From: Sasha Levin Date: Sun, 28 Apr 2024 11:06:21 +0000 (-0400) Subject: Fixes for 6.8 X-Git-Tag: v6.1.89~16 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ce69ccabeae9f6b765f5750d84f857e6ce2d0bd6;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.8 Signed-off-by: Sasha Levin --- diff --git a/queue-6.8/af_unix-suppress-false-positive-lockdep-splat-for-sp.patch b/queue-6.8/af_unix-suppress-false-positive-lockdep-splat-for-sp.patch new file mode 100644 index 00000000000..3dcec43e162 --- /dev/null +++ b/queue-6.8/af_unix-suppress-false-positive-lockdep-splat-for-sp.patch @@ -0,0 +1,171 @@ +From d667ed4665b69ba95f9f0156619b02fc99ae0cbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 10:04:43 -0700 +Subject: af_unix: Suppress false-positive lockdep splat for spin_lock() in + __unix_gc(). + +From: Kuniyuki Iwashima + +[ Upstream commit 1971d13ffa84a551d29a81fdf5b5ec5be166ac83 ] + +syzbot reported a lockdep splat regarding unix_gc_lock and +unix_state_lock(). + +One is called from recvmsg() for a connected socket, and another +is called from GC for TCP_LISTEN socket. + +So, the splat is false-positive. + +Let's add a dedicated lock class for the latter to suppress the splat. + +Note that this change is not necessary for net-next.git as the issue +is only applied to the old GC impl. + +[0]: +WARNING: possible circular locking dependency detected +6.9.0-rc5-syzkaller-00007-g4d2008430ce8 #0 Not tainted + ----------------------------------------------------- +kworker/u8:1/11 is trying to acquire lock: +ffff88807cea4e70 (&u->lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] +ffff88807cea4e70 (&u->lock){+.+.}-{2:2}, at: __unix_gc+0x40e/0xf70 net/unix/garbage.c:302 + +but task is already holding lock: +ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] +ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: __unix_gc+0x117/0xf70 net/unix/garbage.c:261 + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + + -> #1 (unix_gc_lock){+.+.}-{2:2}: + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 + __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] + _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 + spin_lock include/linux/spinlock.h:351 [inline] + unix_notinflight+0x13d/0x390 net/unix/garbage.c:140 + unix_detach_fds net/unix/af_unix.c:1819 [inline] + unix_destruct_scm+0x221/0x350 net/unix/af_unix.c:1876 + skb_release_head_state+0x100/0x250 net/core/skbuff.c:1188 + skb_release_all net/core/skbuff.c:1200 [inline] + __kfree_skb net/core/skbuff.c:1216 [inline] + kfree_skb_reason+0x16d/0x3b0 net/core/skbuff.c:1252 + kfree_skb include/linux/skbuff.h:1262 [inline] + manage_oob net/unix/af_unix.c:2672 [inline] + unix_stream_read_generic+0x1125/0x2700 net/unix/af_unix.c:2749 + unix_stream_splice_read+0x239/0x320 net/unix/af_unix.c:2981 + do_splice_read fs/splice.c:985 [inline] + splice_file_to_pipe+0x299/0x500 fs/splice.c:1295 + do_splice+0xf2d/0x1880 fs/splice.c:1379 + __do_splice fs/splice.c:1436 [inline] + __do_sys_splice fs/splice.c:1652 [inline] + __se_sys_splice+0x331/0x4a0 fs/splice.c:1634 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + + -> #0 (&u->lock){+.+.}-{2:2}: + check_prev_add kernel/locking/lockdep.c:3134 [inline] + check_prevs_add kernel/locking/lockdep.c:3253 [inline] + validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869 + __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 + __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] + _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 + spin_lock include/linux/spinlock.h:351 [inline] + __unix_gc+0x40e/0xf70 net/unix/garbage.c:302 + process_one_work kernel/workqueue.c:3254 [inline] + process_scheduled_works+0xa10/0x17c0 kernel/workqueue.c:3335 + worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 + kthread+0x2f0/0x390 kernel/kthread.c:388 + ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 + ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 + +other info that might help us debug this: + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(unix_gc_lock); + lock(&u->lock); + lock(unix_gc_lock); + lock(&u->lock); + + *** DEADLOCK *** + +3 locks held by kworker/u8:1/11: + #0: ffff888015089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3229 [inline] + #0: ffff888015089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x8e0/0x17c0 kernel/workqueue.c:3335 + #1: ffffc90000107d00 (unix_gc_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3230 [inline] + #1: ffffc90000107d00 (unix_gc_work){+.+.}-{0:0}, at: process_scheduled_works+0x91b/0x17c0 kernel/workqueue.c:3335 + #2: ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] + #2: ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: __unix_gc+0x117/0xf70 net/unix/garbage.c:261 + +stack backtrace: +CPU: 0 PID: 11 Comm: kworker/u8:1 Not tainted 6.9.0-rc5-syzkaller-00007-g4d2008430ce8 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 +Workqueue: events_unbound __unix_gc +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 + check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2187 + check_prev_add kernel/locking/lockdep.c:3134 [inline] + check_prevs_add kernel/locking/lockdep.c:3253 [inline] + validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869 + __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 + __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] + _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 + spin_lock include/linux/spinlock.h:351 [inline] + __unix_gc+0x40e/0xf70 net/unix/garbage.c:302 + process_one_work kernel/workqueue.c:3254 [inline] + process_scheduled_works+0xa10/0x17c0 kernel/workqueue.c:3335 + worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 + kthread+0x2f0/0x390 kernel/kthread.c:388 + ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 + ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 + + +Fixes: 47d8ac011fe1 ("af_unix: Fix garbage collector racing against connect()") +Reported-and-tested-by: syzbot+fa379358c28cc87cc307@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=fa379358c28cc87cc307 +Signed-off-by: Kuniyuki Iwashima +Link: https://lore.kernel.org/r/20240424170443.9832-1-kuniyu@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/af_unix.h | 3 +++ + net/unix/garbage.c | 2 +- + 2 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/include/net/af_unix.h b/include/net/af_unix.h +index d1b07ddbe677e..77bf30203d3cf 100644 +--- a/include/net/af_unix.h ++++ b/include/net/af_unix.h +@@ -77,6 +77,9 @@ enum unix_socket_lock_class { + U_LOCK_NORMAL, + U_LOCK_SECOND, /* for double locking, see unix_state_double_lock(). */ + U_LOCK_DIAG, /* used while dumping icons, see sk_diag_dump_icons(). */ ++ U_LOCK_GC_LISTENER, /* used for listening socket while determining gc ++ * candidates to close a small race window. ++ */ + }; + + static inline void unix_state_lock_nested(struct sock *sk, +diff --git a/net/unix/garbage.c b/net/unix/garbage.c +index 8734c0c1fc197..2a758531e1027 100644 +--- a/net/unix/garbage.c ++++ b/net/unix/garbage.c +@@ -260,7 +260,7 @@ void unix_gc(void) + __set_bit(UNIX_GC_MAYBE_CYCLE, &u->gc_flags); + + if (sk->sk_state == TCP_LISTEN) { +- unix_state_lock(sk); ++ unix_state_lock_nested(sk, U_LOCK_GC_LISTENER); + unix_state_unlock(sk); + } + } +-- +2.43.0 + diff --git a/queue-6.8/arc-plat-hsdk-remove-misplaced-interrupt-cells-prope.patch b/queue-6.8/arc-plat-hsdk-remove-misplaced-interrupt-cells-prope.patch new file mode 100644 index 00000000000..dcdcdcf0ebb --- /dev/null +++ b/queue-6.8/arc-plat-hsdk-remove-misplaced-interrupt-cells-prope.patch @@ -0,0 +1,44 @@ +From 6c52a4bab950ab46ceeb7630ea0d29fa207d0b56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 10:36:50 +0000 +Subject: ARC: [plat-hsdk]: Remove misplaced interrupt-cells property + +From: Alexey Brodkin + +[ Upstream commit 61231eb8113ce47991f35024f9c20810b37996bf ] + +"gmac" node stands for just an ordinary Ethernet controller, +which is by no means a provider of interrupts, i.e. it doesn't serve +as an interrupt controller, thus "#interrupt-cells" property doesn't +belong to it and so we remove it. + +Fixes: +------------>8------------ + DTC arch/arc/boot/dts/hsdk.dtb +arch/arc/boot/dts/hsdk.dts:207.23-235.5: Warning (interrupt_provider): /soc/ethernet@8000: '#interrupt-cells' found, but node is not an interrupt provider +arch/arc/boot/dts/hsdk.dtb: Warning (interrupt_map): Failed prerequisite 'interrupt_provider' +------------>8------------ + +Reported-by: Vineet Gupta +Signed-off-by: Alexey Brodkin +Signed-off-by: Vineet Gupta +Signed-off-by: Sasha Levin +--- + arch/arc/boot/dts/hsdk.dts | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arc/boot/dts/hsdk.dts b/arch/arc/boot/dts/hsdk.dts +index 6691f42550778..41b980df862b1 100644 +--- a/arch/arc/boot/dts/hsdk.dts ++++ b/arch/arc/boot/dts/hsdk.dts +@@ -205,7 +205,6 @@ + }; + + gmac: ethernet@8000 { +- #interrupt-cells = <1>; + compatible = "snps,dwmac"; + reg = <0x8000 0x2000>; + interrupts = <10>; +-- +2.43.0 + diff --git a/queue-6.8/arm-dts-imx6ull-tarragon-fix-usb-over-current-polari.patch b/queue-6.8/arm-dts-imx6ull-tarragon-fix-usb-over-current-polari.patch new file mode 100644 index 00000000000..bccce7110c7 --- /dev/null +++ b/queue-6.8/arm-dts-imx6ull-tarragon-fix-usb-over-current-polari.patch @@ -0,0 +1,36 @@ +From 26c6c96e64477311e37c6ba8ef7e586530a04076 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2024 21:06:58 +0200 +Subject: ARM: dts: imx6ull-tarragon: fix USB over-current polarity + +From: Michael Heimpold + +[ Upstream commit d7f3040a565214a30e2f07dc9b91566d316e2d36 ] + +Our Tarragon platform uses a active-low signal to inform +the i.MX6ULL about the over-current detection. + +Fixes: 5e4f393ccbf0 ("ARM: dts: imx6ull: Add chargebyte Tarragon support") +Signed-off-by: Michael Heimpold +Signed-off-by: Stefan Wahren +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/nxp/imx/imx6ull-tarragon-common.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/nxp/imx/imx6ull-tarragon-common.dtsi b/arch/arm/boot/dts/nxp/imx/imx6ull-tarragon-common.dtsi +index 3fdece5bd31f9..5248a058230c8 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6ull-tarragon-common.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6ull-tarragon-common.dtsi +@@ -805,6 +805,7 @@ + &pinctrl_usb_pwr>; + dr_mode = "host"; + power-active-high; ++ over-current-active-low; + disable-over-current; + status = "okay"; + }; +-- +2.43.0 + diff --git a/queue-6.8/arm-dts-microchip-at91-sama7g5ek-replace-regulator-s.patch b/queue-6.8/arm-dts-microchip-at91-sama7g5ek-replace-regulator-s.patch new file mode 100644 index 00000000000..ef350109470 --- /dev/null +++ b/queue-6.8/arm-dts-microchip-at91-sama7g5ek-replace-regulator-s.patch @@ -0,0 +1,71 @@ +From a2b99031072e6109402c0d45744c383e98886bd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Apr 2024 15:38:23 +0300 +Subject: ARM: dts: microchip: at91-sama7g5ek: Replace + regulator-suspend-voltage with the valid property + +From: Andrei Simion + +[ Upstream commit e027b71762e84ee9d4ba9ad5401b956b9e83ed2a ] + +By checking the pmic node with microchip,mcp16502.yaml# +'regulator-suspend-voltage' does not match any of the +regexes 'pinctrl-[0-9]+' from schema microchip,mcp16502.yaml# +which inherits regulator.yaml#. So replace regulator-suspend-voltage +with regulator-suspend-microvolt to avoid the inconsitency. + +Fixes: 85b1304b9daa ("ARM: dts: at91: sama7g5ek: set regulator voltages for standby state") +Signed-off-by: Andrei Simion +Acked-by: Nicolas Ferre +Link: https://lore.kernel.org/r/20240404123824.19182-2-andrei.simion@microchip.com +[claudiu.beznea: added a dot before starting the last sentence in commit + description] +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/microchip/at91-sama7g5ek.dts | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/microchip/at91-sama7g5ek.dts b/arch/arm/boot/dts/microchip/at91-sama7g5ek.dts +index 217e9b96c61e5..20b2497657ae4 100644 +--- a/arch/arm/boot/dts/microchip/at91-sama7g5ek.dts ++++ b/arch/arm/boot/dts/microchip/at91-sama7g5ek.dts +@@ -293,7 +293,7 @@ + + regulator-state-standby { + regulator-on-in-suspend; +- regulator-suspend-voltage = <1150000>; ++ regulator-suspend-microvolt = <1150000>; + regulator-mode = <4>; + }; + +@@ -314,7 +314,7 @@ + + regulator-state-standby { + regulator-on-in-suspend; +- regulator-suspend-voltage = <1050000>; ++ regulator-suspend-microvolt = <1050000>; + regulator-mode = <4>; + }; + +@@ -331,7 +331,7 @@ + regulator-always-on; + + regulator-state-standby { +- regulator-suspend-voltage = <1800000>; ++ regulator-suspend-microvolt = <1800000>; + regulator-on-in-suspend; + }; + +@@ -346,7 +346,7 @@ + regulator-max-microvolt = <3700000>; + + regulator-state-standby { +- regulator-suspend-voltage = <1800000>; ++ regulator-suspend-microvolt = <1800000>; + regulator-on-in-suspend; + }; + +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-mediatek-cherry-describe-cpu-supplies.patch b/queue-6.8/arm64-dts-mediatek-cherry-describe-cpu-supplies.patch new file mode 100644 index 00000000000..a13ca19a2e8 --- /dev/null +++ b/queue-6.8/arm64-dts-mediatek-cherry-describe-cpu-supplies.patch @@ -0,0 +1,70 @@ +From a9e3f4af9a407678b150b183815d6165fe390895 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jan 2024 11:23:01 -0300 +Subject: arm64: dts: mediatek: cherry: Describe CPU supplies +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 17b33dd9e4a38fbaca87c68e532b52f9d0492ba7 ] + +Describe in each CPU node the regulator supplying it. + +Fixes: 260c04d425eb ("arm64: dts: mediatek: cherry: Enable MT6315 regulators on SPMI bus") +Signed-off-by: Nícolas F. R. A. Prado +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240110142305.755367-2-nfraprado@collabora.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + .../boot/dts/mediatek/mt8195-cherry.dtsi | 32 +++++++++++++++++++ + 1 file changed, 32 insertions(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi b/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi +index 3c6079edda190..1f3a6755f1550 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi +@@ -264,6 +264,38 @@ + status = "okay"; + }; + ++&cpu0 { ++ cpu-supply = <&mt6359_vcore_buck_reg>; ++}; ++ ++&cpu1 { ++ cpu-supply = <&mt6359_vcore_buck_reg>; ++}; ++ ++&cpu2 { ++ cpu-supply = <&mt6359_vcore_buck_reg>; ++}; ++ ++&cpu3 { ++ cpu-supply = <&mt6359_vcore_buck_reg>; ++}; ++ ++&cpu4 { ++ cpu-supply = <&mt6315_6_vbuck1>; ++}; ++ ++&cpu5 { ++ cpu-supply = <&mt6315_6_vbuck1>; ++}; ++ ++&cpu6 { ++ cpu-supply = <&mt6315_6_vbuck1>; ++}; ++ ++&cpu7 { ++ cpu-supply = <&mt6315_6_vbuck1>; ++}; ++ + &dp_intf0 { + status = "okay"; + +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-mediatek-mt2712-fix-validation-errors.patch b/queue-6.8/arm64-dts-mediatek-mt2712-fix-validation-errors.patch new file mode 100644 index 00000000000..60eaa4914ac --- /dev/null +++ b/queue-6.8/arm64-dts-mediatek-mt2712-fix-validation-errors.patch @@ -0,0 +1,94 @@ +From a0d2317b087953b8f3e0cde8433b68a8ce350c76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 08:47:41 +0100 +Subject: arm64: dts: mediatek: mt2712: fix validation errors +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 3baac7291effb501c4d52df7019ebf52011e5772 ] + +1. Fixup infracfg clock controller binding + It also acts as reset controller so #reset-cells is required. +2. Use -pins suffix for pinctrl + +This fixes: +arch/arm64/boot/dts/mediatek/mt2712-evb.dtb: syscon@10001000: '#reset-cells' is a required property + from schema $id: http://devicetree.org/schemas/arm/mediatek/mediatek,infracfg.yaml# +arch/arm64/boot/dts/mediatek/mt2712-evb.dtb: pinctrl@1000b000: 'eth_default', 'eth_sleep', 'usb0_iddig', 'usb1_iddig' do not match any of the regexes: 'pinctrl-[0-9]+', 'pins$' + from schema $id: http://devicetree.org/schemas/pinctrl/mediatek,mt65xx-pinctrl.yaml# + +Signed-off-by: Rafał Miłecki +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240301074741.8362-1-zajec5@gmail.com +[Angelo: Added Fixes tags] +Fixes: 5d4839709c8e ("arm64: dts: mt2712: Add clock controller device nodes") +Fixes: 1724f4cc5133 ("arm64: dts: Add USB3 related nodes for MT2712") +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt2712-evb.dts | 8 ++++---- + arch/arm64/boot/dts/mediatek/mt2712e.dtsi | 3 ++- + 2 files changed, 6 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt2712-evb.dts b/arch/arm64/boot/dts/mediatek/mt2712-evb.dts +index fffdb7bbf889e..2d0ef6f23b3a9 100644 +--- a/arch/arm64/boot/dts/mediatek/mt2712-evb.dts ++++ b/arch/arm64/boot/dts/mediatek/mt2712-evb.dts +@@ -129,7 +129,7 @@ + }; + + &pio { +- eth_default: eth_default { ++ eth_default: eth-default-pins { + tx_pins { + pinmux = , + , +@@ -156,7 +156,7 @@ + }; + }; + +- eth_sleep: eth_sleep { ++ eth_sleep: eth-sleep-pins { + tx_pins { + pinmux = , + , +@@ -182,14 +182,14 @@ + }; + }; + +- usb0_id_pins_float: usb0_iddig { ++ usb0_id_pins_float: usb0-iddig-pins { + pins_iddig { + pinmux = ; + bias-pull-up; + }; + }; + +- usb1_id_pins_float: usb1_iddig { ++ usb1_id_pins_float: usb1-iddig-pins { + pins_iddig { + pinmux = ; + bias-pull-up; +diff --git a/arch/arm64/boot/dts/mediatek/mt2712e.dtsi b/arch/arm64/boot/dts/mediatek/mt2712e.dtsi +index ed1a9d3194153..f767f921bdee1 100644 +--- a/arch/arm64/boot/dts/mediatek/mt2712e.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt2712e.dtsi +@@ -249,10 +249,11 @@ + #clock-cells = <1>; + }; + +- infracfg: syscon@10001000 { ++ infracfg: clock-controller@10001000 { + compatible = "mediatek,mt2712-infracfg", "syscon"; + reg = <0 0x10001000 0 0x1000>; + #clock-cells = <1>; ++ #reset-cells = <1>; + }; + + pericfg: syscon@10003000 { +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-mediatek-mt7622-drop-reset-names-from-ther.patch b/queue-6.8/arm64-dts-mediatek-mt7622-drop-reset-names-from-ther.patch new file mode 100644 index 00000000000..1d3e42f26d3 --- /dev/null +++ b/queue-6.8/arm64-dts-mediatek-mt7622-drop-reset-names-from-ther.patch @@ -0,0 +1,44 @@ +From ab2c029d5559a0b58530b905859dbf544a10bea6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Mar 2024 23:10:50 +0100 +Subject: arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit ecb5b0034f5bcc35003b4b965cf50c6e98316e79 ] + +Binding doesn't specify "reset-names" property and Linux driver also +doesn't use it. + +Fix following validation error: +arch/arm64/boot/dts/mediatek/mt7622-rfb1.dtb: thermal@1100b000: Unevaluated properties are not allowed ('reset-names' was unexpected) + from schema $id: http://devicetree.org/schemas/thermal/mediatek,thermal.yaml# + +Fixes: ae457b7679c4 ("arm64: dts: mt7622: add SoC and peripheral related device nodes") +Signed-off-by: Rafał Miłecki +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240317221050.18595-5-zajec5@gmail.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7622.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7622.dtsi b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +index 8e46480b5364b..917fa39a74f8d 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +@@ -513,7 +513,6 @@ + <&pericfg CLK_PERI_AUXADC_PD>; + clock-names = "therm", "auxadc"; + resets = <&pericfg MT7622_PERI_THERM_SW_RST>; +- reset-names = "therm"; + mediatek,auxadc = <&auxadc>; + mediatek,apmixedsys = <&apmixedsys>; + nvmem-cells = <&thermal_calibration>; +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-mediatek-mt7622-fix-clock-controllers.patch b/queue-6.8/arm64-dts-mediatek-mt7622-fix-clock-controllers.patch new file mode 100644 index 00000000000..72d483e5182 --- /dev/null +++ b/queue-6.8/arm64-dts-mediatek-mt7622-fix-clock-controllers.patch @@ -0,0 +1,96 @@ +From 4aa29ade6bd6226664940c34747abd9295cd9e44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Mar 2024 23:10:47 +0100 +Subject: arm64: dts: mediatek: mt7622: fix clock controllers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 3ba5a61594347ab46e7c2cff6cd63ea0f1282efb ] + +1. Drop unneeded "syscon"s (bindings were updated recently) +2. Use "clock-controller" in nodenames +3. Add missing "#clock-cells" + +Fixes: d7167881e03e ("arm64: dts: mt7622: add clock controller device nodes") +Fixes: e9b65ecb7c30 ("arm64: dts: mediatek: mt7622: introduce nodes for Wireless Ethernet Dispatch") +Signed-off-by: Rafał Miłecki +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240317221050.18595-2-zajec5@gmail.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7622.dtsi | 27 +++++++++++------------- + 1 file changed, 12 insertions(+), 15 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7622.dtsi b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +index 3ee9266fa8e98..283fdf7d2d8b9 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +@@ -283,16 +283,14 @@ + }; + }; + +- apmixedsys: apmixedsys@10209000 { +- compatible = "mediatek,mt7622-apmixedsys", +- "syscon"; ++ apmixedsys: clock-controller@10209000 { ++ compatible = "mediatek,mt7622-apmixedsys"; + reg = <0 0x10209000 0 0x1000>; + #clock-cells = <1>; + }; + +- topckgen: topckgen@10210000 { +- compatible = "mediatek,mt7622-topckgen", +- "syscon"; ++ topckgen: clock-controller@10210000 { ++ compatible = "mediatek,mt7622-topckgen"; + reg = <0 0x10210000 0 0x1000>; + #clock-cells = <1>; + }; +@@ -734,9 +732,8 @@ + power-domains = <&scpsys MT7622_POWER_DOMAIN_WB>; + }; + +- ssusbsys: ssusbsys@1a000000 { +- compatible = "mediatek,mt7622-ssusbsys", +- "syscon"; ++ ssusbsys: clock-controller@1a000000 { ++ compatible = "mediatek,mt7622-ssusbsys"; + reg = <0 0x1a000000 0 0x1000>; + #clock-cells = <1>; + #reset-cells = <1>; +@@ -793,9 +790,8 @@ + }; + }; + +- pciesys: pciesys@1a100800 { +- compatible = "mediatek,mt7622-pciesys", +- "syscon"; ++ pciesys: clock-controller@1a100800 { ++ compatible = "mediatek,mt7622-pciesys"; + reg = <0 0x1a100800 0 0x1000>; + #clock-cells = <1>; + #reset-cells = <1>; +@@ -921,12 +917,13 @@ + }; + }; + +- hifsys: syscon@1af00000 { +- compatible = "mediatek,mt7622-hifsys", "syscon"; ++ hifsys: clock-controller@1af00000 { ++ compatible = "mediatek,mt7622-hifsys"; + reg = <0 0x1af00000 0 0x70>; ++ #clock-cells = <1>; + }; + +- ethsys: syscon@1b000000 { ++ ethsys: clock-controller@1b000000 { + compatible = "mediatek,mt7622-ethsys", + "syscon"; + reg = <0 0x1b000000 0 0x1000>; +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-mediatek-mt7622-fix-ethernet-controller-co.patch b/queue-6.8/arm64-dts-mediatek-mt7622-fix-ethernet-controller-co.patch new file mode 100644 index 00000000000..4301c2a0a02 --- /dev/null +++ b/queue-6.8/arm64-dts-mediatek-mt7622-fix-ethernet-controller-co.patch @@ -0,0 +1,45 @@ +From 4dfd2380569addf31bf024ba855b1f567e94994f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Mar 2024 23:10:49 +0100 +Subject: arm64: dts: mediatek: mt7622: fix ethernet controller "compatible" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 208add29ce5b7291f6c466e4dfd9cbf61c72888e ] + +Fix following validation error: +arch/arm64/boot/dts/mediatek/mt7622-rfb1.dtb: ethernet@1b100000: compatible: ['mediatek,mt7622-eth', 'mediatek,mt2701-eth', 'syscon'] is too long + from schema $id: http://devicetree.org/schemas/net/mediatek,net.yaml# +(and other complains about wrong clocks). + +Fixes: 5f599b3a0bb8 ("arm64: dts: mt7622: add ethernet device nodes") +Signed-off-by: Rafał Miłecki +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240317221050.18595-4-zajec5@gmail.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7622.dtsi | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7622.dtsi b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +index 4c8a71c8184b7..8e46480b5364b 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +@@ -963,9 +963,7 @@ + }; + + eth: ethernet@1b100000 { +- compatible = "mediatek,mt7622-eth", +- "mediatek,mt2701-eth", +- "syscon"; ++ compatible = "mediatek,mt7622-eth"; + reg = <0 0x1b100000 0 0x20000>; + interrupts = , + , +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-mediatek-mt7622-fix-ir-nodename.patch b/queue-6.8/arm64-dts-mediatek-mt7622-fix-ir-nodename.patch new file mode 100644 index 00000000000..e3939e601dc --- /dev/null +++ b/queue-6.8/arm64-dts-mediatek-mt7622-fix-ir-nodename.patch @@ -0,0 +1,42 @@ +From a980ac4fb4650b1b53f6016890d932212f53b092 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Mar 2024 23:10:48 +0100 +Subject: arm64: dts: mediatek: mt7622: fix IR nodename +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 800dc93c3941e372c94278bf4059e6e82f60bd66 ] + +Fix following validation error: +arch/arm64/boot/dts/mediatek/mt7622-rfb1.dtb: cir@10009000: $nodename:0: 'cir@10009000' does not match '^ir(-receiver)?(@[a-f0-9]+)?$' + from schema $id: http://devicetree.org/schemas/media/mediatek,mt7622-cir.yaml# + +Fixes: ae457b7679c4 ("arm64: dts: mt7622: add SoC and peripheral related device nodes") +Signed-off-by: Rafał Miłecki +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240317221050.18595-3-zajec5@gmail.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7622.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7622.dtsi b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +index 283fdf7d2d8b9..4c8a71c8184b7 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +@@ -252,7 +252,7 @@ + clock-names = "hif_sel"; + }; + +- cir: cir@10009000 { ++ cir: ir-receiver@10009000 { + compatible = "mediatek,mt7622-cir"; + reg = <0 0x10009000 0 0x1000>; + interrupts = ; +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-mediatek-mt7986-drop-invalid-properties-fr.patch b/queue-6.8/arm64-dts-mediatek-mt7986-drop-invalid-properties-fr.patch new file mode 100644 index 00000000000..dc9096803cb --- /dev/null +++ b/queue-6.8/arm64-dts-mediatek-mt7986-drop-invalid-properties-fr.patch @@ -0,0 +1,47 @@ +From 9056776cf3bd71eb47fe573ca89c2142d850a031 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 06:37:37 +0100 +Subject: arm64: dts: mediatek: mt7986: drop invalid properties from ethsys +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 3b449bfd2ff6c5d3ceecfcb18528ff8e1b4ac2fd ] + +Mediatek ethsys controller / syscon binding doesn't allow any subnodes +so "#address-cells" and "#size-cells" are redundant (actually: +disallowed). + +This fixes: +arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dtb: syscon@15000000: '#address-cells', '#size-cells' do not match any of the regexes: 'pinctrl-[0-9]+' + from schema $id: http://devicetree.org/schemas/clock/mediatek,ethsys.yaml# + +Fixes: 1f9986b258c2 ("arm64: dts: mediatek: add clock support for mt7986a") +Cc: Sam Shih +Signed-off-by: Rafał Miłecki +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240213053739.14387-1-zajec5@gmail.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi +index eba5e27a1bbea..850b664dfa13d 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi +@@ -501,8 +501,6 @@ + compatible = "mediatek,mt7986-ethsys", + "syscon"; + reg = <0 0x15000000 0 0x1000>; +- #address-cells = <1>; +- #size-cells = <1>; + #clock-cells = <1>; + #reset-cells = <1>; + }; +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-mediatek-mt7986-drop-invalid-thermal-block.patch b/queue-6.8/arm64-dts-mediatek-mt7986-drop-invalid-thermal-block.patch new file mode 100644 index 00000000000..8cab6f8f06f --- /dev/null +++ b/queue-6.8/arm64-dts-mediatek-mt7986-drop-invalid-thermal-block.patch @@ -0,0 +1,55 @@ +From 1477899d72b96dd04584e9f625e6f9c66cdf76fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 06:37:39 +0100 +Subject: arm64: dts: mediatek: mt7986: drop invalid thermal block clock +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 970f8b01bd7719a22e577ba6c78e27f9ccf22783 ] + +Thermal block uses only two clocks. Its binding doesn't document or +allow "adc_32k". Also Linux driver doesn't support it. + +It has been additionally verified by Angelo by his detailed research on +MT7981 / MT7986 clocks (thanks!). + +This fixes: +arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dtb: thermal@1100c800: clocks: [[4, 27], [4, 44], [4, 45]] is too long + from schema $id: http://devicetree.org/schemas/thermal/mediatek,thermal.yaml# +arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dtb: thermal@1100c800: clock-names: ['therm', 'auxadc', 'adc_32k'] is too long + from schema $id: http://devicetree.org/schemas/thermal/mediatek,thermal.yaml# + +Fixes: 0a9615d58d04 ("arm64: dts: mt7986: add thermal and efuse") +Cc: Daniel Golle +Link: https://lore.kernel.org/linux-devicetree/17d143aa-576e-4d67-a0ea-b79f3518b81c@collabora.com/ +Signed-off-by: Rafał Miłecki +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240213053739.14387-3-zajec5@gmail.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi +index f3a2a89fada41..559990dcd1d17 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi +@@ -332,9 +332,8 @@ + reg = <0 0x1100c800 0 0x800>; + interrupts = ; + clocks = <&infracfg CLK_INFRA_THERM_CK>, +- <&infracfg CLK_INFRA_ADC_26M_CK>, +- <&infracfg CLK_INFRA_ADC_FRC_CK>; +- clock-names = "therm", "auxadc", "adc_32k"; ++ <&infracfg CLK_INFRA_ADC_26M_CK>; ++ clock-names = "therm", "auxadc"; + nvmem-cells = <&thermal_calibration>; + nvmem-cell-names = "calibration-data"; + #thermal-sensor-cells = <1>; +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-mediatek-mt7986-drop-reset-cells-from-ethe.patch b/queue-6.8/arm64-dts-mediatek-mt7986-drop-reset-cells-from-ethe.patch new file mode 100644 index 00000000000..be8ebda08c9 --- /dev/null +++ b/queue-6.8/arm64-dts-mediatek-mt7986-drop-reset-cells-from-ethe.patch @@ -0,0 +1,46 @@ +From 0c0bcf10b5a618f539f403f84c915498c8329aa3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 06:37:38 +0100 +Subject: arm64: dts: mediatek: mt7986: drop "#reset-cells" from Ethernet + controller +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 9bd88afc94c3570289a0f1c696578b3e1f4e3169 ] + +Ethernet block doesn't include or act as a reset controller. +Documentation also doesn't document "#reset-cells" for it. + +This fixes: +arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dtb: ethernet@15100000: Unevaluated properties are not allowed ('#reset-cells' was unexpected) + from schema $id: http://devicetree.org/schemas/net/mediatek,net.yaml# + +Fixes: 082ff36bd5c0 ("arm64: dts: mediatek: mt7986: introduce ethernet nodes") +Cc: Lorenzo Bianconi +Signed-off-by: Rafał Miłecki +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240213053739.14387-2-zajec5@gmail.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi +index 850b664dfa13d..5c2fe2f43a142 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi +@@ -577,7 +577,6 @@ + <&topckgen CLK_TOP_SGM_325M_SEL>; + assigned-clock-parents = <&apmixedsys CLK_APMIXED_NET2PLL>, + <&apmixedsys CLK_APMIXED_SGMPLL>; +- #reset-cells = <1>; + #address-cells = <1>; + #size-cells = <0>; + mediatek,ethsys = <ðsys>; +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-mediatek-mt7986-prefix-bpi-r3-cooling-maps.patch b/queue-6.8/arm64-dts-mediatek-mt7986-prefix-bpi-r3-cooling-maps.patch new file mode 100644 index 00000000000..6c71ad391c6 --- /dev/null +++ b/queue-6.8/arm64-dts-mediatek-mt7986-prefix-bpi-r3-cooling-maps.patch @@ -0,0 +1,57 @@ +From 476baea75892edc867f4a3ca760131caf66ccc16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 07:14:59 +0100 +Subject: arm64: dts: mediatek: mt7986: prefix BPI-R3 cooling maps with "map-" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit f8c65a5e4560781f2ea175d8f26cd75ac98e8d78 ] + +This fixes: +arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dtb: thermal-zones: cpu-thermal:cooling-maps: 'cpu-active-high', 'cpu-active-low', 'cpu-active-med' do not match any of the regexes: '^map[-a-zA-Z0-9]*$', 'pinctrl-[0-9]+' + from schema $id: http://devicetree.org/schemas/thermal/thermal-zones.yaml# + +Fixes: c26f779a2295 ("arm64: dts: mt7986: add pwm-fan and cooling-maps to BPI-R3 dts") +Cc: Daniel Golle +Signed-off-by: Rafał Miłecki +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240213061459.17917-1-zajec5@gmail.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts b/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts +index e04b1c0c0ebbf..ed79ad1ae8716 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts ++++ b/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts +@@ -146,19 +146,19 @@ + + &cpu_thermal { + cooling-maps { +- cpu-active-high { ++ map-cpu-active-high { + /* active: set fan to cooling level 2 */ + cooling-device = <&fan 2 2>; + trip = <&cpu_trip_active_high>; + }; + +- cpu-active-med { ++ map-cpu-active-med { + /* active: set fan to cooling level 1 */ + cooling-device = <&fan 1 1>; + trip = <&cpu_trip_active_med>; + }; + +- cpu-active-low { ++ map-cpu-active-low { + /* active: set fan to cooling level 0 */ + cooling-device = <&fan 0 0>; + trip = <&cpu_trip_active_low>; +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-mediatek-mt7986-reorder-nodes.patch b/queue-6.8/arm64-dts-mediatek-mt7986-reorder-nodes.patch new file mode 100644 index 00000000000..9ce026e423e --- /dev/null +++ b/queue-6.8/arm64-dts-mediatek-mt7986-reorder-nodes.patch @@ -0,0 +1,216 @@ +From 7fb4ec613e0e9037d11da34f9d11af85b0e5d6bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Feb 2024 13:16:20 +0100 +Subject: arm64: dts: mediatek: mt7986: reorder nodes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 3f79e8f3364499750d7442767b101b7bc5864ddf ] + +Use order described as preferred in DTS Coding Style: +1. Sort bus nodes by unit address +2. Use alpha-numerical order for the rest + +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20240212121620.15035-2-zajec5@gmail.com +Signed-off-by: AngeloGioacchino Del Regno +Stable-dep-of: 970f8b01bd77 ("arm64: dts: mediatek: mt7986: drop invalid thermal block clock") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 116 +++++++++++----------- + 1 file changed, 58 insertions(+), 58 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi +index 5c2fe2f43a142..f3a2a89fada41 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi +@@ -16,13 +16,6 @@ + #address-cells = <2>; + #size-cells = <2>; + +- clk40m: oscillator-40m { +- compatible = "fixed-clock"; +- clock-frequency = <40000000>; +- #clock-cells = <0>; +- clock-output-names = "clkxtal"; +- }; +- + cpus { + #address-cells = <1>; + #size-cells = <0>; +@@ -59,6 +52,13 @@ + }; + }; + ++ clk40m: oscillator-40m { ++ compatible = "fixed-clock"; ++ clock-frequency = <40000000>; ++ #clock-cells = <0>; ++ clock-output-names = "clkxtal"; ++ }; ++ + psci { + compatible = "arm,psci-0.2"; + method = "smc"; +@@ -121,15 +121,6 @@ + + }; + +- timer { +- compatible = "arm,armv8-timer"; +- interrupt-parent = <&gic>; +- interrupts = , +- , +- , +- ; +- }; +- + soc { + compatible = "simple-bus"; + ranges; +@@ -203,6 +194,19 @@ + #interrupt-cells = <2>; + }; + ++ pwm: pwm@10048000 { ++ compatible = "mediatek,mt7986-pwm"; ++ reg = <0 0x10048000 0 0x1000>; ++ #pwm-cells = <2>; ++ interrupts = ; ++ clocks = <&topckgen CLK_TOP_PWM_SEL>, ++ <&infracfg CLK_INFRA_PWM_STA>, ++ <&infracfg CLK_INFRA_PWM1_CK>, ++ <&infracfg CLK_INFRA_PWM2_CK>; ++ clock-names = "top", "main", "pwm1", "pwm2"; ++ status = "disabled"; ++ }; ++ + sgmiisys0: syscon@10060000 { + compatible = "mediatek,mt7986-sgmiisys_0", + "syscon"; +@@ -240,19 +244,6 @@ + status = "disabled"; + }; + +- pwm: pwm@10048000 { +- compatible = "mediatek,mt7986-pwm"; +- reg = <0 0x10048000 0 0x1000>; +- #pwm-cells = <2>; +- interrupts = ; +- clocks = <&topckgen CLK_TOP_PWM_SEL>, +- <&infracfg CLK_INFRA_PWM_STA>, +- <&infracfg CLK_INFRA_PWM1_CK>, +- <&infracfg CLK_INFRA_PWM2_CK>; +- clock-names = "top", "main", "pwm1", "pwm2"; +- status = "disabled"; +- }; +- + uart0: serial@11002000 { + compatible = "mediatek,mt7986-uart", + "mediatek,mt6577-uart"; +@@ -336,6 +327,21 @@ + status = "disabled"; + }; + ++ thermal: thermal@1100c800 { ++ compatible = "mediatek,mt7986-thermal"; ++ reg = <0 0x1100c800 0 0x800>; ++ interrupts = ; ++ clocks = <&infracfg CLK_INFRA_THERM_CK>, ++ <&infracfg CLK_INFRA_ADC_26M_CK>, ++ <&infracfg CLK_INFRA_ADC_FRC_CK>; ++ clock-names = "therm", "auxadc", "adc_32k"; ++ nvmem-cells = <&thermal_calibration>; ++ nvmem-cell-names = "calibration-data"; ++ #thermal-sensor-cells = <1>; ++ mediatek,auxadc = <&auxadc>; ++ mediatek,apmixedsys = <&apmixedsys>; ++ }; ++ + auxadc: adc@1100d000 { + compatible = "mediatek,mt7986-auxadc"; + reg = <0 0x1100d000 0 0x1000>; +@@ -387,21 +393,6 @@ + status = "disabled"; + }; + +- thermal: thermal@1100c800 { +- compatible = "mediatek,mt7986-thermal"; +- reg = <0 0x1100c800 0 0x800>; +- interrupts = ; +- clocks = <&infracfg CLK_INFRA_THERM_CK>, +- <&infracfg CLK_INFRA_ADC_26M_CK>, +- <&infracfg CLK_INFRA_ADC_FRC_CK>; +- clock-names = "therm", "auxadc", "adc_32k"; +- nvmem-cells = <&thermal_calibration>; +- nvmem-cell-names = "calibration-data"; +- #thermal-sensor-cells = <1>; +- mediatek,auxadc = <&auxadc>; +- mediatek,apmixedsys = <&apmixedsys>; +- }; +- + pcie: pcie@11280000 { + compatible = "mediatek,mt7986-pcie", + "mediatek,mt8192-pcie"; +@@ -531,20 +522,6 @@ + mediatek,wo-ccif = <&wo_ccif1>; + }; + +- wo_ccif0: syscon@151a5000 { +- compatible = "mediatek,mt7986-wo-ccif", "syscon"; +- reg = <0 0x151a5000 0 0x1000>; +- interrupt-parent = <&gic>; +- interrupts = ; +- }; +- +- wo_ccif1: syscon@151ad000 { +- compatible = "mediatek,mt7986-wo-ccif", "syscon"; +- reg = <0 0x151ad000 0 0x1000>; +- interrupt-parent = <&gic>; +- interrupts = ; +- }; +- + eth: ethernet@15100000 { + compatible = "mediatek,mt7986-eth"; + reg = <0 0x15100000 0 0x80000>; +@@ -586,6 +563,20 @@ + status = "disabled"; + }; + ++ wo_ccif0: syscon@151a5000 { ++ compatible = "mediatek,mt7986-wo-ccif", "syscon"; ++ reg = <0 0x151a5000 0 0x1000>; ++ interrupt-parent = <&gic>; ++ interrupts = ; ++ }; ++ ++ wo_ccif1: syscon@151ad000 { ++ compatible = "mediatek,mt7986-wo-ccif", "syscon"; ++ reg = <0 0x151ad000 0 0x1000>; ++ interrupt-parent = <&gic>; ++ interrupts = ; ++ }; ++ + wifi: wifi@18000000 { + compatible = "mediatek,mt7986-wmac"; + reg = <0 0x18000000 0 0x1000000>, +@@ -643,4 +634,13 @@ + }; + }; + }; ++ ++ timer { ++ compatible = "arm,armv8-timer"; ++ interrupt-parent = <&gic>; ++ interrupts = , ++ , ++ , ++ ; ++ }; + }; +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-mediatek-mt7986-reorder-properties.patch b/queue-6.8/arm64-dts-mediatek-mt7986-reorder-properties.patch new file mode 100644 index 00000000000..c8168d83d4e --- /dev/null +++ b/queue-6.8/arm64-dts-mediatek-mt7986-reorder-properties.patch @@ -0,0 +1,249 @@ +From 5af213f5a6c734db96ad81ece4bcbe24ac165104 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Feb 2024 13:16:19 +0100 +Subject: arm64: dts: mediatek: mt7986: reorder properties +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 7eb133c99fbebc6adb1cbd22c926d42d2bbca648 ] + +Use order described as preferred in DTS Coding Style. Mostly just move +"compatible", "reg" and "ranges" properties. In two nodes also move +vendor-prefixed props down. + +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20240212121620.15035-1-zajec5@gmail.com +Signed-off-by: AngeloGioacchino Del Regno +Stable-dep-of: 3b449bfd2ff6 ("arm64: dts: mediatek: mt7986: drop invalid properties from ethsys") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 67 ++++++++++++----------- + 1 file changed, 34 insertions(+), 33 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi +index d974739eae1c9..eba5e27a1bbea 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi +@@ -27,34 +27,34 @@ + #address-cells = <1>; + #size-cells = <0>; + cpu0: cpu@0 { +- device_type = "cpu"; + compatible = "arm,cortex-a53"; +- enable-method = "psci"; + reg = <0x0>; ++ device_type = "cpu"; ++ enable-method = "psci"; + #cooling-cells = <2>; + }; + + cpu1: cpu@1 { +- device_type = "cpu"; + compatible = "arm,cortex-a53"; +- enable-method = "psci"; + reg = <0x1>; ++ device_type = "cpu"; ++ enable-method = "psci"; + #cooling-cells = <2>; + }; + + cpu2: cpu@2 { +- device_type = "cpu"; + compatible = "arm,cortex-a53"; +- enable-method = "psci"; + reg = <0x2>; ++ device_type = "cpu"; ++ enable-method = "psci"; + #cooling-cells = <2>; + }; + + cpu3: cpu@3 { +- device_type = "cpu"; +- enable-method = "psci"; + compatible = "arm,cortex-a53"; + reg = <0x3>; ++ device_type = "cpu"; ++ enable-method = "psci"; + #cooling-cells = <2>; + }; + }; +@@ -131,22 +131,22 @@ + }; + + soc { +- #address-cells = <2>; +- #size-cells = <2>; + compatible = "simple-bus"; + ranges; ++ #address-cells = <2>; ++ #size-cells = <2>; + + gic: interrupt-controller@c000000 { + compatible = "arm,gic-v3"; +- #interrupt-cells = <3>; +- interrupt-parent = <&gic>; +- interrupt-controller; + reg = <0 0x0c000000 0 0x10000>, /* GICD */ + <0 0x0c080000 0 0x80000>, /* GICR */ + <0 0x0c400000 0 0x2000>, /* GICC */ + <0 0x0c410000 0 0x1000>, /* GICH */ + <0 0x0c420000 0 0x2000>; /* GICV */ ++ interrupt-parent = <&gic>; + interrupts = ; ++ interrupt-controller; ++ #interrupt-cells = <3>; + }; + + infracfg: infracfg@10001000 { +@@ -310,9 +310,9 @@ + + spi0: spi@1100a000 { + compatible = "mediatek,mt7986-spi-ipm", "mediatek,spi-ipm"; ++ reg = <0 0x1100a000 0 0x100>; + #address-cells = <1>; + #size-cells = <0>; +- reg = <0 0x1100a000 0 0x100>; + interrupts = ; + clocks = <&topckgen CLK_TOP_MPLL_D2>, + <&topckgen CLK_TOP_SPI_SEL>, +@@ -324,9 +324,9 @@ + + spi1: spi@1100b000 { + compatible = "mediatek,mt7986-spi-ipm", "mediatek,spi-ipm"; ++ reg = <0 0x1100b000 0 0x100>; + #address-cells = <1>; + #size-cells = <0>; +- reg = <0 0x1100b000 0 0x100>; + interrupts = ; + clocks = <&topckgen CLK_TOP_MPLL_D2>, + <&topckgen CLK_TOP_SPIM_MST_SEL>, +@@ -388,7 +388,6 @@ + }; + + thermal: thermal@1100c800 { +- #thermal-sensor-cells = <1>; + compatible = "mediatek,mt7986-thermal"; + reg = <0 0x1100c800 0 0x800>; + interrupts = ; +@@ -396,30 +395,30 @@ + <&infracfg CLK_INFRA_ADC_26M_CK>, + <&infracfg CLK_INFRA_ADC_FRC_CK>; + clock-names = "therm", "auxadc", "adc_32k"; +- mediatek,auxadc = <&auxadc>; +- mediatek,apmixedsys = <&apmixedsys>; + nvmem-cells = <&thermal_calibration>; + nvmem-cell-names = "calibration-data"; ++ #thermal-sensor-cells = <1>; ++ mediatek,auxadc = <&auxadc>; ++ mediatek,apmixedsys = <&apmixedsys>; + }; + + pcie: pcie@11280000 { + compatible = "mediatek,mt7986-pcie", + "mediatek,mt8192-pcie"; ++ reg = <0x00 0x11280000 0x00 0x4000>; ++ reg-names = "pcie-mac"; ++ ranges = <0x82000000 0x00 0x20000000 0x00 ++ 0x20000000 0x00 0x10000000>; + device_type = "pci"; + #address-cells = <3>; + #size-cells = <2>; +- reg = <0x00 0x11280000 0x00 0x4000>; +- reg-names = "pcie-mac"; + interrupts = ; + bus-range = <0x00 0xff>; +- ranges = <0x82000000 0x00 0x20000000 0x00 +- 0x20000000 0x00 0x10000000>; + clocks = <&infracfg CLK_INFRA_IPCIE_PIPE_CK>, + <&infracfg CLK_INFRA_IPCIE_CK>, + <&infracfg CLK_INFRA_IPCIER_CK>, + <&infracfg CLK_INFRA_IPCIEB_CK>; + clock-names = "pl_250m", "tl_26m", "peri_26m", "top_133m"; +- status = "disabled"; + + phys = <&pcie_port PHY_TYPE_PCIE>; + phy-names = "pcie-phy"; +@@ -430,6 +429,8 @@ + <0 0 0 2 &pcie_intc 1>, + <0 0 0 3 &pcie_intc 2>, + <0 0 0 4 &pcie_intc 3>; ++ status = "disabled"; ++ + pcie_intc: interrupt-controller { + #address-cells = <0>; + #interrupt-cells = <1>; +@@ -440,9 +441,9 @@ + pcie_phy: t-phy { + compatible = "mediatek,mt7986-tphy", + "mediatek,generic-tphy-v2"; ++ ranges; + #address-cells = <2>; + #size-cells = <2>; +- ranges; + status = "disabled"; + + pcie_port: pcie-phy@11c00000 { +@@ -467,9 +468,9 @@ + usb_phy: t-phy@11e10000 { + compatible = "mediatek,mt7986-tphy", + "mediatek,generic-tphy-v2"; ++ ranges = <0 0 0x11e10000 0x1700>; + #address-cells = <1>; + #size-cells = <1>; +- ranges = <0 0 0x11e10000 0x1700>; + status = "disabled"; + + u2port0: usb-phy@0 { +@@ -497,11 +498,11 @@ + }; + + ethsys: syscon@15000000 { +- #address-cells = <1>; +- #size-cells = <1>; + compatible = "mediatek,mt7986-ethsys", + "syscon"; + reg = <0 0x15000000 0 0x1000>; ++ #address-cells = <1>; ++ #size-cells = <1>; + #clock-cells = <1>; + #reset-cells = <1>; + }; +@@ -578,26 +579,26 @@ + <&topckgen CLK_TOP_SGM_325M_SEL>; + assigned-clock-parents = <&apmixedsys CLK_APMIXED_NET2PLL>, + <&apmixedsys CLK_APMIXED_SGMPLL>; ++ #reset-cells = <1>; ++ #address-cells = <1>; ++ #size-cells = <0>; + mediatek,ethsys = <ðsys>; + mediatek,sgmiisys = <&sgmiisys0>, <&sgmiisys1>; + mediatek,wed-pcie = <&wed_pcie>; + mediatek,wed = <&wed0>, <&wed1>; +- #reset-cells = <1>; +- #address-cells = <1>; +- #size-cells = <0>; + status = "disabled"; + }; + + wifi: wifi@18000000 { + compatible = "mediatek,mt7986-wmac"; ++ reg = <0 0x18000000 0 0x1000000>, ++ <0 0x10003000 0 0x1000>, ++ <0 0x11d10000 0 0x1000>; + resets = <&watchdog MT7986_TOPRGU_CONSYS_SW_RST>; + reset-names = "consys"; + clocks = <&topckgen CLK_TOP_CONN_MCUSYS_SEL>, + <&topckgen CLK_TOP_AP2CNN_HOST_SEL>; + clock-names = "mcu", "ap2conn"; +- reg = <0 0x18000000 0 0x1000000>, +- <0 0x10003000 0 0x1000>, +- <0 0x11d10000 0 0x1000>; + interrupts = , + , + , +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-mediatek-mt8183-add-power-domains-properit.patch b/queue-6.8/arm64-dts-mediatek-mt8183-add-power-domains-properit.patch new file mode 100644 index 00000000000..0d151133f39 --- /dev/null +++ b/queue-6.8/arm64-dts-mediatek-mt8183-add-power-domains-properit.patch @@ -0,0 +1,39 @@ +From a8bcd29ee1cf822c90b2d39ef90188eaeb2edc7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 17:11:21 +0800 +Subject: arm64: dts: mediatek: mt8183: Add power-domains properity to mfgcfg + +From: Ikjoon Jang + +[ Upstream commit 1781f2c461804c0123f59afc7350e520a88edffb ] + +mfgcfg clock is under MFG_ASYNC power domain. + +Fixes: e526c9bc11f8 ("arm64: dts: Add Mediatek SoC MT8183 and evaluation board dts and Makefile") +Fixes: 37fb78b9aeb7 ("arm64: dts: mediatek: Add mt8183 power domains controller") +Signed-off-by: Weiyi Lu +Signed-off-by: Ikjoon Jang +Reviewed-by: Enric Balletbo i Serra +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20240223091122.2430037-1-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8183.