From: Sasha Levin Date: Wed, 3 Apr 2024 15:59:47 +0000 (-0400) Subject: Fixes for 6.8 X-Git-Tag: v6.6.25~18^2~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ab2cb20908fe6d13a7a30da5746727846de942a2;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.8 Signed-off-by: Sasha Levin --- diff --git a/queue-6.8/acpica-debugger-check-status-of-acpi_evaluate_object.patch b/queue-6.8/acpica-debugger-check-status-of-acpi_evaluate_object.patch new file mode 100644 index 00000000000..1e320be3965 --- /dev/null +++ b/queue-6.8/acpica-debugger-check-status-of-acpi_evaluate_object.patch @@ -0,0 +1,53 @@ +From e63a4248bdfac2f7b3e1ce244a61e132091de479 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Mar 2024 21:07:53 +0300 +Subject: ACPICA: debugger: check status of acpi_evaluate_object() in + acpi_db_walk_for_fields() + +From: Nikita Kiryushin + +[ Upstream commit 40e2710860e57411ab57a1529c5a2748abbe8a19 ] + +ACPICA commit 9061cd9aa131205657c811a52a9f8325a040c6c9 + +Errors in acpi_evaluate_object() can lead to incorrect state of buffer. + +This can lead to access to data in previously ACPI_FREEd buffer and +secondary ACPI_FREE to the same buffer later. + +Handle errors in acpi_evaluate_object the same way it is done earlier +with acpi_ns_handle_to_pathname. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Link: https://github.com/acpica/acpica/commit/9061cd9a +Fixes: 5fd033288a86 ("ACPICA: debugger: add command to dump all fields of particular subtype") +Signed-off-by: Nikita Kiryushin +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/dbnames.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/acpi/acpica/dbnames.c b/drivers/acpi/acpica/dbnames.c +index b91155ea9c343..c9131259f717b 100644 +--- a/drivers/acpi/acpica/dbnames.c ++++ b/drivers/acpi/acpica/dbnames.c +@@ -550,8 +550,12 @@ acpi_db_walk_for_fields(acpi_handle obj_handle, + ACPI_FREE(buffer.pointer); + + buffer.length = ACPI_ALLOCATE_LOCAL_BUFFER; +- acpi_evaluate_object(obj_handle, NULL, NULL, &buffer); +- ++ status = acpi_evaluate_object(obj_handle, NULL, NULL, &buffer); ++ if (ACPI_FAILURE(status)) { ++ acpi_os_printf("Could Not evaluate object %p\n", ++ obj_handle); ++ return (AE_OK); ++ } + /* + * Since this is a field unit, surround the output in braces + */ +-- +2.43.0 + diff --git a/queue-6.8/alsa-hda-cs35l56-set-the-init_done-flag-before-compo.patch b/queue-6.8/alsa-hda-cs35l56-set-the-init_done-flag-before-compo.patch new file mode 100644 index 00000000000..9616329b526 --- /dev/null +++ b/queue-6.8/alsa-hda-cs35l56-set-the-init_done-flag-before-compo.patch @@ -0,0 +1,47 @@ +From 2beceaac549e22a79b83036f2ae5653418f45ae0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 14:55:10 +0000 +Subject: ALSA: hda: cs35l56: Set the init_done flag before component_add() + +From: Simon Trimmer + +[ Upstream commit cafe9c6a72cf1ffe96d2561d988a141cb5c093db ] + +Initialization is completed before adding the component as that can +start the process of the device binding and trigger actions that check +init_done. + +Signed-off-by: Simon Trimmer +Signed-off-by: Richard Fitzgerald +Fixes: 73cfbfa9caea ("ALSA: hda/cs35l56: Add driver for Cirrus Logic CS35L56 amplifier") +Message-ID: <20240325145510.328378-1-rf@opensource.cirrus.com> +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/cs35l56_hda.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/pci/hda/cs35l56_hda.c b/sound/pci/hda/cs35l56_hda.c +index 75a14ba54fcd1..43a445bd961fb 100644 +--- a/sound/pci/hda/cs35l56_hda.c ++++ b/sound/pci/hda/cs35l56_hda.c +@@ -1017,14 +1017,14 @@ int cs35l56_hda_common_probe(struct cs35l56_hda *cs35l56, int id) + pm_runtime_mark_last_busy(cs35l56->base.dev); + pm_runtime_enable(cs35l56->base.dev); + ++ cs35l56->base.init_done = true; ++ + ret = component_add(cs35l56->base.dev, &cs35l56_hda_comp_ops); + if (ret) { + dev_err(cs35l56->base.dev, "Register component failed: %d\n", ret); + goto pm_err; + } + +- cs35l56->base.init_done = true; +- + return 0; + + pm_err: +-- +2.43.0 + diff --git a/queue-6.8/arm64-bpf-fix-32bit-unconditional-bswap.patch b/queue-6.8/arm64-bpf-fix-32bit-unconditional-bswap.patch new file mode 100644 index 00000000000..72ce96de353 --- /dev/null +++ b/queue-6.8/arm64-bpf-fix-32bit-unconditional-bswap.patch @@ -0,0 +1,52 @@ +From 4291ddb269a461ff553b8c8432f99edb50334ac0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Mar 2024 09:18:09 +0100 +Subject: arm64: bpf: fix 32bit unconditional bswap + +From: Artem Savkov + +[ Upstream commit a51cd6bf8e10793103c5870ff9e4db295a843604 ] + +In case when is64 == 1 in emit(A64_REV32(is64, dst, dst), ctx) the +generated insn reverses byte order for both high and low 32-bit words, +resuling in an incorrect swap as indicated by the jit test: + +[ 9757.262607] test_bpf: #312 BSWAP 16: 0x0123456789abcdef -> 0xefcd jited:1 8 PASS +[ 9757.264435] test_bpf: #313 BSWAP 32: 0x0123456789abcdef -> 0xefcdab89 jited:1 ret 1460850314 != -271733879 (0x5712ce8a != 0xefcdab89)FAIL (1 times) +[ 9757.266260] test_bpf: #314 BSWAP 64: 0x0123456789abcdef -> 0x67452301 jited:1 8 PASS +[ 9757.268000] test_bpf: #315 BSWAP 64: 0x0123456789abcdef >> 32 -> 0xefcdab89 jited:1 8 PASS +[ 9757.269686] test_bpf: #316 BSWAP 16: 0xfedcba9876543210 -> 0x1032 jited:1 8 PASS +[ 9757.271380] test_bpf: #317 BSWAP 32: 0xfedcba9876543210 -> 0x10325476 jited:1 ret -1460850316 != 271733878 (0xa8ed3174 != 0x10325476)FAIL (1 times) +[ 9757.273022] test_bpf: #318 BSWAP 64: 0xfedcba9876543210 -> 0x98badcfe jited:1 7 PASS +[ 9757.274721] test_bpf: #319 BSWAP 64: 0xfedcba9876543210 >> 32 -> 0x10325476 jited:1 9 PASS + +Fix this by forcing 32bit variant of rev32. + +Fixes: 1104247f3f979 ("bpf, arm64: Support unconditional bswap") +Signed-off-by: Artem Savkov +Tested-by: Puranjay Mohan +Acked-by: Puranjay Mohan +Acked-by: Xu Kuohai +Message-ID: <20240321081809.158803-1-asavkov@redhat.com> +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + arch/arm64/net/bpf_jit_comp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c +index 582c4c2491edc..00217d8d034b7 100644 +--- a/arch/arm64/net/bpf_jit_comp.c ++++ b/arch/arm64/net/bpf_jit_comp.c +@@ -876,7 +876,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, + emit(A64_UXTH(is64, dst, dst), ctx); + break; + case 32: +- emit(A64_REV32(is64, dst, dst), ctx); ++ emit(A64_REV32(0, dst, dst), ctx); + /* upper 32 bits already cleared */ + break; + case 64: +-- +2.43.0 + diff --git a/queue-6.8/bpf-arm64-fix-bug-in-bpf_ldx_memsx.patch b/queue-6.8/bpf-arm64-fix-bug-in-bpf_ldx_memsx.patch new file mode 100644 index 00000000000..228f51780a4 --- /dev/null +++ b/queue-6.8/bpf-arm64-fix-bug-in-bpf_ldx_memsx.patch @@ -0,0 +1,83 @@ +From 7f52e93297963c67cd767f0d0ee48c8c11ccf309 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 23:59:17 +0000 +Subject: bpf, arm64: fix bug in BPF_LDX_MEMSX + +From: Puranjay Mohan + +[ Upstream commit 114b5b3b4bde7358624437be2f12cde1b265224e ] + +A64_LDRSW() takes three registers: Xt, Xn, Xm as arguments and it loads +and sign extends the value at address Xn + Xm into register Xt. + +Currently, the offset is being directly used in place of the tmp +register which has the offset already loaded by the last emitted +instruction. + +This will cause JIT failures. The easiest way to reproduce this is to +test the following code through test_bpf module: + +{ + "BPF_LDX_MEMSX | BPF_W", + .u.insns_int = { + BPF_LD_IMM64(R1, 0x00000000deadbeefULL), + BPF_LD_IMM64(R2, 0xffffffffdeadbeefULL), + BPF_STX_MEM(BPF_DW, R10, R1, -7), + BPF_LDX_MEMSX(BPF_W, R0, R10, -7), + BPF_JMP_REG(BPF_JNE, R0, R2, 1), + BPF_ALU64_IMM(BPF_MOV, R0, 0), + BPF_EXIT_INSN(), + }, + INTERNAL, + { }, + { { 0, 0 } }, + .stack_depth = 7, +}, + +We need to use the offset as -7 to trigger this code path, there could +be other valid ways to trigger this from proper BPF programs as well. + +This code is rejected by the JIT because -7 is passed to A64_LDRSW() but +it expects a valid register (0 - 31). + + roott@pjy:~# modprobe test_bpf test_name="BPF_LDX_MEMSX | BPF_W" + [11300.490371] test_bpf: test_bpf: set 'test_bpf' as the default test_suite. + [11300.491750] test_bpf: #345 BPF_LDX_MEMSX | BPF_W + [11300.493179] aarch64_insn_encode_register: unknown register encoding -7 + [11300.494133] aarch64_insn_encode_register: unknown register encoding -7 + [11300.495292] FAIL to select_runtime err=-524 + [11300.496804] test_bpf: Summary: 0 PASSED, 1 FAILED, [0/0 JIT'ed] + modprobe: ERROR: could not insert 'test_bpf': Invalid argument + +Applying this patch fixes the issue. + + root@pjy:~# modprobe test_bpf test_name="BPF_LDX_MEMSX | BPF_W" + [ 292.837436] test_bpf: test_bpf: set 'test_bpf' as the default test_suite. + [ 292.839416] test_bpf: #345 BPF_LDX_MEMSX | BPF_W jited:1 156 PASS + [ 292.844794] test_bpf: Summary: 1 PASSED, 0 FAILED, [1/1 JIT'ed] + +Fixes: cc88f540da52 ("bpf, arm64: Support sign-extension load instructions") +Signed-off-by: Puranjay Mohan +Message-ID: <20240312235917.103626-1-puranjay12@gmail.com> +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + arch/arm64/net/bpf_jit_comp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c +index 8955da5c47cf7..582c4c2491edc 100644 +--- a/arch/arm64/net/bpf_jit_comp.c ++++ b/arch/arm64/net/bpf_jit_comp.c +@@ -1189,7 +1189,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, + } else { + emit_a64_mov_i(1, tmp, off, ctx); + if (sign_extend) +- emit(A64_LDRSW(dst, src_adj, off_adj), ctx); ++ emit(A64_LDRSW(dst, src, tmp), ctx); + else + emit(A64_LDR32(dst, src, tmp), ctx); + } +-- +2.43.0 + diff --git a/queue-6.8/bpf-protect-against-int-overflow-for-stack-access-si.patch b/queue-6.8/bpf-protect-against-int-overflow-for-stack-access-si.patch new file mode 100644 index 00000000000..726540f3404 --- /dev/null +++ b/queue-6.8/bpf-protect-against-int-overflow-for-stack-access-si.patch @@ -0,0 +1,53 @@ +From b062ab106188d2ec924b7f5785d17a096d418f5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 22:42:45 -0400 +Subject: bpf: Protect against int overflow for stack access size + +From: Andrei Matei + +[ Upstream commit ecc6a2101840177e57c925c102d2d29f260d37c8 ] + +This patch re-introduces protection against the size of access to stack +memory being negative; the access size can appear negative as a result +of overflowing its signed int representation. This should not actually +happen, as there are other protections along the way, but we should +protect against it anyway. One code path was missing such protections +(fixed in the previous patch in the series), causing out-of-bounds array +accesses in check_stack_range_initialized(). This patch causes the +verification of a program with such a non-sensical access size to fail. + +This check used to exist in a more indirect way, but was inadvertendly +removed in a833a17aeac7. + +Fixes: a833a17aeac7 ("bpf: Fix verification of indirect var-off stack access") +Reported-by: syzbot+33f4297b5f927648741a@syzkaller.appspotmail.com +Reported-by: syzbot+aafd0513053a1cbf52ef@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/bpf/CAADnVQLORV5PT0iTAhRER+iLBTkByCYNBYyvBSgjN1T31K+gOw@mail.gmail.com/ +Acked-by: Andrii Nakryiko +Signed-off-by: Andrei Matei +Link: https://lore.kernel.org/r/20240327024245.318299-3-andreimatei1@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index ddea9567f7559..19e575e6b7fe0 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -6618,6 +6618,11 @@ static int check_stack_access_within_bounds( + err = check_stack_slot_within_bounds(env, min_off, state, type); + if (!err && max_off > 0) + err = -EINVAL; /* out of stack access into non-negative offsets */ ++ if (!err && access_size < 0) ++ /* access_size should not be negative (or overflow an int); others checks ++ * along the way should have prevented such an access. ++ */ ++ err = -EFAULT; /* invalid negative access size; integer overflow? */ + + if (err) { + if (tnum_is_const(reg->var_off)) { +-- +2.43.0 + diff --git a/queue-6.8/cifs-fix-duplicate-fscache-cookie-warnings.patch b/queue-6.8/cifs-fix-duplicate-fscache-cookie-warnings.patch new file mode 100644 index 00000000000..2d21f9633c1 --- /dev/null +++ b/queue-6.8/cifs-fix-duplicate-fscache-cookie-warnings.patch @@ -0,0 +1,93 @@ +From 8549dbd991285d93f326bd2f6d941716fb8cdb7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Mar 2024 14:13:24 +0000 +Subject: cifs: Fix duplicate fscache cookie warnings + +From: David Howells + +[ Upstream commit 8876a37277cb832e1861c35f8c661825179f73f5 ] + +fscache emits a lot of duplicate cookie warnings with cifs because the +index key for the fscache cookies does not include everything that the +cifs_find_inode() function does. The latter is used with iget5_locked() to +distinguish between inodes in the local inode cache. + +Fix this by adding the creation time and file type to the fscache cookie +key. + +Additionally, add a couple of comments to note that if one is changed the +other must be also. + +Signed-off-by: David Howells +Fixes: 70431bfd825d ("cifs: Support fscache indexing rewrite") +cc: Shyam Prasad N +cc: Rohith Surabattula +cc: Jeff Layton +cc: linux-cifs@vger.kernel.org +cc: netfs@lists.linux.dev +cc: linux-fsdevel@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/fscache.c | 16 +++++++++++++++- + fs/smb/client/inode.c | 2 ++ + 2 files changed, 17 insertions(+), 1 deletion(-) + +diff --git a/fs/smb/client/fscache.c b/fs/smb/client/fscache.c +index c4a3cb736881a..340efce8f0529 100644 +--- a/fs/smb/client/fscache.c ++++ b/fs/smb/client/fscache.c +@@ -12,6 +12,16 @@ + #include "cifs_fs_sb.h" + #include "cifsproto.h" + ++/* ++ * Key for fscache inode. [!] Contents must match comparisons in cifs_find_inode(). ++ */ ++struct cifs_fscache_inode_key { ++ ++ __le64 uniqueid; /* server inode number */ ++ __le64 createtime; /* creation time on server */ ++ u8 type; /* S_IFMT file type */ ++} __packed; ++ + static void cifs_fscache_fill_volume_coherency( + struct cifs_tcon *tcon, + struct cifs_fscache_volume_coherency_data *cd) +@@ -97,15 +107,19 @@ void cifs_fscache_release_super_cookie(struct cifs_tcon *tcon) + void cifs_fscache_get_inode_cookie(struct inode *inode) + { + struct cifs_fscache_inode_coherency_data cd; ++ struct cifs_fscache_inode_key key; + struct cifsInodeInfo *cifsi = CIFS_I(inode); + struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb); + struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb); + ++ key.uniqueid = cpu_to_le64(cifsi->uniqueid); ++ key.createtime = cpu_to_le64(cifsi->createtime); ++ key.type = (inode->i_mode & S_IFMT) >> 12; + cifs_fscache_fill_coherency(&cifsi->netfs.inode, &cd); + + cifsi->netfs.cache = + fscache_acquire_cookie(tcon->fscache, 0, +- &cifsi->uniqueid, sizeof(cifsi->uniqueid), ++ &key, sizeof(key), + &cd, sizeof(cd), + i_size_read(&cifsi->netfs.inode)); + if (cifsi->netfs.cache) +diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c +index 7f28edf4b20f3..4c3dec384f922 100644 +--- a/fs/smb/client/inode.c ++++ b/fs/smb/client/inode.c +@@ -1414,6 +1414,8 @@ cifs_find_inode(struct inode *inode, void *opaque) + { + struct cifs_fattr *fattr = opaque; + ++ /* [!] The compared values must be the same in struct cifs_fscache_inode_key. */ ++ + /* don't match inode with different uniqueid */ + if (CIFS_I(inode)->uniqueid != fattr->cf_uniqueid) + return 0; +-- +2.43.0 + diff --git a/queue-6.8/dm-integrity-fix-out-of-range-warning.patch b/queue-6.8/dm-integrity-fix-out-of-range-warning.patch new file mode 100644 index 00000000000..12cdffbf70d --- /dev/null +++ b/queue-6.8/dm-integrity-fix-out-of-range-warning.patch @@ -0,0 +1,47 @@ +From 6222aedd9bdb454c19ff42bd050c83ea3420d129 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 15:30:39 +0100 +Subject: dm integrity: fix out-of-range warning + +From: Arnd Bergmann + +[ Upstream commit 8e91c2342351e0f5ef6c0a704384a7f6fc70c3b2 ] + +Depending on the value of CONFIG_HZ, clang complains about a pointless +comparison: + +drivers/md/dm-integrity.c:4085:12: error: result of comparison of + constant 42949672950 with expression of type + 'unsigned int' is always false + [-Werror,-Wtautological-constant-out-of-range-compare] + if (val >= (uint64_t)UINT_MAX * 1000 / HZ) { + +As the check remains useful for other configurations, shut up the +warning by adding a second type cast to uint64_t. + +Fixes: 468dfca38b1a ("dm integrity: add a bitmap mode") +Signed-off-by: Arnd Bergmann +Reviewed-by: Mikulas Patocka +Reviewed-by: Justin Stitt +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-integrity.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c +index 47cf1ab34941f..3b4218a2e750d 100644 +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -4221,7 +4221,7 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned int argc, char **argv + } else if (sscanf(opt_string, "sectors_per_bit:%llu%c", &llval, &dummy) == 1) { + log2_sectors_per_bitmap_bit = !llval ? 0 : __ilog2_u64(llval); + } else if (sscanf(opt_string, "bitmap_flush_interval:%u%c", &val, &dummy) == 1) { +- if (val >= (uint64_t)UINT_MAX * 1000 / HZ) { ++ if ((uint64_t)val >= (uint64_t)UINT_MAX * 1000 / HZ) { + r = -EINVAL; + ti->error = "Invalid bitmap_flush_interval argument"; + goto bad; +-- +2.43.0 + diff --git a/queue-6.8/dma-buf-fix-null-pointer-dereference-in-sanitycheck.patch b/queue-6.8/dma-buf-fix-null-pointer-dereference-in-sanitycheck.patch new file mode 100644 index 00000000000..0c46e7db65b --- /dev/null +++ b/queue-6.8/dma-buf-fix-null-pointer-dereference-in-sanitycheck.patch @@ -0,0 +1,52 @@ +From 7b1e2551ddaab8cff0996c5150877afa866f9f50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Mar 2024 04:15:23 +0500 +Subject: dma-buf: Fix NULL pointer dereference in sanitycheck() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pavel Sakharov + +[ Upstream commit 2295bd846765c766701e666ed2e4b35396be25e6 ] + +If due to a memory allocation failure mock_chain() returns NULL, it is +passed to dma_fence_enable_sw_signaling() resulting in NULL pointer +dereference there. + +Call dma_fence_enable_sw_signaling() only if mock_chain() succeeds. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: d62c43a953ce ("dma-buf: Enable signaling on fence for selftests") +Signed-off-by: Pavel Sakharov +Reviewed-by: Christian König +Signed-off-by: Christian König +Link: https://patchwork.freedesktop.org/patch/msgid/20240319231527.1821372-1-p.sakharov@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/dma-buf/st-dma-fence-chain.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/dma-buf/st-dma-fence-chain.c b/drivers/dma-buf/st-dma-fence-chain.c +index 9c2a0c082a768..ed4b323886e43 100644 +--- a/drivers/dma-buf/st-dma-fence-chain.c ++++ b/drivers/dma-buf/st-dma-fence-chain.c +@@ -84,11 +84,11 @@ static int sanitycheck(void *arg) + return -ENOMEM; + + chain = mock_chain(NULL, f, 1); +- if (!chain) ++ if (chain) ++ dma_fence_enable_sw_signaling(chain); ++ else + err = -ENOMEM; + +- dma_fence_enable_sw_signaling(chain); +- + dma_fence_signal(f); + dma_fence_put(f); + +-- +2.43.0 + diff --git a/queue-6.8/dpll-indent-dpll-option-type-by-a-tab.patch b/queue-6.8/dpll-indent-dpll-option-type-by-a-tab.patch new file mode 100644 index 00000000000..dd03e9dda36 --- /dev/null +++ b/queue-6.8/dpll-indent-dpll-option-type-by-a-tab.patch @@ -0,0 +1,36 @@ +From 292b4280a7ae7822a0d496b2f1b870215f2eb02c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Mar 2024 17:18:19 +0530 +Subject: dpll: indent DPLL option type by a tab + +From: Prasad Pandit + +[ Upstream commit cc2699268152d8e0386a36fe7c9271d7e23668f2 ] + +Indent config option type by a tab. It helps Kconfig parsers +to read file without error. + +Fixes: 9431063ad323 ("dpll: core: Add DPLL framework base functions") +Signed-off-by: Prasad Pandit +Reviewed-by: Vadim Fedorenko +Reviewed-by: Jiri Pirko +Link: https://lore.kernel.org/r/20240322114819.1801795-1-ppandit@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/dpll/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dpll/Kconfig b/drivers/dpll/Kconfig +index a4cae73f20d3d..20607ed542435 100644 +--- a/drivers/dpll/Kconfig ++++ b/drivers/dpll/Kconfig +@@ -4,4 +4,4 @@ + # + + config DPLL +- bool ++ bool +-- +2.43.0 + diff --git a/queue-6.8/drm-amd-display-send-dtbclk-disable-message-on-first.patch b/queue-6.8/drm-amd-display-send-dtbclk-disable-message-on-first.patch new file mode 100644 index 00000000000..aaca5a125b2 --- /dev/null +++ b/queue-6.8/drm-amd-display-send-dtbclk-disable-message-on-first.patch @@ -0,0 +1,43 @@ +From 3d1629445de53486915343e4bc4b3fda7aa0fb91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jan 2024 18:10:54 -0500 +Subject: drm/amd/display: Send DTBCLK disable message on first commit + +From: Taimur Hassan + +[ Upstream commit f341055b10bd8be55c3c995dff5f770b236b8ca9 ] + +[Why] +Previous patch to allow DTBCLK disable didn't address boot case. Driver +thinks DTBCLK is disabled by default, so we don't send disable message to +PMFW. DTBCLK is then enabled at idle desktop on boot, burning power. + +[How] +Set dtbclk_en to true on boot so that disable message is sent during first +commit. + +Reviewed-by: Nicholas Kazlauskas +Acked-by: Tom Chung +Signed-off-by: Taimur Hassan +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c +index 9cbab880c6233..f07629694ec5e 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c +@@ -415,6 +415,7 @@ void dcn35_init_clocks(struct clk_mgr *clk_mgr) + memset(&(clk_mgr->clks), 0, sizeof(struct dc_clocks)); + + // Assumption is that boot state always supports pstate ++ clk_mgr->clks.dtbclk_en = true; + clk_mgr->clks.ref_dtbclk_khz = ref_dtbclk; // restore ref_dtbclk + clk_mgr->clks.p_state_change_support = true; + clk_mgr->clks.prev_p_state_change_support = true; +-- +2.43.0 + diff --git a/queue-6.8/drm-amd-display-update-p010-scaling-cap.patch b/queue-6.8/drm-amd-display-update-p010-scaling-cap.patch new file mode 100644 index 00000000000..7723f8cf139 --- /dev/null +++ b/queue-6.8/drm-amd-display-update-p010-scaling-cap.patch @@ -0,0 +1,84 @@ +From e27495ba2487d5286099888aba11f03c2050b65e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jan 2024 17:09:30 -0500 +Subject: drm/amd/display: Update P010 scaling cap + +From: Charlene Liu + +[ Upstream commit 038c532346418fb5ab09c8fc6d650283d9a02966 ] + +[Why] +Keep the same as previous APU and also insert clock dump + +Reviewed-by: Ovidiu Bunea +Acked-by: Alex Hung +Signed-off-by: Charlene Liu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Stable-dep-of: f341055b10bd ("drm/amd/display: Send DTBCLK disable message on first commit") +Signed-off-by: Sasha Levin +--- + .../display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 25 +++++++++---------- + .../dc/resource/dcn35/dcn35_resource.c | 2 +- + 2 files changed, 13 insertions(+), 14 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c +index 3db46bdc71a35..9cbab880c6233 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c +@@ -384,19 +384,6 @@ static void dcn35_enable_pme_wa(struct clk_mgr *clk_mgr_base) + dcn35_smu_enable_pme_wa(clk_mgr); + } + +-void dcn35_init_clocks(struct clk_mgr *clk_mgr) +-{ +- uint32_t ref_dtbclk = clk_mgr->clks.ref_dtbclk_khz; +- +- memset(&(clk_mgr->clks), 0, sizeof(struct dc_clocks)); +- +- // Assumption is that boot state always supports pstate +- clk_mgr->clks.ref_dtbclk_khz = ref_dtbclk; // restore ref_dtbclk +- clk_mgr->clks.p_state_change_support = true; +- clk_mgr->clks.prev_p_state_change_support = true; +- clk_mgr->clks.pwr_state = DCN_PWR_STATE_UNKNOWN; +- clk_mgr->clks.zstate_support = DCN_ZSTATE_SUPPORT_UNKNOWN; +-} + + bool dcn35_are_clock_states_equal(struct dc_clocks *a, + struct dc_clocks *b) +@@ -421,7 +408,19 @@ static void dcn35_dump_clk_registers(struct clk_state_registers_and_bypass *regs + struct clk_mgr_dcn35 *clk_mgr) + { + } ++void dcn35_init_clocks(struct clk_mgr *clk_mgr) ++{ ++ uint32_t ref_dtbclk = clk_mgr->clks.ref_dtbclk_khz; + ++ memset(&(clk_mgr->clks), 0, sizeof(struct dc_clocks)); ++ ++ // Assumption is that boot state always supports pstate ++ clk_mgr->clks.ref_dtbclk_khz = ref_dtbclk; // restore ref_dtbclk ++ clk_mgr->clks.p_state_change_support = true; ++ clk_mgr->clks.prev_p_state_change_support = true; ++ clk_mgr->clks.pwr_state = DCN_PWR_STATE_UNKNOWN; ++ clk_mgr->clks.zstate_support = DCN_ZSTATE_SUPPORT_UNKNOWN; ++} + static struct clk_bw_params dcn35_bw_params = { + .vram_type = Ddr4MemType, + .num_channels = 1, +diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c +index 5fdcda8f86026..04d230aa8861f 100644 +--- a/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c +@@ -701,7 +701,7 @@ static const struct dc_plane_cap plane_cap = { + + // 6:1 downscaling ratio: 1000/6 = 166.666 + .max_downscale_factor = { +- .argb8888 = 167, ++ .argb8888 = 250, + .nv12 = 167, + .fp16 = 167 + }, +-- +2.43.0 + diff --git a/queue-6.8/drm-i915-display-disable-auxccs-framebuffers-if-buil.patch b/queue-6.8/drm-i915-display-disable-auxccs-framebuffers-if-buil.patch new file mode 100644 index 00000000000..0fb21b4059d --- /dev/null +++ b/queue-6.8/drm-i915-display-disable-auxccs-framebuffers-if-buil.patch @@ -0,0 +1,49 @@ +From 8cddb4c1bca38259402d62b85b5084c661a0874e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 16:02:25 +0200 +Subject: drm/i915/display: Disable AuxCCS framebuffers if built for Xe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Juha-Pekka Heikkila + +[ Upstream commit cf48bddd31deefb9ab07de9a4d0150da6610198a ] + +AuxCCS framebuffers don't work on Xe driver hence disable them +from plane capabilities until they are fixed. FlatCCS framebuffers +work and they are left enabled. CCS is left untouched for i915 +driver. + +Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/933 +Signed-off-by: Juha-Pekka Heikkila +Reviewed-by: José Roberto de Souza +Tested-by: José Roberto de Souza +Acked-by: Jani Nikula +Fixes: 44e694958b95 ("drm/xe/display: Implement display support") +Signed-off-by: José Roberto de Souza +Link: https://patchwork.freedesktop.org/patch/msgid/20240228140225.858145-1-juhapekka.heikkila@gmail.com +(cherry picked from commit b7232a730fbf043f54fb46fbf4a6e92936770e79) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/skl_universal_plane.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/i915/display/skl_universal_plane.c b/drivers/gpu/drm/i915/display/skl_universal_plane.c +index 511dc1544854f..8bba6c2e50989 100644 +--- a/drivers/gpu/drm/i915/display/skl_universal_plane.c ++++ b/drivers/gpu/drm/i915/display/skl_universal_plane.c +@@ -2290,6 +2290,9 @@ static u8 skl_get_plane_caps(struct drm_i915_private *i915, + if (HAS_4TILE(i915)) + caps |= INTEL_PLANE_CAP_TILING_4; + ++ if (!IS_ENABLED(I915) && !HAS_FLAT_CCS(i915)) ++ return caps; ++ + if (skl_plane_has_rc_ccs(i915, pipe, plane_id)) { + caps |= INTEL_PLANE_CAP_CCS_RC; + if (DISPLAY_VER(i915) >= 12) +-- +2.43.0 + diff --git a/queue-6.8/drm-i915-do-not-print-pxp-init-failed-with-0-when-it.patch b/queue-6.8/drm-i915-do-not-print-pxp-init-failed-with-0-when-it.patch new file mode 100644 index 00000000000..8267a4c4579 --- /dev/null +++ b/queue-6.8/drm-i915-do-not-print-pxp-init-failed-with-0-when-it.patch @@ -0,0 +1,43 @@ +From 0db7916ef561c4480e87586cda3084fa67293674 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Mar 2024 14:05:47 -0700 +Subject: drm/i915: Do not print 'pxp init failed with 0' when it succeed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: José Roberto de Souza + +[ Upstream commit d392e1b9c2e8c60550a2a467732107f0f98b8e97 ] + +It is misleading, if the intention was to also print something +in case it succeed it should have a different string. + +Cc: Alan Previn +Signed-off-by: José Roberto de Souza +Fixes: 698e19da2914 ("drm/i915: Skip pxp init if gt is wedged") +Reviewed-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20240320210547.71937-1-jose.souza@intel.com +(cherry picked from commit d437099ab21cd4c6ce5d578b765df642d759c929) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/i915_driver.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/i915_driver.c b/drivers/gpu/drm/i915/i915_driver.c +index c7d7c3b7ecc63..9967148aedf15 100644 +--- a/drivers/gpu/drm/i915/i915_driver.c ++++ b/drivers/gpu/drm/i915/i915_driver.c +@@ -799,7 +799,7 @@ int i915_driver_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + goto out_cleanup_modeset2; + + ret = intel_pxp_init(i915); +- if (ret != -ENODEV) ++ if (ret && ret != -ENODEV) + drm_dbg(&i915->drm, "pxp init failed with %d\n", ret); + + ret = intel_display_driver_probe(i915); +-- +2.43.0 + diff --git a/queue-6.8/drm-i915-mtl-update-workaround-14018575942.patch b/queue-6.8/drm-i915-mtl-update-workaround-14018575942.patch new file mode 100644 index 00000000000..17e9eb09eb6 --- /dev/null +++ b/queue-6.8/drm-i915-mtl-update-workaround-14018575942.patch @@ -0,0 +1,48 @@ +From 1323f55fd895f32ad05847d2b4e51ad076287acc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 16:07:38 +0530 +Subject: drm/i915/mtl: Update workaround 14018575942 + +From: Tejas Upadhyay + +[ Upstream commit 186bce682772e7346bf7ced5325b5f4ff050ccfb ] + +Applying WA 14018575942 only on Compute engine has impact on +some apps like chrome. Updating this WA to apply on Render +engine as well as it is helping with performance on Chrome. + +Note: There is no concern from media team thus not applying +WA on media engines. We will revisit if any issues reported +from media team. + +V2(Matt): + - Use correct WA number + +Fixes: 668f37e1ee11 ("drm/i915/mtl: Update workaround 14018778641") +Signed-off-by: Tejas Upadhyay +Reviewed-by: Matt Roper +Reviewed-by: Andi Shyti +Signed-off-by: Andi Shyti +Link: https://patchwork.freedesktop.org/patch/msgid/20240228103738.2018458-1-tejas.upadhyay@intel.com +(cherry picked from commit 71271280175aa0ed6673e40cce7c01296bcd05f6) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_workarounds.