3669,8 @@ static int build_acquire(struct sk_buff *skb, struct xfrm_state *x, + err = xfrm_if_id_put(skb, xp->if_id); + if (!err && xp->xdo.dev) + err = copy_user_offload(&xp->xdo, skb); ++ if (!err && x->pcpu_num != UINT_MAX) ++ err = nla_put_u32(skb, XFRMA_SA_PCPU, x->pcpu_num); + if (err) { + nlmsg_cancel(skb, nlh); + return err; +-- +2.39.5 + diff --git a/queue-6.12/xfrm-cache-used-outbound-xfrm-states-at-the-policy.patch b/queue-6.12/xfrm-cache-used-outbound-xfrm-states-at-the-policy.patch new file mode 100644 index 0000000000..57f6a681e0 --- /dev/null +++ b/queue-6.12/xfrm-cache-used-outbound-xfrm-states-at-the-policy.patch @@ -0,0 +1,208 @@ +From 67ce45de3e55024e790fa105c2bac350fac621d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Oct 2024 12:53:43 +0200 +Subject: xfrm: Cache used outbound xfrm states at the policy. + +From: Steffen Klassert + +[ Upstream commit 0045e3d80613cc7174dc15f189ee6fc4e73b9365 ] + +Now that we can have percpu xfrm states, the number of active +states might increase. To get a better lookup performance, +we cache the used xfrm states at the policy for outbound +IPsec traffic. + +Signed-off-by: Steffen Klassert +Tested-by: Antony Antony +Tested-by: Tobias Brunner +Stable-dep-of: e952837f3ddb ("xfrm: state: fix out-of-bounds read during lookup") +Signed-off-by: Sasha Levin +--- + include/net/xfrm.h | 4 +++ + net/xfrm/xfrm_policy.c | 12 +++++++++ + net/xfrm/xfrm_state.c | 55 ++++++++++++++++++++++++++++++++++++++++++ + 3 files changed, 71 insertions(+) + +diff --git a/include/net/xfrm.h b/include/net/xfrm.h +index f5275618e744e..0b394c5fb5f3a 100644 +--- a/include/net/xfrm.h ++++ b/include/net/xfrm.h +@@ -184,6 +184,7 @@ struct xfrm_state { + }; + struct hlist_node byspi; + struct hlist_node byseq; ++ struct hlist_node state_cache; + + refcount_t refcnt; + spinlock_t lock; +@@ -537,6 +538,7 @@ struct xfrm_policy_queue { + * @xp_net: network namespace the policy lives in + * @bydst: hlist node for SPD hash table or rbtree list + * @byidx: hlist node for index hash table ++ * @state_cache_list: hlist head for policy cached xfrm states + * @lock: serialize changes to policy structure members + * @refcnt: reference count, freed once it reaches 0 + * @pos: kernel internal tie-breaker to determine age of policy +@@ -567,6 +569,8 @@ struct xfrm_policy { + struct hlist_node bydst; + struct hlist_node byidx; + ++ struct hlist_head state_cache_list; ++ + /* This lock only affects elements except for entry. */ + rwlock_t lock; + refcount_t refcnt; +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index a2ea9dbac90b3..8a1b83191a6cd 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -434,6 +434,7 @@ struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp) + if (policy) { + write_pnet(&policy->xp_net, net); + INIT_LIST_HEAD(&policy->walk.all); ++ INIT_HLIST_HEAD(&policy->state_cache_list); + INIT_HLIST_NODE(&policy->bydst); + INIT_HLIST_NODE(&policy->byidx); + rwlock_init(&policy->lock); +@@ -475,6 +476,9 @@ EXPORT_SYMBOL(xfrm_policy_destroy); + + static void xfrm_policy_kill(struct xfrm_policy *policy) + { ++ struct net *net = xp_net(policy); ++ struct xfrm_state *x; ++ + xfrm_dev_policy_delete(policy); + + write_lock_bh(&policy->lock); +@@ -490,6 +494,13 @@ static void xfrm_policy_kill(struct xfrm_policy *policy) + if (del_timer(&policy->timer)) + xfrm_pol_put(policy); + ++ /* XXX: Flush state cache */ ++ spin_lock_bh(&net->xfrm.xfrm_state_lock); ++ hlist_for_each_entry_rcu(x, &policy->state_cache_list, state_cache) { ++ hlist_del_init_rcu(&x->state_cache); ++ } ++ spin_unlock_bh(&net->xfrm.xfrm_state_lock); ++ + xfrm_pol_put(policy); + } + +@@ -3275,6 +3286,7 @@ struct dst_entry *xfrm_lookup_with_ifid(struct net *net, + dst_release(dst); + dst = dst_orig; + } ++ + ok: + xfrm_pols_put(pols, drop_pols); + if (dst && dst->xfrm && +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index ebef07b80afad..a2047825f6c88 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -665,6 +665,7 @@ struct xfrm_state *xfrm_state_alloc(struct net *net) + refcount_set(&x->refcnt, 1); + atomic_set(&x->tunnel_users, 0); + INIT_LIST_HEAD(&x->km.all); ++ INIT_HLIST_NODE(&x->state_cache); + INIT_HLIST_NODE(&x->bydst); + INIT_HLIST_NODE(&x->bysrc); + INIT_HLIST_NODE(&x->byspi); +@@ -744,12 +745,15 @@ int __xfrm_state_delete(struct xfrm_state *x) + + if (x->km.state != XFRM_STATE_DEAD) { + x->km.state = XFRM_STATE_DEAD; ++ + spin_lock(&net->xfrm.xfrm_state_lock); + list_del(&x->km.all); + hlist_del_rcu(&x->bydst); + hlist_del_rcu(&x->bysrc); + if (x->km.seq) + hlist_del_rcu(&x->byseq); ++ if (!hlist_unhashed(&x->state_cache)) ++ hlist_del_rcu(&x->state_cache); + if (x->id.spi) + hlist_del_rcu(&x->byspi); + net->xfrm.state_num--; +@@ -1222,6 +1226,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, + unsigned int sequence; + struct km_event c; + unsigned int pcpu_id; ++ bool cached = false; + + /* We need the cpu id just as a lookup key, + * we don't require it to be stable. +@@ -1234,6 +1239,46 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, + sequence = read_seqcount_begin(&net->xfrm.xfrm_state_hash_generation); + + rcu_read_lock(); ++ hlist_for_each_entry_rcu(x, &pol->state_cache_list, state_cache) { ++ if (x->props.family == encap_family && ++ x->props.reqid == tmpl->reqid && ++ (mark & x->mark.m) == x->mark.v && ++ x->if_id == if_id && ++ !(x->props.flags & XFRM_STATE_WILDRECV) && ++ xfrm_state_addr_check(x, daddr, saddr, encap_family) && ++ tmpl->mode == x->props.mode && ++ tmpl->id.proto == x->id.proto && ++ (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) ++ xfrm_state_look_at(pol, x, fl, encap_family, ++ &best, &acquire_in_progress, &error); ++ } ++ ++ if (best) ++ goto cached; ++ ++ hlist_for_each_entry_rcu(x, &pol->state_cache_list, state_cache) { ++ if (x->props.family == encap_family && ++ x->props.reqid == tmpl->reqid && ++ (mark & x->mark.m) == x->mark.v && ++ x->if_id == if_id && ++ !(x->props.flags & XFRM_STATE_WILDRECV) && ++ xfrm_addr_equal(&x->id.daddr, daddr, encap_family) && ++ tmpl->mode == x->props.mode && ++ tmpl->id.proto == x->id.proto && ++ (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) ++ xfrm_state_look_at(pol, x, fl, family, ++ &best, &acquire_in_progress, &error); ++ } ++ ++cached: ++ cached = true; ++ if (best) ++ goto found; ++ else if (error) ++ best = NULL; ++ else if (acquire_in_progress) /* XXX: acquire_in_progress should not happen */ ++ WARN_ON(1); ++ + h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family); + hlist_for_each_entry_rcu(x, net->xfrm.state_bydst + h, bydst) { + #ifdef CONFIG_XFRM_OFFLOAD +@@ -1383,6 +1428,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, + XFRM_STATE_INSERT(bysrc, &x->bysrc, + net->xfrm.state_bysrc + h, + x->xso.type); ++ INIT_HLIST_NODE(&x->state_cache); + if (x->id.spi) { + h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, encap_family); + XFRM_STATE_INSERT(byspi, &x->byspi, +@@ -1431,6 +1477,15 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, + } else { + *err = acquire_in_progress ? -EAGAIN : error; + } ++ ++ if (x && x->km.state == XFRM_STATE_VALID && !cached && ++ (!