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183.dtsi b/arch/arm64/boot/dts/mediatek/mt8183.dtsi +index 920ee415ef5fb..e1767a4e38f3a 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi +@@ -1628,6 +1628,7 @@ + compatible = "mediatek,mt8183-mfgcfg", "syscon"; + reg = <0 0x13000000 0 0x1000>; + #clock-cells = <1>; ++ power-domains = <&spm MT8183_POWER_DOMAIN_MFG_ASYNC>; + }; + + gpu: gpu@13040000 { +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-mediatek-mt8183-kukui-use-default-min-volt.patch b/queue-6.8/arm64-dts-mediatek-mt8183-kukui-use-default-min-volt.patch new file mode 100644 index 00000000000..078f4be29b8 --- /dev/null +++ b/queue-6.8/arm64-dts-mediatek-mt8183-kukui-use-default-min-volt.patch @@ -0,0 +1,40 @@ +From cb415c2fdcd42c122d1c6e9d3d681c6de6005d7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 19:16:04 +0800 +Subject: arm64: dts: mediatek: mt8183-kukui: Use default min voltage for + MT6358 + +From: Pin-yen Lin + +[ Upstream commit 296118a8dc297de47d9b3a364b9743f8446bd612 ] + +The requested voltage could be lower than the minimum voltage on the +GPU OPP table when the MTK Smart Voltage Scaling (SVS) driver is +enabled, so removing the definition in mt8183-kukui to use the default +minimum voltage (500000 uV) defined in mt6358.dtsi. + +Fixes: 31c6732da9d5 ("arm64: dts: mediatek: mt8183-kukui: Override vgpu/vsram_gpu constraints") +Signed-off-by: Pin-yen Lin +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240315111621.2263159-4-treapking@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi +index 90c5ad917a9ba..41aef6c3edfc5 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi +@@ -433,7 +433,6 @@ + }; + + &mt6358_vgpu_reg { +- regulator-min-microvolt = <625000>; + regulator-max-microvolt = <900000>; + + regulator-coupled-with = <&mt6358_vsram_gpu_reg>; +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-mediatek-mt8192-add-missing-gce-client-reg.patch b/queue-6.8/arm64-dts-mediatek-mt8192-add-missing-gce-client-reg.patch new file mode 100644 index 00000000000..840ff501c3f --- /dev/null +++ b/queue-6.8/arm64-dts-mediatek-mt8192-add-missing-gce-client-reg.patch @@ -0,0 +1,43 @@ +From 25fef1b38a8b47c37f93bd3ba1d36df4fd7f97f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 14:44:28 -0500 +Subject: arm64: dts: mediatek: mt8192: Add missing gce-client-reg to mutex +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 00bcc8810d9dd69d3899a4189e2f3964f263a600 ] + +Add the missing mediatek,gce-client-reg property to the mutex node to +allow it to use the GCE. This prevents the "can't parse gce-client-reg +property" error from being printed and should result in better +performance. + +Fixes: b4b75bac952b ("arm64: dts: mt8192: Add display nodes") +Suggested-by: AngeloGioacchino Del Regno +Signed-off-by: Nícolas F. R. A. Prado +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240229-gce-client-reg-add-missing-mt8192-95-v1-1-b12c233a8a33@collabora.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8192.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +index 0e432636b8c23..eea8d141f93cf 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +@@ -1456,6 +1456,7 @@ + reg = <0 0x14001000 0 0x1000>; + interrupts = ; + clocks = <&mmsys CLK_MM_DISP_MUTEX0>; ++ mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x1000 0x1000>; + mediatek,gce-events = , + ; + power-domains = <&spm MT8192_POWER_DOMAIN_DISP>; +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-mediatek-mt8192-asurada-update-min-voltage.patch b/queue-6.8/arm64-dts-mediatek-mt8192-asurada-update-min-voltage.patch new file mode 100644 index 00000000000..fdb84325e50 --- /dev/null +++ b/queue-6.8/arm64-dts-mediatek-mt8192-asurada-update-min-voltage.patch @@ -0,0 +1,62 @@ +From ee103da190a5177c8ae4099339d49821b29b4e60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 19:16:02 +0800 +Subject: arm64: dts: mediatek: mt8192-asurada: Update min voltage constraint + for MT6315 + +From: Pin-yen Lin + +[ Upstream commit 374a7c6400e314458178255a63c37d6347845092 ] + +Update the minimum voltage from 300000 uV to 400000 uV so it matches +the MT6315 datasheet. + +Also update the minimum voltage for Vgpu regulator from 606250 uV to +400000 uV because the requested voltage could be lower than the minimum +voltage on the GPU OPP table when the MTK Smart Voltage Scaling (SVS) +driver is enabled. + +Fixes: 3183cb62b033 ("arm64: dts: mediatek: asurada: Add SPMI regulators") +Signed-off-by: Pin-yen Lin +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240315111621.2263159-2-treapking@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi b/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi +index d4dd5e8b2e1d3..f62b2498eb1c7 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi +@@ -1420,7 +1420,7 @@ + mt6315_6_vbuck1: vbuck1 { + regulator-compatible = "vbuck1"; + regulator-name = "Vbcpu"; +- regulator-min-microvolt = <300000>; ++ regulator-min-microvolt = <400000>; + regulator-max-microvolt = <1193750>; + regulator-enable-ramp-delay = <256>; + regulator-allowed-modes = <0 1 2>; +@@ -1430,7 +1430,7 @@ + mt6315_6_vbuck3: vbuck3 { + regulator-compatible = "vbuck3"; + regulator-name = "Vlcpu"; +- regulator-min-microvolt = <300000>; ++ regulator-min-microvolt = <400000>; + regulator-max-microvolt = <1193750>; + regulator-enable-ramp-delay = <256>; + regulator-allowed-modes = <0 1 2>; +@@ -1447,7 +1447,7 @@ + mt6315_7_vbuck1: vbuck1 { + regulator-compatible = "vbuck1"; + regulator-name = "Vgpu"; +- regulator-min-microvolt = <606250>; ++ regulator-min-microvolt = <400000>; + regulator-max-microvolt = <800000>; + regulator-enable-ramp-delay = <256>; + regulator-allowed-modes = <0 1 2>; +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-mediatek-mt8195-add-missing-gce-client-reg.patch b/queue-6.8/arm64-dts-mediatek-mt8195-add-missing-gce-client-reg.patch new file mode 100644 index 00000000000..d70b5fee459 --- /dev/null +++ b/queue-6.8/arm64-dts-mediatek-mt8195-add-missing-gce-client-reg.patch @@ -0,0 +1,59 @@ +From e8e2e6e2cf6f478b495a8283d48aced573602e4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 14:44:29 -0500 +Subject: arm64: dts: mediatek: mt8195: Add missing gce-client-reg to + vpp/vdosys +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 96b0c1528ef41fe754f5d1378b1db6c098a2e33f ] + +Add the missing mediatek,gce-client-reg property to the vppsys and +vdosys nodes to allow them to use the GCE. This prevents the "can't +parse gce-client-reg property" error from being printed and should +result in better performance. + +Fixes: 6aa5b46d1755 ("arm64: dts: mt8195: Add vdosys and vppsys clock nodes") +Suggested-by: AngeloGioacchino Del Regno +Signed-off-by: Nícolas F. R. A. Prado +Link: https://lore.kernel.org/r/20240229-gce-client-reg-add-missing-mt8192-95-v1-2-b12c233a8a33@collabora.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8195.dtsi | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +index b9101662ce40d..775aeeb6ebd37 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +@@ -1998,6 +1998,7 @@ + compatible = "mediatek,mt8195-vppsys0", "syscon"; + reg = <0 0x14000000 0 0x1000>; + #clock-cells = <1>; ++ mediatek,gce-client-reg = <&gce1 SUBSYS_1400XXXX 0 0x1000>; + }; + + dma-controller@14001000 { +@@ -2221,6 +2222,7 @@ + compatible = "mediatek,mt8195-vppsys1", "syscon"; + reg = <0 0x14f00000 0 0x1000>; + #clock-cells = <1>; ++ mediatek,gce-client-reg = <&gce1 SUBSYS_14f0XXXX 0 0x1000>; + }; + + mutex@14f01000 { +@@ -3050,6 +3052,7 @@ + reg = <0 0x1c01a000 0 0x1000>; + mboxes = <&gce0 0 CMDQ_THR_PRIO_4>; + #clock-cells = <1>; ++ mediatek,gce-client-reg = <&gce0 SUBSYS_1c01XXXX 0xa000 0x1000>; + }; + + +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-mediatek-mt8195-add-missing-gce-client-reg.patch-10049 b/queue-6.8/arm64-dts-mediatek-mt8195-add-missing-gce-client-reg.patch-10049 new file mode 100644 index 00000000000..371b4b24e1a --- /dev/null +++ b/queue-6.8/arm64-dts-mediatek-mt8195-add-missing-gce-client-reg.patch-10049 @@ -0,0 +1,42 @@ +From 86a8d1333c58eb0fd35f0005d4ffe00cab33ea8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 14:44:30 -0500 +Subject: arm64: dts: mediatek: mt8195: Add missing gce-client-reg to mutex +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 3b129949184a1251e6a42db714f6d68b75fabedd ] + +Add the missing mediatek,gce-client-reg property to the mutex node to +allow it to use the GCE. This prevents the "can't parse gce-client-reg +property" error from being printed and should result in better +performance. + +Fixes: b852ee68fd72 ("arm64: dts: mt8195: Add display node for vdosys0") +Suggested-by: AngeloGioacchino Del Regno +Signed-off-by: Nícolas F. R. A. Prado +Link: https://lore.kernel.org/r/20240229-gce-client-reg-add-missing-mt8192-95-v1-3-b12c233a8a33@collabora.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8195.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +index 775aeeb6ebd37..6cea6612e2feb 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +@@ -3234,6 +3234,7 @@ + interrupts = ; + power-domains = <&spm MT8195_POWER_DOMAIN_VDOSYS0>; + clocks = <&vdosys0 CLK_VDO0_DISP_MUTEX0>; ++ mediatek,gce-client-reg = <&gce0 SUBSYS_1c01XXXX 0x6000 0x1000>; + mediatek,gce-events = ; + }; + +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-mediatek-mt8195-add-missing-gce-client-reg.patch-16622 b/queue-6.8/arm64-dts-mediatek-mt8195-add-missing-gce-client-reg.patch-16622 new file mode 100644 index 00000000000..5cec95fd2f3 --- /dev/null +++ b/queue-6.8/arm64-dts-mediatek-mt8195-add-missing-gce-client-reg.patch-16622 @@ -0,0 +1,42 @@ +From 6fee3adb964a481969ec02210febeb1266bbf507 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 14:44:31 -0500 +Subject: arm64: dts: mediatek: mt8195: Add missing gce-client-reg to mutex1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 58f126296c3c52d02bf3fad1f68c331d718c4a9b ] + +Add the missing mediatek,gce-client-reg property to the mutex1 node to +allow it to use the GCE. This prevents the "can't parse gce-client-reg +property" error from being printed and should result in better +performance. + +Fixes: 92d2c23dc269 ("arm64: dts: mt8195: add display node for vdosys1") +Suggested-by: AngeloGioacchino Del Regno +Signed-off-by: Nícolas F. R. A. Prado +Link: https://lore.kernel.org/r/20240229-gce-client-reg-add-missing-mt8192-95-v1-4-b12c233a8a33@collabora.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8195.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +index 6cea6612e2feb..4dd7f755630ea 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +@@ -3305,6 +3305,7 @@ + power-domains = <&spm MT8195_POWER_DOMAIN_VDOSYS1>; + clocks = <&vdosys1 CLK_VDO1_DISP_MUTEX>; + clock-names = "vdo1_mutex"; ++ mediatek,gce-client-reg = <&gce0 SUBSYS_1c10XXXX 0x1000 0x1000>; + mediatek,gce-events = ; + }; + +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-mediatek-mt8195-cherry-update-min-voltage-.patch b/queue-6.8/arm64-dts-mediatek-mt8195-cherry-update-min-voltage-.patch new file mode 100644 index 00000000000..4ebf2a0e80f --- /dev/null +++ b/queue-6.8/arm64-dts-mediatek-mt8195-cherry-update-min-voltage-.patch @@ -0,0 +1,53 @@ +From af652a22179314bf41d1ed7b6f3f8b466a967b45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 19:16:03 +0800 +Subject: arm64: dts: mediatek: mt8195-cherry: Update min voltage constraint + for MT6315 + +From: Pin-yen Lin + +[ Upstream commit e9a6b8b5c61350535c7eb5ea9b2dde0d5745bd1b ] + +Update the minimum voltage from 300000 uV to 400000 uV so it matches +the MT6315 datasheet. + +Also update the minimum voltage for Vgpu regulator from 625000 uV to +400000 uV because the requested voltage could be lower than the minimum +voltage on the GPU OPP table when the MTK Smart Voltage Scaling (SVS) +driver is enabled. + +Fixes: 260c04d425eb ("arm64: dts: mediatek: cherry: Enable MT6315 regulators on SPMI bus") +Signed-off-by: Pin-yen Lin +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240315111621.2263159-3-treapking@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi b/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi +index 1f3a6755f1550..121dfd91da07b 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi +@@ -1245,7 +1245,7 @@ + mt6315_6_vbuck1: vbuck1 { + regulator-compatible = "vbuck1"; + regulator-name = "Vbcpu"; +- regulator-min-microvolt = <300000>; ++ regulator-min-microvolt = <400000>; + regulator-max-microvolt = <1193750>; + regulator-enable-ramp-delay = <256>; + regulator-ramp-delay = <6250>; +@@ -1263,7 +1263,7 @@ + mt6315_7_vbuck1: vbuck1 { + regulator-compatible = "vbuck1"; + regulator-name = "Vgpu"; +- regulator-min-microvolt = <625000>; ++ regulator-min-microvolt = <400000>; + regulator-max-microvolt = <1193750>; + regulator-enable-ramp-delay = <256>; + regulator-ramp-delay = <6250>; +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-qcom-fix-type-of-wdog-irqs-for-remoteprocs.patch b/queue-6.8/arm64-dts-qcom-fix-type-of-wdog-irqs-for-remoteprocs.patch new file mode 100644 index 00000000000..e6af41f6e16 --- /dev/null +++ b/queue-6.8/arm64-dts-qcom-fix-type-of-wdog-irqs-for-remoteprocs.patch @@ -0,0 +1,162 @@ +From bd3fc9e9b8c726fee1a4598c88723ee843ae63c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 15:33:27 +0100 +Subject: arm64: dts: qcom: Fix type of "wdog" IRQs for remoteprocs + +From: Luca Weiss + +[ Upstream commit f011688162ec4c492c12ee7cced74c097270baa2 ] + +The code in qcom_q6v5_init() requests the "wdog" IRQ as +IRQF_TRIGGER_RISING. If dt defines the interrupt type as LEVEL_HIGH then +the driver will have issues getting the IRQ again after probe deferral +with an error like: + + irq: type mismatch, failed to map hwirq-14 for interrupt-controller@b220000! + +Fix that by updating the devicetrees to use IRQ_TYPE_EDGE_RISING for +these interrupts, as is already used in most dt's. Also the driver was +already using the interrupts with that type. + +Fixes: 3658e411efcb ("arm64: dts: qcom: sc7280: Add ADSP node") +Fixes: df62402e5ff9 ("arm64: dts: qcom: sc7280: Add CDSP node") +Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") +Fixes: 8eb5287e8a42 ("arm64: dts: qcom: sm6350: Add CDSP nodes") +Fixes: efc33c969f23 ("arm64: dts: qcom: sm6350: Add ADSP nodes") +Fixes: fe6fd26aeddf ("arm64: dts: qcom: sm6375: Add ADSP&CDSP") +Fixes: 23a8903785b9 ("arm64: dts: qcom: sm8250: Add remoteprocs") +Signed-off-by: Luca Weiss +Link: https://lore.kernel.org/r/20240219-remoteproc-irqs-v1-1-c5aeb02334bd@fairphone.com +[bjorn: Added fixes references] +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7280.dtsi | 4 ++-- + arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 6 +++--- + arch/arm64/boot/dts/qcom/sm6350.dtsi | 4 ++-- + arch/arm64/boot/dts/qcom/sm6375.dtsi | 2 +- + arch/arm64/boot/dts/qcom/sm8250.dtsi | 6 +++--- + 5 files changed, 11 insertions(+), 11 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi +index 7dc2c37716e84..46545cd6964a9 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi +@@ -3650,7 +3650,7 @@ + compatible = "qcom,sc7280-adsp-pas"; + reg = <0 0x03700000 0 0x100>; + +- interrupts-extended = <&pdc 6 IRQ_TYPE_LEVEL_HIGH>, ++ interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>, + <&adsp_smp2p_in 0 IRQ_TYPE_EDGE_RISING>, + <&adsp_smp2p_in 1 IRQ_TYPE_EDGE_RISING>, + <&adsp_smp2p_in 2 IRQ_TYPE_EDGE_RISING>, +@@ -3887,7 +3887,7 @@ + compatible = "qcom,sc7280-cdsp-pas"; + reg = <0 0x0a300000 0 0x10000>; + +- interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_LEVEL_HIGH>, ++ interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>, + <&cdsp_smp2p_in 0 IRQ_TYPE_EDGE_RISING>, + <&cdsp_smp2p_in 1 IRQ_TYPE_EDGE_RISING>, + <&cdsp_smp2p_in 2 IRQ_TYPE_EDGE_RISING>, +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +index febf28356ff8b..e47c58e06c395 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +@@ -2635,7 +2635,7 @@ + compatible = "qcom,sc8280xp-adsp-pas"; + reg = <0 0x03000000 0 0x100>; + +- interrupts-extended = <&intc GIC_SPI 162 IRQ_TYPE_LEVEL_HIGH>, ++ interrupts-extended = <&intc GIC_SPI 162 IRQ_TYPE_EDGE_RISING>, + <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>, + <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>, + <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>, +@@ -4407,7 +4407,7 @@ + compatible = "qcom,sc8280xp-nsp0-pas"; + reg = <0 0x1b300000 0 0x100>; + +- interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_LEVEL_HIGH>, ++ interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>, + <&smp2p_nsp0_in 0 IRQ_TYPE_EDGE_RISING>, + <&smp2p_nsp0_in 1 IRQ_TYPE_EDGE_RISING>, + <&smp2p_nsp0_in 2 IRQ_TYPE_EDGE_RISING>, +@@ -4538,7 +4538,7 @@ + compatible = "qcom,sc8280xp-nsp1-pas"; + reg = <0 0x21300000 0 0x100>; + +- interrupts-extended = <&intc GIC_SPI 887 IRQ_TYPE_LEVEL_HIGH>, ++ interrupts-extended = <&intc GIC_SPI 887 IRQ_TYPE_EDGE_RISING>, + <&smp2p_nsp1_in 0 IRQ_TYPE_EDGE_RISING>, + <&smp2p_nsp1_in 1 IRQ_TYPE_EDGE_RISING>, + <&smp2p_nsp1_in 2 IRQ_TYPE_EDGE_RISING>, +diff --git a/arch/arm64/boot/dts/qcom/sm6350.dtsi b/arch/arm64/boot/dts/qcom/sm6350.dtsi +index 43cffe8e1247e..7532107580aee 100644 +--- a/arch/arm64/boot/dts/qcom/sm6350.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm6350.dtsi +@@ -1249,7 +1249,7 @@ + compatible = "qcom,sm6350-adsp-pas"; + reg = <0 0x03000000 0 0x100>; + +- interrupts-extended = <&pdc 6 IRQ_TYPE_LEVEL_HIGH>, ++ interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>, + <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>, + <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>, + <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>, +@@ -1509,7 +1509,7 @@ + compatible = "qcom,sm6350-cdsp-pas"; + reg = <0 0x08300000 0 0x10000>; + +- interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_LEVEL_HIGH>, ++ interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>, + <&smp2p_cdsp_in 0 IRQ_TYPE_EDGE_RISING>, + <&smp2p_cdsp_in 1 IRQ_TYPE_EDGE_RISING>, + <&smp2p_cdsp_in 2 IRQ_TYPE_EDGE_RISING>, +diff --git a/arch/arm64/boot/dts/qcom/sm6375.dtsi b/arch/arm64/boot/dts/qcom/sm6375.dtsi +index 7ac8bf26dda3a..a74472ac6186d 100644 +--- a/arch/arm64/boot/dts/qcom/sm6375.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm6375.dtsi +@@ -1559,7 +1559,7 @@ + compatible = "qcom,sm6375-adsp-pas"; + reg = <0 0x0a400000 0 0x100>; + +- interrupts-extended = <&intc GIC_SPI 282 IRQ_TYPE_LEVEL_HIGH>, ++ interrupts-extended = <&intc GIC_SPI 282 IRQ_TYPE_EDGE_RISING>, + <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>, + <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>, + <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>, +diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi +index 760501c1301a6..b07a3bad6eb96 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi +@@ -3025,7 +3025,7 @@ + compatible = "qcom,sm8250-slpi-pas"; + reg = <0 0x05c00000 0 0x4000>; + +- interrupts-extended = <&pdc 9 IRQ_TYPE_LEVEL_HIGH>, ++ interrupts-extended = <&pdc 9 IRQ_TYPE_EDGE_RISING>, + <&smp2p_slpi_in 0 IRQ_TYPE_EDGE_RISING>, + <&smp2p_slpi_in 1 IRQ_TYPE_EDGE_RISING>, + <&smp2p_slpi_in 2 IRQ_TYPE_EDGE_RISING>, +@@ -3729,7 +3729,7 @@ + compatible = "qcom,sm8250-cdsp-pas"; + reg = <0 0x08300000 0 0x10000>; + +- interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_LEVEL_HIGH>, ++ interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>, + <&smp2p_cdsp_in 0 IRQ_TYPE_EDGE_RISING>, + <&smp2p_cdsp_in 1 IRQ_TYPE_EDGE_RISING>, + <&smp2p_cdsp_in 2 IRQ_TYPE_EDGE_RISING>, +@@ -5887,7 +5887,7 @@ + compatible = "qcom,sm8250-adsp-pas"; + reg = <0 0x17300000 0 0x100>; + +- interrupts-extended = <&pdc 6 IRQ_TYPE_LEVEL_HIGH>, ++ interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>, + <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>, + <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>, + <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>, +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-qcom-sc8180x-fix-ss_phy_irq-for-secondary-.patch b/queue-6.8/arm64-dts-qcom-sc8180x-fix-ss_phy_irq-for-secondary-.patch new file mode 100644 index 00000000000..75f0b56936d --- /dev/null +++ b/queue-6.8/arm64-dts-qcom-sc8180x-fix-ss_phy_irq-for-secondary-.patch @@ -0,0 +1,73 @@ +From be72ed4f2e4940b3bd1dc11354730b39260119c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 03:21:57 +0100 +Subject: arm64: dts: qcom: sc8180x: Fix ss_phy_irq for secondary USB + controller + +From: Maximilian Luz + +[ Upstream commit ecda8309098402f878c96184f29a1b7ec682d772 ] + +The ACPI DSDT of the Surface Pro X (SQ2) specifies the interrupts for +the secondary UBS controller as + + Name (_CRS, ResourceTemplate () + { + Interrupt (ResourceConsumer, Level, ActiveHigh, Shared, ,, ) + { + 0x000000AA, + } + Interrupt (ResourceConsumer, Level, ActiveHigh, SharedAndWake, ,, ) + { + 0x000000A7, // hs_phy_irq: &intc GIC_SPI 136 + } + Interrupt (ResourceConsumer, Level, ActiveHigh, SharedAndWake, ,, ) + { + 0x00000228, // ss_phy_irq: &pdc 40 + } + Interrupt (ResourceConsumer, Edge, ActiveHigh, SharedAndWake, ,, ) + { + 0x0000020A, // dm_hs_phy_irq: &pdc 10 + } + Interrupt (ResourceConsumer, Edge, ActiveHigh, SharedAndWake, ,, ) + { + 0x0000020B, // dp_hs_phy_irq: &pdc 11 + } + }) + +Generally, the interrupts above 0x200 map to the PDC interrupts (as used +in the devicetree) as ACPI_NUMBER - 0x200. Note that this lines up with +dm_hs_phy_irq and dp_hs_phy_irq (as well as the interrupts for the +primary USB controller). + +Based on the snippet above, ss_phy_irq should therefore be PDC 40 (= +0x28) and not PDC 7. The latter is according to ACPI instead used as +ss_phy_irq for port 0 of the multiport USB controller). Fix this by +setting ss_phy_irq to '&pdc 40'. + +Fixes: b080f53a8f44 ("arm64: dts: qcom: sc8180x: Add remoteprocs, wifi and usb nodes") +Signed-off-by: Maximilian Luz +Reviewed-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20240328022224.336938-1-luzmaximilian@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8180x.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8180x.dtsi b/arch/arm64/boot/dts/qcom/sc8180x.dtsi +index c0dd44f146748..b481c15b255ce 100644 +--- a/arch/arm64/boot/dts/qcom/sc8180x.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8180x.dtsi +@@ -2641,7 +2641,7 @@ + resets = <&gcc GCC_USB30_SEC_BCR>; + power-domains = <&gcc USB30_SEC_GDSC>; + interrupts-extended = <&intc GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>, +- <&pdc 7 IRQ_TYPE_LEVEL_HIGH>, ++ <&pdc 40 IRQ_TYPE_LEVEL_HIGH>, + <&pdc 10 IRQ_TYPE_EDGE_BOTH>, + <&pdc 11 IRQ_TYPE_EDGE_BOTH>; + interrupt-names = "hs_phy_irq", "ss_phy_irq", +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-qcom-x1e80100-fix-the-compatible-for-clust.patch b/queue-6.8/arm64-dts-qcom-x1e80100-fix-the-compatible-for-clust.patch new file mode 100644 index 00000000000..5900d5e5f28 --- /dev/null +++ b/queue-6.8/arm64-dts-qcom-x1e80100-fix-the-compatible-for-clust.patch @@ -0,0 +1,49 @@ +From 0ee59db75578b49ad89feeb99b23d2c7cd779d12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Mar 2024 18:59:18 +0530 +Subject: arm64: dts: qcom: x1e80100: Fix the compatible for cluster idle + states + +From: Rajendra Nayak + +[ Upstream commit cb939b9b35426852896790aba2f18f46df34e596 ] + +The compatible's for the cluster/domain idle states of x1e80100 +are wrong, fix it. + +Fixes: af16b00578a7 ("arm64: dts: qcom: Add base X1E80100 dtsi and the QCP dts") +Signed-off-by: Rajendra Nayak +Reviewed-by: Abel Vesa +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240317132918.1068817-1-quic_rjendra@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/x1e80100.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/x1e80100.dtsi b/arch/arm64/boot/dts/qcom/x1e80100.dtsi +index be1285d9919e0..5ba7924aa4355 100644 +--- a/arch/arm64/boot/dts/qcom/x1e80100.dtsi ++++ b/arch/arm64/boot/dts/qcom/x1e80100.dtsi +@@ -278,7 +278,7 @@ + + domain-idle-states { + CLUSTER_CL4: cluster-sleep-0 { +- compatible = "arm,idle-state"; ++ compatible = "domain-idle-state"; + idle-state-name = "l2-ret"; + arm,psci-suspend-param = <0x01000044>; + entry-latency-us = <350>; +@@ -287,7 +287,7 @@ + }; + + CLUSTER_CL5: cluster-sleep-1 { +- compatible = "arm,idle-state"; ++ compatible = "domain-idle-state"; + idle-state-name = "ret-pll-off"; + arm,psci-suspend-param = <0x01000054>; + entry-latency-us = <2200>; +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-rockchip-enable-internal-pull-up-on-pcie_w.patch b/queue-6.8/arm64-dts-rockchip-enable-internal-pull-up-on-pcie_w.patch new file mode 100644 index 00000000000..f0c64a359c2 --- /dev/null +++ b/queue-6.8/arm64-dts-rockchip-enable-internal-pull-up-on-pcie_w.patch @@ -0,0 +1,44 @@ +From ddb49430e77bb4b8369bbbabed3b6b48f654d9c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 16:46:08 +0100 +Subject: arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for + RK3399 Puma + +From: Quentin Schulz + +[ Upstream commit 945a7c8570916650a415757d15d83e0fa856a686 ] + +The PCIE_WAKE# has a diode used as a level-shifter, and is used as an +input pin. While the SoC default is to enable the pull-up, the core +rk3399 pinconf for this pin opted for pull-none. So as to not disturb +the behaviour of other boards which may rely on pull-none instead of +pull-up, set the needed pull-up only for RK3399 Puma. + +Fixes: 60fd9f72ce8a ("arm64: dts: rockchip: add Haikou baseboard with RK3399-Q7 SoM") +Signed-off-by: Quentin Schulz +Link: https://lore.kernel.org/r/20240308-puma-diode-pu-v2-2-309f83da110a@theobroma-systems.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +index a8102d1e31987..c0eb9f39c33e5 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +@@ -416,6 +416,11 @@ + gpio1830-supply = <&vcc_1v8>; + }; + ++&pcie_clkreqn_cpm { ++ rockchip,pins = ++ <2 RK_PD2 RK_FUNC_GPIO &pcfg_pull_up>; ++}; ++ + &pinctrl { + i2c8 { + i2c8_xfer_a: i2c8-xfer { +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-rockchip-enable-internal-pull-up-on-q7_usb.patch b/queue-6.8/arm64-dts-rockchip-enable-internal-pull-up-on-q7_usb.patch new file mode 100644 index 00000000000..96519426076 --- /dev/null +++ b/queue-6.8/arm64-dts-rockchip-enable-internal-pull-up-on-q7_usb.patch @@ -0,0 +1,40 @@ +From e863e64325ffc0e5085aba817333c59ed252e462 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 16:46:07 +0100 +Subject: arm64: dts: rockchip: enable internal pull-up on Q7_USB_ID for RK3399 + Puma + +From: Quentin Schulz + +[ Upstream commit e6b1168f37e3f86d9966276c5a3fff9eb0df3e5f ] + +The Q7_USB_ID has a diode used as a level-shifter, and is used as an +input pin. The SoC default for this pin is a pull-up, which is correct +but the pinconf in the introducing commit missed that, so let's fix this +oversight. + +Fixes: ed2c66a95c0c ("arm64: dts: rockchip: fix rk3399-puma-haikou USB OTG mode") +Signed-off-by: Quentin Schulz +Link: https://lore.kernel.org/r/20240308-puma-diode-pu-v2-1-309f83da110a@theobroma-systems.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +index c08e69391c015..d4324e57729b5 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +@@ -458,7 +458,7 @@ + usb3 { + usb3_id: usb3-id { + rockchip,pins = +- <1 RK_PC2 RK_FUNC_GPIO &pcfg_pull_none>; ++ <1 RK_PC2 RK_FUNC_GPIO &pcfg_pull_up>; + }; + }; + }; +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-rockchip-fix-alphabetical-ordering-rk3399-.patch b/queue-6.8/arm64-dts-rockchip-fix-alphabetical-ordering-rk3399-.patch new file mode 100644 index 00000000000..8e898b40ef9 --- /dev/null +++ b/queue-6.8/arm64-dts-rockchip-fix-alphabetical-ordering-rk3399-.patch @@ -0,0 +1,62 @@ +From d8505a7d73378c91ad8a149d82e355ee7ccd9a43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 09:52:43 +0100 +Subject: arm64: dts: rockchip: fix alphabetical ordering RK3399 puma + +From: Iskander Amara + +[ Upstream commit f0abb4b2c7acf3c3e4130dc3f54cd90cf2ae62bc ] + +Nodes overridden by their reference should be ordered alphabetically to +make it easier to read the DTS. pinctrl node is defined in the wrong +location so let's reorder it. + +Signed-off-by: Iskander Amara +Reviewed-by: Quentin Schulz +Link: https://lore.kernel.org/r/20240308085243.69903-2-iskander.amara@theobroma-systems.com +Signed-off-by: Heiko Stuebner +Stable-dep-of: 945a7c857091 ("arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +index d4324e57729b5..a8102d1e31987 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +@@ -416,15 +416,6 @@ + gpio1830-supply = <&vcc_1v8>; + }; + +-&pmu_io_domains { +- status = "okay"; +- pmu1830-supply = <&vcc_1v8>; +-}; +- +-&pwm2 { +- status = "okay"; +-}; +- + &pinctrl { + i2c8 { + i2c8_xfer_a: i2c8-xfer { +@@ -463,6 +454,15 @@ + }; + }; + ++&pmu_io_domains { ++ status = "okay"; ++ pmu1830-supply = <&vcc_1v8>; ++}; ++ ++&pwm2 { ++ status = "okay"; ++}; ++ + &sdhci { + /* + * Signal integrity isn't great at 200MHz but 100MHz has proven stable +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-rockchip-fix-the-i2c-address-of-es8316-on-.patch b/queue-6.8/arm64-dts-rockchip-fix-the-i2c-address-of-es8316-on-.patch new file mode 100644 index 00000000000..c1378257ec3 --- /dev/null +++ b/queue-6.8/arm64-dts-rockchip-fix-the-i2c-address-of-es8316-on-.patch @@ -0,0 +1,47 @@ +From 9141381d901fdea21b31899ebe5bfd2ccea065b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Mar 2024 19:28:33 +0800 +Subject: arm64: dts: rockchip: Fix the i2c address of es8316 on Cool Pi CM5 + +From: Andy Yan + +[ Upstream commit 64da060dd4eb625646970d7c96a16de617412ec5 ] + +According to the hardware design, the i2c address of audio codec es8316 +on Cool Pi CM5 is 0x10. + +This fix the read/write error like bellow: +es8316 7-0011: ASoC: error at soc_component_write_no_lock on es8316.7-0011 for register: [0x0000000c] -6 +es8316 7-0011: ASoC: error at soc_component_write_no_lock on es8316.7-0011 for register: [0x00000003] -6 +es8316 7-0011: ASoC: error at soc_component_read_no_lock on es8316.7-0011 for register: [0x00000016] -6 +es8316 7-0011: ASoC: error at soc_component_read_no_lock on es8316.7-0011 for register: [0x00000016] -6 + +Fixes: 791c154c3982 ("arm64: dts: rockchip: Add support for rk3588 based board Cool Pi CM5 EVB") +Signed-off-by: Andy Yan +Link: https://lore.kernel.org/r/20240324112833.2181961-1-andyshrk@163.com +[also adapted the node name to audio-codec@10] +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3588-coolpi-cm5.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3588-coolpi-cm5.dtsi b/arch/arm64/boot/dts/rockchip/rk3588-coolpi-cm5.dtsi +index cce1c8e835877..94ecb9b4f98f8 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588-coolpi-cm5.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3588-coolpi-cm5.dtsi +@@ -216,9 +216,9 @@ + pinctrl-0 = <&i2c7m0_xfer>; + status = "okay"; + +- es8316: audio-codec@11 { ++ es8316: audio-codec@10 { + compatible = "everest,es8316"; +- reg = <0x11>; ++ reg = <0x10>; + assigned-clocks = <&cru I2S0_8CH_MCLKOUT>; + assigned-clock-rates = <12288000>; + clocks = <&cru I2S0_8CH_MCLKOUT>; +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-rockchip-mark-system-power-controller-and-.patch b/queue-6.8/arm64-dts-rockchip-mark-system-power-controller-and-.patch new file mode 100644 index 00000000000..192e88b7d2c --- /dev/null +++ b/queue-6.8/arm64-dts-rockchip-mark-system-power-controller-and-.patch @@ -0,0 +1,47 @@ +From 5a8fd1f14906aef77e8044e1b695e5168a17c641 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Apr 2024 20:32:10 +0300 +Subject: arm64: dts: rockchip: mark system power controller and fix typo on + orangepi-5-plus + +From: Muhammed Efe Cetin + +[ Upstream commit 08cd20bdecd9cfde5c1aec6146fa22ca753efea1 ] + +Mark the PMIC as system power controller, so the board will shut-down +properly and fix the typo on rk806_dvs1_null pins property. + +Fixes: 236d225e1ee7 ("arm64: dts: rockchip: Add board device tree for rk3588-orangepi-5-plus") +Signed-off-by: Muhammed Efe Cetin +Reviewed-by: Dragan Simic +Link: https://lore.kernel.org/r/20240407173210.372585-1-efectn@6tel.net +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3588-orangepi-5-plus.dts | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3588-orangepi-5-plus.dts b/arch/arm64/boot/dts/rockchip/rk3588-orangepi-5-plus.dts +index 3e660ff6cd5ff..e74871491ef56 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588-orangepi-5-plus.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3588-orangepi-5-plus.dts +@@ -486,6 +486,7 @@ + pinctrl-0 = <&pmic_pins>, <&rk806_dvs1_null>, + <&rk806_dvs2_null>, <&rk806_dvs3_null>; + spi-max-frequency = <1000000>; ++ system-power-controller; + + vcc1-supply = <&vcc5v0_sys>; + vcc2-supply = <&vcc5v0_sys>; +@@ -507,7 +508,7 @@ + #gpio-cells = <2>; + + rk806_dvs1_null: dvs1-null-pins { +- pins = "gpio_pwrctrl2"; ++ pins = "gpio_pwrctrl1"; + function = "pin_fun0"; + }; + +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-rockchip-regulator-for-sd-needs-to-be-alwa.patch b/queue-6.8/arm64-dts-rockchip-regulator-for-sd-needs-to-be-alwa.patch new file mode 100644 index 00000000000..4df5623c3b5 --- /dev/null +++ b/queue-6.8/arm64-dts-rockchip-regulator-for-sd-needs-to-be-alwa.patch @@ -0,0 +1,43 @@ +From d38527c972d9a8f3748af528753b9b3730ddbecc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 15:32:18 +0100 +Subject: arm64: dts: rockchip: regulator for sd needs to be always on for + BPI-R2Pro + +From: Jose Ignacio Tornos Martinez + +[ Upstream commit 433d54818f64a2fe0562f8c04c7a81f562368515 ] + +With default dts configuration for BPI-R2Pro, the regulator for sd card is +powered off when reboot is commanded, and the only solution to detect the +sd card again, and therefore, allow rebooting from there, is to do a +hardware reset. + +Configure the regulator for sd to be always on for BPI-R2Pro in order to +avoid this issue. + +Fixes: f901aaadaa2a ("arm64: dts: rockchip: Add Bananapi R2 Pro") +Signed-off-by: Jose Ignacio Tornos Martinez +Link: https://lore.kernel.org/r/20240305143222.189413-1-jtornosm@redhat.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3568-bpi-r2-pro.dts | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-bpi-r2-pro.dts b/arch/arm64/boot/dts/rockchip/rk3568-bpi-r2-pro.dts +index 87c45d8be420f..dc5892d25c100 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-bpi-r2-pro.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3568-bpi-r2-pro.dts +@@ -416,6 +416,8 @@ + + vccio_sd: LDO_REG5 { + regulator-name = "vccio_sd"; ++ regulator-always-on; ++ regulator-boot-on; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <3300000>; + +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-rockchip-remove-unsupported-node-from-the-.patch b/queue-6.8/arm64-dts-rockchip-remove-unsupported-node-from-the-.patch new file mode 100644 index 00000000000..3a0b9b8d996 --- /dev/null +++ b/queue-6.8/arm64-dts-rockchip-remove-unsupported-node-from-the-.patch @@ -0,0 +1,54 @@ +From 83ed9e0f9ac9642987fdf1e41766635734d7321d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Apr 2024 00:20:56 +0200 +Subject: arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro + dts + +From: Dragan Simic + +[ Upstream commit 43853e843aa6c3d47ff2b0cce898318839483d05 ] + +Remove a redundant node from the Pine64 Pinebook Pro dts, which is intended +to provide a value for the delay in PCI Express enumeration, but that isn't +supported without additional out-of-tree kernel patches. + +There were already efforts to upstream those kernel patches, because they +reportedly make some PCI Express cards (such as LSI SAS HBAs) usable in +Pine64 RockPro64 (which is also based on the RK3399); otherwise, those PCI +Express cards fail to enumerate. However, providing the required background +and explanations proved to be a tough nut to crack, which is the reason why +those patches remain outside of the kernel mainline for now. + +If those out-of-tree patches eventually become upstreamed, the resulting +device-tree changes will almost surely belong to the RK3399 SoC dtsi. Also, +the above-mentioned unusable-without-out-of-tree-patches PCI Express devices +are in all fairness not usable in a Pinebook Pro without some extensive +hardware modifications, which is another reason to delete this redundant +node. When it comes to the Pinebook Pro, only M.2 NVMe SSDs can be installed +out of the box (using an additional passive adapter PCB sold separately by +Pine64), which reportedly works fine with no additional patches. + +Fixes: 5a65505a6988 ("arm64: dts: rockchip: Add initial support for Pinebook Pro") +Signed-off-by: Dragan Simic +Link: https://lore.kernel.org/r/0f82c3f97cb798d012270d13b34d8d15305ef293.1711923520.git.dsimic@manjaro.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts +index 054c6a4d1a45f..294eb2de263de 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts +@@ -779,7 +779,6 @@ + }; + + &pcie0 { +- bus-scan-delay-ms = <1000>; + ep-gpios = <&gpio2 RK_PD4 GPIO_ACTIVE_HIGH>; + num-lanes = <4>; + pinctrl-names = "default"; +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-rockchip-set-phy-address-of-mt7531-switch-.patch b/queue-6.8/arm64-dts-rockchip-set-phy-address-of-mt7531-switch-.patch new file mode 100644 index 00000000000..f27e4ee9575 --- /dev/null +++ b/queue-6.8/arm64-dts-rockchip-set-phy-address-of-mt7531-switch-.patch @@ -0,0 +1,49 @@ +From ae1525e66a33f0e0b1f71dc98f6571375db750f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 15:24:35 +0300 +Subject: arm64: dts: rockchip: set PHY address of MT7531 switch to 0x1f +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arınç ÜNAL + +[ Upstream commit a2ac2a1b02590a22a236c43c455f421cdede45f5 ] + +The MT7531 switch listens on PHY address 0x1f on an MDIO bus. I've got two +findings that support this. There's no bootstrapping option to change the +PHY address of the switch. The Linux driver hardcodes 0x1f as the PHY +address of the switch. So the reg property on the device tree is currently +ignored by the Linux driver. + +Therefore, describe the correct PHY address on Banana Pi BPI-R2 Pro that +has this switch. + +Signed-off-by: Arınç ÜNAL +Fixes: c1804463e5c6 ("arm64: dts: rockchip: Add mt7531 dsa node to BPI-R2-Pro board") +Link: https://lore.kernel.org/r/20240314-for-rockchip-mt7531-phy-address-v1-1-743b5873358f@arinc9.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3568-bpi-r2-pro.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-bpi-r2-pro.dts b/arch/arm64/boot/dts/rockchip/rk3568-bpi-r2-pro.dts +index f9127ddfbb7df..87c45d8be420f 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-bpi-r2-pro.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3568-bpi-r2-pro.dts +@@ -525,9 +525,9 @@ + #address-cells = <1>; + #size-cells = <0>; + +- switch@0 { ++ switch@1f { + compatible = "mediatek,mt7531"; +- reg = <0>; ++ reg = <0x1f>; + + ports { + #address-cells = <1>; +-- +2.43.0 + diff --git a/queue-6.8/ax25-fix-netdev-refcount-issue.patch b/queue-6.8/ax25-fix-netdev-refcount-issue.patch new file mode 100644 index 00000000000..fecf67720b7 --- /dev/null +++ b/queue-6.8/ax25-fix-netdev-refcount-issue.patch @@ -0,0 +1,95 @@ +From 92b31e453f00a5bac022e996564cd241564f5c46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Apr 2024 10:04:56 +0800 +Subject: ax25: Fix netdev refcount issue + +From: Duoming Zhou + +[ Upstream commit 467324bcfe1a31ec65d0cf4aa59421d6b7a7d52b ] + +The dev_tracker is added to ax25_cb in ax25_bind(). When the +ax25 device is detaching, the dev_tracker of ax25_cb should be +deallocated in ax25_kill_by_device() instead of the dev_tracker +of ax25_dev. The log reported by ref_tracker is shown below: + +[ 80.884935] ref_tracker: reference already released. +[ 80.885150] ref_tracker: allocated in: +[ 80.885349] ax25_dev_device_up+0x105/0x540 +[ 80.885730] ax25_device_event+0xa4/0x420 +[ 80.885730] notifier_call_chain+0xc9/0x1e0 +[ 80.885730] __dev_notify_flags+0x138/0x280 +[ 80.885730] dev_change_flags+0xd7/0x180 +[ 80.885730] dev_ifsioc+0x6a9/0xa30 +[ 80.885730] dev_ioctl+0x4d8/0xd90 +[ 80.885730] sock_do_ioctl+0x1c2/0x2d0 +[ 80.885730] sock_ioctl+0x38b/0x4f0 +[ 80.885730] __se_sys_ioctl+0xad/0xf0 +[ 80.885730] do_syscall_64+0xc4/0x1b0 +[ 80.885730] entry_SYSCALL_64_after_hwframe+0x67/0x6f +[ 80.885730] ref_tracker: freed in: +[ 80.885730] ax25_device_event+0x272/0x420 +[ 80.885730] notifier_call_chain+0xc9/0x1e0 +[ 80.885730] dev_close_many+0x272/0x370 +[ 80.885730] unregister_netdevice_many_notify+0x3b5/0x1180 +[ 80.885730] unregister_netdev+0xcf/0x120 +[ 80.885730] sixpack_close+0x11f/0x1b0 +[ 80.885730] tty_ldisc_kill+0xcb/0x190 +[ 80.885730] tty_ldisc_hangup+0x338/0x3d0 +[ 80.885730] __tty_hangup+0x504/0x740 +[ 80.885730] tty_release+0x46e/0xd80 +[ 80.885730] __fput+0x37f/0x770 +[ 80.885730] __x64_sys_close+0x7b/0xb0 +[ 80.885730] do_syscall_64+0xc4/0x1b0 +[ 80.885730] entry_SYSCALL_64_after_hwframe+0x67/0x6f +[ 80.893739] ------------[ cut here ]------------ +[ 80.894030] WARNING: CPU: 2 PID: 140 at lib/ref_tracker.c:255 ref_tracker_free+0x47b/0x6b0 +[ 80.894297] Modules linked in: +[ 80.894929] CPU: 2 PID: 140 Comm: ax25_conn_rel_6 Not tainted 6.9.0-rc4-g8cd26fd90c1a #11 +[ 80.895190] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qem4 +[ 80.895514] RIP: 0010:ref_tracker_free+0x47b/0x6b0 +[ 80.895808] Code: 83 c5 18 4c 89 eb 48 c1 eb 03 8a 04 13 84 c0 0f 85 df 01 00 00 41 83 7d 00 00 75 4b 4c 89 ff 9 +[ 80.896171] RSP: 0018:ffff888009edf8c0 EFLAGS: 00000286 +[ 80.896339] RAX: 1ffff1100141ac00 RBX: 1ffff1100149463b RCX: dffffc0000000000 +[ 80.896502] RDX: 0000000000000001 RSI: 0000000000000246 RDI: ffff88800a0d6518 +[ 80.896925] RBP: ffff888009edf9b0 R08: ffff88806d3288d3 R09: 1ffff1100da6511a +[ 80.897212] R10: dffffc0000000000 R11: ffffed100da6511b R12: ffff88800a4a31d4 +[ 80.897859] R13: ffff88800a4a31d8 R14: dffffc0000000000 R15: ffff88800a0d6518 +[ 80.898279] FS: 00007fd88b7fe700(0000) GS:ffff88806d300000(0000) knlGS:0000000000000000 +[ 80.899436] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 80.900181] CR2: 00007fd88c001d48 CR3: 000000000993e000 CR4: 00000000000006f0 +... +[ 80.935774] ref_tracker: sp%d@000000000bb9df3d has 1/1 users at +[ 80.935774] ax25_bind+0x424/0x4e0 +[ 80.935774] __sys_bind+0x1d9/0x270 +[ 80.935774] __x64_sys_bind+0x75/0x80 +[ 80.935774] do_syscall_64+0xc4/0x1b0 +[ 80.935774] entry_SYSCALL_64_after_hwframe+0x67/0x6f + +Change ax25_dev->dev_tracker to the dev_tracker of ax25_cb +in order to mitigate the bug. + +Fixes: feef318c855a ("ax25: fix UAF bugs of net_device caused by rebinding operation") +Signed-off-by: Duoming Zhou +Link: https://lore.kernel.org/r/20240419020456.29826-1-duoming@zju.edu.cn +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ax25/af_ax25.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c +index 558e158c98d01..9169efb2f43aa 100644 +--- a/net/ax25/af_ax25.c ++++ b/net/ax25/af_ax25.c +@@ -103,7 +103,7 @@ static void ax25_kill_by_device(struct net_device *dev) + s->ax25_dev = NULL; + if (sk->sk_socket) { + netdev_put(ax25_dev->dev, +- &ax25_dev->dev_tracker); ++ &s->dev_tracker); + ax25_dev_put(ax25_dev); + } + ax25_cb_del(s); +-- +2.43.0 + diff --git a/queue-6.8/block-fix-module-reference-leakage-from-bdev_open_by.patch b/queue-6.8/block-fix-module-reference-leakage-from-bdev_open_by.patch new file mode 100644 index 00000000000..f9e159bd1f3 --- /dev/null +++ b/queue-6.8/block-fix-module-reference-leakage-from-bdev_open_by.patch @@ -0,0 +1,40 @@ +From d56aef9a83f6b0107076d84f89d617f2747e63cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Apr 2024 17:09:25 +0800 +Subject: block: fix module reference leakage from bdev_open_by_dev error path + +From: Yu Kuai + +[ Upstream commit 9617cd6f24b294552a817f80f5225431ef67b540 ] + +At the time bdev_may_open() is called, module reference is grabbed +already, hence module reference should be released if bdev_may_open() +failed. + +This problem is found by code review. + +Fixes: ed5cc702d311 ("block: Add config option to not allow writing to mounted devices") +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20240406090930.2252838-22-yukuai1@huaweicloud.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + block/bdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/block/bdev.c b/block/bdev.c +index 2b0f97651a0a7..812872cdc0bef 100644 +--- a/block/bdev.c ++++ b/block/bdev.c +@@ -873,7 +873,7 @@ struct bdev_handle *bdev_open_by_dev(dev_t dev, blk_mode_t mode, void *holder, + goto abort_claiming; + ret = -EBUSY; + if (!bdev_may_open(bdev, mode)) +- goto abort_claiming; ++ goto put_module; + if (bdev_is_partition(bdev)) + ret = blkdev_get_part(bdev, mode); + else +-- +2.43.0 + diff --git a/queue-6.8/bluetooth-btusb-fix-triggering-coredump-implementati.patch b/queue-6.8/bluetooth-btusb-fix-triggering-coredump-implementati.patch new file mode 100644 index 00000000000..bb16f289bab --- /dev/null +++ b/queue-6.8/bluetooth-btusb-fix-triggering-coredump-implementati.patch @@ -0,0 +1,47 @@ +From e15f1e05763ce5c9acd6f7899081d958ebe395ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 16:11:49 +0800 +Subject: Bluetooth: btusb: Fix triggering coredump implementation for QCA + +From: Zijun Hu + +[ Upstream commit b23d98d46d2858dcc0fd016caff165cbdc24e70a ] + +btusb_coredump_qca() uses __hci_cmd_sync() to send a vendor-specific +command to trigger firmware coredump, but the command does not +have any event as its sync response, so it is not suitable to use +__hci_cmd_sync(), fixed by using __hci_cmd_send(). + +Fixes: 20981ce2d5a5 ("Bluetooth: btusb: Add WCN6855 devcoredump support") +Signed-off-by: Zijun Hu +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index f684108dc2f1c..58faada874f5c 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -3463,13 +3463,12 @@ static void btusb_dump_hdr_qca(struct hci_dev *hdev, struct sk_buff *skb) + + static void btusb_coredump_qca(struct hci_dev *hdev) + { ++ int err; + static const u8 param[] = { 0x26 }; +- struct sk_buff *skb; + +- skb = __hci_cmd_sync(hdev, 0xfc0c, 1, param, HCI_CMD_TIMEOUT); +- if (IS_ERR(skb)) +- bt_dev_err(hdev, "%s: triggle crash failed (%ld)", __func__, PTR_ERR(skb)); +- kfree_skb(skb); ++ err = __hci_cmd_send(hdev, 0xfc0c, 1, param); ++ if (err < 0) ++ bt_dev_err(hdev, "%s: triggle crash failed (%d)", __func__, err); + } + + /* +-- +2.43.0 + diff --git a/queue-6.8/bluetooth-btusb-mediatek-fix-double-free-of-skb-in-c.patch b/queue-6.8/bluetooth-btusb-mediatek-fix-double-free-of-skb-in-c.patch new file mode 100644 index 00000000000..8983aaeb141 --- /dev/null +++ b/queue-6.8/bluetooth-btusb-mediatek-fix-double-free-of-skb-in-c.patch @@ -0,0 +1,50 @@ +From e4ce86497b170cca7d3fb9bf5800eab80c1fbd6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Apr 2024 16:27:38 -0700 +Subject: Bluetooth: btusb: mediatek: Fix double free of skb in coredump + +From: Sean Wang + +[ Upstream commit 18bdb386a1a30e7a3d7732a98e45e69cf6b5710d ] + +hci_devcd_append() would free the skb on error so the caller don't +have to free it again otherwise it would cause the double free of skb. + +Fixes: 0b7015132878 ("Bluetooth: btusb: mediatek: add MediaTek devcoredump support") +Reported-by : Dan Carpenter +Signed-off-by: Sean Wang +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btmtk.