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c +index 72dac27d9332f..c7561d7c55f5e 100644 +--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c ++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c +@@ -1649,6 +1649,7 @@ static void + xelpg_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) + { + /* Wa_14018575942 / Wa_18018781329 */ ++ wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB); + wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB); + + /* Wa_22016670082 */ +-- +2.43.0 + diff --git a/queue-6.8/drm-i915-stop-doing-double-audio-enable-disable-on-s.patch b/queue-6.8/drm-i915-stop-doing-double-audio-enable-disable-on-s.patch new file mode 100644 index 00000000000..0cee46b5513 --- /dev/null +++ b/queue-6.8/drm-i915-stop-doing-double-audio-enable-disable-on-s.patch @@ -0,0 +1,75 @@ +From bb94ff860e03e458768bacc94ba2593c0e4c217c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Feb 2024 21:32:50 +0200 +Subject: drm/i915: Stop doing double audio enable/disable on SDVO and g4x+ DP +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +[ Upstream commit f378ab7870046704fb92e64d50a67dda2cae8420 ] + +Looks like I misplaced a few hunks when I moved the audio +enable/disable out from the encoder enable/disable hooks. +So we are now doing a double audio enable/disable on SDVO +and g4x+ DP. Probably harmless as doing it twice shouldn't +really change anything, but let's do it just once, as intended. + +Fixes: cff742cc6851 ("drm/i915: Hoist the encoder->audio_{enable,disable}() calls higher up") +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20240226193251.29619-1-ville.syrjala@linux.intel.com +Reviewed-by: Jani Nikula +(cherry picked from commit 315bd0a0825776d6c66d474bf572db64fa019ad8) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/g4x_dp.c | 2 -- + drivers/gpu/drm/i915/display/intel_sdvo.c | 4 ---- + 2 files changed, 6 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/g4x_dp.c b/drivers/gpu/drm/i915/display/g4x_dp.c +index dfe0b07a122d1..06ec04e667e32 100644 +--- a/drivers/gpu/drm/i915/display/g4x_dp.c ++++ b/drivers/gpu/drm/i915/display/g4x_dp.c +@@ -717,7 +717,6 @@ static void g4x_enable_dp(struct intel_atomic_state *state, + { + intel_enable_dp(state, encoder, pipe_config, conn_state); + intel_edp_backlight_on(pipe_config, conn_state); +- encoder->audio_enable(encoder, pipe_config, conn_state); + } + + static void vlv_enable_dp(struct intel_atomic_state *state, +@@ -726,7 +725,6 @@ static void vlv_enable_dp(struct intel_atomic_state *state, + const struct drm_connector_state *conn_state) + { + intel_edp_backlight_on(pipe_config, conn_state); +- encoder->audio_enable(encoder, pipe_config, conn_state); + } + + static void g4x_pre_enable_dp(struct intel_atomic_state *state, +diff --git a/drivers/gpu/drm/i915/display/intel_sdvo.c b/drivers/gpu/drm/i915/display/intel_sdvo.c +index 2915d7afe5ccc..cc978ee6d1309 100644 +--- a/drivers/gpu/drm/i915/display/intel_sdvo.c ++++ b/drivers/gpu/drm/i915/display/intel_sdvo.c +@@ -1830,8 +1830,6 @@ static void intel_disable_sdvo(struct intel_atomic_state *state, + struct intel_crtc *crtc = to_intel_crtc(old_crtc_state->uapi.crtc); + u32 temp; + +- encoder->audio_disable(encoder, old_crtc_state, conn_state); +- + intel_sdvo_set_active_outputs(intel_sdvo, 0); + if (0) + intel_sdvo_set_encoder_power_state(intel_sdvo, +@@ -1923,8 +1921,6 @@ static void intel_enable_sdvo(struct intel_atomic_state *state, + intel_sdvo_set_encoder_power_state(intel_sdvo, + DRM_MODE_DPMS_ON); + intel_sdvo_set_active_outputs(intel_sdvo, intel_sdvo_connector->output_flag); +- +- encoder->audio_enable(encoder, pipe_config, conn_state); + } + + static enum drm_mode_status +-- +2.43.0 + diff --git a/queue-6.8/drm-i915-xelpg-extend-some-workarounds-tuning-to-gfx.patch b/queue-6.8/drm-i915-xelpg-extend-some-workarounds-tuning-to-gfx.patch new file mode 100644 index 00000000000..65a66e8f2e1 --- /dev/null +++ b/queue-6.8/drm-i915-xelpg-extend-some-workarounds-tuning-to-gfx.patch @@ -0,0 +1,150 @@ +From 0ad0b2ad69e2069b00410fcaf157cf7444f59d40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jan 2024 17:57:38 +0530 +Subject: drm/i915/xelpg: Extend some workarounds/tuning to gfx version 12.74 + +From: Matt Roper + +[ Upstream commit c44d4ef47fdad0a33966de89f9064e19736bb52f ] + +Some of our existing Xe_LPG workarounds and tuning are also applicable +to the version 12.74 variant. Extend the condition bounds accordingly. +Also fix the comment on Wa_14018575942 while we're at it. + +v2: Extend some more workarounds (Harish) + +Signed-off-by: Matt Roper +Signed-off-by: Harish Chegondi +Signed-off-by: Haridhar Kalvala +Reviewed-by: Matt Atwood +Link: https://patchwork.freedesktop.org/patch/msgid/20240108122738.14399-4-haridhar.kalvala@intel.com +Stable-dep-of: 186bce682772 ("drm/i915/mtl: Update workaround 14018575942") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/gen8_engine_cs.c | 4 ++-- + drivers/gpu/drm/i915/gt/intel_workarounds.c | 24 +++++++++++++-------- + drivers/gpu/drm/i915/i915_perf.c | 2 +- + 3 files changed, 18 insertions(+), 12 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/gen8_engine_cs.c b/drivers/gpu/drm/i915/gt/gen8_engine_cs.c +index 86a04afff64b3..e1bf13e3d3070 100644 +--- a/drivers/gpu/drm/i915/gt/gen8_engine_cs.c ++++ b/drivers/gpu/drm/i915/gt/gen8_engine_cs.c +@@ -226,7 +226,7 @@ u32 *gen12_emit_aux_table_inv(struct intel_engine_cs *engine, u32 *cs) + static int mtl_dummy_pipe_control(struct i915_request *rq) + { + /* Wa_14016712196 */ +- if (IS_GFX_GT_IP_RANGE(rq->engine->gt, IP_VER(12, 70), IP_VER(12, 71)) || ++ if (IS_GFX_GT_IP_RANGE(rq->engine->gt, IP_VER(12, 70), IP_VER(12, 74)) || + IS_DG2(rq->i915)) { + u32 *cs; + +@@ -822,7 +822,7 @@ u32 *gen12_emit_fini_breadcrumb_rcs(struct i915_request *rq, u32 *cs) + flags |= PIPE_CONTROL_FLUSH_L3; + + /* Wa_14016712196 */ +- if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 71)) || IS_DG2(i915)) ++ if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 74)) || IS_DG2(i915)) + /* dummy PIPE_CONTROL + depth flush */ + cs = gen12_emit_pipe_control(cs, 0, + PIPE_CONTROL_DEPTH_CACHE_FLUSH, 0); +diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c +index 3eacbc50caf8d..72dac27d9332f 100644 +--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c ++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c +@@ -789,8 +789,13 @@ static void xelpg_ctx_gt_tuning_init(struct intel_engine_cs *engine, + + dg2_ctx_gt_tuning_init(engine, wal); + +- if (IS_GFX_GT_IP_STEP(gt, IP_VER(12, 70), STEP_B0, STEP_FOREVER) || +- IS_GFX_GT_IP_STEP(gt, IP_VER(12, 71), STEP_B0, STEP_FOREVER)) ++ /* ++ * Due to Wa_16014892111, the DRAW_WATERMARK tuning must be done in ++ * gen12_emit_indirect_ctx_rcs() rather than here on some early ++ * steppings. ++ */ ++ if (!(IS_GFX_GT_IP_STEP(gt, IP_VER(12, 70), STEP_A0, STEP_B0) || ++ IS_GFX_GT_IP_STEP(gt, IP_VER(12, 71), STEP_A0, STEP_B0))) + wa_add(wal, DRAW_WATERMARK, VERT_WM_VAL, 0x3FF, 0, false); + } + +@@ -908,7 +913,7 @@ __intel_engine_init_ctx_wa(struct intel_engine_cs *engine, + if (engine->class != RENDER_CLASS) + goto done; + +- if (IS_GFX_GT_IP_RANGE(engine->gt, IP_VER(12, 70), IP_VER(12, 71))) ++ if (IS_GFX_GT_IP_RANGE(engine->gt, IP_VER(12, 70), IP_VER(12, 74))) + xelpg_ctx_workarounds_init(engine, wal); + else if (IS_PONTEVECCHIO(i915)) + ; /* noop; none at this time */ +@@ -1643,7 +1648,7 @@ pvc_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) + static void + xelpg_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) + { +- /* Wa_14018778641 / Wa_18018781329 */ ++ /* Wa_14018575942 / Wa_18018781329 */ + wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB); + + /* Wa_22016670082 */ +@@ -1710,7 +1715,7 @@ xelpmp_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) + */ + static void gt_tuning_settings(struct intel_gt *gt, struct i915_wa_list *wal) + { +- if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 71))) { ++ if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 74))) { + wa_mcr_write_or(wal, XEHP_L3SCQREG7, BLEND_FILL_CACHING_OPT_DIS); + wa_mcr_write_or(wal, XEHP_SQCM, EN_32B_ACCESS); + } +@@ -1743,7 +1748,7 @@ gt_init_workarounds(struct intel_gt *gt, struct i915_wa_list *wal) + return; + } + +- if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 71))) ++ if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 74))) + xelpg_gt_workarounds_init(gt, wal); + else if (IS_PONTEVECCHIO(i915)) + pvc_gt_workarounds_init(gt, wal); +@@ -2216,7 +2221,7 @@ void intel_engine_init_whitelist(struct intel_engine_cs *engine) + + if (engine->gt->type == GT_MEDIA) + ; /* none yet */ +- else if (IS_GFX_GT_IP_RANGE(engine->gt, IP_VER(12, 70), IP_VER(12, 71))) ++ else if (IS_GFX_GT_IP_RANGE(engine->gt, IP_VER(12, 70), IP_VER(12, 74))) + xelpg_whitelist_build(engine); + else if (IS_PONTEVECCHIO(i915)) + pvc_whitelist_build(engine); +@@ -2828,7 +2833,7 @@ add_render_compute_tuning_settings(struct intel_gt *gt, + { + struct drm_i915_private *i915 = gt->i915; + +- if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 71)) || IS_DG2(i915)) ++ if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 74)) || IS_DG2(i915)) + wa_mcr_write_clr_set(wal, RT_CTRL, STACKID_CTRL, STACKID_CTRL_512); + + /* +@@ -2881,7 +2886,8 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li + } + + if (IS_GFX_GT_IP_STEP(gt, IP_VER(12, 70), STEP_B0, STEP_FOREVER) || +- IS_GFX_GT_IP_STEP(gt, IP_VER(12, 71), STEP_B0, STEP_FOREVER)) ++ IS_GFX_GT_IP_STEP(gt, IP_VER(12, 71), STEP_B0, STEP_FOREVER) || ++ IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 74), IP_VER(12, 74))) + /* Wa_14017856879 */ + wa_mcr_masked_en(wal, GEN9_ROW_CHICKEN3, MTL_DISABLE_FIX_FOR_EOT_FLUSH); + +diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c +index 2d695818f0062..bd9d812b1afa7 100644 +--- a/drivers/gpu/drm/i915/i915_perf.c ++++ b/drivers/gpu/drm/i915/i915_perf.c +@@ -3225,7 +3225,7 @@ u32 i915_perf_oa_timestamp_frequency(struct drm_i915_private *i915) + struct intel_gt *gt = to_gt(i915); + + /* Wa_18013179988 */ +- if (IS_DG2(i915) || IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 71))) { ++ if (IS_DG2(i915) || IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 74))) { + intel_wakeref_t wakeref; + u32 reg, shift; + +-- +2.43.0 + diff --git a/queue-6.8/drm-rockchip-vop2-remove-ar30-and-ab30-format-suppor.patch b/queue-6.8/drm-rockchip-vop2-remove-ar30-and-ab30-format-suppor.patch new file mode 100644 index 00000000000..9bcd565c430 --- /dev/null +++ b/queue-6.8/drm-rockchip-vop2-remove-ar30-and-ab30-format-suppor.patch @@ -0,0 +1,40 @@ +From b545824122a55d951b60d016197b850ff9dee051 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 18:09:52 +0800 +Subject: drm/rockchip: vop2: Remove AR30 and AB30 format support + +From: Andy Yan + +[ Upstream commit 905f7d53a1bc105b22d9ffd03dc11b6b42ec6ba6 ] + +The Alpha blending for 30 bit RGB/BGR are not +functioning properly for rk3568/rk3588, so remove +it from the format list. + +Fixes: bfd8a5c228fa ("drm/rockchip: vop2: Add more supported 10bit formats") +Signed-off-by: Andy Yan +Acked-by: Sascha Hauer +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20240304100952.3592984-1-andyshrk@163.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_vop2_reg.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_vop2_reg.c b/drivers/gpu/drm/rockchip/rockchip_vop2_reg.c +index 48170694ac6b8..18efb3fe1c000 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_vop2_reg.c ++++ b/drivers/gpu/drm/rockchip/rockchip_vop2_reg.c +@@ -17,9 +17,7 @@ + + static const uint32_t formats_cluster[] = { + DRM_FORMAT_XRGB2101010, +- DRM_FORMAT_ARGB2101010, + DRM_FORMAT_XBGR2101010, +- DRM_FORMAT_ABGR2101010, + DRM_FORMAT_XRGB8888, + DRM_FORMAT_ARGB8888, + DRM_FORMAT_XBGR8888, +-- +2.43.0 + diff --git a/queue-6.8/drm-xe-add-exec_queue.sched_props.job_timeout_ms.patch b/queue-6.8/drm-xe-add-exec_queue.sched_props.job_timeout_ms.patch new file mode 100644 index 00000000000..1ef1c5fab90 --- /dev/null +++ b/queue-6.8/drm-xe-add-exec_queue.sched_props.job_timeout_ms.patch @@ -0,0 +1,71 @@ +From f7bf7d8afe2edc81ecde6e234ad4d378f045f6fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jan 2024 09:32:50 -0800 +Subject: drm/xe: Add exec_queue.sched_props.job_timeout_ms + +From: Brian Welty + +[ Upstream commit 6ae24344e2e3e12e06f7b382af4bba2fd417b2ff ] + +The purpose here is to allow to optimize exec_queue_set_job_timeout() +in follow-on patch. Currently it does q->ops->set_job_timeout(...). +But we'd like to apply exec_queue_user_extensions much earlier and +q->ops cannot be called before __xe_exec_queue_init(). + +It will be much more efficient to instead only have to set +q->sched_props.job_timeout_ms when applying user extensions. That value +will then be used during q->ops->init(). + +Signed-off-by: Brian Welty +Signed-off-by: Matthew Brost +Reviewed-by: Matthew Brost +Stable-dep-of: 9c1256369c10 ("drm/xe/guc_submit: use jiffies for job timeout") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_exec_queue.c | 2 ++ + drivers/gpu/drm/xe/xe_exec_queue_types.h | 2 ++ + drivers/gpu/drm/xe/xe_guc_submit.c | 2 +- + 3 files changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/xe/xe_exec_queue.c b/drivers/gpu/drm/xe/xe_exec_queue.c +index 49223026c89fd..a176d9ad6d1b8 100644 +--- a/drivers/gpu/drm/xe/xe_exec_queue.c ++++ b/drivers/gpu/drm/xe/xe_exec_queue.c +@@ -66,6 +66,8 @@ static struct xe_exec_queue *__xe_exec_queue_create(struct xe_device *xe, + q->sched_props.timeslice_us = hwe->eclass->sched_props.timeslice_us; + q->sched_props.preempt_timeout_us = + hwe->eclass->sched_props.preempt_timeout_us; ++ q->sched_props.job_timeout_ms = ++ hwe->eclass->sched_props.job_timeout_ms; + if (q->flags & EXEC_QUEUE_FLAG_KERNEL && + q->flags & EXEC_QUEUE_FLAG_HIGH_PRIORITY) + q->sched_props.priority = XE_EXEC_QUEUE_PRIORITY_KERNEL; +diff --git a/drivers/gpu/drm/xe/xe_exec_queue_types.h b/drivers/gpu/drm/xe/xe_exec_queue_types.h +index 36f4901d8d7ee..747106584f752 100644 +--- a/drivers/gpu/drm/xe/xe_exec_queue_types.h ++++ b/drivers/gpu/drm/xe/xe_exec_queue_types.h +@@ -132,6 +132,8 @@ struct xe_exec_queue { + u32 timeslice_us; + /** @preempt_timeout_us: preemption timeout in micro-seconds */ + u32 preempt_timeout_us; ++ /** @job_timeout_ms: job timeout in milliseconds */ ++ u32 job_timeout_ms; + /** @priority: priority of this exec queue */ + enum xe_exec_queue_priority priority; + } sched_props; +diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c +index f22ae717b0b2d..9d5e3afef5057 100644 +--- a/drivers/gpu/drm/xe/xe_guc_submit.c ++++ b/drivers/gpu/drm/xe/xe_guc_submit.c +@@ -1216,7 +1216,7 @@ static int guc_exec_queue_init(struct xe_exec_queue *q) + init_waitqueue_head(&ge->suspend_wait); + + timeout = (q->vm && xe_vm_in_lr_mode(q->vm)) ? MAX_SCHEDULE_TIMEOUT : +- q->hwe->eclass->sched_props.job_timeout_ms; ++ q->sched_props.job_timeout_ms; + err = xe_sched_init(&ge->sched, &drm_sched_ops, &xe_sched_ops, + get_submit_wq(guc), + q->lrc[0].ring.size / MAX_JOB_SIZE_BYTES, 64, +-- +2.43.0 + diff --git a/queue-6.8/drm-xe-device-fix-xe_max_gt_per_tile-check.patch b/queue-6.8/drm-xe-device-fix-xe_max_gt_per_tile-check.patch new file mode 100644 index 00000000000..e170c6cf64d --- /dev/null +++ b/queue-6.8/drm-xe-device-fix-xe_max_gt_per_tile-check.patch @@ -0,0 +1,40 @@ +From 430d33b31c2a4e274f4f4f1e7289124d7ccc66eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Mar 2024 18:05:34 +0000 +Subject: drm/xe/device: fix XE_MAX_GT_PER_TILE check + +From: Matthew Auld + +[ Upstream commit 23e1ee3a2317f41f47d4f7255257431c5f8d1c2c ] + +Here XE_MAX_GT_PER_TILE is the total, therefore the gt index should +always be less than. + +Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") +Signed-off-by: Matthew Auld +Cc: Nirmoy Das +Reviewed-by: Nirmoy Das +Link: https://patchwork.freedesktop.org/patch/msgid/20240318180532.57522-5-matthew.auld@intel.com +(cherry picked from commit a5ef563b1d676548a4c5016540833ff970230964) +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_device.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/xe/xe_device.h b/drivers/gpu/drm/xe/xe_device.h +index 08d8b72c77319..ee8be4c6b59b1 100644 +--- a/drivers/gpu/drm/xe/xe_device.h ++++ b/drivers/gpu/drm/xe/xe_device.h +@@ -58,7 +58,7 @@ static inline struct xe_tile *xe_device_get_root_tile(struct xe_device *xe) + + static inline struct xe_gt *xe_tile_get_gt(struct xe_tile *tile, u8 gt_id) + { +- if (drm_WARN_ON(&tile_to_xe(tile)->drm, gt_id > XE_MAX_GT_PER_TILE)) ++ if (drm_WARN_ON(&tile_to_xe(tile)->drm, gt_id >= XE_MAX_GT_PER_TILE)) + gt_id = 0; + + return gt_id ? tile->media_gt : tile->primary_gt; +-- +2.43.0 + diff --git a/queue-6.8/drm-xe-device-fix-xe_max_tiles_per_device-check.patch b/queue-6.8/drm-xe-device-fix-xe_max_tiles_per_device-check.patch new file mode 100644 index 00000000000..1f87dbbaf40 --- /dev/null +++ b/queue-6.8/drm-xe-device-fix-xe_max_tiles_per_device-check.patch @@ -0,0 +1,45 @@ +From 9e79a87326146e35411264167ec24a3489b26dc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Mar 2024 18:05:35 +0000 +Subject: drm/xe/device: fix XE_MAX_TILES_PER_DEVICE check + +From: Matthew Auld + +[ Upstream commit b45f20fa69cedb6038fdaec31bd600c273c865a5 ] + +Here XE_MAX_TILES_PER_DEVICE is the gt array size, therefore the gt +index should always be less than. + +v2 (Lucas): + - Add fixes tag. + +Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") +Signed-off-by: Matthew Auld +Cc: Nirmoy Das +Reviewed-by: Nirmoy Das +Acked-by: Lucas De Marchi +Reviewed-by: Rodrigo Vivi +Link: https://patchwork.freedesktop.org/patch/msgid/20240318180532.57522-6-matthew.auld@intel.com +(cherry picked from commit a96cd71ec7be0790f9fc4039ad21be8d214b03a4) +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_device.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/xe/xe_device.h b/drivers/gpu/drm/xe/xe_device.h +index ee8be4c6b59b1..bf8efb44edf60 100644 +--- a/drivers/gpu/drm/xe/xe_device.h ++++ b/drivers/gpu/drm/xe/xe_device.h +@@ -79,7 +79,7 @@ static inline struct xe_gt *xe_device_get_gt(struct xe_device *xe, u8 gt_id) + if (MEDIA_VER(xe) >= 13) { + gt = xe_tile_get_gt(root_tile, gt_id); + } else { +- if (drm_WARN_ON(&xe->drm, gt_id > XE_MAX_TILES_PER_DEVICE)) ++ if (drm_WARN_ON(&xe->drm, gt_id >= XE_MAX_TILES_PER_DEVICE)) + gt_id = 0; + + gt = xe->tiles[gt_id].primary_gt; +-- +2.43.0 + diff --git a/queue-6.8/drm-xe-guc_submit-use-jiffies-for-job-timeout.patch b/queue-6.8/drm-xe-guc_submit-use-jiffies-for-job-timeout.patch new file mode 100644 index 00000000000..f065ec84cfd --- /dev/null +++ b/queue-6.8/drm-xe-guc_submit-use-jiffies-for-job-timeout.patch @@ -0,0 +1,42 @@ +From 1e11059d1cad4a6f6634e3f3c91ba49fd3f4b863 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 12:15:55 +0000 +Subject: drm/xe/guc_submit: use jiffies for job timeout + +From: Matthew Auld + +[ Upstream commit 9c1256369c10e31b5ce6575e4ea27fe2c375fd94 ] + +drm_sched_init() expects jiffies for the timeout, but here we are +passing the timeout in ms. Convert to jiffies instead. + +Fixes: eef55700f302 ("drm/xe: Add sysfs for default engine scheduler properties") +Signed-off-by: Matthew Auld +Cc: Matthew Brost +Reviewed-by: Nirmoy Das +Reviewed-by: Matthew Brost +Link: https://patchwork.freedesktop.org/patch/msgid/20240314121554.223229-2-matthew.auld@intel.com +Signed-off-by: Lucas De Marchi +(cherry picked from commit 2c5b70f74d61438a071a19370e63c234d2bd8938) +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_guc_submit.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c +index 9d5e3afef5057..bd1079aa88498 100644 +--- a/drivers/gpu/drm/xe/xe_guc_submit.c ++++ b/drivers/gpu/drm/xe/xe_guc_submit.c +@@ -1216,7 +1216,7 @@ static int guc_exec_queue_init(struct xe_exec_queue *q) + init_waitqueue_head(&ge->suspend_wait); + + timeout = (q->vm && xe_vm_in_lr_mode(q->vm)) ? MAX_SCHEDULE_TIMEOUT : +- q->sched_props.job_timeout_ms; ++ msecs_to_jiffies(q->sched_props.job_timeout_ms); + err = xe_sched_init(&ge->sched, &drm_sched_ops, &xe_sched_ops, + get_submit_wq(guc), + q->lrc[0].ring.size / MAX_JOB_SIZE_BYTES, 64, +-- +2.43.0 + diff --git a/queue-6.8/drm-xe-queue-fix-engine_class-bounds-check.patch b/queue-6.8/drm-xe-queue-fix-engine_class-bounds-check.patch new file mode 100644 index 00000000000..c1b9a92d2b6 --- /dev/null +++ b/queue-6.8/drm-xe-queue-fix-engine_class-bounds-check.patch @@ -0,0 +1,40 @@ +From 832753c0d949f9c9ba968eb87da4091408290b51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Mar 2024 18:05:33 +0000 +Subject: drm/xe/queue: fix engine_class bounds check + +From: Matthew Auld + +[ Upstream commit b7dce525c4fcc92b373136288309f8c9ca6c375f ] + +The engine_class is the index into the user_to_xe_engine_class, +therefore it needs to be less than. + +Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") +Signed-off-by: Matthew Auld +Cc: Nirmoy Das +Reviewed-by: Nirmoy Das +Link: https://patchwork.freedesktop.org/patch/msgid/20240318180532.57522-4-matthew.auld@intel.com +(cherry picked from commit fe87b7dfcb204a161d1e38b0e787b2f5ab520f32) +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_exec_queue.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/xe/xe_exec_queue.c b/drivers/gpu/drm/xe/xe_exec_queue.c +index a176d9ad6d1b8..5093c56d60ab6 100644 +--- a/drivers/gpu/drm/xe/xe_exec_queue.c ++++ b/drivers/gpu/drm/xe/xe_exec_queue.c +@@ -405,7 +405,7 @@ find_hw_engine(struct xe_device *xe, + { + u32 idx; + +- if (eci.engine_class > ARRAY_SIZE(user_to_xe_engine_class)) ++ if (eci.engine_class >= ARRAY_SIZE(user_to_xe_engine_class)) + return NULL; + + if (eci.gt_id >= xe->info.gt_count) +-- +2.43.0 + diff --git a/queue-6.8/drm-xe-remove-unused-xe_bo-props-struct.patch b/queue-6.8/drm-xe-remove-unused-xe_bo-props-struct.patch new file mode 100644 index 00000000000..ea902a45c84 --- /dev/null +++ b/queue-6.8/drm-xe-remove-unused-xe_bo-props-struct.patch @@ -0,0 +1,178 @@ +From 4a90254a0ea153834e2e61cd8c2e47637201d689 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Mar 2024 16:11:59 +0100 +Subject: drm/xe: Remove unused xe_bo->props struct +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nirmoy Das + +[ Upstream commit fd00fe8cdbb241644131ece133a2eb1c3951f21e ] + +Property struct is not being used so remove it and related dead code. + +Fixes: ddfa2d6a846a ("drm/xe/uapi: Kill VM_MADVISE IOCTL") +Cc: Rodrigo Vivi +Cc: Thomas Hellström +Cc: intel-xe@lists.freedesktop.org +Signed-off-by: Nirmoy Das +Reviewed-by: Rodrigo Vivi +Link: https://patchwork.freedesktop.org/patch/msgid/20240311151159.10036-1-nirmoy.das@intel.com +Signed-off-by: Lucas De Marchi +(cherry picked from commit 002d8f0b4f76aabbf8e00c538a124b91625d7260) +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_bo.c | 59 +++++--------------------------- + drivers/gpu/drm/xe/xe_bo_types.h | 19 ---------- + 2 files changed, 9 insertions(+), 69 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c +index 4d3b80ec906d0..eb2c44a328278 100644 +--- a/drivers/gpu/drm/xe/xe_bo.c ++++ b/drivers/gpu/drm/xe/xe_bo.c +@@ -140,9 +140,6 @@ static void try_add_system(struct xe_device *xe, struct xe_bo *bo, + .mem_type = XE_PL_TT, + }; + *c += 1; +- +- if (bo->props.preferred_mem_type == XE_BO_PROPS_INVALID) +- bo->props.preferred_mem_type = XE_PL_TT; + } + } + +@@ -177,25 +174,15 @@ static void add_vram(struct xe_device *xe, struct xe_bo *bo, + } + places[*c] = place; + *c += 1; +- +- if (bo->props.preferred_mem_type == XE_BO_PROPS_INVALID) +- bo->props.preferred_mem_type = mem_type; + } + + static void try_add_vram(struct xe_device *xe, struct xe_bo *bo, + u32 bo_flags, u32 *c) + { +- if (bo->props.preferred_gt == XE_GT1) { +- if (bo_flags & XE_BO_CREATE_VRAM1_BIT) +- add_vram(xe, bo, bo->placements, bo_flags, XE_PL_VRAM1, c); +- if (bo_flags & XE_BO_CREATE_VRAM0_BIT) +- add_vram(xe, bo, bo->placements, bo_flags, XE_PL_VRAM0, c); +- } else { +- if (bo_flags & XE_BO_CREATE_VRAM0_BIT) +- add_vram(xe, bo, bo->placements, bo_flags, XE_PL_VRAM0, c); +- if (bo_flags & XE_BO_CREATE_VRAM1_BIT) +- add_vram(xe, bo, bo->placements, bo_flags, XE_PL_VRAM1, c); +- } ++ if (bo_flags & XE_BO_CREATE_VRAM0_BIT) ++ add_vram(xe, bo, bo->placements, bo_flags, XE_PL_VRAM0, c); ++ if (bo_flags & XE_BO_CREATE_VRAM1_BIT) ++ add_vram(xe, bo, bo->placements, bo_flags, XE_PL_VRAM1, c); + } + + static void try_add_stolen(struct xe_device *xe, struct xe_bo *bo, +@@ -219,17 +206,8 @@ static int __xe_bo_placement_for_flags(struct xe_device *xe, struct xe_bo *bo, + { + u32 c = 0; + +- bo->props.preferred_mem_type = XE_BO_PROPS_INVALID; +- +- /* The order of placements should indicate preferred location */ +- +- if (bo->props.preferred_mem_class == DRM_XE_MEM_REGION_CLASS_SYSMEM) { +- try_add_system(xe, bo, bo_flags, &c); +- try_add_vram(xe, bo, bo_flags, &c); +- } else { +- try_add_vram(xe, bo, bo_flags, &c); +- try_add_system(xe, bo, bo_flags, &c); +- } ++ try_add_vram(xe, bo, bo_flags, &c); ++ try_add_system(xe, bo, bo_flags, &c); + try_add_stolen(xe, bo, bo_flags, &c); + + if (!c) +@@ -1106,19 +1084,12 @@ static void xe_gem_object_close(struct drm_gem_object *obj, + } + } + +-static bool should_migrate_to_system(struct xe_bo *bo) +-{ +- struct xe_device *xe = xe_bo_device(bo); +- +- return xe_device_in_fault_mode(xe) && bo->props.cpu_atomic; +-} +- + static vm_fault_t xe_gem_fault(struct vm_fault *vmf) + { + struct ttm_buffer_object *tbo = vmf->vma->vm_private_data; + struct drm_device *ddev = tbo->base.dev; + vm_fault_t ret; +- int idx, r = 0; ++ int idx; + + ret = ttm_bo_vm_reserve(tbo, vmf); + if (ret) +@@ -1129,17 +1100,8 @@ static vm_fault_t xe_gem_fault(struct vm_fault *vmf) + + trace_xe_bo_cpu_fault(bo); + +- if (should_migrate_to_system(bo)) { +- r = xe_bo_migrate(bo, XE_PL_TT); +- if (r == -EBUSY || r == -ERESTARTSYS || r == -EINTR) +- ret = VM_FAULT_NOPAGE; +- else if (r) +- ret = VM_FAULT_SIGBUS; +- } +- if (!ret) +- ret = ttm_bo_vm_fault_reserved(vmf, +- vmf->vma->vm_page_prot, +- TTM_BO_VM_NUM_PREFAULT); ++ ret = ttm_bo_vm_fault_reserved(vmf, vmf->vma->vm_page_prot, ++ TTM_BO_VM_NUM_PREFAULT); + drm_dev_exit(idx); + } else { + ret = ttm_bo_vm_dummy_page(vmf, vmf->vma->vm_page_prot); +@@ -1253,9 +1215,6 @@ struct xe_bo *___xe_bo_create_locked(struct xe_device *xe, struct xe_bo *bo, + bo->flags = flags; + bo->cpu_caching = cpu_caching; + bo->ttm.base.funcs = &xe_gem_object_funcs; +- bo->props.preferred_mem_class = XE_BO_PROPS_INVALID; +- bo->props.preferred_gt = XE_BO_PROPS_INVALID; +- bo->props.preferred_mem_type = XE_BO_PROPS_INVALID; + bo->ttm.priority = XE_BO_PRIORITY_NORMAL; + INIT_LIST_HEAD(&bo->pinned_link); + #ifdef CONFIG_PROC_FS +diff --git a/drivers/gpu/drm/xe/xe_bo_types.h b/drivers/gpu/drm/xe/xe_bo_types.h +index 64c2249a4e407..81dca15315d5c 100644 +--- a/drivers/gpu/drm/xe/xe_bo_types.h ++++ b/drivers/gpu/drm/xe/xe_bo_types.h +@@ -56,25 +56,6 @@ struct xe_bo { + */ + struct list_head client_link; + #endif +- /** @props: BO user controlled properties */ +- struct { +- /** @preferred_mem: preferred memory class for this BO */ +- s16 preferred_mem_class; +- /** @prefered_gt: preferred GT for this BO */ +- s16 preferred_gt; +- /** @preferred_mem_type: preferred memory type */ +- s32 preferred_mem_type; +- /** +- * @cpu_atomic: the CPU expects to do atomics operations to +- * this BO +- */ +- bool cpu_atomic; +- /** +- * @device_atomic: the device expects to do atomics operations +- * to this BO +- */ +- bool device_atomic; +- } props; + /** @freed: List node for delayed put. */ + struct llist_node freed; + /** @created: Whether the bo has passed initial creation */ +-- +2.43.0 + diff --git a/queue-6.8/gpio-protect-the-list-of-gpio-devices-with-srcu.patch b/queue-6.8/gpio-protect-the-list-of-gpio-devices-with-srcu.patch new file mode 100644 index 00000000000..16a85d4db96 --- /dev/null +++ b/queue-6.8/gpio-protect-the-list-of-gpio-devices-with-srcu.patch @@ -0,0 +1,489 @@ +From 077106f97c7d113ebacb00725d83b817d0e89288 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jan 2024 16:43:13 +0100 +Subject: gpio: protect the list of GPIO devices with SRCU + +From: Bartosz Golaszewski + +[ Upstream commit e348544f7994d252427ed3ae637c7081cbb90f66 ] + +We're working towards removing the "multi-function" GPIO spinlock that's +implemented terribly wrong. We tried using an RW-semaphore to protect +the list of GPIO devices but it turned out that we still have old code +using legacy GPIO calls that need to translate the global GPIO number to +the address of the associated descriptor and - to that end - traverse +the list while holding the lock. If we change the spinlock to a sleeping +lock then we'll end up with "scheduling while atomic" bugs. + +Let's allow lockless traversal of the list using SRCU and only use the +mutex when modyfing the list. + +While at it: let's protect the period between when we start the lookup +and when we finally request the descriptor (increasing the reference +count of the GPIO device) with the SRCU read lock. + +Signed-off-by: Bartosz Golaszewski +Reviewed-by: Linus Walleij +Acked-by: Andy Shevchenko +Stable-dep-of: 5c887b65bbd1 ("gpiolib: Fix debug messaging in gpiod_find_and_request()") +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib.c | 247 ++++++++++++++++++++++------------------- + 1 file changed, 135 insertions(+), 112 deletions(-) + +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index 3ad09d2193330..a6f1a4e2e3a4e 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -2,6 +2,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -14,12 +15,14 @@ + #include + #include + #include ++#include + #include + #include + #include + #include + #include + #include ++#include + #include + + #include +@@ -81,7 +84,12 @@ DEFINE_SPINLOCK(gpio_lock); + + static DEFINE_MUTEX(gpio_lookup_lock); + static LIST_HEAD(gpio_lookup_list); ++ + LIST_HEAD(gpio_devices); ++/* Protects the GPIO device list against concurrent modifications. */ ++static DEFINE_MUTEX(gpio_devices_lock); ++/* Ensures coherence during read-only accesses to the list of GPIO devices. */ ++DEFINE_STATIC_SRCU(gpio_devices_srcu); + + static DEFINE_MUTEX(gpio_machine_hogs_mutex); + static LIST_HEAD(gpio_machine_hogs); +@@ -113,20 +121,16 @@ static inline void desc_set_label(struct gpio_desc *d, const char *label) + struct gpio_desc *gpio_to_desc(unsigned gpio) + { + struct gpio_device *gdev; +- unsigned long flags; +- +- spin_lock_irqsave(&gpio_lock, flags); + +- list_for_each_entry(gdev, &gpio_devices, list) { +- if (gdev->base <= gpio && +- gdev->base + gdev->ngpio > gpio) { +- spin_unlock_irqrestore(&gpio_lock, flags); +- return &gdev->descs[gpio - gdev->base]; ++ scoped_guard(srcu, &gpio_devices_srcu) { ++ list_for_each_entry_srcu(gdev, &gpio_devices, list, ++ srcu_read_lock_held(&gpio_devices_srcu)) { ++ if (gdev->base <= gpio && ++ gdev->base + gdev->ngpio > gpio) ++ return &gdev->descs[gpio - gdev->base]; + } + } + +- spin_unlock_irqrestore(&gpio_lock, flags); +- + if (!gpio_is_valid(gpio)) + pr_warn("invalid GPIO %d\n", gpio); + +@@ -282,7 +286,8 @@ static int gpiochip_find_base_unlocked(int ngpio) + struct gpio_device *gdev; + int base = GPIO_DYNAMIC_BASE; + +- list_for_each_entry(gdev, &gpio_devices, list) { ++ list_for_each_entry_srcu(gdev, &gpio_devices, list, ++ lockdep_is_held(&gpio_devices_lock)) { + /* found a free space? */ + if (gdev->base >= base + ngpio) + break; +@@ -354,23 +359,25 @@ static int gpiodev_add_to_list_unlocked(struct gpio_device *gdev) + { + struct gpio_device *prev, *next; + ++ lockdep_assert_held(&gpio_devices_lock); ++ + if (list_empty(&gpio_devices)) { + /* initial entry in list */ +- list_add_tail(&gdev->list, &gpio_devices); ++ list_add_tail_rcu(&gdev->list, &gpio_devices); + return 0; + } + + next = list_first_entry(&gpio_devices, struct gpio_device, list); + if (gdev->base + gdev->ngpio <= next->base) { + /* add before first entry */ +- list_add(&gdev->list, &gpio_devices); ++ list_add_rcu(&gdev->list, &gpio_devices); + return 0; + } + + prev = list_last_entry(&gpio_devices, struct gpio_device, list); + if (prev->base + prev->ngpio <= gdev->base) { + /* add behind last entry */ +- list_add_tail(&gdev->list, &gpio_devices); ++ list_add_tail_rcu(&gdev->list, &gpio_devices); + return 0; + } + +@@ -382,11 +389,13 @@ static int gpiodev_add_to_list_unlocked(struct gpio_device *gdev) + /* add between prev and next */ + if (prev->base + prev->ngpio <= gdev->base + && gdev->base + gdev->ngpio <= next->base) { +- list_add(&gdev->list, &prev->list); ++ list_add_rcu(&gdev->list, &prev->list); + return 0; + } + } + ++ synchronize_srcu(&gpio_devices_srcu); ++ + return -EBUSY; + } + +@@ -399,26 +408,21 @@ static int gpiodev_add_to_list_unlocked(struct gpio_device *gdev) + static struct gpio_desc *gpio_name_to_desc(const char * const name) + { + struct gpio_device *gdev; +- unsigned long flags; ++ struct gpio_desc *desc; + + if (!name) + return NULL; + +- spin_lock_irqsave(&gpio_lock, flags); +- +- list_for_each_entry(gdev, &gpio_devices, list) { +- struct gpio_desc *desc; ++ guard(srcu)(&gpio_devices_srcu); + ++ list_for_each_entry_srcu(gdev, &gpio_devices, list, ++ srcu_read_lock_held(&gpio_devices_srcu)) { + for_each_gpio_desc(gdev->chip, desc) { +- if (desc->name && !strcmp(desc->name, name)) { +- spin_unlock_irqrestore(&gpio_lock, flags); ++ if (desc->name && !strcmp(desc->name, name)) + return desc; +- } + } + } + +- spin_unlock_irqrestore(&gpio_lock, flags); +- + return NULL; + } + +@@ -748,7 +752,10 @@ static void gpiochip_setup_devs(void) + struct gpio_device *gdev; + int ret; + +- list_for_each_entry(gdev, &gpio_devices, list) { ++ guard(srcu)(&gpio_devices_srcu); ++ ++ list_for_each_entry_srcu(gdev, &gpio_devices, list, ++ srcu_read_lock_held(&gpio_devices_srcu)) { + ret = gpiochip_setup_dev(gdev); + if (ret) + dev_err(&gdev->dev, +@@ -813,7 +820,6 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data, + struct lock_class_key *request_key) + { + struct gpio_device *gdev; +- unsigned long flags; + unsigned int i; + int base = 0; + int ret = 0; +@@ -878,49 +884,47 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data, + + gdev->ngpio = gc->ngpio; + +- spin_lock_irqsave(&gpio_lock, flags); +- +- /* +- * TODO: this allocates a Linux GPIO number base in the global +- * GPIO numberspace for this chip. In the long run we want to +- * get *rid* of this numberspace and use only descriptors, but +- * it may be a pipe dream. It will not happen before we get rid +- * of the sysfs interface anyways. +- */ +- base = gc->base; +- if (base < 0) { +- base = gpiochip_find_base_unlocked(gc->ngpio); +- if (base < 0) { +- spin_unlock_irqrestore(&gpio_lock, flags); +- ret = base; +- base = 0; +- goto err_free_label; +- } ++ scoped_guard(mutex, &gpio_devices_lock) { + /* +- * TODO: it should not be necessary to reflect the assigned +- * base outside of the GPIO subsystem. Go over drivers and +- * see if anyone makes use of this, else drop this and assign +- * a poison instead. ++ * TODO: this allocates a Linux GPIO number base in the global ++ * GPIO numberspace for this chip. In the long run we want to ++ * get *rid* of this numberspace and use only descriptors, but ++ * it may be a pipe dream. It will not happen before we get rid ++ * of the sysfs interface anyways. + */ +- gc->base = base; +- } else { +- dev_warn(&gdev->dev, +- "Static allocation of GPIO base is deprecated, use dynamic allocation.