(pol->flags & XFRM_POLICY_CPU_ACQUIRE) || x->pcpu_num == pcpu_id)) { ++ spin_lock_bh(&net->xfrm.xfrm_state_lock); ++ if (hlist_unhashed(&x->state_cache)) ++ hlist_add_head_rcu(&x->state_cache, &pol->state_cache_list); ++ spin_unlock_bh(&net->xfrm.xfrm_state_lock); ++ } ++ + rcu_read_unlock(); + if (to_put) + xfrm_state_put(to_put); +-- +2.39.5 + diff --git a/queue-6.12/xfrm-delete-intermediate-secpath-entry-in-packet-off.patch b/queue-6.12/xfrm-delete-intermediate-secpath-entry-in-packet-off.patch new file mode 100644 index 0000000000..55a5fe5147 --- /dev/null +++ b/queue-6.12/xfrm-delete-intermediate-secpath-entry-in-packet-off.patch @@ -0,0 +1,169 @@ +From 2f7ebbaa0430ee9ca66c49ab21b03d2d9be6439a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jan 2025 12:11:11 +0200 +Subject: xfrm: delete intermediate secpath entry in packet offload mode + +From: Alexandre Cassen + +[ Upstream commit 600258d555f0710b9c47fb78d2d80a4aecd608cc ] + +Packets handled by hardware have added secpath as a way to inform XFRM +core code that this path was already handled. That secpath is not needed +at all after policy is checked and it is removed later in the stack. + +However, in the case of IP forwarding is enabled (/proc/sys/net/ipv4/ip_forward), +that secpath is not removed and packets which already were handled are reentered +to the driver TX path with xfrm_offload set. + +The following kernel panic is observed in mlx5 in such case: + + mlx5_core 0000:04:00.0 enp4s0f0np0: Link up + mlx5_core 0000:04:00.1 enp4s0f1np1: Link up + Initializing XFRM netlink socket + IPsec XFRM device driver + BUG: kernel NULL pointer dereference, address: 0000000000000000 + #PF: supervisor instruction fetch in kernel mode + #PF: error_code(0x0010) - not-present page + PGD 0 P4D 0 + Oops: Oops: 0010 [#1] PREEMPT SMP + CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc1-alex #3 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 + RIP: 0010:0x0 + Code: Unable to access opcode bytes at 0xffffffffffffffd6. + RSP: 0018:ffffb87380003800 EFLAGS: 00010206 + RAX: ffff8df004e02600 RBX: ffffb873800038d8 RCX: 00000000ffff98cf + RDX: ffff8df00733e108 RSI: ffff8df00521fb80 RDI: ffff8df001661f00 + RBP: ffffb87380003850 R08: ffff8df013980000 R09: 0000000000000010 + R10: 0000000000000002 R11: 0000000000000002 R12: ffff8df001661f00 + R13: ffff8df00521fb80 R14: ffff8df00733e108 R15: ffff8df011faf04e + FS: 0000000000000000(0000) GS:ffff8df46b800000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: ffffffffffffffd6 CR3: 0000000106384000 CR4: 0000000000350ef0 + Call Trace: + + ? show_regs+0x63/0x70 + ? __die_body+0x20/0x60 + ? __die+0x2b/0x40 + ? page_fault_oops+0x15c/0x550 + ? do_user_addr_fault+0x3ed/0x870 + ? exc_page_fault+0x7f/0x190 + ? asm_exc_page_fault+0x27/0x30 + mlx5e_ipsec_handle_tx_skb+0xe7/0x2f0 [mlx5_core] + mlx5e_xmit+0x58e/0x1980 [mlx5_core] + ? __fib_lookup+0x6a/0xb0 + dev_hard_start_xmit+0x82/0x1d0 + sch_direct_xmit+0xfe/0x390 + __dev_queue_xmit+0x6d8/0xee0 + ? __fib_lookup+0x6a/0xb0 + ? internal_add_timer+0x48/0x70 + ? mod_timer+0xe2/0x2b0 + neigh_resolve_output+0x115/0x1b0 + __neigh_update+0x26a/0xc50 + neigh_update+0x14/0x20 + arp_process+0x2cb/0x8e0 + ? __napi_build_skb+0x5e/0x70 + arp_rcv+0x11e/0x1c0 + ? dev_gro_receive+0x574/0x820 + __netif_receive_skb_list_core+0x1cf/0x1f0 + netif_receive_skb_list_internal+0x183/0x2a0 + napi_complete_done+0x76/0x1c0 + mlx5e_napi_poll+0x234/0x7a0 [mlx5_core] + __napi_poll+0x2d/0x1f0 + net_rx_action+0x1a6/0x370 + ? atomic_notifier_call_chain+0x3b/0x50 + ? irq_int_handler+0x15/0x20 [mlx5_core] + handle_softirqs+0xb9/0x2f0 + ? handle_irq_event+0x44/0x60 + irq_exit_rcu+0xdb/0x100 + common_interrupt+0x98/0xc0 + + + asm_common_interrupt+0x27/0x40 + RIP: 0010:pv_native_safe_halt+0xb/0x10 + Code: 09 c3 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 0f 22 + 0f 1f 84 00 00 00 00 00 90 eb 07 0f 00 2d 7f e9 36 00 fb +40 00 83 ff 07 77 21 89 ff ff 24 fd 88 3d a1 bd 0f 21 f8 + RSP: 0018:ffffffffbe603de8 EFLAGS: 00000202 + RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000f92f46680 + RDX: 0000000000000037 RSI: 00000000ffffffff RDI: 00000000000518d4 + RBP: ffffffffbe603df0 R08: 000000cd42e4dffb R09: ffffffffbe603d70 + R10: 0000004d80d62680 R11: 0000000000000001 