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c +index ac8ebccd35075..812fd2a8f853e 100644 +--- a/drivers/bluetooth/btmtk.c ++++ b/drivers/bluetooth/btmtk.c +@@ -380,8 +380,10 @@ int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb) + switch (data->cd_info.state) { + case HCI_DEVCOREDUMP_IDLE: + err = hci_devcd_init(hdev, MTK_COREDUMP_SIZE); +- if (err < 0) ++ if (err < 0) { ++ kfree_skb(skb); + break; ++ } + data->cd_info.cnt = 0; + + /* It is supposed coredump can be done within 5 seconds */ +@@ -407,9 +409,6 @@ int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb) + break; + } + +- if (err < 0) +- kfree_skb(skb); +- + return err; + } + EXPORT_SYMBOL_GPL(btmtk_process_coredump); +-- +2.43.0 + diff --git a/queue-6.8/bluetooth-hci_conn-always-use-sk_timeo-as-conn_timeo.patch b/queue-6.8/bluetooth-hci_conn-always-use-sk_timeo-as-conn_timeo.patch new file mode 100644 index 00000000000..17fbf55d81a --- /dev/null +++ b/queue-6.8/bluetooth-hci_conn-always-use-sk_timeo-as-conn_timeo.patch @@ -0,0 +1,206 @@ +From cbb471d70e5f0c37b6d27c5f05c8ff02a0108b1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Feb 2024 15:26:20 -0500 +Subject: Bluetooth: hci_conn: Always use sk_timeo as conn_timeout + +From: Luiz Augusto von Dentz + +[ Upstream commit bf98feea5b65ced367a871cf35fc044dedbcfb85 ] + +This aligns the use socket sk_timeo as conn_timeout when initiating a +connection and then use it when scheduling the resulting HCI command, +that way the command is actually aborted synchronously thus not +blocking commands generated by hci_abort_conn_sync to inform the +controller the connection is to be aborted. + +Signed-off-by: Luiz Augusto von Dentz +Stable-dep-of: 2e7ed5f5e69b ("Bluetooth: hci_sync: Use advertised PHYs on hci_le_ext_create_conn_sync") +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci_core.h | 5 +++-- + include/net/bluetooth/l2cap.h | 2 +- + net/bluetooth/6lowpan.c | 2 +- + net/bluetooth/hci_conn.c | 8 +++++--- + net/bluetooth/hci_sync.c | 2 +- + net/bluetooth/l2cap_core.c | 10 ++++------ + net/bluetooth/l2cap_sock.c | 3 ++- + net/bluetooth/mgmt.c | 3 ++- + net/bluetooth/sco.c | 3 ++- + 9 files changed, 21 insertions(+), 17 deletions(-) + +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index ddbf287ee64fb..65da50f216069 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -1496,9 +1496,10 @@ struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst, + u16 conn_timeout, u8 role); + struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst, + u8 sec_level, u8 auth_type, +- enum conn_reasons conn_reason); ++ enum conn_reasons conn_reason, u16 timeout); + struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst, +- __u16 setting, struct bt_codec *codec); ++ __u16 setting, struct bt_codec *codec, ++ u16 timeout); + struct hci_conn *hci_bind_cis(struct hci_dev *hdev, bdaddr_t *dst, + __u8 dst_type, struct bt_iso_qos *qos); + struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst, +diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h +index 92d7197f9a563..a4278aa618ab1 100644 +--- a/include/net/bluetooth/l2cap.h ++++ b/include/net/bluetooth/l2cap.h +@@ -939,7 +939,7 @@ int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid); + struct l2cap_chan *l2cap_chan_create(void); + void l2cap_chan_close(struct l2cap_chan *chan, int reason); + int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, +- bdaddr_t *dst, u8 dst_type); ++ bdaddr_t *dst, u8 dst_type, u16 timeout); + int l2cap_chan_reconfigure(struct l2cap_chan *chan, __u16 mtu); + int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len); + void l2cap_chan_busy(struct l2cap_chan *chan, int busy); +diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c +index 4eb1b3ced0d27..715cbafbf6631 100644 +--- a/net/bluetooth/6lowpan.c ++++ b/net/bluetooth/6lowpan.c +@@ -892,7 +892,7 @@ static int bt_6lowpan_connect(bdaddr_t *addr, u8 dst_type) + chan->ops = &bt_6lowpan_chan_ops; + + err = l2cap_chan_connect(chan, cpu_to_le16(L2CAP_PSM_IPSP), 0, +- addr, dst_type); ++ addr, dst_type, L2CAP_CONN_TIMEOUT); + + BT_DBG("chan %p err %d", chan, err); + if (err < 0) +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 13481f08e47ee..47f117874479d 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -1607,7 +1607,7 @@ struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst, + + struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst, + u8 sec_level, u8 auth_type, +- enum conn_reasons conn_reason) ++ enum conn_reasons conn_reason, u16 timeout) + { + struct hci_conn *acl; + +@@ -1643,6 +1643,7 @@ struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst, + acl->sec_level = BT_SECURITY_LOW; + acl->pending_sec_level = sec_level; + acl->auth_type = auth_type; ++ acl->conn_timeout = timeout; + + err = hci_acl_create_connection_sync(hdev, acl); + if (err) { +@@ -1683,14 +1684,15 @@ static struct hci_link *hci_conn_link(struct hci_conn *parent, + } + + struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst, +- __u16 setting, struct bt_codec *codec) ++ __u16 setting, struct bt_codec *codec, ++ u16 timeout) + { + struct hci_conn *acl; + struct hci_conn *sco; + struct hci_link *link; + + acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING, +- CONN_REASON_SCO_CONNECT); ++ CONN_REASON_SCO_CONNECT, timeout); + if (IS_ERR(acl)) + return acl; + +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index e4f89b6e917e2..816fd9c38ae04 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -6607,7 +6607,7 @@ static int __hci_acl_create_connection_sync(struct hci_dev *hdev, void *data) + err = __hci_cmd_sync_status_sk(hdev, HCI_OP_CREATE_CONN, + sizeof(cp), &cp, + HCI_EV_CONN_COMPLETE, +- HCI_ACL_CONN_TIMEOUT, NULL); ++ conn->conn_timeout, NULL); + + if (err == -ETIMEDOUT) + hci_abort_conn_sync(hdev, conn, HCI_ERROR_LOCAL_HOST_TERM); +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index 706d2478ddb33..dc08974087936 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -6924,7 +6924,7 @@ static void l2cap_chan_by_pid(struct l2cap_chan *chan, void *data) + } + + int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, +- bdaddr_t *dst, u8 dst_type) ++ bdaddr_t *dst, u8 dst_type, u16 timeout) + { + struct l2cap_conn *conn; + struct hci_conn *hcon; +@@ -7017,19 +7017,17 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, + + if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) + hcon = hci_connect_le(hdev, dst, dst_type, false, +- chan->sec_level, +- HCI_LE_CONN_TIMEOUT, ++ chan->sec_level, timeout, + HCI_ROLE_SLAVE); + else + hcon = hci_connect_le_scan(hdev, dst, dst_type, +- chan->sec_level, +- HCI_LE_CONN_TIMEOUT, ++ chan->sec_level, timeout, + CONN_REASON_L2CAP_CHAN); + + } else { + u8 auth_type = l2cap_get_auth_type(chan); + hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type, +- CONN_REASON_L2CAP_CHAN); ++ CONN_REASON_L2CAP_CHAN, timeout); + } + + if (IS_ERR(hcon)) { +diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c +index 1eeea5d1306c2..e7d810b23082f 100644 +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -254,7 +254,8 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, + chan->mode = L2CAP_MODE_LE_FLOWCTL; + + err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid), +- &la.l2_bdaddr, la.l2_bdaddr_type); ++ &la.l2_bdaddr, la.l2_bdaddr_type, ++ sk->sk_sndtimeo); + if (err) + return err; + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 640d6d54ac6ba..0759975be6479 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -3436,7 +3436,8 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, + + if (cp->addr.type == BDADDR_BREDR) { + conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, +- auth_type, CONN_REASON_PAIR_DEVICE); ++ auth_type, CONN_REASON_PAIR_DEVICE, ++ HCI_ACL_CONN_TIMEOUT); + } else { + u8 addr_type = le_addr_type(cp->addr.type); + struct hci_conn_params *p; +diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c +index 8e4f39b8601cb..368e026f4d15c 100644 +--- a/net/bluetooth/sco.c ++++ b/net/bluetooth/sco.c +@@ -264,7 +264,8 @@ static int sco_connect(struct sock *sk) + } + + hcon = hci_connect_sco(hdev, type, &sco_pi(sk)->dst, +- sco_pi(sk)->setting, &sco_pi(sk)->codec); ++ sco_pi(sk)->setting, &sco_pi(sk)->codec, ++ sk->sk_sndtimeo); + if (IS_ERR(hcon)) { + err = PTR_ERR(hcon); + goto unlock; +-- +2.43.0 + diff --git a/queue-6.8/bluetooth-hci_conn-fix-uaf-write-in-__hci_acl_create.patch b/queue-6.8/bluetooth-hci_conn-fix-uaf-write-in-__hci_acl_create.patch new file mode 100644 index 00000000000..6f49612fdfe --- /dev/null +++ b/queue-6.8/bluetooth-hci_conn-fix-uaf-write-in-__hci_acl_create.patch @@ -0,0 +1,99 @@ +From bd459d1f5d7a86f0797f600d2d25d859e68f632d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Feb 2024 09:08:06 -0500 +Subject: Bluetooth: hci_conn: Fix UAF Write in + __hci_acl_create_connection_sync + +From: Luiz Augusto von Dentz + +[ Upstream commit 5f641f03abccddd1a37233ff1b8e774b9ff1f4e8 ] + +This fixes the UAF on __hci_acl_create_connection_sync caused by +connection abortion, it uses the same logic as to LE_LINK which uses +hci_cmd_sync_cancel to prevent the callback to run if the connection is +abort prematurely. + +Reported-by: syzbot+3f0a39be7a2035700868@syzkaller.appspotmail.com +Fixes: 45340097ce6e ("Bluetooth: hci_conn: Only do ACL connections sequentially") +Signed-off-by: Luiz Augusto von Dentz +Stable-dep-of: 2e7ed5f5e69b ("Bluetooth: hci_sync: Use advertised PHYs on hci_le_ext_create_conn_sync") +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci_sync.h | 3 +-- + net/bluetooth/hci_conn.c | 3 ++- + net/bluetooth/hci_sync.c | 16 ++++++++++------ + 3 files changed, 13 insertions(+), 9 deletions(-) + +diff --git a/include/net/bluetooth/hci_sync.h b/include/net/bluetooth/hci_sync.h +index 824660f8f30da..ed334c253ebcd 100644 +--- a/include/net/bluetooth/hci_sync.h ++++ b/include/net/bluetooth/hci_sync.h +@@ -139,5 +139,4 @@ int hci_le_big_terminate_sync(struct hci_dev *hdev, u8 handle); + + int hci_le_pa_terminate_sync(struct hci_dev *hdev, u16 handle); + +-int hci_acl_create_connection_sync(struct hci_dev *hdev, +- struct hci_conn *conn); ++int hci_connect_acl_sync(struct hci_dev *hdev, struct hci_conn *conn); +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 47f117874479d..3475ea55c2534 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -1645,7 +1645,7 @@ struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst, + acl->auth_type = auth_type; + acl->conn_timeout = timeout; + +- err = hci_acl_create_connection_sync(hdev, acl); ++ err = hci_connect_acl_sync(hdev, acl); + if (err) { + hci_conn_del(acl); + return ERR_PTR(err); +@@ -2942,6 +2942,7 @@ int hci_abort_conn(struct hci_conn *conn, u8 reason) + */ + if (conn->state == BT_CONNECT && hdev->req_status == HCI_REQ_PEND) { + switch (hci_skb_event(hdev->sent_cmd)) { ++ case HCI_EV_CONN_COMPLETE: + case HCI_EV_LE_CONN_COMPLETE: + case HCI_EV_LE_ENHANCED_CONN_COMPLETE: + case HCI_EVT_LE_CIS_ESTABLISHED: +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index 816fd9c38ae04..cffa61ecf234f 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -6552,13 +6552,18 @@ int hci_update_adv_data(struct hci_dev *hdev, u8 instance) + UINT_PTR(instance), NULL); + } + +-static int __hci_acl_create_connection_sync(struct hci_dev *hdev, void *data) ++static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data) + { +- struct hci_conn *conn = data; ++ struct hci_conn *conn; ++ u16 handle = PTR_UINT(data); + struct inquiry_entry *ie; + struct hci_cp_create_conn cp; + int err; + ++ conn = hci_conn_hash_lookup_handle(hdev, handle); ++ if (!conn) ++ return 0; ++ + /* Many controllers disallow HCI Create Connection while it is doing + * HCI Inquiry. So we cancel the Inquiry first before issuing HCI Create + * Connection. This may cause the MGMT discovering state to become false +@@ -6615,9 +6620,8 @@ static int __hci_acl_create_connection_sync(struct hci_dev *hdev, void *data) + return err; + } + +-int hci_acl_create_connection_sync(struct hci_dev *hdev, +- struct hci_conn *conn) ++int hci_connect_acl_sync(struct hci_dev *hdev, struct hci_conn *conn) + { +- return hci_cmd_sync_queue(hdev, __hci_acl_create_connection_sync, +- conn, NULL); ++ return hci_cmd_sync_queue(hdev, hci_acl_create_conn_sync, ++ UINT_PTR(conn->handle), NULL); + } +-- +2.43.0 + diff --git a/queue-6.8/bluetooth-hci_conn-only-do-acl-connections-sequentia.patch b/queue-6.8/bluetooth-hci_conn-only-do-acl-connections-sequentia.patch new file mode 100644 index 00000000000..3c549e8eb52 --- /dev/null +++ b/queue-6.8/bluetooth-hci_conn-only-do-acl-connections-sequentia.patch @@ -0,0 +1,253 @@ +From 31ecd17251f1a833822b9db8bdef73c48797a9df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Feb 2024 12:08:13 +0100 +Subject: Bluetooth: hci_conn: Only do ACL connections sequentially +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonas Dreßler + +[ Upstream commit 45340097ce6ea7e875674a5a7d24c95ecbc93ef9 ] + +Pretty much all bluetooth chipsets only support paging a single device at +a time, and if they don't reject a secondary "Create Connection" request +while another is still ongoing, they'll most likely serialize those +requests in the firware. + +With commit 4c67bc74f016 ("[Bluetooth] Support concurrent connect +requests") we started adding some serialization of our own in case the +adapter returns "Command Disallowed" HCI error. + +This commit was using the BT_CONNECT2 state for the serialization, this +state is also used for a few more things (most notably to indicate we're +waiting for an inquiry to cancel) and therefore a bit unreliable. Also +not all BT firwares would respond with "Command Disallowed" on too many +connection requests, some will also respond with "Hardware Failure" +(BCM4378), and others will error out later and send a "Connect Complete" +event with error "Rejected Limited Resources" (Marvell 88W8897). + +We can clean things up a bit and also make the serialization more reliable +by using our hci_sync machinery to always do "Create Connection" requests +in a sequential manner. + +This is very similar to what we're already doing for establishing LE +connections, and it works well there. + +Note that this causes a test failure in mgmt-tester (test "Pair Device +- Power off 1") because the hci_abort_conn_sync() changes the error we +return on timeout of the "Create Connection". We'll fix this on the +mgmt-tester side by adjusting the expected error for the test. + +Signed-off-by: Jonas Dreßler +Signed-off-by: Luiz Augusto von Dentz +Stable-dep-of: 2e7ed5f5e69b ("Bluetooth: hci_sync: Use advertised PHYs on hci_le_ext_create_conn_sync") +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci.h | 1 + + include/net/bluetooth/hci_sync.h | 3 ++ + net/bluetooth/hci_conn.c | 69 ++++--------------------------- + net/bluetooth/hci_sync.c | 70 ++++++++++++++++++++++++++++++++ + 4 files changed, 83 insertions(+), 60 deletions(-) + +diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h +index 04ec9c6e69e46..bfddb648fcc3e 100644 +--- a/include/net/bluetooth/hci.h ++++ b/include/net/bluetooth/hci.h +@@ -453,6 +453,7 @@ enum { + #define HCI_NCMD_TIMEOUT msecs_to_jiffies(4000) /* 4 seconds */ + #define HCI_ACL_TX_TIMEOUT msecs_to_jiffies(45000) /* 45 seconds */ + #define HCI_AUTO_OFF_TIMEOUT msecs_to_jiffies(2000) /* 2 seconds */ ++#define HCI_ACL_CONN_TIMEOUT msecs_to_jiffies(20000) /* 20 seconds */ + #define HCI_LE_CONN_TIMEOUT msecs_to_jiffies(20000) /* 20 seconds */ + #define HCI_LE_AUTOCONN_TIMEOUT msecs_to_jiffies(4000) /* 4 seconds */ + +diff --git a/include/net/bluetooth/hci_sync.h b/include/net/bluetooth/hci_sync.h +index e2582c2425449..824660f8f30da 100644 +--- a/include/net/bluetooth/hci_sync.h ++++ b/include/net/bluetooth/hci_sync.h +@@ -138,3 +138,6 @@ int hci_le_terminate_big_sync(struct hci_dev *hdev, u8 handle, u8 reason); + int hci_le_big_terminate_sync(struct hci_dev *hdev, u8 handle); + + int hci_le_pa_terminate_sync(struct hci_dev *hdev, u16 handle); ++ ++int hci_acl_create_connection_sync(struct hci_dev *hdev, ++ struct hci_conn *conn); +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index ba330114d38f7..d21e39ae67658 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -178,64 +178,6 @@ static void hci_conn_cleanup(struct hci_conn *conn) + hci_dev_put(hdev); + } + +-static void hci_acl_create_connection(struct hci_conn *conn) +-{ +- struct hci_dev *hdev = conn->hdev; +- struct inquiry_entry *ie; +- struct hci_cp_create_conn cp; +- +- BT_DBG("hcon %p", conn); +- +- /* Many controllers disallow HCI Create Connection while it is doing +- * HCI Inquiry. So we cancel the Inquiry first before issuing HCI Create +- * Connection. This may cause the MGMT discovering state to become false +- * without user space's request but it is okay since the MGMT Discovery +- * APIs do not promise that discovery should be done forever. Instead, +- * the user space monitors the status of MGMT discovering and it may +- * request for discovery again when this flag becomes false. +- */ +- if (test_bit(HCI_INQUIRY, &hdev->flags)) { +- /* Put this connection to "pending" state so that it will be +- * executed after the inquiry cancel command complete event. +- */ +- conn->state = BT_CONNECT2; +- hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL); +- return; +- } +- +- conn->state = BT_CONNECT; +- conn->out = true; +- conn->role = HCI_ROLE_MASTER; +- +- conn->attempt++; +- +- conn->link_policy = hdev->link_policy; +- +- memset(&cp, 0, sizeof(cp)); +- bacpy(&cp.bdaddr, &conn->dst); +- cp.pscan_rep_mode = 0x02; +- +- ie = hci_inquiry_cache_lookup(hdev, &conn->dst); +- if (ie) { +- if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) { +- cp.pscan_rep_mode = ie->data.pscan_rep_mode; +- cp.pscan_mode = ie->data.pscan_mode; +- cp.clock_offset = ie->data.clock_offset | +- cpu_to_le16(0x8000); +- } +- +- memcpy(conn->dev_class, ie->data.dev_class, 3); +- } +- +- cp.pkt_type = cpu_to_le16(conn->pkt_type); +- if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER)) +- cp.role_switch = 0x01; +- else +- cp.role_switch = 0x00; +- +- hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp); +-} +- + int hci_disconnect(struct hci_conn *conn, __u8 reason) + { + BT_DBG("hcon %p", conn); +@@ -1696,10 +1638,17 @@ struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst, + + acl->conn_reason = conn_reason; + if (acl->state == BT_OPEN || acl->state == BT_CLOSED) { ++ int err; ++ + acl->sec_level = BT_SECURITY_LOW; + acl->pending_sec_level = sec_level; + acl->auth_type = auth_type; +- hci_acl_create_connection(acl); ++ ++ err = hci_acl_create_connection_sync(hdev, acl); ++ if (err) { ++ hci_conn_del(acl); ++ return ERR_PTR(err); ++ } + } + + return acl; +@@ -2654,7 +2603,7 @@ void hci_conn_check_pending(struct hci_dev *hdev) + + conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2); + if (conn) +- hci_acl_create_connection(conn); ++ hci_acl_create_connection_sync(hdev, conn); + + hci_dev_unlock(hdev); + } +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index e1050d7d21a59..e4f89b6e917e2 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -6551,3 +6551,73 @@ int hci_update_adv_data(struct hci_dev *hdev, u8 instance) + return hci_cmd_sync_queue(hdev, _update_adv_data_sync, + UINT_PTR(instance), NULL); + } ++ ++static int __hci_acl_create_connection_sync(struct hci_dev *hdev, void *data) ++{ ++ struct hci_conn *conn = data; ++ struct inquiry_entry *ie; ++ struct hci_cp_create_conn cp; ++ int err; ++ ++ /* Many controllers disallow HCI Create Connection while it is doing ++ * HCI Inquiry. So we cancel the Inquiry first before issuing HCI Create ++ * Connection. This may cause the MGMT discovering state to become false ++ * without user space's request but it is okay since the MGMT Discovery ++ * APIs do not promise that discovery should be done forever. Instead, ++ * the user space monitors the status of MGMT discovering and it may ++ * request for discovery again when this flag becomes false. ++ */ ++ if (test_bit(HCI_INQUIRY, &hdev->flags)) { ++ err = __hci_cmd_sync_status(hdev, HCI_OP_INQUIRY_CANCEL, 0, ++ NULL, HCI_CMD_TIMEOUT); ++ if (err) ++ bt_dev_warn(hdev, "Failed to cancel inquiry %d", err); ++ } ++ ++ conn->state = BT_CONNECT; ++ conn->out = true; ++ conn->role = HCI_ROLE_MASTER; ++ ++ conn->attempt++; ++ ++ conn->link_policy = hdev->link_policy; ++ ++ memset(&cp, 0, sizeof(cp)); ++ bacpy(&cp.bdaddr, &conn->dst); ++ cp.pscan_rep_mode = 0x02; ++ ++ ie = hci_inquiry_cache_lookup(hdev, &conn->dst); ++ if (ie) { ++ if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) { ++ cp.pscan_rep_mode = ie->data.pscan_rep_mode; ++ cp.pscan_mode = ie->data.pscan_mode; ++ cp.clock_offset = ie->data.clock_offset | ++ cpu_to_le16(0x8000); ++ } ++ ++ memcpy(conn->dev_class, ie->data.dev_class, 3); ++ } ++ ++ cp.pkt_type = cpu_to_le16(conn->pkt_type); ++ if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER)) ++ cp.role_switch = 0x01; ++ else ++ cp.role_switch = 0x00; ++ ++ err = __hci_cmd_sync_status_sk(hdev, HCI_OP_CREATE_CONN, ++ sizeof(cp), &cp, ++ HCI_EV_CONN_COMPLETE, ++ HCI_ACL_CONN_TIMEOUT, NULL); ++ ++ if (err == -ETIMEDOUT) ++ hci_abort_conn_sync(hdev, conn, HCI_ERROR_LOCAL_HOST_TERM); ++ ++ return err; ++} ++ ++int hci_acl_create_connection_sync(struct hci_dev *hdev, ++ struct hci_conn *conn) ++{ ++ return hci_cmd_sync_queue(hdev, __hci_acl_create_connection_sync, ++ conn, NULL); ++} +-- +2.43.0 + diff --git a/queue-6.8/bluetooth-hci_event-fix-sending-hci_op_read_enc_key_.patch b/queue-6.8/bluetooth-hci_event-fix-sending-hci_op_read_enc_key_.patch new file mode 100644 index 00000000000..e0007c095b0 --- /dev/null +++ b/queue-6.8/bluetooth-hci_event-fix-sending-hci_op_read_enc_key_.patch @@ -0,0 +1,61 @@ +From 46d2d0b2134cb03fe0bfd27e2e0f875d84b4b800 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 13:41:01 -0400 +Subject: Bluetooth: hci_event: Fix sending HCI_OP_READ_ENC_KEY_SIZE + +From: Luiz Augusto von Dentz + +[ Upstream commit a9a830a676a9a93c5020f5c61236166931fa4266 ] + +The code shall always check if HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE has +been set before attempting to use HCI_OP_READ_ENC_KEY_SIZE. + +Fixes: c569242cd492 ("Bluetooth: hci_event: set the conn encrypted before conn establishes") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci_core.h | 4 ++++ + net/bluetooth/hci_event.c | 5 ++--- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index b6fb104ea1976..fe9e1524d30ff 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -1907,6 +1907,10 @@ void hci_conn_del_sysfs(struct hci_conn *conn); + #define privacy_mode_capable(dev) (use_ll_privacy(dev) && \ + (hdev->commands[39] & 0x04)) + ++#define read_key_size_capable(dev) \ ++ ((dev)->commands[20] & 0x10 && \ ++ !test_bit(HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE, &hdev->quirks)) ++ + /* Use enhanced synchronous connection if command is supported and its quirk + * has not been set. + */ +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 9450df4ee5b9b..9d1063c51ed29 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -3218,7 +3218,7 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, void *data, + if (key) { + set_bit(HCI_CONN_ENCRYPT, &conn->flags); + +- if (!(hdev->commands[20] & 0x10)) { ++ if (!read_key_size_capable(hdev)) { + conn->enc_key_size = HCI_LINK_KEY_SIZE; + } else { + cp.handle = cpu_to_le16(conn->handle); +@@ -3666,8 +3666,7 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data, + * controller really supports it. If it doesn't, assume + * the default size (16). + */ +- if (!(hdev->commands[20] & 0x10) || +- test_bit(HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE, &hdev->quirks)) { ++ if (!read_key_size_capable(hdev)) { + conn->enc_key_size = HCI_LINK_KEY_SIZE; + goto notify; + } +-- +2.43.0 + diff --git a/queue-6.8/bluetooth-hci_event-use-hci-error-defines-instead-of.patch b/queue-6.8/bluetooth-hci_event-use-hci-error-defines-instead-of.patch new file mode 100644 index 00000000000..6d53834f0f0 --- /dev/null +++ b/queue-6.8/bluetooth-hci_event-use-hci-error-defines-instead-of.patch @@ -0,0 +1,82 @@ +From 6f5c6ff7579e3364ed6b498ea486e0fedb14f67c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jan 2024 23:46:07 +0100 +Subject: Bluetooth: hci_event: Use HCI error defines instead of magic values +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonas Dreßler + +[ Upstream commit 79c0868ad65a8fc7cdfaa5f2b77a4b70d0b0ea16 ] + +We have error defines already, so let's use them. + +Signed-off-by: Jonas Dreßler +Signed-off-by: Luiz Augusto von Dentz +Stable-dep-of: 2e7ed5f5e69b ("Bluetooth: hci_sync: Use advertised PHYs on hci_le_ext_create_conn_sync") +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci.h | 2 ++ + net/bluetooth/hci_event.c | 8 ++++---- + 2 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h +index 35c5f75a3a5ee..04ec9c6e69e46 100644 +--- a/include/net/bluetooth/hci.h ++++ b/include/net/bluetooth/hci.h +@@ -668,6 +668,7 @@ enum { + #define HCI_ERROR_PIN_OR_KEY_MISSING 0x06 + #define HCI_ERROR_MEMORY_EXCEEDED 0x07 + #define HCI_ERROR_CONNECTION_TIMEOUT 0x08 ++#define HCI_ERROR_COMMAND_DISALLOWED 0x0c + #define HCI_ERROR_REJ_LIMITED_RESOURCES 0x0d + #define HCI_ERROR_REJ_BAD_ADDR 0x0f + #define HCI_ERROR_INVALID_PARAMETERS 0x12 +@@ -676,6 +677,7 @@ enum { + #define HCI_ERROR_REMOTE_POWER_OFF 0x15 + #define HCI_ERROR_LOCAL_HOST_TERM 0x16 + #define HCI_ERROR_PAIRING_NOT_ALLOWED 0x18 ++#define HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE 0x1e + #define HCI_ERROR_INVALID_LL_PARAMS 0x1e + #define HCI_ERROR_UNSPECIFIED 0x1f + #define HCI_ERROR_ADVERTISING_TIMEOUT 0x3c +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 3992e18f0babb..a59b5b4711a46 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -93,11 +93,11 @@ static u8 hci_cc_inquiry_cancel(struct hci_dev *hdev, void *data, + /* It is possible that we receive Inquiry Complete event right + * before we receive Inquiry Cancel Command Complete event, in + * which case the latter event should have status of Command +- * Disallowed (0x0c). This should not be treated as error, since ++ * Disallowed. This should not be treated as error, since + * we actually achieve what Inquiry Cancel wants to achieve, + * which is to end the last Inquiry session. + */ +- if (rp->status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) { ++ if (rp->status == HCI_ERROR_COMMAND_DISALLOWED && !test_bit(HCI_INQUIRY, &hdev->flags)) { + bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command"); + rp->status = 0x00; + } +@@ -2340,7 +2340,7 @@ static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status) + + if (status) { + if (conn && conn->state == BT_CONNECT) { +- if (status != 0x0c || conn->attempt > 2) { ++ if (status != HCI_ERROR_COMMAND_DISALLOWED || conn->attempt > 2) { + conn->state = BT_CLOSED; + hci_connect_cfm(conn, status); + hci_conn_del(conn); +@@ -6710,7 +6710,7 @@ static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev, void *data, + * transition into connected state and mark it as + * successful. + */ +- if (!conn->out && ev->status == 0x1a && ++ if (!conn->out && ev->status == HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE && + (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) + status = 0x00; + else +-- +2.43.0 + diff --git a/queue-6.8/bluetooth-hci_sync-add-helper-functions-to-manipulat.patch b/queue-6.8/bluetooth-hci_sync-add-helper-functions-to-manipulat.patch new file mode 100644 index 00000000000..27052023021 --- /dev/null +++ b/queue-6.8/bluetooth-hci_sync-add-helper-functions-to-manipulat.patch @@ -0,0 +1,211 @@ +From f69db00b6d27a97867299b28d25150fa5886e049 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Aug 2023 13:43:53 -0700 +Subject: Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync + queue + +From: Luiz Augusto von Dentz + +[ Upstream commit 505ea2b295929e7be2b4e1bc86ee31cb7862fb01 ] + +This adds functions to queue, dequeue and lookup into the cmd_sync +list. + +Signed-off-by: Luiz Augusto von Dentz +Stable-dep-of: 2e7ed5f5e69b ("Bluetooth: hci_sync: Use advertised PHYs on hci_le_ext_create_conn_sync") +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci_sync.h | 12 +++ + net/bluetooth/hci_sync.c | 132 +++++++++++++++++++++++++++++-- + 2 files changed, 136 insertions(+), 8 deletions(-) + +diff --git a/include/net/bluetooth/hci_sync.h b/include/net/bluetooth/hci_sync.h +index ed334c253ebcd..4ff4aa68ee196 100644 +--- a/include/net/bluetooth/hci_sync.h ++++ b/include/net/bluetooth/hci_sync.h +@@ -48,6 +48,18 @@ int hci_cmd_sync_submit(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, + void *data, hci_cmd_sync_work_destroy_t destroy); + int hci_cmd_sync_queue(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, + void *data, hci_cmd_sync_work_destroy_t destroy); ++struct hci_cmd_sync_work_entry * ++hci_cmd_sync_lookup_entry(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, ++ void *data, hci_cmd_sync_work_destroy_t destroy); ++int hci_cmd_sync_queue_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, ++ void *data, hci_cmd_sync_work_destroy_t destroy); ++void hci_cmd_sync_cancel_entry(struct hci_dev *hdev, ++ struct hci_cmd_sync_work_entry *entry); ++bool hci_cmd_sync_dequeue(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, ++ void *data, hci_cmd_sync_work_destroy_t destroy); ++bool hci_cmd_sync_dequeue_once(struct hci_dev *hdev, ++ hci_cmd_sync_work_func_t func, void *data, ++ hci_cmd_sync_work_destroy_t destroy); + + int hci_update_eir_sync(struct hci_dev *hdev); + int hci_update_class_sync(struct hci_dev *hdev); +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index cffa61ecf234f..22db2949eb3ef 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -570,6 +570,17 @@ void hci_cmd_sync_init(struct hci_dev *hdev) + INIT_DELAYED_WORK(&hdev->adv_instance_expire, adv_timeout_expire); + } + ++static void _hci_cmd_sync_cancel_entry(struct hci_dev *hdev, ++ struct hci_cmd_sync_work_entry *entry, ++ int err) ++{ ++ if (entry->destroy) ++ entry->destroy(hdev, entry->data, err); ++ ++ list_del(&entry->list); ++ kfree(entry); ++} ++ + void hci_cmd_sync_clear(struct hci_dev *hdev) + { + struct hci_cmd_sync_work_entry *entry, *tmp; +@@ -578,13 +589,8 @@ void hci_cmd_sync_clear(struct hci_dev *hdev) + cancel_work_sync(&hdev->reenable_adv_work); + + mutex_lock(&hdev->cmd_sync_work_lock); +- list_for_each_entry_safe(entry, tmp, &hdev->cmd_sync_work_list, list) { +- if (entry->destroy) +- entry->destroy(hdev, entry->data, -ECANCELED); +- +- list_del(&entry->list); +- kfree(entry); +- } ++ list_for_each_entry_safe(entry, tmp, &hdev->cmd_sync_work_list, list) ++ _hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED); + mutex_unlock(&hdev->cmd_sync_work_lock); + } + +@@ -676,6 +682,115 @@ int hci_cmd_sync_queue(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, + } + EXPORT_SYMBOL(hci_cmd_sync_queue); + ++static struct hci_cmd_sync_work_entry * ++_hci_cmd_sync_lookup_entry(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, ++ void *data, hci_cmd_sync_work_destroy_t destroy) ++{ ++ struct hci_cmd_sync_work_entry *entry, *tmp; ++ ++ list_for_each_entry_safe(entry, tmp, &hdev->cmd_sync_work_list, list) { ++ if (func && entry->func != func) ++ continue; ++ ++ if (data && entry->data != data) ++ continue; ++ ++ if (destroy && entry->destroy != destroy) ++ continue; ++ ++ return entry; ++ } ++ ++ return NULL; ++} ++ ++/* Queue HCI command entry once: ++ * ++ * - Lookup if an entry already exist and only if it doesn't creates a new entry ++ * and queue it. ++ */ ++int hci_cmd_sync_queue_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, ++ void *data, hci_cmd_sync_work_destroy_t destroy) ++{ ++ if (hci_cmd_sync_lookup_entry(hdev, func, data, destroy)) ++ return 0; ++ ++ return hci_cmd_sync_queue(hdev, func, data, destroy); ++} ++EXPORT_SYMBOL(hci_cmd_sync_queue_once); ++ ++/* Lookup HCI command entry: ++ * ++ * - Return first entry that matches by function callback or data or ++ * destroy callback. ++ */ ++struct hci_cmd_sync_work_entry * ++hci_cmd_sync_lookup_entry(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, ++ void *data, hci_cmd_sync_work_destroy_t destroy) ++{ ++ struct hci_cmd_sync_work_entry *entry; ++ ++ mutex_lock(&hdev->cmd_sync_work_lock); ++ entry = _hci_cmd_sync_lookup_entry(hdev, func, data, destroy); ++ mutex_unlock(&hdev->cmd_sync_work_lock); ++ ++ return entry; ++} ++EXPORT_SYMBOL(hci_cmd_sync_lookup_entry); ++ ++/* Cancel HCI command entry */ ++void hci_cmd_sync_cancel_entry(struct hci_dev *hdev, ++ struct hci_cmd_sync_work_entry *entry) ++{ ++ mutex_lock(&hdev->cmd_sync_work_lock); ++ _hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED); ++ mutex_unlock(&hdev->cmd_sync_work_lock); ++} ++EXPORT_SYMBOL(hci_cmd_sync_cancel_entry); ++ ++/* Dequeue one HCI command entry: ++ * ++ * - Lookup and cancel first entry that matches. ++ */ ++bool hci_cmd_sync_dequeue_once(struct hci_dev *hdev, ++ hci_cmd_sync_work_func_t func, ++ void *data, hci_cmd_sync_work_destroy_t destroy) ++{ ++ struct hci_cmd_sync_work_entry *entry; ++ ++ entry = hci_cmd_sync_lookup_entry(hdev, func, data, destroy); ++ if (!entry) ++ return false; ++ ++ hci_cmd_sync_cancel_entry(hdev, entry); ++ ++ return true; ++} ++EXPORT_SYMBOL(hci_cmd_sync_dequeue_once); ++ ++/* Dequeue HCI command entry: ++ * ++ * - Lookup and cancel any entry that matches by function callback or data or ++ * destroy callback. ++ */ ++bool hci_cmd_sync_dequeue(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, ++ void *data, hci_cmd_sync_work_destroy_t destroy) ++{ ++ struct hci_cmd_sync_work_entry *entry; ++ bool ret = false; ++ ++ mutex_lock(&hdev->cmd_sync_work_lock); ++ while ((entry = _hci_cmd_sync_lookup_entry(hdev, func, data, ++ destroy))) { ++ _hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED); ++ ret = true; ++ } ++ mutex_unlock(&hdev->cmd_sync_work_lock); ++ ++ return ret; ++} ++EXPORT_SYMBOL(hci_cmd_sync_dequeue); ++ + int hci_update_eir_sync(struct hci_dev *hdev) + { + struct hci_cp_write_eir cp; +@@ -2932,7 +3047,8 @@ int hci_update_passive_scan(struct hci_dev *hdev) + hci_dev_test_flag(hdev, HCI_UNREGISTER)) + return 0; + +- return hci_cmd_sync_queue(hdev, update_passive_scan_sync, NULL, NULL); ++ return hci_cmd_sync_queue_once(hdev, update_passive_scan_sync, NULL, ++ NULL); + } + + int hci_write_sc_support_sync(struct hci_dev *hdev, u8 val) +-- +2.43.0 + diff --git a/queue-6.8/bluetooth-hci_sync-attempt-to-dequeue-connection-att.patch b/queue-6.8/bluetooth-hci_sync-attempt-to-dequeue-connection-att.patch new file mode 100644 index 00000000000..87b2376a427 --- /dev/null +++ b/queue-6.8/bluetooth-hci_sync-attempt-to-dequeue-connection-att.patch @@ -0,0 +1,321 @@ +From b44f9f1acd6d9cfef9841729adbfc1c3759861f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 09:59:32 -0500 +Subject: Bluetooth: hci_sync: Attempt to dequeue connection attempt + +From: Luiz Augusto von Dentz + +[ Upstream commit 881559af5f5c545f6828e7c74d79813eb886d523 ] + +If connection is still queued/pending in the cmd_sync queue it means no +command has been generated and it should be safe to just dequeue the +callback when it is being aborted. + +Signed-off-by: Luiz Augusto von Dentz +Stable-dep-of: 2e7ed5f5e69b ("Bluetooth: hci_sync: Use advertised PHYs on hci_le_ext_create_conn_sync") +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci_core.h | 19 ++++++++ + include/net/bluetooth/hci_sync.h | 10 +++-- + net/bluetooth/hci_conn.c | 70 ++++++------------------------ + net/bluetooth/hci_sync.c | 74 ++++++++++++++++++++++++++++---- + 4 files changed, 102 insertions(+), 71 deletions(-) + +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index 65da50f216069..93e2b17b11267 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -1084,6 +1084,24 @@ static inline unsigned int hci_conn_count(struct hci_dev *hdev) + return c->acl_num + c->amp_num + c->sco_num + c->le_num + c->iso_num; + } + ++static inline bool hci_conn_valid(struct hci_dev *hdev, struct hci_conn *conn) ++{ ++ struct hci_conn_hash *h = &hdev->conn_hash; ++ struct hci_conn *c; ++ ++ rcu_read_lock(); ++ ++ list_for_each_entry_rcu(c, &h->list, list) { ++ if (c == conn) { ++ rcu_read_unlock(); ++ return true; ++ } ++ } ++ rcu_read_unlock(); ++ ++ return false; ++} ++ + static inline __u8 hci_conn_lookup_type(struct hci_dev *hdev, __u16 handle) + { + struct hci_conn_hash *h = &hdev->conn_hash; +@@ -1494,6 +1512,7 @@ struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst, + struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst, + u8 dst_type, bool dst_resolved, u8 sec_level, + u16 conn_timeout, u8 role); ++void hci_connect_le_scan_cleanup(struct hci_conn *conn, u8 status); + struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst, + u8 sec_level, u8 auth_type, + enum conn_reasons conn_reason, u16 timeout); +diff --git a/include/net/bluetooth/hci_sync.h b/include/net/bluetooth/hci_sync.h +index 4ff4aa68ee196..6a9d063e9f472 100644 +--- a/include/net/bluetooth/hci_sync.h ++++ b/include/net/bluetooth/hci_sync.h +@@ -48,11 +48,11 @@ int hci_cmd_sync_submit(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, + void *data, hci_cmd_sync_work_destroy_t destroy); + int hci_cmd_sync_queue(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, + void *data, hci_cmd_sync_work_destroy_t destroy); ++int hci_cmd_sync_queue_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, ++ void *data, hci_cmd_sync_work_destroy_t destroy); + struct hci_cmd_sync_work_entry * + hci_cmd_sync_lookup_entry(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, + void *data, hci_cmd_sync_work_destroy_t destroy); +-int hci_cmd_sync_queue_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, +- void *data, hci_cmd_sync_work_destroy_t destroy); + void hci_cmd_sync_cancel_entry(struct hci_dev *hdev, + struct hci_cmd_sync_work_entry *entry); + bool hci_cmd_sync_dequeue(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, +@@ -139,8 +139,6 @@ struct hci_conn; + + int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, u8 reason); + +-int hci_le_create_conn_sync(struct hci_dev *hdev, struct hci_conn *conn); +- + int hci_le_create_cis_sync(struct hci_dev *hdev); + + int hci_le_remove_cig_sync(struct hci_dev *hdev, u8 handle); +@@ -152,3 +150,7 @@ int hci_le_big_terminate_sync(struct hci_dev *hdev, u8 handle); + int hci_le_pa_terminate_sync(struct hci_dev *hdev, u16 handle); + + int hci_connect_acl_sync(struct hci_dev *hdev, struct hci_conn *conn); ++ ++int hci_connect_le_sync(struct hci_dev *hdev, struct hci_conn *conn); ++ ++int hci_cancel_connect_sync(struct hci_dev *hdev, struct hci_conn *conn); +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 3475ea55c2534..3a66d357b9323 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -68,7 +68,7 @@ static const struct sco_param esco_param_msbc[] = { + }; + + /* This function requires the caller holds hdev->lock */ +-static void hci_connect_le_scan_cleanup(struct hci_conn *conn, u8 status) ++void hci_connect_le_scan_cleanup(struct hci_conn *conn, u8 status) + { + struct hci_conn_params *params; + struct hci_dev *hdev = conn->hdev; +@@ -1124,6 +1124,9 @@ void hci_conn_del(struct hci_conn *conn) + * rest of hci_conn_del. + */ + hci_conn_cleanup(conn); ++ ++ /* Dequeue callbacks using connection pointer as data */ ++ hci_cmd_sync_dequeue(hdev, NULL, conn, NULL); + } + + struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type) +@@ -1258,53 +1261,6 @@ u8 hci_conn_set_handle(struct hci_conn *conn, u16 handle) + return 0; + } + +-static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err) +-{ +- struct hci_conn *conn; +- u16 handle = PTR_UINT(data); +- +- conn = hci_conn_hash_lookup_handle(hdev, handle); +- if (!conn) +- return; +- +- bt_dev_dbg(hdev, "err %d", err); +- +- hci_dev_lock(hdev); +- +- if (!err) { +- hci_connect_le_scan_cleanup(conn, 0x00); +- goto done; +- } +- +- /* Check if connection is still pending */ +- if (conn != hci_lookup_le_connect(hdev)) +- goto done; +- +- /* Flush to make sure we send create conn cancel command if needed */ +- flush_delayed_work(&conn->le_conn_timeout); +- hci_conn_failed(conn, bt_status(err)); +- +-done: +- hci_dev_unlock(hdev); +-} +- +-static int hci_connect_le_sync(struct hci_dev *hdev, void *data) +-{ +- struct hci_conn *conn; +- u16 handle = PTR_UINT(data); +- +- conn = hci_conn_hash_lookup_handle(hdev, handle); +- if (!conn) +- return 0; +- +- bt_dev_dbg(hdev, "conn %p", conn); +- +- clear_bit(HCI_CONN_SCANNING, &conn->flags); +- conn->state = BT_CONNECT; +- +- return hci_le_create_conn_sync(hdev, conn); +-} +- + struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst, + u8 dst_type, bool dst_resolved, u8 sec_level, + u16 conn_timeout, u8 role) +@@ -1371,9 +1327,7 @@ struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst, + conn->sec_level = BT_SECURITY_LOW; + conn->conn_timeout = conn_timeout; + +- err = hci_cmd_sync_queue(hdev, hci_connect_le_sync, +- UINT_PTR(conn->handle), +- create_le_conn_complete); ++ err = hci_connect_le_sync(hdev, conn); + if (err) { + hci_conn_del(conn); + return ERR_PTR(err); +@@ -2909,12 +2863,10 @@ u32 hci_conn_get_phy(struct hci_conn *conn) + + static int abort_conn_sync(struct hci_dev *hdev, void *data) + { +- struct hci_conn *conn; +- u16 handle = PTR_UINT(data); ++ struct hci_conn *conn = data; + +- conn = hci_conn_hash_lookup_handle(hdev, handle); +- if (!conn) +- return 0; ++ if (!hci_conn_valid(hdev, conn)) ++ return -ECANCELED; + + return hci_abort_conn_sync(hdev, conn, conn->abort_reason); + } +@@ -2949,8 +2901,10 @@ int hci_abort_conn(struct hci_conn *conn, u8 reason) + hci_cmd_sync_cancel(hdev, ECANCELED); + break; + } ++ /* Cancel connect attempt if still queued/pending */ ++ } else if (!hci_cancel_connect_sync(hdev, conn)) { ++ return 0; + } + +- return hci_cmd_sync_queue(hdev, abort_conn_sync, UINT_PTR(conn->handle), +- NULL); ++ return hci_cmd_sync_queue_once(hdev, abort_conn_sync, conn, NULL); + } +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index 22db2949eb3ef..ed7db30ac0e0d 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -6344,12 +6344,21 @@ static int hci_le_ext_create_conn_sync(struct hci_dev *hdev, + conn->conn_timeout, NULL); + } + +-int hci_le_create_conn_sync(struct hci_dev *hdev, struct hci_conn *conn) ++static int hci_le_create_conn_sync(struct hci_dev *hdev, void *data) + { + struct hci_cp_le_create_conn cp; + struct hci_conn_params *params; + u8 own_addr_type; + int err; ++ struct hci_conn *conn = data; ++ ++ if (!hci_conn_valid(hdev, conn)) ++ return -ECANCELED; ++ ++ bt_dev_dbg(hdev, "conn %p", conn); ++ ++ clear_bit(HCI_CONN_SCANNING, &conn->flags); ++ conn->state = BT_CONNECT; + + /* If requested to connect as peripheral use directed advertising */ + if (conn->role == HCI_ROLE_SLAVE) { +@@ -6670,16 +6679,11 @@ int hci_update_adv_data(struct hci_dev *hdev, u8 instance) + + static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data) + { +- struct hci_conn *conn; +- u16 handle = PTR_UINT(data); ++ struct hci_conn *conn = data; + struct inquiry_entry *ie; + struct hci_cp_create_conn cp; + int err; + +- conn = hci_conn_hash_lookup_handle(hdev, handle); +- if (!conn) +- return 0; +- + /* Many controllers disallow HCI Create Connection while it is doing + * HCI Inquiry. So we cancel the Inquiry first before issuing HCI Create + * Connection. This may cause the MGMT discovering state to become false +@@ -6738,6 +6742,58 @@ static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data) + + int hci_connect_acl_sync(struct hci_dev *hdev, struct hci_conn *conn) + { +- return hci_cmd_sync_queue(hdev, hci_acl_create_conn_sync, +- UINT_PTR(conn->handle), NULL); ++ return hci_cmd_sync_queue_once(hdev, hci_acl_create_conn_sync, conn, ++ NULL); ++} ++ ++static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err) ++{ ++ struct hci_conn *conn = data; ++ ++ bt_dev_dbg(hdev, "err %d", err); ++ ++ if (err == -ECANCELED) ++ return; ++ ++ hci_dev_lock(hdev); ++ ++ if (!err) { ++ hci_connect_le_scan_cleanup(conn, 0x00); ++ goto done; ++ } ++ ++ /* Check if connection is still pending */ ++ if (conn != hci_lookup_le_connect(hdev)) ++ goto done; ++ ++ /* Flush to make sure we send create conn cancel command if needed */ ++ flush_delayed_work(&conn->le_conn_timeout); ++ hci_conn_failed(conn, bt_status(err)); ++ ++done: ++ hci_dev_unlock(hdev); ++} ++ ++int hci_connect_le_sync(struct hci_dev *hdev, struct hci_conn *conn) ++{ ++ return hci_cmd_sync_queue_once(hdev, hci_le_create_conn_sync, conn, ++ create_le_conn_complete); ++} ++ ++int hci_cancel_connect_sync(struct hci_dev *hdev, struct hci_conn *conn) ++{ ++ if (conn->state != BT_OPEN) ++ return -EINVAL; ++ ++ switch (conn->type) { ++ case ACL_LINK: ++ return !hci_cmd_sync_dequeue_once(hdev, ++ hci_acl_create_conn_sync, ++ conn, NULL); ++ case LE_LINK: ++ return !hci_cmd_sync_dequeue_once(hdev, hci_le_create_conn_sync, ++ conn, create_le_conn_complete); ++ } ++ ++ return -ENOENT; + } +-- +2.43.0 + diff --git a/queue-6.8/bluetooth-hci_sync-use-advertised-phys-on-hci_le_ext.patch b/queue-6.8/bluetooth-hci_sync-use-advertised-phys-on-hci_le_ext.patch new file mode 100644 index 00000000000..7bb5f1f9a56 --- /dev/null +++ b/queue-6.8/bluetooth-hci_sync-use-advertised-phys-on-hci_le_ext.patch @@ -0,0 +1,203 @@ +From 0666c7f7f22725ed4ef509cc809020ae9d20703c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2024 16:40:33 -0400 +Subject: Bluetooth: hci_sync: Use advertised PHYs on + hci_le_ext_create_conn_sync + +From: Luiz Augusto von Dentz + +[ Upstream commit 2e7ed5f5e69b6fe93dd3c6b651d041e0a7a456d1 ] + +The extended advertising reports do report the PHYs so this store then +in hci_conn so it can be later used in hci_le_ext_create_conn_sync to +narrow the PHYs to be scanned since the controller will also perform a +scan having a smaller set of PHYs shall reduce the time it takes to +find and connect peers. + +Fixes: 288c90224eec ("Bluetooth: Enable all supported LE PHY by default") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci_core.h | 4 +++- + net/bluetooth/hci_conn.c | 6 ++++-- + net/bluetooth/hci_event.c | 20 ++++++++++++-------- + net/bluetooth/hci_sync.c | 9 ++++++--- + net/bluetooth/l2cap_core.c | 2 +- + 5 files changed, 26 insertions(+), 15 deletions(-) + +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index 1da71254caf61..b6fb104ea1976 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -738,6 +738,8 @@ struct hci_conn { + __u8 le_per_adv_data[HCI_MAX_PER_AD_TOT_LEN]; + __u16 le_per_adv_data_len; + __u16 le_per_adv_data_offset; ++ __u8 le_adv_phy; ++ __u8 le_adv_sec_phy; + __u8 le_tx_phy; + __u8 le_rx_phy; + __s8 rssi; +@@ -1512,7 +1514,7 @@ struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst, + enum conn_reasons conn_reason); + struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst, + u8 dst_type, bool dst_resolved, u8 sec_level, +- u16 conn_timeout, u8 role); ++ u16 conn_timeout, u8 role, u8 phy, u8 sec_phy); + void hci_connect_le_scan_cleanup(struct hci_conn *conn, u8 status); + struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst, + u8 sec_level, u8 auth_type, +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 3a66d357b9323..18f97b2288699 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -1263,7 +1263,7 @@ u8 hci_conn_set_handle(struct hci_conn *conn, u16 handle) + + struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst, + u8 dst_type, bool dst_resolved, u8 sec_level, +- u16 conn_timeout, u8 role) ++ u16 conn_timeout, u8 role, u8 phy, u8 sec_phy) + { + struct hci_conn *conn; + struct smp_irk *irk; +@@ -1326,6 +1326,8 @@ struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst, + conn->dst_type = dst_type; + conn->sec_level = BT_SECURITY_LOW; + conn->conn_timeout = conn_timeout; ++ conn->le_adv_phy = phy; ++ conn->le_adv_sec_phy = sec_phy; + + err = hci_connect_le_sync(hdev, conn); + if (err) { +@@ -2253,7 +2255,7 @@ struct hci_conn *hci_connect_cis(struct hci_dev *hdev, bdaddr_t *dst, + le = hci_connect_le(hdev, dst, dst_type, false, + BT_SECURITY_LOW, + HCI_LE_CONN_TIMEOUT, +- HCI_ROLE_SLAVE); ++ HCI_ROLE_SLAVE, 0, 0); + else + le = hci_connect_le_scan(hdev, dst, dst_type, + BT_SECURITY_LOW, +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index f5d77c8089d81..9450df4ee5b9b 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -6182,7 +6182,7 @@ static void hci_le_conn_update_complete_evt(struct hci_dev *hdev, void *data, + static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev, + bdaddr_t *addr, + u8 addr_type, bool addr_resolved, +- u8 adv_type) ++ u8 adv_type, u8 phy, u8 sec_phy) + { + struct hci_conn *conn; + struct hci_conn_params *params; +@@ -6237,7 +6237,7 @@ static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev, + + conn = hci_connect_le(hdev, addr, addr_type, addr_resolved, + BT_SECURITY_LOW, hdev->def_le_autoconnect_timeout, +- HCI_ROLE_MASTER); ++ HCI_ROLE_MASTER, phy, sec_phy); + if (!IS_ERR(conn)) { + /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned + * by higher layer that tried to connect, if no then +@@ -6272,8 +6272,9 @@ static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev, + + static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr, + u8 bdaddr_type, bdaddr_t *direct_addr, +- u8 direct_addr_type, s8 rssi, u8 *data, u8 len, +- bool ext_adv, bool ctl_time, u64 instant) ++ u8 direct_addr_type, u8 phy, u8 sec_phy, s8 rssi, ++ u8 *data, u8 len, bool ext_adv, bool ctl_time, ++ u64 instant) + { + struct discovery_state *d = &hdev->discovery; + struct smp_irk *irk; +@@ -6361,7 +6362,7 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr, + * for advertising reports) and is already verified to be RPA above. + */ + conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, bdaddr_resolved, +- type); ++ type, phy, sec_phy); + if (!ext_adv && conn && type == LE_ADV_IND && + len <= max_adv_len(hdev)) { + /* Store report for later inclusion by +@@ -6507,7 +6508,8 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, void *data, + if (info->length <= max_adv_len(hdev)) { + rssi = info->data[info->length]; + process_adv_report(hdev, info->type, &info->bdaddr, +- info->bdaddr_type, NULL, 0, rssi, ++ info->bdaddr_type, NULL, 0, ++ HCI_ADV_PHY_1M, 0, rssi, + info->data, info->length, false, + false, instant); + } else { +@@ -6592,6 +6594,8 @@ static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, void *data, + if (legacy_evt_type != LE_ADV_INVALID) { + process_adv_report(hdev, legacy_evt_type, &info->bdaddr, + info->bdaddr_type, NULL, 0, ++ info->primary_phy, ++ info->secondary_phy, + info->rssi, info->data, info->length, + !