\n"); +- } +- gdev->base = base; ++ base = gc->base; ++ if (base < 0) { ++ base = gpiochip_find_base_unlocked(gc->ngpio); ++ if (base < 0) { ++ ret = base; ++ base = 0; ++ goto err_free_label; ++ } + +- ret = gpiodev_add_to_list_unlocked(gdev); +- if (ret) { +- spin_unlock_irqrestore(&gpio_lock, flags); +- chip_err(gc, "GPIO integer space overlap, cannot add chip\n"); +- goto err_free_label; ++ /* ++ * TODO: it should not be necessary to reflect the ++ * assigned base outside of the GPIO subsystem. Go over ++ * drivers and see if anyone makes use of this, else ++ * drop this and assign a poison instead. ++ */ ++ gc->base = base; ++ } else { ++ dev_warn(&gdev->dev, ++ "Static allocation of GPIO base is deprecated, use dynamic allocation.\n"); ++ } ++ ++ gdev->base = base; ++ ++ ret = gpiodev_add_to_list_unlocked(gdev); ++ if (ret) { ++ chip_err(gc, "GPIO integer space overlap, cannot add chip\n"); ++ goto err_free_label; ++ } + } + + for (i = 0; i < gc->ngpio; i++) + gdev->descs[i].gdev = gdev; + +- spin_unlock_irqrestore(&gpio_lock, flags); +- + BLOCKING_INIT_NOTIFIER_HEAD(&gdev->line_state_notifier); + BLOCKING_INIT_NOTIFIER_HEAD(&gdev->device_notifier); + init_rwsem(&gdev->sem); +@@ -1006,9 +1010,9 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data, + err_free_gpiochip_mask: + gpiochip_free_valid_mask(gc); + err_remove_from_list: +- spin_lock_irqsave(&gpio_lock, flags); +- list_del(&gdev->list); +- spin_unlock_irqrestore(&gpio_lock, flags); ++ scoped_guard(mutex, &gpio_devices_lock) ++ list_del_rcu(&gdev->list); ++ synchronize_srcu(&gpio_devices_srcu); + if (gdev->dev.release) { + /* release() has been registered by gpiochip_setup_dev() */ + gpio_device_put(gdev); +@@ -1052,6 +1056,11 @@ void gpiochip_remove(struct gpio_chip *gc) + /* FIXME: should the legacy sysfs handling be moved to gpio_device? */ + gpiochip_sysfs_unregister(gdev); + gpiochip_free_hogs(gc); ++ ++ scoped_guard(mutex, &gpio_devices_lock) ++ list_del_rcu(&gdev->list); ++ synchronize_srcu(&gpio_devices_srcu); ++ + /* Numb the device, cancelling all outstanding operations */ + gdev->chip = NULL; + gpiochip_irqchip_remove(gc); +@@ -1076,9 +1085,6 @@ void gpiochip_remove(struct gpio_chip *gc) + dev_crit(&gdev->dev, + "REMOVING GPIOCHIP WITH GPIOS STILL REQUESTED\n"); + +- scoped_guard(spinlock_irqsave, &gpio_lock) +- list_del(&gdev->list); +- + /* + * The gpiochip side puts its use of the device to rest here: + * if there are no userspace clients, the chardev and device will +@@ -1125,7 +1131,7 @@ struct gpio_device *gpio_device_find(void *data, + */ + might_sleep(); + +- guard(spinlock_irqsave)(&gpio_lock); ++ guard(srcu)(&gpio_devices_srcu); + + list_for_each_entry(gdev, &gpio_devices, list) { + if (gdev->chip && match(gdev->chip, data)) +@@ -4147,30 +4153,39 @@ struct gpio_desc *gpiod_find_and_request(struct device *consumer, + bool platform_lookup_allowed) + { + unsigned long lookupflags = GPIO_LOOKUP_FLAGS_DEFAULT; +- struct gpio_desc *desc; +- int ret; ++ /* ++ * scoped_guard() is implemented as a for loop, meaning static ++ * analyzers will complain about these two not being initialized. ++ */ ++ struct gpio_desc *desc = NULL; ++ int ret = 0; ++ ++ scoped_guard(srcu, &gpio_devices_srcu) { ++ desc = gpiod_find_by_fwnode(fwnode, consumer, con_id, idx, ++ &flags, &lookupflags); ++ if (gpiod_not_found(desc) && platform_lookup_allowed) { ++ /* ++ * Either we are not using DT or ACPI, or their lookup ++ * did not return a result. In that case, use platform ++ * lookup as a fallback. ++ */ ++ dev_dbg(consumer, ++ "using lookup tables for GPIO lookup\n"); ++ desc = gpiod_find(consumer, con_id, idx, &lookupflags); ++ } ++ ++ if (IS_ERR(desc)) { ++ dev_dbg(consumer, "No GPIO consumer %s found\n", ++ con_id); ++ return desc; ++ } + +- desc = gpiod_find_by_fwnode(fwnode, consumer, con_id, idx, &flags, &lookupflags); +- if (gpiod_not_found(desc) && platform_lookup_allowed) { + /* +- * Either we are not using DT or ACPI, or their lookup did not +- * return a result. In that case, use platform lookup as a +- * fallback. ++ * If a connection label was passed use that, else attempt to use ++ * the device name as label + */ +- dev_dbg(consumer, "using lookup tables for GPIO lookup\n"); +- desc = gpiod_find(consumer, con_id, idx, &lookupflags); +- } +- +- if (IS_ERR(desc)) { +- dev_dbg(consumer, "No GPIO consumer %s found\n", con_id); +- return desc; ++ ret = gpiod_request(desc, label); + } +- +- /* +- * If a connection label was passed use that, else attempt to use +- * the device name as label +- */ +- ret = gpiod_request(desc, label); + if (ret) { + if (!(ret == -EBUSY && flags & GPIOD_FLAGS_BIT_NONEXCLUSIVE)) + return ERR_PTR(ret); +@@ -4739,61 +4754,69 @@ static void gpiolib_dbg_show(struct seq_file *s, struct gpio_device *gdev) + } + } + ++struct gpiolib_seq_priv { ++ bool newline; ++ int idx; ++}; ++ + static void *gpiolib_seq_start(struct seq_file *s, loff_t *pos) + { +- unsigned long flags; +- struct gpio_device *gdev = NULL; ++ struct gpiolib_seq_priv *priv; ++ struct gpio_device *gdev; + loff_t index = *pos; + +- s->private = ""; ++ priv = kzalloc(sizeof(*priv), GFP_KERNEL); ++ if (!priv) ++ return NULL; ++ ++ s->private = priv; ++ priv->idx = srcu_read_lock(&gpio_devices_srcu); + +- spin_lock_irqsave(&gpio_lock, flags); +- list_for_each_entry(gdev, &gpio_devices, list) +- if (index-- == 0) { +- spin_unlock_irqrestore(&gpio_lock, flags); ++ list_for_each_entry_srcu(gdev, &gpio_devices, list, ++ srcu_read_lock_held(&gpio_devices_srcu)) { ++ if (index-- == 0) + return gdev; +- } +- spin_unlock_irqrestore(&gpio_lock, flags); ++ } + + return NULL; + } + + static void *gpiolib_seq_next(struct seq_file *s, void *v, loff_t *pos) + { +- unsigned long flags; +- struct gpio_device *gdev = v; +- void *ret = NULL; ++ struct gpiolib_seq_priv *priv = s->private; ++ struct gpio_device *gdev = v, *next; + +- spin_lock_irqsave(&gpio_lock, flags); +- if (list_is_last(&gdev->list, &gpio_devices)) +- ret = NULL; +- else +- ret = list_first_entry(&gdev->list, struct gpio_device, list); +- spin_unlock_irqrestore(&gpio_lock, flags); +- +- s->private = "\n"; ++ next = list_entry_rcu(gdev->list.next, struct gpio_device, list); ++ gdev = &next->list == &gpio_devices ? NULL : next; ++ priv->newline = true; + ++*pos; + +- return ret; ++ return gdev; + } + + static void gpiolib_seq_stop(struct seq_file *s, void *v) + { ++ struct gpiolib_seq_priv *priv = s->private; ++ ++ srcu_read_unlock(&gpio_devices_srcu, priv->idx); ++ kfree(priv); + } + + static int gpiolib_seq_show(struct seq_file *s, void *v) + { ++ struct gpiolib_seq_priv *priv = s->private; + struct gpio_device *gdev = v; + struct gpio_chip *gc = gdev->chip; + struct device *parent; + + if (!gc) { +- seq_printf(s, "%s%s: (dangling chip)", (char *)s->private, ++ seq_printf(s, "%s%s: (dangling chip)", ++ priv->newline ? "\n" : "", + dev_name(&gdev->dev)); + return 0; + } + +- seq_printf(s, "%s%s: GPIOs %d-%d", (char *)s->private, ++ seq_printf(s, "%s%s: GPIOs %d-%d", priv->newline ? "\n" : "", + dev_name(&gdev->dev), + gdev->base, gdev->base + gdev->ngpio - 1); + parent = gc->parent; +-- +2.43.0 + diff --git a/queue-6.8/gpiolib-fix-debug-messaging-in-gpiod_find_and_reques.patch b/queue-6.8/gpiolib-fix-debug-messaging-in-gpiod_find_and_reques.patch new file mode 100644 index 00000000000..fb21d32a0d9 --- /dev/null +++ b/queue-6.8/gpiolib-fix-debug-messaging-in-gpiod_find_and_reques.patch @@ -0,0 +1,157 @@ +From 789fa62fccea267b377ba9e49b591510504d9163 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 19:16:25 +0200 +Subject: gpiolib: Fix debug messaging in gpiod_find_and_request() + +From: Andy Shevchenko + +[ Upstream commit 5c887b65bbd1a3fc28e2e20399acede0baa83edb ] + +When consolidating GPIO lookups in ACPI code, the debug messaging +had been reworked that the user may see + + [ 13.401147] (NULL device *): using ACPI '\_SB.LEDS.led-0' for '(null)' GPIO lookup + [ 13.401378] gpio gpiochip0: Persistence not supported for GPIO 40 + [ 13.401402] gpio-40 (?): no flags found for (null) + +instead of + + [ 14.182962] gpio gpiochip0: Persistence not supported for GPIO 40 + [ 14.182994] gpio-40 (?): no flags found for gpios + +The '(null)' parts are less informative and likely scare the users. +Replace them by '(default)' which can point out to the default connection +IDs, such as 'gpios'. + +While at it, amend other places where con_id is used in the messages. + +Reported-by: Ferry Toth +Fixes: 8eb1f71e7acc ("gpiolib: consolidate GPIO lookups") +Suggested-by: Dmitry Torokhov +Tested-by: Ferry Toth +Signed-off-by: Andy Shevchenko +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib.c | 32 ++++++++++++++++++-------------- + 1 file changed, 18 insertions(+), 14 deletions(-) + +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index a6f1a4e2e3a4e..3bd2b3a986be5 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -2408,6 +2408,11 @@ char *gpiochip_dup_line_label(struct gpio_chip *gc, unsigned int offset) + } + EXPORT_SYMBOL_GPL(gpiochip_dup_line_label); + ++static inline const char *function_name_or_default(const char *con_id) ++{ ++ return con_id ?: "(default)"; ++} ++ + /** + * gpiochip_request_own_desc - Allow GPIO chip to request its own descriptor + * @gc: GPIO chip +@@ -2436,10 +2441,11 @@ struct gpio_desc *gpiochip_request_own_desc(struct gpio_chip *gc, + enum gpiod_flags dflags) + { + struct gpio_desc *desc = gpiochip_get_desc(gc, hwnum); ++ const char *name = function_name_or_default(label); + int ret; + + if (IS_ERR(desc)) { +- chip_err(gc, "failed to get GPIO descriptor\n"); ++ chip_err(gc, "failed to get GPIO %s descriptor\n", name); + return desc; + } + +@@ -2449,8 +2455,8 @@ struct gpio_desc *gpiochip_request_own_desc(struct gpio_chip *gc, + + ret = gpiod_configure_flags(desc, label, lflags, dflags); + if (ret) { +- chip_err(gc, "setup of own GPIO %s failed\n", label); + gpiod_free_commit(desc); ++ chip_err(gc, "setup of own GPIO %s failed\n", name); + return ERR_PTR(ret); + } + +@@ -4125,19 +4131,17 @@ static struct gpio_desc *gpiod_find_by_fwnode(struct fwnode_handle *fwnode, + enum gpiod_flags *flags, + unsigned long *lookupflags) + { ++ const char *name = function_name_or_default(con_id); + struct gpio_desc *desc = ERR_PTR(-ENOENT); + + if (is_of_node(fwnode)) { +- dev_dbg(consumer, "using DT '%pfw' for '%s' GPIO lookup\n", +- fwnode, con_id); ++ dev_dbg(consumer, "using DT '%pfw' for '%s' GPIO lookup\n", fwnode, name); + desc = of_find_gpio(to_of_node(fwnode), con_id, idx, lookupflags); + } else if (is_acpi_node(fwnode)) { +- dev_dbg(consumer, "using ACPI '%pfw' for '%s' GPIO lookup\n", +- fwnode, con_id); ++ dev_dbg(consumer, "using ACPI '%pfw' for '%s' GPIO lookup\n", fwnode, name); + desc = acpi_find_gpio(fwnode, con_id, idx, flags, lookupflags); + } else if (is_software_node(fwnode)) { +- dev_dbg(consumer, "using swnode '%pfw' for '%s' GPIO lookup\n", +- fwnode, con_id); ++ dev_dbg(consumer, "using swnode '%pfw' for '%s' GPIO lookup\n", fwnode, name); + desc = swnode_find_gpio(fwnode, con_id, idx, lookupflags); + } + +@@ -4153,6 +4157,7 @@ struct gpio_desc *gpiod_find_and_request(struct device *consumer, + bool platform_lookup_allowed) + { + unsigned long lookupflags = GPIO_LOOKUP_FLAGS_DEFAULT; ++ const char *name = function_name_or_default(con_id); + /* + * scoped_guard() is implemented as a for loop, meaning static + * analyzers will complain about these two not being initialized. +@@ -4175,8 +4180,7 @@ struct gpio_desc *gpiod_find_and_request(struct device *consumer, + } + + if (IS_ERR(desc)) { +- dev_dbg(consumer, "No GPIO consumer %s found\n", +- con_id); ++ dev_dbg(consumer, "No GPIO consumer %s found\n", name); + return desc; + } + +@@ -4198,15 +4202,14 @@ struct gpio_desc *gpiod_find_and_request(struct device *consumer, + * + * FIXME: Make this more sane and safe. + */ +- dev_info(consumer, +- "nonexclusive access to GPIO for %s\n", con_id); ++ dev_info(consumer, "nonexclusive access to GPIO for %s\n", name); + return desc; + } + + ret = gpiod_configure_flags(desc, con_id, lookupflags, flags); + if (ret < 0) { +- dev_dbg(consumer, "setup of GPIO %s failed\n", con_id); + gpiod_put(desc); ++ dev_dbg(consumer, "setup of GPIO %s failed\n", name); + return ERR_PTR(ret); + } + +@@ -4322,6 +4325,7 @@ EXPORT_SYMBOL_GPL(gpiod_get_optional); + int gpiod_configure_flags(struct gpio_desc *desc, const char *con_id, + unsigned long lflags, enum gpiod_flags dflags) + { ++ const char *name = function_name_or_default(con_id); + int ret; + + if (lflags & GPIO_ACTIVE_LOW) +@@ -4365,7 +4369,7 @@ int gpiod_configure_flags(struct gpio_desc *desc, const char *con_id, + + /* No particular flag request, return here... */ + if (!(dflags & GPIOD_FLAGS_BIT_DIR_SET)) { +- gpiod_dbg(desc, "no flags found for %s\n", con_id); ++ gpiod_dbg(desc, "no flags found for GPIO %s\n", name); + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.8/ice-fix-memory-corruption-bug-with-suspend-and-rebui.patch b/queue-6.8/ice-fix-memory-corruption-bug-with-suspend-and-rebui.patch new file mode 100644 index 00000000000..fce8f079dd4 --- /dev/null +++ b/queue-6.8/ice-fix-memory-corruption-bug-with-suspend-and-rebui.patch @@ -0,0 +1,155 @@ +From b31f3f6076a1a22ff27dcdb6772afdf997d4c3a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 15:02:03 -0800 +Subject: ice: fix memory corruption bug with suspend and rebuild + +From: Jesse Brandeburg + +[ Upstream commit 1cb7fdb1dfde1aab66780b4ba44dba6402172111 ] + +The ice driver would previously panic after suspend. This is caused +from the driver *only* calling the ice_vsi_free_q_vectors() function by +itself, when it is suspending. Since commit b3e7b3a6ee92 ("ice: prevent +NULL pointer deref during reload") the driver has zeroed out +num_q_vectors, and only restored it in ice_vsi_cfg_def(). + +This further causes the ice_rebuild() function to allocate a zero length +buffer, after which num_q_vectors is updated, and then the new value of +num_q_vectors is used to index into the zero length buffer, which +corrupts memory. + +The fix entails making sure all the code referencing num_q_vectors only +does so after it has been reset via ice_vsi_cfg_def(). + +I didn't perform a full bisect, but I was able to test against 6.1.77 +kernel and that ice driver works fine for suspend/resume with no panic, +so sometime since then, this problem was introduced. + +Also clean up an un-needed init of a local variable in the function +being modified. + +PANIC from 6.8.0-rc1: + +[1026674.915596] PM: suspend exit +[1026675.664697] ice 0000:17:00.1: PTP reset successful +[1026675.664707] ice 0000:17:00.1: 2755 msecs passed between update to cached PHC time +[1026675.667660] ice 0000:b1:00.0: PTP reset successful +[1026675.675944] ice 0000:b1:00.0: 2832 msecs passed between update to cached PHC time +[1026677.137733] ixgbe 0000:31:00.0 ens787: NIC Link is Up 1 Gbps, Flow Control: None +[1026677.190201] BUG: kernel NULL pointer dereference, address: 0000000000000010 +[1026677.192753] ice 0000:17:00.0: PTP reset successful +[1026677.192764] ice 0000:17:00.0: 4548 msecs passed between update to cached PHC time +[1026677.197928] #PF: supervisor read access in kernel mode +[1026677.197933] #PF: error_code(0x0000) - not-present page +[1026677.197937] PGD 1557a7067 P4D 0 +[1026677.212133] ice 0000:b1:00.1: PTP reset successful +[1026677.212143] ice 0000:b1:00.1: 4344 msecs passed between update to cached PHC time +[1026677.212575] +[1026677.243142] Oops: 0000 [#1] PREEMPT SMP NOPTI +[1026677.247918] CPU: 23 PID: 42790 Comm: kworker/23:0 Kdump: loaded Tainted: G W 6.8.0-rc1+ #1 +[1026677.257989] Hardware name: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0005.2202160810 02/16/2022 +[1026677.269367] Workqueue: ice ice_service_task [ice] +[1026677.274592] RIP: 0010:ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice] +[1026677.281421] Code: 0f 84 3a ff ff ff 41 0f b7 74 ec 02 66 89 b0 22 02 00 00 81 e6 ff 1f 00 00 e8 ec fd ff ff e9 35 ff ff ff 48 8b 43 30 49 63 ed <41> 0f b7 34 24 41 83 c5 01 48 8b 3c e8 66 89 b7 aa 02 00 00 81 e6 +[1026677.300877] RSP: 0018:ff3be62a6399bcc0 EFLAGS: 00010202 +[1026677.306556] RAX: ff28691e28980828 RBX: ff28691e41099828 RCX: 0000000000188000 +[1026677.314148] RDX: 0000000000000000 RSI: 0000000000000010 RDI: ff28691e41099828 +[1026677.321730] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 +[1026677.329311] R10: 0000000000000007 R11: ffffffffffffffc0 R12: 0000000000000010 +[1026677.336896] R13: 0000000000000000 R14: 0000000000000000 R15: ff28691e0eaa81a0 +[1026677.344472] FS: 0000000000000000(0000) GS:ff28693cbffc0000(0000) knlGS:0000000000000000 +[1026677.353000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[1026677.359195] CR2: 0000000000000010 CR3: 0000000128df4001 CR4: 0000000000771ef0 +[1026677.366779] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[1026677.374369] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[1026677.381952] PKRU: 55555554 +[1026677.385116] Call Trace: +[1026677.388023] +[1026677.390589] ? __die+0x20/0x70 +[1026677.394105] ? page_fault_oops+0x82/0x160 +[1026677.398576] ? do_user_addr_fault+0x65/0x6a0 +[1026677.403307] ? exc_page_fault+0x6a/0x150 +[1026677.407694] ? asm_exc_page_fault+0x22/0x30 +[1026677.412349] ? ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice] +[1026677.418614] ice_vsi_rebuild+0x34b/0x3c0 [ice] +[1026677.423583] ice_vsi_rebuild_by_type+0x76/0x180 [ice] +[1026677.429147] ice_rebuild+0x18b/0x520 [ice] +[1026677.433746] ? delay_tsc+0x8f/0xc0 +[1026677.437630] ice_do_reset+0xa3/0x190 [ice] +[1026677.442231] ice_service_task+0x26/0x440 [ice] +[1026677.447180] process_one_work+0x174/0x340 +[1026677.451669] worker_thread+0x27e/0x390 +[1026677.455890] ? __pfx_worker_thread+0x10/0x10 +[1026677.460627] kthread+0xee/0x120 +[1026677.464235] ? __pfx_kthread+0x10/0x10 +[1026677.468445] ret_from_fork+0x2d/0x50 +[1026677.472476] ? __pfx_kthread+0x10/0x10 +[1026677.476671] ret_from_fork_asm+0x1b/0x30 +[1026677.481050] + +Fixes: b3e7b3a6ee92 ("ice: prevent NULL pointer deref during reload") +Reported-by: Robert Elliott +Signed-off-by: Jesse Brandeburg +Reviewed-by: Simon Horman +Reviewed-by: Aleksandr Loktionov +Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_lib.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c +index fc23dbe302b46..cfc20684f25ab 100644 +--- a/drivers/net/ethernet/intel/ice/ice_lib.c ++++ b/drivers/net/ethernet/intel/ice/ice_lib.c +@@ -3238,7 +3238,7 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags) + { + struct ice_vsi_cfg_params params = {}; + struct ice_coalesce_stored *coalesce; +- int prev_num_q_vectors = 0; ++ int prev_num_q_vectors; + struct ice_pf *pf; + int ret; + +@@ -3252,13 +3252,6 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags) + if (WARN_ON(vsi->type == ICE_VSI_VF && !vsi->vf)) + return -EINVAL; + +- coalesce = kcalloc(vsi->num_q_vectors, +- sizeof(struct ice_coalesce_stored), GFP_KERNEL); +- if (!coalesce) +- return -ENOMEM; +- +- prev_num_q_vectors = ice_vsi_rebuild_get_coalesce(vsi, coalesce); +- + ret = ice_vsi_realloc_stat_arrays(vsi); + if (ret) + goto err_vsi_cfg; +@@ -3268,6 +3261,13 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags) + if (ret) + goto err_vsi_cfg; + ++ coalesce = kcalloc(vsi->num_q_vectors, ++ sizeof(struct ice_coalesce_stored), GFP_KERNEL); ++ if (!coalesce) ++ return -ENOMEM; ++ ++ prev_num_q_vectors = ice_vsi_rebuild_get_coalesce(vsi, coalesce); ++ + ret = ice_vsi_cfg_tc_lan(pf, vsi); + if (ret) { + if (vsi_flags & ICE_VSI_FLAG_INIT) { +@@ -3286,8 +3286,8 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags) + + err_vsi_cfg_tc_lan: + ice_vsi_decfg(vsi); +-err_vsi_cfg: + kfree(coalesce); ++err_vsi_cfg: + return ret; + } + +-- +2.43.0 + diff --git a/queue-6.8/ice-refactor-fw-data-type-and-fix-bitmap-casting-iss.patch b/queue-6.8/ice-refactor-fw-data-type-and-fix-bitmap-casting-iss.patch new file mode 100644 index 00000000000..ab8fa39e0c6 --- /dev/null +++ b/queue-6.8/ice-refactor-fw-data-type-and-fix-bitmap-casting-iss.patch @@ -0,0 +1,188 @@ +From 4702be88b3b30ebde4999ca7260fc4ed4502c666 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Feb 2024 09:49:59 +0800 +Subject: ice: Refactor FW data type and fix bitmap casting issue + +From: Steven Zou + +[ Upstream commit 817b18965b58a6e5fb6ce97abf01b03a205a6aea ] + +According to the datasheet, the recipe association data is an 8-byte +little-endian value. It is described as 'Bitmap of the recipe indexes +associated with this profile', it is from 24 to 31 byte area in FW. +Therefore, it is defined to '__le64 recipe_assoc' in struct +ice_aqc_recipe_to_profile. And then fix the bitmap casting issue, as we +must never ever use castings for bitmap type. + +Fixes: 1e0f9881ef79 ("ice: Flesh out implementation of support for SRIOV on bonded interface") +Reviewed-by: Przemek Kitszel +Reviewed-by: Andrii Staikov +Reviewed-by: Jan Sokolowski +Reviewed-by: Simon Horman +Signed-off-by: Steven Zou +Tested-by: Sujai Buvaneswaran +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + .../net/ethernet/intel/ice/ice_adminq_cmd.h | 3 ++- + drivers/net/ethernet/intel/ice/ice_lag.c | 4 ++-- + drivers/net/ethernet/intel/ice/ice_switch.c | 24 +++++++++++-------- + drivers/net/ethernet/intel/ice/ice_switch.h | 4 ++-- + 4 files changed, 20 insertions(+), 15 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h +index 8040317c95617..1f3e7a6903e56 100644 +--- a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h ++++ b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h +@@ -593,8 +593,9 @@ struct ice_aqc_recipe_data_elem { + struct ice_aqc_recipe_to_profile { + __le16 profile_id; + u8 rsvd[6]; +- DECLARE_BITMAP(recipe_assoc, ICE_MAX_NUM_RECIPES); ++ __le64 recipe_assoc; + }; ++static_assert(sizeof(struct ice_aqc_recipe_to_profile) == 16); + + /* Add/Update/Remove/Get switch rules (indirect 0x02A0, 0x02A1, 0x02A2, 0x02A3) + */ +diff --git a/drivers/net/ethernet/intel/ice/ice_lag.c b/drivers/net/ethernet/intel/ice/ice_lag.c +index 467372d541d21..a7a342809935f 100644 +--- a/drivers/net/ethernet/intel/ice/ice_lag.c ++++ b/drivers/net/ethernet/intel/ice/ice_lag.c +@@ -2041,7 +2041,7 @@ int ice_init_lag(struct ice_pf *pf) + /* associate recipes to profiles */ + for (n = 0; n < ICE_PROFID_IPV6_GTPU_IPV6_TCP_INNER; n++) { + err = ice_aq_get_recipe_to_profile(&pf->hw, n, +- (u8 *)&recipe_bits, NULL); ++ &recipe_bits, NULL); + if (err) + continue; + +@@ -2049,7 +2049,7 @@ int ice_init_lag(struct ice_pf *pf) + recipe_bits |= BIT(lag->pf_recipe) | + BIT(lag->lport_recipe); + ice_aq_map_recipe_to_profile(&pf->hw, n, +- (u8 *)&recipe_bits, NULL); ++ recipe_bits, NULL); + } + } + +diff --git a/drivers/net/ethernet/intel/ice/ice_switch.c b/drivers/net/ethernet/intel/ice/ice_switch.c +index f84bab80ca423..ba0ef91e4c19c 100644 +--- a/drivers/net/ethernet/intel/ice/ice_switch.c ++++ b/drivers/net/ethernet/intel/ice/ice_switch.c +@@ -2025,12 +2025,12 @@ ice_update_recipe_lkup_idx(struct ice_hw *hw, + * ice_aq_map_recipe_to_profile - Map recipe to packet profile + * @hw: pointer to the HW struct + * @profile_id: package profile ID to associate the recipe with +- * @r_bitmap: Recipe bitmap filled in and need to be returned as response ++ * @r_assoc: Recipe bitmap filled in and need to be returned as response + * @cd: pointer to command details structure or NULL + * Recipe to profile association (0x0291) + */ + int +-ice_aq_map_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap, ++ice_aq_map_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u64 r_assoc, + struct ice_sq_cd *cd) + { + struct ice_aqc_recipe_to_profile *cmd; +@@ -2042,7 +2042,7 @@ ice_aq_map_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap, + /* Set the recipe ID bit in the bitmask to let the device know which + * profile we are associating the recipe to + */ +- memcpy(cmd->recipe_assoc, r_bitmap, sizeof(cmd->recipe_assoc)); ++ cmd->recipe_assoc = cpu_to_le64(r_assoc); + + return ice_aq_send_cmd(hw, &desc, NULL, 0, cd); + } +@@ -2051,12 +2051,12 @@ ice_aq_map_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap, + * ice_aq_get_recipe_to_profile - Map recipe to packet profile + * @hw: pointer to the HW struct + * @profile_id: package profile ID to associate the recipe with +- * @r_bitmap: Recipe bitmap filled in and need to be returned as response ++ * @r_assoc: Recipe bitmap filled in and need to be returned as response + * @cd: pointer to command details structure or NULL + * Associate profile ID with given recipe (0x0293) + */ + int +-ice_aq_get_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap, ++ice_aq_get_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u64 *r_assoc, + struct ice_sq_cd *cd) + { + struct ice_aqc_recipe_to_profile *cmd; +@@ -2069,7 +2069,7 @@ ice_aq_get_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap, + + status = ice_aq_send_cmd(hw, &desc, NULL, 0, cd); + if (!status) +- memcpy(r_bitmap, cmd->recipe_assoc, sizeof(cmd->recipe_assoc)); ++ *r_assoc = le64_to_cpu(cmd->recipe_assoc); + + return status; + } +@@ -2108,6 +2108,7 @@ int ice_alloc_recipe(struct ice_hw *hw, u16 *rid) + static void ice_get_recp_to_prof_map(struct ice_hw *hw) + { + DECLARE_BITMAP(r_bitmap, ICE_MAX_NUM_RECIPES); ++ u64 recp_assoc; + u16 i; + + for (i = 0; i < hw->switch_info->max_used_prof_index + 1; i++) { +@@ -2115,8 +2116,9 @@ static void ice_get_recp_to_prof_map(struct ice_hw *hw) + + bitmap_zero(profile_to_recipe[i], ICE_MAX_NUM_RECIPES); + bitmap_zero(r_bitmap, ICE_MAX_NUM_RECIPES); +- if (ice_aq_get_recipe_to_profile(hw, i, (u8 *)r_bitmap, NULL)) ++ if (ice_aq_get_recipe_to_profile(hw, i, &recp_assoc, NULL)) + continue; ++ bitmap_from_arr64(r_bitmap, &recp_assoc, ICE_MAX_NUM_RECIPES); + bitmap_copy(profile_to_recipe[i], r_bitmap, + ICE_MAX_NUM_RECIPES); + for_each_set_bit(j, r_bitmap, ICE_MAX_NUM_RECIPES) +@@ -5390,22 +5392,24 @@ ice_add_adv_recipe(struct ice_hw *hw, struct ice_adv_lkup_elem *lkups, + */ + list_for_each_entry(fvit, &rm->fv_list, list_entry) { + DECLARE_BITMAP(r_bitmap, ICE_MAX_NUM_RECIPES); ++ u64 recp_assoc; + u16 j; + + status = ice_aq_get_recipe_to_profile(hw, fvit->profile_id, +- (u8 *)r_bitmap, NULL); ++ &recp_assoc, NULL); + if (status) + goto err_unroll; + ++ bitmap_from_arr64(r_bitmap, &recp_assoc, ICE_MAX_NUM_RECIPES); + bitmap_or(r_bitmap, r_bitmap, rm->r_bitmap, + ICE_MAX_NUM_RECIPES); + status = ice_acquire_change_lock(hw, ICE_RES_WRITE); + if (status) + goto err_unroll; + ++ bitmap_to_arr64(&recp_assoc, r_bitmap, ICE_MAX_NUM_RECIPES); + status = ice_aq_map_recipe_to_profile(hw, fvit->profile_id, +- (u8 *)r_bitmap, +- NULL); ++ recp_assoc, NULL); + ice_release_change_lock(hw); + + if (status) +diff --git a/drivers/net/ethernet/intel/ice/ice_switch.h b/drivers/net/ethernet/intel/ice/ice_switch.h +index db7e501b7e0a4..89ffa1b51b5ad 100644 +--- a/drivers/net/ethernet/intel/ice/ice_switch.h ++++ b/drivers/net/ethernet/intel/ice/ice_switch.h +@@ -424,10 +424,10 @@ int ice_aq_add_recipe(struct ice_hw *hw, + struct ice_aqc_recipe_data_elem *s_recipe_list, + u16 num_recipes, struct ice_sq_cd *cd); + int +-ice_aq_get_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap, ++ice_aq_get_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u64 *r_assoc, + struct ice_sq_cd *cd); + int +-ice_aq_map_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap, ++ice_aq_map_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u64 r_assoc, + struct ice_sq_cd *cd); + + #endif /* _ICE_SWITCH_H_ */ +-- +2.43.0 + diff --git a/queue-6.8/igc-remove-stale-comment-about-tx-timestamping.patch b/queue-6.8/igc-remove-stale-comment-about-tx-timestamping.patch new file mode 100644 index 00000000000..d3c0b213a56 --- /dev/null +++ b/queue-6.8/igc-remove-stale-comment-about-tx-timestamping.patch @@ -0,0 +1,43 @@ +From 277559ef5ae6d57322b178d1949287acbac1d46d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 14:03:10 +0100 +Subject: igc: Remove stale comment about Tx timestamping + +From: Kurt Kanzenbach + +[ Upstream commit 47ce2956c7a61ff354723e28235205fa2012265b ] + +The initial igc Tx timestamping implementation used only one register for +retrieving Tx timestamps. Commit 3ed247e78911 ("igc: Add support for +multiple in-flight TX timestamps") added support for utilizing all four of +them e.g., for multiple domain support. Remove the stale comment/FIXME. + +Fixes: 3ed247e78911 ("igc: Add support for multiple in-flight TX timestamps") +Signed-off-by: Kurt Kanzenbach +Acked-by: Vinicius Costa Gomes +Reviewed-by: Przemek Kitszel +Tested-by: Naama Meir +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_main.