R12: ffffffffbe60bf40 + R13: 0000000000000000 R14: 0000000000000000 R15: ffffffffbe60aff8 + ? default_idle+0x9/0x20 + arch_cpu_idle+0x9/0x10 + default_idle_call+0x29/0xf0 + do_idle+0x1f2/0x240 + cpu_startup_entry+0x2c/0x30 + rest_init+0xe7/0x100 + start_kernel+0x76b/0xb90 + x86_64_start_reservations+0x18/0x30 + x86_64_start_kernel+0xc0/0x110 + ? setup_ghcb+0xe/0x130 + common_startup_64+0x13e/0x141 + + Modules linked in: esp4_offload esp4 xfrm_interface +xfrm6_tunnel tunnel4 tunnel6 xfrm_user xfrm_algo binfmt_misc +intel_rapl_msr intel_rapl_common kvm_amd ccp kvm input_leds serio_raw +qemu_fw_cfg sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc +scsi_dh_alua efi_pstore ip_tables x_tables autofs4 raid10 raid456 +async_raid6_recov async_memcpy async_pq raid6_pq async_xor xor async_tx +libcrc32c raid1 raid0 mlx5_core crct10dif_pclmul crc32_pclmul +polyval_clmulni polyval_generic ghash_clmulni_intel sha256_ssse3 +sha1_ssse3 ahci mlxfw i2c_i801 libahci i2c_mux i2c_smbus psample +virtio_rng pci_hyperv_intf aesni_intel crypto_simd cryptd + CR2: 0000000000000000 + ---[ end trace 0000000000000000 ]--- + RIP: 0010:0x0 + Code: Unable to access opcode bytes at 0xffffffffffffffd6. + RSP: 0018:ffffb87380003800 EFLAGS: 00010206 + RAX: ffff8df004e02600 RBX: ffffb873800038d8 RCX: 00000000ffff98cf + RDX: ffff8df00733e108 RSI: ffff8df00521fb80 RDI: ffff8df001661f00 + RBP: ffffb87380003850 R08: ffff8df013980000 R09: 0000000000000010 + R10: 0000000000000002 R11: 0000000000000002 R12: ffff8df001661f00 + R13: ffff8df00521fb80 R14: ffff8df00733e108 R15: ffff8df011faf04e + FS: 0000000000000000(0000) GS:ffff8df46b800000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: ffffffffffffffd6 CR3: 0000000106384000 CR4: 0000000000350ef0 + Kernel panic - not syncing: Fatal exception in interrupt + Kernel Offset: 0x3b800000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) + ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- + +Fixes: 5958372ddf62 ("xfrm: add RX datapath protection for IPsec packet offload mode") +Signed-off-by: Alexandre Cassen +Signed-off-by: Leon Romanovsky +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + include/net/xfrm.h | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/include/net/xfrm.h b/include/net/xfrm.h +index 2b87999bd5aae..83e9ef25b8d0d 100644 +--- a/include/net/xfrm.h ++++ b/include/net/xfrm.h +@@ -1223,9 +1223,19 @@ static inline int __xfrm_policy_check2(struct sock *sk, int dir, + + if (xo) { + x = xfrm_input_state(skb); +- if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET) +- return (xo->flags & CRYPTO_DONE) && +- (xo->status & CRYPTO_SUCCESS); ++ if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET) { ++ bool check = (xo->flags & CRYPTO_DONE) && ++ (xo->status & CRYPTO_SUCCESS); ++ ++ /* The packets here are plain ones and secpath was ++ * needed to indicate that hardware already handled ++ * them and there is no need to do nothing in addition. ++ * ++ * Consume secpath which was set by drivers. ++ */ ++ secpath_reset(skb); ++ return check; ++ } + } + + return __xfrm_check_nopolicy(net, skb, dir) || +-- +2.39.5 + diff --git a/queue-6.12/xfrm-don-t-disable-preemption-while-looking-up-cache.patch b/queue-6.12/xfrm-don-t-disable-preemption-while-looking-up-cache.patch new file mode 100644 index 0000000000..f7585172be --- /dev/null +++ b/queue-6.12/xfrm-don-t-disable-preemption-while-looking-up-cache.patch @@ -0,0 +1,58 @@ +From 60f391254169010c0acb4b7f3a64dfe78be3971f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jan 2025 17:20:45 +0100 +Subject: xfrm: Don't disable preemption while looking up cache state. + +From: Sebastian Sewior + +[ Upstream commit 6c9b7db96db62ee9ad8d359d90ff468d462518c4 ] + +For the state cache lookup xfrm_input_state_lookup() first disables +preemption, to