(evt_type & LE_EXT_ADV_LEGACY_PDU), + false, instant); +@@ -6874,8 +6878,8 @@ static void hci_le_direct_adv_report_evt(struct hci_dev *hdev, void *data, + + process_adv_report(hdev, info->type, &info->bdaddr, + info->bdaddr_type, &info->direct_addr, +- info->direct_addr_type, info->rssi, NULL, 0, +- false, false, instant); ++ info->direct_addr_type, HCI_ADV_PHY_1M, 0, ++ info->rssi, NULL, 0, false, false, instant); + } + + hci_dev_unlock(hdev); +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index ed7db30ac0e0d..84fe44c796f4f 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -6315,7 +6315,8 @@ static int hci_le_ext_create_conn_sync(struct hci_dev *hdev, + + plen = sizeof(*cp); + +- if (scan_1m(hdev)) { ++ if (scan_1m(hdev) && (conn->le_adv_phy == HCI_ADV_PHY_1M || ++ conn->le_adv_sec_phy == HCI_ADV_PHY_1M)) { + cp->phys |= LE_SCAN_PHY_1M; + set_ext_conn_params(conn, p); + +@@ -6323,7 +6324,8 @@ static int hci_le_ext_create_conn_sync(struct hci_dev *hdev, + plen += sizeof(*p); + } + +- if (scan_2m(hdev)) { ++ if (scan_2m(hdev) && (conn->le_adv_phy == HCI_ADV_PHY_2M || ++ conn->le_adv_sec_phy == HCI_ADV_PHY_2M)) { + cp->phys |= LE_SCAN_PHY_2M; + set_ext_conn_params(conn, p); + +@@ -6331,7 +6333,8 @@ static int hci_le_ext_create_conn_sync(struct hci_dev *hdev, + plen += sizeof(*p); + } + +- if (scan_coded(hdev)) { ++ if (scan_coded(hdev) && (conn->le_adv_phy == HCI_ADV_PHY_CODED || ++ conn->le_adv_sec_phy == HCI_ADV_PHY_CODED)) { + cp->phys |= LE_SCAN_PHY_CODED; + set_ext_conn_params(conn, p); + +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index dc08974087936..84fc70862d78a 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -7018,7 +7018,7 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, + if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) + hcon = hci_connect_le(hdev, dst, dst_type, false, + chan->sec_level, timeout, +- HCI_ROLE_SLAVE); ++ HCI_ROLE_SLAVE, 0, 0); + else + hcon = hci_connect_le_scan(hdev, dst, dst_type, + chan->sec_level, timeout, +-- +2.43.0 + diff --git a/queue-6.8/bluetooth-hci_sync-using-hci_cmd_sync_submit-when-re.patch b/queue-6.8/bluetooth-hci_sync-using-hci_cmd_sync_submit-when-re.patch new file mode 100644 index 00000000000..eeb800a078c --- /dev/null +++ b/queue-6.8/bluetooth-hci_sync-using-hci_cmd_sync_submit-when-re.patch @@ -0,0 +1,58 @@ +From 8cfba95fd8962b49792c4089a6c06499402cca5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 21:59:03 +0800 +Subject: Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv + Monitor + +From: Chun-Yi Lee + +[ Upstream commit 88cd6e6b2d327faa13e4505b07f1e380e51b21ff ] + +Since the d883a4669a1de be introduced in v6.4, bluetooth daemon +got the following failed message of MGMT_OP_REMOVE_ADV_MONITOR +command when controller is power-off: + +bluetoothd[20976]: +src/adapter.c:reset_adv_monitors_complete() Failed to reset Adv +Monitors: Failed> + +Normally this situation is happened when the bluetoothd deamon +be started manually after system booting. Which means that +bluetoothd received MGMT_EV_INDEX_ADDED event after kernel +runs hci_power_off(). + +Base on doc/mgmt-api.txt, the MGMT_OP_REMOVE_ADV_MONITOR command +can be used when the controller is not powered. This patch changes +the code in remove_adv_monitor() to use hci_cmd_sync_submit() +instead of hci_cmd_sync_queue(). + +Fixes: d883a4669a1de ("Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running") +Cc: Luiz Augusto von Dentz +Cc: Manish Mandlik +Cc: Archie Pusaka +Cc: Miao-chen Chou +Signed-off-by: Chun-Yi Lee +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/mgmt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 7e56cb3d377a1..b8e05ddeedba9 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -5478,8 +5478,8 @@ static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, + goto unlock; + } + +- err = hci_cmd_sync_queue(hdev, mgmt_remove_adv_monitor_sync, cmd, +- mgmt_remove_adv_monitor_complete); ++ err = hci_cmd_sync_submit(hdev, mgmt_remove_adv_monitor_sync, cmd, ++ mgmt_remove_adv_monitor_complete); + + if (err) { + mgmt_pending_remove(cmd); +-- +2.43.0 + diff --git a/queue-6.8/bluetooth-iso-reassemble-pa-data-for-bcast-sink.patch b/queue-6.8/bluetooth-iso-reassemble-pa-data-for-bcast-sink.patch new file mode 100644 index 00000000000..66e0eca8664 --- /dev/null +++ b/queue-6.8/bluetooth-iso-reassemble-pa-data-for-bcast-sink.patch @@ -0,0 +1,138 @@ +From 3adaf4d387646a92f9ad919b2a532247d0a0c1fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 15:14:42 +0200 +Subject: Bluetooth: ISO: Reassemble PA data for bcast sink + +From: Iulia Tanasescu + +[ Upstream commit 168d9bf9c7f01df71e6404cfff66d9c2a8e968fb ] + +This adds support to reassemble PA data for a Broadcast Sink +listening socket. This is needed in case the BASE is received +fragmented in multiple PA reports. + +PA data is first reassembled inside the hcon, before the BASE +is extracted and stored inside the socket. The length of the +le_per_adv_data hcon array has been raised to 1650, to accommodate +the maximum PA data length that can come fragmented, according to +spec. + +Signed-off-by: Iulia Tanasescu +Signed-off-by: Luiz Augusto von Dentz +Stable-dep-of: 2e7ed5f5e69b ("Bluetooth: hci_sync: Use advertised PHYs on hci_le_ext_create_conn_sync") +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci.h | 5 ++++ + include/net/bluetooth/hci_core.h | 5 ++-- + net/bluetooth/iso.c | 50 +++++++++++++++++++++++++++++--- + 3 files changed, 54 insertions(+), 6 deletions(-) + +diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h +index bfddb648fcc3e..2cfd8d862639f 100644 +--- a/include/net/bluetooth/hci.h ++++ b/include/net/bluetooth/hci.h +@@ -2053,6 +2053,7 @@ struct hci_cp_le_set_per_adv_params { + } __packed; + + #define HCI_MAX_PER_AD_LENGTH 252 ++#define HCI_MAX_PER_AD_TOT_LEN 1650 + + #define HCI_OP_LE_SET_PER_ADV_DATA 0x203f + struct hci_cp_le_set_per_adv_data { +@@ -2813,6 +2814,10 @@ struct hci_ev_le_per_adv_report { + __u8 data[]; + } __packed; + ++#define LE_PA_DATA_COMPLETE 0x00 ++#define LE_PA_DATA_MORE_TO_COME 0x01 ++#define LE_PA_DATA_TRUNCATED 0x02 ++ + #define HCI_EV_LE_EXT_ADV_SET_TERM 0x12 + struct hci_evt_le_ext_adv_set_term { + __u8 status; +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index 93e2b17b11267..1da71254caf61 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -735,8 +735,9 @@ struct hci_conn { + __u16 le_supv_timeout; + __u8 le_adv_data[HCI_MAX_EXT_AD_LENGTH]; + __u8 le_adv_data_len; +- __u8 le_per_adv_data[HCI_MAX_PER_AD_LENGTH]; +- __u8 le_per_adv_data_len; ++ __u8 le_per_adv_data[HCI_MAX_PER_AD_TOT_LEN]; ++ __u16 le_per_adv_data_len; ++ __u16 le_per_adv_data_offset; + __u8 le_tx_phy; + __u8 le_rx_phy; + __s8 rssi; +diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c +index a8b05baa8e5a9..fa6c2e95d5542 100644 +--- a/net/bluetooth/iso.c ++++ b/net/bluetooth/iso.c +@@ -1955,16 +1955,58 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags) + + ev3 = hci_recv_event_data(hdev, HCI_EV_LE_PER_ADV_REPORT); + if (ev3) { +- size_t base_len = ev3->length; ++ size_t base_len = 0; + u8 *base; ++ struct hci_conn *hcon; + + sk = iso_get_sock_listen(&hdev->bdaddr, bdaddr, + iso_match_sync_handle_pa_report, ev3); +- base = eir_get_service_data(ev3->data, ev3->length, +- EIR_BAA_SERVICE_UUID, &base_len); +- if (base && sk && base_len <= sizeof(iso_pi(sk)->base)) { ++ if (!sk) ++ goto done; ++ ++ hcon = iso_pi(sk)->conn->hcon; ++ if (!hcon) ++ goto done; ++ ++ if (ev3->data_status == LE_PA_DATA_TRUNCATED) { ++ /* The controller was unable to retrieve PA data. */ ++ memset(hcon->le_per_adv_data, 0, ++ HCI_MAX_PER_AD_TOT_LEN); ++ hcon->le_per_adv_data_len = 0; ++ hcon->le_per_adv_data_offset = 0; ++ goto done; ++ } ++ ++ if (hcon->le_per_adv_data_offset + ev3->length > ++ HCI_MAX_PER_AD_TOT_LEN) ++ goto done; ++ ++ memcpy(hcon->le_per_adv_data + hcon->le_per_adv_data_offset, ++ ev3->data, ev3->length); ++ hcon->le_per_adv_data_offset += ev3->length; ++ ++ if (ev3->data_status == LE_PA_DATA_COMPLETE) { ++ /* All PA data has been received. */ ++ hcon->le_per_adv_data_len = ++ hcon->le_per_adv_data_offset; ++ hcon->le_per_adv_data_offset = 0; ++ ++ /* Extract BASE */ ++ base = eir_get_service_data(hcon->le_per_adv_data, ++ hcon->le_per_adv_data_len, ++ EIR_BAA_SERVICE_UUID, ++ &base_len); ++ ++ if (!base || base_len > BASE_MAX_LENGTH) ++ goto done; ++ + memcpy(iso_pi(sk)->base, base, base_len); + iso_pi(sk)->base_len = base_len; ++ } else { ++ /* This is a PA data fragment. Keep pa_data_len set to 0 ++ * until all data has been reassembled. ++ */ ++ hcon->le_per_adv_data_len = 0; + } + } else { + sk = iso_get_sock_listen(&hdev->bdaddr, BDADDR_ANY, NULL, NULL); +-- +2.43.0 + diff --git a/queue-6.8/bluetooth-mgmt-fix-failing-to-mgmt_op_add_uuid-mgmt_.patch b/queue-6.8/bluetooth-mgmt-fix-failing-to-mgmt_op_add_uuid-mgmt_.patch new file mode 100644 index 00000000000..261a5b0c7de --- /dev/null +++ b/queue-6.8/bluetooth-mgmt-fix-failing-to-mgmt_op_add_uuid-mgmt_.patch @@ -0,0 +1,70 @@ +From 13ed2dec84a201740950c39b8e9d9bf3ff3b12a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2024 15:34:45 -0400 +Subject: Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID + +From: Luiz Augusto von Dentz + +[ Upstream commit 6eb5fcc416f127f220b9177a5c9ae751cac1cda8 ] + +These commands don't require the adapter to be up and running so don't +use hci_cmd_sync_queue which would check that flag, instead use +hci_cmd_sync_submit which would ensure mgmt_class_complete is set +properly regardless if any command was actually run or not. + +Link: https://github.com/bluez/bluez/issues/809 +Fixes: d883a4669a1d ("Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/mgmt.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 0759975be6479..7e56cb3d377a1 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -2616,7 +2616,11 @@ static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) + goto failed; + } + +- err = hci_cmd_sync_queue(hdev, add_uuid_sync, cmd, mgmt_class_complete); ++ /* MGMT_OP_ADD_UUID don't require adapter the UP/Running so use ++ * hci_cmd_sync_submit instead of hci_cmd_sync_queue. ++ */ ++ err = hci_cmd_sync_submit(hdev, add_uuid_sync, cmd, ++ mgmt_class_complete); + if (err < 0) { + mgmt_pending_free(cmd); + goto failed; +@@ -2710,8 +2714,11 @@ static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, + goto unlock; + } + +- err = hci_cmd_sync_queue(hdev, remove_uuid_sync, cmd, +- mgmt_class_complete); ++ /* MGMT_OP_REMOVE_UUID don't require adapter the UP/Running so use ++ * hci_cmd_sync_submit instead of hci_cmd_sync_queue. ++ */ ++ err = hci_cmd_sync_submit(hdev, remove_uuid_sync, cmd, ++ mgmt_class_complete); + if (err < 0) + mgmt_pending_free(cmd); + +@@ -2777,8 +2784,11 @@ static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, + goto unlock; + } + +- err = hci_cmd_sync_queue(hdev, set_class_sync, cmd, +- mgmt_class_complete); ++ /* MGMT_OP_SET_DEV_CLASS don't require adapter the UP/Running so use ++ * hci_cmd_sync_submit instead of hci_cmd_sync_queue. ++ */ ++ err = hci_cmd_sync_submit(hdev, set_class_sync, cmd, ++ mgmt_class_complete); + if (err < 0) + mgmt_pending_free(cmd); + +-- +2.43.0 + diff --git a/queue-6.8/bluetooth-qca-set-power_ctrl_enabled-on-null-returne.patch b/queue-6.8/bluetooth-qca-set-power_ctrl_enabled-on-null-returne.patch new file mode 100644 index 00000000000..d0e6e67e7c9 --- /dev/null +++ b/queue-6.8/bluetooth-qca-set-power_ctrl_enabled-on-null-returne.patch @@ -0,0 +1,84 @@ +From 5a31018068d9c509af29d3e145819dfb2d27ba08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 14:29:32 +0200 +Subject: Bluetooth: qca: set power_ctrl_enabled on NULL returned by + gpiod_get_optional() + +From: Bartosz Golaszewski + +[ Upstream commit 3d05fc82237aa97162d0d7dc300b55bb34e91d02 ] + +Any return value from gpiod_get_optional() other than a pointer to a +GPIO descriptor or a NULL-pointer is an error and the driver should +abort probing. That being said: commit 56d074d26c58 ("Bluetooth: hci_qca: +don't use IS_ERR_OR_NULL() with gpiod_get_optional()") no longer sets +power_ctrl_enabled on NULL-pointer returned by +devm_gpiod_get_optional(). Restore this behavior but bail-out on errors. +While at it: also bail-out on error returned when trying to get the +"swctrl" GPIO. + +Reported-by: Wren Turkal +Reported-by: Zijun Hu +Closes: https://lore.kernel.org/linux-bluetooth/1713449192-25926-2-git-send-email-quic_zijuhu@quicinc.com/ +Fixes: 56d074d26c58 ("Bluetooth: hci_qca: don't use IS_ERR_OR_NULL() with gpiod_get_optional()") +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Bartosz Golaszewski +Tested-by: Wren Turkal" +Reported-by: Wren Turkal +Reported-by: Zijun Hu +Reviewed-by: Krzysztof Kozlowski +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/hci_qca.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c +index ecbc52eaf1010..2f7ae38d85eb0 100644 +--- a/drivers/bluetooth/hci_qca.c ++++ b/drivers/bluetooth/hci_qca.c +@@ -2329,16 +2329,21 @@ static int qca_serdev_probe(struct serdev_device *serdev) + (data->soc_type == QCA_WCN6750 || + data->soc_type == QCA_WCN6855)) { + dev_err(&serdev->dev, "failed to acquire BT_EN gpio\n"); +- power_ctrl_enabled = false; ++ return PTR_ERR(qcadev->bt_en); + } + ++ if (!qcadev->bt_en) ++ power_ctrl_enabled = false; ++ + qcadev->sw_ctrl = devm_gpiod_get_optional(&serdev->dev, "swctrl", + GPIOD_IN); + if (IS_ERR(qcadev->sw_ctrl) && + (data->soc_type == QCA_WCN6750 || + data->soc_type == QCA_WCN6855 || +- data->soc_type == QCA_WCN7850)) +- dev_warn(&serdev->dev, "failed to acquire SW_CTRL gpio\n"); ++ data->soc_type == QCA_WCN7850)) { ++ dev_err(&serdev->dev, "failed to acquire SW_CTRL gpio\n"); ++ return PTR_ERR(qcadev->sw_ctrl); ++ } + + qcadev->susclk = devm_clk_get_optional(&serdev->dev, NULL); + if (IS_ERR(qcadev->susclk)) { +@@ -2357,10 +2362,13 @@ static int qca_serdev_probe(struct serdev_device *serdev) + qcadev->bt_en = devm_gpiod_get_optional(&serdev->dev, "enable", + GPIOD_OUT_LOW); + if (IS_ERR(qcadev->bt_en)) { +- dev_warn(&serdev->dev, "failed to acquire enable gpio\n"); +- power_ctrl_enabled = false; ++ dev_err(&serdev->dev, "failed to acquire enable gpio\n"); ++ return PTR_ERR(qcadev->bt_en); + } + ++ if (!qcadev->bt_en) ++ power_ctrl_enabled = false; ++ + qcadev->susclk = devm_clk_get_optional(&serdev->dev, NULL); + if (IS_ERR(qcadev->susclk)) { + dev_warn(&serdev->dev, "failed to acquire clk\n"); +-- +2.43.0 + diff --git a/queue-6.8/bluetooth-remove-pending-acl-connection-attempts.patch b/queue-6.8/bluetooth-remove-pending-acl-connection-attempts.patch new file mode 100644 index 00000000000..41bcb818dce --- /dev/null +++ b/queue-6.8/bluetooth-remove-pending-acl-connection-attempts.patch @@ -0,0 +1,152 @@ +From 3ae89f9ae8f5abdbdb51fda77ccd4a8fafe0dd94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Feb 2024 12:08:14 +0100 +Subject: Bluetooth: Remove pending ACL connection attempts +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonas Dreßler + +[ Upstream commit 4aa42119d971603dc9e4d8cf4f53d5fcf082ea7d ] + +With the last commit we moved to using the hci_sync queue for "Create +Connection" requests, removing the need for retrying the paging after +finished/failed "Create Connection" requests and after the end of +inquiries. + +hci_conn_check_pending() was used to trigger this retry, we can remove it +now. + +Note that we can also remove the special handling for COMMAND_DISALLOWED +errors in the completion handler of "Create Connection", because "Create +Connection" requests are now always serialized. + +This is somewhat reverting commit 4c67bc74f016 ("[Bluetooth] Support +concurrent connect requests"). + +With this, the BT_CONNECT2 state of ACL hci_conn objects should now be +back to meaning only one thing: That we received a "Connection Request" +from another device (see hci_conn_request_evt), but the response to that +is going to be deferred. + +Signed-off-by: Jonas Dreßler +Signed-off-by: Luiz Augusto von Dentz +Stable-dep-of: 2e7ed5f5e69b ("Bluetooth: hci_sync: Use advertised PHYs on hci_le_ext_create_conn_sync") +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci_core.h | 1 - + net/bluetooth/hci_conn.c | 16 ---------------- + net/bluetooth/hci_event.c | 21 ++++----------------- + 3 files changed, 4 insertions(+), 34 deletions(-) + +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index d1228857b1d0f..ddbf287ee64fb 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -1481,7 +1481,6 @@ struct hci_conn *hci_conn_add_unset(struct hci_dev *hdev, int type, + bdaddr_t *dst, u8 role); + void hci_conn_del(struct hci_conn *conn); + void hci_conn_hash_flush(struct hci_dev *hdev); +-void hci_conn_check_pending(struct hci_dev *hdev); + + struct hci_chan *hci_chan_create(struct hci_conn *conn); + void hci_chan_del(struct hci_chan *chan); +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index d21e39ae67658..13481f08e47ee 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -2592,22 +2592,6 @@ void hci_conn_hash_flush(struct hci_dev *hdev) + } + } + +-/* Check pending connect attempts */ +-void hci_conn_check_pending(struct hci_dev *hdev) +-{ +- struct hci_conn *conn; +- +- BT_DBG("hdev %s", hdev->name); +- +- hci_dev_lock(hdev); +- +- conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2); +- if (conn) +- hci_acl_create_connection_sync(hdev, conn); +- +- hci_dev_unlock(hdev); +-} +- + static u32 get_link_mode(struct hci_conn *conn) + { + u32 link_mode = 0; +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index a59b5b4711a46..f5d77c8089d81 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -118,8 +118,6 @@ static u8 hci_cc_inquiry_cancel(struct hci_dev *hdev, void *data, + hci_discovery_set_state(hdev, DISCOVERY_STOPPED); + hci_dev_unlock(hdev); + +- hci_conn_check_pending(hdev); +- + return rp->status; + } + +@@ -150,8 +148,6 @@ static u8 hci_cc_exit_periodic_inq(struct hci_dev *hdev, void *data, + + hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ); + +- hci_conn_check_pending(hdev); +- + return rp->status; + } + +@@ -2312,10 +2308,8 @@ static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status) + { + bt_dev_dbg(hdev, "status 0x%2.2x", status); + +- if (status) { +- hci_conn_check_pending(hdev); ++ if (status) + return; +- } + + if (hci_sent_cmd_data(hdev, HCI_OP_INQUIRY)) + set_bit(HCI_INQUIRY, &hdev->flags); +@@ -2340,12 +2334,9 @@ static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status) + + if (status) { + if (conn && conn->state == BT_CONNECT) { +- if (status != HCI_ERROR_COMMAND_DISALLOWED || conn->attempt > 2) { +- conn->state = BT_CLOSED; +- hci_connect_cfm(conn, status); +- hci_conn_del(conn); +- } else +- conn->state = BT_CONNECT2; ++ conn->state = BT_CLOSED; ++ hci_connect_cfm(conn, status); ++ hci_conn_del(conn); + } + } else { + if (!conn) { +@@ -3035,8 +3026,6 @@ static void hci_inquiry_complete_evt(struct hci_dev *hdev, void *data, + + bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); + +- hci_conn_check_pending(hdev); +- + if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags)) + return; + +@@ -3283,8 +3272,6 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, void *data, + + unlock: + hci_dev_unlock(hdev); +- +- hci_conn_check_pending(hdev); + } + + static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr) +-- +2.43.0 + diff --git a/queue-6.8/bnxt_en-fix-error-recovery-for-5760x-p7-chips.patch b/queue-6.8/bnxt_en-fix-error-recovery-for-5760x-p7-chips.patch new file mode 100644 index 00000000000..8ac5420272f --- /dev/null +++ b/queue-6.8/bnxt_en-fix-error-recovery-for-5760x-p7-chips.patch @@ -0,0 +1,55 @@ +From 29c43ade7149f214819143be9433fda2675c1bff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Apr 2024 11:34:49 -0700 +Subject: bnxt_en: Fix error recovery for 5760X (P7) chips + +From: Michael Chan + +[ Upstream commit 41e54045b741daf61e03c82d442227af3d12111f ] + +During error recovery, such as AER fatal error slot reset, we call +bnxt_try_map_fw_health_reg() to try to get access to the health +register to determine the firmware state. Fix +bnxt_try_map_fw_health_reg() to recognize the P7 chip correctly +and set up the health register. + +This fixes this type of AER slot reset failure: + +bnxt_en 0000:04:00.0: AER: PCIe Bus Error: severity=Uncorrectable (Fatal), type=Inaccessible, (Unregistered Agent ID) +bnxt_en 0000:04:00.0 enp4s0f0np0: PCI I/O error detected +bnxt_en 0000:04:00.0 bnxt_re0: Handle device suspend call +bnxt_en 0000:04:00.1 enp4s0f1np1: PCI I/O error detected +bnxt_en 0000:04:00.1 bnxt_re1: Handle device suspend call +pcieport 0000:00:02.0: AER: Root Port link has been reset (0) +bnxt_en 0000:04:00.0 enp4s0f0np0: PCI Slot Reset +bnxt_en 0000:04:00.0: enabling device (0000 -> 0002) +bnxt_en 0000:04:00.0: Firmware not ready +bnxt_en 0000:04:00.1 enp4s0f1np1: PCI Slot Reset +bnxt_en 0000:04:00.1: enabling device (0000 -> 0002) +bnxt_en 0000:04:00.1: Firmware not ready +pcieport 0000:00:02.0: AER: device recovery failed + +Fixes: a432a45bdba4 ("bnxt_en: Define basic P7 macros") +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 6bdd8c2607898..5b4d810748f2a 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -8906,7 +8906,7 @@ static void bnxt_try_map_fw_health_reg(struct bnxt *bp) + BNXT_FW_HEALTH_WIN_BASE + + BNXT_GRC_REG_CHIP_NUM); + } +- if (!BNXT_CHIP_P5(bp)) ++ if (!BNXT_CHIP_P5_PLUS(bp)) + return; + + status_loc = BNXT_GRC_REG_STATUS_P5 | +-- +2.43.0 + diff --git a/queue-6.8/bnxt_en-fix-the-pci-aer-routines.patch b/queue-6.8/bnxt_en-fix-the-pci-aer-routines.patch new file mode 100644 index 00000000000..c6ab4f3b6f1 --- /dev/null +++ b/queue-6.8/bnxt_en-fix-the-pci-aer-routines.patch @@ -0,0 +1,79 @@ +From 63979c823971192af4bc2ebf8e553cb78a50fa41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Apr 2024 11:34:48 -0700 +Subject: bnxt_en: Fix the PCI-AER routines + +From: Vikas Gupta + +[ Upstream commit a1acdc226baec331512f815d6ac9dd6f8435cc7f ] + +We do not support two simultaneous recoveries so check for reset +flag, BNXT_STATE_IN_FW_RESET, and do not proceed with AER further. +When the pci channel state is pci_channel_io_frozen, the PCIe link +can not be trusted so we disable the traffic immediately and stop +BAR access by calling bnxt_fw_fatal_close(). BAR access after +AER fatal error can cause an NMI. + +Fixes: f75d9a0aa967 ("bnxt_en: Re-write PCI BARs after PCI fatal error.") +Signed-off-by: Vikas Gupta +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 260ffd71e2a89..6bdd8c2607898 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -15045,6 +15045,7 @@ static pci_ers_result_t bnxt_io_error_detected(struct pci_dev *pdev, + { + struct net_device *netdev = pci_get_drvdata(pdev); + struct bnxt *bp = netdev_priv(netdev); ++ bool abort = false; + + netdev_info(netdev, "PCI I/O error detected\n"); + +@@ -15053,16 +15054,27 @@ static pci_ers_result_t bnxt_io_error_detected(struct pci_dev *pdev, + + bnxt_ulp_stop(bp); + +- if (state == pci_channel_io_perm_failure) { ++ if (test_and_set_bit(BNXT_STATE_IN_FW_RESET, &bp->state)) { ++ netdev_err(bp->dev, "Firmware reset already in progress\n"); ++ abort = true; ++ } ++ ++ if (abort || state == pci_channel_io_perm_failure) { + rtnl_unlock(); + return PCI_ERS_RESULT_DISCONNECT; + } + +- if (state == pci_channel_io_frozen) ++ /* Link is not reliable anymore if state is pci_channel_io_frozen ++ * so we disable bus master to prevent any potential bad DMAs before ++ * freeing kernel memory. ++ */ ++ if (state == pci_channel_io_frozen) { + set_bit(BNXT_STATE_PCI_CHANNEL_IO_FROZEN, &bp->state); ++ bnxt_fw_fatal_close(bp); ++ } + + if (netif_running(netdev)) +- bnxt_close(netdev); ++ __bnxt_close_nic(bp, true, true); + + if (pci_is_enabled(pdev)) + pci_disable_device(pdev); +@@ -15146,6 +15158,7 @@ static pci_ers_result_t bnxt_io_slot_reset(struct pci_dev *pdev) + } + + reset_exit: ++ clear_bit(BNXT_STATE_IN_FW_RESET, &bp->state); + bnxt_clear_reservations(bp, true); + rtnl_unlock(); + +-- +2.43.0 + diff --git a/queue-6.8/bnxt_en-refactor-reset-close-code.patch b/queue-6.8/bnxt_en-refactor-reset-close-code.patch new file mode 100644 index 00000000000..22e05731d4d --- /dev/null +++ b/queue-6.8/bnxt_en-refactor-reset-close-code.patch @@ -0,0 +1,60 @@ +From 6f66c9a07165c9fabc42ec3c81dd394b186af936 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Apr 2024 11:34:47 -0700 +Subject: bnxt_en: refactor reset close code + +From: Vikas Gupta + +[ Upstream commit 7474b1c82be3780692d537d331f9aa7fc1e5a368 ] + +Introduce bnxt_fw_fatal_close() API which can be used +to stop data path and disable device when firmware +is in fatal state. + +Signed-off-by: Vikas Gupta +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Stable-dep-of: a1acdc226bae ("bnxt_en: Fix the PCI-AER routines") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 5e6e32d708e24..260ffd71e2a89 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -12776,6 +12776,16 @@ static void bnxt_rx_ring_reset(struct bnxt *bp) + bnxt_rtnl_unlock_sp(bp); + } + ++static void bnxt_fw_fatal_close(struct bnxt *bp) ++{ ++ bnxt_tx_disable(bp); ++ bnxt_disable_napi(bp); ++ bnxt_disable_int_sync(bp); ++ bnxt_free_irq(bp); ++ bnxt_clear_int_mode(bp); ++ pci_disable_device(bp->pdev); ++} ++ + static void bnxt_fw_reset_close(struct bnxt *bp) + { + bnxt_ulp_stop(bp); +@@ -12789,12 +12799,7 @@ static void bnxt_fw_reset_close(struct bnxt *bp) + pci_read_config_word(bp->pdev, PCI_SUBSYSTEM_ID, &val); + if (val == 0xffff) + bp->fw_reset_min_dsecs = 0; +- bnxt_tx_disable(bp); +- bnxt_disable_napi(bp); +- bnxt_disable_int_sync(bp); +- bnxt_free_irq(bp); +- bnxt_clear_int_mode(bp); +- pci_disable_device(bp->pdev); ++ bnxt_fw_fatal_close(bp); + } + __bnxt_close_nic(bp, true, false); + bnxt_vf_reps_free(bp); +-- +2.43.0 + diff --git a/queue-6.8/bridge-br_netlink.c-no-need-to-return-void-function.patch b/queue-6.8/bridge-br_netlink.c-no-need-to-return-void-function.patch new file mode 100644 index 00000000000..b0bdd392737 --- /dev/null +++ b/queue-6.8/bridge-br_netlink.c-no-need-to-return-void-function.patch @@ -0,0 +1,36 @@ +From 4a1cdb48974035127cbd2f62fed309c9384fdd80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Apr 2024 16:02:00 +0800 +Subject: bridge/br_netlink.c: no need to return void function + +From: Hangbin Liu + +[ Upstream commit 4fd1edcdf13c0d234543ecf502092be65c5177db ] + +br_info_notify is a void function. There is no need to return. + +Fixes: b6d0425b816e ("bridge: cfm: Netlink Notifications.") +Signed-off-by: Hangbin Liu +Acked-by: Nikolay Aleksandrov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/bridge/br_netlink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c +index 5ad4abfcb7ba3..d415833fce91f 100644 +--- a/net/bridge/br_netlink.c ++++ b/net/bridge/br_netlink.c +@@ -666,7 +666,7 @@ void br_ifinfo_notify(int event, const struct net_bridge *br, + { + u32 filter = RTEXT_FILTER_BRVLAN_COMPRESSED; + +- return br_info_notify(event, br, port, filter); ++ br_info_notify(event, br, port, filter); + } + + /* +-- +2.43.0 + diff --git a/queue-6.8/cifs-fix-reacquisition-of-volume-cookie-on-still-liv.patch b/queue-6.8/cifs-fix-reacquisition-of-volume-cookie-on-still-liv.patch new file mode 100644 index 00000000000..4b03afcd0e4 --- /dev/null +++ b/queue-6.8/cifs-fix-reacquisition-of-volume-cookie-on-still-liv.patch @@ -0,0 +1,119 @@ +From 481559c1218ec7e6a92f98646a815fcf8e51817c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Apr 2024 16:05:19 +0100 +Subject: cifs: Fix reacquisition of volume cookie on still-live connection + +From: David Howells + +[ Upstream commit dad80c6bff770d25f67ec25fe011730e4a463008 ] + +During mount, cifs_mount_get_tcon() gets a tcon resource connection record +and then attaches an fscache volume cookie to it. However, it does this +irrespective of whether or not the tcon returned from cifs_get_tcon() is a +new record or one that's already in use. This leads to a warning about a +volume cookie collision and a leaked volume cookie because tcon->fscache +gets reset. + +Fix this be adding a mutex and a "we've already tried this" flag and only +doing it once for the lifetime of the tcon. + +[!] Note: Looking at cifs_mount_get_tcon(), a more general solution may +actually be required. Reacquiring the volume cookie isn't the only thing +that function does: it also partially reinitialises the tcon record without +any locking - which may cause live filesystem ops already using the tcon +through a previous mount to malfunction. + +This can be reproduced simply by something like: + + mount //example.com/test /xfstest.test -o user=shares,pass=xxx,fsc + mount //example.com/test /mnt -o user=shares,pass=xxx,fsc + +Fixes: 70431bfd825d ("cifs: Support fscache indexing rewrite") +Signed-off-by: David Howells +Acked-by: Paulo Alcantara (Red Hat) +cc: Shyam Prasad N +cc: linux-cifs@vger.kernel.org +cc: linux-fsdevel@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifsglob.h | 2 ++ + fs/smb/client/fscache.c | 13 +++++++++++++ + fs/smb/client/misc.c | 3 +++ + 3 files changed, 18 insertions(+) + +diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h +index 844afda090d05..0c3311de5dc0a 100644 +--- a/fs/smb/client/cifsglob.h ++++ b/fs/smb/client/cifsglob.h +@@ -1261,7 +1261,9 @@ struct cifs_tcon { + __u32 max_cached_dirs; + #ifdef CONFIG_CIFS_FSCACHE + u64 resource_id; /* server resource id */ ++ bool fscache_acquired; /* T if we've tried acquiring a cookie */ + struct fscache_volume *fscache; /* cookie for share */ ++ struct mutex fscache_lock; /* Prevent regetting a cookie */ + #endif + struct list_head pending_opens; /* list of incomplete opens */ + struct cached_fids *cfids; +diff --git a/fs/smb/client/fscache.c b/fs/smb/client/fscache.c +index 340efce8f0529..113bde8f1e613 100644 +--- a/fs/smb/client/fscache.c ++++ b/fs/smb/client/fscache.c +@@ -43,12 +43,23 @@ int cifs_fscache_get_super_cookie(struct cifs_tcon *tcon) + char *key; + int ret = -ENOMEM; + ++ if (tcon->fscache_acquired) ++ return 0; ++ ++ mutex_lock(&tcon->fscache_lock); ++ if (tcon->fscache_acquired) { ++ mutex_unlock(&tcon->fscache_lock); ++ return 0; ++ } ++ tcon->fscache_acquired = true; ++ + tcon->fscache = NULL; + switch (sa->sa_family) { + case AF_INET: + case AF_INET6: + break; + default: ++ mutex_unlock(&tcon->fscache_lock); + cifs_dbg(VFS, "Unknown network family '%d'\n", sa->sa_family); + return -EINVAL; + } +@@ -57,6 +68,7 @@ int cifs_fscache_get_super_cookie(struct cifs_tcon *tcon) + + sharename = extract_sharename(tcon->tree_name); + if (IS_ERR(sharename)) { ++ mutex_unlock(&tcon->fscache_lock); + cifs_dbg(FYI, "%s: couldn't extract sharename\n", __func__); + return PTR_ERR(sharename); + } +@@ -90,6 +102,7 @@ int cifs_fscache_get_super_cookie(struct cifs_tcon *tcon) + kfree(key); + out: + kfree(sharename); ++ mutex_unlock(&tcon->fscache_lock); + return ret; + } + +diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c +index 74627d647818a..0d13db80e67c9 100644 +--- a/fs/smb/client/misc.c ++++ b/fs/smb/client/misc.c +@@ -141,6 +141,9 @@ tcon_info_alloc(bool dir_leases_enabled) + atomic_set(&ret_buf->num_local_opens, 0); + atomic_set(&ret_buf->num_remote_opens, 0); + ret_buf->stats_from_time = ktime_get_real_seconds(); ++#ifdef CONFIG_CIFS_FSCACHE ++ mutex_init(&ret_buf->fscache_lock); ++#endif + + return ret_buf; + } +-- +2.43.0 + diff --git a/queue-6.8/cifs-reinstate-original-behavior-again-for-forceuid-.patch b/queue-6.8/cifs-reinstate-original-behavior-again-for-forceuid-.patch new file mode 100644 index 00000000000..b6ef5309efd --- /dev/null +++ b/queue-6.8/cifs-reinstate-original-behavior-again-for-forceuid-.patch @@ -0,0 +1,82 @@ +From 1f1742f5d55afd1ab5b41661c334aba10245f696 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 16:47:49 +0900 +Subject: cifs: reinstate original behavior again for forceuid/forcegid + +From: Takayuki Nagata + +[ Upstream commit 77d8aa79ecfb209308e0644c02f655122b31def7 ] + +forceuid/forcegid should be enabled by default when uid=/gid= options are +specified, but commit 24e0a1eff9e2 ("cifs: switch to new mount api") +changed the behavior. Due to the change, a mounted share does not show +intentional uid/gid for files and directories even though uid=/gid= +options are specified since forceuid/forcegid are not enabled. + +This patch reinstates original behavior that overrides uid/gid with +specified uid/gid by the options. + +Fixes: 24e0a1eff9e2 ("cifs: switch to new mount api") +Signed-off-by: Takayuki Nagata +Acked-by: Paulo Alcantara (Red Hat) +Acked-by: Ronnie Sahlberg +Acked-by: Tom Talpey +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/fs_context.c | 12 ++++++++++++ + fs/smb/client/fs_context.h | 2 ++ + 2 files changed, 14 insertions(+) + +diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c +index d9fe17b2ba375..775b0ca605892 100644 +--- a/fs/smb/client/fs_context.c ++++ b/fs/smb/client/fs_context.c +@@ -715,6 +715,16 @@ static int smb3_fs_context_validate(struct fs_context *fc) + /* set the port that we got earlier */ + cifs_set_port((struct sockaddr *)&ctx->dstaddr, ctx->port); + ++ if (ctx->uid_specified && !ctx->forceuid_specified) { ++ ctx->override_uid = 1; ++ pr_notice("enabling forceuid mount option implicitly because uid= option is specified\n"); ++ } ++ ++ if (ctx->gid_specified && !ctx->forcegid_specified) { ++ ctx->override_gid = 1; ++ pr_notice("enabling forcegid mount option implicitly because gid= option is specified\n"); ++ } ++ + if (ctx->override_uid && !ctx->uid_specified) { + ctx->override_uid = 0; + pr_notice("ignoring forceuid mount option specified with no uid= option\n"); +@@ -984,12 +994,14 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, + ctx->override_uid = 0; + else + ctx->override_uid = 1; ++ ctx->forceuid_specified = true; + break; + case Opt_forcegid: + if (result.negated) + ctx->override_gid = 0; + else + ctx->override_gid = 1; ++ ctx->forcegid_specified = true; + break; + case Opt_perm: + if (result.negated) +diff --git a/fs/smb/client/fs_context.h b/fs/smb/client/fs_context.h +index b3d51b345eaef..61776572b8d2d 100644 +--- a/fs/smb/client/fs_context.h ++++ b/fs/smb/client/fs_context.h +@@ -156,6 +156,8 @@ enum cifs_param { + }; + + struct smb3_fs_context { ++ bool forceuid_specified; ++ bool forcegid_specified; + bool uid_specified; + bool cruid_specified; + bool gid_specified; +-- +2.43.0 + diff --git a/queue-6.8/cxl-core-fix-potential-payload-size-confusion-in-cxl.patch b/queue-6.8/cxl-core-fix-potential-payload-size-confusion-in-cxl.patch new file mode 100644 index 00000000000..42ef1fc729b --- /dev/null +++ b/queue-6.8/cxl-core-fix-potential-payload-size-confusion-in-cxl.patch @@ -0,0 +1,120 @@ +From 0fef208b16962a938cb34e4524048c4784966aa0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2024 15:00:16 -0700 +Subject: cxl/core: Fix potential payload size confusion in + cxl_mem_get_poison() + +From: Dan Williams + +[ Upstream commit 4b759dd5765503bd466defac7d93aca14c23a15d ] + +A recent change to cxl_mem_get_records_log() [1] highlighted a subtle +nuance of looping calls to cxl_internal_send_cmd(), i.e. that +cxl_internal_send_cmd() modifies the 'size_out' member of the @mbox_cmd +argument. That mechanism is useful for communicating underflow, but it +is unwanted when reusing @mbox_cmd for a subsequent submission. It turns +out that cxl_xfer_log() avoids this scenario by always redefining +@mbox_cmd each iteration. + +Update cxl_mem_get_records_log() and cxl_mem_get_poison() to follow the +same style as cxl_xfer_log(), i.e. re-define @mbox_cmd each iteration. +The cxl_mem_get_records_log() change is just a style fixup, but the +cxl_mem_get_poison() change is a potential fix, per Alison [2]: + + Poison list retrieval can hit this case if the MORE flag is set and + a follow on read of the list delivers more records than the previous + read. ie. device gives one record, sets the _MORE flag, then gives 5. + +Not an urgent fix since this behavior has not been seen in the wild, +but worth tracking as a fix. + +Cc: Kwangjin Ko +Cc: Alison Schofield +Fixes: ed83f7ca398b ("cxl/mbox: Add GET_POISON_LIST mailbox command") +Link: http://lore.kernel.org/r/20240402081404.1106-2-kwangjin.ko@sk.com [1] +Link: http://lore.kernel.org/r/ZhAhAL/GOaWFrauw@aschofie-mobl2 [2] +Signed-off-by: Dan Williams +Reviewed-by: Ira Weiny +Reviewed-by: Alison Schofield +Link: https://lore.kernel.org/r/171235441633.2716581.12330082428680958635.stgit@dwillia2-xfh.jf.intel.com +Signed-off-by: Dave Jiang +Signed-off-by: Sasha Levin +--- + drivers/cxl/core/mbox.c | 38 +++++++++++++++++--------------------- + 1 file changed, 17 insertions(+), 21 deletions(-) + +diff --git a/drivers/cxl/core/mbox.c b/drivers/cxl/core/mbox.c +index f0f54aeccc872..65185c9fa0013 100644 +--- a/drivers/cxl/core/mbox.c ++++ b/drivers/cxl/core/mbox.c +@@ -946,25 +946,22 @@ static void cxl_mem_get_records_log(struct cxl_memdev_state *mds, + struct cxl_memdev *cxlmd = mds->cxlds.cxlmd; + struct device *dev = mds->cxlds.dev; + struct cxl_get_event_payload *payload; +- struct cxl_mbox_cmd mbox_cmd; + u8 log_type = type; + u16 nr_rec; + + mutex_lock(&mds->event.log_lock); + payload = mds->event.buf; + +- mbox_cmd = (struct cxl_mbox_cmd) { +- .opcode = CXL_MBOX_OP_GET_EVENT_RECORD, +- .payload_in = &log_type, +- .size_in = sizeof(log_type), +- .payload_out = payload, +- .min_out = struct_size(payload, records, 0), +- }; +- + do { + int rc, i; +- +- mbox_cmd.size_out = mds->payload_size; ++ struct cxl_mbox_cmd mbox_cmd = (struct cxl_mbox_cmd) { ++ .opcode = CXL_MBOX_OP_GET_EVENT_RECORD, ++ .payload_in = &log_type, ++ .size_in = sizeof(log_type), ++ .payload_out = payload, ++ .size_out = mds->payload_size, ++ .min_out = struct_size(payload, records, 0), ++ }; + + rc = cxl_internal_send_cmd(mds, &mbox_cmd); + if (rc) { +@@ -1297,7 +1294,6 @@ int cxl_mem_get_poison(struct cxl_memdev *cxlmd, u64 offset, u64 len, + struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlmd->cxlds); + struct cxl_mbox_poison_out *po; + struct cxl_mbox_poison_in pi; +- struct cxl_mbox_cmd mbox_cmd; + int nr_records = 0; + int rc; + +@@ -1309,16 +1305,16 @@ int cxl_mem_get_poison(struct cxl_memdev *cxlmd, u64 offset, u64 len, + pi.offset = cpu_to_le64(offset); + pi.length = cpu_to_le64(len / CXL_POISON_LEN_MULT); + +- mbox_cmd = (struct cxl_mbox_cmd) { +- .opcode = CXL_MBOX_OP_GET_POISON, +- .size_in = sizeof(pi), +- .payload_in = &pi, +- .size_out = mds->payload_size, +- .payload_out = po, +- .min_out = struct_size(po, record, 0), +- }; +- + do { ++ struct cxl_mbox_cmd mbox_cmd = (struct cxl_mbox_cmd){ ++ .opcode = CXL_MBOX_OP_GET_POISON, ++ .size_in = sizeof(pi), ++ .payload_in = &pi, ++ .size_out = mds->payload_size, ++ .payload_out = po, ++ .min_out = struct_size(po, record, 0), ++ }; ++ + rc = cxl_internal_send_cmd(mds, &mbox_cmd); + if (rc) + break; +-- +2.43.0 + diff --git a/queue-6.8/dpll-check-that-pin-is-registered-in-__dpll_pin_unre.patch b/queue-6.8/dpll-check-that-pin-is-registered-in-__dpll_pin_unre.patch new file mode 100644 index 00000000000..6fa58ff6724 --- /dev/null +++ b/queue-6.8/dpll-check-that-pin-is-registered-in-__dpll_pin_unre.patch @@ -0,0 +1,48 @@ +From 642db0169440e485a2daa0406dbf8b37252fa629 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Feb 2024 08:48:53 +0100 +Subject: dpll: check that pin is registered in __dpll_pin_unregister() + +From: Jiri Pirko + +[ Upstream commit 9736c648370d237f61065a7e45e668e2db4374e9 ] + +Similar to what is done in dpll_device_unregister(), add assertion to +__dpll_pin_unregister() to make sure driver does not try to unregister +non-registered pin. + +Signed-off-by: Jiri Pirko +Reviewed-by: Vadim Fedorenko +Reviewed-by: Arkadiusz Kubalewski +Link: https://lore.kernel.org/r/20240206074853.345744-1-jiri@resnulli.us +Signed-off-by: Jakub Kicinski +Stable-dep-of: 38d7b94e81d0 ("dpll: fix dpll_pin_on_pin_register() for multiple parent pins") +Signed-off-by: Sasha Levin +--- + drivers/dpll/dpll_core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/dpll/dpll_core.c b/drivers/dpll/dpll_core.c +index c751a87c7a8e6..3e6282937e35c 100644 +--- a/drivers/dpll/dpll_core.c ++++ b/drivers/dpll/dpll_core.c +@@ -29,6 +29,8 @@ static u32 dpll_pin_xa_id; + WARN_ON_ONCE(!xa_get_mark(&dpll_device_xa, (d)->id, DPLL_REGISTERED)) + #define ASSERT_DPLL_NOT_REGISTERED(d) \ + WARN_ON_ONCE(xa_get_mark(&dpll_device_xa, (d)->id, DPLL_REGISTERED)) ++#define ASSERT_DPLL_PIN_REGISTERED(p) \ ++ WARN_ON_ONCE(!xa_get_mark(&dpll_pin_xa, (p)->id, DPLL_REGISTERED)) + + struct dpll_device_registration { + struct list_head list; +@@ -651,6 +653,7 @@ static void + __dpll_pin_unregister(struct dpll_device *dpll, struct dpll_pin *pin, + const struct dpll_pin_ops *ops, void *priv) + { ++ ASSERT_DPLL_PIN_REGISTERED(pin); + dpll_xa_ref_pin_del(&dpll->pin_refs, pin, ops, priv); + dpll_xa_ref_dpll_del(&pin->dpll_refs, dpll, ops, priv); + if (xa_empty(&pin->dpll_refs)) +-- +2.43.0 + diff --git a/queue-6.8/dpll-fix-dpll_pin_on_pin_register-for-multiple-paren.patch b/queue-6.8/dpll-fix-dpll_pin_on_pin_register-for-multiple-paren.patch new file mode 100644 index 00000000000..7cdf51aa11e --- /dev/null +++ b/queue-6.8/dpll-fix-dpll_pin_on_pin_register-for-multiple-paren.patch @@ -0,0 +1,272 @@ +From aba49cf6388da87ae49abe7c9eaf967c078ca4a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 12:16:36 +0200 +Subject: dpll: fix dpll_pin_on_pin_register() for multiple parent pins + +From: Arkadiusz Kubalewski + +[ Upstream commit 38d7b94e81d068b8d8c8392f421cfd2c3bbfd1a6 ] + +In scenario where pin is registered with multiple parent pins via +dpll_pin_on_pin_register(..), all belonging to the same dpll device. +A second call to dpll_pin_on_pin_unregister(..) would cause a call trace, +as it tries to use already released registration resources (due to fix +introduced in b446631f355e). In this scenario pin was registered twice, +so resources are not yet expected to be release until each registered +pin/pin pair is unregistered. + +Currently, the following crash/call trace is produced when ice driver is +removed on the system with installed E810T NIC which includes dpll device: + +WARNING: CPU: 51 PID: 9155 at drivers/dpll/dpll_core.c:809 dpll_pin_ops+0x20/0x30 +RIP: 0010:dpll_pin_ops+0x20/0x30 +Call Trace: + ? __warn+0x7f/0x130 + ? dpll_pin_ops+0x20/0x30 + dpll_msg_add_pin_freq+0x37/0x1d0 + dpll_cmd_pin_get_one+0x1c0/0x400 + ? __nlmsg_put+0x63/0x80 + dpll_pin_event_send+0x93/0x140 + dpll_pin_on_pin_unregister+0x3f/0x100 + ice_dpll_deinit_pins+0xa1/0x230 [ice] + ice_remove+0xf1/0x210 [ice] + +Fix by adding a parent pointer as a cookie when creating a registration, +also when searching for it. For the regular pins pass NULL, this allows to +create separated registration for each parent the pin is registered with. + +Fixes: b446631f355e ("dpll: fix dpll_xa_ref_*_del() for multiple registrations") +Signed-off-by: Arkadiusz Kubalewski +Reviewed-by: Jiri Pirko +Link: https://lore.kernel.org/r/20240424101636.1491424-1-arkadiusz.kubalewski@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/dpll/dpll_core.c | 58 +++++++++++++++++++++++----------------- + 1 file changed, 33 insertions(+), 25 deletions(-) + +diff --git a/drivers/dpll/dpll_core.c b/drivers/dpll/dpll_core.c +index 3e6282937e35c..a6856730ca90f 100644 +--- a/drivers/dpll/dpll_core.c ++++ b/drivers/dpll/dpll_core.c +@@ -42,6 +42,7 @@ struct dpll_pin_registration { + struct list_head list; + const struct dpll_pin_ops *ops; + void *priv; ++ void *cookie; + }; + + struct dpll_device *dpll_device_get_by_id(int id) +@@ -54,12 +55,14 @@ struct dpll_device *dpll_device_get_by_id(int id) + + static struct dpll_pin_registration * + dpll_pin_registration_find(struct dpll_pin_ref *ref, +- const struct dpll_pin_ops *ops, void *priv) ++ const struct dpll_pin_ops *ops, void *priv, ++ void *cookie) + { + struct dpll_pin_registration *reg; + + list_for_each_entry(reg, &ref->registration_list, list) { +- if (reg->ops == ops && reg->priv == priv) ++ if (reg->ops == ops && reg->priv == priv && ++ reg->cookie == cookie) + return reg; + } + return NULL; +@@ -67,7 +70,8 @@ dpll_pin_registration_find(struct dpll_pin_ref *ref, + + static int + dpll_xa_ref_pin_add(struct xarray *xa_pins, struct dpll_pin *pin, +- const struct dpll_pin_ops *ops, void *priv) ++ const struct dpll_pin_ops *ops, void *priv, ++ void *cookie) + { + struct dpll_pin_registration *reg; + struct dpll_pin_ref *ref; +@@ -78,7 +82,7 @@ dpll_xa_ref_pin_add(struct xarray *xa_pins, struct dpll_pin *pin, + xa_for_each(xa_pins, i, ref) { + if (ref->pin != pin) + continue; +- reg = dpll_pin_registration_find(ref, ops, priv); ++ reg = dpll_pin_registration_find(ref, ops, priv, cookie); + if (reg) { + refcount_inc(&ref->refcount); + return 0; +@@ -111,6 +115,7 @@ dpll_xa_ref_pin_add(struct xarray *xa_pins, struct dpll_pin *pin, + } + reg->ops = ops; + reg->priv = priv; ++ reg->cookie = cookie; + if (ref_exists) + refcount_inc(&ref->refcount); + list_add_tail(®->list, &ref->registration_list); +@@ -119,7 +124,8 @@ dpll_xa_ref_pin_add(struct xarray *xa_pins, struct dpll_pin *pin, + } + + static int dpll_xa_ref_pin_del(struct xarray *xa_pins, struct dpll_pin *pin, +- const struct dpll_pin_ops *ops, void *priv) ++ const struct dpll_pin_ops *ops, void *priv, ++ void *cookie) + { + struct dpll_pin_registration *reg; + struct dpll_pin_ref *ref; +@@ -128,7 +134,7 @@ static int dpll_xa_ref_pin_del(struct xarray *xa_pins, struct