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c +index e447ba0370568..23bed58a9d825 100644 +--- a/drivers/net/ethernet/intel/igc/igc_main.c ++++ b/drivers/net/ethernet/intel/igc/igc_main.c +@@ -1642,10 +1642,6 @@ static netdev_tx_t igc_xmit_frame_ring(struct sk_buff *skb, + + if (unlikely(test_bit(IGC_RING_FLAG_TX_HWTSTAMP, &tx_ring->flags) && + skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP)) { +- /* FIXME: add support for retrieving timestamps from +- * the other timer registers before skipping the +- * timestamping request. +- */ + unsigned long flags; + u32 tstamp_flags; + +-- +2.43.0 + diff --git a/queue-6.8/inet-inet_defrag-prevent-sk-release-while-still-in-u.patch b/queue-6.8/inet-inet_defrag-prevent-sk-release-while-still-in-u.patch new file mode 100644 index 00000000000..e3d756855d4 --- /dev/null +++ b/queue-6.8/inet-inet_defrag-prevent-sk-release-while-still-in-u.patch @@ -0,0 +1,315 @@ +From 23446a96cb154edae892363223913bf2132dec8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 11:18:41 +0100 +Subject: inet: inet_defrag: prevent sk release while still in use + +From: Florian Westphal + +[ Upstream commit 18685451fc4e546fc0e718580d32df3c0e5c8272 ] + +ip_local_out() and other functions can pass skb->sk as function argument. + +If the skb is a fragment and reassembly happens before such function call +returns, the sk must not be released. + +This affects skb fragments reassembled via netfilter or similar +modules, e.g. openvswitch or ct_act.c, when run as part of tx pipeline. + +Eric Dumazet made an initial analysis of this bug. Quoting Eric: + Calling ip_defrag() in output path is also implying skb_orphan(), + which is buggy because output path relies on sk not disappearing. + + A relevant old patch about the issue was : + 8282f27449bf ("inet: frag: Always orphan skbs inside ip_defrag()") + + [..] + + net/ipv4/ip_output.c depends on skb->sk being set, and probably to an + inet socket, not an arbitrary one. + + If we orphan the packet in ipvlan, then downstream things like FQ + packet scheduler will not work properly. + + We need to change ip_defrag() to only use skb_orphan() when really + needed, ie whenever frag_list is going to be used. + +Eric suggested to stash sk in fragment queue and made an initial patch. +However there is a problem with this: + +If skb is refragmented again right after, ip_do_fragment() will copy +head->sk to the new fragments, and sets up destructor to sock_wfree. +IOW, we have no choice but to fix up sk_wmem accouting to reflect the +fully reassembled skb, else wmem will underflow. + +This change moves the orphan down into the core, to last possible moment. +As ip_defrag_offset is aliased with sk_buff->sk member, we must move the +offset into the FRAG_CB, else skb->sk gets clobbered. + +This allows to delay the orphaning long enough to learn if the skb has +to be queued or if the skb is completing the reasm queue. + +In the former case, things work as before, skb is orphaned. This is +safe because skb gets queued/stolen and won't continue past reasm engine. + +In the latter case, we will steal the skb->sk reference, reattach it to +the head skb, and fix up wmem accouting when inet_frag inflates truesize. + +Fixes: 7026b1ddb6b8 ("netfilter: Pass socket pointer down through okfn().") +Diagnosed-by: Eric Dumazet +Reported-by: xingwei lee +Reported-by: yue sun +Reported-by: syzbot+e5167d7144a62715044c@syzkaller.appspotmail.com +Signed-off-by: Florian Westphal +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/20240326101845.30836-1-fw@strlen.de +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + include/linux/skbuff.h | 7 +-- + net/ipv4/inet_fragment.c | 70 ++++++++++++++++++++----- + net/ipv4/ip_fragment.c | 2 +- + net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- + 4 files changed, 60 insertions(+), 21 deletions(-) + +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index d9a1ccfb57080..227f4514476b1 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -748,8 +748,6 @@ typedef unsigned char *sk_buff_data_t; + * @list: queue head + * @ll_node: anchor in an llist (eg socket defer_list) + * @sk: Socket we are owned by +- * @ip_defrag_offset: (aka @sk) alternate use of @sk, used in +- * fragmentation management + * @dev: Device we arrived on/are leaving by + * @dev_scratch: (aka @dev) alternate use of @dev when @dev would be %NULL + * @cb: Control buffer. Free for use by every layer. Put private vars here +@@ -870,10 +868,7 @@ struct sk_buff { + struct llist_node ll_node; + }; + +- union { +- struct sock *sk; +- int ip_defrag_offset; +- }; ++ struct sock *sk; + + union { + ktime_t tstamp; +diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c +index 7072fc0783ef5..c88c9034d6300 100644 +--- a/net/ipv4/inet_fragment.c ++++ b/net/ipv4/inet_fragment.c +@@ -24,6 +24,8 @@ + #include + #include + ++#include "../core/sock_destructor.h" ++ + /* Use skb->cb to track consecutive/adjacent fragments coming at + * the end of the queue. Nodes in the rb-tree queue will + * contain "runs" of one or more adjacent fragments. +@@ -39,6 +41,7 @@ struct ipfrag_skb_cb { + }; + struct sk_buff *next_frag; + int frag_run_len; ++ int ip_defrag_offset; + }; + + #define FRAG_CB(skb) ((struct ipfrag_skb_cb *)((skb)->cb)) +@@ -396,12 +399,12 @@ int inet_frag_queue_insert(struct inet_frag_queue *q, struct sk_buff *skb, + */ + if (!last) + fragrun_create(q, skb); /* First fragment. */ +- else if (last->ip_defrag_offset + last->len < end) { ++ else if (FRAG_CB(last)->ip_defrag_offset + last->len < end) { + /* This is the common case: skb goes to the end. */ + /* Detect and discard overlaps. */ +- if (offset < last->ip_defrag_offset + last->len) ++ if (offset < FRAG_CB(last)->ip_defrag_offset + last->len) + return IPFRAG_OVERLAP; +- if (offset == last->ip_defrag_offset + last->len) ++ if (offset == FRAG_CB(last)->ip_defrag_offset + last->len) + fragrun_append_to_last(q, skb); + else + fragrun_create(q, skb); +@@ -418,13 +421,13 @@ int inet_frag_queue_insert(struct inet_frag_queue *q, struct sk_buff *skb, + + parent = *rbn; + curr = rb_to_skb(parent); +- curr_run_end = curr->ip_defrag_offset + ++ curr_run_end = FRAG_CB(curr)->ip_defrag_offset + + FRAG_CB(curr)->frag_run_len; +- if (end <= curr->ip_defrag_offset) ++ if (end <= FRAG_CB(curr)->ip_defrag_offset) + rbn = &parent->rb_left; + else if (offset >= curr_run_end) + rbn = &parent->rb_right; +- else if (offset >= curr->ip_defrag_offset && ++ else if (offset >= FRAG_CB(curr)->ip_defrag_offset && + end <= curr_run_end) + return IPFRAG_DUP; + else +@@ -438,7 +441,7 @@ int inet_frag_queue_insert(struct inet_frag_queue *q, struct sk_buff *skb, + rb_insert_color(&skb->rbnode, &q->rb_fragments); + } + +- skb->ip_defrag_offset = offset; ++ FRAG_CB(skb)->ip_defrag_offset = offset; + + return IPFRAG_OK; + } +@@ -448,13 +451,28 @@ void *inet_frag_reasm_prepare(struct inet_frag_queue *q, struct sk_buff *skb, + struct sk_buff *parent) + { + struct sk_buff *fp, *head = skb_rb_first(&q->rb_fragments); +- struct sk_buff **nextp; ++ void (*destructor)(struct sk_buff *); ++ unsigned int orig_truesize = 0; ++ struct sk_buff **nextp = NULL; ++ struct sock *sk = skb->sk; + int delta; + ++ if (sk && is_skb_wmem(skb)) { ++ /* TX: skb->sk might have been passed as argument to ++ * dst->output and must remain valid until tx completes. ++ * ++ * Move sk to reassembled skb and fix up wmem accounting. ++ */ ++ orig_truesize = skb->truesize; ++ destructor = skb->destructor; ++ } ++ + if (head != skb) { + fp = skb_clone(skb, GFP_ATOMIC); +- if (!fp) +- return NULL; ++ if (!fp) { ++ head = skb; ++ goto out_restore_sk; ++ } + FRAG_CB(fp)->next_frag = FRAG_CB(skb)->next_frag; + if (RB_EMPTY_NODE(&skb->rbnode)) + FRAG_CB(parent)->next_frag = fp; +@@ -463,6 +481,12 @@ void *inet_frag_reasm_prepare(struct inet_frag_queue *q, struct sk_buff *skb, + &q->rb_fragments); + if (q->fragments_tail == skb) + q->fragments_tail = fp; ++ ++ if (orig_truesize) { ++ /* prevent skb_morph from releasing sk */ ++ skb->sk = NULL; ++ skb->destructor = NULL; ++ } + skb_morph(skb, head); + FRAG_CB(skb)->next_frag = FRAG_CB(head)->next_frag; + rb_replace_node(&head->rbnode, &skb->rbnode, +@@ -470,13 +494,13 @@ void *inet_frag_reasm_prepare(struct inet_frag_queue *q, struct sk_buff *skb, + consume_skb(head); + head = skb; + } +- WARN_ON(head->ip_defrag_offset != 0); ++ WARN_ON(FRAG_CB(head)->ip_defrag_offset != 0); + + delta = -head->truesize; + + /* Head of list must not be cloned. */ + if (skb_unclone(head, GFP_ATOMIC)) +- return NULL; ++ goto out_restore_sk; + + delta += head->truesize; + if (delta) +@@ -492,7 +516,7 @@ void *inet_frag_reasm_prepare(struct inet_frag_queue *q, struct sk_buff *skb, + + clone = alloc_skb(0, GFP_ATOMIC); + if (!clone) +- return NULL; ++ goto out_restore_sk; + skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list; + skb_frag_list_init(head); + for (i = 0; i < skb_shinfo(head)->nr_frags; i++) +@@ -509,6 +533,21 @@ void *inet_frag_reasm_prepare(struct inet_frag_queue *q, struct sk_buff *skb, + nextp = &skb_shinfo(head)->frag_list; + } + ++out_restore_sk: ++ if (orig_truesize) { ++ int ts_delta = head->truesize - orig_truesize; ++ ++ /* if this reassembled skb is fragmented later, ++ * fraglist skbs will get skb->sk assigned from head->sk, ++ * and each frag skb will be released via sock_wfree. ++ * ++ * Update sk_wmem_alloc. ++ */ ++ head->sk = sk; ++ head->destructor = destructor; ++ refcount_add(ts_delta, &sk->sk_wmem_alloc); ++ } ++ + return nextp; + } + EXPORT_SYMBOL(inet_frag_reasm_prepare); +@@ -516,6 +555,8 @@ EXPORT_SYMBOL(inet_frag_reasm_prepare); + void inet_frag_reasm_finish(struct inet_frag_queue *q, struct sk_buff *head, + void *reasm_data, bool try_coalesce) + { ++ struct sock *sk = is_skb_wmem(head) ? head->sk : NULL; ++ const unsigned int head_truesize = head->truesize; + struct sk_buff **nextp = reasm_data; + struct rb_node *rbn; + struct sk_buff *fp; +@@ -579,6 +620,9 @@ void inet_frag_reasm_finish(struct inet_frag_queue *q, struct sk_buff *head, + head->prev = NULL; + head->tstamp = q->stamp; + head->mono_delivery_time = q->mono_delivery_time; ++ ++ if (sk) ++ refcount_add(sum_truesize - head_truesize, &sk->sk_wmem_alloc); + } + EXPORT_SYMBOL(inet_frag_reasm_finish); + +diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c +index a4941f53b5237..fb947d1613fe2 100644 +--- a/net/ipv4/ip_fragment.c ++++ b/net/ipv4/ip_fragment.c +@@ -384,6 +384,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) + } + + skb_dst_drop(skb); ++ skb_orphan(skb); + return -EINPROGRESS; + + insert_error: +@@ -487,7 +488,6 @@ int ip_defrag(struct net *net, struct sk_buff *skb, u32 user) + struct ipq *qp; + + __IP_INC_STATS(net, IPSTATS_MIB_REASMREQDS); +- skb_orphan(skb); + + /* Lookup (or create) queue header */ + qp = ip_find(net, ip_hdr(skb), user, vif); +diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c +index b2dd48911c8d6..efbec7ee27d0a 100644 +--- a/net/ipv6/netfilter/nf_conntrack_reasm.c ++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c +@@ -294,6 +294,7 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb, + } + + skb_dst_drop(skb); ++ skb_orphan(skb); + return -EINPROGRESS; + + insert_error: +@@ -469,7 +470,6 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user) + hdr = ipv6_hdr(skb); + fhdr = (struct frag_hdr *)skb_transport_header(skb); + +- skb_orphan(skb); + fq = fq_find(net, fhdr->identification, user, hdr, + skb->dev ? skb->dev->ifindex : 0); + if (fq == NULL) { +-- +2.43.0 + diff --git a/queue-6.8/iommu-validate-the-pasid-in-iommu_attach_device_pasi.patch b/queue-6.8/iommu-validate-the-pasid-in-iommu_attach_device_pasi.patch new file mode 100644 index 00000000000..721ed704a43 --- /dev/null +++ b/queue-6.8/iommu-validate-the-pasid-in-iommu_attach_device_pasi.patch @@ -0,0 +1,62 @@ +From a6a2017f3d361984fd2d39fade2be5d417dddf6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Mar 2024 10:41:39 -0300 +Subject: iommu: Validate the PASID in iommu_attach_device_pasid() + +From: Jason Gunthorpe + +[ Upstream commit c404f55c26fc23c70a9f2262f3f36a69fc46289b ] + +The SVA code checks that the PASID is valid for the device when assigning +the PASID to the MM, but the normal PAGING related path does not check it. + +Devices that don't support PASID or PASID values too large for the device +should not invoke the driver callback. The drivers should rely on the +core code for this enforcement. + +Fixes: 16603704559c7a68 ("iommu: Add attach/detach_dev_pasid iommu interfaces") +Signed-off-by: Jason Gunthorpe +Reviewed-by: Yi Liu +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/0-v1-460705442b30+659-iommu_check_pasid_jgg@nvidia.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/iommu.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c +index cd1210026ac53..ad33161f2374b 100644 +--- a/drivers/iommu/iommu.c ++++ b/drivers/iommu/iommu.c +@@ -3547,6 +3547,7 @@ int iommu_attach_device_pasid(struct iommu_domain *domain, + { + /* Caller must be a probed driver on dev */ + struct iommu_group *group = dev->iommu_group; ++ struct group_device *device; + void *curr; + int ret; + +@@ -3556,10 +3557,18 @@ int iommu_attach_device_pasid(struct iommu_domain *domain, + if (!group) + return -ENODEV; + +- if (!dev_has_iommu(dev) || dev_iommu_ops(dev) != domain->owner) ++ if (!dev_has_iommu(dev) || dev_iommu_ops(dev) != domain->owner || ++ pasid == IOMMU_NO_PASID) + return -EINVAL; + + mutex_lock(&group->mutex); ++ for_each_group_device(group, device) { ++ if (pasid >= device->dev->iommu->max_pasids) { ++ ret = -EINVAL; ++ goto out_unlock; ++ } ++ } ++ + curr = xa_cmpxchg(&group->pasid_array, pasid, NULL, domain, GFP_KERNEL); + if (curr) { + ret = xa_err(curr) ? : -EBUSY; +-- +2.43.0 + diff --git a/queue-6.8/ixgbe-avoid-sleeping-allocation-in-ixgbe_ipsec_vf_ad.patch b/queue-6.8/ixgbe-avoid-sleeping-allocation-in-ixgbe_ipsec_vf_ad.patch new file mode 100644 index 00000000000..c98e2e9a904 --- /dev/null +++ b/queue-6.8/ixgbe-avoid-sleeping-allocation-in-ixgbe_ipsec_vf_ad.patch @@ -0,0 +1,75 @@ +From 2d0c7ce9a19aa6c8001a1cc6a1be61b96cfc796a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 17:02:02 +0100 +Subject: ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa() + +From: Przemek Kitszel + +[ Upstream commit aec806fb4afba5fe80b09e29351379a4292baa43 ] + +Change kzalloc() flags used in ixgbe_ipsec_vf_add_sa() to GFP_ATOMIC, to +avoid sleeping in IRQ context. + +Dan Carpenter, with the help of Smatch, has found following issue: +The patch eda0333ac293: "ixgbe: add VF IPsec management" from Aug 13, +2018 (linux-next), leads to the following Smatch static checker +warning: drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c:917 ixgbe_ipsec_vf_add_sa() + warn: sleeping in IRQ context + +The call tree that Smatch is worried about is: +ixgbe_msix_other() <- IRQ handler +-> ixgbe_msg_task() + -> ixgbe_rcv_msg_from_vf() + -> ixgbe_ipsec_vf_add_sa() + +Fixes: eda0333ac293 ("ixgbe: add VF IPsec management") +Reported-by: Dan Carpenter +Link: https://lore.kernel.org/intel-wired-lan/db31a0b0-4d9f-4e6b-aed8-88266eb5665c@moroto.mountain +Reviewed-by: Michal Kubiak +Signed-off-by: Przemek Kitszel +Reviewed-by: Shannon Nelson +Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c +index 13a6fca31004a..866024f2b9eeb 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c +@@ -914,7 +914,13 @@ int ixgbe_ipsec_vf_add_sa(struct ixgbe_adapter *adapter, u32 *msgbuf, u32 vf) + goto err_out; + } + +- xs = kzalloc(sizeof(*xs), GFP_KERNEL); ++ algo = xfrm_aead_get_byname(aes_gcm_name, IXGBE_IPSEC_AUTH_BITS, 1); ++ if (unlikely(!algo)) { ++ err = -ENOENT; ++ goto err_out; ++ } ++ ++ xs = kzalloc(sizeof(*xs), GFP_ATOMIC); + if (unlikely(!xs)) { + err = -ENOMEM; + goto err_out; +@@ -930,14 +936,8 @@ int ixgbe_ipsec_vf_add_sa(struct ixgbe_adapter *adapter, u32 *msgbuf, u32 vf) + memcpy(&xs->id.daddr.a4, sam->addr, sizeof(xs->id.daddr.a4)); + xs->xso.dev = adapter->netdev; + +- algo = xfrm_aead_get_byname(aes_gcm_name, IXGBE_IPSEC_AUTH_BITS, 1); +- if (unlikely(!algo)) { +- err = -ENOENT; +- goto err_xs; +- } +- + aead_len = sizeof(*xs->aead) + IXGBE_IPSEC_KEY_BITS / 8; +- xs->aead = kzalloc(aead_len, GFP_KERNEL); ++ xs->aead = kzalloc(aead_len, GFP_ATOMIC); + if (unlikely(!xs->aead)) { + err = -ENOMEM; + goto err_xs; +-- +2.43.0 + diff --git a/queue-6.8/kbuild-make-woverride-init-warnings-more-consistent.patch b/queue-6.8/kbuild-make-woverride-init-warnings-more-consistent.patch new file mode 100644 index 00000000000..52bb1f14a54 --- /dev/null +++ b/queue-6.8/kbuild-make-woverride-init-warnings-more-consistent.patch @@ -0,0 +1,256 @@ +From 2d65d6764176574b705a07883dfea48c56cb133d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 15:47:16 +0100 +Subject: kbuild: make -Woverride-init warnings more consistent + +From: Arnd Bergmann + +[ Upstream commit c40845e3195d074b34f8f8e400e28c9403a06588 ] + +The -Woverride-init warn about code that may be intentional or not, +but the inintentional ones tend to be real bugs, so there is a bit of +disagreement on whether this warning option should be enabled by default +and we have multiple settings in scripts/Makefile.extrawarn as well as +individual subsystems. + +Older versions of clang only supported -Wno-initializer-overrides with +the same meaning as gcc's -Woverride-init, though all supported versions +now work with both. Because of this difference, an earlier cleanup of +mine accidentally turned the clang warning off for W=1 builds and only +left it on for W=2, while it's still enabled for gcc with W=1. + +There is also one driver that only turns the warning off for newer +versions of gcc but not other compilers, and some but not all the +Makefiles still use a cc-disable-warning conditional that is no +longer needed with supported compilers here. + +Address all of the above by removing the special cases for clang +and always turning the warning off unconditionally where it got +in the way, using the syntax that is supported by both compilers. + +Fixes: 2cd3271b7a31 ("kbuild: avoid duplicate warning options") +Signed-off-by: Arnd Bergmann +Acked-by: Hamza Mahfooz +Acked-by: Jani Nikula +Acked-by: Andrew Jeffery +Signed-off-by: Jani Nikula +Reviewed-by: Linus Walleij +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce110/Makefile | 2 +- + drivers/gpu/drm/amd/display/dc/dce112/Makefile | 2 +- + drivers/gpu/drm/amd/display/dc/dce120/Makefile | 2 +- + drivers/gpu/drm/amd/display/dc/dce60/Makefile | 2 +- + drivers/gpu/drm/amd/display/dc/dce80/Makefile | 2 +- + drivers/gpu/drm/i915/Makefile | 6 +++--- + drivers/gpu/drm/xe/Makefile | 4 ++-- + drivers/net/ethernet/renesas/sh_eth.c | 2 +- + drivers/pinctrl/aspeed/Makefile | 2 +- + fs/proc/Makefile | 2 +- + kernel/bpf/Makefile | 2 +- + mm/Makefile | 3 +-- + scripts/Makefile.extrawarn | 10 +++------- + 13 files changed, 18 insertions(+), 23 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce110/Makefile b/drivers/gpu/drm/amd/display/dc/dce110/Makefile +index f0777d61c2cbb..c307f040e48fc 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce110/Makefile ++++ b/drivers/gpu/drm/amd/display/dc/dce110/Makefile +@@ -23,7 +23,7 @@ + # Makefile for the 'controller' sub-component of DAL. + # It provides the control and status of HW CRTC block. + +-CFLAGS_$(AMDDALPATH)/dc/dce110/dce110_resource.o = $(call cc-disable-warning, override-init) ++CFLAGS_$(AMDDALPATH)/dc/dce110/dce110_resource.o = -Wno-override-init + + DCE110 = dce110_timing_generator.o \ + dce110_compressor.o dce110_opp_regamma_v.o \ +diff --git a/drivers/gpu/drm/amd/display/dc/dce112/Makefile b/drivers/gpu/drm/amd/display/dc/dce112/Makefile +index 7e92effec8944..683866797709b 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce112/Makefile ++++ b/drivers/gpu/drm/amd/display/dc/dce112/Makefile +@@ -23,7 +23,7 @@ + # Makefile for the 'controller' sub-component of DAL. + # It provides the control and status of HW CRTC block. + +-CFLAGS_$(AMDDALPATH)/dc/dce112/dce112_resource.o = $(call cc-disable-warning, override-init) ++CFLAGS_$(AMDDALPATH)/dc/dce112/dce112_resource.o = -Wno-override-init + + DCE112 = dce112_compressor.o + +diff --git a/drivers/gpu/drm/amd/display/dc/dce120/Makefile b/drivers/gpu/drm/amd/display/dc/dce120/Makefile +index 1e3ef68a452a5..8f508e6627480 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce120/Makefile ++++ b/drivers/gpu/drm/amd/display/dc/dce120/Makefile +@@ -24,7 +24,7 @@ + # It provides the control and status of HW CRTC block. + + +-CFLAGS_$(AMDDALPATH)/dc/dce120/dce120_resource.o = $(call cc-disable-warning, override-init) ++CFLAGS_$(AMDDALPATH)/dc/dce120/dce120_resource.o = -Wno-override-init + + DCE120 = dce120_timing_generator.o + +diff --git a/drivers/gpu/drm/amd/display/dc/dce60/Makefile b/drivers/gpu/drm/amd/display/dc/dce60/Makefile +index fee331accc0e7..eede83ad91fa0 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce60/Makefile ++++ b/drivers/gpu/drm/amd/display/dc/dce60/Makefile +@@ -23,7 +23,7 @@ + # Makefile for the 'controller' sub-component of DAL. + # It provides the control and status of HW CRTC block. + +-CFLAGS_$(AMDDALPATH)/dc/dce60/dce60_resource.o = $(call cc-disable-warning, override-init) ++CFLAGS_$(AMDDALPATH)/dc/dce60/dce60_resource.o = -Wno-override-init + + DCE60 = dce60_timing_generator.o dce60_hw_sequencer.o \ + dce60_resource.o +diff --git a/drivers/gpu/drm/amd/display/dc/dce80/Makefile b/drivers/gpu/drm/amd/display/dc/dce80/Makefile +index 7eefffbdc9253..fba189d26652d 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce80/Makefile ++++ b/drivers/gpu/drm/amd/display/dc/dce80/Makefile +@@ -23,7 +23,7 @@ + # Makefile for the 'controller' sub-component of DAL. + # It provides the control and status of HW CRTC block. + +-CFLAGS_$(AMDDALPATH)/dc/dce80/dce80_resource.o = $(call cc-disable-warning, override-init) ++CFLAGS_$(AMDDALPATH)/dc/dce80/dce80_resource.o = -Wno-override-init + + DCE80 = dce80_timing_generator.o + +diff --git a/drivers/gpu/drm/i915/Makefile b/drivers/gpu/drm/i915/Makefile +index c13f14edb5088..7b20c2bcc641d 100644 +--- a/drivers/gpu/drm/i915/Makefile ++++ b/drivers/gpu/drm/i915/Makefile +@@ -33,9 +33,9 @@ endif + subdir-ccflags-$(CONFIG_DRM_I915_WERROR) += -Werror + + # Fine grained warnings disable +-CFLAGS_i915_pci.o = $(call cc-disable-warning, override-init) +-CFLAGS_display/intel_display_device.o = $(call cc-disable-warning, override-init) +-CFLAGS_display/intel_fbdev.o = $(call cc-disable-warning, override-init) ++CFLAGS_i915_pci.o = -Wno-override-init ++CFLAGS_display/intel_display_device.o = -Wno-override-init ++CFLAGS_display/intel_fbdev.o = -Wno-override-init + + # Support compiling the display code separately for both i915 and xe + # drivers. Define I915 when building i915. +diff --git a/drivers/gpu/drm/xe/Makefile b/drivers/gpu/drm/xe/Makefile +index 802c807c782cc..1c9e6906b06a2 100644 +--- a/drivers/gpu/drm/xe/Makefile ++++ b/drivers/gpu/drm/xe/Makefile +@@ -162,8 +162,8 @@ subdir-ccflags-$(CONFIG_DRM_XE_DISPLAY) += \ + -Ddrm_i915_gem_object=xe_bo \ + -Ddrm_i915_private=xe_device + +-CFLAGS_i915-display/intel_fbdev.o = $(call cc-disable-warning, override-init) +-CFLAGS_i915-display/intel_display_device.o = $(call cc-disable-warning, override-init) ++CFLAGS_i915-display/intel_fbdev.o = -Wno-override-init ++CFLAGS_i915-display/intel_display_device.o = -Wno-override-init + + # Rule to build SOC code shared with i915 + $(obj)/i915-soc/%.o: $(srctree)/drivers/gpu/drm/i915/soc/%.c FORCE +diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c +index 475e1e8c1d35f..0786eb0da3914 100644 +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -50,7 +50,7 @@ + * the macros available to do this only define GCC 8. + */ + __diag_push(); +-__diag_ignore(GCC, 8, "-Woverride-init", ++__diag_ignore_all("-Woverride-init", + "logic to initialize all and then override some is OK"); + static const u16 sh_eth_offset_gigabit[SH_ETH_MAX_REGISTER_OFFSET] = { + SH_ETH_OFFSET_DEFAULTS, +diff --git a/drivers/pinctrl/aspeed/Makefile b/drivers/pinctrl/aspeed/Makefile +index 489ea1778353f..db2a7600ae2bd 100644 +--- a/drivers/pinctrl/aspeed/Makefile ++++ b/drivers/pinctrl/aspeed/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0-only + # Aspeed pinctrl support + +-ccflags-y += $(call cc-option,-Woverride-init) ++ccflags-y += -Woverride-init + obj-$(CONFIG_PINCTRL_ASPEED) += pinctrl-aspeed.o pinmux-aspeed.o + obj-$(CONFIG_PINCTRL_ASPEED_G4) += pinctrl-aspeed-g4.o + obj-$(CONFIG_PINCTRL_ASPEED_G5) += pinctrl-aspeed-g5.o +diff --git a/fs/proc/Makefile b/fs/proc/Makefile +index bd08616ed8bad..7b4db9c56e6a7 100644 +--- a/fs/proc/Makefile ++++ b/fs/proc/Makefile +@@ -5,7 +5,7 @@ + + obj-y += proc.o + +-CFLAGS_task_mmu.o += $(call cc-option,-Wno-override-init,) ++CFLAGS_task_mmu.o += -Wno-override-init + proc-y := nommu.o task_nommu.o + proc-$(CONFIG_MMU) := task_mmu.o + +diff --git a/kernel/bpf/Makefile b/kernel/bpf/Makefile +index f526b7573e97c..418a8188a8e84 100644 +--- a/kernel/bpf/Makefile ++++ b/kernel/bpf/Makefile +@@ -4,7 +4,7 @@ ifneq ($(CONFIG_BPF_JIT_ALWAYS_ON),y) + # ___bpf_prog_run() needs GCSE disabled on x86; see 3193c0836f203 for details + cflags-nogcse-$(CONFIG_X86)$(CONFIG_CC_IS_GCC) := -fno-gcse + endif +-CFLAGS_core.o += $(call cc-disable-warning, override-init) $(cflags-nogcse-yy) ++CFLAGS_core.o += -Wno-override-init $(cflags-nogcse-yy) + + obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o inode.o helpers.o tnum.o log.o + obj-$(CONFIG_BPF_SYSCALL) += bpf_iter.o map_iter.o task_iter.o prog_iter.o link_iter.o +diff --git a/mm/Makefile b/mm/Makefile +index e4b5b75aaec9c..4abb40b911ec4 100644 +--- a/mm/Makefile ++++ b/mm/Makefile +@@ -29,8 +29,7 @@ KCOV_INSTRUMENT_mmzone.o := n + KCOV_INSTRUMENT_vmstat.o := n + KCOV_INSTRUMENT_failslab.o := n + +-CFLAGS_init-mm.o += $(call cc-disable-warning, override-init) +-CFLAGS_init-mm.o += $(call cc-disable-warning, initializer-overrides) ++CFLAGS_init-mm.o += -Wno-override-init + + mmu-y := nommu.o + mmu-$(CONFIG_MMU) := highmem.o memory.o mincore.o \ +diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn +index 2f25a1de129d1..5660b96213e4b 100644 +--- a/scripts/Makefile.extrawarn ++++ b/scripts/Makefile.extrawarn +@@ -114,6 +114,8 @@ KBUILD_CFLAGS += $(call cc-disable-warning, format-overflow) + KBUILD_CFLAGS += $(call cc-disable-warning, format-truncation) + KBUILD_CFLAGS += $(call cc-disable-warning, stringop-truncation) + ++KBUILD_CFLAGS += -Wno-override-init # alias for -Wno-initializer-overrides in clang ++ + ifdef CONFIG_CC_IS_CLANG + # Clang before clang-16 would warn on default argument promotions. + ifneq ($(call clang-min-version, 160000),y) +@@ -151,10 +153,6 @@ KBUILD_CFLAGS += -Wtype-limits + KBUILD_CFLAGS += $(call cc-option, -Wmaybe-uninitialized) + KBUILD_CFLAGS += $(call cc-option, -Wunused-macros) + +-ifdef CONFIG_CC_IS_CLANG +-KBUILD_CFLAGS += -Winitializer-overrides +-endif +- + KBUILD_CPPFLAGS += -DKBUILD_EXTRA_WARN2 + + else +@@ -164,9 +162,7 @@ KBUILD_CFLAGS += -Wno-missing-field-initializers + KBUILD_CFLAGS += -Wno-type-limits + KBUILD_CFLAGS += -Wno-shift-negative-value + +-ifdef CONFIG_CC_IS_CLANG +-KBUILD_CFLAGS += -Wno-initializer-overrides +-else ++ifdef CONFIG_CC_IS_GCC + KBUILD_CFLAGS += -Wno-maybe-uninitialized + endif + +-- +2.43.0 + diff --git a/queue-6.8/mlxbf_gige-call-request_irq-after-napi-initialized.patch b/queue-6.8/mlxbf_gige-call-request_irq-after-napi-initialized.patch new file mode 100644 index 00000000000..55d4ef31ebb --- /dev/null +++ b/queue-6.8/mlxbf_gige-call-request_irq-after-napi-initialized.patch @@ -0,0 +1,168 @@ +From 91d5fd0c1b25eee5a3b97699781a37550f155e65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 14:36:27 -0400 +Subject: mlxbf_gige: call request_irq() after NAPI initialized + +From: David Thompson + +[ Upstream commit f7442a634ac06b953fc1f7418f307b25acd4cfbc ] + +The mlxbf_gige driver encounters a NULL pointer exception in +mlxbf_gige_open() when kdump is enabled. The sequence to reproduce +the exception is as follows: +a) enable kdump +b) trigger kdump via "echo c > /proc/sysrq-trigger" +c) kdump kernel executes +d) kdump kernel loads mlxbf_gige module +e) the mlxbf_gige module runs its open() as the + the "oob_net0" interface is brought up +f) mlxbf_gige module will experience an exception + during its open(), something like: + + Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 + Mem abort info: + ESR = 0x0000000086000004 + EC = 0x21: IABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 + FSC = 0x04: level 0 translation fault + user pgtable: 4k pages, 48-bit VAs, pgdp=00000000e29a4000 + [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 + Internal error: Oops: 0000000086000004 [#1] SMP + CPU: 0 PID: 812 Comm: NetworkManager Tainted: G OE 5.15.0-1035-bluefield #37-Ubuntu + Hardware name: https://www.mellanox.com BlueField-3 SmartNIC Main Card/BlueField-3 SmartNIC Main Card, BIOS 4.6.0.13024 Jan 19 2024 + pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : 0x0 + lr : __napi_poll+0x40/0x230 + sp : ffff800008003e00 + x29: ffff800008003e00 x28: 0000000000000000 x27: 00000000ffffffff + x26: ffff000066027238 x25: ffff00007cedec00 x24: ffff800008003ec8 + x23: 000000000000012c x22: ffff800008003eb7 x21: 0000000000000000 + x20: 0000000000000001 x19: ffff000066027238 x18: 0000000000000000 + x17: ffff578fcb450000 x16: ffffa870b083c7c0 x15: 0000aaab010441d0 + x14: 0000000000000001 x13: 00726f7272655f65 x12: 6769675f6662786c + x11: 0000000000000000 x10: 0000000000000000 x9 : ffffa870b0842398 + x8 : 0000000000000004 x7 : fe5a48b9069706ea x6 : 17fdb11fc84ae0d2 + x5 : d94a82549d594f35 x4 : 0000000000000000 x3 : 0000000000400100 + x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000066027238 + Call trace: + 0x0 + net_rx_action+0x178/0x360 + __do_softirq+0x15c/0x428 + __irq_exit_rcu+0xac/0xec + irq_exit+0x18/0x2c + handle_domain_irq+0x6c/0xa0 + gic_handle_irq+0xec/0x1b0 + call_on_irq_stack+0x20/0x2c + do_interrupt_handler+0x5c/0x70 + el1_interrupt+0x30/0x50 + el1h_64_irq_handler+0x18/0x2c + el1h_64_irq+0x7c/0x80 + __setup_irq+0x4c0/0x950 + request_threaded_irq+0xf4/0x1bc + mlxbf_gige_request_irqs+0x68/0x110 [mlxbf_gige] + mlxbf_gige_open+0x5c/0x170 [mlxbf_gige] + __dev_open+0x100/0x220 + __dev_change_flags+0x16c/0x1f0 + dev_change_flags+0x2c/0x70 + do_setlink+0x220/0xa40 + __rtnl_newlink+0x56c/0x8a0 + rtnl_newlink+0x58/0x84 + rtnetlink_rcv_msg+0x138/0x3c4 + netlink_rcv_skb+0x64/0x130 + rtnetlink_rcv+0x20/0x30 + netlink_unicast+0x2ec/0x360 + netlink_sendmsg+0x278/0x490 + __sock_sendmsg+0x5c/0x6c + ____sys_sendmsg+0x290/0x2d4 + ___sys_sendmsg+0x84/0xd0 + __sys_sendmsg+0x70/0xd0 + __arm64_sys_sendmsg+0x2c/0x40 + invoke_syscall+0x78/0x100 + el0_svc_common.constprop.0+0x54/0x184 + do_el0_svc+0x30/0xac + el0_svc+0x48/0x160 + el0t_64_sync_handler+0xa4/0x12c + el0t_64_sync+0x1a4/0x1a8 + Code: bad PC value + ---[ end trace 7d1c3f3bf9d81885 ]--- + Kernel panic - not syncing: Oops: Fatal exception in interrupt + Kernel Offset: 0x2870a7a00000 from 0xffff800008000000 + PHYS_OFFSET: 0x80000000 + CPU features: 0x0,000005c1,a3332a5a + Memory Limit: none + ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]--- + +The exception happens because there is a pending RX interrupt before the +call to request_irq(RX IRQ) executes. Then, the RX IRQ handler fires +immediately after this request_irq() completes. The RX IRQ handler runs +"napi_schedule()" before NAPI is fully initialized via "netif_napi_add()" +and "napi_enable()", both which happen later in the open() logic. + +The logic in mlxbf_gige_open() must fully initialize NAPI before any calls +to request_irq() execute. + +Fixes: f92e1869d74e ("Add Mellanox BlueField Gigabit Ethernet driver") +Signed-off-by: David Thompson +Reviewed-by: Asmaa Mnebhi +Link: https://lore.kernel.org/r/20240325183627.7641-1-davthompson@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../mellanox/mlxbf_gige/mlxbf_gige_main.