remain on the CPU and then retrieves a per-CPU pointer. +Within the preempt-disable section it also acquires +netns_xfrm::xfrm_state_lock, a spinlock_t. This lock must not be +acquired with explicit disabled preemption (such as by get_cpu()) +because this lock becomes a sleeping lock on PREEMPT_RT. + +To remain on the same CPU is just an optimisation for the CPU local +lookup. The actual modification of the per-CPU variable happens with +netns_xfrm::xfrm_state_lock acquired. + +Remove get_cpu() and use the state_cache_input on the current CPU. + +Reported-by: Alexei Starovoitov +Closes: https://lore.kernel.org/all/CAADnVQKkCLaj=roayH=Mjiiqz_svdf1tsC3OE4EC0E=mAD+L1A@mail.gmail.com/ +Fixes: 81a331a0e72dd ("xfrm: Add an inbound percpu state cache.") +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_state.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index 567f02ff88597..6441e94233daa 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -1150,9 +1150,8 @@ struct xfrm_state *xfrm_input_state_lookup(struct net *net, u32 mark, + struct xfrm_hash_state_ptrs state_ptrs; + struct hlist_head *state_cache_input; + struct xfrm_state *x = NULL; +- int cpu = get_cpu(); + +- state_cache_input = per_cpu_ptr(net->xfrm.state_cache_input, cpu); ++ state_cache_input = raw_cpu_ptr(net->xfrm.state_cache_input); + + rcu_read_lock(); + hlist_for_each_entry_rcu(x, state_cache_input, state_cache_input) { +@@ -1186,7 +1185,6 @@ struct xfrm_state *xfrm_input_state_lookup(struct net *net, u32 mark, + + out: + rcu_read_unlock(); +- put_cpu(); + return x; + } + EXPORT_SYMBOL(xfrm_input_state_lookup); +-- +2.39.5 + diff --git a/queue-6.12/xfrm-replay-fix-the-update-of-replay_esn-oseq_hi-for.patch b/queue-6.12/xfrm-replay-fix-the-update-of-replay_esn-oseq_hi-for.patch new file mode 100644 index 0000000000..31cfc1f2e1 --- /dev/null +++ b/queue-6.12/xfrm-replay-fix-the-update-of-replay_esn-oseq_hi-for.patch @@ -0,0 +1,61 @@ +From dfd483d9accc19744783a7fbe020fb3c2a25792a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Nov 2024 14:10:31 +0200 +Subject: xfrm: replay: Fix the update of replay_esn->oseq_hi for GSO + +From: Jianbo Liu + +[ Upstream commit c05c5e5aa163f4682ca97a2f0536575fc7dbdecb ] + +When skb needs GSO and wrap around happens, if xo->seq.low (seqno of +the first skb segment) is before the last seq number but oseq (seqno +of the last segment) is after it, xo->seq.low is still bigger than +replay_esn->oseq while oseq is smaller than it, so the update of +replay_esn->oseq_hi is missed for this case wrap around because of +the change in the cited commit. + +For example, if sending a packet with gso_segs=3 while old +replay_esn->oseq=0xfffffffe, we calculate: + xo->seq.low = 0xfffffffe + 1 = 0x0xffffffff + oseq = 0xfffffffe + 3 = 0x1 +(oseq < replay_esn->oseq) is true, but (xo->seq.low < +replay_esn->oseq) is false, so replay_esn->oseq_hi is not incremented. + +To fix this issue, change the outer checking back for the update of +replay_esn->oseq_hi. And add new checking inside for the update of +packet's oseq_hi. + +Fixes: 4b549ccce941 ("xfrm: replay: Fix ESN wrap around for GSO") +Signed-off-by: Jianbo Liu +Reviewed-by: Patrisious Haddad +Signed-off-by: Leon Romanovsky +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_replay.