dpll_pin *pin, + xa_for_each(xa_pins, i, ref) { + if (ref->pin != pin) + continue; +- reg = dpll_pin_registration_find(ref, ops, priv); ++ reg = dpll_pin_registration_find(ref, ops, priv, cookie); + if (WARN_ON(!reg)) + return -EINVAL; + list_del(®->list); +@@ -146,7 +152,7 @@ static int dpll_xa_ref_pin_del(struct xarray *xa_pins, struct dpll_pin *pin, + + static int + dpll_xa_ref_dpll_add(struct xarray *xa_dplls, struct dpll_device *dpll, +- const struct dpll_pin_ops *ops, void *priv) ++ const struct dpll_pin_ops *ops, void *priv, void *cookie) + { + struct dpll_pin_registration *reg; + struct dpll_pin_ref *ref; +@@ -157,7 +163,7 @@ dpll_xa_ref_dpll_add(struct xarray *xa_dplls, struct dpll_device *dpll, + xa_for_each(xa_dplls, i, ref) { + if (ref->dpll != dpll) + continue; +- reg = dpll_pin_registration_find(ref, ops, priv); ++ reg = dpll_pin_registration_find(ref, ops, priv, cookie); + if (reg) { + refcount_inc(&ref->refcount); + return 0; +@@ -190,6 +196,7 @@ dpll_xa_ref_dpll_add(struct xarray *xa_dplls, struct dpll_device *dpll, + } + reg->ops = ops; + reg->priv = priv; ++ reg->cookie = cookie; + if (ref_exists) + refcount_inc(&ref->refcount); + list_add_tail(®->list, &ref->registration_list); +@@ -199,7 +206,7 @@ dpll_xa_ref_dpll_add(struct xarray *xa_dplls, struct dpll_device *dpll, + + static void + dpll_xa_ref_dpll_del(struct xarray *xa_dplls, struct dpll_device *dpll, +- const struct dpll_pin_ops *ops, void *priv) ++ const struct dpll_pin_ops *ops, void *priv, void *cookie) + { + struct dpll_pin_registration *reg; + struct dpll_pin_ref *ref; +@@ -208,7 +215,7 @@ dpll_xa_ref_dpll_del(struct xarray *xa_dplls, struct dpll_device *dpll, + xa_for_each(xa_dplls, i, ref) { + if (ref->dpll != dpll) + continue; +- reg = dpll_pin_registration_find(ref, ops, priv); ++ reg = dpll_pin_registration_find(ref, ops, priv, cookie); + if (WARN_ON(!reg)) + return; + list_del(®->list); +@@ -594,14 +601,14 @@ EXPORT_SYMBOL_GPL(dpll_pin_put); + + static int + __dpll_pin_register(struct dpll_device *dpll, struct dpll_pin *pin, +- const struct dpll_pin_ops *ops, void *priv) ++ const struct dpll_pin_ops *ops, void *priv, void *cookie) + { + int ret; + +- ret = dpll_xa_ref_pin_add(&dpll->pin_refs, pin, ops, priv); ++ ret = dpll_xa_ref_pin_add(&dpll->pin_refs, pin, ops, priv, cookie); + if (ret) + return ret; +- ret = dpll_xa_ref_dpll_add(&pin->dpll_refs, dpll, ops, priv); ++ ret = dpll_xa_ref_dpll_add(&pin->dpll_refs, dpll, ops, priv, cookie); + if (ret) + goto ref_pin_del; + xa_set_mark(&dpll_pin_xa, pin->id, DPLL_REGISTERED); +@@ -610,7 +617,7 @@ __dpll_pin_register(struct dpll_device *dpll, struct dpll_pin *pin, + return ret; + + ref_pin_del: +- dpll_xa_ref_pin_del(&dpll->pin_refs, pin, ops, priv); ++ dpll_xa_ref_pin_del(&dpll->pin_refs, pin, ops, priv, cookie); + return ret; + } + +@@ -642,7 +649,7 @@ dpll_pin_register(struct dpll_device *dpll, struct dpll_pin *pin, + dpll->clock_id == pin->clock_id))) + ret = -EINVAL; + else +- ret = __dpll_pin_register(dpll, pin, ops, priv); ++ ret = __dpll_pin_register(dpll, pin, ops, priv, NULL); + mutex_unlock(&dpll_lock); + + return ret; +@@ -651,11 +658,11 @@ EXPORT_SYMBOL_GPL(dpll_pin_register); + + static void + __dpll_pin_unregister(struct dpll_device *dpll, struct dpll_pin *pin, +- const struct dpll_pin_ops *ops, void *priv) ++ const struct dpll_pin_ops *ops, void *priv, void *cookie) + { + ASSERT_DPLL_PIN_REGISTERED(pin); +- dpll_xa_ref_pin_del(&dpll->pin_refs, pin, ops, priv); +- dpll_xa_ref_dpll_del(&pin->dpll_refs, dpll, ops, priv); ++ dpll_xa_ref_pin_del(&dpll->pin_refs, pin, ops, priv, cookie); ++ dpll_xa_ref_dpll_del(&pin->dpll_refs, dpll, ops, priv, cookie); + if (xa_empty(&pin->dpll_refs)) + xa_clear_mark(&dpll_pin_xa, pin->id, DPLL_REGISTERED); + } +@@ -680,7 +687,7 @@ void dpll_pin_unregister(struct dpll_device *dpll, struct dpll_pin *pin, + + mutex_lock(&dpll_lock); + dpll_pin_delete_ntf(pin); +- __dpll_pin_unregister(dpll, pin, ops, priv); ++ __dpll_pin_unregister(dpll, pin, ops, priv, NULL); + mutex_unlock(&dpll_lock); + } + EXPORT_SYMBOL_GPL(dpll_pin_unregister); +@@ -716,12 +723,12 @@ int dpll_pin_on_pin_register(struct dpll_pin *parent, struct dpll_pin *pin, + return -EINVAL; + + mutex_lock(&dpll_lock); +- ret = dpll_xa_ref_pin_add(&pin->parent_refs, parent, ops, priv); ++ ret = dpll_xa_ref_pin_add(&pin->parent_refs, parent, ops, priv, pin); + if (ret) + goto unlock; + refcount_inc(&pin->refcount); + xa_for_each(&parent->dpll_refs, i, ref) { +- ret = __dpll_pin_register(ref->dpll, pin, ops, priv); ++ ret = __dpll_pin_register(ref->dpll, pin, ops, priv, parent); + if (ret) { + stop = i; + goto dpll_unregister; +@@ -735,11 +742,12 @@ int dpll_pin_on_pin_register(struct dpll_pin *parent, struct dpll_pin *pin, + dpll_unregister: + xa_for_each(&parent->dpll_refs, i, ref) + if (i < stop) { +- __dpll_pin_unregister(ref->dpll, pin, ops, priv); ++ __dpll_pin_unregister(ref->dpll, pin, ops, priv, ++ parent); + dpll_pin_delete_ntf(pin); + } + refcount_dec(&pin->refcount); +- dpll_xa_ref_pin_del(&pin->parent_refs, parent, ops, priv); ++ dpll_xa_ref_pin_del(&pin->parent_refs, parent, ops, priv, pin); + unlock: + mutex_unlock(&dpll_lock); + return ret; +@@ -764,10 +772,10 @@ void dpll_pin_on_pin_unregister(struct dpll_pin *parent, struct dpll_pin *pin, + + mutex_lock(&dpll_lock); + dpll_pin_delete_ntf(pin); +- dpll_xa_ref_pin_del(&pin->parent_refs, parent, ops, priv); ++ dpll_xa_ref_pin_del(&pin->parent_refs, parent, ops, priv, pin); + refcount_dec(&pin->refcount); + xa_for_each(&pin->dpll_refs, i, ref) +- __dpll_pin_unregister(ref->dpll, pin, ops, priv); ++ __dpll_pin_unregister(ref->dpll, pin, ops, priv, parent); + mutex_unlock(&dpll_lock); + } + EXPORT_SYMBOL_GPL(dpll_pin_on_pin_unregister); +-- +2.43.0 + diff --git a/queue-6.8/drm-gma500-remove-lid-code.patch b/queue-6.8/drm-gma500-remove-lid-code.patch new file mode 100644 index 00000000000..269e2857441 --- /dev/null +++ b/queue-6.8/drm-gma500-remove-lid-code.patch @@ -0,0 +1,193 @@ +From 3dbe36e7255f1c7f9173a99d433752dadce7db68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 13:27:31 +0200 +Subject: drm/gma500: Remove lid code + +From: Patrik Jakobsson + +[ Upstream commit 6aff4c26ed677b1f464f721fbd3e7767f24a684d ] + +Due to a change in the order of initialization, the lid timer got +started before proper setup was made. This resulted in a crash during +boot. + +The lid switch is handled by gma500 through a timer that periodically +polls the opregion for changes. These types of ACPI events shouldn't be +handled by the graphics driver so let's get rid of the lid code. This +fixes the crash during boot. + +Reported-by: Enrico Bartky +Fixes: 8f1aaccb04b7 ("drm/gma500: Implement client-based fbdev emulation") +Tested-by: Enrico Bartky +Signed-off-by: Patrik Jakobsson +Reviewed-by: Thomas Zimmermann +Signed-off-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/20240415112731.31841-1-patrik.r.jakobsson@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/gma500/Makefile | 1 - + drivers/gpu/drm/gma500/psb_device.c | 5 +- + drivers/gpu/drm/gma500/psb_drv.h | 9 ---- + drivers/gpu/drm/gma500/psb_lid.c | 80 ----------------------------- + 4 files changed, 1 insertion(+), 94 deletions(-) + delete mode 100644 drivers/gpu/drm/gma500/psb_lid.c + +diff --git a/drivers/gpu/drm/gma500/Makefile b/drivers/gpu/drm/gma500/Makefile +index 4f302cd5e1a6c..58fed80c7392a 100644 +--- a/drivers/gpu/drm/gma500/Makefile ++++ b/drivers/gpu/drm/gma500/Makefile +@@ -34,7 +34,6 @@ gma500_gfx-y += \ + psb_intel_lvds.o \ + psb_intel_modes.o \ + psb_intel_sdvo.o \ +- psb_lid.o \ + psb_irq.o + + gma500_gfx-$(CONFIG_ACPI) += opregion.o +diff --git a/drivers/gpu/drm/gma500/psb_device.c b/drivers/gpu/drm/gma500/psb_device.c +index dcfcd7b89d4a1..6dece8f0e380f 100644 +--- a/drivers/gpu/drm/gma500/psb_device.c ++++ b/drivers/gpu/drm/gma500/psb_device.c +@@ -73,8 +73,7 @@ static int psb_backlight_setup(struct drm_device *dev) + } + + psb_intel_lvds_set_brightness(dev, PSB_MAX_BRIGHTNESS); +- /* This must occur after the backlight is properly initialised */ +- psb_lid_timer_init(dev_priv); ++ + return 0; + } + +@@ -259,8 +258,6 @@ static int psb_chip_setup(struct drm_device *dev) + + static void psb_chip_teardown(struct drm_device *dev) + { +- struct drm_psb_private *dev_priv = to_drm_psb_private(dev); +- psb_lid_timer_takedown(dev_priv); + gma_intel_teardown_gmbus(dev); + } + +diff --git a/drivers/gpu/drm/gma500/psb_drv.h b/drivers/gpu/drm/gma500/psb_drv.h +index c5edfa4aa4ccd..83c17689c454f 100644 +--- a/drivers/gpu/drm/gma500/psb_drv.h ++++ b/drivers/gpu/drm/gma500/psb_drv.h +@@ -162,7 +162,6 @@ + #define PSB_NUM_VBLANKS 2 + + #define PSB_WATCHDOG_DELAY (HZ * 2) +-#define PSB_LID_DELAY (HZ / 10) + + #define PSB_MAX_BRIGHTNESS 100 + +@@ -491,11 +490,7 @@ struct drm_psb_private { + /* Hotplug handling */ + struct work_struct hotplug_work; + +- /* LID-Switch */ +- spinlock_t lid_lock; +- struct timer_list lid_timer; + struct psb_intel_opregion opregion; +- u32 lid_last_state; + + /* Watchdog */ + uint32_t apm_reg; +@@ -591,10 +586,6 @@ struct psb_ops { + int i2c_bus; /* I2C bus identifier for Moorestown */ + }; + +-/* psb_lid.c */ +-extern void psb_lid_timer_init(struct drm_psb_private *dev_priv); +-extern void psb_lid_timer_takedown(struct drm_psb_private *dev_priv); +- + /* modesetting */ + extern void psb_modeset_init(struct drm_device *dev); + extern void psb_modeset_cleanup(struct drm_device *dev); +diff --git a/drivers/gpu/drm/gma500/psb_lid.c b/drivers/gpu/drm/gma500/psb_lid.c +deleted file mode 100644 +index 58a7fe3926360..0000000000000 +--- a/drivers/gpu/drm/gma500/psb_lid.c ++++ /dev/null +@@ -1,80 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0-only +-/************************************************************************** +- * Copyright (c) 2007, Intel Corporation. +- * +- * Authors: Thomas Hellstrom +- **************************************************************************/ +- +-#include +- +-#include "psb_drv.h" +-#include "psb_intel_reg.h" +-#include "psb_reg.h" +- +-static void psb_lid_timer_func(struct timer_list *t) +-{ +- struct drm_psb_private *dev_priv = from_timer(dev_priv, t, lid_timer); +- struct drm_device *dev = (struct drm_device *)&dev_priv->dev; +- struct timer_list *lid_timer = &dev_priv->lid_timer; +- unsigned long irq_flags; +- u32 __iomem *lid_state = dev_priv->opregion.lid_state; +- u32 pp_status; +- +- if (readl(lid_state) == dev_priv->lid_last_state) +- goto lid_timer_schedule; +- +- if ((readl(lid_state)) & 0x01) { +- /*lid state is open*/ +- REG_WRITE(PP_CONTROL, REG_READ(PP_CONTROL) | POWER_TARGET_ON); +- do { +- pp_status = REG_READ(PP_STATUS); +- } while ((pp_status & PP_ON) == 0 && +- (pp_status & PP_SEQUENCE_MASK) != 0); +- +- if (REG_READ(PP_STATUS) & PP_ON) { +- /*FIXME: should be backlight level before*/ +- psb_intel_lvds_set_brightness(dev, 100); +- } else { +- DRM_DEBUG("LVDS panel never powered up"); +- return; +- } +- } else { +- psb_intel_lvds_set_brightness(dev, 0); +- +- REG_WRITE(PP_CONTROL, REG_READ(PP_CONTROL) & ~POWER_TARGET_ON); +- do { +- pp_status = REG_READ(PP_STATUS); +- } while ((pp_status & PP_ON) == 0); +- } +- dev_priv->lid_last_state = readl(lid_state); +- +-lid_timer_schedule: +- spin_lock_irqsave(&dev_priv->lid_lock, irq_flags); +- if (!timer_pending(lid_timer)) { +- lid_timer->expires = jiffies + PSB_LID_DELAY; +- add_timer(lid_timer); +- } +- spin_unlock_irqrestore(&dev_priv->lid_lock, irq_flags); +-} +- +-void psb_lid_timer_init(struct drm_psb_private *dev_priv) +-{ +- struct timer_list *lid_timer = &dev_priv->lid_timer; +- unsigned long irq_flags; +- +- spin_lock_init(&dev_priv->lid_lock); +- spin_lock_irqsave(&dev_priv->lid_lock, irq_flags); +- +- timer_setup(lid_timer, psb_lid_timer_func, 0); +- +- lid_timer->expires = jiffies + PSB_LID_DELAY; +- +- add_timer(lid_timer); +- spin_unlock_irqrestore(&dev_priv->lid_lock, irq_flags); +-} +- +-void psb_lid_timer_takedown(struct drm_psb_private *dev_priv) +-{ +- del_timer_sync(&dev_priv->lid_timer); +-} +- +-- +2.43.0 + diff --git a/queue-6.8/drm-xe-call-free_gsc_pkt-only-once-on-action-add-fai.patch b/queue-6.8/drm-xe-call-free_gsc_pkt-only-once-on-action-add-fai.patch new file mode 100644 index 00000000000..7a33a17f0b8 --- /dev/null +++ b/queue-6.8/drm-xe-call-free_gsc_pkt-only-once-on-action-add-fai.patch @@ -0,0 +1,61 @@ +From a092fed727fe87fcebca86b189e8f7be480bea44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 23:42:07 +0530 +Subject: drm/xe: call free_gsc_pkt only once on action add failure + +From: Himal Prasad Ghimiray + +[ Upstream commit f38c4d224aa37fce1e3fe05db4377ef888f0737f ] + +The drmm_add_action_or_reset function automatically invokes the +action (free_gsc_pkt) in the event of a failure; therefore, there's no +necessity to call it within the return check. + +-v2 +Fix commit message. (Lucas) + +Fixes: d8b1571312b7 ("drm/xe/huc: HuC authentication via GSC") +Cc: Rodrigo Vivi +Cc: Daniele Ceraolo Spurio +Reviewed-by: Lucas De Marchi +Reviewed-by: Daniele Ceraolo Spurio +Signed-off-by: Himal Prasad Ghimiray +Link: https://patchwork.freedesktop.org/patch/msgid/20240412181211.1155732-4-himal.prasad.ghimiray@intel.com +Signed-off-by: Lucas De Marchi +(cherry picked from commit 22bf0bc04d273ca002a47de55693797b13076602) +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_huc.c | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_huc.c b/drivers/gpu/drm/xe/xe_huc.c +index eca109791c6ae..01b2d0bd26a30 100644 +--- a/drivers/gpu/drm/xe/xe_huc.c ++++ b/drivers/gpu/drm/xe/xe_huc.c +@@ -53,7 +53,6 @@ static int huc_alloc_gsc_pkt(struct xe_huc *huc) + struct xe_gt *gt = huc_to_gt(huc); + struct xe_device *xe = gt_to_xe(gt); + struct xe_bo *bo; +- int err; + + /* we use a single object for both input and output */ + bo = xe_bo_create_pin_map(xe, gt_to_tile(gt), NULL, +@@ -66,13 +65,7 @@ static int huc_alloc_gsc_pkt(struct xe_huc *huc) + + huc->gsc_pkt = bo; + +- err = drmm_add_action_or_reset(&xe->drm, free_gsc_pkt, huc); +- if (err) { +- free_gsc_pkt(&xe->drm, huc); +- return err; +- } +- +- return 0; ++ return drmm_add_action_or_reset(&xe->drm, free_gsc_pkt, huc); + } + + int xe_huc_init(struct xe_huc *huc) +-- +2.43.0 + diff --git a/queue-6.8/drm-xe-remove-sysfs-only-once-on-action-add-failure.patch b/queue-6.8/drm-xe-remove-sysfs-only-once-on-action-add-failure.patch new file mode 100644 index 00000000000..10da56e39a9 --- /dev/null +++ b/queue-6.8/drm-xe-remove-sysfs-only-once-on-action-add-failure.patch @@ -0,0 +1,109 @@ +From ac97c36fb48ce47338c4fd5966f47b709080c7a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 23:42:06 +0530 +Subject: drm/xe: Remove sysfs only once on action add failure + +From: Himal Prasad Ghimiray + +[ Upstream commit d6dab9017b7cf155e73ba5c7f498de1beb5f8e24 ] + +The drmm_add_action_or_reset function automatically invokes the action +(sysfs removal) in the event of a failure; therefore, there's no +necessity to call it within the return check. + +Modify the return type of xe_gt_ccs_mode_sysfs_init to int, allowing the +caller to pass errors up the call chain. Should sysfs creation or +drmm_add_action_or_reset fail, error propagation will prompt a driver +load abort. + +-v2 +Edit commit message (Nikula/Lucas) +use err_force_wake label instead of new. (Lucas) +Avoid unnecessary warn/error messages. (Lucas) + +Fixes: f3bc5bb4d53d ("drm/xe: Allow userspace to configure CCS mode") +Cc: Lucas De Marchi +Cc: Jani Nikula +Cc: Rodrigo Vivi +Cc: Niranjana Vishwanathapura +Reviewed-by: Lucas De Marchi +Signed-off-by: Himal Prasad Ghimiray +Link: https://patchwork.freedesktop.org/patch/msgid/20240412181211.1155732-3-himal.prasad.ghimiray@intel.com +Signed-off-by: Lucas De Marchi +(cherry picked from commit a99641e38704202ae2a97202b3d249208c9cda7f) +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_gt.c | 4 +++- + drivers/gpu/drm/xe/xe_gt_ccs_mode.c | 19 +++++++------------ + drivers/gpu/drm/xe/xe_gt_ccs_mode.h | 2 +- + 3 files changed, 11 insertions(+), 14 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_gt.c b/drivers/gpu/drm/xe/xe_gt.c +index 35474ddbaf97e..d23ee1397cf07 100644 +--- a/drivers/gpu/drm/xe/xe_gt.c ++++ b/drivers/gpu/drm/xe/xe_gt.c +@@ -384,7 +384,9 @@ static int gt_fw_domain_init(struct xe_gt *gt) + err); + + /* Initialize CCS mode sysfs after early initialization of HW engines */ +- xe_gt_ccs_mode_sysfs_init(gt); ++ err = xe_gt_ccs_mode_sysfs_init(gt); ++ if (err) ++ goto err_force_wake; + + err = xe_force_wake_put(gt_to_fw(gt), XE_FW_GT); + XE_WARN_ON(err); +diff --git a/drivers/gpu/drm/xe/xe_gt_ccs_mode.c b/drivers/gpu/drm/xe/xe_gt_ccs_mode.c +index 529fc286cd06c..396aeb5b99242 100644 +--- a/drivers/gpu/drm/xe/xe_gt_ccs_mode.c ++++ b/drivers/gpu/drm/xe/xe_gt_ccs_mode.c +@@ -167,25 +167,20 @@ static void xe_gt_ccs_mode_sysfs_fini(struct drm_device *drm, void *arg) + * and it is expected that there are no open drm clients while doing so. + * The number of available compute slices is exposed to user through a per-gt + * 'num_cslices' sysfs interface. ++ * ++ * Returns: Returns error value for failure and 0 for success. + */ +-void xe_gt_ccs_mode_sysfs_init(struct xe_gt *gt) ++int xe_gt_ccs_mode_sysfs_init(struct xe_gt *gt) + { + struct xe_device *xe = gt_to_xe(gt); + int err; + + if (!xe_gt_ccs_mode_enabled(gt)) +- return; ++ return 0; + + err = sysfs_create_files(gt->sysfs, gt_ccs_mode_attrs); +- if (err) { +- drm_warn(&xe->drm, "Sysfs creation for ccs_mode failed err: %d\n", err); +- return; +- } ++ if (err) ++ return err; + +- err = drmm_add_action_or_reset(&xe->drm, xe_gt_ccs_mode_sysfs_fini, gt); +- if (err) { +- sysfs_remove_files(gt->sysfs, gt_ccs_mode_attrs); +- drm_warn(&xe->drm, "%s: drmm_add_action_or_reset failed, err: %d\n", +- __func__, err); +- } ++ return drmm_add_action_or_reset(&xe->drm, xe_gt_ccs_mode_sysfs_fini, gt); + } +diff --git a/drivers/gpu/drm/xe/xe_gt_ccs_mode.h b/drivers/gpu/drm/xe/xe_gt_ccs_mode.h +index f39975aaaab0d..f8779852cf0d2 100644 +--- a/drivers/gpu/drm/xe/xe_gt_ccs_mode.h ++++ b/drivers/gpu/drm/xe/xe_gt_ccs_mode.h +@@ -12,7 +12,7 @@ + #include "xe_platform_types.h" + + void xe_gt_apply_ccs_mode(struct xe_gt *gt); +-void xe_gt_ccs_mode_sysfs_init(struct xe_gt *gt); ++int xe_gt_ccs_mode_sysfs_init(struct xe_gt *gt); + + static inline bool xe_gt_ccs_mode_enabled(const struct xe_gt *gt) + { +-- +2.43.0 + diff --git a/queue-6.8/eth-bnxt-fix-counting-packets-discarded-due-to-oom-a.patch b/queue-6.8/eth-bnxt-fix-counting-packets-discarded-due-to-oom-a.patch new file mode 100644 index 00000000000..469e784443a --- /dev/null +++ b/queue-6.8/eth-bnxt-fix-counting-packets-discarded-due-to-oom-a.patch @@ -0,0 +1,150 @@ +From d6cd1f467d2b682e989bfec038ad083eaa648436 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 17:21:48 -0700 +Subject: eth: bnxt: fix counting packets discarded due to OOM and netpoll + +From: Jakub Kicinski + +[ Upstream commit 730117730709992c9f6535dd7b47638ee561ec45 ] + +I added OOM and netpoll discard counters, naively assuming that +the cpr pointer is pointing to a common completion ring. +Turns out that is usually *a* completion ring but not *the* +completion ring which bnapi->cp_ring points to. bnapi->cp_ring +is where the stats are read from, so we end up reporting 0 +thru ethtool -S and qstat even though the drop events have happened. +Make 100% sure we're recording statistics in the correct structure. + +Fixes: 907fd4a294db ("bnxt: count discards due to memory allocation errors") +Reviewed-by: Michael Chan +Link: https://lore.kernel.org/r/20240424002148.3937059-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 44 ++++++++++------------- + 1 file changed, 18 insertions(+), 26 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 5b4d810748f2a..e133a412a13fc 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -1735,7 +1735,7 @@ static inline struct sk_buff *bnxt_tpa_end(struct bnxt *bp, + skb = bnxt_copy_skb(bnapi, data_ptr, len, mapping); + if (!skb) { + bnxt_abort_tpa(cpr, idx, agg_bufs); +- cpr->sw_stats.rx.rx_oom_discards += 1; ++ cpr->bnapi->cp_ring.sw_stats.rx.rx_oom_discards += 1; + return NULL; + } + } else { +@@ -1745,7 +1745,7 @@ static inline struct sk_buff *bnxt_tpa_end(struct bnxt *bp, + new_data = __bnxt_alloc_rx_frag(bp, &new_mapping, GFP_ATOMIC); + if (!new_data) { + bnxt_abort_tpa(cpr, idx, agg_bufs); +- cpr->sw_stats.rx.rx_oom_discards += 1; ++ cpr->bnapi->cp_ring.sw_stats.rx.rx_oom_discards += 1; + return NULL; + } + +@@ -1761,7 +1761,7 @@ static inline struct sk_buff *bnxt_tpa_end(struct bnxt *bp, + if (!skb) { + skb_free_frag(data); + bnxt_abort_tpa(cpr, idx, agg_bufs); +- cpr->sw_stats.rx.rx_oom_discards += 1; ++ cpr->bnapi->cp_ring.sw_stats.rx.rx_oom_discards += 1; + return NULL; + } + skb_reserve(skb, bp->rx_offset); +@@ -1772,7 +1772,7 @@ static inline struct sk_buff *bnxt_tpa_end(struct bnxt *bp, + skb = bnxt_rx_agg_pages_skb(bp, cpr, skb, idx, agg_bufs, true); + if (!skb) { + /* Page reuse already handled by bnxt_rx_pages(). */ +- cpr->sw_stats.rx.rx_oom_discards += 1; ++ cpr->bnapi->cp_ring.sw_stats.rx.rx_oom_discards += 1; + return NULL; + } + } +@@ -2051,11 +2051,8 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + u32 frag_len = bnxt_rx_agg_pages_xdp(bp, cpr, &xdp, + cp_cons, agg_bufs, + false); +- if (!frag_len) { +- cpr->sw_stats.rx.rx_oom_discards += 1; +- rc = -ENOMEM; +- goto next_rx; +- } ++ if (!frag_len) ++ goto oom_next_rx; + } + xdp_active = true; + } +@@ -2078,9 +2075,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + else + bnxt_xdp_buff_frags_free(rxr, &xdp); + } +- cpr->sw_stats.rx.rx_oom_discards += 1; +- rc = -ENOMEM; +- goto next_rx; ++ goto oom_next_rx; + } + } else { + u32 payload; +@@ -2091,29 +2086,21 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + payload = 0; + skb = bp->rx_skb_func(bp, rxr, cons, data, data_ptr, dma_addr, + payload | len); +- if (!skb) { +- cpr->sw_stats.rx.rx_oom_discards += 1; +- rc = -ENOMEM; +- goto next_rx; +- } ++ if (!skb) ++ goto oom_next_rx; + } + + if (agg_bufs) { + if (!xdp_active) { + skb = bnxt_rx_agg_pages_skb(bp, cpr, skb, cp_cons, agg_bufs, false); +- if (!skb) { +- cpr->sw_stats.rx.rx_oom_discards += 1; +- rc = -ENOMEM; +- goto next_rx; +- } ++ if (!skb) ++ goto oom_next_rx; + } else { + skb = bnxt_xdp_build_skb(bp, skb, agg_bufs, rxr->page_pool, &xdp, rxcmp1); + if (!skb) { + /* we should be able to free the old skb here */ + bnxt_xdp_buff_frags_free(rxr, &xdp); +- cpr->sw_stats.rx.rx_oom_discards += 1; +- rc = -ENOMEM; +- goto next_rx; ++ goto oom_next_rx; + } + } + } +@@ -2191,6 +2178,11 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + *raw_cons = tmp_raw_cons; + + return rc; ++ ++oom_next_rx: ++ cpr->bnapi->cp_ring.sw_stats.rx.rx_oom_discards += 1; ++ rc = -ENOMEM; ++ goto next_rx; + } + + /* In netpoll mode, if we are using a combined completion ring, we need to +@@ -2237,7 +2229,7 @@ static int bnxt_force_rx_discard(struct bnxt *bp, + } + rc = bnxt_rx_pkt(bp, cpr, raw_cons, event); + if (rc && rc != -EBUSY) +- cpr->sw_stats.rx.rx_netpoll_discards += 1; ++ cpr->bnapi->cp_ring.sw_stats.rx.rx_netpoll_discards += 1; + return rc; + } + +-- +2.43.0 + diff --git a/queue-6.8/gpio-tangier-use-correct-type-for-the-irq-chip-data.patch b/queue-6.8/gpio-tangier-use-correct-type-for-the-irq-chip-data.patch new file mode 100644 index 00000000000..647f6134f7a --- /dev/null +++ b/queue-6.8/gpio-tangier-use-correct-type-for-the-irq-chip-data.patch @@ -0,0 +1,57 @@ +From 6df86306205c5e115a93a3b87dcd0f501e562c0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Mar 2024 21:43:03 +0200 +Subject: gpio: tangier: Use correct type for the IRQ chip data + +From: Andy Shevchenko + +[ Upstream commit 7d045025a24b6336d444d359bd4312f351d017f9 ] + +IRQ chip data contains a pointer to the GPIO chip. Luckily we have +the pointers the same, but strictly speaking it's not guaranteed. +Even though, still better to fix this. + +Fixes: ccf6fd6dcc86 ("gpio: merrifield: Introduce GPIO driver to support Merrifield") +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-tangier.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpio/gpio-tangier.c b/drivers/gpio/gpio-tangier.c +index b75e0b12087ac..4b29abafecf6a 100644 +--- a/drivers/gpio/gpio-tangier.c ++++ b/drivers/gpio/gpio-tangier.c +@@ -195,7 +195,8 @@ static int tng_gpio_set_config(struct gpio_chip *chip, unsigned int offset, + + static void tng_irq_ack(struct irq_data *d) + { +- struct tng_gpio *priv = irq_data_get_irq_chip_data(d); ++ struct gpio_chip *gc = irq_data_get_irq_chip_data(d); ++ struct tng_gpio *priv = gpiochip_get_data(gc); + irq_hw_number_t gpio = irqd_to_hwirq(d); + void __iomem *gisr; + u8 shift; +@@ -227,7 +228,8 @@ static void tng_irq_unmask_mask(struct tng_gpio *priv, u32 gpio, bool unmask) + + static void tng_irq_mask(struct irq_data *d) + { +- struct tng_gpio *priv = irq_data_get_irq_chip_data(d); ++ struct gpio_chip *gc = irq_data_get_irq_chip_data(d); ++ struct tng_gpio *priv = gpiochip_get_data(gc); + irq_hw_number_t gpio = irqd_to_hwirq(d); + + tng_irq_unmask_mask(priv, gpio, false); +@@ -236,7 +238,8 @@ static void tng_irq_mask(struct irq_data *d) + + static void tng_irq_unmask(struct irq_data *d) + { +- struct tng_gpio *priv = irq_data_get_irq_chip_data(d); ++ struct gpio_chip *gc = irq_data_get_irq_chip_data(d); ++ struct tng_gpio *priv = gpiochip_get_data(gc); + irq_hw_number_t gpio = irqd_to_hwirq(d); + + gpiochip_enable_irq(&priv->chip, gpio); +-- +2.43.0 + diff --git a/queue-6.8/gpio-tegra186-fix-tegra186_gpio_is_accessible-check.patch b/queue-6.8/gpio-tegra186-fix-tegra186_gpio_is_accessible-check.patch new file mode 100644 index 00000000000..f7646f4cd78 --- /dev/null +++ b/queue-6.8/gpio-tegra186-fix-tegra186_gpio_is_accessible-check.patch @@ -0,0 +1,81 @@ +From 011e41043e3fa96ce513a00e85069098b00ded7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 15:25:14 +0530 +Subject: gpio: tegra186: Fix tegra186_gpio_is_accessible() check + +From: Prathamesh Shete + +[ Upstream commit d806f474a9a7993648a2c70642ee129316d8deff ] + +The controller has several register bits describing access control +information for a given GPIO pin. When SCR_SEC_[R|W]EN is unset, it +means we have full read/write access to all the registers for given GPIO +pin. When SCR_SEC[R|W]EN is set, it means we need to further check the +accompanying SCR_SEC_G1[R|W] bit to determine read/write access to all +the registers for given GPIO pin. + +This check was previously declaring that a GPIO pin was accessible +only if either of the following conditions were met: + + - SCR_SEC_REN + SCR_SEC_WEN both set + + or + + - SCR_SEC_REN + SCR_SEC_WEN both set and + SCR_SEC_G1R + SCR_SEC_G1W both set + +Update the check to properly handle cases where only one of +SCR_SEC_REN or SCR_SEC_WEN is set. + +Fixes: b2b56a163230 ("gpio: tegra186: Check GPIO pin permission before access.") +Signed-off-by: Prathamesh Shete +Acked-by: Thierry Reding +Link: https://lore.kernel.org/r/20240424095514.24397-1-pshete@nvidia.com +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-tegra186.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpio/gpio-tegra186.c b/drivers/gpio/gpio-tegra186.c +index d87dd06db40d0..9130c691a2dd3 100644 +--- a/drivers/gpio/gpio-tegra186.c ++++ b/drivers/gpio/gpio-tegra186.c +@@ -36,12 +36,6 @@ + #define TEGRA186_GPIO_SCR_SEC_REN BIT(27) + #define TEGRA186_GPIO_SCR_SEC_G1W BIT(9) + #define TEGRA186_GPIO_SCR_SEC_G1R BIT(1) +-#define TEGRA186_GPIO_FULL_ACCESS (TEGRA186_GPIO_SCR_SEC_WEN | \ +- TEGRA186_GPIO_SCR_SEC_REN | \ +- TEGRA186_GPIO_SCR_SEC_G1R | \ +- TEGRA186_GPIO_SCR_SEC_G1W) +-#define TEGRA186_GPIO_SCR_SEC_ENABLE (TEGRA186_GPIO_SCR_SEC_WEN | \ +- TEGRA186_GPIO_SCR_SEC_REN) + + /* control registers */ + #define TEGRA186_GPIO_ENABLE_CONFIG 0x00 +@@ -177,10 +171,18 @@ static inline bool tegra186_gpio_is_accessible(struct tegra_gpio *gpio, unsigned + + value = __raw_readl(secure + TEGRA186_GPIO_SCR); + +- if ((value & TEGRA186_GPIO_SCR_SEC_ENABLE) == 0) +- return true; ++ /* ++ * When SCR_SEC_[R|W]EN is unset, then we have full read/write access to all the ++ * registers for given GPIO pin. ++ * When SCR_SEC[R|W]EN is set, then there is need to further check the accompanying ++ * SCR_SEC_G1[R|W] bit to determine read/write access to all the registers for given ++ * GPIO pin. ++ */ + +- if ((value & TEGRA186_GPIO_FULL_ACCESS) == TEGRA186_GPIO_FULL_ACCESS) ++ if (((value & TEGRA186_GPIO_SCR_SEC_REN) == 0 || ++ ((value & TEGRA186_GPIO_SCR_SEC_REN) && (value & TEGRA186_GPIO_SCR_SEC_G1R))) && ++ ((value & TEGRA186_GPIO_SCR_SEC_WEN) == 0 || ++ ((value & TEGRA186_GPIO_SCR_SEC_WEN) && (value & TEGRA186_GPIO_SCR_SEC_G1W)))) + return true; + + return false; +-- +2.43.0 + diff --git a/queue-6.8/hid-intel-ish-hid-ipc-fix-dev_err-usage-with-uniniti.patch b/queue-6.8/hid-intel-ish-hid-ipc-fix-dev_err-usage-with-uniniti.patch new file mode 100644 index 00000000000..7a36bdf10eb --- /dev/null +++ b/queue-6.8/hid-intel-ish-hid-ipc-fix-dev_err-usage-with-uniniti.patch @@ -0,0 +1,49 @@ +From b006acf54721953161b548556c33f7615c965291 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 00:44:04 +0000 +Subject: HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized + dev->devc + +From: Zhang Lixu + +[ Upstream commit 92826905ae340b7f2b25759a06c8c60bfc476b9f ] + +The variable dev->devc in ish_dev_init was utilized by dev_err before it +was properly assigned. To rectify this, the assignment of dev->devc has +been moved to immediately follow memory allocation. + +Without this change "(NULL device *)" is printed for device information. + +Fixes: 8ae2f2b0a284 ("HID: intel-ish-hid: ipc: Fix potential use-after-free in work function") +Fixes: ae02e5d40d5f ("HID: intel-ish-hid: ipc layer") +Signed-off-by: Zhang Lixu +Acked-by: Srinivas Pandruvada +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/intel-ish-hid/ipc/ipc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hid/intel-ish-hid/ipc/ipc.c b/drivers/hid/intel-ish-hid/ipc/ipc.c +index a49c6affd7c4c..dd5fc60874ba1 100644 +--- a/drivers/hid/intel-ish-hid/ipc/ipc.c ++++ b/drivers/hid/intel-ish-hid/ipc/ipc.c +@@ -948,6 +948,7 @@ struct ishtp_device *ish_dev_init(struct pci_dev *pdev) + if (!dev) + return NULL; + ++ dev->devc = &pdev->dev; + ishtp_device_init(dev); + + init_waitqueue_head(&dev->wait_hw_ready); +@@ -983,7 +984,6 @@ struct ishtp_device *ish_dev_init(struct pci_dev *pdev) + } + + dev->ops = &ish_hw_ops; +- dev->devc = &pdev->dev; + dev->mtu = IPC_PAYLOAD_SIZE - sizeof(struct ishtp_msg_hdr); + return dev; + } +-- +2.43.0 + diff --git a/queue-6.8/hid-logitech-dj-allow-mice-to-use-all-types-of-repor.patch b/queue-6.8/hid-logitech-dj-allow-mice-to-use-all-types-of-repor.patch new file mode 100644 index 00000000000..839195f317a --- /dev/null +++ b/queue-6.8/hid-logitech-dj-allow-mice-to-use-all-types-of-repor.patch @@ -0,0 +1,39 @@ +From 1f74f301984dc35c6d207afa847f278cab447ba5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 19:54:24 +0300 +Subject: HID: logitech-dj: allow mice to use all types of reports + +From: Yaraslau Furman + +[ Upstream commit 21f28a7eb78dea6c59be6b0a5e0b47bf3d25fcbb ] + +You can bind whatever action you want to the mouse's reprogrammable +buttons using Windows application. Allow Linux to receive multimedia keycodes. + +Fixes: 3ed224e273ac ("HID: logitech-dj: Fix 064d:c52f receiver support") +Signed-off-by: Yaraslau Furman +Reviewed-by: Hans de Goede +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-logitech-dj.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c +index e6a8b6d8eab70..3c3c497b6b911 100644 +--- a/drivers/hid/hid-logitech-dj.c ++++ b/drivers/hid/hid-logitech-dj.c +@@ -965,9 +965,7 @@ static void logi_hidpp_dev_conn_notif_equad(struct hid_device *hdev, + } + break; + case REPORT_TYPE_MOUSE: +- workitem->reports_supported |= STD_MOUSE | HIDPP; +- if (djrcv_dev->type == recvr_type_mouse_only) +- workitem->reports_supported |= MULTIMEDIA; ++ workitem->reports_supported |= STD_MOUSE | HIDPP | MULTIMEDIA; + break; + } + } +-- +2.43.0 + diff --git a/queue-6.8/i40e-do-not-use-wq_mem_reclaim-flag-for-workqueue.patch b/queue-6.8/i40e-do-not-use-wq_mem_reclaim-flag-for-workqueue.patch new file mode 100644 index 00000000000..934b660a09b --- /dev/null +++ b/queue-6.8/i40e-do-not-use-wq_mem_reclaim-flag-for-workqueue.patch @@ -0,0 +1,125 @@ +From 564463d19d88738f9c91c02b8e5c16600f873eed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 11:27:17 -0700 +Subject: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue + +From: Sindhu Devale + +[ Upstream commit 2cc7d150550cc981aceedf008f5459193282425c ] + +Issue reported by customer during SRIOV testing, call trace: +When both i40e and the i40iw driver are loaded, a warning +in check_flush_dependency is being triggered. This seems +to be because of the i40e driver workqueue is allocated with +the WQ_MEM_RECLAIM flag, and the i40iw one is not. + +Similar error was encountered on ice too and it was fixed by +removing the flag. Do the same for i40e too. + +[Feb 9 09:08] ------------[ cut here ]------------ +[ +0.000004] workqueue: WQ_MEM_RECLAIM i40e:i40e_service_task [i40e] is +flushing !WQ_MEM_RECLAIM infiniband:0x0 +[ +0.000060] WARNING: CPU: 0 PID: 937 at kernel/workqueue.c:2966 +check_flush_dependency+0x10b/0x120 +[ +0.000007] Modules linked in: snd_seq_dummy snd_hrtimer snd_seq +snd_timer snd_seq_device snd soundcore nls_utf8 cifs cifs_arc4 +nls_ucs2_utils rdma_cm iw_cm ib_cm cifs_md4 dns_resolver netfs qrtr +rfkill sunrpc vfat fat intel_rapl_msr intel_rapl_common irdma +intel_uncore_frequency intel_uncore_frequency_common ice ipmi_ssif +isst_if_common skx_edac nfit libnvdimm x86_pkg_temp_thermal +intel_powerclamp gnss coretemp ib_uverbs rapl intel_cstate ib_core +iTCO_wdt iTCO_vendor_support acpi_ipmi mei_me ipmi_si intel_uncore +ioatdma i2c_i801 joydev pcspkr mei ipmi_devintf lpc_ich +intel_pch_thermal i2c_smbus ipmi_msghandler acpi_power_meter acpi_pad +xfs libcrc32c ast sd_mod drm_shmem_helper t10_pi drm_kms_helper sg ixgbe +drm i40e ahci crct10dif_pclmul libahci crc32_pclmul igb crc32c_intel +libata ghash_clmulni_intel i2c_algo_bit mdio dca wmi dm_mirror +dm_region_hash dm_log dm_mod fuse +[ +0.000050] CPU: 0 PID: 937 Comm: kworker/0:3 Kdump: loaded Not +tainted 6.8.0-rc2-Feb-net_dev-Qiueue-00279-gbd43c5687e05 #1 +[ +0.000003] Hardware name: Intel Corporation S2600BPB/S2600BPB, BIOS +SE5C620.86B.02.01.0013.121520200651 12/15/2020 +[ +0.000001] Workqueue: i40e i40e_service_task [i40e] +[ +0.000024] RIP: 0010:check_flush_dependency+0x10b/0x120 +[ +0.000003] Code: ff 49 8b 54 24 18 48 8d 8b b0 00 00 00 49 89 e8 48 +81 c6 b0 00 00 00 48 c7 c7 b0 97 fa 9f c6 05 8a cc 1f 02 01 e8 35 b3 fd +ff <0f> 0b e9 10 ff ff ff 80 3d 78 cc 1f 02 00 75 94 e9 46 ff ff ff 90 +[ +0.000002] RSP: 0018:ffffbd294976bcf8 EFLAGS: 00010282 +[ +0.000002] RAX: 0000000000000000 RBX: ffff94d4c483c000 RCX: +0000000000000027 +[ +0.000001] RDX: ffff94d47f620bc8 RSI: 0000000000000001 RDI: +ffff94d47f620bc0 +[ +0.000001] RBP: 0000000000000000 R08: 0000000000000000 R09: +00000000ffff7fff +[ +0.000001] R10: ffffbd294976bb98 R11: ffffffffa0be65e8 R12: +ffff94c5451ea180 +[ +0.000001] R13: ffff94c5ab5e8000 R14: ffff94c5c20b6e05 R15: +ffff94c5f1330ab0 +[ +0.000001] FS: 0000000000000000(0000) GS:ffff94d47f600000(0000) +knlGS:0000000000000000 +[ +0.000002] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ +0.000001] CR2: 00007f9e6f1fca70 CR3: 0000000038e20004 CR4: +00000000007706f0 +[ +0.000000] DR0: 0000000000000000 DR1: 0000000000000000 DR2: +0000000000000000 +[ +0.000001] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: +0000000000000400 +[ +0.000001] PKRU: 55555554 +[ +0.000001] Call Trace: +[ +0.000001] +[ +0.000002] ? __warn+0x80/0x130 +[ +0.000003] ? check_flush_dependency+0x10b/0x120 +[ +0.000002] ? report_bug+0x195/0x1a0 +[ +0.000005] ? handle_bug+0x3c/0x70 +[ +0.000003] ? exc_invalid_op+0x14/0x70 +[ +0.000002] ? asm_exc_invalid_op+0x16/0x20 +[ +0.000006] ? check_flush_dependency+0x10b/0x120 +[ +0.000002] ? check_flush_dependency+0x10b/0x120 +[ +0.000002] __flush_workqueue+0x126/0x3f0 +[ +0.000015] ib_cache_cleanup_one+0x1c/0xe0 [ib_core] +[ +0.000056] __ib_unregister_device+0x6a/0xb0 [ib_core] +[ +0.000023] ib_unregister_device_and_put+0x34/0x50 [ib_core] +[ +0.000020] i40iw_close+0x4b/0x90 [irdma] +[ +0.000022] i40e_notify_client_of_netdev_close+0x54/0xc0 [i40e] +[ +0.000035] i40e_service_task+0x126/0x190 [i40e] +[ +0.000024] process_one_work+0x174/0x340 +[ +0.000003] worker_thread+0x27e/0x390 +[ +0.000001] ? __pfx_worker_thread+0x10/0x10 +[ +0.000002] kthread+0xdf/0x110 +[ +0.000002] ? __pfx_kthread+0x10/0x10 +[ +0.000002] ret_from_fork+0x2d/0x50 +[ +0.000003] ? __pfx_kthread+0x10/0x10 +[ +0.000001] ret_from_fork_asm+0x1b/0x30 +[ +0.000004] +[ +0.000001] ---[ end trace 0000000000000000 ]--- + +Fixes: 4d5957cbdecd ("i40e: remove WQ_UNBOUND and the task limit of our workqueue") +Signed-off-by: Sindhu Devale +Reviewed-by: Arkadiusz Kubalewski +Reviewed-by: Mateusz Polchlopek +Signed-off-by: Aleksandr Loktionov +Tested-by: Robert Ganzynkowicz +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20240423182723.740401-2-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index bb4ab3a9576b9..4c38782d95516 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -16733,7 +16733,7 @@ static int __init i40e_init_module(void) + * since we need to be able to guarantee forward progress even under + * memory pressure. + */ +- i40e_wq = alloc_workqueue("%s", WQ_MEM_RECLAIM, 0, i40e_driver_name); ++ i40e_wq = alloc_workqueue("%s", 0, 0, i40e_driver_name); + if (!i40e_wq) { + pr_err("%s: Failed to create workqueue\n", i40e_driver_name); + return -ENOMEM; +-- +2.43.0 + diff --git a/queue-6.8/i40e-report-mfs-in-decimal-base-instead-of-hex.patch b/queue-6.8/i40e-report-mfs-in-decimal-base-instead-of-hex.patch new file mode 100644 index 00000000000..7797403ee9d --- /dev/null +++ b/queue-6.8/i40e-report-mfs-in-decimal-base-instead-of-hex.patch @@ -0,0 +1,59 @@ +From 7a2c300c9e11219d16f3d8b00d36db777367d7cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 11:27:18 -0700 +Subject: i40e: Report MFS in decimal base instead of hex + +From: Erwan Velu + +[ Upstream commit ef3c313119ea448c22da10366faa26b5b4b1a18e ] + +If the MFS is set below the default (0x2600), a warning message is +reported like the following : + + MFS for port 1 has been set below the default: 600 + +This message is a bit confusing as the number shown here (600) is in +fact an hexa number: 0x600 = 1536 + +Without any explicit "0x" prefix, this message is read like the MFS is +set to 600 bytes. + +MFS, as per MTUs, are usually expressed in decimal base. + +This commit reports both current and default MFS values in decimal +so it's less confusing for end-users. + +A typical warning message looks like the following : + + MFS for port 1 (1536) has been set below the default (9728) + +Signed-off-by: Erwan Velu +Reviewed-by: Simon Horman +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Fixes: 3a2c6ced90e1 ("i40e: Add a check to see if MFS is set") +Link: https://lore.kernel.org/r/20240423182723.740401-3-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 4c38782d95516..f3c1df46f699c 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -16186,8 +16186,8 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + val = FIELD_GET(I40E_PRTGL_SAH_MFS_MASK, + rd32(&pf->hw, I40E_PRTGL_SAH)); + if (val < MAX_FRAME_SIZE_DEFAULT) +- dev_warn(&pdev->dev, "MFS for port %x has been set below the default: %x\n", +- pf->hw.port, val); ++ dev_warn(&pdev->dev, "MFS for port %x (%d) has been set below the default (%d)\n", ++ pf->hw.port, val, MAX_FRAME_SIZE_DEFAULT); + + /* Add a filter to drop all Flow control frames from any VSI from being + * transmitted. By doing so we stop a malicious VF from sending out +-- +2.43.0 + diff --git a/queue-6.8/iavf-fix-tc-config-comparison-with-existing-adapter-.patch b/queue-6.8/iavf-fix-tc-config-comparison-with-existing-adapter-.patch new file mode 100644 index 00000000000..832b7ed1ebf --- /dev/null +++ b/queue-6.8/iavf-fix-tc-config-comparison-with-existing-adapter-.patch @@ -0,0 +1,76 @@ +From 6ae370ce1eb3dc86c9e65867b483d75f2e39d361 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 11:27:19 -0700 +Subject: iavf: Fix TC config comparison with existing adapter TC config + +From: Sudheer Mogilappagari + +[ Upstream commit 54976cf58d6168b8d15cebb395069f23b2f34b31 ] + +Same number of TCs doesn't imply that underlying TC configs are +same. The config could be different due to difference in number +of queues in each TC. Add utility function to determine if TC +configs are same. + +Fixes: d5b33d024496 ("i40evf: add ndo_setup_tc callback to i40evf") +Signed-off-by: Sudheer Mogilappagari +Tested-by: Mineri Bhange (A Contingent Worker at Intel) +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20240423182723.740401-4-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 30 ++++++++++++++++++++- + 1 file changed, 29 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 335fd13e86f71..1ff381361c29d 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -3511,6 +3511,34 @@ static void iavf_del_all_cloud_filters(struct iavf_adapter *adapter) + spin_unlock_bh(&adapter->cloud_filter_list_lock); + } + ++/** ++ * iavf_is_tc_config_same - Compare the mqprio TC config with the ++ * TC config already configured on this adapter. ++ * @adapter: board private structure ++ * @mqprio_qopt: TC config received from kernel. ++ * ++ * This function compares the TC config received from the kernel ++ * with the config already configured on the adapter. ++ * ++ * Return: True if configuration is same, false otherwise. ++ **/ ++static bool iavf_is_tc_config_same(struct iavf_adapter *adapter, ++ struct tc_mqprio_qopt *mqprio_qopt) ++{ ++ struct virtchnl_channel_info *ch = &adapter->ch_config.ch_info[0]; ++ int i; ++ ++ if (adapter->num_tc != mqprio_qopt->num_tc) ++ return false; ++ ++ for (i = 0; i < adapter->num_tc; i++) { ++ if (ch[i].count != mqprio_qopt->count[i] || ++ ch[i].offset != mqprio_qopt->offset[i]) ++ return false; ++ } ++ return true; ++} ++ + /** + * __iavf_setup_tc - configure multiple traffic classes + * @netdev: network interface device structure +@@ -3568,7 +3596,7 @@ static int __iavf_setup_tc(struct net_device *netdev, void *type_data) + if (ret) + return ret; + /* Return if same TC config is requested */ +- if (adapter->num_tc == num_tc) ++ if (iavf_is_tc_config_same(adapter, &mqprio_qopt->qopt)) + return 0; + adapter->num_tc = num_tc; + +-- +2.43.0 + diff --git a/queue-6.8/ice-fix-lag-and-vf-lock-dependency-in-ice_reset_vf.patch b/queue-6.8/ice-fix-lag-and-vf-lock-dependency-in-ice_reset_vf.patch new file mode 100644 index 00000000000..d738b856b88 --- /dev/null +++ b/queue-6.8/ice-fix-lag-and-vf-lock-dependency-in-ice_reset_vf.patch @@ -0,0 +1,184 @@ +From 98fe77152349d65bc88107557b20cd51ad221240 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 11:27:20 -0700 +Subject: ice: fix LAG and VF lock dependency in ice_reset_vf() + +From: Jacob Keller + +[ Upstream commit 96fdd1f6b4ed72a741fb0eb705c0e13049b8721f ] + +9f74a3dfcf83 ("ice: Fix VF Reset paths when interface in a failed over +aggregate"), the ice driver has acquired the LAG mutex in ice_reset_vf(). +The commit placed this lock acquisition just prior to the acquisition of +the VF configuration lock. + +If ice_reset_vf() acquires the configuration lock via the ICE_VF_RESET_LOCK +flag, this could deadlock with ice_vc_cfg_qs_msg() because it always +acquires the locks in the order of the VF configuration lock and then the +LAG mutex. + +Lockdep reports this violation almost immediately on creating and then +removing 2 VF: + +====================================================== +WARNING: possible circular locking dependency detected +6.8.0-rc6 #54 Tainted: G W O +------------------------------------------------------ +kworker/60:3/6771 is trying to acquire lock: +ff40d43e099380a0 (&vf->cfg_lock){+.+.}-{3:3}, at: ice_reset_vf+0x22f/0x4d0 [ice] + +but task is already holding lock: +ff40d43ea1961210 (&pf->lag_mutex){+.+.}-{3:3}, at: ice_reset_vf+0xb7/0x4d0 [ice] + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + +-> #1 (&pf->lag_mutex){+.+.}-{3:3}: + __lock_acquire+0x4f8/0xb40 + lock_acquire+0xd4/0x2d0 + __mutex_lock+0x9b/0xbf0 + ice_vc_cfg_qs_msg+0x45/0x690 [ice] + ice_vc_process_vf_msg+0x4f5/0x870 [ice] + __ice_clean_ctrlq+0x2b5/0x600 [ice] + ice_service_task+0x2c9/0x480 [ice] + process_one_work+0x1e9/0x4d0 + worker_thread+0x1e1/0x3d0 + kthread+0x104/0x140 + ret_from_fork+0x31/0x50 + ret_from_fork_asm+0x1b/0x30 + +-> #0 (&vf->cfg_lock){+.+.}-{3:3}: + check_prev_add+0xe2/0xc50 + validate_chain+0x558/0x800 + __lock_acquire+0x4f8/0xb40 + lock_acquire+0xd4/0x2d0 + __mutex_lock+0x9b/0xbf0 + ice_reset_vf+0x22f/0x4d0 [ice] + ice_process_vflr_event+0x98/0xd0 [ice] + ice_service_task+0x1cc/0x480 [ice] + process_one_work+0x1e9/0x4d0 + worker_thread+0x1e1/0x3d0 + kthread+0x104/0x140 + ret_from_fork+0x31/0x50 + ret_from_fork_asm+0x1b/0x30 + +other info that might help us debug this: + Possible unsafe locking scenario: + CPU0 CPU1 + ---- ---- + lock(&pf->lag_mutex); + lock(&vf->cfg_lock); + lock(&pf->lag_mutex); + lock(&vf->cfg_lock); + + *** DEADLOCK *** +4 locks held by kworker/60:3/6771: + #0: ff40d43e05428b38 ((wq_completion)ice){+.+.}-{0:0}, at: process_one_work+0x176/0x4d0 + #1: ff50d06e05197e58 ((work_completion)(&pf->serv_task)){+.+.}-{0:0}, at: process_one_work+0x176/0x4d0 + #2: ff40d43ea1960e50 (&pf->vfs.table_lock){+.+.}-{3:3}, at: ice_process_vflr_event+0x48/0xd0 [ice] + #3: ff40d43ea1961210 (&pf->lag_mutex){+.+.}-{3:3}, at: ice_reset_vf+0xb7/0x4d0 [ice] + +stack backtrace: +CPU: 60 PID: 6771 Comm: kworker/60:3 Tainted: G W O 6.8.0-rc6 #54 +Hardware name: +Workqueue: ice ice_service_task [ice] +Call Trace: + + dump_stack_lvl+0x4a/0x80 + check_noncircular+0x12d/0x150 + check_prev_add+0xe2/0xc50 + ? save_trace+0x59/0x230 + ? add_chain_cache+0x109/0x450 + validate_chain+0x558/0x800 + __lock_acquire+0x4f8/0xb40 + ? lockdep_hardirqs_on+0x7d/0x100 + lock_acquire+0xd4/0x2d0 + ? ice_reset_vf+0x22f/0x4d0 [ice] + ? lock_is_held_type+0xc7/0x120 + __mutex_lock+0x9b/0xbf0 + ? ice_reset_vf+0x22f/0x4d0 [ice] + ? ice_reset_vf+0x22f/0x4d0 [ice] + ? rcu_is_watching+0x11/0x50 + ? ice_reset_vf+0x22f/0x4d0 [ice] + ice_reset_vf+0x22f/0x4d0 [ice] + ? process_one_work+0x176/0x4d0 + ice_process_vflr_event+0x98/0xd0 [ice] + ice_service_task+0x1cc/0x480 [ice] + process_one_work+0x1e9/0x4d0 + worker_thread+0x1e1/0x3d0 + ? __pfx_worker_thread+0x10/0x10 + kthread+0x104/0x140 + ? __pfx_kthread+0x10/0x10 + ret_from_fork+0x31/0x50 + ? __pfx_kthread+0x10/0x10 + ret_from_fork_asm+0x1b/0x30 + + +To avoid deadlock, we must acquire the LAG mutex only after acquiring the +VF configuration lock. Fix the ice_reset_vf() to acquire the LAG mutex only +after we either acquire or check that the VF configuration lock is held. + +Fixes: 9f74a3dfcf83 ("ice: Fix VF Reset paths when interface in a failed over aggregate") +Signed-off-by: Jacob Keller +Reviewed-by: Dave Ertman +Reviewed-by: Mateusz Polchlopek +Tested-by: Przemek Kitszel +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20240423182723.740401-5-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_vf_lib.