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c +index cef0e2d3f1a7b..77134ca929382 100644 +--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c ++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c +@@ -139,13 +139,10 @@ static int mlxbf_gige_open(struct net_device *netdev) + control |= MLXBF_GIGE_CONTROL_PORT_EN; + writeq(control, priv->base + MLXBF_GIGE_CONTROL); + +- err = mlxbf_gige_request_irqs(priv); +- if (err) +- return err; + mlxbf_gige_cache_stats(priv); + err = mlxbf_gige_clean_port(priv); + if (err) +- goto free_irqs; ++ return err; + + /* Clear driver's valid_polarity to match hardware, + * since the above call to clean_port() resets the +@@ -166,6 +163,10 @@ static int mlxbf_gige_open(struct net_device *netdev) + napi_enable(&priv->napi); + netif_start_queue(netdev); + ++ err = mlxbf_gige_request_irqs(priv); ++ if (err) ++ goto napi_deinit; ++ + /* Set bits in INT_EN that we care about */ + int_en = MLXBF_GIGE_INT_EN_HW_ACCESS_ERROR | + MLXBF_GIGE_INT_EN_TX_CHECKSUM_INPUTS | +@@ -182,14 +183,17 @@ static int mlxbf_gige_open(struct net_device *netdev) + + return 0; + ++napi_deinit: ++ netif_stop_queue(netdev); ++ napi_disable(&priv->napi); ++ netif_napi_del(&priv->napi); ++ mlxbf_gige_rx_deinit(priv); ++ + tx_deinit: + mlxbf_gige_tx_deinit(priv); + + phy_deinit: + phy_stop(phydev); +- +-free_irqs: +- mlxbf_gige_free_irqs(priv); + return err; + } + +-- +2.43.0 + diff --git a/queue-6.8/mlxbf_gige-stop-phy-during-open-error-paths.patch b/queue-6.8/mlxbf_gige-stop-phy-during-open-error-paths.patch new file mode 100644 index 00000000000..19424495ca6 --- /dev/null +++ b/queue-6.8/mlxbf_gige-stop-phy-during-open-error-paths.patch @@ -0,0 +1,50 @@ +From 2aaf004aa92ac925670749b45e46f69e5629ad19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Mar 2024 15:31:17 -0400 +Subject: mlxbf_gige: stop PHY during open() error paths + +From: David Thompson + +[ Upstream commit d6c30c5a168f8586b8bcc0d8e42e2456eb05209b ] + +The mlxbf_gige_open() routine starts the PHY as part of normal +initialization. The mlxbf_gige_open() routine must stop the +PHY during its error paths. + +Fixes: f92e1869d74e ("Add Mellanox BlueField Gigabit Ethernet driver") +Signed-off-by: David Thompson +Reviewed-by: Asmaa Mnebhi +Reviewed-by: Andrew Lunn +Reviewed-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c +index 3d09fa54598f1..cef0e2d3f1a7b 100644 +--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c ++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c +@@ -157,7 +157,7 @@ static int mlxbf_gige_open(struct net_device *netdev) + + err = mlxbf_gige_tx_init(priv); + if (err) +- goto free_irqs; ++ goto phy_deinit; + err = mlxbf_gige_rx_init(priv); + if (err) + goto tx_deinit; +@@ -185,6 +185,9 @@ static int mlxbf_gige_open(struct net_device *netdev) + tx_deinit: + mlxbf_gige_tx_deinit(priv); + ++phy_deinit: ++ phy_stop(phydev); ++ + free_irqs: + mlxbf_gige_free_irqs(priv); + return err; +-- +2.43.0 + diff --git a/queue-6.8/mm-treewide-replace-pud_large-with-pud_leaf.patch b/queue-6.8/mm-treewide-replace-pud_large-with-pud_leaf.patch new file mode 100644 index 00000000000..cda0aff8d6e --- /dev/null +++ b/queue-6.8/mm-treewide-replace-pud_large-with-pud_leaf.patch @@ -0,0 +1,402 @@ +From e45e809bd3b45fa491cc233a5e9ed5d23249e89a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 12:37:48 +0800 +Subject: mm/treewide: replace pud_large() with pud_leaf() + +From: Peter Xu + +[ Upstream commit 0a845e0f6348ccfa2dcc8c450ffd1c9ffe8c4add ] + +pud_large() is always defined as pud_leaf(). Merge their usages. Chose +pud_leaf() because pud_leaf() is a global API, while pud_large() is not. + +Link: https://lkml.kernel.org/r/20240305043750.93762-9-peterx@redhat.com +Signed-off-by: Peter Xu +Reviewed-by: Jason Gunthorpe +Cc: Alexander Potapenko +Cc: Andrey Konovalov +Cc: Andrey Ryabinin +Cc: "Aneesh Kumar K.V" +Cc: Borislav Petkov +Cc: Christophe Leroy +Cc: Dave Hansen +Cc: Dmitry Vyukov +Cc: Ingo Molnar +Cc: Kirill A. Shutemov +Cc: Michael Ellerman +Cc: Muchun Song +Cc: "Naveen N. Rao" +Cc: Nicholas Piggin +Cc: Thomas Gleixner +Cc: Vincenzo Frascino +Cc: Yang Shi +Signed-off-by: Andrew Morton +Stable-dep-of: c567f2948f57 ("Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped."") +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/book3s64/pgtable.c | 2 +- + arch/s390/boot/vmem.c | 2 +- + arch/s390/include/asm/pgtable.h | 4 ++-- + arch/s390/mm/gmap.c | 2 +- + arch/s390/mm/hugetlbpage.c | 4 ++-- + arch/s390/mm/pageattr.c | 2 +- + arch/s390/mm/pgtable.c | 2 +- + arch/s390/mm/vmem.c | 6 +++--- + arch/sparc/mm/init_64.c | 2 +- + arch/x86/kvm/mmu/mmu.c | 2 +- + arch/x86/mm/fault.c | 4 ++-- + arch/x86/mm/ident_map.c | 2 +- + arch/x86/mm/init_64.c | 4 ++-- + arch/x86/mm/kasan_init_64.c | 2 +- + arch/x86/mm/mem_encrypt_identity.c | 2 +- + arch/x86/mm/pat/set_memory.c | 6 +++--- + arch/x86/mm/pgtable.c | 2 +- + arch/x86/mm/pti.c | 2 +- + arch/x86/power/hibernate.c | 2 +- + arch/x86/xen/mmu_pv.c | 4 ++-- + 20 files changed, 29 insertions(+), 29 deletions(-) + +diff --git a/arch/powerpc/mm/book3s64/pgtable.c b/arch/powerpc/mm/book3s64/pgtable.c +index 3438ab72c346b..d975fb5d7cbe4 100644 +--- a/arch/powerpc/mm/book3s64/pgtable.c ++++ b/arch/powerpc/mm/book3s64/pgtable.c +@@ -130,7 +130,7 @@ void set_pud_at(struct mm_struct *mm, unsigned long addr, + + WARN_ON(pte_hw_valid(pud_pte(*pudp))); + assert_spin_locked(pud_lockptr(mm, pudp)); +- WARN_ON(!(pud_large(pud))); ++ WARN_ON(!(pud_leaf(pud))); + #endif + trace_hugepage_set_pud(addr, pud_val(pud)); + return set_pte_at(mm, addr, pudp_ptep(pudp), pud_pte(pud)); +diff --git a/arch/s390/boot/vmem.c b/arch/s390/boot/vmem.c +index e3a4500a5a757..47e1f54c587ae 100644 +--- a/arch/s390/boot/vmem.c ++++ b/arch/s390/boot/vmem.c +@@ -366,7 +366,7 @@ static void pgtable_pud_populate(p4d_t *p4d, unsigned long addr, unsigned long e + } + pmd = boot_crst_alloc(_SEGMENT_ENTRY_EMPTY); + pud_populate(&init_mm, pud, pmd); +- } else if (pud_large(*pud)) { ++ } else if (pud_leaf(*pud)) { + continue; + } + pgtable_pmd_populate(pud, addr, next, mode); +diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h +index 1299b56e43f6f..12a7b86789259 100644 +--- a/arch/s390/include/asm/pgtable.h ++++ b/arch/s390/include/asm/pgtable.h +@@ -730,7 +730,7 @@ static inline int pud_bad(pud_t pud) + { + unsigned long type = pud_val(pud) & _REGION_ENTRY_TYPE_MASK; + +- if (type > _REGION_ENTRY_TYPE_R3 || pud_large(pud)) ++ if (type > _REGION_ENTRY_TYPE_R3 || pud_leaf(pud)) + return 1; + if (type < _REGION_ENTRY_TYPE_R3) + return 0; +@@ -1398,7 +1398,7 @@ static inline unsigned long pud_deref(pud_t pud) + unsigned long origin_mask; + + origin_mask = _REGION_ENTRY_ORIGIN; +- if (pud_large(pud)) ++ if (pud_leaf(pud)) + origin_mask = _REGION3_ENTRY_ORIGIN_LARGE; + return (unsigned long)__va(pud_val(pud) & origin_mask); + } +diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c +index 8da39deb56ca4..08a7eca03daf7 100644 +--- a/arch/s390/mm/gmap.c ++++ b/arch/s390/mm/gmap.c +@@ -596,7 +596,7 @@ int __gmap_link(struct gmap *gmap, unsigned long gaddr, unsigned long vmaddr) + pud = pud_offset(p4d, vmaddr); + VM_BUG_ON(pud_none(*pud)); + /* large puds cannot yet be handled */ +- if (pud_large(*pud)) ++ if (pud_leaf(*pud)) + return -EFAULT; + pmd = pmd_offset(pud, vmaddr); + VM_BUG_ON(pmd_none(*pmd)); +diff --git a/arch/s390/mm/hugetlbpage.c b/arch/s390/mm/hugetlbpage.c +index 297a6d897d5a0..5f64f3d0fafbb 100644 +--- a/arch/s390/mm/hugetlbpage.c ++++ b/arch/s390/mm/hugetlbpage.c +@@ -224,7 +224,7 @@ pte_t *huge_pte_offset(struct mm_struct *mm, + if (p4d_present(*p4dp)) { + pudp = pud_offset(p4dp, addr); + if (pud_present(*pudp)) { +- if (pud_large(*pudp)) ++ if (pud_leaf(*pudp)) + return (pte_t *) pudp; + pmdp = pmd_offset(pudp, addr); + } +@@ -240,7 +240,7 @@ int pmd_huge(pmd_t pmd) + + int pud_huge(pud_t pud) + { +- return pud_large(pud); ++ return pud_leaf(pud); + } + + bool __init arch_hugetlb_valid_size(unsigned long size) +diff --git a/arch/s390/mm/pageattr.c b/arch/s390/mm/pageattr.c +index 631e3a4ee2de8..739185fc39ead 100644 +--- a/arch/s390/mm/pageattr.c ++++ b/arch/s390/mm/pageattr.c +@@ -274,7 +274,7 @@ static int walk_pud_level(p4d_t *p4d, unsigned long addr, unsigned long end, + if (pud_none(*pudp)) + return -EINVAL; + next = pud_addr_end(addr, end); +- if (pud_large(*pudp)) { ++ if (pud_leaf(*pudp)) { + need_split = !!(flags & SET_MEMORY_4K); + need_split |= !!(addr & ~PUD_MASK); + need_split |= !!(addr + PUD_SIZE > next); +diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c +index 99422926efe1b..3ff07b6bcd65a 100644 +--- a/arch/s390/mm/pgtable.c ++++ b/arch/s390/mm/pgtable.c +@@ -470,7 +470,7 @@ static int pmd_lookup(struct mm_struct *mm, unsigned long addr, pmd_t **pmdp) + return -ENOENT; + + /* Large PUDs are not supported yet. */ +- if (pud_large(*pud)) ++ if (pud_leaf(*pud)) + return -EFAULT; + + *pmdp = pmd_offset(pud, addr); +diff --git a/arch/s390/mm/vmem.c b/arch/s390/mm/vmem.c +index 186a020857cf6..84e173c02ab91 100644 +--- a/arch/s390/mm/vmem.c ++++ b/arch/s390/mm/vmem.c +@@ -323,7 +323,7 @@ static int modify_pud_table(p4d_t *p4d, unsigned long addr, unsigned long end, + if (!add) { + if (pud_none(*pud)) + continue; +- if (pud_large(*pud)) { ++ if (pud_leaf(*pud)) { + if (IS_ALIGNED(addr, PUD_SIZE) && + IS_ALIGNED(next, PUD_SIZE)) { + pud_clear(pud); +@@ -344,7 +344,7 @@ static int modify_pud_table(p4d_t *p4d, unsigned long addr, unsigned long end, + if (!pmd) + goto out; + pud_populate(&init_mm, pud, pmd); +- } else if (pud_large(*pud)) { ++ } else if (pud_leaf(*pud)) { + continue; + } + ret = modify_pmd_table(pud, addr, next, add, direct); +@@ -591,7 +591,7 @@ pte_t *vmem_get_alloc_pte(unsigned long addr, bool alloc) + if (!pmd) + goto out; + pud_populate(&init_mm, pud, pmd); +- } else if (WARN_ON_ONCE(pud_large(*pud))) { ++ } else if (WARN_ON_ONCE(pud_leaf(*pud))) { + goto out; + } + pmd = pmd_offset(pud, addr); +diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c +index f83017992eaae..d7db4e737218c 100644 +--- a/arch/sparc/mm/init_64.c ++++ b/arch/sparc/mm/init_64.c +@@ -1665,7 +1665,7 @@ bool kern_addr_valid(unsigned long addr) + if (pud_none(*pud)) + return false; + +- if (pud_large(*pud)) ++ if (pud_leaf(*pud)) + return pfn_valid(pud_pfn(*pud)); + + pmd = pmd_offset(pud, addr); +diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c +index 0544700ca50b8..e2c3573f53e43 100644 +--- a/arch/x86/kvm/mmu/mmu.c ++++ b/arch/x86/kvm/mmu/mmu.c +@@ -3126,7 +3126,7 @@ static int host_pfn_mapping_level(struct kvm *kvm, gfn_t gfn, + if (pud_none(pud) || !pud_present(pud)) + goto out; + +- if (pud_large(pud)) { ++ if (pud_leaf(pud)) { + level = PG_LEVEL_1G; + goto out; + } +diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c +index d6375b3c633bc..b01df023de04c 100644 +--- a/arch/x86/mm/fault.c ++++ b/arch/x86/mm/fault.c +@@ -376,7 +376,7 @@ static void dump_pagetable(unsigned long address) + goto bad; + + pr_cont("PUD %lx ", pud_val(*pud)); +- if (!pud_present(*pud) || pud_large(*pud)) ++ if (!pud_present(*pud) || pud_leaf(*pud)) + goto out; + + pmd = pmd_offset(pud, address); +@@ -1037,7 +1037,7 @@ spurious_kernel_fault(unsigned long error_code, unsigned long address) + if (!pud_present(*pud)) + return 0; + +- if (pud_large(*pud)) ++ if (pud_leaf(*pud)) + return spurious_kernel_fault_check(error_code, (pte_t *) pud); + + pmd = pmd_offset(pud, address); +diff --git a/arch/x86/mm/ident_map.c b/arch/x86/mm/ident_map.c +index f50cc210a9818..a204a332c71fc 100644 +--- a/arch/x86/mm/ident_map.c ++++ b/arch/x86/mm/ident_map.c +@@ -33,7 +33,7 @@ static int ident_pud_init(struct x86_mapping_info *info, pud_t *pud_page, + next = end; + + /* if this is already a gbpage, this portion is already mapped */ +- if (pud_large(*pud)) ++ if (pud_leaf(*pud)) + continue; + + /* Is using a gbpage allowed? */ +diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c +index a0dffaca6d2bf..534436c9d3997 100644 +--- a/arch/x86/mm/init_64.c ++++ b/arch/x86/mm/init_64.c +@@ -617,7 +617,7 @@ phys_pud_init(pud_t *pud_page, unsigned long paddr, unsigned long paddr_end, + } + + if (!pud_none(*pud)) { +- if (!pud_large(*pud)) { ++ if (!pud_leaf(*pud)) { + pmd = pmd_offset(pud, 0); + paddr_last = phys_pmd_init(pmd, paddr, + paddr_end, +@@ -1163,7 +1163,7 @@ remove_pud_table(pud_t *pud_start, unsigned long addr, unsigned long end, + if (!pud_present(*pud)) + continue; + +- if (pud_large(*pud) && ++ if (pud_leaf(*pud) && + IS_ALIGNED(addr, PUD_SIZE) && + IS_ALIGNED(next, PUD_SIZE)) { + spin_lock(&init_mm.page_table_lock); +diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c +index 0302491d799d1..fcf508c52bdc5 100644 +--- a/arch/x86/mm/kasan_init_64.c ++++ b/arch/x86/mm/kasan_init_64.c +@@ -115,7 +115,7 @@ static void __init kasan_populate_p4d(p4d_t *p4d, unsigned long addr, + pud = pud_offset(p4d, addr); + do { + next = pud_addr_end(addr, end); +- if (!pud_large(*pud)) ++ if (!pud_leaf(*pud)) + kasan_populate_pud(pud, addr, next, nid); + } while (pud++, addr = next, addr != end); + } +diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c +index 0166ab1780ccb..ead3561359242 100644 +--- a/arch/x86/mm/mem_encrypt_identity.c ++++ b/arch/x86/mm/mem_encrypt_identity.c +@@ -144,7 +144,7 @@ static pud_t __init *sme_prepare_pgd(struct sme_populate_pgd_data *ppd) + set_pud(pud, __pud(PUD_FLAGS | __pa(pmd))); + } + +- if (pud_large(*pud)) ++ if (pud_leaf(*pud)) + return NULL; + + return pud; +diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c +index 1028804040463..135bb594df8b7 100644 +--- a/arch/x86/mm/pat/set_memory.c ++++ b/arch/x86/mm/pat/set_memory.c +@@ -684,7 +684,7 @@ pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address, + return NULL; + + *level = PG_LEVEL_1G; +- if (pud_large(*pud) || !pud_present(*pud)) ++ if (pud_leaf(*pud) || !pud_present(*pud)) + return (pte_t *)pud; + + pmd = pmd_offset(pud, address); +@@ -743,7 +743,7 @@ pmd_t *lookup_pmd_address(unsigned long address) + return NULL; + + pud = pud_offset(p4d, address); +- if (pud_none(*pud) || pud_large(*pud) || !pud_present(*pud)) ++ if (pud_none(*pud) || pud_leaf(*pud) || !pud_present(*pud)) + return NULL; + + return pmd_offset(pud, address); +@@ -1278,7 +1278,7 @@ static void unmap_pud_range(p4d_t *p4d, unsigned long start, unsigned long end) + */ + while (end - start >= PUD_SIZE) { + +- if (pud_large(*pud)) ++ if (pud_leaf(*pud)) + pud_clear(pud); + else + unmap_pmd_range(pud, start, start + PUD_SIZE); +diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c +index 0cbc1b8e8e3d1..a67bb8f982bd5 100644 +--- a/arch/x86/mm/pgtable.c ++++ b/arch/x86/mm/pgtable.c +@@ -777,7 +777,7 @@ int pmd_set_huge(pmd_t *pmd, phys_addr_t addr, pgprot_t prot) + */ + int pud_clear_huge(pud_t *pud) + { +- if (pud_large(*pud)) { ++ if (pud_leaf(*pud)) { + pud_clear(pud); + return 1; + } +diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c +index 669ba1c345b38..912b1da7ed80c 100644 +--- a/arch/x86/mm/pti.c ++++ b/arch/x86/mm/pti.c +@@ -217,7 +217,7 @@ static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address) + + pud = pud_offset(p4d, address); + /* The user page tables do not use large mappings: */ +- if (pud_large(*pud)) { ++ if (pud_leaf(*pud)) { + WARN_ON(1); + return NULL; + } +diff --git a/arch/x86/power/hibernate.c b/arch/x86/power/hibernate.c +index 6f955eb1e1631..d8af46e677503 100644 +--- a/arch/x86/power/hibernate.c ++++ b/arch/x86/power/hibernate.c +@@ -170,7 +170,7 @@ int relocate_restore_code(void) + goto out; + } + pud = pud_offset(p4d, relocated_restore_code); +- if (pud_large(*pud)) { ++ if (pud_leaf(*pud)) { + set_pud(pud, __pud(pud_val(*pud) & ~_PAGE_NX)); + goto out; + } +diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c +index 72af496a160c8..994aef4473a65 100644 +--- a/arch/x86/xen/mmu_pv.c ++++ b/arch/x86/xen/mmu_pv.c +@@ -1082,7 +1082,7 @@ static void __init xen_cleanmfnmap_pud(pud_t *pud, bool unpin) + pmd_t *pmd_tbl; + int i; + +- if (pud_large(*pud)) { ++ if (pud_leaf(*pud)) { + pa = pud_val(*pud) & PHYSICAL_PAGE_MASK; + xen_free_ro_pages(pa, PUD_SIZE); + return; +@@ -1863,7 +1863,7 @@ static phys_addr_t __init xen_early_virt_to_phys(unsigned long vaddr) + if (!pud_present(pud)) + return 0; + pa = pud_val(pud) & PTE_PFN_MASK; +- if (pud_large(pud)) ++ if (pud_leaf(pud)) + return pa + (vaddr & ~PUD_MASK); + + pmd = native_make_pmd(xen_read_phys_ulong(pa + pmd_index(vaddr) * +-- +2.43.0 + diff --git a/queue-6.8/modpost-do-not-make-find_tosym-return-null.patch b/queue-6.8/modpost-do-not-make-find_tosym-return-null.patch new file mode 100644 index 00000000000..d6d70a5d026 --- /dev/null +++ b/queue-6.8/modpost-do-not-make-find_tosym-return-null.patch @@ -0,0 +1,54 @@ +From 5ede8130b2ce0d7e24650e47456e6d1d880b3f10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Mar 2024 20:45:11 +0900 +Subject: modpost: do not make find_tosym() return NULL + +From: Masahiro Yamada + +[ Upstream commit 1102f9f85bf66b1a7bd6a40afb40efbbe05dfc05 ] + +As mentioned in commit 397586506c3d ("modpost: Add '.ltext' and +'.ltext.*' to TEXT_SECTIONS"), modpost can result in a segmentation +fault due to a NULL pointer dereference in default_mismatch_handler(). + +find_tosym() can return the original symbol pointer instead of NULL +if a better one is not found. + +This fixes the reported segmentation fault. + +Fixes: a23e7584ecf3 ("modpost: unify 'sym' and 'to' in default_mismatch_handler()") +Reported-by: Nathan Chancellor +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/mod/modpost.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index 267b9a0a3abcd..6568f8177e392 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -1007,6 +1007,8 @@ static Elf_Sym *find_fromsym(struct elf_info *elf, Elf_Addr addr, + + static Elf_Sym *find_tosym(struct elf_info *elf, Elf_Addr addr, Elf_Sym *sym) + { ++ Elf_Sym *new_sym; ++ + /* If the supplied symbol has a valid name, return it */ + if (is_valid_name(elf, sym)) + return sym; +@@ -1015,8 +1017,9 @@ static Elf_Sym *find_tosym(struct elf_info *elf, Elf_Addr addr, Elf_Sym *sym) + * Strive to find a better symbol name, but the resulting name may not + * match the symbol referenced in the original code. + */ +- return symsearch_find_nearest(elf, addr, get_secindex(elf, sym), +- true, 20); ++ new_sym = symsearch_find_nearest(elf, addr, get_secindex(elf, sym), ++ true, 20); ++ return new_sym ? new_sym : sym; + } + + static bool is_executable_section(struct elf_info *elf, unsigned int secndx) +-- +2.43.0 + diff --git a/queue-6.8/net-bcmasp-bring-up-unimac-after-phy-link-up.patch b/queue-6.8/net-bcmasp-bring-up-unimac-after-phy-link-up.patch new file mode 100644 index 00000000000..fcf5a92d14e --- /dev/null +++ b/queue-6.8/net-bcmasp-bring-up-unimac-after-phy-link-up.patch @@ -0,0 +1,105 @@ +From 852dd25681292e8ee431ef28f61b0e041f242429 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 12:30:24 -0700 +Subject: net: bcmasp: Bring up unimac after PHY link up + +From: Justin Chen + +[ Upstream commit dfd222e2aef68818320a57b13a1c52a44c22bc80 ] + +The unimac requires the PHY RX clk during reset or it may be put +into a bad state. Bring up the unimac after link up to ensure the +PHY RX clk exists. + +Fixes: 490cb412007d ("net: bcmasp: Add support for ASP2.0 Ethernet controller") +Signed-off-by: Justin Chen +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../net/ethernet/broadcom/asp2/bcmasp_intf.c | 28 +++++++++++++------ + 1 file changed, 19 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c b/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c +index 6ad1366270f79..78901e2e73032 100644 +--- a/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c ++++ b/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c +@@ -391,7 +391,9 @@ static void umac_reset(struct bcmasp_intf *intf) + umac_wl(intf, 0x0, UMC_CMD); + umac_wl(intf, UMC_CMD_SW_RESET, UMC_CMD); + usleep_range(10, 100); +- umac_wl(intf, 0x0, UMC_CMD); ++ /* We hold the umac in reset and bring it out of ++ * reset when phy link is up. ++ */ + } + + static void umac_set_hw_addr(struct bcmasp_intf *intf, +@@ -411,6 +413,8 @@ static void umac_enable_set(struct bcmasp_intf *intf, u32 mask, + u32 reg; + + reg = umac_rl(intf, UMC_CMD); ++ if (reg & UMC_CMD_SW_RESET) ++ return; + if (enable) + reg |= mask; + else +@@ -429,7 +433,6 @@ static void umac_init(struct bcmasp_intf *intf) + umac_wl(intf, 0x800, UMC_FRM_LEN); + umac_wl(intf, 0xffff, UMC_PAUSE_CNTRL); + umac_wl(intf, 0x800, UMC_RX_MAX_PKT_SZ); +- umac_enable_set(intf, UMC_CMD_PROMISC, 1); + } + + static int bcmasp_tx_poll(struct napi_struct *napi, int budget) +@@ -656,6 +659,12 @@ static void bcmasp_adj_link(struct net_device *dev) + UMC_CMD_HD_EN | UMC_CMD_RX_PAUSE_IGNORE | + UMC_CMD_TX_PAUSE_IGNORE); + reg |= cmd_bits; ++ if (reg & UMC_CMD_SW_RESET) { ++ reg &= ~UMC_CMD_SW_RESET; ++ umac_wl(intf, reg, UMC_CMD); ++ udelay(2); ++ reg |= UMC_CMD_TX_EN | UMC_CMD_RX_EN | UMC_CMD_PROMISC; ++ } + umac_wl(intf, reg, UMC_CMD); + + intf->eee.eee_active = phy_init_eee(phydev, 0) >= 0; +@@ -1063,9 +1072,6 @@ static int bcmasp_netif_init(struct net_device *dev, bool phy_connect) + + umac_init(intf); + +- /* Disable the UniMAC RX/TX */ +- umac_enable_set(intf, (UMC_CMD_RX_EN | UMC_CMD_TX_EN), 0); +- + umac_set_hw_addr(intf, dev->dev_addr); + + intf->old_duplex = -1; +@@ -1085,9 +1091,6 @@ static int bcmasp_netif_init(struct net_device *dev, bool phy_connect) + + bcmasp_enable_rx(intf, 1); + +- /* Turn on UniMAC TX/RX */ +- umac_enable_set(intf, (UMC_CMD_RX_EN | UMC_CMD_TX_EN), 1); +- + intf->crc_fwd = !!(umac_rl(intf, UMC_CMD) & UMC_CMD_CRC_FWD); + + bcmasp_netif_start(dev); +@@ -1324,7 +1327,14 @@ static void bcmasp_suspend_to_wol(struct bcmasp_intf *intf) + if (intf->wolopts & WAKE_FILTER) + bcmasp_netfilt_suspend(intf); + +- /* UniMAC receive needs to be turned on */ ++ /* Bring UniMAC out of reset if needed and enable RX */ ++ reg = umac_rl(intf, UMC_CMD); ++ if (reg & UMC_CMD_SW_RESET) ++ reg &= ~UMC_CMD_SW_RESET; ++ ++ reg |= UMC_CMD_RX_EN | UMC_CMD_PROMISC; ++ umac_wl(intf, reg, UMC_CMD); ++ + umac_enable_set(intf, UMC_CMD_RX_EN, 1); + + if (intf->parent->wol_irq > 0) { +-- +2.43.0 + diff --git a/queue-6.8/net-hns3-fix-index-limit-to-support-all-queue-stats.patch b/queue-6.8/net-hns3-fix-index-limit-to-support-all-queue-stats.patch new file mode 100644 index 00000000000..1cb93ed886a --- /dev/null +++ b/queue-6.8/net-hns3-fix-index-limit-to-support-all-queue-stats.patch @@ -0,0 +1,40 @@ +From 5aa0a91a6858a446a5719b5d31ed7398c2bc9d53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 20:43:09 +0800 +Subject: net: hns3: fix index limit to support all queue stats + +From: Jie Wang + +[ Upstream commit 47e39d213e09c6cae0d6b4d95e454ea404013312 ] + +Currently, hns hardware supports more than 512 queues and the index limit +in hclge_comm_tqps_update_stats is wrong. So this patch removes it. + +Fixes: 287db5c40d15 ("net: hns3: create new set of common tqp stats APIs for PF and VF reuse") +Signed-off-by: Jie Wang +Signed-off-by: Jijie Shao +Reviewed-by: Michal Kubiak +Reviewed-by: Kalesh AP +Reviewed-by: Simon Horman +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c +index f3c9395d8351c..618f66d9586b3 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c +@@ -85,7 +85,7 @@ int hclge_comm_tqps_update_stats(struct hnae3_handle *handle, + hclge_comm_cmd_setup_basic_desc(&desc, HCLGE_OPC_QUERY_TX_STATS, + true); + +- desc.data[0] = cpu_to_le32(tqp->index & 0x1ff); ++ desc.data[0] = cpu_to_le32(tqp->index); + ret = hclge_comm_cmd_send(hw, &desc, 1); + if (ret) { + dev_err(&hw->cmq.csq.pdev->dev, +-- +2.43.0 + diff --git a/queue-6.8/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch b/queue-6.8/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch new file mode 100644 index 00000000000..a350c569283 --- /dev/null +++ b/queue-6.8/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch @@ -0,0 +1,57 @@ +From 997f0fd61e67ef4785fd27db6fcb32cd7a393fd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 20:43:10 +0800 +Subject: net: hns3: fix kernel crash when devlink reload during pf + initialization + +From: Yonglong Liu + +[ Upstream commit 93305b77ffcb042f1538ecc383505e87d95aa05a ] + +The devlink reload process will access the hardware resources, +but the register operation is done before the hardware is initialized. +So, processing the devlink reload during initialization may lead to kernel +crash. This patch fixes this by taking devl_lock during initialization. + +Fixes: b741269b2759 ("net: hns3: add support for registering devlink for PF") +Signed-off-by: Yonglong Liu +Signed-off-by: Jijie Shao +Reviewed-by: Simon Horman +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 609d3799d7738..a3b7723a97bb1 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -11613,6 +11613,8 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev) + if (ret) + goto err_pci_uninit; + ++ devl_lock(hdev->devlink); ++ + /* Firmware command queue initialize */ + ret = hclge_comm_cmd_queue_init(hdev->pdev, &hdev->hw.hw); + if (ret) +@@ -11792,6 +11794,7 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev) + + hclge_task_schedule(hdev, round_jiffies_relative(HZ)); + ++ devl_unlock(hdev->devlink); + return 0; + + err_mdiobus_unreg: +@@ -11804,6 +11807,7 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev) + err_cmd_uninit: + hclge_comm_cmd_uninit(hdev->ae_dev, &hdev->hw.hw); + err_devlink_uninit: ++ devl_unlock(hdev->devlink); + hclge_devlink_uninit(hdev); + err_pci_uninit: + pcim_iounmap(pdev, hdev->hw.hw.io_base); +-- +2.43.0 + diff --git a/queue-6.8/net-hns3-mark-unexcuted-loopback-test-result-as-unex.patch b/queue-6.8/net-hns3-mark-unexcuted-loopback-test-result-as-unex.patch new file mode 100644 index 00000000000..5e5fc0bbe26 --- /dev/null +++ b/queue-6.8/net-hns3-mark-unexcuted-loopback-test-result-as-unex.patch @@ -0,0 +1,82 @@ +From b8bab6f905a69dbb669703d2e86f63758776df1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 20:43:11 +0800 +Subject: net: hns3: mark unexcuted loopback test result as UNEXECUTED + +From: Jian Shen + +[ Upstream commit 5bd088d6c21a45ee70e6116879310e54174d75eb ] + +Currently, loopback test may be skipped when resetting, but the test +result will still show as 'PASS', because the driver doesn't set +ETH_TEST_FL_FAILED flag. Fix it by setting the flag and +initializating the value to UNEXECUTED. + +Fixes: 4c8dab1c709c ("net: hns3: reconstruct function hns3_self_test") +Signed-off-by: Jian Shen +Signed-off-by: Jijie Shao +Reviewed-by: Michal Kubiak +Reviewed-by: Simon Horman +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../ethernet/hisilicon/hns3/hns3_ethtool.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c +index 999a0ee162a64..941cb529d671f 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c +@@ -78,6 +78,9 @@ static const struct hns3_stats hns3_rxq_stats[] = { + #define HNS3_NIC_LB_TEST_NO_MEM_ERR 1 + #define HNS3_NIC_LB_TEST_TX_CNT_ERR 2 + #define HNS3_NIC_LB_TEST_RX_CNT_ERR 3 ++#define HNS3_NIC_LB_TEST_UNEXECUTED 4 ++ ++static int hns3_get_sset_count(struct net_device *netdev, int stringset); + + static int hns3_lp_setup(struct net_device *ndev, enum hnae3_loop loop, bool en) + { +@@ -418,18 +421,26 @@ static void hns3_do_external_lb(struct net_device *ndev, + static void hns3_self_test(struct net_device *ndev, + struct ethtool_test *eth_test, u64 *data) + { ++ int cnt = hns3_get_sset_count(ndev, ETH_SS_TEST); + struct hns3_nic_priv *priv = netdev_priv(ndev); + struct hnae3_handle *h = priv->ae_handle; + int st_param[HNAE3_LOOP_NONE][2]; + bool if_running = netif_running(ndev); ++ int i; ++ ++ /* initialize the loopback test result, avoid marking an unexcuted ++ * loopback test as PASS. ++ */ ++ for (i = 0; i < cnt; i++) ++ data[i] = HNS3_NIC_LB_TEST_UNEXECUTED; + + if (hns3_nic_resetting(ndev)) { + netdev_err(ndev, "dev resetting!"); +- return; ++ goto failure; + } + + if (!(eth_test->flags & ETH_TEST_FL_OFFLINE)) +- return; ++ goto failure; + + if (netif_msg_ifdown(h)) + netdev_info(ndev, "self test start\n"); +@@ -451,6 +462,10 @@ static void hns3_self_test(struct net_device *ndev, + + if (netif_msg_ifdown(h)) + netdev_info(ndev, "self test end\n"); ++ return; ++ ++failure: ++ eth_test->flags |= ETH_TEST_FL_FAILED; + } + + static void hns3_update_limit_promisc_mode(struct net_device *netdev, +-- +2.43.0 + diff --git a/queue-6.8/net-hsr-hsr_slave-fix-the-promiscuous-mode-in-offloa.patch b/queue-6.8/net-hsr-hsr_slave-fix-the-promiscuous-mode-in-offloa.patch new file mode 100644 index 00000000000..f0c970331dc --- /dev/null +++ b/queue-6.8/net-hsr-hsr_slave-fix-the-promiscuous-mode-in-offloa.patch @@ -0,0 +1,46 @@ +From 36c4d335f28911b3f2c9fbe503ad8f679b21f31e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Mar 2024 15:34:47 +0530 +Subject: net: hsr: hsr_slave: Fix the promiscuous mode in offload mode + +From: Ravi Gunasekaran + +[ Upstream commit b11c81731c810efe592e510bb0110e0db6877419 ] + +commit e748d0fd66ab ("net: hsr: Disable promiscuous mode in +offload mode") disables promiscuous mode of slave devices +while creating an HSR interface. But while deleting the +HSR interface, it does not take care of it. It decreases the +promiscuous mode count, which eventually enables promiscuous +mode on the slave devices when creating HSR interface again. + +Fix this by not decrementing the promiscuous mode count while +deleting the HSR interface when offload is enabled. + +Fixes: e748d0fd66ab ("net: hsr: Disable promiscuous mode in offload mode") +Signed-off-by: Ravi Gunasekaran +Reviewed-by: Jiri Pirko +Link: https://lore.kernel.org/r/20240322100447.27615-1-r-gunasekaran@ti.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/hsr/hsr_slave.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/hsr/hsr_slave.c b/net/hsr/hsr_slave.c +index e5742f2a2d522..1b6457f357bdb 100644 +--- a/net/hsr/hsr_slave.c ++++ b/net/hsr/hsr_slave.c +@@ -220,7 +220,8 @@ void hsr_del_port(struct hsr_port *port) + netdev_update_features(master->dev); + dev_set_mtu(master->dev, hsr_get_max_mtu(hsr)); + netdev_rx_handler_unregister(port->dev); +- dev_set_promiscuity(port->dev, -1); ++ if (!port->hsr->fwd_offloaded) ++ dev_set_promiscuity(port->dev, -1); + netdev_upper_dev_unlink(port->dev, master->dev); + } + +-- +2.43.0 + diff --git a/queue-6.8/net-lan743x-add-set-rfe-read-fifo-threshold-for-pci1.patch b/queue-6.8/net-lan743x-add-set-rfe-read-fifo-threshold-for-pci1.patch new file mode 100644 index 00000000000..39caabd20d4 --- /dev/null +++ b/queue-6.8/net-lan743x-add-set-rfe-read-fifo-threshold-for-pci1.patch @@ -0,0 +1,93 @@ +From bdde1f5e545bf1eed08d5f0c5a97a1b8e19221f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 12:28:05 +0530 +Subject: net: lan743x: Add set RFE read fifo threshold for PCI1x1x chips + +From: Raju Lakkaraju + +[ Upstream commit e4a58989f5c839316ac63675e8800b9eed7dbe96 ] + +PCI11x1x Rev B0 devices might drop packets when receiving back to back frames +at 2.5G link speed. Change the B0 Rev device's Receive filtering Engine FIFO +threshold parameter from its hardware default of 4 to 3 dwords to prevent the +problem. Rev C0 and later hardware already defaults to 3 dwords. + +Fixes: bb4f6bffe33c ("net: lan743x: Add PCI11010 / PCI11414 device IDs") +Signed-off-by: Raju Lakkaraju +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20240326065805.686128-1-Raju.Lakkaraju@microchip.