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c +index bc56c63057252..235bbefc2abae 100644 +--- a/net/xfrm/xfrm_replay.c ++++ b/net/xfrm/xfrm_replay.c +@@ -714,10 +714,12 @@ static int xfrm_replay_overflow_offload_esn(struct xfrm_state *x, struct sk_buff + oseq += skb_shinfo(skb)->gso_segs; + } + +- if (unlikely(xo->seq.low < replay_esn->oseq)) { +- XFRM_SKB_CB(skb)->seq.output.hi = ++oseq_hi; +- xo->seq.hi = oseq_hi; +- replay_esn->oseq_hi = oseq_hi; ++ if (unlikely(oseq < replay_esn->oseq)) { ++ replay_esn->oseq_hi = ++oseq_hi; ++ if (xo->seq.low < replay_esn->oseq) { ++ XFRM_SKB_CB(skb)->seq.output.hi = oseq_hi; ++ xo->seq.hi = oseq_hi; ++ } + if (replay_esn->oseq_hi == 0) { + replay_esn->oseq--; + replay_esn->oseq_hi--; +-- +2.39.5 + diff --git a/queue-6.12/xfrm-state-fix-out-of-bounds-read-during-lookup.patch b/queue-6.12/xfrm-state-fix-out-of-bounds-read-during-lookup.patch new file mode 100644 index 0000000000..4433c5c522 --- /dev/null +++ b/queue-6.12/xfrm-state-fix-out-of-bounds-read-during-lookup.patch @@ -0,0 +1,294 @@ +From acdf5c7e13574cca14e3d81d1bd3c1410887ddaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Nov 2024 15:26:25 +0100 +Subject: xfrm: state: fix out-of-bounds read during lookup + +From: Florian Westphal + +[ Upstream commit e952837f3ddb0ff726d5b582aa1aad9aa38d024d ] + +lookup and resize can run in parallel. + +The xfrm_state_hash_generation seqlock ensures a retry, but the hash +functions can observe a hmask value that is too large for the new hlist +array. + +rehash does: + rcu_assign_pointer(net->xfrm.state_bydst, ndst) [..] + net->xfrm.state_hmask = nhashmask; + +While state lookup does: + h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family); + hlist_for_each_entry_rcu(x, net->xfrm.state_bydst + h, bydst) { + +This is only safe in case the update to state_bydst is larger than +net->xfrm.xfrm_state_hmask (or if the lookup function gets +serialized via state spinlock again). + +Fix this by prefetching state_hmask and the associated pointers. +The xfrm_state_hash_generation seqlock retry will ensure that the pointer +and the hmask will be consistent. + +The existing helpers, like xfrm_dst_hash(), are now unsafe for RCU side, +add lockdep assertions to document that they are only safe for insert +side. + +xfrm_state_lookup_byaddr() uses the spinlock rather than RCU. +AFAICS this is an oversight from back when state lookup was converted to +RCU, this lock should be replaced with RCU in a future patch. + +Reported-by: syzbot+5f9f31cb7d985f584d8e@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/CACT4Y+azwfrE3uz6A5ZErov5YN2LYBN5KrsymBerT36VU8qzBA@mail.gmail.com/ +Diagnosed-by: Dmitry Vyukov +Fixes: c2f672fc9464 ("xfrm: state lookup can be lockless") +Signed-off-by: Florian Westphal +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_state.c | 89 ++++++++++++++++++++++++++++++++++--------- + 1 file changed, 70 insertions(+), 19 deletions(-) + +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index e3266a5d4f90d..567f02ff88597 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -34,6 +34,8 @@ + + #define xfrm_state_deref_prot(table, net) \ + rcu_dereference_protected((table), lockdep_is_held(&(net)->xfrm.xfrm_state_lock)) ++#define xfrm_state_deref_check(table, net) \ ++ rcu_dereference_check((table), lockdep_is_held(&(net)->xfrm.xfrm_state_lock)) + + static void xfrm_state_gc_task(struct work_struct *work); + +@@ -62,6 +64,8 @@ static inline unsigned int xfrm_dst_hash(struct net *net, + u32 reqid, + unsigned short family) + { ++ lockdep_assert_held(&net->xfrm.xfrm_state_lock); ++ + return __xfrm_dst_hash(daddr, saddr, reqid, family, net->xfrm.state_hmask); + } + +@@ -70,6 +74,8 @@ static inline unsigned int xfrm_src_hash(struct net *net, + const xfrm_address_t *saddr, + unsigned short family) + { ++ lockdep_assert_held(&net->xfrm.xfrm_state_lock); ++ + return __xfrm_src_hash(daddr, saddr, family, net->xfrm.state_hmask); + } + +@@ -77,11 +83,15 @@ static inline unsigned int + xfrm_spi_hash(struct net *net, const xfrm_address_t *daddr, + __be32 spi, u8 proto, unsigned short family) + { ++ lockdep_assert_held(&net->xfrm.xfrm_state_lock); ++ + return __xfrm_spi_hash(daddr, spi, proto, family, net->xfrm.state_hmask); + } + + static unsigned int xfrm_seq_hash(struct net *net, u32 