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_vf_lib.c b/drivers/net/ethernet/intel/ice/ice_vf_lib.c +index 2ffdae9a82dfb..15ade19de55a2 100644 +--- a/drivers/net/ethernet/intel/ice/ice_vf_lib.c ++++ b/drivers/net/ethernet/intel/ice/ice_vf_lib.c +@@ -863,6 +863,11 @@ int ice_reset_vf(struct ice_vf *vf, u32 flags) + return 0; + } + ++ if (flags & ICE_VF_RESET_LOCK) ++ mutex_lock(&vf->cfg_lock); ++ else ++ lockdep_assert_held(&vf->cfg_lock); ++ + lag = pf->lag; + mutex_lock(&pf->lag_mutex); + if (lag && lag->bonded && lag->primary) { +@@ -874,11 +879,6 @@ int ice_reset_vf(struct ice_vf *vf, u32 flags) + act_prt = ICE_LAG_INVALID_PORT; + } + +- if (flags & ICE_VF_RESET_LOCK) +- mutex_lock(&vf->cfg_lock); +- else +- lockdep_assert_held(&vf->cfg_lock); +- + if (ice_is_vf_disabled(vf)) { + vsi = ice_get_vf_vsi(vf); + if (!vsi) { +@@ -963,14 +963,14 @@ int ice_reset_vf(struct ice_vf *vf, u32 flags) + ice_mbx_clear_malvf(&vf->mbx_info); + + out_unlock: +- if (flags & ICE_VF_RESET_LOCK) +- mutex_unlock(&vf->cfg_lock); +- + if (lag && lag->bonded && lag->primary && + act_prt != ICE_LAG_INVALID_PORT) + ice_lag_move_vf_nodes_cfg(lag, pri_prt, act_prt); + mutex_unlock(&pf->lag_mutex); + ++ if (flags & ICE_VF_RESET_LOCK) ++ mutex_unlock(&vf->cfg_lock); ++ + return err; + } + +-- +2.43.0 + diff --git a/queue-6.8/icmp-prevent-possible-null-dereferences-from-icmp_bu.patch b/queue-6.8/icmp-prevent-possible-null-dereferences-from-icmp_bu.patch new file mode 100644 index 00000000000..a490d36a172 --- /dev/null +++ b/queue-6.8/icmp-prevent-possible-null-dereferences-from-icmp_bu.patch @@ -0,0 +1,74 @@ +From 32735c1982b32b0c5686f065429cf7d4e8068514 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Apr 2024 07:01:16 +0000 +Subject: icmp: prevent possible NULL dereferences from icmp_build_probe() + +From: Eric Dumazet + +[ Upstream commit c58e88d49097bd12dfcfef4f075b43f5d5830941 ] + +First problem is a double call to __in_dev_get_rcu(), because +the second one could return NULL. + +if (__in_dev_get_rcu(dev) && __in_dev_get_rcu(dev)->ifa_list) + +Second problem is a read from dev->ip6_ptr with no NULL check: + +if (!list_empty(&rcu_dereference(dev->ip6_ptr)->addr_list)) + +Use the correct RCU API to fix these. + +v2: add missing include + +Fixes: d329ea5bd884 ("icmp: add response to RFC 8335 PROBE messages") +Signed-off-by: Eric Dumazet +Cc: Andreas Roeseler +Reviewed-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/icmp.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index e63a3bf996176..437e782b9663b 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -92,6 +92,7 @@ + #include + #include + #include ++#include + + /* + * Build xmit assembly blocks +@@ -1032,6 +1033,8 @@ bool icmp_build_probe(struct sk_buff *skb, struct icmphdr *icmphdr) + struct icmp_ext_hdr *ext_hdr, _ext_hdr; + struct icmp_ext_echo_iio *iio, _iio; + struct net *net = dev_net(skb->dev); ++ struct inet6_dev *in6_dev; ++ struct in_device *in_dev; + struct net_device *dev; + char buff[IFNAMSIZ]; + u16 ident_len; +@@ -1115,10 +1118,15 @@ bool icmp_build_probe(struct sk_buff *skb, struct icmphdr *icmphdr) + /* Fill bits in reply message */ + if (dev->flags & IFF_UP) + status |= ICMP_EXT_ECHOREPLY_ACTIVE; +- if (__in_dev_get_rcu(dev) && __in_dev_get_rcu(dev)->ifa_list) ++ ++ in_dev = __in_dev_get_rcu(dev); ++ if (in_dev && rcu_access_pointer(in_dev->ifa_list)) + status |= ICMP_EXT_ECHOREPLY_IPV4; +- if (!list_empty(&rcu_dereference(dev->ip6_ptr)->addr_list)) ++ ++ in6_dev = __in6_dev_get(dev); ++ if (in6_dev && !list_empty(&in6_dev->addr_list)) + status |= ICMP_EXT_ECHOREPLY_IPV6; ++ + dev_put(dev); + icmphdr->un.echo.sequence |= htons(status); + return true; +-- +2.43.0 + diff --git a/queue-6.8/ipv4-check-for-null-idev-in-ip_route_use_hint.patch b/queue-6.8/ipv4-check-for-null-idev-in-ip_route_use_hint.patch new file mode 100644 index 00000000000..8de3ff46e0e --- /dev/null +++ b/queue-6.8/ipv4-check-for-null-idev-in-ip_route_use_hint.patch @@ -0,0 +1,83 @@ +From ee67efc5b08c46adc86d62074a9374ffa97ee843 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Apr 2024 18:43:26 +0000 +Subject: ipv4: check for NULL idev in ip_route_use_hint() + +From: Eric Dumazet + +[ Upstream commit 58a4c9b1e5a3e53c9148e80b90e1e43897ce77d1 ] + +syzbot was able to trigger a NULL deref in fib_validate_source() +in an old tree [1]. + +It appears the bug exists in latest trees. + +All calls to __in_dev_get_rcu() must be checked for a NULL result. + +[1] +general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN +KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] +CPU: 2 PID: 3257 Comm: syz-executor.3 Not tainted 5.10.0-syzkaller #0 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 + RIP: 0010:fib_validate_source+0xbf/0x15a0 net/ipv4/fib_frontend.c:425 +Code: 18 f2 f2 f2 f2 42 c7 44 20 23 f3 f3 f3 f3 48 89 44 24 78 42 c6 44 20 27 f3 e8 5d 88 48 fc 4c 89 e8 48 c1 e8 03 48 89 44 24 18 <42> 80 3c 20 00 74 08 4c 89 ef e8 d2 15 98 fc 48 89 5c 24 10 41 bf +RSP: 0018:ffffc900015fee40 EFLAGS: 00010246 +RAX: 0000000000000000 RBX: ffff88800f7a4000 RCX: ffff88800f4f90c0 +RDX: 0000000000000000 RSI: 0000000004001eac RDI: ffff8880160c64c0 +RBP: ffffc900015ff060 R08: 0000000000000000 R09: ffff88800f7a4000 +R10: 0000000000000002 R11: ffff88800f4f90c0 R12: dffffc0000000000 +R13: 0000000000000000 R14: 0000000000000000 R15: ffff88800f7a4000 +FS: 00007f938acfe6c0(0000) GS:ffff888058c00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f938acddd58 CR3: 000000001248e000 CR4: 0000000000352ef0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + ip_route_use_hint+0x410/0x9b0 net/ipv4/route.c:2231 + ip_rcv_finish_core+0x2c4/0x1a30 net/ipv4/ip_input.c:327 + ip_list_rcv_finish net/ipv4/ip_input.c:612 [inline] + ip_sublist_rcv+0x3ed/0xe50 net/ipv4/ip_input.c:638 + ip_list_rcv+0x422/0x470 net/ipv4/ip_input.c:673 + __netif_receive_skb_list_ptype net/core/dev.c:5572 [inline] + __netif_receive_skb_list_core+0x6b1/0x890 net/core/dev.c:5620 + __netif_receive_skb_list net/core/dev.c:5672 [inline] + netif_receive_skb_list_internal+0x9f9/0xdc0 net/core/dev.c:5764 + netif_receive_skb_list+0x55/0x3e0 net/core/dev.c:5816 + xdp_recv_frames net/bpf/test_run.c:257 [inline] + xdp_test_run_batch net/bpf/test_run.c:335 [inline] + bpf_test_run_xdp_live+0x1818/0x1d00 net/bpf/test_run.c:363 + bpf_prog_test_run_xdp+0x81f/0x1170 net/bpf/test_run.c:1376 + bpf_prog_test_run+0x349/0x3c0 kernel/bpf/syscall.c:3736 + __sys_bpf+0x45c/0x710 kernel/bpf/syscall.c:5115 + __do_sys_bpf kernel/bpf/syscall.c:5201 [inline] + __se_sys_bpf kernel/bpf/syscall.c:5199 [inline] + __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5199 + +Fixes: 02b24941619f ("ipv4: use dst hint for ipv4 list receive") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Acked-by: Paolo Abeni +Link: https://lore.kernel.org/r/20240421184326.1704930-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/route.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 15c37c8113fc8..f67d3d6fe9345 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -2166,6 +2166,9 @@ int ip_route_use_hint(struct sk_buff *skb, __be32 daddr, __be32 saddr, + int err = -EINVAL; + u32 tag = 0; + ++ if (!in_dev) ++ return -EINVAL; ++ + if (ipv4_is_multicast(saddr) || ipv4_is_lbcast(saddr)) + goto martian_source; + +-- +2.43.0 + diff --git a/queue-6.8/ipvs-fix-checksumming-on-gso-of-sctp-packets.patch b/queue-6.8/ipvs-fix-checksumming-on-gso-of-sctp-packets.patch new file mode 100644 index 00000000000..96a3a14a764 --- /dev/null +++ b/queue-6.8/ipvs-fix-checksumming-on-gso-of-sctp-packets.patch @@ -0,0 +1,53 @@ +From 323740727f893917f910b0605d127426f038a917 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Apr 2024 16:22:32 +0200 +Subject: ipvs: Fix checksumming on GSO of SCTP packets + +From: Ismael Luceno + +[ Upstream commit e10d3ba4d434ed172914617ed8d74bd411421193 ] + +It was observed in the wild that pairs of consecutive packets would leave +the IPVS with the same wrong checksum, and the issue only went away when +disabling GSO. + +IPVS needs to avoid computing the SCTP checksum when using GSO. + +Fixes: 90017accff61 ("sctp: Add GSO support") +Co-developed-by: Firo Yang +Signed-off-by: Ismael Luceno +Tested-by: Andreas Taschner +Acked-by: Julian Anastasov +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_proto_sctp.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c +index a0921adc31a9f..1e689c7141271 100644 +--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c ++++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c +@@ -126,7 +126,8 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, + if (sctph->source != cp->vport || payload_csum || + skb->ip_summed == CHECKSUM_PARTIAL) { + sctph->source = cp->vport; +- sctp_nat_csum(skb, sctph, sctphoff); ++ if (!skb_is_gso(skb) || !skb_is_gso_sctp(skb)) ++ sctp_nat_csum(skb, sctph, sctphoff); + } else { + skb->ip_summed = CHECKSUM_UNNECESSARY; + } +@@ -174,7 +175,8 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, + (skb->ip_summed == CHECKSUM_PARTIAL && + !(skb_dst(skb)->dev->features & NETIF_F_SCTP_CRC))) { + sctph->dest = cp->dport; +- sctp_nat_csum(skb, sctph, sctphoff); ++ if (!skb_is_gso(skb) || !skb_is_gso_sctp(skb)) ++ sctp_nat_csum(skb, sctph, sctphoff); + } else if (skb->ip_summed != CHECKSUM_PARTIAL) { + skb->ip_summed = CHECKSUM_UNNECESSARY; + } +-- +2.43.0 + diff --git a/queue-6.8/mlxsw-core-unregister-emad-trap-using-forward-action.patch b/queue-6.8/mlxsw-core-unregister-emad-trap-using-forward-action.patch new file mode 100644 index 00000000000..86efab8faaf --- /dev/null +++ b/queue-6.8/mlxsw-core-unregister-emad-trap-using-forward-action.patch @@ -0,0 +1,57 @@ +From 901396b955a7d82a30648b558e987b37bf609b82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 15:46:06 +0200 +Subject: mlxsw: core: Unregister EMAD trap using FORWARD action + +From: Ido Schimmel + +[ Upstream commit 976c44af48141cd8595601c0af2a19a43c5b228b ] + +The device's manual (PRM - Programmer's Reference Manual) classifies the +trap that is used to deliver EMAD responses as an "event trap". Among +other things, it means that the only actions that can be associated with +the trap are TRAP and FORWARD (NOP). + +Currently, during driver de-initialization the driver unregisters the +trap by setting its action to DISCARD, which violates the above +guideline. Future firmware versions will prevent such misuses by +returning an error. This does not prevent the driver from working, but +an error will be printed to the kernel log during module removal / +devlink reload: + +mlxsw_spectrum 0000:03:00.0: Reg cmd access status failed (status=7(bad parameter)) +mlxsw_spectrum 0000:03:00.0: Reg cmd access failed (reg_id=7003(hpkt),type=write) + +Suppress the error message by aligning the driver to the manual and use +a FORWARD (NOP) action when unregistering the trap. + +Fixes: 4ec14b7634b2 ("mlxsw: Add interface to access registers and process events") +Cc: Jiri Pirko +Cc: Amit Cohen +Signed-off-by: Ido Schimmel +Reviewed-by: Petr Machata +Reviewed-by: Simon Horman +Signed-off-by: Petr Machata +Link: https://lore.kernel.org/r/753a89e14008fde08cb4a2c1e5f537b81d8eb2d6.1713446092.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c +index e4d7739bd7c88..4a79c0d7e7ad8 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/core.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c +@@ -849,7 +849,7 @@ static void mlxsw_emad_rx_listener_func(struct sk_buff *skb, u16 local_port, + + static const struct mlxsw_listener mlxsw_emad_rx_listener = + MLXSW_RXL(mlxsw_emad_rx_listener_func, ETHEMAD, TRAP_TO_CPU, false, +- EMAD, DISCARD); ++ EMAD, FORWARD); + + static int mlxsw_emad_tlv_enable(struct mlxsw_core *mlxsw_core) + { +-- +2.43.0 + diff --git a/queue-6.8/mlxsw-core_env-fix-driver-initialization-with-old-fi.patch b/queue-6.8/mlxsw-core_env-fix-driver-initialization-with-old-fi.patch new file mode 100644 index 00000000000..dd470dc6d4b --- /dev/null +++ b/queue-6.8/mlxsw-core_env-fix-driver-initialization-with-old-fi.patch @@ -0,0 +1,86 @@ +From d613318e2461d984c414523b871299c221d447c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 15:46:07 +0200 +Subject: mlxsw: core_env: Fix driver initialization with old firmware + +From: Ido Schimmel + +[ Upstream commit 7e2050a8366315aeaf0316b3d362e67cf58f3ea8 ] + +The driver queries the Management Capabilities Mask (MCAM) register +during initialization to understand if it can read up to 128 bytes from +transceiver modules. + +However, not all firmware versions support this register, leading to the +driver failing to load. + +Fix by treating an error in the register query as an indication that the +feature is not supported. + +Fixes: 1f4aea1f72da ("mlxsw: core_env: Read transceiver module EEPROM in 128 bytes chunks") +Reported-by: Tim 'mithro' Ansell +Signed-off-by: Ido Schimmel +Reviewed-by: Petr Machata +Signed-off-by: Petr Machata +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/0afa8b2e8bac178f5f88211344429176dcc72281.1713446092.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlxsw/core_env.c | 20 ++++++------------- + 1 file changed, 6 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_env.c b/drivers/net/ethernet/mellanox/mlxsw/core_env.c +index 53b150b7ae4e7..6c06b05927608 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/core_env.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/core_env.c +@@ -1357,24 +1357,20 @@ static struct mlxsw_linecards_event_ops mlxsw_env_event_ops = { + .got_inactive = mlxsw_env_got_inactive, + }; + +-static int mlxsw_env_max_module_eeprom_len_query(struct mlxsw_env *mlxsw_env) ++static void mlxsw_env_max_module_eeprom_len_query(struct mlxsw_env *mlxsw_env) + { + char mcam_pl[MLXSW_REG_MCAM_LEN]; +- bool mcia_128b_supported; ++ bool mcia_128b_supported = false; + int err; + + mlxsw_reg_mcam_pack(mcam_pl, + MLXSW_REG_MCAM_FEATURE_GROUP_ENHANCED_FEATURES); + err = mlxsw_reg_query(mlxsw_env->core, MLXSW_REG(mcam), mcam_pl); +- if (err) +- return err; +- +- mlxsw_reg_mcam_unpack(mcam_pl, MLXSW_REG_MCAM_MCIA_128B, +- &mcia_128b_supported); ++ if (!err) ++ mlxsw_reg_mcam_unpack(mcam_pl, MLXSW_REG_MCAM_MCIA_128B, ++ &mcia_128b_supported); + + mlxsw_env->max_eeprom_len = mcia_128b_supported ? 128 : 48; +- +- return 0; + } + + int mlxsw_env_init(struct mlxsw_core *mlxsw_core, +@@ -1445,15 +1441,11 @@ int mlxsw_env_init(struct mlxsw_core *mlxsw_core, + if (err) + goto err_type_set; + +- err = mlxsw_env_max_module_eeprom_len_query(env); +- if (err) +- goto err_eeprom_len_query; +- ++ mlxsw_env_max_module_eeprom_len_query(env); + env->line_cards[0]->active = true; + + return 0; + +-err_eeprom_len_query: + err_type_set: + mlxsw_env_module_event_disable(env, 0); + err_mlxsw_env_module_event_enable: +-- +2.43.0 + diff --git a/queue-6.8/mlxsw-pci-fix-driver-initialization-with-old-firmwar.patch b/queue-6.8/mlxsw-pci-fix-driver-initialization-with-old-firmwar.patch new file mode 100644 index 00000000000..15628d785b7 --- /dev/null +++ b/queue-6.8/mlxsw-pci-fix-driver-initialization-with-old-firmwar.patch @@ -0,0 +1,64 @@ +From 1598939542c83586d8f0486dd3944b8240961482 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 15:46:08 +0200 +Subject: mlxsw: pci: Fix driver initialization with old firmware + +From: Ido Schimmel + +[ Upstream commit 773501d01e6bc3f2557882a25679392d982d5f3e ] + +The driver queries the Management Capabilities Mask (MCAM) register +during initialization to understand if a new and deeper reset flow is +supported. + +However, not all firmware versions support this register, leading to the +driver failing to load. + +Fix by treating an error in the register query as an indication that the +feature is not supported. + +Fixes: f257c73e5356 ("mlxsw: pci: Add support for new reset flow") +Reported-by: Tim 'mithro' Ansell +Signed-off-by: Ido Schimmel +Reviewed-by: Petr Machata +Reviewed-by: Simon Horman +Reviewed-by: Kalesh AP +Signed-off-by: Petr Machata +Link: https://lore.kernel.org/r/ee968c49d53bac96a4c66d1b09ebbd097d81aca5.1713446092.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/pci.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethernet/mellanox/mlxsw/pci.c +index af99bf17eb36d..f42a1b1c93687 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/pci.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c +@@ -1530,7 +1530,7 @@ mlxsw_pci_reset(struct mlxsw_pci *mlxsw_pci, const struct pci_device_id *id) + { + struct pci_dev *pdev = mlxsw_pci->pdev; + char mcam_pl[MLXSW_REG_MCAM_LEN]; +- bool pci_reset_supported; ++ bool pci_reset_supported = false; + u32 sys_status; + int err; + +@@ -1548,11 +1548,9 @@ mlxsw_pci_reset(struct mlxsw_pci *mlxsw_pci, const struct pci_device_id *id) + mlxsw_reg_mcam_pack(mcam_pl, + MLXSW_REG_MCAM_FEATURE_GROUP_ENHANCED_FEATURES); + err = mlxsw_reg_query(mlxsw_pci->core, MLXSW_REG(mcam), mcam_pl); +- if (err) +- return err; +- +- mlxsw_reg_mcam_unpack(mcam_pl, MLXSW_REG_MCAM_PCI_RESET, +- &pci_reset_supported); ++ if (!err) ++ mlxsw_reg_mcam_unpack(mcam_pl, MLXSW_REG_MCAM_PCI_RESET, ++ &pci_reset_supported); + + if (pci_reset_supported) { + pci_dbg(pdev, "Starting PCI reset flow\n"); +-- +2.43.0 + diff --git a/queue-6.8/mlxsw-spectrum_acl_tcam-fix-incorrect-list-api-usage.patch b/queue-6.8/mlxsw-spectrum_acl_tcam-fix-incorrect-list-api-usage.patch new file mode 100644 index 00000000000..3a869a8eb07 --- /dev/null +++ b/queue-6.8/mlxsw-spectrum_acl_tcam-fix-incorrect-list-api-usage.patch @@ -0,0 +1,84 @@ +From 676efad1e264060aacc1972e386bd53df95cded4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 17:26:01 +0200 +Subject: mlxsw: spectrum_acl_tcam: Fix incorrect list API usage + +From: Ido Schimmel + +[ Upstream commit b377add0f0117409c418ddd6504bd682ebe0bf79 ] + +Both the function that migrates all the chunks within a region and the +function that migrates all the entries within a chunk call +list_first_entry() on the respective lists without checking that the +lists are not empty. This is incorrect usage of the API, which leads to +the following warning [1]. + +Fix by returning if the lists are empty as there is nothing to migrate +in this case. + +[1] +WARNING: CPU: 0 PID: 6437 at drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c:1266 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0> +Modules linked in: +CPU: 0 PID: 6437 Comm: kworker/0:37 Not tainted 6.9.0-rc3-custom-00883-g94a65f079ef6 #39 +Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 +Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work +RIP: 0010:mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0x2c0 +[...] +Call Trace: + + mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x4a0 + process_one_work+0x151/0x370 + worker_thread+0x2cb/0x3e0 + kthread+0xd0/0x100 + ret_from_fork+0x34/0x50 + ret_from_fork_asm+0x1a/0x30 + + +Fixes: 6f9579d4e302 ("mlxsw: spectrum_acl: Remember where to continue rehash migration") +Signed-off-by: Ido Schimmel +Tested-by: Alexander Zubkov +Reviewed-by: Petr Machata +Signed-off-by: Petr Machata +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/4628e9a22d1d84818e28310abbbc498e7bc31bc9.1713797103.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +index e8c6078866213..89a5ebc3463ff 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +@@ -1254,6 +1254,9 @@ mlxsw_sp_acl_tcam_vchunk_migrate_one(struct mlxsw_sp *mlxsw_sp, + return 0; + } + ++ if (list_empty(&vchunk->ventry_list)) ++ goto out; ++ + /* If the migration got interrupted, we have the ventry to start from + * stored in context. + */ +@@ -1305,6 +1308,7 @@ mlxsw_sp_acl_tcam_vchunk_migrate_one(struct mlxsw_sp *mlxsw_sp, + } + } + ++out: + mlxsw_sp_acl_tcam_vchunk_migrate_end(mlxsw_sp, vchunk, ctx); + return 0; + } +@@ -1318,6 +1322,9 @@ mlxsw_sp_acl_tcam_vchunk_migrate_all(struct mlxsw_sp *mlxsw_sp, + struct mlxsw_sp_acl_tcam_vchunk *vchunk; + int err; + ++ if (list_empty(&vregion->vchunk_list)) ++ return 0; ++ + /* If the migration got interrupted, we have the vchunk + * we are working on stored in context. + */ +-- +2.43.0 + diff --git a/queue-6.8/mlxsw-spectrum_acl_tcam-fix-memory-leak-during-rehas.patch b/queue-6.8/mlxsw-spectrum_acl_tcam-fix-memory-leak-during-rehas.patch new file mode 100644 index 00000000000..812ed07c394 --- /dev/null +++ b/queue-6.8/mlxsw-spectrum_acl_tcam-fix-memory-leak-during-rehas.patch @@ -0,0 +1,91 @@ +From cf7179254b92a27ffb8ecfcb742ee3c1c3ecadeb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 17:25:59 +0200 +Subject: mlxsw: spectrum_acl_tcam: Fix memory leak during rehash + +From: Ido Schimmel + +[ Upstream commit 8ca3f7a7b61393804c46f170743c3b839df13977 ] + +The rehash delayed work migrates filters from one region to another. +This is done by iterating over all chunks (all the filters with the same +priority) in the region and in each chunk iterating over all the +filters. + +If the migration fails, the code tries to migrate the filters back to +the old region. However, the rollback itself can also fail in which case +another migration will be erroneously performed. Besides the fact that +this ping pong is not a very good idea, it also creates a problem. + +Each virtual chunk references two chunks: The currently used one +('vchunk->chunk') and a backup ('vchunk->chunk2'). During migration the +first holds the chunk we want to migrate filters to and the second holds +the chunk we are migrating filters from. + +The code currently assumes - but does not verify - that the backup chunk +does not exist (NULL) if the currently used chunk does not reference the +target region. This assumption breaks when we are trying to rollback a +rollback, resulting in the backup chunk being overwritten and leaked +[1]. + +Fix by not rolling back a failed rollback and add a warning to avoid +future cases. + +[1] +WARNING: CPU: 5 PID: 1063 at lib/parman.c:291 parman_destroy+0x17/0x20 +Modules linked in: +CPU: 5 PID: 1063 Comm: kworker/5:11 Tainted: G W 6.9.0-rc2-custom-00784-gc6a05c468a0b #14 +Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 +Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work +RIP: 0010:parman_destroy+0x17/0x20 +[...] +Call Trace: + + mlxsw_sp_acl_atcam_region_fini+0x19/0x60 + mlxsw_sp_acl_tcam_region_destroy+0x49/0xf0 + mlxsw_sp_acl_tcam_vregion_rehash_work+0x1f1/0x470 + process_one_work+0x151/0x370 + worker_thread+0x2cb/0x3e0 + kthread+0xd0/0x100 + ret_from_fork+0x34/0x50 + ret_from_fork_asm+0x1a/0x30 + + +Fixes: 843500518509 ("mlxsw: spectrum_acl: Do rollback as another call to mlxsw_sp_acl_tcam_vchunk_migrate_all()") +Signed-off-by: Ido Schimmel +Tested-by: Alexander Zubkov +Reviewed-by: Petr Machata +Signed-off-by: Petr Machata +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/d5edd4f4503934186ae5cfe268503b16345b4e0f.1713797103.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +index 568ae7092fe0e..0902eb7651e14 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +@@ -1200,6 +1200,8 @@ mlxsw_sp_acl_tcam_vchunk_migrate_start(struct mlxsw_sp *mlxsw_sp, + { + struct mlxsw_sp_acl_tcam_chunk *new_chunk; + ++ WARN_ON(vchunk->chunk2); ++ + new_chunk = mlxsw_sp_acl_tcam_chunk_create(mlxsw_sp, vchunk, region); + if (IS_ERR(new_chunk)) + return PTR_ERR(new_chunk); +@@ -1334,6 +1336,8 @@ mlxsw_sp_acl_tcam_vregion_migrate(struct mlxsw_sp *mlxsw_sp, + err = mlxsw_sp_acl_tcam_vchunk_migrate_all(mlxsw_sp, vregion, + ctx, credits); + if (err) { ++ if (ctx->this_is_rollback) ++ return err; + /* In case migration was not successful, we need to swap + * so the original region pointer is assigned again + * to vregion->region. +-- +2.43.0 + diff --git a/queue-6.8/mlxsw-spectrum_acl_tcam-fix-memory-leak-when-canceli.patch b/queue-6.8/mlxsw-spectrum_acl_tcam-fix-memory-leak-when-canceli.patch new file mode 100644 index 00000000000..91b328baa63 --- /dev/null +++ b/queue-6.8/mlxsw-spectrum_acl_tcam-fix-memory-leak-when-canceli.patch @@ -0,0 +1,82 @@ +From 5cdecdd6f336124a523136aba7a6ea8af2528c03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 17:26:02 +0200 +Subject: mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work + +From: Ido Schimmel + +[ Upstream commit fb4e2b70a7194b209fc7320bbf33b375f7114bd5 ] + +The rehash delayed work is rescheduled with a delay if the number of +credits at end of the work is not negative as supposedly it means that +the migration ended. Otherwise, it is rescheduled immediately. + +After "mlxsw: spectrum_acl_tcam: Fix possible use-after-free during +rehash" the above is no longer accurate as a non-negative number of +credits is no longer indicative of the migration being done. It can also +happen if the work encountered an error in which case the migration will +resume the next time the work is scheduled. + +The significance of the above is that it is possible for the work to be +pending and associated with hints that were allocated when the migration +started. This leads to the hints being leaked [1] when the work is +canceled while pending as part of ACL region dismantle. + +Fix by freeing the hints if hints are associated with a work that was +canceled while pending. + +Blame the original commit since the reliance on not having a pending +work associated with hints is fragile. + +[1] +unreferenced object 0xffff88810e7c3000 (size 256): + comm "kworker/0:16", pid 176, jiffies 4295460353 + hex dump (first 32 bytes): + 00 30 95 11 81 88 ff ff 61 00 00 00 00 00 00 80 .0......a....... + 00 00 61 00 40 00 00 00 00 00 00 00 04 00 00 00 ..a.@........... + backtrace (crc 2544ddb9): + [<00000000cf8cfab3>] kmalloc_trace+0x23f/0x2a0 + [<000000004d9a1ad9>] objagg_hints_get+0x42/0x390 + [<000000000b143cf3>] mlxsw_sp_acl_erp_rehash_hints_get+0xca/0x400 + [<0000000059bdb60a>] mlxsw_sp_acl_tcam_vregion_rehash_work+0x868/0x1160 + [<00000000e81fd734>] process_one_work+0x59c/0xf20 + [<00000000ceee9e81>] worker_thread+0x799/0x12c0 + [<00000000bda6fe39>] kthread+0x246/0x300 + [<0000000070056d23>] ret_from_fork+0x34/0x70 + [<00000000dea2b93e>] ret_from_fork_asm+0x1a/0x30 + +Fixes: c9c9af91f1d9 ("mlxsw: spectrum_acl: Allow to interrupt/continue rehash work") +Signed-off-by: Ido Schimmel +Tested-by: Alexander Zubkov +Signed-off-by: Petr Machata +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/0cc12ebb07c4d4c41a1265ee2c28b392ff997a86.1713797103.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +index 89a5ebc3463ff..92a406f02eae7 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +@@ -836,10 +836,14 @@ mlxsw_sp_acl_tcam_vregion_destroy(struct mlxsw_sp *mlxsw_sp, + struct mlxsw_sp_acl_tcam *tcam = vregion->tcam; + + if (vgroup->vregion_rehash_enabled && ops->region_rehash_hints_get) { ++ struct mlxsw_sp_acl_tcam_rehash_ctx *ctx = &vregion->rehash.ctx; ++ + mutex_lock(&tcam->lock); + list_del(&vregion->tlist); + mutex_unlock(&tcam->lock); +- cancel_delayed_work_sync(&vregion->rehash.dw); ++ if (cancel_delayed_work_sync(&vregion->rehash.dw) && ++ ctx->hints_priv) ++ ops->region_rehash_hints_put(ctx->hints_priv); + } + mlxsw_sp_acl_tcam_vgroup_vregion_detach(mlxsw_sp, vregion); + if (vregion->region2) +-- +2.43.0 + diff --git a/queue-6.8/mlxsw-spectrum_acl_tcam-fix-possible-use-after-free-.patch b/queue-6.8/mlxsw-spectrum_acl_tcam-fix-possible-use-after-free-.patch new file mode 100644 index 00000000000..9a9975addfa --- /dev/null +++ b/queue-6.8/mlxsw-spectrum_acl_tcam-fix-possible-use-after-free-.patch @@ -0,0 +1,107 @@ +From 95cece06219469eb2fa4e995818eb8e0e692dedf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 17:25:56 +0200 +Subject: mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity + update + +From: Ido Schimmel + +[ Upstream commit 79b5b4b18bc85b19d3a518483f9abbbe6d7b3ba4 ] + +The rule activity update delayed work periodically traverses the list of +configured rules and queries their activity from the device. + +As part of this task it accesses the entry pointed by 'ventry->entry', +but this entry can be changed concurrently by the rehash delayed work, +leading to a use-after-free [1]. + +Fix by closing the race and perform the activity query under the +'vregion->lock' mutex. + +[1] +BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140 +Read of size 8 at addr ffff8881054ed808 by task kworker/0:18/181 + +CPU: 0 PID: 181 Comm: kworker/0:18 Not tainted 6.9.0-rc2-custom-00781-gd5ab772d32f7 #2 +Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 +Workqueue: mlxsw_core mlxsw_sp_acl_rule_activity_update_work +Call Trace: + + dump_stack_lvl+0xc6/0x120 + print_report+0xce/0x670 + kasan_report+0xd7/0x110 + mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140 + mlxsw_sp_acl_rule_activity_update_work+0x219/0x400 + process_one_work+0x8eb/0x19b0 + worker_thread+0x6c9/0xf70 + kthread+0x2c9/0x3b0 + ret_from_fork+0x4d/0x80 + ret_from_fork_asm+0x1a/0x30 + + +Allocated by task 1039: + kasan_save_stack+0x33/0x60 + kasan_save_track+0x14/0x30 + __kasan_kmalloc+0x8f/0xa0 + __kmalloc+0x19c/0x360 + mlxsw_sp_acl_tcam_entry_create+0x7b/0x1f0 + mlxsw_sp_acl_tcam_vchunk_migrate_all+0x30d/0xb50 + mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 + process_one_work+0x8eb/0x19b0 + worker_thread+0x6c9/0xf70 + kthread+0x2c9/0x3b0 + ret_from_fork+0x4d/0x80 + ret_from_fork_asm+0x1a/0x30 + +Freed by task 1039: + kasan_save_stack+0x33/0x60 + kasan_save_track+0x14/0x30 + kasan_save_free_info+0x3b/0x60 + poison_slab_object+0x102/0x170 + __kasan_slab_free+0x14/0x30 + kfree+0xc1/0x290 + mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3d7/0xb50 + mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 + process_one_work+0x8eb/0x19b0 + worker_thread+0x6c9/0xf70 + kthread+0x2c9/0x3b0 + ret_from_fork+0x4d/0x80 + ret_from_fork_asm+0x1a/0x30 + +Fixes: 2bffc5322fd8 ("mlxsw: spectrum_acl: Don't take mutex in mlxsw_sp_acl_tcam_vregion_rehash_work()") +Signed-off-by: Ido Schimmel +Tested-by: Alexander Zubkov +Reviewed-by: Petr Machata +Signed-off-by: Petr Machata +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/1fcce0a60b231ebeb2515d91022284ba7b4ffe7a.1713797103.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +index 9c0c728bb42dc..7e69225c057de 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +@@ -1159,8 +1159,14 @@ mlxsw_sp_acl_tcam_ventry_activity_get(struct mlxsw_sp *mlxsw_sp, + struct mlxsw_sp_acl_tcam_ventry *ventry, + bool *activity) + { +- return mlxsw_sp_acl_tcam_entry_activity_get(mlxsw_sp, +- ventry->entry, activity); ++ struct mlxsw_sp_acl_tcam_vregion *vregion = ventry->vchunk->vregion; ++ int err; ++ ++ mutex_lock(&vregion->lock); ++ err = mlxsw_sp_acl_tcam_entry_activity_get(mlxsw_sp, ventry->entry, ++ activity); ++ mutex_unlock(&vregion->lock); ++ return err; + } + + static int +-- +2.43.0 + diff --git a/queue-6.8/mlxsw-spectrum_acl_tcam-fix-possible-use-after-free-.patch-5019 b/queue-6.8/mlxsw-spectrum_acl_tcam-fix-possible-use-after-free-.patch-5019 new file mode 100644 index 00000000000..0769ed290c5 --- /dev/null +++ b/queue-6.8/mlxsw-spectrum_acl_tcam-fix-possible-use-after-free-.patch-5019 @@ -0,0 +1,103 @@ +From a19a66bd2cf03d35cba644d8b1fb724c75ec6f7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 17:25:57 +0200 +Subject: mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash + +From: Ido Schimmel + +[ Upstream commit 54225988889931467a9b55fdbef534079b665519 ] + +The rehash delayed work migrates filters from one region to another +according to the number of available credits. + +The migrated from region is destroyed at the end of the work if the +number of credits is non-negative as the assumption is that this is +indicative of migration being complete. This assumption is incorrect as +a non-negative number of credits can also be the result of a failed +migration. + +The destruction of a region that still has filters referencing it can +result in a use-after-free [1]. + +Fix by not destroying the region if migration failed. + +[1] +BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 +Read of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858 + +CPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G W 6.9.0-rc2-custom-00782-gf2275c2157d8 #5 +Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 +Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work +Call Trace: + + dump_stack_lvl+0xc6/0x120 + print_report+0xce/0x670 + kasan_report+0xd7/0x110 + mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 + mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70 + mlxsw_sp_acl_atcam_entry_del+0x81/0x210 + mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50 + mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 + process_one_work+0x8eb/0x19b0 + worker_thread+0x6c9/0xf70 + kthread+0x2c9/0x3b0 + ret_from_fork+0x4d/0x80 + ret_from_fork_asm+0x1a/0x30 + + +Allocated by task 174: + kasan_save_stack+0x33/0x60 + kasan_save_track+0x14/0x30 + __kasan_kmalloc+0x8f/0xa0 + __kmalloc+0x19c/0x360 + mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0 + mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300 + process_one_work+0x8eb/0x19b0 + worker_thread+0x6c9/0xf70 + kthread+0x2c9/0x3b0 + ret_from_fork+0x4d/0x80 + ret_from_fork_asm+0x1a/0x30 + +Freed by task 7: + kasan_save_stack+0x33/0x60 + kasan_save_track+0x14/0x30 + kasan_save_free_info+0x3b/0x60 + poison_slab_object+0x102/0x170 + __kasan_slab_free+0x14/0x30 + kfree+0xc1/0x290 + mlxsw_sp_acl_tcam_region_destroy+0x272/0x310 + mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300 + process_one_work+0x8eb/0x19b0 + worker_thread+0x6c9/0xf70 + kthread+0x2c9/0x3b0 + ret_from_fork+0x4d/0x80 + ret_from_fork_asm+0x1a/0x30 + +Fixes: c9c9af91f1d9 ("mlxsw: spectrum_acl: Allow to interrupt/continue rehash work") +Signed-off-by: Ido Schimmel +Tested-by: Alexander Zubkov +Reviewed-by: Petr Machata +Signed-off-by: Petr Machata +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/3e412b5659ec2310c5c615760dfe5eac18dd7ebd.1713797103.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +index 7e69225c057de..1ff0b2c7c11de 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +@@ -1451,6 +1451,7 @@ mlxsw_sp_acl_tcam_vregion_rehash(struct mlxsw_sp *mlxsw_sp, + ctx, credits); + if (err) { + dev_err(mlxsw_sp->bus_info->dev, "Failed to migrate vregion\n"); ++ return; + } + + if (*credits >= 0) +-- +2.43.0 + diff --git a/queue-6.8/mlxsw-spectrum_acl_tcam-fix-race-during-rehash-delay.patch b/queue-6.8/mlxsw-spectrum_acl_tcam-fix-race-during-rehash-delay.patch new file mode 100644 index 00000000000..cbe1eb0d861 --- /dev/null +++ b/queue-6.8/mlxsw-spectrum_acl_tcam-fix-race-during-rehash-delay.patch @@ -0,0 +1,80 @@ +From 9f6f7527839d6b7b9e4f34ba1b15afb959303533 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 17:25:55 +0200 +Subject: mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work + +From: Ido Schimmel + +[ Upstream commit d90cfe20562407d9f080d24123078d666d730707 ] + +The purpose of the rehash delayed work is to reduce the number of masks +(eRPs) used by an ACL region as the eRP bank is a global and limited +resource. + +This is done in three steps: + +1. Creating a new set of masks and a new ACL region which will use the + new masks and to which the existing filters will be migrated to. The + new region is assigned to 'vregion->region' and the region from which + the filters are migrated from is assigned to 'vregion->region2'. + +2. Migrating all the filters from the old region to the new region. + +3. Destroying the old region and setting 'vregion->region2' to NULL. + +Only the second steps is performed under the 'vregion->lock' mutex +although its comments says that among other things it "Protects +consistency of region, region2 pointers". + +This is problematic as the first step can race with filter insertion +from user space that uses 'vregion->region', but under the mutex. + +Fix by holding the mutex across the entirety of the delayed work and not +only during the second step. + +Fixes: 2bffc5322fd8 ("mlxsw: spectrum_acl: Don't take mutex in mlxsw_sp_acl_tcam_vregion_rehash_work()") +Signed-off-by: Ido Schimmel +Tested-by: Alexander Zubkov +Reviewed-by: Petr Machata +Signed-off-by: Petr Machata +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/1ec1d54edf2bad0a369e6b4fa030aba64e1f124b.1713797103.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +index b6a4652a6475a..9c0c728bb42dc 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +@@ -718,7 +718,9 @@ static void mlxsw_sp_acl_tcam_vregion_rehash_work(struct work_struct *work) + rehash.dw.work); + int credits = MLXSW_SP_ACL_TCAM_VREGION_REHASH_CREDITS; + ++ mutex_lock(&vregion->lock); + mlxsw_sp_acl_tcam_vregion_rehash(vregion->mlxsw_sp, vregion, &credits); ++ mutex_unlock(&vregion->lock); + if (credits < 0) + /* Rehash gone out of credits so it was interrupted. + * Schedule the work as soon as possible to continue. +@@ -1323,7 +1325,6 @@ mlxsw_sp_acl_tcam_vregion_migrate(struct mlxsw_sp *mlxsw_sp, + int err, err2; + + trace_mlxsw_sp_acl_tcam_vregion_migrate(mlxsw_sp, vregion); +- mutex_lock(&vregion->lock); + err = mlxsw_sp_acl_tcam_vchunk_migrate_all(mlxsw_sp, vregion, + ctx, credits); + if (err) { +@@ -1343,7 +1344,6 @@ mlxsw_sp_acl_tcam_vregion_migrate(struct mlxsw_sp *mlxsw_sp, + /* Let the rollback to be continued later on. */ + } + } +- mutex_unlock(&vregion->lock); + trace_mlxsw_sp_acl_tcam_vregion_migrate_end(mlxsw_sp, vregion); + return err; + } +-- +2.43.0 + diff --git a/queue-6.8/mlxsw-spectrum_acl_tcam-fix-race-in-region-id-alloca.patch b/queue-6.8/mlxsw-spectrum_acl_tcam-fix-race-in-region-id-alloca.patch new file mode 100644 index 00000000000..d61a473a8da --- /dev/null +++ b/queue-6.8/mlxsw-spectrum_acl_tcam-fix-race-in-region-id-alloca.patch @@ -0,0 +1,182 @@ +From b2ed431e79f47cd1ce2773bdecad135a2d41fbd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 17:25:54 +0200 +Subject: mlxsw: spectrum_acl_tcam: Fix race in region ID allocation + +From: Ido Schimmel + +[ Upstream commit 627f9c1bb882765a84aa78015abbacd783d429be ] + +Region identifiers can be allocated both when user space tries to insert +a new tc filter and when filters are migrated from one region to another +as part of the rehash delayed work. + +There is no lock protecting the bitmap from which these identifiers are +allocated from, which is racy and leads to bad parameter errors from the +device's firmware. + +Fix by converting the bitmap to IDA which handles its own locking. For +consistency, do the same for the group identifiers that are part of the +same structure. + +Fixes: 2bffc5322fd8 ("mlxsw: spectrum_acl: Don't take mutex in mlxsw_sp_acl_tcam_vregion_rehash_work()") +Reported-by: Amit Cohen +Signed-off-by: Ido Schimmel +Tested-by: Alexander Zubkov +Reviewed-by: Petr Machata +Signed-off-by: Petr Machata +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/ce494b7940cadfe84f3e18da7785b51ef5f776e3.1713797103.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../mellanox/mlxsw/spectrum_acl_tcam.c | 61 ++++++++----------- + .../mellanox/mlxsw/spectrum_acl_tcam.h | 5 +- + 2 files changed, 30 insertions(+), 36 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +index f20052776b3f2..b6a4652a6475a 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -58,41 +59,43 @@ int mlxsw_sp_acl_tcam_priority_get(struct mlxsw_sp *mlxsw_sp, + static int mlxsw_sp_acl_tcam_region_id_get(struct mlxsw_sp_acl_tcam *tcam, + u16 *p_id) + { +- u16 id; ++ int id; + +- id = find_first_zero_bit(tcam->used_regions, tcam->max_regions); +- if (id < tcam->max_regions) { +- __set_bit(id, tcam->used_regions); +- *p_id = id; +- return 0; +- } +- return -ENOBUFS; ++ id = ida_alloc_max(&tcam->used_regions, tcam->max_regions - 1, ++ GFP_KERNEL); ++ if (id < 0) ++ return id; ++ ++ *p_id = id; ++ ++ return 0; + } + + static void mlxsw_sp_acl_tcam_region_id_put(struct mlxsw_sp_acl_tcam *tcam, + u16 id) + { +- __clear_bit(id, tcam->used_regions); ++ ida_free(&tcam->used_regions, id); + } + + static int mlxsw_sp_acl_tcam_group_id_get(struct mlxsw_sp_acl_tcam *tcam, + u16 *p_id) + { +- u16 id; ++ int id; + +- id = find_first_zero_bit(tcam->used_groups, tcam->max_groups); +- if (id < tcam->max_groups) { +- __set_bit(id, tcam->used_groups); +- *p_id = id; +- return 0; +- } +- return -ENOBUFS; ++ id = ida_alloc_max(&tcam->used_groups, tcam->max_groups - 1, ++ GFP_KERNEL); ++ if (id < 0) ++ return id; ++ ++ *p_id = id; ++ ++ return 0; + } + + static void mlxsw_sp_acl_tcam_group_id_put(struct mlxsw_sp_acl_tcam *tcam, + u16 id) + { +- __clear_bit(id, tcam->used_groups); ++ ida_free(&tcam->used_groups, id); + } + + struct mlxsw_sp_acl_tcam_pattern { +@@ -1549,19 +1552,11 @@ int mlxsw_sp_acl_tcam_init(struct mlxsw_sp *mlxsw_sp, + if (max_tcam_regions < max_regions) + max_regions = max_tcam_regions; + +- tcam->used_regions = bitmap_zalloc(max_regions, GFP_KERNEL); +- if (!tcam->used_regions) { +- err = -ENOMEM; +- goto err_alloc_used_regions; +- } ++ ida_init(&tcam->used_regions); + tcam->max_regions = max_regions; + + max_groups = MLXSW_CORE_RES_GET(mlxsw_sp->core, ACL_MAX_GROUPS); +- tcam->used_groups = bitmap_zalloc(max_groups, GFP_KERNEL); +- if (!tcam->used_groups) { +- err = -ENOMEM; +- goto err_alloc_used_groups; +- } ++ ida_init(&tcam->used_groups); + tcam->max_groups = max_groups; + tcam->max_group_size = MLXSW_CORE_RES_GET(mlxsw_sp->core, + ACL_MAX_GROUP_SIZE); +@@ -1575,10 +1570,8 @@ int mlxsw_sp_acl_tcam_init(struct mlxsw_sp *mlxsw_sp, + return 0; + + err_tcam_init: +- bitmap_free(tcam->used_groups); +-err_alloc_used_groups: +- bitmap_free(tcam->used_regions); +-err_alloc_used_regions: ++ ida_destroy(&tcam->used_groups); ++ ida_destroy(&tcam->used_regions); + mlxsw_sp_acl_tcam_rehash_params_unregister(mlxsw_sp); + err_rehash_params_register: + mutex_destroy(&tcam->lock); +@@ -1591,8 +1584,8 @@ void mlxsw_sp_acl_tcam_fini(struct mlxsw_sp *mlxsw_sp, + const struct mlxsw_sp_acl_tcam_ops *ops = mlxsw_sp->acl_tcam_ops; + + ops->fini(mlxsw_sp, tcam->priv); +- bitmap_free(tcam->used_groups); +- bitmap_free(tcam->used_regions); ++ ida_destroy(&tcam->used_groups); ++ ida_destroy(&tcam->used_regions); + mlxsw_sp_acl_tcam_rehash_params_unregister(mlxsw_sp); + mutex_destroy(&tcam->lock); + } +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.h +index 462bf448497d3..79a1d86065125 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.h ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.h +@@ -6,15 +6,16 @@ + + #include + #include ++#include + + #include "reg.h" + #include "spectrum.h" + #include "core_acl_flex_keys.h" + + struct mlxsw_sp_acl_tcam { +- unsigned long *used_regions; /* bit array */ ++ struct ida used_regions; + unsigned int max_regions; +- unsigned long *used_groups; /* bit array */ ++ struct ida used_groups; + unsigned int max_groups; + unsigned int max_group_size; + struct mutex lock; /* guards vregion list */ +-- +2.43.0 + diff --git a/queue-6.8/mlxsw-spectrum_acl_tcam-fix-warning-during-rehash.patch b/queue-6.8/mlxsw-spectrum_acl_tcam-fix-warning-during-rehash.patch new file mode 100644 index 00000000000..11bf18de8e8 --- /dev/null +++ b/queue-6.8/mlxsw-spectrum_acl_tcam-fix-warning-during-rehash.patch @@ -0,0 +1,133 @@ +From 0604d00ab8644fe55885b1ba124bd5913610fe5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 17:26:00 +0200 +Subject: mlxsw: spectrum_acl_tcam: Fix warning during rehash + +From: Ido Schimmel + +[ Upstream commit 743edc8547a92b6192aa1f1b6bb78233fa21dc9b ] + +As previously explained, the rehash delayed work migrates filters from +one region to another. This is done by iterating over all chunks (all +the filters with the same priority) in the region and in each chunk +iterating over all the filters. + +When the work runs out of credits it stores the current chunk and entry +as markers in the per-work context so that it would know where to resume +the migration from the next time the work is scheduled. + +Upon error, the chunk marker is reset to NULL, but without resetting the +entry markers despite being relative to it. This can result in migration +being resumed from an entry that does not belong to the chunk being +migrated. In turn, this will eventually lead to a chunk being iterated +over as if it is an entry. Because of how the two structures happen to +be defined, this does not lead to KASAN splats, but to warnings such as +[1]. + +Fix by creating a helper that resets all the markers and call it from +all the places the currently only reset the chunk marker. For good +measures also call it when starting a completely new rehash. Add a +warning to avoid future cases. + +[1] +WARNING: CPU: 7 PID: 1076 at drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.c:407 mlxsw_afk_encode+0x242/0x2f0 +Modules linked in: +CPU: 7 PID: 1076 Comm: kworker/7:24 Tainted: G W 6.9.0-rc3-custom-00880-g29e61d91b77b #29 +Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 +Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work +RIP: 0010:mlxsw_afk_encode+0x242/0x2f0 +[...] +Call Trace: + + mlxsw_sp_acl_atcam_entry_add+0xd9/0x3c0 + mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 + mlxsw_sp_acl_tcam_vchunk_migrate_all+0x109/0x290 + mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x470 + process_one_work+0x151/0x370 + worker_thread+0x2cb/0x3e0 + kthread+0xd0/0x100 + ret_from_fork+0x34/0x50 + + +Fixes: 6f9579d4e302 ("mlxsw: spectrum_acl: Remember where to continue rehash migration") +Signed-off-by: Ido Schimmel +Tested-by: Alexander Zubkov +Reviewed-by: Petr Machata +Signed-off-by: Petr Machata +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/cc17eed86b41dd829d39b07906fec074a9ce580e.1713797103.