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/microchip/lan743x_main.c | 18 ++++++++++++++++++ + drivers/net/ethernet/microchip/lan743x_main.h | 4 ++++ + 2 files changed, 22 insertions(+) + +diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c +index 45e209a7d0831..6bf3367404eba 100644 +--- a/drivers/net/ethernet/microchip/lan743x_main.c ++++ b/drivers/net/ethernet/microchip/lan743x_main.c +@@ -25,6 +25,8 @@ + #define PCS_POWER_STATE_DOWN 0x6 + #define PCS_POWER_STATE_UP 0x4 + ++#define RFE_RD_FIFO_TH_3_DWORDS 0x3 ++ + static void pci11x1x_strap_get_status(struct lan743x_adapter *adapter) + { + u32 chip_rev; +@@ -3272,6 +3274,21 @@ static void lan743x_full_cleanup(struct lan743x_adapter *adapter) + lan743x_pci_cleanup(adapter); + } + ++static void pci11x1x_set_rfe_rd_fifo_threshold(struct lan743x_adapter *adapter) ++{ ++ u16 rev = adapter->csr.id_rev & ID_REV_CHIP_REV_MASK_; ++ ++ if (rev == ID_REV_CHIP_REV_PCI11X1X_B0_) { ++ u32 misc_ctl; ++ ++ misc_ctl = lan743x_csr_read(adapter, MISC_CTL_0); ++ misc_ctl &= ~MISC_CTL_0_RFE_READ_FIFO_MASK_; ++ misc_ctl |= FIELD_PREP(MISC_CTL_0_RFE_READ_FIFO_MASK_, ++ RFE_RD_FIFO_TH_3_DWORDS); ++ lan743x_csr_write(adapter, MISC_CTL_0, misc_ctl); ++ } ++} ++ + static int lan743x_hardware_init(struct lan743x_adapter *adapter, + struct pci_dev *pdev) + { +@@ -3287,6 +3304,7 @@ static int lan743x_hardware_init(struct lan743x_adapter *adapter, + pci11x1x_strap_get_status(adapter); + spin_lock_init(&adapter->eth_syslock_spinlock); + mutex_init(&adapter->sgmii_rw_lock); ++ pci11x1x_set_rfe_rd_fifo_threshold(adapter); + } else { + adapter->max_tx_channels = LAN743X_MAX_TX_CHANNELS; + adapter->used_tx_channels = LAN743X_USED_TX_CHANNELS; +diff --git a/drivers/net/ethernet/microchip/lan743x_main.h b/drivers/net/ethernet/microchip/lan743x_main.h +index be79cb0ae5af3..645bc048e52ef 100644 +--- a/drivers/net/ethernet/microchip/lan743x_main.h ++++ b/drivers/net/ethernet/microchip/lan743x_main.h +@@ -26,6 +26,7 @@ + #define ID_REV_CHIP_REV_MASK_ (0x0000FFFF) + #define ID_REV_CHIP_REV_A0_ (0x00000000) + #define ID_REV_CHIP_REV_B0_ (0x00000010) ++#define ID_REV_CHIP_REV_PCI11X1X_B0_ (0x000000B0) + + #define FPGA_REV (0x04) + #define FPGA_REV_GET_MINOR_(fpga_rev) (((fpga_rev) >> 8) & 0x000000FF) +@@ -311,6 +312,9 @@ + #define SGMII_CTL_LINK_STATUS_SOURCE_ BIT(8) + #define SGMII_CTL_SGMII_POWER_DN_ BIT(1) + ++#define MISC_CTL_0 (0x920) ++#define MISC_CTL_0_RFE_READ_FIFO_MASK_ GENMASK(6, 4) ++ + /* Vendor Specific SGMII MMD details */ + #define SR_VSMMD_PCS_ID1 0x0004 + #define SR_VSMMD_PCS_ID2 0x0005 +-- +2.43.0 + diff --git a/queue-6.8/net-wwan-t7xx-split-64bit-accesses-to-fix-alignment-.patch b/queue-6.8/net-wwan-t7xx-split-64bit-accesses-to-fix-alignment-.patch new file mode 100644 index 00000000000..b3708e85e7c --- /dev/null +++ b/queue-6.8/net-wwan-t7xx-split-64bit-accesses-to-fix-alignment-.patch @@ -0,0 +1,162 @@ +From 4e819ceba75a7fd5b66d1fe05bceb456bb8ca358 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Mar 2024 15:40:00 +0100 +Subject: net: wwan: t7xx: Split 64bit accesses to fix alignment issues +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bjørn Mork + +[ Upstream commit 7d5a7dd5a35876f0ecc286f3602a88887a788217 ] + +Some of the registers are aligned on a 32bit boundary, causing +alignment faults on 64bit platforms. + + Unable to handle kernel paging request at virtual address ffffffc084a1d004 + Mem abort info: + ESR = 0x0000000096000061 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 + FSC = 0x21: alignment fault + Data abort info: + ISV = 0, ISS = 0x00000061, ISS2 = 0x00000000 + CM = 0, WnR = 1, TnD = 0, TagAccess = 0 + GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 + swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000046ad6000 + [ffffffc084a1d004] pgd=100000013ffff003, p4d=100000013ffff003, pud=100000013ffff003, pmd=0068000020a00711 + Internal error: Oops: 0000000096000061 [#1] SMP + Modules linked in: mtk_t7xx(+) qcserial pppoe ppp_async option nft_fib_inet nf_flow_table_inet mt7921u(O) mt7921s(O) mt7921e(O) mt7921_common(O) iwlmvm(O) iwldvm(O) usb_wwan rndis_host qmi_wwan pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mt7996e(O) mt792x_usb(O) mt792x_lib(O) mt7915e(O) mt76_usb(O) mt76_sdio(O) mt76_connac_lib(O) mt76(O) mac80211(O) iwlwifi(O) huawei_cdc_ncm cfg80211(O) cdc_ncm cdc_ether wwan usbserial usbnet slhc sfp rtc_pcf8563 nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 mt6577_auxadc mdio_i2c libcrc32c compat(O) cdc_wdm cdc_acm at24 crypto_safexcel pwm_fan i2c_gpio i2c_smbus industrialio i2c_algo_bit i2c_mux_reg i2c_mux_pca954x i2c_mux_pca9541 i2c_mux_gpio i2c_mux dummy oid_registry tun sha512_arm64 sha1_ce sha1_generic seqiv + md5 geniv des_generic libdes cbc authencesn authenc leds_gpio xhci_plat_hcd xhci_pci xhci_mtk_hcd xhci_hcd nvme nvme_core gpio_button_hotplug(O) dm_mirror dm_region_hash dm_log dm_crypt dm_mod dax usbcore usb_common ptp aquantia pps_core mii tpm encrypted_keys trusted + CPU: 3 PID: 5266 Comm: kworker/u9:1 Tainted: G O 6.6.22 #0 + Hardware name: Bananapi BPI-R4 (DT) + Workqueue: md_hk_wq t7xx_fsm_uninit [mtk_t7xx] + pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : t7xx_cldma_hw_set_start_addr+0x1c/0x3c [mtk_t7xx] + lr : t7xx_cldma_start+0xac/0x13c [mtk_t7xx] + sp : ffffffc085d63d30 + x29: ffffffc085d63d30 x28: 0000000000000000 x27: 0000000000000000 + x26: 0000000000000000 x25: ffffff80c804f2c0 x24: ffffff80ca196c05 + x23: 0000000000000000 x22: ffffff80c814b9b8 x21: ffffff80c814b128 + x20: 0000000000000001 x19: ffffff80c814b080 x18: 0000000000000014 + x17: 0000000055c9806b x16: 000000007c5296d0 x15: 000000000f6bca68 + x14: 00000000dbdbdce4 x13: 000000001aeaf72a x12: 0000000000000001 + x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 + x8 : ffffff80ca1ef6b4 x7 : ffffff80c814b818 x6 : 0000000000000018 + x5 : 0000000000000870 x4 : 0000000000000000 x3 : 0000000000000000 + x2 : 000000010a947000 x1 : ffffffc084a1d004 x0 : ffffffc084a1d004 + Call trace: + t7xx_cldma_hw_set_start_addr+0x1c/0x3c [mtk_t7xx] + t7xx_fsm_uninit+0x578/0x5ec [mtk_t7xx] + process_one_work+0x154/0x2a0 + worker_thread+0x2ac/0x488 + kthread+0xe0/0xec + ret_from_fork+0x10/0x20 + Code: f9400800 91001000 8b214001 d50332bf (f9000022) + ---[ end trace 0000000000000000 ]--- + +The inclusion of io-64-nonatomic-lo-hi.h indicates that all 64bit +accesses can be replaced by pairs of nonatomic 32bit access. Fix +alignment by forcing all accesses to be 32bit on 64bit platforms. + +Link: https://forum.openwrt.org/t/fibocom-fm350-gl-support/142682/72 +Fixes: 39d439047f1d ("net: wwan: t7xx: Add control DMA interface") +Signed-off-by: Bjørn Mork +Reviewed-by: Sergey Ryazanov +Tested-by: Liviu Dudau +Link: https://lore.kernel.org/r/20240322144000.1683822-1-bjorn@mork.no +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/wwan/t7xx/t7xx_cldma.c | 4 ++-- + drivers/net/wwan/t7xx/t7xx_hif_cldma.c | 9 +++++---- + drivers/net/wwan/t7xx/t7xx_pcie_mac.c | 8 ++++---- + 3 files changed, 11 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/wwan/t7xx/t7xx_cldma.c b/drivers/net/wwan/t7xx/t7xx_cldma.c +index 9f43f256db1d0..f0a4783baf1f3 100644 +--- a/drivers/net/wwan/t7xx/t7xx_cldma.c ++++ b/drivers/net/wwan/t7xx/t7xx_cldma.c +@@ -106,7 +106,7 @@ bool t7xx_cldma_tx_addr_is_set(struct t7xx_cldma_hw *hw_info, unsigned int qno) + { + u32 offset = REG_CLDMA_UL_START_ADDRL_0 + qno * ADDR_SIZE; + +- return ioread64(hw_info->ap_pdn_base + offset); ++ return ioread64_lo_hi(hw_info->ap_pdn_base + offset); + } + + void t7xx_cldma_hw_set_start_addr(struct t7xx_cldma_hw *hw_info, unsigned int qno, u64 address, +@@ -117,7 +117,7 @@ void t7xx_cldma_hw_set_start_addr(struct t7xx_cldma_hw *hw_info, unsigned int qn + + reg = tx_rx == MTK_RX ? hw_info->ap_ao_base + REG_CLDMA_DL_START_ADDRL_0 : + hw_info->ap_pdn_base + REG_CLDMA_UL_START_ADDRL_0; +- iowrite64(address, reg + offset); ++ iowrite64_lo_hi(address, reg + offset); + } + + void t7xx_cldma_hw_resume_queue(struct t7xx_cldma_hw *hw_info, unsigned int qno, +diff --git a/drivers/net/wwan/t7xx/t7xx_hif_cldma.c b/drivers/net/wwan/t7xx/t7xx_hif_cldma.c +index cc70360364b7d..554ba4669cc8d 100644 +--- a/drivers/net/wwan/t7xx/t7xx_hif_cldma.c ++++ b/drivers/net/wwan/t7xx/t7xx_hif_cldma.c +@@ -139,8 +139,9 @@ static int t7xx_cldma_gpd_rx_from_q(struct cldma_queue *queue, int budget, bool + return -ENODEV; + } + +- gpd_addr = ioread64(hw_info->ap_pdn_base + REG_CLDMA_DL_CURRENT_ADDRL_0 + +- queue->index * sizeof(u64)); ++ gpd_addr = ioread64_lo_hi(hw_info->ap_pdn_base + ++ REG_CLDMA_DL_CURRENT_ADDRL_0 + ++ queue->index * sizeof(u64)); + if (req->gpd_addr == gpd_addr || hwo_polling_count++ >= 100) + return 0; + +@@ -318,8 +319,8 @@ static void t7xx_cldma_txq_empty_hndl(struct cldma_queue *queue) + struct t7xx_cldma_hw *hw_info = &md_ctrl->hw_info; + + /* Check current processing TGPD, 64-bit address is in a table by Q index */ +- ul_curr_addr = ioread64(hw_info->ap_pdn_base + REG_CLDMA_UL_CURRENT_ADDRL_0 + +- queue->index * sizeof(u64)); ++ ul_curr_addr = ioread64_lo_hi(hw_info->ap_pdn_base + REG_CLDMA_UL_CURRENT_ADDRL_0 + ++ queue->index * sizeof(u64)); + if (req->gpd_addr != ul_curr_addr) { + spin_unlock_irqrestore(&md_ctrl->cldma_lock, flags); + dev_err(md_ctrl->dev, "CLDMA%d queue %d is not empty\n", +diff --git a/drivers/net/wwan/t7xx/t7xx_pcie_mac.c b/drivers/net/wwan/t7xx/t7xx_pcie_mac.c +index 76da4c15e3de1..f071ec7ff23d5 100644 +--- a/drivers/net/wwan/t7xx/t7xx_pcie_mac.c ++++ b/drivers/net/wwan/t7xx/t7xx_pcie_mac.c +@@ -75,7 +75,7 @@ static void t7xx_pcie_mac_atr_tables_dis(void __iomem *pbase, enum t7xx_atr_src_ + for (i = 0; i < ATR_TABLE_NUM_PER_ATR; i++) { + offset = ATR_PORT_OFFSET * port + ATR_TABLE_OFFSET * i; + reg = pbase + ATR_PCIE_WIN0_T0_ATR_PARAM_SRC_ADDR + offset; +- iowrite64(0, reg); ++ iowrite64_lo_hi(0, reg); + } + } + +@@ -112,17 +112,17 @@ static int t7xx_pcie_mac_atr_cfg(struct t7xx_pci_dev *t7xx_dev, struct t7xx_atr_ + + reg = pbase + ATR_PCIE_WIN0_T0_TRSL_ADDR + offset; + value = cfg->trsl_addr & ATR_PCIE_WIN0_ADDR_ALGMT; +- iowrite64(value, reg); ++ iowrite64_lo_hi(value, reg); + + reg = pbase + ATR_PCIE_WIN0_T0_TRSL_PARAM + offset; + iowrite32(cfg->trsl_id, reg); + + reg = pbase + ATR_PCIE_WIN0_T0_ATR_PARAM_SRC_ADDR + offset; + value = (cfg->src_addr & ATR_PCIE_WIN0_ADDR_ALGMT) | (atr_size << 1) | BIT(0); +- iowrite64(value, reg); ++ iowrite64_lo_hi(value, reg); + + /* Ensure ATR is set */ +- ioread64(reg); ++ ioread64_lo_hi(reg); + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.8/netfilter-nf_tables-reject-destroy-command-to-remove.patch b/queue-6.8/netfilter-nf_tables-reject-destroy-command-to-remove.patch new file mode 100644 index 00000000000..daa3b57ae8f --- /dev/null +++ b/queue-6.8/netfilter-nf_tables-reject-destroy-command-to-remove.patch @@ -0,0 +1,37 @@ +From 215fac04bcb5388ec6f4b30dc214d6c484af1106 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Mar 2024 01:27:50 +0100 +Subject: netfilter: nf_tables: reject destroy command to remove basechain + hooks + +From: Pablo Neira Ayuso + +[ Upstream commit b32ca27fa238ff83427d23bef2a5b741e2a88a1e ] + +Report EOPNOTSUPP if NFT_MSG_DESTROYCHAIN is used to delete hooks in an +existing netdev basechain, thus, only NFT_MSG_DELCHAIN is allowed. + +Fixes: 7d937b107108f ("netfilter: nf_tables: support for deleting devices in an existing netdev chain") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index ec6266c1972c0..00288b31f734c 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -2932,7 +2932,8 @@ static int nf_tables_delchain(struct sk_buff *skb, const struct nfnl_info *info, + nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); + + if (nla[NFTA_CHAIN_HOOK]) { +- if (chain->flags & NFT_CHAIN_HW_OFFLOAD) ++ if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYCHAIN || ++ chain->flags & NFT_CHAIN_HW_OFFLOAD) + return -EOPNOTSUPP; + + if (nft_is_base_chain(chain)) { +-- +2.43.0 + diff --git a/queue-6.8/netfilter-nf_tables-reject-table-flag-and-netdev-bas.patch b/queue-6.8/netfilter-nf_tables-reject-table-flag-and-netdev-bas.patch new file mode 100644 index 00000000000..996c1599e7e --- /dev/null +++ b/queue-6.8/netfilter-nf_tables-reject-table-flag-and-netdev-bas.patch @@ -0,0 +1,99 @@ +From 24c3a7d923529a5cb7754cedc7c94e8ab519bf09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Mar 2024 01:27:59 +0100 +Subject: netfilter: nf_tables: reject table flag and netdev basechain updates + +From: Pablo Neira Ayuso + +[ Upstream commit 1e1fb6f00f52812277963365d9bd835b9b0ea4e0 ] + +netdev basechain updates are stored in the transaction object hook list. +When setting on the table dormant flag, it iterates over the existing +hooks in the basechain. Thus, skipping the hooks that are being +added/deleted in this transaction, which leaves hook registration in +inconsistent state. + +Reject table flag updates in combination with netdev basechain updates +in the same batch: + +- Update table flags and add/delete basechain: Check from basechain update + path if there are pending flag updates for this table. +- add/delete basechain and update table flags: Iterate over the transaction + list to search for basechain updates from the table update path. + +In both cases, the batch is rejected. Based on suggestion from Florian Westphal. + +Fixes: b9703ed44ffb ("netfilter: nf_tables: support for adding new devices to an existing netdev chain") +Fixes: 7d937b107108f ("netfilter: nf_tables: support for deleting devices in an existing netdev chain") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 31 ++++++++++++++++++++++++++++++- + 1 file changed, 30 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 00288b31f734c..db233965631bb 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -1198,6 +1198,25 @@ static void nf_tables_table_disable(struct net *net, struct nft_table *table) + #define __NFT_TABLE_F_UPDATE (__NFT_TABLE_F_WAS_DORMANT | \ + __NFT_TABLE_F_WAS_AWAKEN) + ++static bool nft_table_pending_update(const struct nft_ctx *ctx) ++{ ++ struct nftables_pernet *nft_net = nft_pernet(ctx->net); ++ struct nft_trans *trans; ++ ++ if (ctx->table->flags & __NFT_TABLE_F_UPDATE) ++ return true; ++ ++ list_for_each_entry(trans, &nft_net->commit_list, list) { ++ if ((trans->msg_type == NFT_MSG_NEWCHAIN || ++ trans->msg_type == NFT_MSG_DELCHAIN) && ++ trans->ctx.table == ctx->table && ++ nft_trans_chain_update(trans)) ++ return true; ++ } ++ ++ return false; ++} ++ + static int nf_tables_updtable(struct nft_ctx *ctx) + { + struct nft_trans *trans; +@@ -1221,7 +1240,7 @@ static int nf_tables_updtable(struct nft_ctx *ctx) + return -EOPNOTSUPP; + + /* No dormant off/on/off/on games in single transaction */ +- if (ctx->table->flags & __NFT_TABLE_F_UPDATE) ++ if (nft_table_pending_update(ctx)) + return -EINVAL; + + trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE, +@@ -2619,6 +2638,13 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, + } + } + ++ if (table->flags & __NFT_TABLE_F_UPDATE && ++ !list_empty(&hook.list)) { ++ NL_SET_BAD_ATTR(extack, attr); ++ err = -EOPNOTSUPP; ++ goto err_hooks; ++ } ++ + if (!(table->flags & NFT_TABLE_F_DORMANT) && + nft_is_base_chain(chain) && + !list_empty(&hook.list)) { +@@ -2848,6 +2874,9 @@ static int nft_delchain_hook(struct nft_ctx *ctx, + struct nft_trans *trans; + int err; + ++ if (ctx->table->flags & __NFT_TABLE_F_UPDATE) ++ return -EOPNOTSUPP; ++ + err = nft_chain_parse_hook(ctx->net, basechain, nla, &chain_hook, + ctx->family, chain->flags, extack); + if (err < 0) +-- +2.43.0 + diff --git a/queue-6.8/netfilter-nf_tables-skip-netdev-hook-unregistration-.patch b/queue-6.8/netfilter-nf_tables-skip-netdev-hook-unregistration-.patch new file mode 100644 index 00000000000..279bd74c1cd --- /dev/null +++ b/queue-6.8/netfilter-nf_tables-skip-netdev-hook-unregistration-.patch @@ -0,0 +1,59 @@ +From cde5c117c02c65dcbf8178532de396e9eb8d00a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Mar 2024 01:28:07 +0100 +Subject: netfilter: nf_tables: skip netdev hook unregistration if table is + dormant + +From: Pablo Neira Ayuso + +[ Upstream commit 216e7bf7402caf73f4939a8e0248392e96d7c0da ] + +Skip hook unregistration when adding or deleting devices from an +existing netdev basechain. Otherwise, commit/abort path try to +unregister hooks which not enabled. + +Fixes: b9703ed44ffb ("netfilter: nf_tables: support for adding new devices to an existing netdev chain") +Fixes: 7d937b107108 ("netfilter: nf_tables: support for deleting devices in an existing netdev chain") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index db233965631bb..8ccda4af3f80d 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -10208,9 +10208,11 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) + if (nft_trans_chain_update(trans)) { + nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN, + &nft_trans_chain_hooks(trans)); +- nft_netdev_unregister_hooks(net, +- &nft_trans_chain_hooks(trans), +- true); ++ if (!(trans->ctx.table->flags & NFT_TABLE_F_DORMANT)) { ++ nft_netdev_unregister_hooks(net, ++ &nft_trans_chain_hooks(trans), ++ true); ++ } + } else { + nft_chain_del(trans->ctx.chain); + nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN, +@@ -10482,9 +10484,11 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) + break; + case NFT_MSG_NEWCHAIN: + if (nft_trans_chain_update(trans)) { +- nft_netdev_unregister_hooks(net, +- &nft_trans_chain_hooks(trans), +- true); ++ if (!(trans->ctx.table->flags & NFT_TABLE_F_DORMANT)) { ++ nft_netdev_unregister_hooks(net, ++ &nft_trans_chain_hooks(trans), ++ true); ++ } + free_percpu(nft_trans_chain_stats(trans)); + kfree(nft_trans_chain_name(trans)); + nft_trans_destroy(trans); +-- +2.43.0 + diff --git a/queue-6.8/nfc-nci-fix-uninit-value-in-nci_dev_up-and-nci_ntf_p.patch b/queue-6.8/nfc-nci-fix-uninit-value-in-nci_dev_up-and-nci_ntf_p.patch new file mode 100644 index 00000000000..a7f25624bab --- /dev/null +++ b/queue-6.8/nfc-nci-fix-uninit-value-in-nci_dev_up-and-nci_ntf_p.patch @@ -0,0 +1,53 @@ +From 5dee6c3d953de0bf14841fdfc896f92eaab31548 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Mar 2024 09:54:10 +0900 +Subject: nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet + +From: Ryosuke Yasuoka + +[ Upstream commit d24b03535e5eb82e025219c2f632b485409c898f ] + +syzbot reported the following uninit-value access issue [1][2]: + +nci_rx_work() parses and processes received packet. When the payload +length is zero, each message type handler reads uninitialized payload +and KMSAN detects this issue. The receipt of a packet with a zero-size +payload is considered unexpected, and therefore, such packets should be +silently discarded. + +This patch resolved this issue by checking payload size before calling +each message type handler codes. + +Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") +Reported-and-tested-by: syzbot+7ea9413ea6749baf5574@syzkaller.appspotmail.com +Reported-and-tested-by: syzbot+29b5ca705d2e0f4a44d2@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=7ea9413ea6749baf5574 [1] +Closes: https://syzkaller.appspot.com/bug?extid=29b5ca705d2e0f4a44d2 [2] +Signed-off-by: Ryosuke Yasuoka +Reviewed-by: Jeremy Cline +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/nfc/nci/core.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c +index cdad47b140fa4..0d26c8ec9993e 100644 +--- a/net/nfc/nci/core.c ++++ b/net/nfc/nci/core.c +@@ -1516,6 +1516,11 @@ static void nci_rx_work(struct work_struct *work) + nfc_send_to_raw_sock(ndev->nfc_dev, skb, + RAW_PAYLOAD_NCI, NFC_DIRECTION_RX); + ++ if (!nci_plen(skb->data)) { ++ kfree_skb(skb); ++ break; ++ } ++ + /* Process frame */ + switch (nci_mt(skb->data)) { + case NCI_MT_RSP_PKT: +-- +2.43.0 + diff --git a/queue-6.8/nfsd-fix-error-cleanup-path-in-nfsd_rename.patch b/queue-6.8/nfsd-fix-error-cleanup-path-in-nfsd_rename.patch new file mode 100644 index 00000000000..ab8db0f622d --- /dev/null +++ b/queue-6.8/nfsd-fix-error-cleanup-path-in-nfsd_rename.patch @@ -0,0 +1,48 @@ +From cb45d2959913f0f89a9cceaeb7789b340645d014 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Mar 2024 17:32:09 +0100 +Subject: nfsd: Fix error cleanup path in nfsd_rename() + +From: Jan Kara + +[ Upstream commit 9fe6e9e7b58944037714442384075c17cfde1c56 ] + +Commit a8b0026847b8 ("rename(): avoid a deadlock in the case of parents +having no common ancestor") added an error bail out path. However this +path does not drop the remount protection that has been acquired. Fix +the cleanup path to properly drop the remount protection. + +Fixes: a8b0026847b8 ("rename(): avoid a deadlock in the case of parents having no common ancestor") +Signed-off-by: Jan Kara +Reviewed-by: Jeff Layton +Acked-by: Al Viro +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/vfs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c +index b7c7a9273ea01..4ed1e83defa23 100644 +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -1833,7 +1833,7 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, + trap = lock_rename(tdentry, fdentry); + if (IS_ERR(trap)) { + err = (rqstp->rq_vers == 2) ? nfserr_acces : nfserr_xdev; +- goto out; ++ goto out_want_write; + } + err = fh_fill_pre_attrs(ffhp); + if (err != nfs_ok) +@@ -1903,6 +1903,7 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, + } + out_unlock: + unlock_rename(tdentry, fdentry); ++out_want_write: + fh_drop_write(ffhp); + + /* +-- +2.43.0 + diff --git a/queue-6.8/octeontx2-af-fix-pause-frame-configuration-in-gmp-mo.patch b/queue-6.8/octeontx2-af-fix-pause-frame-configuration-in-gmp-mo.patch new file mode 100644 index 00000000000..ad4b742201b --- /dev/null +++ b/queue-6.8/octeontx2-af-fix-pause-frame-configuration-in-gmp-mo.patch @@ -0,0 +1,46 @@ +From 23abf4b0b8c4796b77d0a0e03cde859448955f68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 10:57:20 +0530 +Subject: Octeontx2-af: fix pause frame configuration in GMP mode + +From: Hariprasad Kelam + +[ Upstream commit 40d4b4807cadd83fb3f46cc8cd67a945b5b25461 ] + +The Octeontx2 MAC block (CGX) has separate data paths (SMU and GMP) for +different speeds, allowing for efficient data transfer. + +The previous patch which added pause frame configuration has a bug due +to which pause frame feature is not working in GMP mode. + +This patch fixes the issue by configurating appropriate registers. + +Fixes: f7e086e754fe ("octeontx2-af: Pause frame configuration at cgx") +Signed-off-by: Hariprasad Kelam +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20240326052720.4441-1-hkelam@marvell.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +index 3c0f55b3e48ea..b86f3224f0b78 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +@@ -808,6 +808,11 @@ static int cgx_lmac_enadis_pause_frm(void *cgxd, int lmac_id, + if (!is_lmac_valid(cgx, lmac_id)) + return -ENODEV; + ++ cfg = cgx_read(cgx, lmac_id, CGXX_GMP_GMI_RXX_FRM_CTL); ++ cfg &= ~CGX_GMP_GMI_RXX_FRM_CTL_CTL_BCK; ++ cfg |= rx_pause ? CGX_GMP_GMI_RXX_FRM_CTL_CTL_BCK : 0x0; ++ cgx_write(cgx, lmac_id, CGXX_GMP_GMI_RXX_FRM_CTL, cfg); ++ + cfg = cgx_read(cgx, lmac_id, CGXX_SMUX_RX_FRM_CTL); + cfg &= ~CGX_SMUX_RX_FRM_CTL_CTL_BCK; + cfg |= rx_pause ? CGX_SMUX_RX_FRM_CTL_CTL_BCK : 0x0; +-- +2.43.0 + diff --git a/queue-6.8/revert-x86-mm-ident_map-use-gbpages-only-where-full-.patch b/queue-6.8/revert-x86-mm-ident_map-use-gbpages-only-where-full-.patch new file mode 100644 index 00000000000..efa2a5a9834 --- /dev/null +++ b/queue-6.8/revert-x86-mm-ident_map-use-gbpages-only-where-full-.patch @@ -0,0 +1,80 @@ +From ca7d59f8b0da69525bd6288eee3f2786773eb5db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 11:47:51 +0100 +Subject: Revert "x86/mm/ident_map: Use gbpages only where full GB page should + be mapped." + +From: Ingo Molnar + +[ Upstream commit c567f2948f57bdc03ed03403ae0234085f376b7d ] + +This reverts commit d794734c9bbfe22f86686dc2909c25f5ffe1a572. + +While the original change tries to fix a bug, it also unintentionally broke +existing systems, see the regressions reported at: + + https://lore.kernel.org/all/3a1b9909-45ac-4f97-ad68-d16ef1ce99db@pavinjoseph.com/ + +Since d794734c9bbf was also marked for -stable, let's back it out before +causing more damage. + +Note that due to another upstream change the revert was not 100% automatic: + + 0a845e0f6348 mm/treewide: replace pud_large() with pud_leaf() + +Signed-off-by: Ingo Molnar +Cc: +Cc: Russ Anderson +Cc: Steve Wahl +Cc: Dave Hansen +Link: https://lore.kernel.org/all/3a1b9909-45ac-4f97-ad68-d16ef1ce99db@pavinjoseph.com/ +Fixes: d794734c9bbf ("x86/mm/ident_map: Use gbpages only where full GB page should be mapped.") +Signed-off-by: Sasha Levin +--- + arch/x86/mm/ident_map.c | 23 +++++------------------ + 1 file changed, 5 insertions(+), 18 deletions(-) + +diff --git a/arch/x86/mm/ident_map.c b/arch/x86/mm/ident_map.c +index a204a332c71fc..968d7005f4a72 100644 +--- a/arch/x86/mm/ident_map.c ++++ b/arch/x86/mm/ident_map.c +@@ -26,31 +26,18 @@ static int ident_pud_init(struct x86_mapping_info *info, pud_t *pud_page, + for (; addr < end; addr = next) { + pud_t *pud = pud_page + pud_index(addr); + pmd_t *pmd; +- bool use_gbpage; + + next = (addr & PUD_MASK) + PUD_SIZE; + if (next > end) + next = end; + +- /* if this is already a gbpage, this portion is already mapped */ +- if (pud_leaf(*pud)) +- continue; +- +- /* Is using a gbpage allowed? */ +- use_gbpage = info->direct_gbpages; +- +- /* Don't use gbpage if it maps more than the requested region. */ +- /* at the begining: */ +- use_gbpage &= ((addr & ~PUD_MASK) == 0); +- /* ... or at the end: */ +- use_gbpage &= ((next & ~PUD_MASK) == 0); +- +- /* Never overwrite existing mappings */ +- use_gbpage &= !pud_present(*pud); +- +- if (use_gbpage) { ++ if (info->direct_gbpages) { + pud_t pudval; + ++ if (pud_present(*pud)) ++ continue; ++ ++ addr &= PUD_MASK; + pudval = __pud((addr - info->offset) | info->page_flag); + set_pud(pud, pudval); + continue; +-- +2.43.0 + diff --git a/queue-6.8/s390-bpf-fix-bpf_plt-pointer-arithmetic.patch b/queue-6.8/s390-bpf-fix-bpf_plt-pointer-arithmetic.patch new file mode 100644 index 00000000000..64f748fc502 --- /dev/null +++ b/queue-6.8/s390-bpf-fix-bpf_plt-pointer-arithmetic.patch @@ -0,0 +1,163 @@ +From 1a12c6969579b7f5124906a1c927afb91caf391c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Mar 2024 02:54:12 +0100 +Subject: s390/bpf: Fix bpf_plt pointer arithmetic + +From: Ilya Leoshkevich + +[ Upstream commit 7ded842b356d151ece8ac4985940438e6d3998bb ] + +Kui-Feng Lee reported a crash on s390x triggered by the +dummy_st_ops/dummy_init_ptr_arg test [1]: + + [<0000000000000002>] 0x2 + [<00000000009d5cde>] bpf_struct_ops_test_run+0x156/0x250 + [<000000000033145a>] __sys_bpf+0xa1a/0xd00 + [<00000000003319dc>] __s390x_sys_bpf+0x44/0x50 + [<0000000000c4382c>] __do_syscall+0x244/0x300 + [<0000000000c59a40>] system_call+0x70/0x98 + +This is caused by GCC moving memcpy() after assignments in +bpf_jit_plt(), resulting in NULL pointers being written instead of +the return and the target addresses. + +Looking at the GCC internals, the reordering is allowed because the +alias analysis thinks that the memcpy() destination and the assignments' +left-hand-sides are based on different objects: new_plt and +bpf_plt_ret/bpf_plt_target respectively, and therefore they cannot +alias. + +This is in turn due to a violation of the C standard: + + When two pointers are subtracted, both shall point to elements of the + same array object, or one past the last element of the array object + ... + +From the C's perspective, bpf_plt_ret and bpf_plt are distinct objects +and cannot be subtracted. In the practical terms, doing so confuses the +GCC's alias analysis. + +The code was written this way in order to let the C side know a few +offsets defined in the assembly. While nice, this is by no means +necessary. Fix the noncompliance by hardcoding these offsets. + +[1] https://lore.kernel.org/bpf/c9923c1d-971d-4022-8dc8-1364e929d34c@gmail.com/ + +Fixes: f1d5df84cd8c ("s390/bpf: Implement bpf_arch_text_poke()") +Signed-off-by: Ilya Leoshkevich +Message-ID: <20240320015515.11883-1-iii@linux.ibm.com> +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + arch/s390/net/bpf_jit_comp.c | 46 ++++++++++++++++-------------------- + 1 file changed, 20 insertions(+), 26 deletions(-) + +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index b418333bb0863..5af0402e94b88 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -516,11 +516,12 @@ static void bpf_skip(struct bpf_jit *jit, int size) + * PLT for hotpatchable calls. The calling convention is the same as for the + * ftrace hotpatch trampolines: %r0 is return address, %r1 is clobbered. + */ +-extern const char bpf_plt[]; +-extern const char bpf_plt_ret[]; +-extern const char bpf_plt_target[]; +-extern const char bpf_plt_end[]; +-#define BPF_PLT_SIZE 32 ++struct bpf_plt { ++ char code[16]; ++ void *ret; ++ void *target; ++} __packed; ++extern const struct bpf_plt bpf_plt; + asm( + ".pushsection .rodata\n" + " .balign 8\n" +@@ -531,15 +532,14 @@ asm( + " .balign 8\n" + "bpf_plt_ret: .quad 0\n" + "bpf_plt_target: .quad 0\n" +- "bpf_plt_end:\n" + " .popsection\n" + ); + +-static void bpf_jit_plt(void *plt, void *ret, void *target) ++static void bpf_jit_plt(struct bpf_plt *plt, void *ret, void *target) + { +- memcpy(plt, bpf_plt, BPF_PLT_SIZE); +- *(void **)((char *)plt + (bpf_plt_ret - bpf_plt)) = ret; +- *(void **)((char *)plt + (bpf_plt_target - bpf_plt)) = target ?: ret; ++ memcpy(plt, &bpf_plt, sizeof(*plt)); ++ plt->ret = ret; ++ plt->target = target; + } + + /* +@@ -662,9 +662,9 @@ static void bpf_jit_epilogue(struct bpf_jit *jit, u32 stack_depth) + jit->prg = ALIGN(jit->prg, 8); + jit->prologue_plt = jit->prg; + if (jit->prg_buf) +- bpf_jit_plt(jit->prg_buf + jit->prg, ++ bpf_jit_plt((struct bpf_plt *)(jit->prg_buf + jit->prg), + jit->prg_buf + jit->prologue_plt_ret, NULL); +- jit->prg += BPF_PLT_SIZE; ++ jit->prg += sizeof(struct bpf_plt); + } + + static int get_probe_mem_regno(const u8 *insn) +@@ -2040,9 +2040,6 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) + struct bpf_jit jit; + int pass; + +- if (WARN_ON_ONCE(bpf_plt_end - bpf_plt != BPF_PLT_SIZE)) +- return orig_fp; +- + if (!fp->jit_requested) + return orig_fp; + +@@ -2148,14 +2145,11 @@ bool bpf_jit_supports_far_kfunc_call(void) + int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type t, + void *old_addr, void *new_addr) + { ++ struct bpf_plt expected_plt, current_plt, new_plt, *plt; + struct { + u16 opc; + s32 disp; + } __packed insn; +- char expected_plt[BPF_PLT_SIZE]; +- char current_plt[BPF_PLT_SIZE]; +- char new_plt[BPF_PLT_SIZE]; +- char *plt; + char *ret; + int err; + +@@ -2174,18 +2168,18 @@ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type t, + */ + } else { + /* Verify the PLT. */ +- plt = (char *)ip + (insn.disp << 1); +- err = copy_from_kernel_nofault(current_plt, plt, BPF_PLT_SIZE); ++ plt = ip + (insn.disp << 1); ++ err = copy_from_kernel_nofault(¤t_plt, plt, ++ sizeof(current_plt)); + if (err < 0) + return err; + ret = (char *)ip + 6; +- bpf_jit_plt(expected_plt, ret, old_addr); +- if (memcmp(current_plt, expected_plt, BPF_PLT_SIZE)) ++ bpf_jit_plt(&expected_plt, ret, old_addr); ++ if (memcmp(¤t_plt, &expected_plt, sizeof(current_plt))) + return -EINVAL; + /* Adjust the call address. */ +- bpf_jit_plt(new_plt, ret, new_addr); +- s390_kernel_write(plt + (bpf_plt_target - bpf_plt), +- new_plt + (bpf_plt_target - bpf_plt), ++ bpf_jit_plt(&new_plt, ret, new_addr); ++ s390_kernel_write(&plt->target, &new_plt.target, + sizeof(void *)); + } + +-- +2.43.0 + diff --git a/queue-6.8/s390-qeth-handle-deferred-cc1.patch b/queue-6.8/s390-qeth-handle-deferred-cc1.patch new file mode 100644 index 00000000000..951792f0024 --- /dev/null +++ b/queue-6.8/s390-qeth-handle-deferred-cc1.patch @@ -0,0 +1,116 @@ +From 0d8ef5e478f8129b4ff37f4d82a55f48165a5157 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Mar 2024 12:53:37 +0100 +Subject: s390/qeth: handle deferred cc1 + +From: Alexandra Winter + +[ Upstream commit afb373ff3f54c9d909efc7f810dc80a9742807b2 ] + +The IO subsystem expects a driver to retry a ccw_device_start, when the +subsequent interrupt response block (irb) contains a deferred +condition code 1. + +Symptoms before this commit: +On the read channel we always trigger the next read anyhow, so no +different behaviour here. +On the write channel we may experience timeout errors, because the +expected reply will never be received without the retry. +Other callers of qeth_send_control_data() may wrongly assume that the ccw +was successful, which may cause problems later. + +Note that since +commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers") +and +commit 5ef1dc40ffa6 ("s390/cio: fix invalid -EBUSY on ccw_device_start") +deferred CC1s are much more likely to occur. See the commit message of the +latter for more background information. + +Fixes: 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers") +Signed-off-by: Alexandra Winter +Co-developed-by: Thorsten Winkler +Signed-off-by: Thorsten Winkler +Reviewed-by: Peter Oberparleiter +Link: https://lore.kernel.org/r/20240321115337.3564694-1-wintera@linux.ibm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/s390/net/qeth_core_main.c | 38 +++++++++++++++++++++++++++++-- + 1 file changed, 36 insertions(+), 2 deletions(-) + +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index cf8506d0f185c..601d00e09de4a 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -1179,6 +1179,20 @@ static int qeth_check_irb_error(struct qeth_card *card, struct ccw_device *cdev, + } + } + ++/** ++ * qeth_irq() - qeth interrupt handler ++ * @cdev: ccw device ++ * @intparm: expect