seq) + { ++ lockdep_assert_held(&net->xfrm.xfrm_state_lock); ++ + return __xfrm_seq_hash(seq, net->xfrm.state_hmask); + } + +@@ -1041,16 +1051,38 @@ xfrm_init_tempstate(struct xfrm_state *x, const struct flowi *fl, + x->props.family = tmpl->encap_family; + } + +-static struct xfrm_state *__xfrm_state_lookup_all(struct net *net, u32 mark, ++struct xfrm_hash_state_ptrs { ++ const struct hlist_head *bydst; ++ const struct hlist_head *bysrc; ++ const struct hlist_head *byspi; ++ unsigned int hmask; ++}; ++ ++static void xfrm_hash_ptrs_get(const struct net *net, struct xfrm_hash_state_ptrs *ptrs) ++{ ++ unsigned int sequence; ++ ++ do { ++ sequence = read_seqcount_begin(&net->xfrm.xfrm_state_hash_generation); ++ ++ ptrs->bydst = xfrm_state_deref_check(net->xfrm.state_bydst, net); ++ ptrs->bysrc = xfrm_state_deref_check(net->xfrm.state_bysrc, net); ++ ptrs->byspi = xfrm_state_deref_check(net->xfrm.state_byspi, net); ++ ptrs->hmask = net->xfrm.state_hmask; ++ } while (read_seqcount_retry(&net->xfrm.xfrm_state_hash_generation, sequence)); ++} ++ ++static struct xfrm_state *__xfrm_state_lookup_all(const struct xfrm_hash_state_ptrs *state_ptrs, ++ u32 mark, + const xfrm_address_t *daddr, + __be32 spi, u8 proto, + unsigned short family, + struct xfrm_dev_offload *xdo) + { +- unsigned int h = xfrm_spi_hash(net, daddr, spi, proto, family); ++ unsigned int h = __xfrm_spi_hash(daddr, spi, proto, family, state_ptrs->hmask); + struct xfrm_state *x; + +- hlist_for_each_entry_rcu(x, net->xfrm.state_byspi + h, byspi) { ++ hlist_for_each_entry_rcu(x, state_ptrs->byspi + h, byspi) { + #ifdef CONFIG_XFRM_OFFLOAD + if (xdo->type == XFRM_DEV_OFFLOAD_PACKET) { + if (x->xso.type != XFRM_DEV_OFFLOAD_PACKET) +@@ -1084,15 +1116,16 @@ static struct xfrm_state *__xfrm_state_lookup_all(struct net *net, u32 mark, + return NULL; + } + +-static struct xfrm_state *__xfrm_state_lookup(struct net *net, u32 mark, ++static struct xfrm_state *__xfrm_state_lookup(const struct xfrm_hash_state_ptrs *state_ptrs, ++ u32 mark, + const xfrm_address_t *daddr, + __be32 spi, u8 proto, + unsigned short family) + { +- unsigned int h = xfrm_spi_hash(net, daddr, spi, proto, family); ++ unsigned int h = __xfrm_spi_hash(daddr, spi, proto, family, state_ptrs->hmask); + struct xfrm_state *x; + +- hlist_for_each_entry_rcu(x, net->xfrm.state_byspi + h, byspi) { ++ hlist_for_each_entry_rcu(x, state_ptrs->byspi + h, byspi) { + if (x->props.family != family || + x->id.spi != spi || + x->id.proto != proto || +@@ -1114,6 +1147,7 @@ struct xfrm_state *xfrm_input_state_lookup(struct net *net, u32 mark, + __be32 spi, u8 proto, + unsigned short family) + { ++ struct xfrm_hash_state_ptrs state_ptrs; + struct hlist_head *state_cache_input; + struct xfrm_state *x = NULL; + int cpu = get_cpu(); +@@ -1135,7 +1169,9 @@ struct xfrm_state *xfrm_input_state_lookup(struct net *net, u32 mark, + goto out; + } + +- x = __xfrm_state_lookup(net, mark, daddr, spi, proto, family); ++ xfrm_hash_ptrs_get(net, &state_ptrs); ++ ++ x = __xfrm_state_lookup(&state_ptrs, mark, daddr, spi, proto, family); + + if (x && x->km.state == XFRM_STATE_VALID) { + spin_lock_bh(&net->xfrm.xfrm_state_lock); +@@ -1155,15 +1191,16 @@ struct xfrm_state *xfrm_input_state_lookup(struct net *net, u32 mark, + } + EXPORT_SYMBOL(xfrm_input_state_lookup); + +-static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, u32 mark, ++static struct xfrm_state *__xfrm_state_lookup_byaddr(const struct xfrm_hash_state_ptrs *state_ptrs, ++ u32 mark, + const xfrm_address_t *daddr, + const xfrm_address_t *saddr, + u8 proto, unsigned short family) + { +- unsigned int h = xfrm_src_hash(net, daddr, saddr, family); ++ unsigned int h = __xfrm_src_hash(daddr, saddr, family, state_ptrs->hmask); + struct xfrm_state *x; + +- hlist_for_each_entry_rcu(x, net->xfrm.state_bysrc + h, bysrc) { ++ hlist_for_each_entry_rcu(x, state_ptrs->bysrc + h, bysrc) { + if (x->props.family != family || + x->id.proto != proto || + !xfrm_addr_equal(&x->id.daddr, daddr, family) || +@@ -1183,14 +1220,17 @@ static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, u32 mark, + static inline struct xfrm_state * + __xfrm_state_locate(struct xfrm_state *x, int use_spi, int family) + { ++ struct xfrm_hash_state_ptrs state_ptrs; + struct net *net = xs_net(x); + u32 mark = x->mark.v & x->mark.m; + ++ xfrm_hash_ptrs_get(net, &state_ptrs); ++ + if (use_spi) +- return __xfrm_state_lookup(net, mark, &x->id.daddr, ++ return __xfrm_state_lookup(&state_ptrs, mark, &x->id.daddr, + x->id.spi, x->id.proto, family); + else +- return __xfrm_state_lookup_byaddr(net, mark, ++ return __xfrm_state_lookup_byaddr(&state_ptrs, mark, + &x->id.daddr, + &x->props.saddr, + x->id.proto, family); +@@ -1264,6 +1304,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, + unsigned short family, u32 if_id) + { + static xfrm_address_t saddr_wildcard = { }; ++ struct xfrm_hash_state_ptrs state_ptrs; + struct net *net = xp_net(pol); + unsigned int h, h_wildcard; + struct xfrm_state *x, *x0, *to_put; +@@ -1328,8 +1369,10 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, + else if (acquire_in_progress) /* XXX: acquire_in_progress should not happen */ + WARN_ON(1); + +- h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family); +- hlist_for_each_entry_rcu(x, net->xfrm.state_bydst + h, bydst) { ++ xfrm_hash_ptrs_get(net, &state_ptrs); ++ ++ h = __xfrm_dst_hash(daddr, saddr, tmpl->reqid, encap_family, state_ptrs.hmask); ++ hlist_for_each_entry_rcu(x, state_ptrs.bydst + h, bydst) { + #ifdef CONFIG_XFRM_OFFLOAD + if (pol->xdo.type == XFRM_DEV_OFFLOAD_PACKET) { + if (x->xso.type != XFRM_DEV_OFFLOAD_PACKET) +@@ -1362,8 +1405,9 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, + if (best || acquire_in_progress) + goto found; + +- h_wildcard = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, encap_family); +- hlist_for_each_entry_rcu(x, net->xfrm.state_bydst + h_wildcard, bydst) { ++ h_wildcard = __xfrm_dst_hash(daddr, &saddr_wildcard, tmpl->reqid, ++ encap_family, state_ptrs.hmask); ++ hlist_for_each_entry_rcu(x, state_ptrs.bydst + h_wildcard, bydst) { + #ifdef CONFIG_XFRM_OFFLOAD + if (pol->xdo.type == XFRM_DEV_OFFLOAD_PACKET) { + if (x->xso.type != XFRM_DEV_OFFLOAD_PACKET) +@@ -1401,7 +1445,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, + + if (!x && !error && !acquire_in_progress) { + if (tmpl->id.spi && +- (x0 = __xfrm_state_lookup_all(net, mark, daddr, ++ (x0 = __xfrm_state_lookup_all(&state_ptrs, mark, daddr, + tmpl->id.spi, tmpl->id.proto, + encap_family, + &pol->xdo)) != NULL) { +@@ -2179,10 +2223,13 @@ struct xfrm_state * + xfrm_state_lookup(struct net *net, u32 mark, const xfrm_address_t *daddr, __be32 spi, + u8 proto, unsigned short family) + { ++ struct xfrm_hash_state_ptrs state_ptrs; + struct xfrm_state *x; + + rcu_read_lock(); +- x = __xfrm_state_lookup(net, mark, daddr, spi, proto, family); ++ xfrm_hash_ptrs_get(net, &state_ptrs); ++ ++ x = __xfrm_state_lookup(&state_ptrs, mark, daddr, spi, proto, family); + rcu_read_unlock(); + return x; + } +@@ -2193,10 +2240,14 @@ xfrm_state_lookup_byaddr(struct net *net, u32 mark, + const xfrm_address_t *daddr, const xfrm_address_t *saddr, + u8 proto, unsigned short family) + { ++ struct xfrm_hash_state_ptrs state_ptrs; + struct xfrm_state *x; + + spin_lock_bh(&net->xfrm.xfrm_state_lock); +- x = __xfrm_state_lookup_byaddr(net, mark, daddr, saddr, proto, family); ++ ++ xfrm_hash_ptrs_get(net, &state_ptrs); ++ ++ x = __xfrm_state_lookup_byaddr(&state_ptrs, mark, daddr, saddr, proto, family); + spin_unlock_bh(&net->xfrm.xfrm_state_lock); + return x; + } +-- +2.39.5 +