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../mellanox/mlxsw/spectrum_acl_tcam.c | 20 ++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +index 0902eb7651e14..e8c6078866213 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +@@ -730,6 +730,17 @@ static void mlxsw_sp_acl_tcam_vregion_rehash_work(struct work_struct *work) + mlxsw_sp_acl_tcam_vregion_rehash_work_schedule(vregion); + } + ++static void ++mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset(struct mlxsw_sp_acl_tcam_rehash_ctx *ctx) ++{ ++ /* The entry markers are relative to the current chunk and therefore ++ * needs to be reset together with the chunk marker. ++ */ ++ ctx->current_vchunk = NULL; ++ ctx->start_ventry = NULL; ++ ctx->stop_ventry = NULL; ++} ++ + static void + mlxsw_sp_acl_tcam_rehash_ctx_vchunk_changed(struct mlxsw_sp_acl_tcam_vchunk *vchunk) + { +@@ -752,7 +763,7 @@ mlxsw_sp_acl_tcam_rehash_ctx_vregion_changed(struct mlxsw_sp_acl_tcam_vregion *v + * the current chunk pointer to make sure all chunks + * are properly migrated. + */ +- vregion->rehash.ctx.current_vchunk = NULL; ++ mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset(&vregion->rehash.ctx); + } + + static struct mlxsw_sp_acl_tcam_vregion * +@@ -1220,7 +1231,7 @@ mlxsw_sp_acl_tcam_vchunk_migrate_end(struct mlxsw_sp *mlxsw_sp, + { + mlxsw_sp_acl_tcam_chunk_destroy(mlxsw_sp, vchunk->chunk2); + vchunk->chunk2 = NULL; +- ctx->current_vchunk = NULL; ++ mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset(ctx); + } + + static int +@@ -1252,6 +1263,8 @@ mlxsw_sp_acl_tcam_vchunk_migrate_one(struct mlxsw_sp *mlxsw_sp, + ventry = list_first_entry(&vchunk->ventry_list, + typeof(*ventry), list); + ++ WARN_ON(ventry->vchunk != vchunk); ++ + list_for_each_entry_from(ventry, &vchunk->ventry_list, list) { + /* During rollback, once we reach the ventry that failed + * to migrate, we are done. +@@ -1343,7 +1356,7 @@ mlxsw_sp_acl_tcam_vregion_migrate(struct mlxsw_sp *mlxsw_sp, + * to vregion->region. + */ + swap(vregion->region, vregion->region2); +- ctx->current_vchunk = NULL; ++ mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset(ctx); + ctx->this_is_rollback = true; + err2 = mlxsw_sp_acl_tcam_vchunk_migrate_all(mlxsw_sp, vregion, + ctx, credits); +@@ -1402,6 +1415,7 @@ mlxsw_sp_acl_tcam_vregion_rehash_start(struct mlxsw_sp *mlxsw_sp, + + ctx->hints_priv = hints_priv; + ctx->this_is_rollback = false; ++ mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset(ctx); + + return 0; + +-- +2.43.0 + diff --git a/queue-6.8/mlxsw-spectrum_acl_tcam-rate-limit-error-message.patch b/queue-6.8/mlxsw-spectrum_acl_tcam-rate-limit-error-message.patch new file mode 100644 index 00000000000..6e87081d248 --- /dev/null +++ b/queue-6.8/mlxsw-spectrum_acl_tcam-rate-limit-error-message.patch @@ -0,0 +1,45 @@ +From 55b64838bb56468b72285d74ba7ca80516807a7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 17:25:58 +0200 +Subject: mlxsw: spectrum_acl_tcam: Rate limit error message + +From: Ido Schimmel + +[ Upstream commit 5bcf925587e9b5d36420d572a0b4d131c90fb306 ] + +In the rare cases when the device resources are exhausted it is likely +that the rehash delayed work will fail. An error message will be printed +whenever this happens which can be overwhelming considering the fact +that the work is per-region and that there can be hundreds of regions. + +Fix by rate limiting the error message. + +Fixes: e5e7962ee5c2 ("mlxsw: spectrum_acl: Implement region migration according to hints") +Signed-off-by: Ido Schimmel +Tested-by: Alexander Zubkov +Reviewed-by: Petr Machata +Signed-off-by: Petr Machata +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/c510763b2ebd25e7990d80183feff91cde593145.1713797103.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +index 1ff0b2c7c11de..568ae7092fe0e 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +@@ -1450,7 +1450,7 @@ mlxsw_sp_acl_tcam_vregion_rehash(struct mlxsw_sp *mlxsw_sp, + err = mlxsw_sp_acl_tcam_vregion_migrate(mlxsw_sp, vregion, + ctx, credits); + if (err) { +- dev_err(mlxsw_sp->bus_info->dev, "Failed to migrate vregion\n"); ++ dev_err_ratelimited(mlxsw_sp->bus_info->dev, "Failed to migrate vregion\n"); + return; + } + +-- +2.43.0 + diff --git a/queue-6.8/mlxsw-use-refcount_t-for-reference-counting.patch b/queue-6.8/mlxsw-use-refcount_t-for-reference-counting.patch new file mode 100644 index 00000000000..543ff26f1a4 --- /dev/null +++ b/queue-6.8/mlxsw-use-refcount_t-for-reference-counting.patch @@ -0,0 +1,396 @@ +From 499e3c74b6cc811e61beda346a5a8e38666f3bbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 19:58:31 +0100 +Subject: mlxsw: Use refcount_t for reference counting + +From: Amit Cohen + +[ Upstream commit 1267f7223bec186dc26ef4e6075496c6217355de ] + +mlxsw driver uses 'unsigned int' for reference counters in several +structures. Instead, use refcount_t type which allows us to catch overflow +and underflow issues. Change the type of the counters and use the +appropriate API. + +Signed-off-by: Amit Cohen +Reviewed-by: Ido Schimmel +Signed-off-by: Ido Schimmel +Signed-off-by: Petr Machata +Reviewed-by: Simon Horman +Signed-off-by: Paolo Abeni +Stable-dep-of: 627f9c1bb882 ("mlxsw: spectrum_acl_tcam: Fix race in region ID allocation") +Signed-off-by: Sasha Levin +--- + .../mellanox/mlxsw/core_acl_flex_actions.c | 16 ++++++++-------- + .../mellanox/mlxsw/core_acl_flex_keys.c | 9 +++++---- + .../net/ethernet/mellanox/mlxsw/spectrum_acl.c | 11 ++++++----- + .../ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 17 +++++++++-------- + .../ethernet/mellanox/mlxsw/spectrum_router.c | 15 ++++++++------- + .../mellanox/mlxsw/spectrum_switchdev.c | 8 ++++---- + 6 files changed, 40 insertions(+), 36 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c b/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c +index faa63ea9b83e1..1915fa41c6224 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c +@@ -95,7 +95,7 @@ struct mlxsw_afa_set { + */ + has_trap:1, + has_police:1; +- unsigned int ref_count; ++ refcount_t ref_count; + struct mlxsw_afa_set *next; /* Pointer to the next set. */ + struct mlxsw_afa_set *prev; /* Pointer to the previous set, + * note that set may have multiple +@@ -120,7 +120,7 @@ struct mlxsw_afa_fwd_entry { + struct rhash_head ht_node; + struct mlxsw_afa_fwd_entry_ht_key ht_key; + u32 kvdl_index; +- unsigned int ref_count; ++ refcount_t ref_count; + }; + + static const struct rhashtable_params mlxsw_afa_fwd_entry_ht_params = { +@@ -282,7 +282,7 @@ static struct mlxsw_afa_set *mlxsw_afa_set_create(bool is_first) + /* Need to initialize the set to pass by default */ + mlxsw_afa_set_goto_set(set, MLXSW_AFA_SET_GOTO_BINDING_CMD_TERM, 0); + set->ht_key.is_first = is_first; +- set->ref_count = 1; ++ refcount_set(&set->ref_count, 1); + return set; + } + +@@ -330,7 +330,7 @@ static void mlxsw_afa_set_unshare(struct mlxsw_afa *mlxsw_afa, + static void mlxsw_afa_set_put(struct mlxsw_afa *mlxsw_afa, + struct mlxsw_afa_set *set) + { +- if (--set->ref_count) ++ if (!refcount_dec_and_test(&set->ref_count)) + return; + if (set->shared) + mlxsw_afa_set_unshare(mlxsw_afa, set); +@@ -350,7 +350,7 @@ static struct mlxsw_afa_set *mlxsw_afa_set_get(struct mlxsw_afa *mlxsw_afa, + set = rhashtable_lookup_fast(&mlxsw_afa->set_ht, &orig_set->ht_key, + mlxsw_afa_set_ht_params); + if (set) { +- set->ref_count++; ++ refcount_inc(&set->ref_count); + mlxsw_afa_set_put(mlxsw_afa, orig_set); + } else { + set = orig_set; +@@ -564,7 +564,7 @@ mlxsw_afa_fwd_entry_create(struct mlxsw_afa *mlxsw_afa, u16 local_port) + if (!fwd_entry) + return ERR_PTR(-ENOMEM); + fwd_entry->ht_key.local_port = local_port; +- fwd_entry->ref_count = 1; ++ refcount_set(&fwd_entry->ref_count, 1); + + err = rhashtable_insert_fast(&mlxsw_afa->fwd_entry_ht, + &fwd_entry->ht_node, +@@ -607,7 +607,7 @@ mlxsw_afa_fwd_entry_get(struct mlxsw_afa *mlxsw_afa, u16 local_port) + fwd_entry = rhashtable_lookup_fast(&mlxsw_afa->fwd_entry_ht, &ht_key, + mlxsw_afa_fwd_entry_ht_params); + if (fwd_entry) { +- fwd_entry->ref_count++; ++ refcount_inc(&fwd_entry->ref_count); + return fwd_entry; + } + return mlxsw_afa_fwd_entry_create(mlxsw_afa, local_port); +@@ -616,7 +616,7 @@ mlxsw_afa_fwd_entry_get(struct mlxsw_afa *mlxsw_afa, u16 local_port) + static void mlxsw_afa_fwd_entry_put(struct mlxsw_afa *mlxsw_afa, + struct mlxsw_afa_fwd_entry *fwd_entry) + { +- if (--fwd_entry->ref_count) ++ if (!refcount_dec_and_test(&fwd_entry->ref_count)) + return; + mlxsw_afa_fwd_entry_destroy(mlxsw_afa, fwd_entry); + } +diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.c b/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.c +index 0d5e6f9b466ec..947500f8ed714 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.c +@@ -5,6 +5,7 @@ + #include + #include + #include ++#include + + #include "item.h" + #include "core_acl_flex_keys.h" +@@ -107,7 +108,7 @@ EXPORT_SYMBOL(mlxsw_afk_destroy); + + struct mlxsw_afk_key_info { + struct list_head list; +- unsigned int ref_count; ++ refcount_t ref_count; + unsigned int blocks_count; + int element_to_block[MLXSW_AFK_ELEMENT_MAX]; /* index is element, value + * is index inside "blocks" +@@ -334,7 +335,7 @@ mlxsw_afk_key_info_create(struct mlxsw_afk *mlxsw_afk, + if (err) + goto err_picker; + list_add(&key_info->list, &mlxsw_afk->key_info_list); +- key_info->ref_count = 1; ++ refcount_set(&key_info->ref_count, 1); + return key_info; + + err_picker: +@@ -356,7 +357,7 @@ mlxsw_afk_key_info_get(struct mlxsw_afk *mlxsw_afk, + + key_info = mlxsw_afk_key_info_find(mlxsw_afk, elusage); + if (key_info) { +- key_info->ref_count++; ++ refcount_inc(&key_info->ref_count); + return key_info; + } + return mlxsw_afk_key_info_create(mlxsw_afk, elusage); +@@ -365,7 +366,7 @@ EXPORT_SYMBOL(mlxsw_afk_key_info_get); + + void mlxsw_afk_key_info_put(struct mlxsw_afk_key_info *key_info) + { +- if (--key_info->ref_count) ++ if (!refcount_dec_and_test(&key_info->ref_count)) + return; + mlxsw_afk_key_info_destroy(key_info); + } +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c +index 7c59c8a135840..b01b000bc71c1 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c +@@ -9,6 +9,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -55,7 +56,7 @@ struct mlxsw_sp_acl_ruleset { + struct rhash_head ht_node; /* Member of acl HT */ + struct mlxsw_sp_acl_ruleset_ht_key ht_key; + struct rhashtable rule_ht; +- unsigned int ref_count; ++ refcount_t ref_count; + unsigned int min_prio; + unsigned int max_prio; + unsigned long priv[]; +@@ -99,7 +100,7 @@ static bool + mlxsw_sp_acl_ruleset_is_singular(const struct mlxsw_sp_acl_ruleset *ruleset) + { + /* We hold a reference on ruleset ourselves */ +- return ruleset->ref_count == 2; ++ return refcount_read(&ruleset->ref_count) == 2; + } + + int mlxsw_sp_acl_ruleset_bind(struct mlxsw_sp *mlxsw_sp, +@@ -176,7 +177,7 @@ mlxsw_sp_acl_ruleset_create(struct mlxsw_sp *mlxsw_sp, + ruleset = kzalloc(alloc_size, GFP_KERNEL); + if (!ruleset) + return ERR_PTR(-ENOMEM); +- ruleset->ref_count = 1; ++ refcount_set(&ruleset->ref_count, 1); + ruleset->ht_key.block = block; + ruleset->ht_key.chain_index = chain_index; + ruleset->ht_key.ops = ops; +@@ -222,13 +223,13 @@ static void mlxsw_sp_acl_ruleset_destroy(struct mlxsw_sp *mlxsw_sp, + + static void mlxsw_sp_acl_ruleset_ref_inc(struct mlxsw_sp_acl_ruleset *ruleset) + { +- ruleset->ref_count++; ++ refcount_inc(&ruleset->ref_count); + } + + static void mlxsw_sp_acl_ruleset_ref_dec(struct mlxsw_sp *mlxsw_sp, + struct mlxsw_sp_acl_ruleset *ruleset) + { +- if (--ruleset->ref_count) ++ if (!refcount_dec_and_test(&ruleset->ref_count)) + return; + mlxsw_sp_acl_ruleset_destroy(mlxsw_sp, ruleset); + } +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +index 50ea1eff02b2f..f20052776b3f2 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +@@ -9,6 +9,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -155,7 +156,7 @@ struct mlxsw_sp_acl_tcam_vregion { + struct mlxsw_sp_acl_tcam_rehash_ctx ctx; + } rehash; + struct mlxsw_sp *mlxsw_sp; +- unsigned int ref_count; ++ refcount_t ref_count; + }; + + struct mlxsw_sp_acl_tcam_vchunk; +@@ -176,7 +177,7 @@ struct mlxsw_sp_acl_tcam_vchunk { + unsigned int priority; /* Priority within the vregion and group */ + struct mlxsw_sp_acl_tcam_vgroup *vgroup; + struct mlxsw_sp_acl_tcam_vregion *vregion; +- unsigned int ref_count; ++ refcount_t ref_count; + }; + + struct mlxsw_sp_acl_tcam_entry { +@@ -769,7 +770,7 @@ mlxsw_sp_acl_tcam_vregion_create(struct mlxsw_sp *mlxsw_sp, + vregion->tcam = tcam; + vregion->mlxsw_sp = mlxsw_sp; + vregion->vgroup = vgroup; +- vregion->ref_count = 1; ++ refcount_set(&vregion->ref_count, 1); + + vregion->key_info = mlxsw_afk_key_info_get(afk, elusage); + if (IS_ERR(vregion->key_info)) { +@@ -856,7 +857,7 @@ mlxsw_sp_acl_tcam_vregion_get(struct mlxsw_sp *mlxsw_sp, + */ + return ERR_PTR(-EOPNOTSUPP); + } +- vregion->ref_count++; ++ refcount_inc(&vregion->ref_count); + return vregion; + } + +@@ -871,7 +872,7 @@ static void + mlxsw_sp_acl_tcam_vregion_put(struct mlxsw_sp *mlxsw_sp, + struct mlxsw_sp_acl_tcam_vregion *vregion) + { +- if (--vregion->ref_count) ++ if (!refcount_dec_and_test(&vregion->ref_count)) + return; + mlxsw_sp_acl_tcam_vregion_destroy(mlxsw_sp, vregion); + } +@@ -924,7 +925,7 @@ mlxsw_sp_acl_tcam_vchunk_create(struct mlxsw_sp *mlxsw_sp, + INIT_LIST_HEAD(&vchunk->ventry_list); + vchunk->priority = priority; + vchunk->vgroup = vgroup; +- vchunk->ref_count = 1; ++ refcount_set(&vchunk->ref_count, 1); + + vregion = mlxsw_sp_acl_tcam_vregion_get(mlxsw_sp, vgroup, + priority, elusage); +@@ -1008,7 +1009,7 @@ mlxsw_sp_acl_tcam_vchunk_get(struct mlxsw_sp *mlxsw_sp, + if (WARN_ON(!mlxsw_afk_key_info_subset(vchunk->vregion->key_info, + elusage))) + return ERR_PTR(-EINVAL); +- vchunk->ref_count++; ++ refcount_inc(&vchunk->ref_count); + return vchunk; + } + return mlxsw_sp_acl_tcam_vchunk_create(mlxsw_sp, vgroup, +@@ -1019,7 +1020,7 @@ static void + mlxsw_sp_acl_tcam_vchunk_put(struct mlxsw_sp *mlxsw_sp, + struct mlxsw_sp_acl_tcam_vchunk *vchunk) + { +- if (--vchunk->ref_count) ++ if (!refcount_dec_and_test(&vchunk->ref_count)) + return; + mlxsw_sp_acl_tcam_vchunk_destroy(mlxsw_sp, vchunk); + } +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +index 7164f9e6370fb..87617df694ab2 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +@@ -501,7 +501,7 @@ struct mlxsw_sp_rt6 { + + struct mlxsw_sp_lpm_tree { + u8 id; /* tree ID */ +- unsigned int ref_count; ++ refcount_t ref_count; + enum mlxsw_sp_l3proto proto; + unsigned long prefix_ref_count[MLXSW_SP_PREFIX_COUNT]; + struct mlxsw_sp_prefix_usage prefix_usage; +@@ -578,7 +578,7 @@ mlxsw_sp_lpm_tree_find_unused(struct mlxsw_sp *mlxsw_sp) + + for (i = 0; i < mlxsw_sp->router->lpm.tree_count; i++) { + lpm_tree = &mlxsw_sp->router->lpm.trees[i]; +- if (lpm_tree->ref_count == 0) ++ if (refcount_read(&lpm_tree->ref_count) == 0) + return lpm_tree; + } + return NULL; +@@ -654,7 +654,7 @@ mlxsw_sp_lpm_tree_create(struct mlxsw_sp *mlxsw_sp, + sizeof(lpm_tree->prefix_usage)); + memset(&lpm_tree->prefix_ref_count, 0, + sizeof(lpm_tree->prefix_ref_count)); +- lpm_tree->ref_count = 1; ++ refcount_set(&lpm_tree->ref_count, 1); + return lpm_tree; + + err_left_struct_set: +@@ -678,7 +678,7 @@ mlxsw_sp_lpm_tree_get(struct mlxsw_sp *mlxsw_sp, + + for (i = 0; i < mlxsw_sp->router->lpm.tree_count; i++) { + lpm_tree = &mlxsw_sp->router->lpm.trees[i]; +- if (lpm_tree->ref_count != 0 && ++ if (refcount_read(&lpm_tree->ref_count) && + lpm_tree->proto == proto && + mlxsw_sp_prefix_usage_eq(&lpm_tree->prefix_usage, + prefix_usage)) { +@@ -691,14 +691,15 @@ mlxsw_sp_lpm_tree_get(struct mlxsw_sp *mlxsw_sp, + + static void mlxsw_sp_lpm_tree_hold(struct mlxsw_sp_lpm_tree *lpm_tree) + { +- lpm_tree->ref_count++; ++ refcount_inc(&lpm_tree->ref_count); + } + + static void mlxsw_sp_lpm_tree_put(struct mlxsw_sp *mlxsw_sp, + struct mlxsw_sp_lpm_tree *lpm_tree) + { +- if (--lpm_tree->ref_count == 0) +- mlxsw_sp_lpm_tree_destroy(mlxsw_sp, lpm_tree); ++ if (!refcount_dec_and_test(&lpm_tree->ref_count)) ++ return; ++ mlxsw_sp_lpm_tree_destroy(mlxsw_sp, lpm_tree); + } + + #define MLXSW_SP_LPM_TREE_MIN 1 /* tree 0 is reserved */ +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +index 6c749c148148d..6397ff0dc951c 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +@@ -61,7 +61,7 @@ struct mlxsw_sp_bridge_port { + struct mlxsw_sp_bridge_device *bridge_device; + struct list_head list; + struct list_head vlans_list; +- unsigned int ref_count; ++ refcount_t ref_count; + u8 stp_state; + unsigned long flags; + bool mrouter; +@@ -495,7 +495,7 @@ mlxsw_sp_bridge_port_create(struct mlxsw_sp_bridge_device *bridge_device, + BR_MCAST_FLOOD; + INIT_LIST_HEAD(&bridge_port->vlans_list); + list_add(&bridge_port->list, &bridge_device->ports_list); +- bridge_port->ref_count = 1; ++ refcount_set(&bridge_port->ref_count, 1); + + err = switchdev_bridge_port_offload(brport_dev, mlxsw_sp_port->dev, + NULL, NULL, NULL, false, extack); +@@ -531,7 +531,7 @@ mlxsw_sp_bridge_port_get(struct mlxsw_sp_bridge *bridge, + + bridge_port = mlxsw_sp_bridge_port_find(bridge, brport_dev); + if (bridge_port) { +- bridge_port->ref_count++; ++ refcount_inc(&bridge_port->ref_count); + return bridge_port; + } + +@@ -558,7 +558,7 @@ static void mlxsw_sp_bridge_port_put(struct mlxsw_sp_bridge *bridge, + { + struct mlxsw_sp_bridge_device *bridge_device; + +- if (--bridge_port->ref_count != 0) ++ if (!refcount_dec_and_test(&bridge_port->ref_count)) + return; + bridge_device = bridge_port->bridge_device; + mlxsw_sp_bridge_port_destroy(bridge_port); +-- +2.43.0 + diff --git a/queue-6.8/net-bcmasp-fix-memory-leak-when-bringing-down-interf.patch b/queue-6.8/net-bcmasp-fix-memory-leak-when-bringing-down-interf.patch new file mode 100644 index 00000000000..aefccb5efdd --- /dev/null +++ b/queue-6.8/net-bcmasp-fix-memory-leak-when-bringing-down-interf.patch @@ -0,0 +1,83 @@ +From 65deca92de124fb184efc5cfa711b26eac5704c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 11:05:41 -0700 +Subject: net: bcmasp: fix memory leak when bringing down interface + +From: Justin Chen + +[ Upstream commit 9f898fc2c31fbf0ac5ecd289f528a716464cb005 ] + +When bringing down the TX rings we flush the rings but forget to +reclaimed the flushed packets. This leads to a memory leak since we +do not free the dma mapped buffers. This also leads to tx control +block corruption when bringing down the interface for power +management. + +Fixes: 490cb412007d ("net: bcmasp: Add support for ASP2.0 Ethernet controller") +Signed-off-by: Justin Chen +Acked-by: Florian Fainelli +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20240418180541.2271719-1-justin.chen@broadcom.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/broadcom/asp2/bcmasp_intf.c | 21 ++++++++++++------- + 1 file changed, 14 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c b/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c +index 78901e2e73032..529172a87ae50 100644 +--- a/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c ++++ b/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c +@@ -435,10 +435,8 @@ static void umac_init(struct bcmasp_intf *intf) + umac_wl(intf, 0x800, UMC_RX_MAX_PKT_SZ); + } + +-static int bcmasp_tx_poll(struct napi_struct *napi, int budget) ++static int bcmasp_tx_reclaim(struct bcmasp_intf *intf) + { +- struct bcmasp_intf *intf = +- container_of(napi, struct bcmasp_intf, tx_napi); + struct bcmasp_intf_stats64 *stats = &intf->stats64; + struct device *kdev = &intf->parent->pdev->dev; + unsigned long read, released = 0; +@@ -481,10 +479,16 @@ static int bcmasp_tx_poll(struct napi_struct *napi, int budget) + DESC_RING_COUNT); + } + +- /* Ensure all descriptors have been written to DRAM for the hardware +- * to see updated contents. +- */ +- wmb(); ++ return released; ++} ++ ++static int bcmasp_tx_poll(struct napi_struct *napi, int budget) ++{ ++ struct bcmasp_intf *intf = ++ container_of(napi, struct bcmasp_intf, tx_napi); ++ int released = 0; ++ ++ released = bcmasp_tx_reclaim(intf); + + napi_complete(&intf->tx_napi); + +@@ -796,6 +800,7 @@ static int bcmasp_init_tx(struct bcmasp_intf *intf) + + intf->tx_spb_index = 0; + intf->tx_spb_clean_index = 0; ++ memset(intf->tx_cbs, 0, sizeof(struct bcmasp_tx_cb) * DESC_RING_COUNT); + + netif_napi_add_tx(intf->ndev, &intf->tx_napi, bcmasp_tx_poll); + +@@ -906,6 +911,8 @@ static void bcmasp_netif_deinit(struct net_device *dev) + } while (timeout-- > 0); + tx_spb_dma_wl(intf, 0x0, TX_SPB_DMA_FIFO_CTRL); + ++ bcmasp_tx_reclaim(intf); ++ + umac_enable_set(intf, UMC_CMD_TX_EN, 0); + + phy_stop(dev->phydev); +-- +2.43.0 + diff --git a/queue-6.8/net-dsa-mv88e6xx-fix-supported_interfaces-setup-in-m.patch b/queue-6.8/net-dsa-mv88e6xx-fix-supported_interfaces-setup-in-m.patch new file mode 100644 index 00000000000..dbdb7181e8e --- /dev/null +++ b/queue-6.8/net-dsa-mv88e6xx-fix-supported_interfaces-setup-in-m.patch @@ -0,0 +1,138 @@ +From 5dbef2f31f2c20e44d8c679f4fcba1dbb410c047 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Apr 2024 12:37:37 +0200 +Subject: net: dsa: mv88e6xx: fix supported_interfaces setup in + mv88e6250_phylink_get_caps() + +From: Matthias Schiffer + +[ Upstream commit a4e3899065ffa87d49dc20e8c17501edbc189692 ] + +With the recent PHYLINK changes requiring supported_interfaces to be set, +MV88E6250 family switches like the 88E6020 fail to probe - cmode is +never initialized on these devices, so mv88e6250_phylink_get_caps() does +not set any supported_interfaces flags. + +Instead of a cmode, on 88E6250 we have a read-only port mode value that +encodes similar information. There is no reason to bother mapping port +mode to the cmodes of other switch models; instead we introduce a +mv88e6250_setup_supported_interfaces() that is called directly from +mv88e6250_phylink_get_caps(). + +Fixes: de5c9bf40c45 ("net: phylink: require supported_interfaces to be filled") +Signed-off-by: Matthias Schiffer +Link: https://lore.kernel.org/r/20240417103737.166651-1-matthias.schiffer@ew.tq-group.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 56 +++++++++++++++++++++++++++++--- + drivers/net/dsa/mv88e6xxx/port.h | 23 ++++++++++--- + 2 files changed, 71 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index 7de8a9c9e4576..32416d8802ca4 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -566,13 +566,61 @@ static void mv88e6xxx_translate_cmode(u8 cmode, unsigned long *supported) + phy_interface_set_rgmii(supported); + } + +-static void mv88e6250_phylink_get_caps(struct mv88e6xxx_chip *chip, int port, +- struct phylink_config *config) ++static void ++mv88e6250_setup_supported_interfaces(struct mv88e6xxx_chip *chip, int port, ++ struct phylink_config *config) + { + unsigned long *supported = config->supported_interfaces; ++ int err; ++ u16 reg; + +- /* Translate the default cmode */ +- mv88e6xxx_translate_cmode(chip->ports[port].cmode, supported); ++ err = mv88e6xxx_port_read(chip, port, MV88E6XXX_PORT_STS, ®); ++ if (err) { ++ dev_err(chip->dev, "p%d: failed to read port status\n", port); ++ return; ++ } ++ ++ switch (reg & MV88E6250_PORT_STS_PORTMODE_MASK) { ++ case MV88E6250_PORT_STS_PORTMODE_MII_10_HALF_PHY: ++ case MV88E6250_PORT_STS_PORTMODE_MII_100_HALF_PHY: ++ case MV88E6250_PORT_STS_PORTMODE_MII_10_FULL_PHY: ++ case MV88E6250_PORT_STS_PORTMODE_MII_100_FULL_PHY: ++ __set_bit(PHY_INTERFACE_MODE_REVMII, supported); ++ break; ++ ++ case MV88E6250_PORT_STS_PORTMODE_MII_HALF: ++ case MV88E6250_PORT_STS_PORTMODE_MII_FULL: ++ __set_bit(PHY_INTERFACE_MODE_MII, supported); ++ break; ++ ++ case MV88E6250_PORT_STS_PORTMODE_MII_DUAL_100_RMII_FULL_PHY: ++ case MV88E6250_PORT_STS_PORTMODE_MII_200_RMII_FULL_PHY: ++ case MV88E6250_PORT_STS_PORTMODE_MII_10_100_RMII_HALF_PHY: ++ case MV88E6250_PORT_STS_PORTMODE_MII_10_100_RMII_FULL_PHY: ++ __set_bit(PHY_INTERFACE_MODE_REVRMII, supported); ++ break; ++ ++ case MV88E6250_PORT_STS_PORTMODE_MII_DUAL_100_RMII_FULL: ++ case MV88E6250_PORT_STS_PORTMODE_MII_10_100_RMII_FULL: ++ __set_bit(PHY_INTERFACE_MODE_RMII, supported); ++ break; ++ ++ case MV88E6250_PORT_STS_PORTMODE_MII_100_RGMII: ++ __set_bit(PHY_INTERFACE_MODE_RGMII, supported); ++ break; ++ ++ default: ++ dev_err(chip->dev, ++ "p%d: invalid port mode in status register: %04x\n", ++ port, reg); ++ } ++} ++ ++static void mv88e6250_phylink_get_caps(struct mv88e6xxx_chip *chip, int port, ++ struct phylink_config *config) ++{ ++ if (!mv88e6xxx_phy_is_internal(chip, port)) ++ mv88e6250_setup_supported_interfaces(chip, port, config); + + config->mac_capabilities = MAC_SYM_PAUSE | MAC_10 | MAC_100; + } +diff --git a/drivers/net/dsa/mv88e6xxx/port.h b/drivers/net/dsa/mv88e6xxx/port.h +index 86deeb347cbc1..ddadeb9bfdaee 100644 +--- a/drivers/net/dsa/mv88e6xxx/port.h ++++ b/drivers/net/dsa/mv88e6xxx/port.h +@@ -25,10 +25,25 @@ + #define MV88E6250_PORT_STS_PORTMODE_PHY_100_HALF 0x0900 + #define MV88E6250_PORT_STS_PORTMODE_PHY_10_FULL 0x0a00 + #define MV88E6250_PORT_STS_PORTMODE_PHY_100_FULL 0x0b00 +-#define MV88E6250_PORT_STS_PORTMODE_MII_10_HALF 0x0c00 +-#define MV88E6250_PORT_STS_PORTMODE_MII_100_HALF 0x0d00 +-#define MV88E6250_PORT_STS_PORTMODE_MII_10_FULL 0x0e00 +-#define MV88E6250_PORT_STS_PORTMODE_MII_100_FULL 0x0f00 ++/* - Modes with PHY suffix use output instead of input clock ++ * - Modes without RMII or RGMII use MII ++ * - Modes without speed do not have a fixed speed specified in the manual ++ * ("DC to x MHz" - variable clock support?) ++ */ ++#define MV88E6250_PORT_STS_PORTMODE_MII_DISABLED 0x0000 ++#define MV88E6250_PORT_STS_PORTMODE_MII_100_RGMII 0x0100 ++#define MV88E6250_PORT_STS_PORTMODE_MII_DUAL_100_RMII_FULL_PHY 0x0200 ++#define MV88E6250_PORT_STS_PORTMODE_MII_200_RMII_FULL_PHY 0x0400 ++#define MV88E6250_PORT_STS_PORTMODE_MII_DUAL_100_RMII_FULL 0x0600 ++#define MV88E6250_PORT_STS_PORTMODE_MII_10_100_RMII_FULL 0x0700 ++#define MV88E6250_PORT_STS_PORTMODE_MII_HALF 0x0800 ++#define MV88E6250_PORT_STS_PORTMODE_MII_10_100_RMII_HALF_PHY 0x0900 ++#define MV88E6250_PORT_STS_PORTMODE_MII_FULL 0x0a00 ++#define MV88E6250_PORT_STS_PORTMODE_MII_10_100_RMII_FULL_PHY 0x0b00 ++#define MV88E6250_PORT_STS_PORTMODE_MII_10_HALF_PHY 0x0c00 ++#define MV88E6250_PORT_STS_PORTMODE_MII_100_HALF_PHY 0x0d00 ++#define MV88E6250_PORT_STS_PORTMODE_MII_10_FULL_PHY 0x0e00 ++#define MV88E6250_PORT_STS_PORTMODE_MII_100_FULL_PHY 0x0f00 + #define MV88E6XXX_PORT_STS_LINK 0x0800 + #define MV88E6XXX_PORT_STS_DUPLEX 0x0400 + #define MV88E6XXX_PORT_STS_SPEED_MASK 0x0300 +-- +2.43.0 + diff --git a/queue-6.8/net-ethernet-ti-am65-cpts-fix-ptpv1-message-type-on-.patch b/queue-6.8/net-ethernet-ti-am65-cpts-fix-ptpv1-message-type-on-.patch new file mode 100644 index 00000000000..03f5dc9ad83 --- /dev/null +++ b/queue-6.8/net-ethernet-ti-am65-cpts-fix-ptpv1-message-type-on-.patch @@ -0,0 +1,58 @@ +From f71346fb4523f1c37e13b70a49ece720d9c0bbf4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 12:46:26 +0530 +Subject: net: ethernet: ti: am65-cpts: Fix PTPv1 message type on TX packets + +From: Jason Reeder + +[ Upstream commit 1b9e743e923b256e353a9a644195372285e5a6c0 ] + +The CPTS, by design, captures the messageType (Sync, Delay_Req, etc.) +field from the second nibble of the PTP header which is defined in the +PTPv2 (1588-2008) specification. In the PTPv1 (1588-2002) specification +the first two bytes of the PTP header are defined as the versionType +which is always 0x0001. This means that any PTPv1 packets that are +tagged for TX timestamping by the CPTS will have their messageType set +to 0x0 which corresponds to a Sync message type. This causes issues +when a PTPv1 stack is expecting a Delay_Req (messageType: 0x1) +timestamp that never appears. + +Fix this by checking if the ptp_class of the timestamped TX packet is +PTP_CLASS_V1 and then matching the PTP sequence ID to the stored +sequence ID in the skb->cb data structure. If the sequence IDs match +and the packet is of type PTPv1 then there is a chance that the +messageType has been incorrectly stored by the CPTS so overwrite the +messageType stored by the CPTS with the messageType from the skb->cb +data structure. This allows the PTPv1 stack to receive TX timestamps +for Delay_Req packets which are necessary to lock onto a PTP Leader. + +Signed-off-by: Jason Reeder +Signed-off-by: Ravi Gunasekaran +Tested-by: Ed Trexel +Fixes: f6bd59526ca5 ("net: ethernet: ti: introduce am654 common platform time sync driver") +Link: https://lore.kernel.org/r/20240424071626.32558-1-r-gunasekaran@ti.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/am65-cpts.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/ti/am65-cpts.c b/drivers/net/ethernet/ti/am65-cpts.c +index c66618d91c28f..f89716b1cfb64 100644 +--- a/drivers/net/ethernet/ti/am65-cpts.c ++++ b/drivers/net/ethernet/ti/am65-cpts.c +@@ -784,6 +784,11 @@ static bool am65_cpts_match_tx_ts(struct am65_cpts *cpts, + struct am65_cpts_skb_cb_data *skb_cb = + (struct am65_cpts_skb_cb_data *)skb->cb; + ++ if ((ptp_classify_raw(skb) & PTP_CLASS_V1) && ++ ((mtype_seqid & AM65_CPTS_EVENT_1_SEQUENCE_ID_MASK) == ++ (skb_cb->skb_mtype_seqid & AM65_CPTS_EVENT_1_SEQUENCE_ID_MASK))) ++ mtype_seqid = skb_cb->skb_mtype_seqid; ++ + if (mtype_seqid == skb_cb->skb_mtype_seqid) { + u64 ns = event->timestamp; + +-- +2.43.0 + diff --git a/queue-6.8/net-fix-sk_memory_allocated_-add-sub-vs-softirqs.patch b/queue-6.8/net-fix-sk_memory_allocated_-add-sub-vs-softirqs.patch new file mode 100644 index 00000000000..d2a9bb575c2 --- /dev/null +++ b/queue-6.8/net-fix-sk_memory_allocated_-add-sub-vs-softirqs.patch @@ -0,0 +1,102 @@ +From be40f5a7d70329e8ebd34d72198cc81790e8303a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Apr 2024 17:52:48 +0000 +Subject: net: fix sk_memory_allocated_{add|sub} vs softirqs + +From: Eric Dumazet + +[ Upstream commit 3584718cf2ec7e79b6814f2596dcf398c5fb2eca ] + +Jonathan Heathcote reported a regression caused by blamed commit +on aarch64 architecture. + +x86 happens to have irq-safe __this_cpu_add_return() +and __this_cpu_sub(), but this is not generic. + +I think my confusion came from "struct sock" argument, +because these helpers are called with a locked socket. +But the memory accounting is per-proto (and per-cpu after +the blamed commit). We might cleanup these helpers later +to directly accept a "struct proto *proto" argument. + +Switch to this_cpu_add_return() and this_cpu_xchg() +operations, and get rid of preempt_disable()/preempt_enable() pairs. + +Fast path becomes a bit faster as a result :) + +Many thanks to Jonathan Heathcote for his awesome report and +investigations. + +Fixes: 3cd3399dd7a8 ("net: implement per-cpu reserves for memory_allocated") +Reported-by: Jonathan Heathcote +Closes: https://lore.kernel.org/netdev/VI1PR01MB42407D7947B2EA448F1E04EFD10D2@VI1PR01MB4240.eurprd01.prod.exchangelabs.com/ +Signed-off-by: Eric Dumazet +Acked-by: Soheil Hassas Yeganeh +Reviewed-by: Shakeel Butt +Link: https://lore.kernel.org/r/20240421175248.1692552-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/sock.h | 38 ++++++++++++++++++++------------------ + 1 file changed, 20 insertions(+), 18 deletions(-) + +diff --git a/include/net/sock.h b/include/net/sock.h +index 6855c50a70f1b..54a7967613348 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -1431,32 +1431,34 @@ sk_memory_allocated(const struct sock *sk) + #define SK_MEMORY_PCPU_RESERVE (1 << (20 - PAGE_SHIFT)) + extern int sysctl_mem_pcpu_rsv; + ++static inline void proto_memory_pcpu_drain(struct proto *proto) ++{ ++ int val = this_cpu_xchg(*proto->per_cpu_fw_alloc, 0); ++ ++ if (val) ++ atomic_long_add(val, proto->memory_allocated); ++} ++ + static inline void +-sk_memory_allocated_add(struct sock *sk, int amt) ++sk_memory_allocated_add(const struct sock *sk, int val) + { +- int local_reserve; ++ struct proto *proto = sk->sk_prot; + +- preempt_disable(); +- local_reserve = __this_cpu_add_return(*sk->sk_prot->per_cpu_fw_alloc, amt); +- if (local_reserve >= READ_ONCE(sysctl_mem_pcpu_rsv)) { +- __this_cpu_sub(*sk->sk_prot->per_cpu_fw_alloc, local_reserve); +- atomic_long_add(local_reserve, sk->sk_prot->memory_allocated); +- } +- preempt_enable(); ++ val = this_cpu_add_return(*proto->per_cpu_fw_alloc, val); ++ ++ if (unlikely(val >= READ_ONCE(sysctl_mem_pcpu_rsv))) ++ proto_memory_pcpu_drain(proto); + } + + static inline void +-sk_memory_allocated_sub(struct sock *sk, int amt) ++sk_memory_allocated_sub(const struct sock *sk, int val) + { +- int local_reserve; ++ struct proto *proto = sk->sk_prot; + +- preempt_disable(); +- local_reserve = __this_cpu_sub_return(*sk->sk_prot->per_cpu_fw_alloc, amt); +- if (local_reserve <= -READ_ONCE(sysctl_mem_pcpu_rsv)) { +- __this_cpu_sub(*sk->sk_prot->per_cpu_fw_alloc, local_reserve); +- atomic_long_add(local_reserve, sk->sk_prot->memory_allocated); +- } +- preempt_enable(); ++ val = this_cpu_sub_return(*proto->per_cpu_fw_alloc, val); ++ ++ if (unlikely(val <= -READ_ONCE(sysctl_mem_pcpu_rsv))) ++ proto_memory_pcpu_drain(proto); + } + + #define SK_ALLOC_PERCPU_COUNTER_BATCH 16 +-- +2.43.0 + diff --git a/queue-6.8/net-gtp-fix-use-after-free-in-gtp_dellink.patch b/queue-6.8/net-gtp-fix-use-after-free-in-gtp_dellink.patch new file mode 100644 index 00000000000..3c7a596154d --- /dev/null +++ b/queue-6.8/net-gtp-fix-use-after-free-in-gtp_dellink.patch @@ -0,0 +1,46 @@ +From 9cf1eec6e298682cc11b2ad3b6ae62786f7cb630 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 05:39:30 -0400 +Subject: net: gtp: Fix Use-After-Free in gtp_dellink + +From: Hyunwoo Kim + +[ Upstream commit f2a904107ee2b647bb7794a1a82b67740d7c8a64 ] + +Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal +of gtp_dellink, is not part of the RCU read critical section, it +is possible that the RCU grace period will pass during the traversal and +the key will be free. + +To prevent this, it should be changed to hlist_for_each_entry_safe. + +Fixes: 94dc550a5062 ("gtp: fix an use-after-free in ipv4_pdp_find()") +Signed-off-by: Hyunwoo Kim +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/gtp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c +index 2b5357d94ff56..63f932256c9f5 100644 +--- a/drivers/net/gtp.c ++++ b/drivers/net/gtp.c +@@ -1111,11 +1111,12 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev, + static void gtp_dellink(struct net_device *dev, struct list_head *head) + { + struct gtp_dev *gtp = netdev_priv(dev); ++ struct hlist_node *next; + struct pdp_ctx *pctx; + int i; + + for (i = 0; i < gtp->hash_size; i++) +- hlist_for_each_entry_rcu(pctx, >p->tid_hash[i], hlist_tid) ++ hlist_for_each_entry_safe(pctx, next, >p->tid_hash[i], hlist_tid) + pdp_context_delete(pctx); + + list_del_rcu(>p->list); +-- +2.43.0 + diff --git a/queue-6.8/net-libwx-fix-alloc-msix-vectors-failed.patch b/queue-6.8/net-libwx-fix-alloc-msix-vectors-failed.patch new file mode 100644 index 00000000000..cfb10bc8af1 --- /dev/null +++ b/queue-6.8/net-libwx-fix-alloc-msix-vectors-failed.patch @@ -0,0 +1,43 @@ +From f0120d6c72976dec2556080f80b9a2b7223e827f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 10:15:56 +0800 +Subject: net: libwx: fix alloc msix vectors failed + +From: Duanqiang Wen + +[ Upstream commit 69197dfc64007b5292cc960581548f41ccd44828 ] + +driver needs queue msix vectors and one misc irq vector, +but only queue vectors need irq affinity. +when num_online_cpus is less than chip max msix vectors, +driver will acquire (num_online_cpus + 1) vecotrs, and +call pci_alloc_irq_vectors_affinity functions with affinity +params without setting pre_vectors or post_vectors, it will +cause return error code -ENOSPC. +Misc irq vector is vector 0, driver need to set affinity params +.pre_vectors = 1. + +Fixes: 3f703186113f ("net: libwx: Add irq flow functions") +Signed-off-by: Duanqiang Wen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/wangxun/libwx/wx_lib.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/wangxun/libwx/wx_lib.c b/drivers/net/ethernet/wangxun/libwx/wx_lib.c +index 8706223a6e5aa..08d3e4069c5fa 100644 +--- a/drivers/net/ethernet/wangxun/libwx/wx_lib.c ++++ b/drivers/net/ethernet/wangxun/libwx/wx_lib.c +@@ -1598,7 +1598,7 @@ static void wx_set_num_queues(struct wx *wx) + */ + static int wx_acquire_msix_vectors(struct wx *wx) + { +- struct irq_affinity affd = {0, }; ++ struct irq_affinity affd = { .pre_vectors = 1 }; + int nvecs, i; + + /* We start by asking for one vector per queue pair */ +-- +2.43.0 + diff --git a/queue-6.8/net-make-sk_memory_pcpu_reserv-tunable.patch b/queue-6.8/net-make-sk_memory_pcpu_reserv-tunable.patch new file mode 100644 index 00000000000..ca58b82dc9d --- /dev/null +++ b/queue-6.8/net-make-sk_memory_pcpu_reserv-tunable.patch @@ -0,0 +1,126 @@ +From abdf8f5de328642052678557043a4feb2fe6a576 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Feb 2024 02:24:52 +0000 +Subject: net: make SK_MEMORY_PCPU_RESERV tunable + +From: Adam Li + +[ Upstream commit 12a686c2e761f1f1f6e6e2117a9ab9c6de2ac8a7 ] + +This patch adds /proc/sys/net/core/mem_pcpu_rsv sysctl file, +to make SK_MEMORY_PCPU_RESERV tunable. + +Commit 3cd3399dd7a8 ("net: implement per-cpu reserves for +memory_allocated") introduced per-cpu forward alloc cache: + +"Implement a per-cpu cache of +1/-1 MB, to reduce number +of changes to sk->sk_prot->memory_allocated, which +would otherwise be cause of false sharing." + +sk_prot->memory_allocated points to global atomic variable: +atomic_long_t tcp_memory_allocated ____cacheline_aligned_in_smp; + +If increasing the per-cpu cache size from 1MB to e.g. 16MB, +changes to sk->sk_prot->memory_allocated can be further reduced. +Performance may be improved on system with many cores. + +Signed-off-by: Adam Li +Reviewed-by: Christoph Lameter (Ampere) +Signed-off-by: David S. Miller +Stable-dep-of: 3584718cf2ec ("net: fix sk_memory_allocated_{add|sub} vs softirqs") +Signed-off-by: Sasha Levin +--- + Documentation/admin-guide/sysctl/net.rst | 5 +++++ + include/net/sock.h | 5 +++-- + net/core/sock.c | 1 + + net/core/sysctl_net_core.c | 9 +++++++++ + 4 files changed, 18 insertions(+), 2 deletions(-) + +diff --git a/Documentation/admin-guide/sysctl/net.rst b/Documentation/admin-guide/sysctl/net.rst +index 3960916519557..7250c0542828b 100644 +--- a/Documentation/admin-guide/sysctl/net.rst ++++ b/Documentation/admin-guide/sysctl/net.rst +@@ -206,6 +206,11 @@ Will increase power usage. + + Default: 0 (off) + ++mem_pcpu_rsv ++------------ ++ ++Per-cpu reserved forward alloc cache size in page units. Default 1MB per CPU. ++ + rmem_default + ------------ + +diff --git a/include/net/sock.h b/include/net/sock.h +index 4afb4376c97e8..6855c50a70f1b 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -1429,6 +1429,7 @@ sk_memory_allocated(const struct sock *sk) + + /* 1 MB per cpu, in page units */ + #define SK_MEMORY_PCPU_RESERVE (1 << (20 - PAGE_SHIFT)) ++extern int sysctl_mem_pcpu_rsv; + + static inline void + sk_memory_allocated_add(struct sock *sk, int amt) +@@ -1437,7 +1438,7 @@ sk_memory_allocated_add(struct sock *sk, int amt) + + preempt_disable(); + local_reserve = __this_cpu_add_return(*sk->sk_prot->per_cpu_fw_alloc, amt); +- if (local_reserve >= SK_MEMORY_PCPU_RESERVE) { ++ if (local_reserve >= READ_ONCE(sysctl_mem_pcpu_rsv)) { + __this_cpu_sub(*sk->sk_prot->per_cpu_fw_alloc, local_reserve); + atomic_long_add(local_reserve, sk->sk_prot->memory_allocated); + } +@@ -1451,7 +1452,7 @@ sk_memory_allocated_sub(struct sock *sk, int amt) + + preempt_disable(); + local_reserve = __this_cpu_sub_return(*sk->sk_prot->per_cpu_fw_alloc, amt); +- if (local_reserve <= -SK_MEMORY_PCPU_RESERVE) { ++ if (local_reserve <= -READ_ONCE(sysctl_mem_pcpu_rsv)) { + __this_cpu_sub(*sk->sk_prot->per_cpu_fw_alloc, local_reserve); + atomic_long_add(local_reserve, sk->sk_prot->memory_allocated); + } +diff --git a/net/core/sock.c b/net/core/sock.c +index 5e78798456fd8..9cf404e8038a4 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -283,6 +283,7 @@ __u32 sysctl_rmem_max __read_mostly = SK_RMEM_MAX; + EXPORT_SYMBOL(sysctl_rmem_max); + __u32 sysctl_wmem_default __read_mostly = SK_WMEM_MAX; + __u32 sysctl_rmem_default __read_mostly = SK_RMEM_MAX; ++int sysctl_mem_pcpu_rsv __read_mostly = SK_MEMORY_PCPU_RESERVE; + + int sysctl_tstamp_allow_data __read_mostly = 1; + +diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c +index 0f0cb1465e089..986f15e5d6c41 100644 +--- a/net/core/sysctl_net_core.c ++++ b/net/core/sysctl_net_core.c +@@ -30,6 +30,7 @@ static int int_3600 = 3600; + static int min_sndbuf = SOCK_MIN_SNDBUF; + static int min_rcvbuf = SOCK_MIN_RCVBUF; + static int max_skb_frags = MAX_SKB_FRAGS; ++static int min_mem_pcpu_rsv = SK_MEMORY_PCPU_RESERVE; + + static int net_msg_warn; /* Unused, but still a sysctl */ + +@@ -407,6 +408,14 @@ static struct ctl_table net_core_table[] = { + .proc_handler = proc_dointvec_minmax, + .extra1 = &min_rcvbuf, + }, ++ { ++ .procname = "mem_pcpu_rsv", ++ .data = &sysctl_mem_pcpu_rsv, ++ .maxlen = sizeof(int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec_minmax, ++ .extra1 = &min_mem_pcpu_rsv, ++ }, + { + .procname = "dev_weight", + .data = &weight_p, +-- +2.43.0 + diff --git a/queue-6.8/net-openvswitch-fix-use-after-free-in-ovs_ct_exit.patch b/queue-6.8/net-openvswitch-fix-use-after-free-in-ovs_ct_exit.patch new file mode 100644 index 00000000000..20bbc8c5c7b --- /dev/null +++ b/queue-6.8/net-openvswitch-fix-use-after-free-in-ovs_ct_exit.patch @@ -0,0 +1,46 @@ +From 54e54aee23e3d9c8313cddc501595bce54598147 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 05:37:17 -0400 +Subject: net: openvswitch: Fix Use-After-Free in ovs_ct_exit + +From: Hyunwoo Kim + +[ Upstream commit 5ea7b72d4fac2fdbc0425cd8f2ea33abe95235b2 ] + +Since kfree_rcu, which is called in the hlist_for_each_entry_rcu traversal +of ovs_ct_limit_exit, is not part of the RCU read critical section, it +is possible that the RCU grace period will pass during the traversal and +the key will be free. + +To prevent this, it should be changed to hlist_for_each_entry_safe. + +Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit") +Signed-off-by: Hyunwoo Kim +Reviewed-by: Eric Dumazet +Reviewed-by: Aaron Conole +Link: https://lore.kernel.org/r/ZiYvzQN/Ry5oeFQW@v4bel-B760M-AORUS-ELITE-AX +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/openvswitch/conntrack.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c +index 74b63cdb59923..2928c142a2ddb 100644 +--- a/net/openvswitch/conntrack.c ++++ b/net/openvswitch/conntrack.c +@@ -1593,9 +1593,9 @@ static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net) + for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) { + struct hlist_head *head = &info->limits[i]; + struct ovs_ct_limit *ct_limit; ++ struct hlist_node *next; + +- hlist_for_each_entry_rcu(ct_limit, head, hlist_node, +- lockdep_ovsl_is_held()) ++ hlist_for_each_entry_safe(ct_limit, next, head, hlist_node) + kfree_rcu(ct_limit, rcu); + } + kfree(info->limits); +-- +2.43.0 + diff --git a/queue-6.8/net-phy-dp83869-fix-mii-mode-failure.patch b/queue-6.8/net-phy-dp83869-fix-mii-mode-failure.patch new file mode 100644 index 00000000000..01fdc7db0e7 --- /dev/null +++ b/queue-6.8/net-phy-dp83869-fix-mii-mode-failure.patch @@ -0,0 +1,50 @@ +From fcc748a8757b606db8c6f4d71f2a3bdbeec48ae8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 14:18:28 +0530 +Subject: net: phy: dp83869: Fix MII mode failure + +From: MD Danish Anwar + +[ Upstream commit 6c9cd59dbcb09a2122b5ce0dfc07c74e6fc00dc0 ] + +The DP83869 driver sets the MII bit (needed for PHY to work in MII mode) +only if the op-mode is either DP83869_100M_MEDIA_CONVERT or +DP83869_RGMII_100_BASE. + +Some drivers i.e. ICSSG support MII mode with op-mode as +DP83869_RGMII_COPPER_ETHERNET for which the MII bit is not set in dp83869 +driver. As a result MII mode on ICSSG doesn't work and below log is seen. + +TI DP83869 300b2400.mdio:0f: selected op-mode is not valid with MII mode +icssg-prueth icssg1-eth: couldn't connect to phy ethernet-phy@0 +icssg-prueth icssg1-eth: can't phy connect port MII0 + +Fix this by setting MII bit for DP83869_RGMII_COPPER_ETHERNET op-mode as +well. + +Fixes: 94e86ef1b801 ("net: phy: dp83869: support mii mode when rgmii strap cfg is used") +Signed-off-by: MD Danish Anwar +Reviewed-by: Ravi Gunasekaran +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/dp83869.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/phy/dp83869.c b/drivers/net/phy/dp83869.c +index fa8c6fdcf3018..d7aaefb5226b6 100644 +--- a/drivers/net/phy/dp83869.c ++++ b/drivers/net/phy/dp83869.c +@@ -695,7 +695,8 @@ static int dp83869_configure_mode(struct phy_device *phydev, + phy_ctrl_val = dp83869->mode; + if (phydev->interface == PHY_INTERFACE_MODE_MII) { + if (dp83869->mode == DP83869_100M_MEDIA_CONVERT || +- dp83869->mode == DP83869_RGMII_100_BASE) { ++ dp83869->mode == DP83869_RGMII_100_BASE || ++ dp83869->mode == DP83869_RGMII_COPPER_ETHERNET) { + phy_ctrl_val |= DP83869_OP_MODE_MII; + } else { + phydev_err(phydev, "selected op-mode is not valid with MII mode\n"); +-- +2.43.0 + diff --git a/queue-6.8/net-phy-mediatek-ge-soc-follow-netdev-led-trigger-se.patch b/queue-6.8/net-phy-mediatek-ge-soc-follow-netdev-led-trigger-se.patch new file mode 100644 index 00000000000..cc3aceb68f7 --- /dev/null +++ b/queue-6.8/net-phy-mediatek-ge-soc-follow-netdev-led-trigger-se.patch @@ -0,0 +1,133 @@ +From 3cee1d4829c58bc206fca76c5d06b718d37d07b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Apr 2024 01:08:31 +0100 +Subject: net: phy: mediatek-ge-soc: follow netdev LED trigger semantics + +From: Daniel Golle + +[ Upstream commit 5b5f724b05c550e10693a53a81cadca901aefd16 ] + +Only blink if the link is up on a LED which is programmed to also +indicate link-status. + +Otherwise, if both LEDs are in use to indicate different speeds, the +resulting blinking being inverted on LEDs which aren't switched on at +a specific speed is quite counter-intuitive. + +Also make sure that state left behind by reset or the bootloader is +recognized correctly including the half-duplex and full-duplex bits as +well as the (unsupported by Linux netdev trigger semantics) link-down +bit. + +Fixes: c66937b0f8db ("net: phy: mediatek-ge-soc: support PHY LEDs") +Signed-off-by: Daniel Golle +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/mediatek-ge-soc.c | 43 +++++++++++++++++++------------ + 1 file changed, 26 insertions(+), 17 deletions(-) + +diff --git a/drivers/net/phy/mediatek-ge-soc.c b/drivers/net/phy/mediatek-ge-soc.c +index 0f3a1538a8b8e..f4f9412d0cd7e 100644 +--- a/drivers/net/phy/mediatek-ge-soc.c ++++ b/drivers/net/phy/mediatek-ge-soc.c +@@ -216,6 +216,9 @@ + #define MTK_PHY_LED_ON_LINK1000 BIT(0) + #define MTK_PHY_LED_ON_LINK100 BIT(1) + #define MTK_PHY_LED_ON_LINK10 BIT(2) ++#define MTK_PHY_LED_ON_LINK (MTK_PHY_LED_ON_LINK10 |\ ++ MTK_PHY_LED_ON_LINK100 |\ ++ MTK_PHY_LED_ON_LINK1000) + #define MTK_PHY_LED_ON_LINKDOWN BIT(3) + #define MTK_PHY_LED_ON_FDX BIT(4) /* Full duplex */ + #define MTK_PHY_LED_ON_HDX BIT(5) /* Half duplex */ +@@ -231,6 +234,12 @@ + #define MTK_PHY_LED_BLINK_100RX BIT(3) + #define MTK_PHY_LED_BLINK_10TX BIT(4) + #define MTK_PHY_LED_BLINK_10RX BIT(5) ++#define MTK_PHY_LED_BLINK_RX (MTK_PHY_LED_BLINK_10RX |\ ++ MTK_PHY_LED_BLINK_100RX |\ ++ MTK_PHY_LED_BLINK_1000RX) ++#define MTK_PHY_LED_BLINK_TX (MTK_PHY_LED_BLINK_10TX |\ ++ MTK_PHY_LED_BLINK_100TX |\ ++ MTK_PHY_LED_BLINK_1000TX) + #define MTK_PHY_LED_BLINK_COLLISION BIT(6) + #define MTK_PHY_LED_BLINK_RX_CRC_ERR BIT(7) + #define MTK_PHY_LED_BLINK_RX_IDLE_ERR BIT(8) +@@ -1247,11 +1256,9 @@ static int mt798x_phy_led_hw_control_get(struct phy_device *phydev, u8 index, + if (blink < 0) + return -EIO; + +- if ((on & (MTK_PHY_LED_ON_LINK1000 | MTK_PHY_LED_ON_LINK100 | +- MTK_PHY_LED_ON_LINK10)) || +- (blink & (MTK_PHY_LED_BLINK_1000RX | MTK_PHY_LED_BLINK_100RX | +- MTK_PHY_LED_BLINK_10RX | MTK_PHY_LED_BLINK_1000TX | +- MTK_PHY_LED_BLINK_100TX | MTK_PHY_LED_BLINK_10TX))) ++ if ((on & (MTK_PHY_LED_ON_LINK | MTK_PHY_LED_ON_FDX | MTK_PHY_LED_ON_HDX | ++ MTK_PHY_LED_ON_LINKDOWN)) || ++ (blink & (MTK_PHY_LED_BLINK_RX | MTK_PHY_LED_BLINK_TX))) + set_bit(bit_netdev, &priv->led_state); + else + clear_bit(bit_netdev, &priv->led_state); +@@ -1269,7 +1276,7 @@ static int mt798x_phy_led_hw_control_get(struct phy_device *phydev, u8 index, + if (!rules) + return 0; + +- if (on & (MTK_PHY_LED_ON_LINK1000 | MTK_PHY_LED_ON_LINK100 | MTK_PHY_LED_ON_LINK10)) ++ if (on & MTK_PHY_LED_ON_LINK) + *rules |= BIT(TRIGGER_NETDEV_LINK); + + if (on & MTK_PHY_LED_ON_LINK10) +@@ -1287,10 +1294,10 @@ static int mt798x_phy_led_hw_control_get(struct phy_device *phydev, u8 index, + if (on & MTK_PHY_LED_ON_HDX) + *rules |= BIT(TRIGGER_NETDEV_HALF_DUPLEX); + +- if (blink & (MTK_PHY_LED_BLINK_1000RX | MTK_PHY_LED_BLINK_100RX | MTK_PHY_LED_BLINK_10RX)) ++ if (blink & MTK_PHY_LED_BLINK_RX) + *rules |= BIT(TRIGGER_NETDEV_RX); + +- if (blink & (MTK_PHY_LED_BLINK_1000TX | MTK_PHY_LED_BLINK_100TX | MTK_PHY_LED_BLINK_10TX)) ++ if (blink & MTK_PHY_LED_BLINK_TX) + *rules |= BIT(TRIGGER_NETDEV_TX); + + return 0; +@@ -1323,15 +1330,19 @@ static int mt798x_phy_led_hw_control_set(struct phy_device *phydev, u8 index, + on |= MTK_PHY_LED_ON_LINK1000; + + if (rules & BIT(TRIGGER_NETDEV_RX)) { +- blink |= MTK_PHY_LED_BLINK_10RX | +- MTK_PHY_LED_BLINK_100RX | +- MTK_PHY_LED_BLINK_1000RX; ++ blink |= (on & MTK_PHY_LED_ON_LINK) ? ++ (((on & MTK_PHY_LED_ON_LINK10) ? MTK_PHY_LED_BLINK_10RX : 0) | ++ ((on & MTK_PHY_LED_ON_LINK100) ? MTK_PHY_LED_BLINK_100RX : 0) | ++ ((on & MTK_PHY_LED_ON_LINK1000) ? MTK_PHY_LED_BLINK_1000RX : 0)) : ++ MTK_PHY_LED_BLINK_RX; + } + + if (rules & BIT(TRIGGER_NETDEV_TX)) { +- blink |= MTK_PHY_LED_BLINK_10TX | +- MTK_PHY_LED_BLINK_100TX | +- MTK_PHY_LED_BLINK_1000TX; ++ blink |= (on & MTK_PHY_LED_ON_LINK) ? ++ (((on & MTK_PHY_LED_ON_LINK10) ? MTK_PHY_LED_BLINK_10TX : 0) | ++ ((on & MTK_PHY_LED_ON_LINK100) ? MTK_PHY_LED_BLINK_100TX : 0) | ++ ((on & MTK_PHY_LED_ON_LINK1000) ? MTK_PHY_LED_BLINK_1000TX : 0)) : ++ MTK_PHY_LED_BLINK_TX; + } + + if (blink || on) +@@ -1344,9 +1355,7 @@ static int mt798x_phy_led_hw_control_set(struct phy_device *phydev, u8 index, + MTK_PHY_LED0_ON_CTRL, + MTK_PHY_LED_ON_FDX | + MTK_PHY_LED_ON_HDX | +- MTK_PHY_LED_ON_LINK10 | +- MTK_PHY_LED_ON_LINK100 | +- MTK_PHY_LED_ON_LINK1000, ++ MTK_PHY_LED_ON_LINK, + on); + + if (ret) +-- +2.43.0 + diff --git a/queue-6.8/net-ti-icssg-prueth-fix-signedness-bug-in-prueth_ini.patch b/queue-6.8/net-ti-icssg-prueth-fix-signedness-bug-in-prueth_ini.patch new file mode 100644 index 00000000000..13efe5d82d1 --- /dev/null +++ b/queue-6.8/net-ti-icssg-prueth-fix-signedness-bug-in-prueth_ini.patch @@ -0,0 +1,49 @@ +From 88e35741300c8a2ed9a0850d350d1317cd163696 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 19:15:22 +0300 +Subject: net: ti: icssg-prueth: Fix signedness bug in prueth_init_rx_chns() + +From: Dan Carpenter + +[ Upstream commit 4dcd0e83ea1d1df9b2e0174a6d3e795b3477d64e ] + +The rx_chn->irq[] array is unsigned int but it should be signed for the +error handling to work. Also if k3_udma_glue_rx_get_irq() returns zero +then we should return -ENXIO instead of success. + +Fixes: 128d5874c082 ("net: ti: icssg-prueth: Add ICSSG ethernet driver") +Signed-off-by: Dan Carpenter +Reviewed-by: Roger Quadros +Reviewed-by: MD Danish Anwar +Link: https://lore.kernel.org/r/05282415-e7f4-42f3-99f8-32fde8f30936@moroto.mountain +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/icssg/icssg_prueth.