pointer to iob ++ * @irb: Interruption Response Block ++ * ++ * In the good path: ++ * corresponding qeth channel is locked with last used iob as active_cmd. ++ * But this function is also called for error interrupts. ++ * ++ * Caller ensures that: ++ * Interrupts are disabled; ccw device lock is held; ++ * ++ */ + static void qeth_irq(struct ccw_device *cdev, unsigned long intparm, + struct irb *irb) + { +@@ -1220,11 +1234,10 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm, + iob = (struct qeth_cmd_buffer *) (addr_t)intparm; + } + +- qeth_unlock_channel(card, channel); +- + rc = qeth_check_irb_error(card, cdev, irb); + if (rc) { + /* IO was terminated, free its resources. */ ++ qeth_unlock_channel(card, channel); + if (iob) + qeth_cancel_cmd(iob, rc); + return; +@@ -1268,6 +1281,7 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm, + rc = qeth_get_problem(card, cdev, irb); + if (rc) { + card->read_or_write_problem = 1; ++ qeth_unlock_channel(card, channel); + if (iob) + qeth_cancel_cmd(iob, rc); + qeth_clear_ipacmd_list(card); +@@ -1276,6 +1290,26 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm, + } + } + ++ if (scsw_cmd_is_valid_cc(&irb->scsw) && irb->scsw.cmd.cc == 1 && iob) { ++ /* channel command hasn't started: retry. ++ * active_cmd is still set to last iob ++ */ ++ QETH_CARD_TEXT(card, 2, "irqcc1"); ++ rc = ccw_device_start_timeout(cdev, __ccw_from_cmd(iob), ++ (addr_t)iob, 0, 0, iob->timeout); ++ if (rc) { ++ QETH_DBF_MESSAGE(2, ++ "ccw retry on %x failed, rc = %i\n", ++ CARD_DEVID(card), rc); ++ QETH_CARD_TEXT_(card, 2, " err%d", rc); ++ qeth_unlock_channel(card, channel); ++ qeth_cancel_cmd(iob, rc); ++ } ++ return; ++ } ++ ++ qeth_unlock_channel(card, channel); ++ + if (iob) { + /* sanity check: */ + if (irb->scsw.cmd.count > iob->length) { +-- +2.43.0 + diff --git a/queue-6.8/scripts-bpf_doc-use-silent-mode-when-exec-make-cmd.patch b/queue-6.8/scripts-bpf_doc-use-silent-mode-when-exec-make-cmd.patch new file mode 100644 index 00000000000..be23e9e5fc5 --- /dev/null +++ b/queue-6.8/scripts-bpf_doc-use-silent-mode-when-exec-make-cmd.patch @@ -0,0 +1,60 @@ +From 062e2e468c5eda2d055ffee6ab5dc87b11c7ca21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 10:34:43 +0800 +Subject: scripts/bpf_doc: Use silent mode when exec make cmd + +From: Hangbin Liu + +[ Upstream commit 5384cc0d1a88c27448a6a4e65b8abe6486de8012 ] + +When getting kernel version via make, the result may be polluted by other +output, like directory change info. e.g. + + $ export MAKEFLAGS="-w" + $ make kernelversion + make: Entering directory '/home/net' + 6.8.0 + make: Leaving directory '/home/net' + +This will distort the reStructuredText output and make latter rst2man +failed like: + + [...] + bpf-helpers.rst:20: (WARNING/2) Field list ends without a blank line; unexpected unindent. + [...] + +Using silent mode would help. e.g. + + $ make -s --no-print-directory kernelversion + 6.8.0 + +Fixes: fd0a38f9c37d ("scripts/bpf: Set version attribute for bpf-helpers(7) man page") +Signed-off-by: Michael Hofmann +Signed-off-by: Hangbin Liu +Signed-off-by: Daniel Borkmann +Reviewed-by: Quentin Monnet +Acked-by: Alejandro Colomar +Link: https://lore.kernel.org/bpf/20240315023443.2364442-1-liuhangbin@gmail.com +Signed-off-by: Sasha Levin +--- + scripts/bpf_doc.py | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/scripts/bpf_doc.py b/scripts/bpf_doc.py +index 0669bac5e900e..3f899cc7e99a9 100755 +--- a/scripts/bpf_doc.py ++++ b/scripts/bpf_doc.py +@@ -414,8 +414,8 @@ class PrinterRST(Printer): + version = version.stdout.decode().rstrip() + except: + try: +- version = subprocess.run(['make', 'kernelversion'], cwd=linuxRoot, +- capture_output=True, check=True) ++ version = subprocess.run(['make', '-s', '--no-print-directory', 'kernelversion'], ++ cwd=linuxRoot, capture_output=True, check=True) + version = version.stdout.decode().rstrip() + except: + return 'Linux' +-- +2.43.0 + diff --git a/queue-6.8/selftests-vxlan_mdb-fix-failures-with-old-libnet.patch b/queue-6.8/selftests-vxlan_mdb-fix-failures-with-old-libnet.patch new file mode 100644 index 00000000000..ce5e01936e8 --- /dev/null +++ b/queue-6.8/selftests-vxlan_mdb-fix-failures-with-old-libnet.patch @@ -0,0 +1,978 @@ +From e6e0f0a4ddaeb8b42c9ae445b297fb57b060aa4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 09:50:30 +0200 +Subject: selftests: vxlan_mdb: Fix failures with old libnet + +From: Ido Schimmel + +[ Upstream commit f1425529c33def8b46faae4400dd9e2bbaf16a05 ] + +Locally generated IP multicast packets (such as the ones used in the +test) do not perform routing and simply egress the bound device. + +However, as explained in commit 8bcfb4ae4d97 ("selftests: forwarding: +Fix failing tests with old libnet"), old versions of libnet (used by +mausezahn) do not use the "SO_BINDTODEVICE" socket option. Specifically, +the library started using the option for IPv6 sockets in version 1.1.6 +and for IPv4 sockets in version 1.2. This explains why on Ubuntu - which +uses version 1.1.6 - the IPv4 overlay tests are failing whereas the IPv6 +ones are passing. + +Fix by specifying the source and destination MAC of the packets which +will cause mausezahn to use a packet socket instead of an IP socket. + +Fixes: 62199e3f1658 ("selftests: net: Add VXLAN MDB test") +Reported-by: Mirsad Todorovac +Closes: https://lore.kernel.org/netdev/5bb50349-196d-4892-8ed2-f37543aa863f@alu.unizg.hr/ +Tested-by: Mirsad Todorovac +Signed-off-by: Ido Schimmel +Link: https://lore.kernel.org/r/20240325075030.2379513-1-idosch@nvidia.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/test_vxlan_mdb.sh | 205 +++++++++++------- + 1 file changed, 128 insertions(+), 77 deletions(-) + +diff --git a/tools/testing/selftests/net/test_vxlan_mdb.sh b/tools/testing/selftests/net/test_vxlan_mdb.sh +index 84a05a9e46d86..04fb17a92e993 100755 +--- a/tools/testing/selftests/net/test_vxlan_mdb.sh ++++ b/tools/testing/selftests/net/test_vxlan_mdb.sh +@@ -1177,6 +1177,7 @@ encap_params_common() + local plen=$1; shift + local enc_ethtype=$1; shift + local grp=$1; shift ++ local grp_dmac=$1; shift + local src=$1; shift + local mz=$1; shift + +@@ -1195,11 +1196,11 @@ encap_params_common() + run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent dst $vtep2_ip src_vni 10020" + + run_cmd "tc -n $ns2 filter replace dev vx0 ingress pref 1 handle 101 proto all flower enc_dst_ip $vtep1_ip action pass" +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 1 + log_test $? 0 "Destination IP - match" + +- run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 1 + log_test $? 0 "Destination IP - no match" + +@@ -1212,20 +1213,20 @@ encap_params_common() + run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent dst $vtep1_ip dst_port 1111 src_vni 10020" + + run_cmd "tc -n $ns2 filter replace dev veth0 ingress pref 1 handle 101 proto $enc_ethtype flower ip_proto udp dst_port 4789 action pass" +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev veth0 ingress" 101 1 + log_test $? 0 "Default destination port - match" + +- run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev veth0 ingress" 101 1 + log_test $? 0 "Default destination port - no match" + + run_cmd "tc -n $ns2 filter replace dev veth0 ingress pref 1 handle 101 proto $enc_ethtype flower ip_proto udp dst_port 1111 action pass" +- run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev veth0 ingress" 101 1 + log_test $? 0 "Non-default destination port - match" + +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev veth0 ingress" 101 1 + log_test $? 0 "Non-default destination port - no match" + +@@ -1238,11 +1239,11 @@ encap_params_common() + run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent dst $vtep1_ip src_vni 10020" + + run_cmd "tc -n $ns2 filter replace dev vx0 ingress pref 1 handle 101 proto all flower enc_key_id 10010 action pass" +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 1 + log_test $? 0 "Default destination VNI - match" + +- run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 1 + log_test $? 0 "Default destination VNI - no match" + +@@ -1250,11 +1251,11 @@ encap_params_common() + run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent dst $vtep1_ip vni 10010 src_vni 10020" + + run_cmd "tc -n $ns2 filter replace dev vx0 ingress pref 1 handle 101 proto all flower enc_key_id 10020 action pass" +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 1 + log_test $? 0 "Non-default destination VNI - match" + +- run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 1 + log_test $? 0 "Non-default destination VNI - no match" + +@@ -1272,6 +1273,7 @@ encap_params_ipv4_ipv4() + local plen=32 + local enc_ethtype="ip" + local grp=239.1.1.1 ++ local grp_dmac=01:00:5e:01:01:01 + local src=192.0.2.129 + + echo +@@ -1279,7 +1281,7 @@ encap_params_ipv4_ipv4() + echo "------------------------------------------------------------------" + + encap_params_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $enc_ethtype \ +- $grp $src "mausezahn" ++ $grp $grp_dmac $src "mausezahn" + } + + encap_params_ipv6_ipv4() +@@ -1291,6 +1293,7 @@ encap_params_ipv6_ipv4() + local plen=32 + local enc_ethtype="ip" + local grp=ff0e::1 ++ local grp_dmac=33:33:00:00:00:01 + local src=2001:db8:100::1 + + echo +@@ -1298,7 +1301,7 @@ encap_params_ipv6_ipv4() + echo "------------------------------------------------------------------" + + encap_params_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $enc_ethtype \ +- $grp $src "mausezahn -6" ++ $grp $grp_dmac $src "mausezahn -6" + } + + encap_params_ipv4_ipv6() +@@ -1310,6 +1313,7 @@ encap_params_ipv4_ipv6() + local plen=128 + local enc_ethtype="ipv6" + local grp=239.1.1.1 ++ local grp_dmac=01:00:5e:01:01:01 + local src=192.0.2.129 + + echo +@@ -1317,7 +1321,7 @@ encap_params_ipv4_ipv6() + echo "------------------------------------------------------------------" + + encap_params_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $enc_ethtype \ +- $grp $src "mausezahn" ++ $grp $grp_dmac $src "mausezahn" + } + + encap_params_ipv6_ipv6() +@@ -1329,6 +1333,7 @@ encap_params_ipv6_ipv6() + local plen=128 + local enc_ethtype="ipv6" + local grp=ff0e::1 ++ local grp_dmac=33:33:00:00:00:01 + local src=2001:db8:100::1 + + echo +@@ -1336,7 +1341,7 @@ encap_params_ipv6_ipv6() + echo "------------------------------------------------------------------" + + encap_params_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $enc_ethtype \ +- $grp $src "mausezahn -6" ++ $grp $grp_dmac $src "mausezahn -6" + } + + starg_exclude_ir_common() +@@ -1347,6 +1352,7 @@ starg_exclude_ir_common() + local vtep2_ip=$1; shift + local plen=$1; shift + local grp=$1; shift ++ local grp_dmac=$1; shift + local valid_src=$1; shift + local invalid_src=$1; shift + local mz=$1; shift +@@ -1368,14 +1374,14 @@ starg_exclude_ir_common() + run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent filter_mode exclude source_list $invalid_src dst $vtep2_ip src_vni 10010" + + # Check that invalid source is not forwarded to any VTEP. +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 0 + log_test $? 0 "Block excluded source - first VTEP" + tc_check_packets "$ns2" "dev vx0 ingress" 102 0 + log_test $? 0 "Block excluded source - second VTEP" + + # Check that valid source is forwarded to both VTEPs. +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 1 + log_test $? 0 "Forward valid source - first VTEP" + tc_check_packets "$ns2" "dev vx0 ingress" 102 1 +@@ -1385,14 +1391,14 @@ starg_exclude_ir_common() + run_cmd "bridge -n $ns1 mdb del dev vx0 port vx0 grp $grp dst $vtep2_ip src_vni 10010" + + # Check that invalid source is not forwarded to any VTEP. +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 1 + log_test $? 0 "Block excluded source after removal - first VTEP" + tc_check_packets "$ns2" "dev vx0 ingress" 102 1 + log_test $? 0 "Block excluded source after removal - second VTEP" + + # Check that valid source is forwarded to the remaining VTEP. +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 2 + log_test $? 0 "Forward valid source after removal - first VTEP" + tc_check_packets "$ns2" "dev vx0 ingress" 102 1 +@@ -1407,6 +1413,7 @@ starg_exclude_ir_ipv4_ipv4() + local vtep2_ip=198.51.100.200 + local plen=32 + local grp=239.1.1.1 ++ local grp_dmac=01:00:5e:01:01:01 + local valid_src=192.0.2.129 + local invalid_src=192.0.2.145 + +@@ -1415,7 +1422,7 @@ starg_exclude_ir_ipv4_ipv4() + echo "-------------------------------------------------------------" + + starg_exclude_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ +- $valid_src $invalid_src "mausezahn" ++ $grp_dmac $valid_src $invalid_src "mausezahn" + } + + starg_exclude_ir_ipv6_ipv4() +@@ -1426,6 +1433,7 @@ starg_exclude_ir_ipv6_ipv4() + local vtep2_ip=198.51.100.200 + local plen=32 + local grp=ff0e::1 ++ local grp_dmac=33:33:00:00:00:01 + local valid_src=2001:db8:100::1 + local invalid_src=2001:db8:200::1 + +@@ -1434,7 +1442,7 @@ starg_exclude_ir_ipv6_ipv4() + echo "-------------------------------------------------------------" + + starg_exclude_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ +- $valid_src $invalid_src "mausezahn -6" ++ $grp_dmac $valid_src $invalid_src "mausezahn -6" + } + + starg_exclude_ir_ipv4_ipv6() +@@ -1445,6 +1453,7 @@ starg_exclude_ir_ipv4_ipv6() + local vtep2_ip=2001:db8:2000::1 + local plen=128 + local grp=239.1.1.1 ++ local grp_dmac=01:00:5e:01:01:01 + local valid_src=192.0.2.129 + local invalid_src=192.0.2.145 + +@@ -1453,7 +1462,7 @@ starg_exclude_ir_ipv4_ipv6() + echo "-------------------------------------------------------------" + + starg_exclude_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ +- $valid_src $invalid_src "mausezahn" ++ $grp_dmac $valid_src $invalid_src "mausezahn" + } + + starg_exclude_ir_ipv6_ipv6() +@@ -1464,6 +1473,7 @@ starg_exclude_ir_ipv6_ipv6() + local vtep2_ip=2001:db8:2000::1 + local plen=128 + local grp=ff0e::1 ++ local grp_dmac=33:33:00:00:00:01 + local valid_src=2001:db8:100::1 + local invalid_src=2001:db8:200::1 + +@@ -1472,7 +1482,7 @@ starg_exclude_ir_ipv6_ipv6() + echo "-------------------------------------------------------------" + + starg_exclude_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ +- $valid_src $invalid_src "mausezahn -6" ++ $grp_dmac $valid_src $invalid_src "mausezahn -6" + } + + starg_include_ir_common() +@@ -1483,6 +1493,7 @@ starg_include_ir_common() + local vtep2_ip=$1; shift + local plen=$1; shift + local grp=$1; shift ++ local grp_dmac=$1; shift + local valid_src=$1; shift + local invalid_src=$1; shift + local mz=$1; shift +@@ -1504,14 +1515,14 @@ starg_include_ir_common() + run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent filter_mode include source_list $valid_src dst $vtep2_ip src_vni 10010" + + # Check that invalid source is not forwarded to any VTEP. +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 0 + log_test $? 0 "Block excluded source - first VTEP" + tc_check_packets "$ns2" "dev vx0 ingress" 102 0 + log_test $? 0 "Block excluded source - second VTEP" + + # Check that valid source is forwarded to both VTEPs. +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 1 + log_test $? 0 "Forward valid source - first VTEP" + tc_check_packets "$ns2" "dev vx0 ingress" 102 1 +@@ -1521,14 +1532,14 @@ starg_include_ir_common() + run_cmd "bridge -n $ns1 mdb del dev vx0 port vx0 grp $grp dst $vtep2_ip src_vni 10010" + + # Check that invalid source is not forwarded to any VTEP. +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 1 + log_test $? 0 "Block excluded source after removal - first VTEP" + tc_check_packets "$ns2" "dev vx0 ingress" 102 1 + log_test $? 0 "Block excluded source after removal - second VTEP" + + # Check that valid source is forwarded to the remaining VTEP. +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 2 + log_test $? 0 "Forward valid source after removal - first VTEP" + tc_check_packets "$ns2" "dev vx0 ingress" 102 1 +@@ -1543,6 +1554,7 @@ starg_include_ir_ipv4_ipv4() + local vtep2_ip=198.51.100.200 + local plen=32 + local grp=239.1.1.1 ++ local grp_dmac=01:00:5e:01:01:01 + local valid_src=192.0.2.129 + local invalid_src=192.0.2.145 + +@@ -1551,7 +1563,7 @@ starg_include_ir_ipv4_ipv4() + echo "-------------------------------------------------------------" + + starg_include_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ +- $valid_src $invalid_src "mausezahn" ++ $grp_dmac $valid_src $invalid_src "mausezahn" + } + + starg_include_ir_ipv6_ipv4() +@@ -1562,6 +1574,7 @@ starg_include_ir_ipv6_ipv4() + local vtep2_ip=198.51.100.200 + local plen=32 + local grp=ff0e::1 ++ local grp_dmac=33:33:00:00:00:01 + local valid_src=2001:db8:100::1 + local invalid_src=2001:db8:200::1 + +@@ -1570,7 +1583,7 @@ starg_include_ir_ipv6_ipv4() + echo "-------------------------------------------------------------" + + starg_include_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ +- $valid_src $invalid_src "mausezahn -6" ++ $grp_dmac $valid_src $invalid_src "mausezahn -6" + } + + starg_include_ir_ipv4_ipv6() +@@ -1581,6 +1594,7 @@ starg_include_ir_ipv4_ipv6() + local vtep2_ip=2001:db8:2000::1 + local plen=128 + local grp=239.1.1.1 ++ local grp_dmac=01:00:5e:01:01:01 + local valid_src=192.0.2.129 + local invalid_src=192.0.2.145 + +@@ -1589,7 +1603,7 @@ starg_include_ir_ipv4_ipv6() + echo "-------------------------------------------------------------" + + starg_include_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ +- $valid_src $invalid_src "mausezahn" ++ $grp_dmac $valid_src $invalid_src "mausezahn" + } + + starg_include_ir_ipv6_ipv6() +@@ -1600,6 +1614,7 @@ starg_include_ir_ipv6_ipv6() + local vtep2_ip=2001:db8:2000::1 + local plen=128 + local grp=ff0e::1 ++ local grp_dmac=33:33:00:00:00:01 + local valid_src=2001:db8:100::1 + local invalid_src=2001:db8:200::1 + +@@ -1608,7 +1623,7 @@ starg_include_ir_ipv6_ipv6() + echo "-------------------------------------------------------------" + + starg_include_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ +- $valid_src $invalid_src "mausezahn -6" ++ $grp_dmac $valid_src $invalid_src "mausezahn -6" + } + + starg_exclude_p2mp_common() +@@ -1618,6 +1633,7 @@ starg_exclude_p2mp_common() + local mcast_grp=$1; shift + local plen=$1; shift + local grp=$1; shift ++ local grp_dmac=$1; shift + local valid_src=$1; shift + local invalid_src=$1; shift + local mz=$1; shift +@@ -1635,12 +1651,12 @@ starg_exclude_p2mp_common() + run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent filter_mode exclude source_list $invalid_src dst $mcast_grp src_vni 10010 via veth0" + + # Check that invalid source is not forwarded. +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 0 + log_test $? 0 "Block excluded source" + + # Check that valid source is forwarded. +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 1 + log_test $? 0 "Forward valid source" + +@@ -1648,7 +1664,7 @@ starg_exclude_p2mp_common() + run_cmd "ip -n $ns2 address del $mcast_grp/$plen dev veth0" + + # Check that valid source is not received anymore. +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 1 + log_test $? 0 "Receive of valid source after removal from group" + } +@@ -1660,6 +1676,7 @@ starg_exclude_p2mp_ipv4_ipv4() + local mcast_grp=238.1.1.1 + local plen=32 + local grp=239.1.1.1 ++ local grp_dmac=01:00:5e:01:01:01 + local valid_src=192.0.2.129 + local invalid_src=192.0.2.145 + +@@ -1667,7 +1684,7 @@ starg_exclude_p2mp_ipv4_ipv4() + echo "Data path: (*, G) EXCLUDE - P2MP - IPv4 overlay / IPv4 underlay" + echo "---------------------------------------------------------------" + +- starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ ++ starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ + $valid_src $invalid_src "mausezahn" + } + +@@ -1678,6 +1695,7 @@ starg_exclude_p2mp_ipv6_ipv4() + local mcast_grp=238.1.1.1 + local plen=32 + local grp=ff0e::1 ++ local grp_dmac=33:33:00:00:00:01 + local valid_src=2001:db8:100::1 + local invalid_src=2001:db8:200::1 + +@@ -1685,7 +1703,7 @@ starg_exclude_p2mp_ipv6_ipv4() + echo "Data path: (*, G) EXCLUDE - P2MP - IPv6 overlay / IPv4 underlay" + echo "---------------------------------------------------------------" + +- starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ ++ starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ + $valid_src $invalid_src "mausezahn -6" + } + +@@ -1696,6 +1714,7 @@ starg_exclude_p2mp_ipv4_ipv6() + local mcast_grp=ff0e::2 + local plen=128 + local grp=239.1.1.1 ++ local grp_dmac=01:00:5e:01:01:01 + local valid_src=192.0.2.129 + local invalid_src=192.0.2.145 + +@@ -1703,7 +1722,7 @@ starg_exclude_p2mp_ipv4_ipv6() + echo "Data path: (*, G) EXCLUDE - P2MP - IPv4 overlay / IPv6 underlay" + echo "---------------------------------------------------------------" + +- starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ ++ starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ + $valid_src $invalid_src "mausezahn" + } + +@@ -1714,6 +1733,7 @@ starg_exclude_p2mp_ipv6_ipv6() + local mcast_grp=ff0e::2 + local plen=128 + local grp=ff0e::1 ++ local grp_dmac=33:33:00:00:00:01 + local valid_src=2001:db8:100::1 + local invalid_src=2001:db8:200::1 + +@@ -1721,7 +1741,7 @@ starg_exclude_p2mp_ipv6_ipv6() + echo "Data path: (*, G) EXCLUDE - P2MP - IPv6 overlay / IPv6 underlay" + echo "---------------------------------------------------------------" + +- starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ ++ starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ + $valid_src $invalid_src "mausezahn -6" + } + +@@ -1732,6 +1752,7 @@ starg_include_p2mp_common() + local mcast_grp=$1; shift + local plen=$1; shift + local grp=$1; shift ++ local grp_dmac=$1; shift + local valid_src=$1; shift + local invalid_src=$1; shift + local mz=$1; shift +@@ -1749,12 +1770,12 @@ starg_include_p2mp_common() + run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent filter_mode include source_list $valid_src dst $mcast_grp src_vni 10010 via veth0" + + # Check that invalid source is not forwarded. +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 0 + log_test $? 0 "Block excluded source" + + # Check that valid source is forwarded. +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 1 + log_test $? 0 "Forward valid source" + +@@ -1762,7 +1783,7 @@ starg_include_p2mp_common() + run_cmd "ip -n $ns2 address del $mcast_grp/$plen dev veth0" + + # Check that valid source is not received anymore. +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 1 + log_test $? 0 "Receive of valid source after removal from group" + } +@@ -1774,6 +1795,7 @@ starg_include_p2mp_ipv4_ipv4() + local mcast_grp=238.1.1.1 + local plen=32 + local grp=239.1.1.1 ++ local grp_dmac=01:00:5e:01:01:01 + local valid_src=192.0.2.129 + local invalid_src=192.0.2.145 + +@@ -1781,7 +1803,7 @@ starg_include_p2mp_ipv4_ipv4() + echo "Data path: (*, G) INCLUDE - P2MP - IPv4 overlay / IPv4 underlay" + echo "---------------------------------------------------------------" + +- starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ ++ starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ + $valid_src $invalid_src "mausezahn" + } + +@@ -1792,6 +1814,7 @@ starg_include_p2mp_ipv6_ipv4() + local mcast_grp=238.1.1.1 + local plen=32 + local grp=ff0e::1 ++ local grp_dmac=33:33:00:00:00:01 + local valid_src=2001:db8:100::1 + local invalid_src=2001:db8:200::1 + +@@ -1799,7 +1822,7 @@ starg_include_p2mp_ipv6_ipv4() + echo "Data path: (*, G) INCLUDE - P2MP - IPv6 overlay / IPv4 underlay" + echo "---------------------------------------------------------------" + +- starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ ++ starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ + $valid_src $invalid_src "mausezahn -6" + } + +@@ -1810,6 +1833,7 @@ starg_include_p2mp_ipv4_ipv6() + local mcast_grp=ff0e::2 + local plen=128 + local grp=239.1.1.1 ++ local grp_dmac=01:00:5e:01:01:01 + local valid_src=192.0.2.129 + local invalid_src=192.0.2.145 + +@@ -1817,7 +1841,7 @@ starg_include_p2mp_ipv4_ipv6() + echo "Data path: (*, G) INCLUDE - P2MP - IPv4 overlay / IPv6 underlay" + echo "---------------------------------------------------------------" + +- starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ ++ starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ + $valid_src $invalid_src "mausezahn" + } + +@@ -1828,6 +1852,7 @@ starg_include_p2mp_ipv6_ipv6() + local mcast_grp=ff0e::2 + local plen=128 + local grp=ff0e::1 ++ local grp_dmac=33:33:00:00:00:01 + local valid_src=2001:db8:100::1 + local invalid_src=2001:db8:200::1 + +@@ -1835,7 +1860,7 @@ starg_include_p2mp_ipv6_ipv6() + echo "Data path: (*, G) INCLUDE - P2MP - IPv6 overlay / IPv6 underlay" + echo "---------------------------------------------------------------" + +- starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ ++ starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ + $valid_src $invalid_src "mausezahn -6" + } + +@@ -1847,6 +1872,7 @@ egress_vni_translation_common() + local plen=$1; shift + local proto=$1; shift + local grp=$1; shift ++ local grp_dmac=$1; shift + local src=$1; shift + local mz=$1; shift + +@@ -1882,20 +1908,20 @@ egress_vni_translation_common() + # Make sure that packets sent from the first VTEP over VLAN 10 are + # received by the SVI corresponding to the L3VNI (14000 / VLAN 4000) on + # the second VTEP, since it is configured as PVID. +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev br0.4000 ingress" 101 1 + log_test $? 0 "Egress VNI translation - PVID configured" + + # Remove PVID flag from VLAN 4000 on the second VTEP and make sure + # packets are no longer received by the SVI interface. + run_cmd "bridge -n $ns2 vlan add vid 4000 dev vx0" +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev br0.4000 ingress" 101 1 + log_test $? 0 "Egress VNI translation - no PVID configured" + + # Reconfigure the PVID and make sure packets are received again. + run_cmd "bridge -n $ns2 vlan add vid 4000 dev vx0 pvid" +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev br0.4000 ingress" 101 2 + log_test $? 0 "Egress VNI translation - PVID reconfigured" + } +@@ -1908,6 +1934,7 @@ egress_vni_translation_ipv4_ipv4() + local plen=32 + local proto="ipv4" + local grp=239.1.1.1 ++ local grp_dmac=01:00:5e:01:01:01 + local src=192.0.2.129 + + echo +@@ -1915,7 +1942,7 @@ egress_vni_translation_ipv4_ipv4() + echo "----------------------------------------------------------------" + + egress_vni_translation_common $ns1 $ns2 $mcast_grp $plen $proto $grp \ +- $src "mausezahn" ++ $grp_dmac $src "mausezahn" + } + + egress_vni_translation_ipv6_ipv4() +@@ -1926,6 +1953,7 @@ egress_vni_translation_ipv6_ipv4() + local plen=32 + local proto="ipv6" + local grp=ff0e::1 ++ local grp_dmac=33:33:00:00:00:01 + local src=2001:db8:100::1 + + echo +@@ -1933,7 +1961,7 @@ egress_vni_translation_ipv6_ipv4() + echo "----------------------------------------------------------------" + + egress_vni_translation_common $ns1 $ns2 $mcast_grp $plen $proto $grp \ +- $src "mausezahn -6" ++ $grp_dmac $src "mausezahn -6" + } + + egress_vni_translation_ipv4_ipv6() +@@ -1944,6 +1972,7 @@ egress_vni_translation_ipv4_ipv6() + local plen=128 + local proto="ipv4" + local grp=239.1.1.1 ++ local grp_dmac=01:00:5e:01:01:01 + local src=192.0.2.129 + + echo +@@ -1951,7 +1980,7 @@ egress_vni_translation_ipv4_ipv6() + echo "----------------------------------------------------------------" + + egress_vni_translation_common $ns1 $ns2 $mcast_grp $plen $proto $grp \ +- $src "mausezahn" ++ $grp_dmac $src "mausezahn" + } + + egress_vni_translation_ipv6_ipv6() +@@ -1962,6 +1991,7 @@ egress_vni_translation_ipv6_ipv6() + local plen=128 + local proto="ipv6" + local grp=ff0e::1 ++ local grp_dmac=33:33:00:00:00:01 + local src=2001:db8:100::1 + + echo +@@ -1969,7 +1999,7 @@ egress_vni_translation_ipv6_ipv6() + echo "----------------------------------------------------------------" + + egress_vni_translation_common $ns1 $ns2 $mcast_grp $plen $proto $grp \ +- $src "mausezahn -6" ++ $grp_dmac $src "mausezahn -6" + } + + all_zeros_mdb_common() +@@ -1982,12 +2012,18 @@ all_zeros_mdb_common() + local vtep4_ip=$1; shift + local plen=$1; shift + local ipv4_grp=239.1.1.1 ++ local ipv4_grp_dmac=01:00:5e:01:01:01 + local ipv4_unreg_grp=239.2.2.2 ++ local ipv4_unreg_grp_dmac=01:00:5e:02:02:02 + local ipv4_ll_grp=224.0.0.100 ++ local ipv4_ll_grp_dmac=01:00:5e:00:00:64 + local ipv4_src=192.0.2.129 + local ipv6_grp=ff0e::1 ++ local ipv6_grp_dmac=33:33:00:00:00:01 + local ipv6_unreg_grp=ff0e::2 ++ local ipv6_unreg_grp_dmac=33:33:00:00:00:02 + local ipv6_ll_grp=ff02::1 ++ local ipv6_ll_grp_dmac=33:33:00:00:00:01 + local ipv6_src=2001:db8:100::1 + + # Install all-zeros (catchall) MDB entries for IPv4 and IPv6 traffic +@@ -2023,7 +2059,7 @@ all_zeros_mdb_common() + + # Send registered IPv4 multicast and make sure it only arrives to the + # first VTEP. +- run_cmd "ip netns exec $ns1 mausezahn br0.10 -A $ipv4_src -B $ipv4_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 mausezahn br0.10 -a own -b $ipv4_grp_dmac -A $ipv4_src -B $ipv4_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 1 + log_test $? 0 "Registered IPv4 multicast - first VTEP" + tc_check_packets "$ns2" "dev vx0 ingress" 102 0 +@@ -2031,7 +2067,7 @@ all_zeros_mdb_common() + + # Send unregistered IPv4 multicast that is not link-local and make sure + # it arrives to the first and second VTEPs. +- run_cmd "ip netns exec $ns1 mausezahn br0.10 -A $ipv4_src -B $ipv4_unreg_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 mausezahn br0.10 -a own -b $ipv4_unreg_grp_dmac -A $ipv4_src -B $ipv4_unreg_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 2 + log_test $? 0 "Unregistered IPv4 multicast - first VTEP" + tc_check_packets "$ns2" "dev vx0 ingress" 102 1 +@@ -2039,7 +2075,7 @@ all_zeros_mdb_common() + + # Send IPv4 link-local multicast traffic and make sure it does not + # arrive to any VTEP. +- run_cmd "ip netns exec $ns1 mausezahn br0.10 -A $ipv4_src -B $ipv4_ll_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 mausezahn br0.10 -a own -b $ipv4_ll_grp_dmac -A $ipv4_src -B $ipv4_ll_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 2 + log_test $? 0 "Link-local IPv4 multicast - first VTEP" + tc_check_packets "$ns2" "dev vx0 ingress" 102 1 +@@ -2074,7 +2110,7 @@ all_zeros_mdb_common() + + # Send registered IPv6 multicast and make sure it only arrives to the + # third VTEP. +- run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -A $ipv6_src -B $ipv6_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -a own -b $ipv6_grp_dmac -A $ipv6_src -B $ipv6_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 103 1 + log_test $? 0 "Registered IPv6 multicast - third VTEP" + tc_check_packets "$ns2" "dev vx0 ingress" 104 0 +@@ -2082,7 +2118,7 @@ all_zeros_mdb_common() + + # Send unregistered IPv6 multicast that is not link-local and make sure + # it arrives to the third and fourth VTEPs. +- run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -A $ipv6_src -B $ipv6_unreg_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -a own -b $ipv6_unreg_grp_dmac -A $ipv6_src -B $ipv6_unreg_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 103 2 + log_test $? 0 "Unregistered IPv6 multicast - third VTEP" + tc_check_packets "$ns2" "dev vx0 ingress" 104 1 +@@ -2090,7 +2126,7 @@ all_zeros_mdb_common() + + # Send IPv6 link-local multicast traffic and make sure it does not + # arrive to any VTEP. +- run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -A $ipv6_src -B $ipv6_ll_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -a own -b $ipv6_ll_grp_dmac -A $ipv6_src -B $ipv6_ll_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 103 2 + log_test $? 0 "Link-local IPv6 multicast - third VTEP" + tc_check_packets "$ns2" "dev vx0 ingress" 104 1 +@@ -2165,6 +2201,7 @@ mdb_fdb_common() + local plen=$1; shift + local proto=$1; shift + local grp=$1; shift ++ local grp_dmac=$1; shift + local src=$1; shift + local mz=$1; shift + +@@ -2188,7 +2225,7 @@ mdb_fdb_common() + + # Send IP multicast traffic and make sure it is forwarded by the MDB + # and only arrives to the first VTEP. +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 1 + log_test $? 0 "IP multicast - first VTEP" + tc_check_packets "$ns2" "dev vx0 ingress" 102 0 +@@ -2205,7 +2242,7 @@ mdb_fdb_common() + # Remove the MDB entry and make sure that IP multicast is now forwarded + # by the FDB to the second VTEP. + run_cmd "bridge -n $ns1 mdb del dev vx0 port vx0 grp $grp dst $vtep1_ip src_vni 10010" +- run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" ++ run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + tc_check_packets "$ns2" "dev vx0 ingress" 101 1 + log_test $? 0 "IP multicast after removal - first VTEP" + tc_check_packets "$ns2" "dev vx0 ingress" 102 2 +@@ -2221,14 +2258,15 @@ mdb_fdb_ipv4_ipv4() + local plen=32 + local proto="ipv4" + local grp=239.1.1.1 ++ local grp_dmac=01:00:5e:01:01:01 + local src=192.0.2.129 + + echo + echo "Data path: MDB with FDB - IPv4 overlay / IPv4 underlay" + echo "------------------------------------------------------" + +- mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp $src \ +- "mausezahn" ++ mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp \ ++ $grp_dmac $src "mausezahn" + } + + mdb_fdb_ipv6_ipv4() +@@ -2240,14 +2278,15 @@ mdb_fdb_ipv6_ipv4() + local plen=32 + local proto="ipv6" + local grp=ff0e::1 ++ local grp_dmac=33:33:00:00:00:01 + local src=2001:db8:100::1 + + echo + echo "Data path: MDB with FDB - IPv6 overlay / IPv4 underlay" + echo "------------------------------------------------------" + +- mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp $src \ +- "mausezahn -6" ++ mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp \ ++ $grp_dmac $src "mausezahn -6" + } + + mdb_fdb_ipv4_ipv6() +@@ -2259,14 +2298,15 @@ mdb_fdb_ipv4_ipv6() + local plen=128 + local proto="ipv4" + local grp=239.1.1.1 ++ local grp_dmac=01:00:5e:01:01:01 + local src=192.0.2.129 + + echo + echo "Data path: MDB with FDB - IPv4 overlay / IPv6 underlay" + echo "------------------------------------------------------" + +- mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp $src \ +- "mausezahn" ++ mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp \ ++ $grp_dmac $src "mausezahn" + } + + mdb_fdb_ipv6_ipv6() +@@ -2278,14 +2318,15 @@ mdb_fdb_ipv6_ipv6() + local plen=128 + local proto="ipv6" + local grp=ff0e::1 ++ local grp_dmac=33:33:00:00:00:01 + local src=2001:db8:100::1 + + echo + echo "Data path: MDB with FDB - IPv6 overlay / IPv6 underlay" + echo "------------------------------------------------------" + +- mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp $src \ +- "mausezahn -6" ++ mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp \ ++ $grp_dmac $src "mausezahn -6" + } + + mdb_grp1_loop() +@@ -2320,7 +2361,9 @@ mdb_torture_common() + local vtep1_ip=$1; shift + local vtep2_ip=$1; shift + local grp1=$1; shift ++ local grp1_dmac=$1; shift + local grp2=$1; shift ++ local grp2_dmac=$1; shift + local src=$1; shift + local mz=$1; shift + local pid1 +@@ -2345,9 +2388,9 @@ mdb_torture_common() + pid1=$! + mdb_grp2_loop $ns1 $vtep1_ip $vtep2_ip $grp2 & + pid2=$! +- ip netns exec $ns1 $mz br0.10 -A $src -B $grp1 -t udp sp=12345,dp=54321 -p 100 -c 0 -q & ++ ip netns exec $ns1 $mz br0.10 -a own -b $grp1_dmac -A $src -B $grp1 -t udp sp=12345,dp=54321 -p 100 -c 0 -q & + pid3=$! +- ip netns exec $ns1 $mz br0.10 -A $src -B $grp2 -t udp sp=12345,dp=54321 -p 100 -c 0 -q & ++ ip netns exec $ns1 $mz br0.10 -a own -b $grp2_dmac -A $src -B $grp2 -t udp sp=12345,dp=54321 -p 100 -c 0 -q & + pid4=$! + + sleep 30 +@@ -2363,15 +2406,17 @@ mdb_torture_ipv4_ipv4() + local vtep1_ip=198.51.100.100 + local vtep2_ip=198.51.100.200 + local grp1=239.1.1.1 ++ local grp1_dmac=01:00:5e:01:01:01 + local grp2=239.2.2.2 ++ local grp2_dmac=01:00:5e:02:02:02 + local src=192.0.2.129 + + echo + echo "Data path: MDB torture test - IPv4 overlay / IPv4 underlay" + echo "----------------------------------------------------------" + +- mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp2 $src \ +- "mausezahn" ++ mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp1_dmac $grp2 \ ++ $grp2_dmac $src "mausezahn" + } + + mdb_torture_ipv6_ipv4() +@@ -2380,15 +2425,17 @@ mdb_torture_ipv6_ipv4() + local vtep1_ip=198.51.100.100 + local vtep2_ip=198.51.100.200 + local grp1=ff0e::1 ++ local grp1_dmac=33:33:00:00:00:01 + local grp2=ff0e::2 ++ local grp2_dmac=33:33:00:00:00:02 + local src=2001:db8:100::1 + + echo + echo "Data path: MDB torture test - IPv6 overlay / IPv4 underlay" + echo "----------------------------------------------------------" + +- mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp2 $src \ +- "mausezahn -6" ++ mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp1_dmac $grp2 \ ++ $grp2_dmac $src "mausezahn -6" + } + + mdb_torture_ipv4_ipv6() +@@ -2397,15 +2444,17 @@ mdb_torture_ipv4_ipv6() + local vtep1_ip=2001:db8:1000::1 + local vtep2_ip=2001:db8:2000::1 + local grp1=239.1.1.1 ++ local grp1_dmac=01:00:5e:01:01:01 + local grp2=239.2.2.2 ++ local grp2_dmac=01:00:5e:02:02:02 + local src=192.0.2.129 + + echo + echo "Data path: MDB torture test - IPv4 overlay / IPv6 underlay" + echo "----------------------------------------------------------" + +- mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp2 $src \ +- "mausezahn" ++ mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp1_dmac $grp2 \ ++ $grp2_dmac $src "mausezahn" + } + + mdb_torture_ipv6_ipv6() +@@ -2414,15 +2463,17 @@ mdb_torture_ipv6_ipv6() + local vtep1_ip=2001:db8:1000::1 + local vtep2_ip=2001:db8:2000::1 + local grp1=ff0e::1 ++ local grp1_dmac=33:33:00:00:00:01 + local grp2=ff0e::2 ++ local grp2_dmac=33:33:00:00:00:02 + local src=2001:db8:100::1 + + echo + echo "Data path: MDB torture test - IPv6 overlay / IPv6 underlay" + echo "----------------------------------------------------------" + +- mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp2 $src \ +- "mausezahn -6" ++ mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp1_dmac $grp2 \ ++ $grp2_dmac $src "mausezahn -6" + } + + ################################################################################ +-- +2.43.0 + diff --git a/queue-6.8/series b/queue-6.8/series new file mode 100644 index 00000000000..827e3c39a3f --- /dev/null +++ b/queue-6.8/series @@ -0,0 +1,63 @@ +scripts-bpf_doc-use-silent-mode-when-exec-make-cmd.patch +xsk-don-t-assume-metadata-is-always-requested-in-tx-.patch +s390-bpf-fix-bpf_plt-pointer-arithmetic.patch +bpf-arm64-fix-bug-in-bpf_ldx_memsx.patch +dma-buf-fix-null-pointer-dereference-in-sanitycheck.patch +arm64-bpf-fix-32bit-unconditional-bswap.patch +nfc-nci-fix-uninit-value-in-nci_dev_up-and-nci_ntf_p.patch +nfsd-fix-error-cleanup-path-in-nfsd_rename.patch +tools-ynl-fix-setting-presence-bits-in-simple-nests.patch +mlxbf_gige-stop-phy-during-open-error-paths.patch +wifi-iwlwifi-mvm-pick-the-version-of-session_protect.patch +wifi-iwlwifi-mvm-rfi-fix-potential-response-leaks.patch +wifi-iwlwifi-mvm-include-link-id-when-releasing-fram.patch +alsa-hda-cs35l56-set-the-init_done-flag-before-compo.patch +ice-refactor-fw-data-type-and-fix-bitmap-casting-iss.patch +ice-fix-memory-corruption-bug-with-suspend-and-rebui.patch +ixgbe-avoid-sleeping-allocation-in-ixgbe_ipsec_vf_ad.patch +igc-remove-stale-comment-about-tx-timestamping.patch +drm-xe-remove-unused-xe_bo-props-struct.patch +drm-xe-add-exec_queue.sched_props.job_timeout_ms.patch +drm-xe-guc_submit-use-jiffies-for-job-timeout.patch +drm-xe-queue-fix-engine_class-bounds-check.patch +drm-xe-device-fix-xe_max_gt_per_tile-check.patch +drm-xe-device-fix-xe_max_tiles_per_device-check.patch +dpll-indent-dpll-option-type-by-a-tab.patch +s390-qeth-handle-deferred-cc1.patch +net-hsr-hsr_slave-fix-the-promiscuous-mode-in-offloa.patch +tcp-properly-terminate-timers-for-kernel-sockets.patch +net-wwan-t7xx-split-64bit-accesses-to-fix-alignment-.patch +drm-rockchip-vop2-remove-ar30-and-ab30-format-suppor.patch +selftests-vxlan_mdb-fix-failures-with-old-libnet.patch +gpio-protect-the-list-of-gpio-devices-with-srcu.patch +gpiolib-fix-debug-messaging-in-gpiod_find_and_reques.patch +acpica-debugger-check-status-of-acpi_evaluate_object.patch +net-hns3-fix-index-limit-to-support-all-queue-stats.patch +net-hns3-fix-kernel-crash-when-devlink-reload-during.patch +net-hns3-mark-unexcuted-loopback-test-result-as-unex.patch +tls-recv-process_rx_list-shouldn-t-use-an-offset-wit.patch +tls-adjust-recv-return-with-async-crypto-and-failed-.patch +tls-get-psock-ref-after-taking-rxlock-to-avoid-leak.patch +mlxbf_gige-call-request_irq-after-napi-initialized.patch +drm-amd-display-update-p010-scaling-cap.patch +drm-amd-display-send-dtbclk-disable-message-on-first.patch +bpf-protect-against-int-overflow-for-stack-access-si.patch +cifs-fix-duplicate-fscache-cookie-warnings.patch +netfilter-nf_tables-reject-destroy-command-to-remove.patch +netfilter-nf_tables-reject-table-flag-and-netdev-bas.patch +netfilter-nf_tables-skip-netdev-hook-unregistration-.patch +iommu-validate-the-pasid-in-iommu_attach_device_pasi.patch +net-bcmasp-bring-up-unimac-after-phy-link-up.patch +net-lan743x-add-set-rfe-read-fifo-threshold-for-pci1.patch +octeontx2-af-fix-pause-frame-configuration-in-gmp-mo.patch +inet-inet_defrag-prevent-sk-release-while-still-in-u.patch +drm-i915-stop-doing-double-audio-enable-disable-on-s.patch +drm-i915-display-disable-auxccs-framebuffers-if-buil.patch +drm-i915-xelpg-extend-some-workarounds-tuning-to-gfx.patch +drm-i915-mtl-update-workaround-14018575942.patch +drm-i915-do-not-print-pxp-init-failed-with-0-when-it.patch +dm-integrity-fix-out-of-range-warning.patch +modpost-do-not-make-find_tosym-return-null.patch +kbuild-make-woverride-init-warnings-more-consistent.patch +mm-treewide-replace-pud_large-with-pud_leaf.patch +revert-x86-mm-ident_map-use-gbpages-only-where-full-.patch diff --git a/queue-6.8/tcp-properly-terminate-timers-for-kernel-sockets.patch b/queue-6.8/tcp-properly-terminate-timers-for-kernel-sockets.patch new file mode 100644 index 00000000000..046dec4b4fb --- /dev/null +++ b/queue-6.8/tcp-properly-terminate-timers-for-kernel-sockets.patch @@ -0,0 +1,138 @@ +From f49d36d1ccfaa6e3bd0e3f1124a2a32b81d3aa44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Mar 2024 13:57:32 +0000 +Subject: tcp: properly terminate timers for kernel sockets + +From: Eric Dumazet + +[ Upstream commit 151c9c724d05d5b0dd8acd3e11cb69ef1f2dbada ] + +We had various syzbot reports about tcp timers firing after +the corresponding netns has been dismantled. + +Fortunately Josef Bacik could trigger the issue more often, +and could test a patch I wrote two years ago. + +When TCP sockets are closed, we call inet_csk_clear_xmit_timers() +to 'stop' the timers. + +inet_csk_clear_xmit_timers() can be called from any context, +including when socket lock is held. +This is the reason it uses sk_stop_timer(), aka del_timer(). +This means that ongoing timers might finish much later. + +For user sockets, this is fine because each running timer +holds a reference on the socket, and the user socket holds +a reference on the netns. + +For kernel sockets, we risk that the netns is freed before +timer can complete, because kernel sockets do not hold +reference on the netns. + +This patch adds inet_csk_clear_xmit_timers_sync() function +that using sk_stop_timer_sync() to make sure all timers +are terminated before the kernel socket is released. +Modules using kernel sockets close them in their netns exit() +handler. + +Also add sock_not_owned_by_me() helper to get LOCKDEP +support : inet_csk_clear_xmit_timers_sync() must not be called +while socket lock is held. + +It is very possible we can revert in the future commit +3a58f13a881e ("net: rds: acquire refcount on TCP sockets") +which attempted to solve the issue in rds only. +(net/smc/af_smc.c and net/mptcp/subflow.c have similar code) + +We probably can remove the check_net() tests from +tcp_out_of_resources() and __tcp_close() in the future. + +Reported-by: Josef Bacik +Closes: https://lore.kernel.org/netdev/20240314210740.GA2823176@perftesting/ +Fixes: 26abe14379f8 ("net: Modify sk_alloc to not reference count the netns of kernel sockets.") +Fixes: 8a68173691f0 ("net: sk_clone_lock() should only do get_net() if the parent is not a kernel socket") +Link: https://lore.kernel.org/bpf/CANn89i+484ffqb93aQm1N-tjxxvb3WDKX0EbD7318RwRgsatjw@mail.gmail.com/ +Signed-off-by: Eric Dumazet +Tested-by: Josef Bacik +Cc: Tetsuo Handa +Link: https://lore.kernel.org/r/20240322135732.1535772-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/inet_connection_sock.h | 1 + + include/net/sock.h | 7 +++++++ + net/ipv4/inet_connection_sock.c | 14 ++++++++++++++ + net/ipv4/tcp.c | 2 ++ + 4 files changed, 24 insertions(+) + +diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h +index 9ab4bf704e864..ccf171f7eb60d 100644 +--- a/include/net/inet_connection_sock.h ++++ b/include/net/inet_connection_sock.h +@@ -175,6 +175,7 @@ void inet_csk_init_xmit_timers(struct sock *sk, + void (*delack_handler)(struct timer_list *), + void (*keepalive_handler)(struct timer_list *)); + void inet_csk_clear_xmit_timers(struct sock *sk); ++void inet_csk_clear_xmit_timers_sync(struct sock *sk); + + static inline void inet_csk_schedule_ack(struct sock *sk) + { +diff --git a/include/net/sock.h b/include/net/sock.h +index 54ca8dcbfb433..4afb4376c97e8 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -1779,6 +1779,13 @@ static inline void sock_owned_by_me(const struct sock *sk) + #endif + } + ++static inline void sock_not_owned_by_me(const struct sock *sk) ++{ ++#ifdef CONFIG_LOCKDEP ++ WARN_ON_ONCE(lockdep_sock_is_held(sk) && debug_locks); ++#endif ++} ++ + static inline bool sock_owned_by_user(const struct sock *sk) + { + sock_owned_by_me(sk); +diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c +index 459af1f897395..17eb9ae912239 100644 +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -771,6 +771,20 @@ void inet_csk_clear_xmit_timers(struct sock *sk) + } + EXPORT_SYMBOL(inet_csk_clear_xmit_timers); + ++void inet_csk_clear_xmit_timers_sync(struct sock *sk) ++{ ++ struct inet_connection_sock *icsk = inet_csk(sk); ++ ++ /* ongoing timer handlers need to acquire socket lock. */ ++ sock_not_owned_by_me(sk); ++ ++ icsk->icsk_pending = icsk->icsk_ack.pending = 0; ++ ++ sk_stop_timer_sync(sk, &icsk->icsk_retransmit_timer); ++ sk_stop_timer_sync(sk, &icsk->icsk_delack_timer); ++ sk_stop_timer_sync(sk, &sk->sk_timer); ++} ++ + void inet_csk_delete_keepalive_timer(struct sock *sk) + { + sk_stop_timer(sk, &sk->sk_timer); +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index a4f4185923144..5887eac87bd28 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -2930,6 +2930,8 @@ void tcp_close(struct sock *sk, long timeout) + lock_sock(sk); + __tcp_close(sk, timeout); + release_sock(sk); ++ if (!sk->sk_net_refcnt) ++ inet_csk_clear_xmit_timers_sync(sk); + sock_put(sk); + } + EXPORT_SYMBOL(tcp_close); +-- +2.43.0 + diff --git a/queue-6.8/tls-adjust-recv-return-with-async-crypto-and-failed-.patch b/queue-6.8/tls-adjust-recv-return-with-async-crypto-and-failed-.patch new file mode 100644 index 00000000000..cca82eada35 --- /dev/null +++ b/queue-6.8/tls-adjust-recv-return-with-async-crypto-and-failed-.patch @@ -0,0 +1,50 @@ +From 51d65a1266d8399a6c1b603707b947cdbbe8e3cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 16:56:46 +0100 +Subject: tls: adjust recv return with async crypto and failed copy to + userspace + +From: Sabrina Dubroca + +[ Upstream commit 85eef9a41d019b59be7bc91793f26251909c0710 ] + +process_rx_list may not copy as many bytes as we want to the userspace +buffer, for example in case we hit an EFAULT during the copy. If this +happens, we should only count the bytes that were actually copied, +which may be 0. + +Subtracting async_copy_bytes is correct in both peek and !peek cases, +because decrypted == async_copy_bytes + peeked for the peek case: peek +is always !ZC, and we can go through either the sync or async path. In +the async case, we add chunk to both decrypted and +async_copy_bytes. In the sync case, we add chunk to both decrypted and +peeked. I missed that in commit 6caaf104423d ("tls: fix peeking with +sync+async decryption"). + +Fixes: 4d42cd6bc2ac ("tls: rx: fix return value for async crypto") +Signed-off-by: Sabrina Dubroca +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/1b5a1eaab3c088a9dd5d9f1059ceecd7afe888d1.1711120964.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 3cdc6bc9fba69..14faf6189eb14 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -2158,6 +2158,9 @@ int tls_sw_recvmsg(struct sock *sk, + else + err = process_rx_list(ctx, msg, &control, 0, + async_copy_bytes, is_peek, NULL); ++ ++ /* we could have copied less than we wanted, and possibly nothing */ ++ decrypted += max(err, 0) - async_copy_bytes; + } + + copied += decrypted; +-- +2.43.0 + diff --git a/queue-6.8/tls-get-psock-ref-after-taking-rxlock-to-avoid-leak.patch b/queue-6.8/tls-get-psock-ref-after-taking-rxlock-to-avoid-leak.patch new file mode 100644 index 00000000000..f07f1927774 --- /dev/null +++ b/queue-6.8/tls-get-psock-ref-after-taking-rxlock-to-avoid-leak.patch @@ -0,0 +1,45 @@ +From 1fce83d0b6de5a7217fdde308d1d48c666a26d9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 16:56:48 +0100 +Subject: tls: get psock ref after taking rxlock to avoid leak + +From: Sabrina Dubroca + +[ Upstream commit 417e91e856099e9b8a42a2520e2255e6afe024be ] + +At the start of tls_sw_recvmsg, we take a reference on the psock, and +then call tls_rx_reader_lock. If that fails, we return directly +without releasing the reference. + +Instead of adding a new label, just take the reference after locking +has succeeded, since we don't need it before. + +Fixes: 4cbc325ed6b4 ("tls: rx: allow only one reader at a time") +Signed-off-by: Sabrina Dubroca +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/fe2ade22d030051ce4c3638704ed58b67d0df643.1711120964.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 14faf6189eb14..b783231668c65 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1976,10 +1976,10 @@ int tls_sw_recvmsg(struct sock *sk, + if (unlikely(flags & MSG_ERRQUEUE)) + return sock_recv_errqueue(sk, msg, len, SOL_IP, IP_RECVERR); + +- psock = sk_psock_get(sk); + err = tls_rx_reader_lock(sk, ctx, flags & MSG_DONTWAIT); + if (err < 0) + return err; ++ psock = sk_psock_get(sk); + bpf_strp_enabled = sk_psock_strp_enabled(psock); + + /* If crypto failed the connection is broken */ +-- +2.43.0 + diff --git a/queue-6.8/tls-recv-process_rx_list-shouldn-t-use-an-offset-wit.patch b/queue-6.8/tls-recv-process_rx_list-shouldn-t-use-an-offset-wit.patch new file mode 100644 index 00000000000..044931623b1 --- /dev/null +++ b/queue-6.8/tls-recv-process_rx_list-shouldn-t-use-an-offset-wit.patch @@ -0,0 +1,41 @@ +From 5b173d50bc75465bf53e408e72cd12e99ef70077 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 16:56:45 +0100 +Subject: tls: recv: process_rx_list shouldn't use an offset with kvec + +From: Sabrina Dubroca + +[ Upstream commit 7608a971fdeb4c3eefa522d1bfe8d4bc6b2481cc ] + +Only MSG_PEEK needs to copy from an offset during the final +process_rx_list call, because the bytes we copied at the beginning of +tls_sw_recvmsg were left on the rx_list. In the KVEC case, we removed +data from the rx_list as we were copying it, so there's no need to use +an offset, just like in the normal case. + +Fixes: 692d7b5d1f91 ("tls: Fix recvmsg() to be able to peek across multiple records") +Signed-off-by: Sabrina Dubroca +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/e5487514f828e0347d2b92ca40002c62b58af73d.1711120964.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 211f57164cb61..3cdc6bc9fba69 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -2152,7 +2152,7 @@ int tls_sw_recvmsg(struct sock *sk, + } + + /* Drain records from the rx_list & copy if required */ +- if (is_peek || is_kvec) ++ if (is_peek) + err = process_rx_list(ctx, msg, &control, copied + peeked, + decrypted - peeked, is_peek, NULL); + else +-- +2.43.0 + diff --git a/queue-6.8/tools-ynl-fix-setting-presence-bits-in-simple-nests.patch b/queue-6.8/tools-ynl-fix-setting-presence-bits-in-simple-nests.patch new file mode 100644 index 00000000000..5e712478734 --- /dev/null +++ b/queue-6.8/tools-ynl-fix-setting-presence-bits-in-simple-nests.patch @@ -0,0 +1,44 @@ +From 378918a750596101703bc4a990141c06ebb9a589 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Mar 2024 19:02:14 -0700 +Subject: tools: ynl: fix setting presence bits in simple nests + +From: Jakub Kicinski + +[ Upstream commit f6c8f5e8694c7a78c94e408b628afa6255cc428a ] + +When we set members of simple nested structures in requests +we need to set "presence" bits for all the nesting layers +below. This has nothing to do with the presence type of +the last layer. + +Fixes: be5bea1cc0bf ("net: add basic C code generators for Netlink") +Reviewed-by: Breno Leitao +Link: https://lore.kernel.org/r/20240321020214.1250202-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/net/ynl/ynl-gen-c.py | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/tools/net/ynl/ynl-gen-c.py b/tools/net/ynl/ynl-gen-c.py +index 7fc1aa788f6f5..c19dec2394915 100755 +--- a/tools/net/ynl/ynl-gen-c.py ++++ b/tools/net/ynl/ynl-gen-c.py +@@ -243,8 +243,11 @@ class Type(SpecAttr): + presence = '' + for i in range(0, len(ref)): + presence = f"{var}->{'.'.join(ref[:i] + [''])}_present.{ref[i]}" +- if self.presence_type() == 'bit': +- code.append(presence + ' = 1;') ++ # Every layer below last is a nest, so we know it uses bit presence ++ # last layer is "self" and may be a complex type ++ if i == len(ref) - 1 and self.presence_type() != 'bit': ++ continue ++ code.append(presence + ' = 1;') + code += self._setter_lines(ri, member, presence) + + func_name = f"{op_prefix(ri, direction, deref=deref)}_set_{'_'.join(ref)}" +-- +2.43.0 + diff --git a/queue-6.8/wifi-iwlwifi-mvm-include-link-id-when-releasing-fram.patch b/queue-6.8/wifi-iwlwifi-mvm-include-link-id-when-releasing-fram.patch new file mode 100644 index 00000000000..84b1ba2cd3a --- /dev/null +++ b/queue-6.8/wifi-iwlwifi-mvm-include-link-id-when-releasing-fram.patch @@ -0,0 +1,88 @@ +From 396ee86c3c23612e8ee97379b060a368a462129e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Mar 2024 23:26:22 +0200 +Subject: wifi: iwlwifi: mvm: include link ID when releasing frames + +From: Benjamin Berg + +[ Upstream commit e78d7877308989ef91b64a3c746ae31324c07caa ] + +When releasing frames from the reorder buffer, the link ID was not +included in the RX status information. This subsequently led mac80211 to +drop the frame. Change it so that the link information is set +immediately when possible so that it doesn't not need to be filled in +anymore when submitting the frame to mac80211. + +Fixes: b8a85a1d42d7 ("wifi: iwlwifi: mvm: rxmq: report link ID to mac80211") +Signed-off-by: Benjamin Berg +Tested-by: Emmanuel Grumbach +Reviewed-by: Johannes Berg +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240320232419.bbbd5e9bfe80.Iec1bf5c884e371f7bc5ea2534ed9ea8d3f2c0bf6@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 20 ++++++++----------- + 1 file changed, 8 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c +index 7bf2a5947e5e9..481dfbbe46162 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c +@@ -236,21 +236,13 @@ static void iwl_mvm_add_rtap_sniffer_config(struct iwl_mvm *mvm, + static void iwl_mvm_pass_packet_to_mac80211(struct iwl_mvm *mvm, + struct napi_struct *napi, + struct sk_buff *skb, int queue, +- struct ieee80211_sta *sta, +- struct ieee80211_link_sta *link_sta) ++ struct ieee80211_sta *sta) + { + if (unlikely(iwl_mvm_check_pn(mvm, skb, queue, sta))) { + kfree_skb(skb); + return; + } + +- if (sta && sta->valid_links && link_sta) { +- struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb); +- +- rx_status->link_valid = 1; +- rx_status->link_id = link_sta->link_id; +- } +- + ieee80211_rx_napi(mvm->hw, sta, skb, napi); + } + +@@ -587,7 +579,7 @@ static void iwl_mvm_release_frames(struct iwl_mvm *mvm, + while ((skb = __skb_dequeue(skb_list))) { + iwl_mvm_pass_packet_to_mac80211(mvm, napi, skb, + reorder_buf->queue, +- sta, NULL /* FIXME */); ++ sta); + reorder_buf->num_stored--; + } + } +@@ -2214,6 +2206,11 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi, + if (IS_ERR(sta)) + sta = NULL; + link_sta = rcu_dereference(mvm->fw_id_to_link_sta[id]); ++ ++ if (sta && sta->valid_links && link_sta) { ++ rx_status->link_valid = 1; ++ rx_status->link_id = link_sta->link_id; ++ } + } + } else if (!is_multicast_ether_addr(hdr->addr2)) { + /* +@@ -2357,8 +2354,7 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi, + !(desc->amsdu_info & IWL_RX_MPDU_AMSDU_LAST_SUBFRAME)) + rx_status->flag |= RX_FLAG_AMSDU_MORE; + +- iwl_mvm_pass_packet_to_mac80211(mvm, napi, skb, queue, sta, +- link_sta); ++ iwl_mvm_pass_packet_to_mac80211(mvm, napi, skb, queue, sta); + } + out: + rcu_read_unlock(); +-- +2.43.0 + diff --git a/queue-6.8/wifi-iwlwifi-mvm-pick-the-version-of-session_protect.patch b/queue-6.8/wifi-iwlwifi-mvm-pick-the-version-of-session_protect.patch new file mode 100644 index 00000000000..21aeea7548a --- /dev/null +++ b/queue-6.8/wifi-iwlwifi-mvm-pick-the-version-of-session_protect.patch @@ -0,0 +1,72 @@ +From c29e867999a75d8621caba8090f89a6943455331 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Mar 2024 08:28:01 +0200 +Subject: wifi: iwlwifi: mvm: pick the version of SESSION_PROTECTION_NOTIF + +From: Emmanuel Grumbach + +[ Upstream commit bbe806c294c9c4cd1221140d96e5f367673e393a ] + +When we want to know whether we should look for the mac_id or the +link_id in struct iwl_mvm_session_prot_notif, we should look at the +version of SESSION_PROTECTION_NOTIF. + +This causes WARNINGs: + +WARNING: CPU: 0 PID: 11403 at drivers/net/wireless/intel/iwlwifi/mvm/time-event.c:959 iwl_mvm_rx_session_protect_notif+0x333/0x340 [iwlmvm] +RIP: 0010:iwl_mvm_rx_session_protect_notif+0x333/0x340 [iwlmvm] +Code: 00 49 c7 84 24 48 07 00 00 00 00 00 00 41 c6 84 24 78 07 00 00 ff 4c 89 f7 e8 e9 71 54 d9 e9 7d fd ff ff 0f 0b e9 23 fe ff ff <0f> 0b e9 1c fe ff ff 66 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 +RSP: 0018:ffffb4bb00003d40 EFLAGS: 00010202 +RAX: 0000000000000000 RBX: ffff9ae63a361000 RCX: ffff9ae4a98b60d4 +RDX: ffff9ae4588499c0 RSI: 0000000000000305 RDI: ffff9ae4a98b6358 +RBP: ffffb4bb00003d68 R08: 0000000000000003 R09: 0000000000000010 +R10: ffffb4bb00003d00 R11: 000000000000000f R12: ffff9ae441399050 +R13: ffff9ae4761329e8 R14: 0000000000000001 R15: 0000000000000000 +FS: 0000000000000000(0000) GS:ffff9ae7af400000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 000055fb75680018 CR3: 00000003dae32006 CR4: 0000000000f70ef0 +PKRU: 55555554 +Call Trace: + + ? show_regs+0x69/0x80 + ? __warn+0x8d/0x150 + ? iwl_mvm_rx_session_protect_notif+0x333/0x340 [iwlmvm] + ? report_bug+0x196/0x1c0 + ? handle_bug+0x45/0x80 + ? exc_invalid_op+0x1c/0xb0 + ? asm_exc_invalid_op+0x1f/0x30 + ? iwl_mvm_rx_session_protect_notif+0x333/0x340 [iwlmvm] + iwl_mvm_rx_common+0x115/0x340 [iwlmvm] + iwl_mvm_rx_mq+0xa6/0x100 [iwlmvm] + iwl_pcie_rx_handle+0x263/0xa10 [iwlwifi] + iwl_pcie_napi_poll_msix+0x32/0xd0 [iwlwifi] + +Fixes: 085d33c53012 ("wifi: iwlwifi: support link id in SESSION_PROTECTION_NOTIF") +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240311081938.39d5618f7b9d.I564d863e53c6cbcb49141467932ecb6a9840b320@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/time-event.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c +index da00ef6e4fbcf..3d96a824dbd65 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c +@@ -898,9 +898,8 @@ void iwl_mvm_rx_session_protect_notif(struct iwl_mvm *mvm, + struct iwl_rx_packet *pkt = rxb_addr(rxb); + struct iwl_mvm_session_prot_notif *notif = (void *)pkt->data; + unsigned int ver = +- iwl_fw_lookup_cmd_ver(mvm->fw, +- WIDE_ID(MAC_CONF_GROUP, +- SESSION_PROTECTION_CMD), 2); ++ iwl_fw_lookup_notif_ver(mvm->fw, MAC_CONF_GROUP, ++ SESSION_PROTECTION_NOTIF, 2); + int id = le32_to_cpu(notif->mac_link_id); + struct ieee80211_vif *vif; + struct iwl_mvm_vif *mvmvif; +-- +2.43.0 + diff --git a/queue-6.8/wifi-iwlwifi-mvm-rfi-fix-potential-response-leaks.patch b/queue-6.8/wifi-iwlwifi-mvm-rfi-fix-potential-response-leaks.patch new file mode 100644 index 00000000000..cec766a29b0 --- /dev/null +++ b/queue-6.8/wifi-iwlwifi-mvm-rfi-fix-potential-response-leaks.patch @@ -0,0 +1,51 @@ +From aa8fa0243888abb0a7897c00a324ad020d07afcf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Mar 2024 10:10:17 +0200 +Subject: wifi: iwlwifi: mvm: rfi: fix potential response leaks + +From: Johannes Berg + +[ Upstream commit 06a093807eb7b5c5b29b6cff49f8174a4e702341 ] + +If the rx payload length check fails, or if kmemdup() fails, +we still need to free the command response. Fix that. + +Fixes: 21254908cbe9 ("iwlwifi: mvm: add RFI-M support") +Co-authored-by: Anjaneyulu +Signed-off-by: Johannes Berg +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240319100755.db2fa0196aa7.I116293b132502ac68a65527330fa37799694b79c@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/rfi.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rfi.c b/drivers/net/wireless/intel/iwlwifi/mvm/rfi.c +index 2ecd32bed752f..045c862a8fc4f 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rfi.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rfi.c +@@ -132,14 +132,18 @@ struct iwl_rfi_freq_table_resp_cmd *iwl_rfi_get_freq_table(struct iwl_mvm *mvm) + if (ret) + return ERR_PTR(ret); + +- if (WARN_ON_ONCE(iwl_rx_packet_payload_len(cmd.resp_pkt) != resp_size)) ++ if (WARN_ON_ONCE(iwl_rx_packet_payload_len(cmd.resp_pkt) != ++ resp_size)) { ++ iwl_free_resp(&cmd); + return ERR_PTR(-EIO); ++ } + + resp = kmemdup(cmd.resp_pkt->data, resp_size, GFP_KERNEL); ++ iwl_free_resp(&cmd); ++ + if (!resp) + return ERR_PTR(-ENOMEM); + +- iwl_free_resp(&cmd); + return resp; + } + +-- +2.43.0 + diff --git a/queue-6.8/xsk-don-t-assume-metadata-is-always-requested-in-tx-.patch b/queue-6.8/xsk-don-t-assume-metadata-is-always-requested-in-tx-.patch new file mode 100644 index 00000000000..6fb124932e8 --- /dev/null +++ b/queue-6.8/xsk-don-t-assume-metadata-is-always-requested-in-tx-.patch @@ -0,0 +1,39 @@ +From 73e1de4dcd5fc4f3ef1646515ab3172b0c875c14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Mar 2024 09:54:27 -0700 +Subject: xsk: Don't assume metadata is always requested in TX completion + +From: Stanislav Fomichev + +[ Upstream commit f6e922365faf4cd576bd1cf3e64b58c8a32e1856 ] + +`compl->tx_timestam != NULL` means that the user has explicitly +requested the metadata via XDP_TX_METADATA+XDP_TX_METADATA_TIMESTAMP. + +Fixes: 48eb03dd2630 ("xsk: Add TX timestamp and TX checksum offload support") +Reported-by: Daniele Salvatore Albano +Signed-off-by: Stanislav Fomichev +Signed-off-by: Daniel Borkmann +Tested-by: Daniele Salvatore Albano +Link: https://lore.kernel.org/bpf/20240318165427.1403313-1-sdf@google.com +Signed-off-by: Sasha Levin +--- + include/net/xdp_sock.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/include/net/xdp_sock.h b/include/net/xdp_sock.h +index 3cb4dc9bd70e4..3d54de168a6d9 100644 +--- a/include/net/xdp_sock.h ++++ b/include/net/xdp_sock.h +@@ -188,6 +188,8 @@ static inline void xsk_tx_metadata_complete(struct xsk_tx_metadata_compl *compl, + { + if (!compl) + return; ++ if (!compl->tx_timestamp) ++ return; + + *compl->tx_timestamp = ops->tmo_fill_timestamp(priv); + } +-- +2.43.0 +