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/ti/icssg/icssg_prueth.c b/drivers/net/ethernet/ti/icssg/icssg_prueth.c +index 411898a4f38ca..4a78e8a1cabf4 100644 +--- a/drivers/net/ethernet/ti/icssg/icssg_prueth.c ++++ b/drivers/net/ethernet/ti/icssg/icssg_prueth.c +@@ -421,12 +421,14 @@ static int prueth_init_rx_chns(struct prueth_emac *emac, + if (!i) + fdqring_id = k3_udma_glue_rx_flow_get_fdq_id(rx_chn->rx_chn, + i); +- rx_chn->irq[i] = k3_udma_glue_rx_get_irq(rx_chn->rx_chn, i); +- if (rx_chn->irq[i] <= 0) { +- ret = rx_chn->irq[i]; ++ ret = k3_udma_glue_rx_get_irq(rx_chn->rx_chn, i); ++ if (ret <= 0) { ++ if (!ret) ++ ret = -ENXIO; + netdev_err(ndev, "Failed to get rx dma irq"); + goto fail; + } ++ rx_chn->irq[i] = ret; + } + + return 0; +-- +2.43.0 + diff --git a/queue-6.8/net-usb-ax88179_178a-stop-lying-about-skb-truesize.patch b/queue-6.8/net-usb-ax88179_178a-stop-lying-about-skb-truesize.patch new file mode 100644 index 00000000000..12d71c65b83 --- /dev/null +++ b/queue-6.8/net-usb-ax88179_178a-stop-lying-about-skb-truesize.patch @@ -0,0 +1,64 @@ +From cc6edfed163e62832138f57030db9705670d3777 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Apr 2024 19:38:28 +0000 +Subject: net: usb: ax88179_178a: stop lying about skb->truesize + +From: Eric Dumazet + +[ Upstream commit 4ce62d5b2f7aecd4900e7d6115588ad7f9acccca ] + +Some usb drivers try to set small skb->truesize and break +core networking stacks. + +In this patch, I removed one of the skb->truesize overide. + +I also replaced one skb_clone() by an allocation of a fresh +and small skb, to get minimally sized skbs, like we did +in commit 1e2c61172342 ("net: cdc_ncm: reduce skb truesize +in rx path") + +Fixes: f8ebb3ac881b ("net: usb: ax88179_178a: Fix packet receiving") +Reported-by: shironeko +Closes: https://lore.kernel.org/netdev/c110f41a0d2776b525930f213ca9715c@tesaguri.club/ +Signed-off-by: Eric Dumazet +Cc: Jose Alonso +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20240421193828.1966195-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/ax88179_178a.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c +index 3078511f76083..21b6c4d94a632 100644 +--- a/drivers/net/usb/ax88179_178a.c ++++ b/drivers/net/usb/ax88179_178a.c +@@ -1456,21 +1456,16 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + /* Skip IP alignment pseudo header */ + skb_pull(skb, 2); + +- skb->truesize = SKB_TRUESIZE(pkt_len_plus_padd); + ax88179_rx_checksum(skb, pkt_hdr); + return 1; + } + +- ax_skb = skb_clone(skb, GFP_ATOMIC); ++ ax_skb = netdev_alloc_skb_ip_align(dev->net, pkt_len); + if (!ax_skb) + return 0; +- skb_trim(ax_skb, pkt_len); ++ skb_put(ax_skb, pkt_len); ++ memcpy(ax_skb->data, skb->data + 2, pkt_len); + +- /* Skip IP alignment pseudo header */ +- skb_pull(ax_skb, 2); +- +- skb->truesize = pkt_len_plus_padd + +- SKB_DATA_ALIGN(sizeof(struct sk_buff)); + ax88179_rx_checksum(ax_skb, pkt_hdr); + usbnet_skb_return(dev, ax_skb); + +-- +2.43.0 + diff --git a/queue-6.8/netfilter-nf_tables-honor-table-dormant-flag-from-ne.patch b/queue-6.8/netfilter-nf_tables-honor-table-dormant-flag-from-ne.patch new file mode 100644 index 00000000000..66c83273175 --- /dev/null +++ b/queue-6.8/netfilter-nf_tables-honor-table-dormant-flag-from-ne.patch @@ -0,0 +1,73 @@ +From 5514e521c7fb3ef995ba913d7f9fe8ec31b7dc66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 20:45:01 +0200 +Subject: netfilter: nf_tables: honor table dormant flag from netdev release + event path + +From: Pablo Neira Ayuso + +[ Upstream commit 8e30abc9ace4f0add4cd761dfdbfaebae5632dd2 ] + +Check for table dormant flag otherwise netdev release event path tries +to unregister an already unregistered hook. + +[524854.857999] ------------[ cut here ]------------ +[524854.858010] WARNING: CPU: 0 PID: 3386599 at net/netfilter/core.c:501 __nf_unregister_net_hook+0x21a/0x260 +[...] +[524854.858848] CPU: 0 PID: 3386599 Comm: kworker/u32:2 Not tainted 6.9.0-rc3+ #365 +[524854.858869] Workqueue: netns cleanup_net +[524854.858886] RIP: 0010:__nf_unregister_net_hook+0x21a/0x260 +[524854.858903] Code: 24 e8 aa 73 83 ff 48 63 43 1c 83 f8 01 0f 85 3d ff ff ff e8 98 d1 f0 ff 48 8b 3c 24 e8 8f 73 83 ff 48 63 43 1c e9 26 ff ff ff <0f> 0b 48 83 c4 18 48 c7 c7 00 68 e9 82 5b 5d 41 5c 41 5d 41 5e 41 +[524854.858914] RSP: 0018:ffff8881e36d79e0 EFLAGS: 00010246 +[524854.858926] RAX: 0000000000000000 RBX: ffff8881339ae790 RCX: ffffffff81ba524a +[524854.858936] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff8881c8a16438 +[524854.858945] RBP: ffff8881c8a16438 R08: 0000000000000001 R09: ffffed103c6daf34 +[524854.858954] R10: ffff8881e36d79a7 R11: 0000000000000000 R12: 0000000000000005 +[524854.858962] R13: ffff8881c8a16000 R14: 0000000000000000 R15: ffff8881351b5a00 +[524854.858971] FS: 0000000000000000(0000) GS:ffff888390800000(0000) knlGS:0000000000000000 +[524854.858982] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[524854.858991] CR2: 00007fc9be0f16f4 CR3: 00000001437cc004 CR4: 00000000001706f0 +[524854.859000] Call Trace: +[524854.859006] +[524854.859013] ? __warn+0x9f/0x1a0 +[524854.859027] ? __nf_unregister_net_hook+0x21a/0x260 +[524854.859044] ? report_bug+0x1b1/0x1e0 +[524854.859060] ? handle_bug+0x3c/0x70 +[524854.859071] ? exc_invalid_op+0x17/0x40 +[524854.859083] ? asm_exc_invalid_op+0x1a/0x20 +[524854.859100] ? __nf_unregister_net_hook+0x6a/0x260 +[524854.859116] ? __nf_unregister_net_hook+0x21a/0x260 +[524854.859135] nf_tables_netdev_event+0x337/0x390 [nf_tables] +[524854.859304] ? __pfx_nf_tables_netdev_event+0x10/0x10 [nf_tables] +[524854.859461] ? packet_notifier+0xb3/0x360 +[524854.859476] ? _raw_spin_unlock_irqrestore+0x11/0x40 +[524854.859489] ? dcbnl_netdevice_event+0x35/0x140 +[524854.859507] ? __pfx_nf_tables_netdev_event+0x10/0x10 [nf_tables] +[524854.859661] notifier_call_chain+0x7d/0x140 +[524854.859677] unregister_netdevice_many_notify+0x5e1/0xae0 + +Fixes: d54725cd11a5 ("netfilter: nf_tables: support for multiple devices per netdev hook") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_chain_filter.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nft_chain_filter.c b/net/netfilter/nft_chain_filter.c +index 274b6f7e6bb57..d170758a1eb5d 100644 +--- a/net/netfilter/nft_chain_filter.c ++++ b/net/netfilter/nft_chain_filter.c +@@ -338,7 +338,9 @@ static void nft_netdev_event(unsigned long event, struct net_device *dev, + return; + + if (n > 1) { +- nf_unregister_net_hook(ctx->net, &found->ops); ++ if (!(ctx->chain->table->flags & NFT_TABLE_F_DORMANT)) ++ nf_unregister_net_hook(ctx->net, &found->ops); ++ + list_del_rcu(&found->list); + kfree_rcu(found, rcu); + return; +-- +2.43.0 + diff --git a/queue-6.8/netfs-fix-the-pre-flush-when-appending-to-a-file-in-.patch b/queue-6.8/netfs-fix-the-pre-flush-when-appending-to-a-file-in-.patch new file mode 100644 index 00000000000..97d2d772eb6 --- /dev/null +++ b/queue-6.8/netfs-fix-the-pre-flush-when-appending-to-a-file-in-.patch @@ -0,0 +1,93 @@ +From 012b4f7129a1204a2a1f0e34fcd2d3cb06249523 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 12:15:15 +0100 +Subject: netfs: Fix the pre-flush when appending to a file in writethrough + mode + +From: David Howells + +[ Upstream commit c97f59e276d4e93480f29a70accbd0d7273cf3f5 ] + +In netfs_perform_write(), when the file is marked NETFS_ICTX_WRITETHROUGH +or O_*SYNC or RWF_*SYNC was specified, write-through caching is performed +on a buffered file. When setting up for write-through, we flush any +conflicting writes in the region and wait for the write to complete, +failing if there's a write error to return. + +The issue arises if we're writing at or above the EOF position because we +skip the flush and - more importantly - the wait. This becomes a problem +if there's a partial folio at the end of the file that is being written out +and we want to make a write to it too. Both the already-running write and +the write we start both want to clear the writeback mark, but whoever is +second causes a warning looking something like: + + ------------[ cut here ]------------ + R=00000012: folio 11 is not under writeback + WARNING: CPU: 34 PID: 654 at fs/netfs/write_collect.c:105 + ... + CPU: 34 PID: 654 Comm: kworker/u386:27 Tainted: G S ... + ... + Workqueue: events_unbound netfs_write_collection_worker + ... + RIP: 0010:netfs_writeback_lookup_folio + +Fix this by making the flush-and-wait unconditional. It will do nothing if +there are no folios in the pagecache and will return quickly if there are +no folios in the region specified. + +Further, move the WBC attachment above the flush call as the flush is going +to attach a WBC and detach it again if it is not present - and since we +need one anyway we might as well share it. + +Fixes: 41d8e7673a77 ("netfs: Implement a write-through caching option") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-lkp/202404161031.468b84f-oliver.sang@intel.com +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/2150448.1714130115@warthog.procyon.org.uk +Reviewed-by: Jeffrey Layton +cc: Eric Van Hensbergen +cc: Latchesar Ionkov +cc: Dominique Martinet +cc: Christian Schoenebeck +cc: Marc Dionne +cc: netfs@lists.linux.dev +cc: linux-fsdevel@vger.kernel.org +cc: linux-mm@kvack.org +cc: v9fs@lists.linux.dev +cc: linux-afs@lists.infradead.org +cc: linux-cifs@vger.kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/netfs/buffered_write.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/fs/netfs/buffered_write.c b/fs/netfs/buffered_write.c +index 8f13ca8fbc74d..267b622d923b1 100644 +--- a/fs/netfs/buffered_write.c ++++ b/fs/netfs/buffered_write.c +@@ -172,15 +172,14 @@ ssize_t netfs_perform_write(struct kiocb *iocb, struct iov_iter *iter, + if (unlikely(test_bit(NETFS_ICTX_WRITETHROUGH, &ctx->flags) || + iocb->ki_flags & (IOCB_DSYNC | IOCB_SYNC)) + ) { +- if (pos < i_size_read(inode)) { +- ret = filemap_write_and_wait_range(mapping, pos, pos + iter->count); +- if (ret < 0) { +- goto out; +- } +- } +- + wbc_attach_fdatawrite_inode(&wbc, mapping->host); + ++ ret = filemap_write_and_wait_range(mapping, pos, pos + iter->count); ++ if (ret < 0) { ++ wbc_detach_inode(&wbc); ++ goto out; ++ } ++ + wreq = netfs_begin_writethrough(iocb, iter->count); + if (IS_ERR(wreq)) { + wbc_detach_inode(&wbc); +-- +2.43.0 + diff --git a/queue-6.8/netfs-fix-writethrough-mode-error-handling.patch b/queue-6.8/netfs-fix-writethrough-mode-error-handling.patch new file mode 100644 index 00000000000..a7cd56113fa --- /dev/null +++ b/queue-6.8/netfs-fix-writethrough-mode-error-handling.patch @@ -0,0 +1,66 @@ +From 170c66c57fd246d0b67b94a7a98196ef700f11f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Apr 2024 09:47:19 +0100 +Subject: netfs: Fix writethrough-mode error handling + +From: David Howells + +[ Upstream commit 619606a7b8d5e54b71578ecc988d3f8e1896bbc6 ] + +Fix the error return in netfs_perform_write() acting in writethrough-mode +to return any cached error in the case that netfs_end_writethrough() +returns 0. + +This can affect the use of O_SYNC/O_DSYNC/RWF_SYNC/RWF_DSYNC in 9p and afs. + +Fixes: 41d8e7673a77 ("netfs: Implement a write-through caching option") +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/6736.1713343639@warthog.procyon.org.uk +Reviewed-by: Jeff Layton +cc: Eric Van Hensbergen +cc: Latchesar Ionkov +cc: Dominique Martinet +cc: Christian Schoenebeck +cc: Marc Dionne +cc: netfs@lists.linux.dev +cc: linux-fsdevel@vger.kernel.org +cc: v9fs@lists.linux.dev +cc: linux-afs@lists.infradead.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/netfs/buffered_write.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/fs/netfs/buffered_write.c b/fs/netfs/buffered_write.c +index 9a0d32e4b422a..8f13ca8fbc74d 100644 +--- a/fs/netfs/buffered_write.c ++++ b/fs/netfs/buffered_write.c +@@ -164,7 +164,7 @@ ssize_t netfs_perform_write(struct kiocb *iocb, struct iov_iter *iter, + enum netfs_how_to_modify howto; + enum netfs_folio_trace trace; + unsigned int bdp_flags = (iocb->ki_flags & IOCB_SYNC) ? 0: BDP_ASYNC; +- ssize_t written = 0, ret; ++ ssize_t written = 0, ret, ret2; + loff_t i_size, pos = iocb->ki_pos, from, to; + size_t max_chunk = PAGE_SIZE << MAX_PAGECACHE_ORDER; + bool maybe_trouble = false; +@@ -395,10 +395,12 @@ ssize_t netfs_perform_write(struct kiocb *iocb, struct iov_iter *iter, + + out: + if (unlikely(wreq)) { +- ret = netfs_end_writethrough(wreq, iocb); ++ ret2 = netfs_end_writethrough(wreq, iocb); + wbc_detach_inode(&wbc); +- if (ret == -EIOCBQUEUED) +- return ret; ++ if (ret2 == -EIOCBQUEUED) ++ return ret2; ++ if (ret == 0) ++ ret = ret2; + } + + iocb->ki_pos += written; +-- +2.43.0 + diff --git a/queue-6.8/nfc-trf7970a-disable-all-regulators-on-removal.patch b/queue-6.8/nfc-trf7970a-disable-all-regulators-on-removal.patch new file mode 100644 index 00000000000..dd75edaf57e --- /dev/null +++ b/queue-6.8/nfc-trf7970a-disable-all-regulators-on-removal.patch @@ -0,0 +1,145 @@ +From 274248414611200c6428d44d197871f3b69201e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 21:25:38 +0200 +Subject: NFC: trf7970a: disable all regulators on removal + +From: Paul Geurts + +[ Upstream commit 6bea4f03c6a4e973ef369e15aac88f37981db49e ] + +During module probe, regulator 'vin' and 'vdd-io' are used and enabled, +but the vdd-io regulator overwrites the 'vin' regulator pointer. During +remove, only the vdd-io is disabled, as the vin regulator pointer is not +available anymore. When regulator_put() is called during resource +cleanup a kernel warning is given, as the regulator is still enabled. + +Store the two regulators in separate pointers and disable both the +regulators on module remove. + +Fixes: 49d22c70aaf0 ("NFC: trf7970a: Add device tree option of 1.8 Volt IO voltage") +Signed-off-by: Paul Geurts +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/DB7PR09MB26847A4EBF88D9EDFEB1DA0F950E2@DB7PR09MB2684.eurprd09.prod.outlook.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/nfc/trf7970a.c | 42 +++++++++++++++++++++++------------------- + 1 file changed, 23 insertions(+), 19 deletions(-) + +diff --git a/drivers/nfc/trf7970a.c b/drivers/nfc/trf7970a.c +index 7eb17f46a8153..9e1a34e23af26 100644 +--- a/drivers/nfc/trf7970a.c ++++ b/drivers/nfc/trf7970a.c +@@ -424,7 +424,8 @@ struct trf7970a { + enum trf7970a_state state; + struct device *dev; + struct spi_device *spi; +- struct regulator *regulator; ++ struct regulator *vin_regulator; ++ struct regulator *vddio_regulator; + struct nfc_digital_dev *ddev; + u32 quirks; + bool is_initiator; +@@ -1883,7 +1884,7 @@ static int trf7970a_power_up(struct trf7970a *trf) + if (trf->state != TRF7970A_ST_PWR_OFF) + return 0; + +- ret = regulator_enable(trf->regulator); ++ ret = regulator_enable(trf->vin_regulator); + if (ret) { + dev_err(trf->dev, "%s - Can't enable VIN: %d\n", __func__, ret); + return ret; +@@ -1926,7 +1927,7 @@ static int trf7970a_power_down(struct trf7970a *trf) + if (trf->en2_gpiod && !(trf->quirks & TRF7970A_QUIRK_EN2_MUST_STAY_LOW)) + gpiod_set_value_cansleep(trf->en2_gpiod, 0); + +- ret = regulator_disable(trf->regulator); ++ ret = regulator_disable(trf->vin_regulator); + if (ret) + dev_err(trf->dev, "%s - Can't disable VIN: %d\n", __func__, + ret); +@@ -2065,37 +2066,37 @@ static int trf7970a_probe(struct spi_device *spi) + mutex_init(&trf->lock); + INIT_DELAYED_WORK(&trf->timeout_work, trf7970a_timeout_work_handler); + +- trf->regulator = devm_regulator_get(&spi->dev, "vin"); +- if (IS_ERR(trf->regulator)) { +- ret = PTR_ERR(trf->regulator); ++ trf->vin_regulator = devm_regulator_get(&spi->dev, "vin"); ++ if (IS_ERR(trf->vin_regulator)) { ++ ret = PTR_ERR(trf->vin_regulator); + dev_err(trf->dev, "Can't get VIN regulator: %d\n", ret); + goto err_destroy_lock; + } + +- ret = regulator_enable(trf->regulator); ++ ret = regulator_enable(trf->vin_regulator); + if (ret) { + dev_err(trf->dev, "Can't enable VIN: %d\n", ret); + goto err_destroy_lock; + } + +- uvolts = regulator_get_voltage(trf->regulator); ++ uvolts = regulator_get_voltage(trf->vin_regulator); + if (uvolts > 4000000) + trf->chip_status_ctrl = TRF7970A_CHIP_STATUS_VRS5_3; + +- trf->regulator = devm_regulator_get(&spi->dev, "vdd-io"); +- if (IS_ERR(trf->regulator)) { +- ret = PTR_ERR(trf->regulator); ++ trf->vddio_regulator = devm_regulator_get(&spi->dev, "vdd-io"); ++ if (IS_ERR(trf->vddio_regulator)) { ++ ret = PTR_ERR(trf->vddio_regulator); + dev_err(trf->dev, "Can't get VDD_IO regulator: %d\n", ret); +- goto err_destroy_lock; ++ goto err_disable_vin_regulator; + } + +- ret = regulator_enable(trf->regulator); ++ ret = regulator_enable(trf->vddio_regulator); + if (ret) { + dev_err(trf->dev, "Can't enable VDD_IO: %d\n", ret); +- goto err_destroy_lock; ++ goto err_disable_vin_regulator; + } + +- if (regulator_get_voltage(trf->regulator) == 1800000) { ++ if (regulator_get_voltage(trf->vddio_regulator) == 1800000) { + trf->io_ctrl = TRF7970A_REG_IO_CTRL_IO_LOW; + dev_dbg(trf->dev, "trf7970a config vdd_io to 1.8V\n"); + } +@@ -2108,7 +2109,7 @@ static int trf7970a_probe(struct spi_device *spi) + if (!trf->ddev) { + dev_err(trf->dev, "Can't allocate NFC digital device\n"); + ret = -ENOMEM; +- goto err_disable_regulator; ++ goto err_disable_vddio_regulator; + } + + nfc_digital_set_parent_dev(trf->ddev, trf->dev); +@@ -2137,8 +2138,10 @@ static int trf7970a_probe(struct spi_device *spi) + trf7970a_shutdown(trf); + err_free_ddev: + nfc_digital_free_device(trf->ddev); +-err_disable_regulator: +- regulator_disable(trf->regulator); ++err_disable_vddio_regulator: ++ regulator_disable(trf->vddio_regulator); ++err_disable_vin_regulator: ++ regulator_disable(trf->vin_regulator); + err_destroy_lock: + mutex_destroy(&trf->lock); + return ret; +@@ -2157,7 +2160,8 @@ static void trf7970a_remove(struct spi_device *spi) + nfc_digital_unregister_device(trf->ddev); + nfc_digital_free_device(trf->ddev); + +- regulator_disable(trf->regulator); ++ regulator_disable(trf->vddio_regulator); ++ regulator_disable(trf->vin_regulator); + + mutex_destroy(&trf->lock); + } +-- +2.43.0 + diff --git a/queue-6.8/octeontx2-af-fix-the-double-free-in-rvu_npc_freemem.patch b/queue-6.8/octeontx2-af-fix-the-double-free-in-rvu_npc_freemem.patch new file mode 100644 index 00000000000..a855d241ddb --- /dev/null +++ b/queue-6.8/octeontx2-af-fix-the-double-free-in-rvu_npc_freemem.patch @@ -0,0 +1,46 @@ +From 07cde3b6c8b008ec865863c3e9a58fb17944a1a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 10:27:25 +0800 +Subject: octeontx2-af: fix the double free in rvu_npc_freemem() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Su Hui + +[ Upstream commit 6e965eba43e9724f3e603d7b7cc83e53b23d155e ] + +Clang static checker(scan-build) warning： +drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c:line 2184, column 2 +Attempt to free released memory. + +npc_mcam_rsrcs_deinit() has released 'mcam->counters.bmap'. Deleted this +redundant kfree() to fix this double free problem. + +Fixes: dd7842878633 ("octeontx2-af: Add new devlink param to configure maximum usable NIX block LFs") +Signed-off-by: Su Hui +Reviewed-by: Geetha sowjanya +Reviewed-by: Kalesh AP +Reviewed-by: Hariprasad Kelam +Link: https://lore.kernel.org/r/20240424022724.144587-1-suhui@nfschina.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +index 42b5ed02bc87f..d94b7b88e14ca 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +@@ -2181,7 +2181,6 @@ void rvu_npc_freemem(struct rvu *rvu) + + kfree(pkind->rsrc.bmap); + npc_mcam_rsrcs_deinit(rvu); +- kfree(mcam->counters.bmap); + if (rvu->kpu_prfl_addr) + iounmap(rvu->kpu_prfl_addr); + else +-- +2.43.0 + diff --git a/queue-6.8/series b/queue-6.8/series new file mode 100644 index 00000000000..012e2fba611 --- /dev/null +++ b/queue-6.8/series @@ -0,0 +1,119 @@ +cifs-fix-reacquisition-of-volume-cookie-on-still-liv.patch +smb-client-fix-rename-2-regression-against-samba.patch +cifs-reinstate-original-behavior-again-for-forceuid-.patch +hid-intel-ish-hid-ipc-fix-dev_err-usage-with-uniniti.patch +hid-logitech-dj-allow-mice-to-use-all-types-of-repor.patch +arm64-dts-rockchip-set-phy-address-of-mt7531-switch-.patch +arm64-dts-rockchip-enable-internal-pull-up-on-q7_usb.patch +arm64-dts-rockchip-fix-alphabetical-ordering-rk3399-.patch +arm64-dts-rockchip-enable-internal-pull-up-on-pcie_w.patch +arm64-dts-rockchip-fix-the-i2c-address-of-es8316-on-.patch +arm64-dts-rockchip-remove-unsupported-node-from-the-.patch +arm64-dts-mediatek-mt8183-add-power-domains-properit.patch +arm64-dts-mediatek-mt8192-add-missing-gce-client-reg.patch +arm64-dts-mediatek-mt8195-add-missing-gce-client-reg.patch +arm64-dts-mediatek-mt8195-add-missing-gce-client-reg.patch-10049 +arm64-dts-mediatek-mt8195-add-missing-gce-client-reg.patch-16622 +arm64-dts-mediatek-cherry-describe-cpu-supplies.patch +arm64-dts-mediatek-mt8192-asurada-update-min-voltage.patch +arm64-dts-mediatek-mt8195-cherry-update-min-voltage-.patch +arm64-dts-mediatek-mt8183-kukui-use-default-min-volt.patch +arm64-dts-mediatek-mt7622-fix-clock-controllers.patch +arm64-dts-mediatek-mt7622-fix-ir-nodename.patch +arm64-dts-mediatek-mt7622-fix-ethernet-controller-co.patch +arm64-dts-mediatek-mt7622-drop-reset-names-from-ther.patch +arm64-dts-mediatek-mt7986-reorder-properties.patch +arm64-dts-mediatek-mt7986-drop-invalid-properties-fr.patch +arm64-dts-mediatek-mt7986-drop-reset-cells-from-ethe.patch +arm64-dts-mediatek-mt7986-reorder-nodes.patch +arm64-dts-mediatek-mt7986-drop-invalid-thermal-block.patch +arm64-dts-mediatek-mt7986-prefix-bpi-r3-cooling-maps.patch +arm64-dts-mediatek-mt2712-fix-validation-errors.patch +arm64-dts-rockchip-mark-system-power-controller-and-.patch +arm64-dts-rockchip-regulator-for-sd-needs-to-be-alwa.patch +block-fix-module-reference-leakage-from-bdev_open_by.patch +arm64-dts-qcom-fix-type-of-wdog-irqs-for-remoteprocs.patch +arm64-dts-qcom-x1e80100-fix-the-compatible-for-clust.patch +arm64-dts-qcom-sc8180x-fix-ss_phy_irq-for-secondary-.patch +gpio-tangier-use-correct-type-for-the-irq-chip-data.patch +arc-plat-hsdk-remove-misplaced-interrupt-cells-prope.patch +wifi-mac80211-clean-up-assignments-to-pointer-cache.patch +wifi-mac80211-split-mesh-fast-tx-cache-into-local-pr.patch +wifi-iwlwifi-mvm-remove-old-pasn-station-when-adding.patch +wifi-iwlwifi-mvm-return-uid-from-iwl_mvm_build_scan_.patch +drm-gma500-remove-lid-code.patch +wifi-mac80211_hwsim-init-peer-measurement-result.patch +wifi-mac80211-remove-link-before-ap.patch +wifi-mac80211-fix-unaligned-le16-access.patch +net-libwx-fix-alloc-msix-vectors-failed.patch +vxlan-drop-packets-from-invalid-src-address.patch +net-bcmasp-fix-memory-leak-when-bringing-down-interf.patch +mlxsw-core-unregister-emad-trap-using-forward-action.patch +mlxsw-core_env-fix-driver-initialization-with-old-fi.patch +mlxsw-pci-fix-driver-initialization-with-old-firmwar.patch +arm-dts-microchip-at91-sama7g5ek-replace-regulator-s.patch +icmp-prevent-possible-null-dereferences-from-icmp_bu.patch +bridge-br_netlink.c-no-need-to-return-void-function.patch +bnxt_en-refactor-reset-close-code.patch +bnxt_en-fix-the-pci-aer-routines.patch +bnxt_en-fix-error-recovery-for-5760x-p7-chips.patch +cxl-core-fix-potential-payload-size-confusion-in-cxl.patch +net-dsa-mv88e6xx-fix-supported_interfaces-setup-in-m.patch +nfc-trf7970a-disable-all-regulators-on-removal.patch +netfs-fix-writethrough-mode-error-handling.patch +ax25-fix-netdev-refcount-issue.patch +soc-mediatek-mtk-svs-append-thermal-to-thermal-zone-.patch +tools-ynl-don-t-ignore-errors-in-nlmsg_done-messages.patch +net-make-sk_memory_pcpu_reserv-tunable.patch +net-fix-sk_memory_allocated_-add-sub-vs-softirqs.patch +ipv4-check-for-null-idev-in-ip_route_use_hint.patch +net-usb-ax88179_178a-stop-lying-about-skb-truesize.patch +tcp-fix-use-after-free-in-tcp_ao_connect_init.patch +net-gtp-fix-use-after-free-in-gtp_dellink.patch +net-phy-mediatek-ge-soc-follow-netdev-led-trigger-se.patch +gpio-tegra186-fix-tegra186_gpio_is_accessible-check.patch +drm-xe-remove-sysfs-only-once-on-action-add-failure.patch +drm-xe-call-free_gsc_pkt-only-once-on-action-add-fai.patch +bluetooth-hci_event-use-hci-error-defines-instead-of.patch +bluetooth-hci_conn-only-do-acl-connections-sequentia.patch +bluetooth-remove-pending-acl-connection-attempts.patch +bluetooth-hci_conn-always-use-sk_timeo-as-conn_timeo.patch +bluetooth-hci_conn-fix-uaf-write-in-__hci_acl_create.patch +bluetooth-hci_sync-add-helper-functions-to-manipulat.patch +bluetooth-hci_sync-attempt-to-dequeue-connection-att.patch +bluetooth-iso-reassemble-pa-data-for-bcast-sink.patch +bluetooth-hci_sync-use-advertised-phys-on-hci_le_ext.patch +bluetooth-btusb-fix-triggering-coredump-implementati.patch +bluetooth-hci_event-fix-sending-hci_op_read_enc_key_.patch +bluetooth-mgmt-fix-failing-to-mgmt_op_add_uuid-mgmt_.patch +bluetooth-btusb-mediatek-fix-double-free-of-skb-in-c.patch +bluetooth-hci_sync-using-hci_cmd_sync_submit-when-re.patch +bluetooth-qca-set-power_ctrl_enabled-on-null-returne.patch +ipvs-fix-checksumming-on-gso-of-sctp-packets.patch +net-openvswitch-fix-use-after-free-in-ovs_ct_exit.patch +mlxsw-use-refcount_t-for-reference-counting.patch +mlxsw-spectrum_acl_tcam-fix-race-in-region-id-alloca.patch +mlxsw-spectrum_acl_tcam-fix-race-during-rehash-delay.patch +mlxsw-spectrum_acl_tcam-fix-possible-use-after-free-.patch +mlxsw-spectrum_acl_tcam-fix-possible-use-after-free-.patch-5019 +mlxsw-spectrum_acl_tcam-rate-limit-error-message.patch +mlxsw-spectrum_acl_tcam-fix-memory-leak-during-rehas.patch +mlxsw-spectrum_acl_tcam-fix-warning-during-rehash.patch +mlxsw-spectrum_acl_tcam-fix-incorrect-list-api-usage.patch +mlxsw-spectrum_acl_tcam-fix-memory-leak-when-canceli.patch +eth-bnxt-fix-counting-packets-discarded-due-to-oom-a.patch +arm-dts-imx6ull-tarragon-fix-usb-over-current-polari.patch +netfilter-nf_tables-honor-table-dormant-flag-from-ne.patch +net-phy-dp83869-fix-mii-mode-failure.patch +net-ti-icssg-prueth-fix-signedness-bug-in-prueth_ini.patch +i40e-do-not-use-wq_mem_reclaim-flag-for-workqueue.patch +i40e-report-mfs-in-decimal-base-instead-of-hex.patch +iavf-fix-tc-config-comparison-with-existing-adapter-.patch +ice-fix-lag-and-vf-lock-dependency-in-ice_reset_vf.patch +net-ethernet-ti-am65-cpts-fix-ptpv1-message-type-on-.patch +octeontx2-af-fix-the-double-free-in-rvu_npc_freemem.patch +dpll-check-that-pin-is-registered-in-__dpll_pin_unre.patch +dpll-fix-dpll_pin_on_pin_register-for-multiple-paren.patch +tls-fix-lockless-read-of-strp-msg_ready-in-poll.patch +af_unix-suppress-false-positive-lockdep-splat-for-sp.patch +netfs-fix-the-pre-flush-when-appending-to-a-file-in-.patch diff --git a/queue-6.8/smb-client-fix-rename-2-regression-against-samba.patch b/queue-6.8/smb-client-fix-rename-2-regression-against-samba.patch new file mode 100644 index 00000000000..c17d747999c --- /dev/null +++ b/queue-6.8/smb-client-fix-rename-2-regression-against-samba.patch @@ -0,0 +1,56 @@ +From 08c529b400fa1c02f579fd87f590e1912989874b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Apr 2024 12:05:07 -0300 +Subject: smb: client: fix rename(2) regression against samba + +From: Paulo Alcantara + +[ Upstream commit 18d86965e31f9be4d477da0744a7cdc9815858de ] + +After commit 2c7d399e551c ("smb: client: reuse file lease key in +compound operations") the client started reusing lease keys for +rename, unlink and set path size operations to prevent it from +breaking its own leases and thus causing unnecessary lease breaks to +same connection. + +The implementation relies on positive dentries and +cifsInodeInfo::lease_granted to decide whether reusing lease keys for +the compound requests. cifsInodeInfo::lease_granted was introduced by +commit 0ab95c2510b6 ("Defer close only when lease is enabled.") to +indicate whether lease caching is granted for a specific file, but +that can only happen until file is open, so +cifsInodeInfo::lease_granted was left uninitialised in ->alloc_inode +and then client started sending random lease keys for files that +hadn't any leases. + +This fixes the following test case against samba: + +mount.cifs //srv/share /mnt/1 -o ...,nosharesock +mount.cifs //srv/share /mnt/2 -o ...,nosharesock +touch /mnt/1/foo; tail -f /mnt/1/foo & pid=$! +mv /mnt/2/foo /mnt/2/bar # fails with -EIO +kill $pid + +Fixes: 0ab95c2510b6 ("Defer close only when lease is enabled.") +Signed-off-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifsfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c +index 501bfd3afdc64..81fe60815885c 100644 +--- a/fs/smb/client/cifsfs.c ++++ b/fs/smb/client/cifsfs.c +@@ -393,6 +393,7 @@ cifs_alloc_inode(struct super_block *sb) + * server, can not assume caching of file data or metadata. + */ + cifs_set_oplock_level(cifs_inode, 0); ++ cifs_inode->lease_granted = false; + cifs_inode->flags = 0; + spin_lock_init(&cifs_inode->writers_lock); + cifs_inode->writers = 0; +-- +2.43.0 + diff --git a/queue-6.8/soc-mediatek-mtk-svs-append-thermal-to-thermal-zone-.patch b/queue-6.8/soc-mediatek-mtk-svs-append-thermal-to-thermal-zone-.patch new file mode 100644 index 00000000000..1eebb4aec4c --- /dev/null +++ b/queue-6.8/soc-mediatek-mtk-svs-append-thermal-to-thermal-zone-.patch @@ -0,0 +1,52 @@ +From f2860a9f65084ce6dea44320afea3e1e6a1ebdda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Mar 2024 12:32:37 +0100 +Subject: soc: mediatek: mtk-svs: Append "-thermal" to thermal zone names + +From: AngeloGioacchino Del Regno + +[ Upstream commit 7ca803b489455b9242c81b4befe546ea3a692e5c ] + +The thermal framework registers thermal zones as specified in DT and +including the "-thermal" suffix: append that to the driver specified +tzone_name to actually match the thermal zone name as registered by +the thermal API. + +Fixes: 2bfbf82956e2 ("soc: mediatek: mtk-svs: Constify runtime-immutable members of svs_bank") +Link: https://lore.kernel.org/r/20240318113237.125802-1-angelogioacchino.delregno@collabora.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + drivers/soc/mediatek/mtk-svs.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/soc/mediatek/mtk-svs.c b/drivers/soc/mediatek/mtk-svs.c +index c832f5c670bcf..9a91298c12539 100644 +--- a/drivers/soc/mediatek/mtk-svs.c ++++ b/drivers/soc/mediatek/mtk-svs.c +@@ -1768,6 +1768,7 @@ static int svs_bank_resource_setup(struct svs_platform *svsp) + const struct svs_bank_pdata *bdata; + struct svs_bank *svsb; + struct dev_pm_opp *opp; ++ char tz_name_buf[20]; + unsigned long freq; + int count, ret; + u32 idx, i; +@@ -1819,10 +1820,12 @@ static int svs_bank_resource_setup(struct svs_platform *svsp) + } + + if (!IS_ERR_OR_NULL(bdata->tzone_name)) { +- svsb->tzd = thermal_zone_get_zone_by_name(bdata->tzone_name); ++ snprintf(tz_name_buf, ARRAY_SIZE(tz_name_buf), ++ "%s-thermal", bdata->tzone_name); ++ svsb->tzd = thermal_zone_get_zone_by_name(tz_name_buf); + if (IS_ERR(svsb->tzd)) { + dev_err(svsb->dev, "cannot get \"%s\" thermal zone\n", +- bdata->tzone_name); ++ tz_name_buf); + return PTR_ERR(svsb->tzd); + } + } +-- +2.43.0 + diff --git a/queue-6.8/tcp-fix-use-after-free-in-tcp_ao_connect_init.patch b/queue-6.8/tcp-fix-use-after-free-in-tcp_ao_connect_init.patch new file mode 100644 index 00000000000..98e059b716a --- /dev/null +++ b/queue-6.8/tcp-fix-use-after-free-in-tcp_ao_connect_init.patch @@ -0,0 +1,51 @@ +From 859c98f1a2a5298c4fa00cc42c03d5b6333eeb55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 05:33:40 -0400 +Subject: tcp: Fix Use-After-Free in tcp_ao_connect_init + +From: Hyunwoo Kim + +[ Upstream commit 80e679b352c3ce5158f3f778cfb77eb767e586fb ] + +Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal +of tcp_ao_connect_init, is not part of the RCU read critical section, it +is possible that the RCU grace period will pass during the traversal and +the key will be free. + +To prevent this, it should be changed to hlist_for_each_entry_safe. + +Fixes: 7c2ffaf21bd6 ("net/tcp: Calculate TCP-AO traffic keys") +Signed-off-by: Hyunwoo Kim +Reviewed-by: Eric Dumazet +Acked-by: Dmitry Safonov <0x7f454c46@gmail.com> +Link: https://lore.kernel.org/r/ZiYu9NJ/ClR8uSkH@v4bel-B760M-AORUS-ELITE-AX +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_ao.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_ao.c b/net/ipv4/tcp_ao.c +index 87db432c6bb4a..254d6e3f93fa7 100644 +--- a/net/ipv4/tcp_ao.c ++++ b/net/ipv4/tcp_ao.c +@@ -1068,6 +1068,7 @@ void tcp_ao_connect_init(struct sock *sk) + { + struct tcp_sock *tp = tcp_sk(sk); + struct tcp_ao_info *ao_info; ++ struct hlist_node *next; + union tcp_ao_addr *addr; + struct tcp_ao_key *key; + int family, l3index; +@@ -1090,7 +1091,7 @@ void tcp_ao_connect_init(struct sock *sk) + l3index = l3mdev_master_ifindex_by_index(sock_net(sk), + sk->sk_bound_dev_if); + +- hlist_for_each_entry_rcu(key, &ao_info->head, node) { ++ hlist_for_each_entry_safe(key, next, &ao_info->head, node) { + if (!tcp_ao_key_cmp(key, l3index, addr, key->prefixlen, family, -1, -1)) + continue; + +-- +2.43.0 + diff --git a/queue-6.8/tls-fix-lockless-read-of-strp-msg_ready-in-poll.patch b/queue-6.8/tls-fix-lockless-read-of-strp-msg_ready-in-poll.patch new file mode 100644 index 00000000000..182d7caf0e8 --- /dev/null +++ b/queue-6.8/tls-fix-lockless-read-of-strp-msg_ready-in-poll.patch @@ -0,0 +1,86 @@ +From 43877813802f2733195713c3e90c18b4d9a21fe8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 12:25:47 +0200 +Subject: tls: fix lockless read of strp->msg_ready in ->poll + +From: Sabrina Dubroca + +[ Upstream commit 0844370f8945086eb9335739d10205dcea8d707b ] + +tls_sk_poll is called without locking the socket, and needs to read +strp->msg_ready (via tls_strp_msg_ready). Convert msg_ready to a bool +and use READ_ONCE/WRITE_ONCE where needed. The remaining reads are +only performed when the socket is locked. + +Fixes: 121dca784fc0 ("tls: suppress wakeups unless we have a full record") +Signed-off-by: Sabrina Dubroca +Link: https://lore.kernel.org/r/0b7ee062319037cf86af6b317b3d72f7bfcd2e97.1713797701.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/tls.h | 3 ++- + net/tls/tls.h | 2 +- + net/tls/tls_strp.c | 6 +++--- + 3 files changed, 6 insertions(+), 5 deletions(-) + +diff --git a/include/net/tls.h b/include/net/tls.h +index 340ad43971e47..33f657d3c0510 100644 +--- a/include/net/tls.h ++++ b/include/net/tls.h +@@ -111,7 +111,8 @@ struct tls_strparser { + u32 stopped : 1; + u32 copy_mode : 1; + u32 mixed_decrypted : 1; +- u32 msg_ready : 1; ++ ++ bool msg_ready; + + struct strp_msg stm; + +diff --git a/net/tls/tls.h b/net/tls/tls.h +index 762f424ff2d59..e5e47452308ab 100644 +--- a/net/tls/tls.h ++++ b/net/tls/tls.h +@@ -215,7 +215,7 @@ static inline struct sk_buff *tls_strp_msg(struct tls_sw_context_rx *ctx) + + static inline bool tls_strp_msg_ready(struct tls_sw_context_rx *ctx) + { +- return ctx->strp.msg_ready; ++ return READ_ONCE(ctx->strp.msg_ready); + } + + static inline bool tls_strp_msg_mixed_decrypted(struct tls_sw_context_rx *ctx) +diff --git a/net/tls/tls_strp.c b/net/tls/tls_strp.c +index ca1e0e198ceb4..5df08d848b5c9 100644 +--- a/net/tls/tls_strp.c ++++ b/net/tls/tls_strp.c +@@ -360,7 +360,7 @@ static int tls_strp_copyin(read_descriptor_t *desc, struct sk_buff *in_skb, + if (strp->stm.full_len && strp->stm.full_len == skb->len) { + desc->count = 0; + +- strp->msg_ready = 1; ++ WRITE_ONCE(strp->msg_ready, 1); + tls_rx_msg_ready(strp); + } + +@@ -528,7 +528,7 @@ static int tls_strp_read_sock(struct tls_strparser *strp) + if (!tls_strp_check_queue_ok(strp)) + return tls_strp_read_copy(strp, false); + +- strp->msg_ready = 1; ++ WRITE_ONCE(strp->msg_ready, 1); + tls_rx_msg_ready(strp); + + return 0; +@@ -580,7 +580,7 @@ void tls_strp_msg_done(struct tls_strparser *strp) + else + tls_strp_flush_anchor_copy(strp); + +- strp->msg_ready = 0; ++ WRITE_ONCE(strp->msg_ready, 0); + memset(&strp->stm, 0, sizeof(strp->stm)); + + tls_strp_check_rcv(strp); +-- +2.43.0 + diff --git a/queue-6.8/tools-ynl-don-t-ignore-errors-in-nlmsg_done-messages.patch b/queue-6.8/tools-ynl-don-t-ignore-errors-in-nlmsg_done-messages.patch new file mode 100644 index 00000000000..9870ca84f00 --- /dev/null +++ b/queue-6.8/tools-ynl-don-t-ignore-errors-in-nlmsg_done-messages.patch @@ -0,0 +1,38 @@ +From d761736c76954c0c4751c4d7eb16231de9bac795 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Apr 2024 19:08:26 -0700 +Subject: tools: ynl: don't ignore errors in NLMSG_DONE messages + +From: Jakub Kicinski + +[ Upstream commit a44f2eb106a46f2275a79de54ce0ea63e4f3d8c8 ] + +NLMSG_DONE contains an error code, it has to be extracted. +Prior to this change all dumps will end in success, +and in case of failure the result is silently truncated. + +Fixes: e4b48ed460d3 ("tools: ynl: add a completely generic client") +Signed-off-by: Jakub Kicinski +Reviewed-by: Donald Hunter +Link: https://lore.kernel.org/r/20240420020827.3288615-1-kuba@kernel.org +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + tools/net/ynl/lib/ynl.py | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/net/ynl/lib/ynl.py b/tools/net/ynl/lib/ynl.py +index 1e10512b2117c..571c2e218993f 100644 +--- a/tools/net/ynl/lib/ynl.py ++++ b/tools/net/ynl/lib/ynl.py +@@ -208,6 +208,7 @@ class NlMsg: + self.done = 1 + extack_off = 20 + elif self.nl_type == Netlink.NLMSG_DONE: ++ self.error = struct.unpack("i", self.raw[0:4])[0] + self.done = 1 + extack_off = 4 + +-- +2.43.0 + diff --git a/queue-6.8/vxlan-drop-packets-from-invalid-src-address.patch b/queue-6.8/vxlan-drop-packets-from-invalid-src-address.patch new file mode 100644 index 00000000000..251a06637e6 --- /dev/null +++ b/queue-6.8/vxlan-drop-packets-from-invalid-src-address.patch @@ -0,0 +1,52 @@ +From 964b5934946244239c9a1bbdaad9d014e7f6ee4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 15:29:08 +0200 +Subject: vxlan: drop packets from invalid src-address + +From: David Bauer + +[ Upstream commit f58f45c1e5b92975e91754f5407250085a6ae7cf ] + +The VXLAN driver currently does not check if the inner layer2 +source-address is valid. + +In case source-address snooping/learning is enabled, a entry in the FDB +for the invalid address is created with the layer3 address of the tunnel +endpoint. + +If the frame happens to have a non-unicast address set, all this +non-unicast traffic is subsequently not flooded to the tunnel network +but sent to the learnt host in the FDB. To make matters worse, this FDB +entry does not expire. + +Apply the same filtering for packets as it is done for bridges. This not +only drops these invalid packets but avoids them from being learnt into +the FDB. + +Fixes: d342894c5d2f ("vxlan: virtual extensible lan") +Suggested-by: Ido Schimmel +Signed-off-by: David Bauer +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/vxlan/vxlan_core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c +index 0bedb804824ba..9ec46048d361d 100644 +--- a/drivers/net/vxlan/vxlan_core.c ++++ b/drivers/net/vxlan/vxlan_core.c +@@ -1615,6 +1615,10 @@ static bool vxlan_set_mac(struct vxlan_dev *vxlan, + if (ether_addr_equal(eth_hdr(skb)->h_source, vxlan->dev->dev_addr)) + return false; + ++ /* Ignore packets from invalid src-address */ ++ if (!is_valid_ether_addr(eth_hdr(skb)->h_source)) ++ return false; ++ + /* Get address from the outer IP header */ + if (vxlan_get_sk_family(vs) == AF_INET) { + saddr.sin.sin_addr.s_addr = ip_hdr(skb)->saddr; +-- +2.43.0 + diff --git a/queue-6.8/wifi-iwlwifi-mvm-remove-old-pasn-station-when-adding.patch b/queue-6.8/wifi-iwlwifi-mvm-remove-old-pasn-station-when-adding.patch new file mode 100644 index 00000000000..02bff465ab2 --- /dev/null +++ b/queue-6.8/wifi-iwlwifi-mvm-remove-old-pasn-station-when-adding.patch @@ -0,0 +1,40 @@ +From eec3f12daa2d4d89fbebff0ae4a561b186b2af5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 11:54:43 +0300 +Subject: wifi: iwlwifi: mvm: remove old PASN station when adding a new one + +From: Avraham Stern + +[ Upstream commit dbfff5bf9292714f02ace002fea8ce6599ea1145 ] + +If a PASN station is added, and an old PASN station already exists +for the same mac address, remove the old station before adding the +new one. Keeping the old station caueses old security context to +be used in measurements. + +Fixes: 0739a7d70e00 ("iwlwifi: mvm: initiator: add option for adding a PASN responder") +Signed-off-by: Avraham Stern +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240415114847.ef3544a416f2.I4e8c7c8ca22737f4f908ae5cd4fc0b920c703dd3@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c b/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c +index 233ae81884a0e..ae0eb585b61ee 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c +@@ -53,6 +53,8 @@ int iwl_mvm_ftm_add_pasn_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif, + if (!pasn) + return -ENOBUFS; + ++ iwl_mvm_ftm_remove_pasn_sta(mvm, addr); ++ + pasn->cipher = iwl_mvm_cipher_to_location_cipher(cipher); + + switch (pasn->cipher) { +-- +2.43.0 + diff --git a/queue-6.8/wifi-iwlwifi-mvm-return-uid-from-iwl_mvm_build_scan_.patch b/queue-6.8/wifi-iwlwifi-mvm-return-uid-from-iwl_mvm_build_scan_.patch new file mode 100644 index 00000000000..4738259fbef --- /dev/null +++ b/queue-6.8/wifi-iwlwifi-mvm-return-uid-from-iwl_mvm_build_scan_.patch @@ -0,0 +1,44 @@ +From 2c342eb6ea648bee20850f57ac8c06b84909bc85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 11:54:44 +0300 +Subject: wifi: iwlwifi: mvm: return uid from iwl_mvm_build_scan_cmd + +From: Miri Korenblit + +[ Upstream commit bada85a3f584763deadd201147778c3e791d279c ] + +This function is supposed to return a uid on success, and an errno in +failure. +But it currently returns the return value of the specific cmd version +handler, which in turn returns 0 on success and errno otherwise. +This means that on success, iwl_mvm_build_scan_cmd will return 0 +regardless if the actual uid. +Fix this by returning the uid if the handler succeeded. + +Fixes: 687db6ff5b70 ("iwlwifi: scan: make new scan req versioning flow") +Signed-off-by: Miri Korenblit +Reviewed-by: Ilan Peer +Link: https://msgid.link/20240415114847.5e2d602b3190.I4c4931021be74a67a869384c8f8ee7463e0c7857@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +index 7b6f1cdca067e..97d44354dbbb5 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +@@ -2815,7 +2815,8 @@ static int iwl_mvm_build_scan_cmd(struct iwl_mvm *mvm, + if (ver_handler->version != scan_ver) + continue; + +- return ver_handler->handler(mvm, vif, params, type, uid); ++ err = ver_handler->handler(mvm, vif, params, type, uid); ++ return err ? : uid; + } + + err = iwl_mvm_scan_umac(mvm, vif, params, type, uid); +-- +2.43.0 + diff --git a/queue-6.8/wifi-mac80211-clean-up-assignments-to-pointer-cache.patch b/queue-6.8/wifi-mac80211-clean-up-assignments-to-pointer-cache.patch new file mode 100644 index 00000000000..d94589e7823 --- /dev/null +++ b/queue-6.8/wifi-mac80211-clean-up-assignments-to-pointer-cache.patch @@ -0,0 +1,73 @@ +From bc5cce456d41e228f8a2fa4f8fcd6381267017b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Feb 2024 23:21:51 +0000 +Subject: wifi: mac80211: clean up assignments to pointer cache. + +From: Colin Ian King + +[ Upstream commit ba4b1fa3128b2fbf14e167230315cbd9074b629b ] + +The assignment to pointer cache in function mesh_fast_tx_gc can +be made at the declaration time rather than a later assignment. +There are also 3 functions where pointer cache is being initialized +at declaration time and later re-assigned again with the same +value, these are redundant and can be removed. + +Cleans up code and three clang scan build warnings: +warning: Value stored to 'cache' during its initialization is never +read [deadcode.DeadStores] + +Signed-off-by: Colin Ian King +Reviewed-by: Simon Horman +Link: https://msgid.link/20240215232151.2075483-1-colin.i.king@gmail.com +Signed-off-by: Johannes Berg +Stable-dep-of: 8c75cdcdf869 ("wifi: mac80211: split mesh fast tx cache into local/proxied/forwarded") +Signed-off-by: Sasha Levin +--- + net/mac80211/mesh_pathtbl.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c +index 735edde1bd819..91b55d6a68b97 100644 +--- a/net/mac80211/mesh_pathtbl.c ++++ b/net/mac80211/mesh_pathtbl.c +@@ -600,11 +600,10 @@ void mesh_fast_tx_cache(struct ieee80211_sub_if_data *sdata, + void mesh_fast_tx_gc(struct ieee80211_sub_if_data *sdata) + { + unsigned long timeout = msecs_to_jiffies(MESH_FAST_TX_CACHE_TIMEOUT); +- struct mesh_tx_cache *cache; ++ struct mesh_tx_cache *cache = &sdata->u.mesh.tx_cache; + struct ieee80211_mesh_fast_tx *entry; + struct hlist_node *n; + +- cache = &sdata->u.mesh.tx_cache; + if (atomic_read(&cache->rht.nelems) < MESH_FAST_TX_CACHE_THRESHOLD_SIZE) + return; + +@@ -622,7 +621,6 @@ void mesh_fast_tx_flush_mpath(struct mesh_path *mpath) + struct ieee80211_mesh_fast_tx *entry; + struct hlist_node *n; + +- cache = &sdata->u.mesh.tx_cache; + spin_lock_bh(&cache->walk_lock); + hlist_for_each_entry_safe(entry, n, &cache->walk_head, walk_list) + if (entry->mpath == mpath) +@@ -637,7 +635,6 @@ void mesh_fast_tx_flush_sta(struct ieee80211_sub_if_data *sdata, + struct ieee80211_mesh_fast_tx *entry; + struct hlist_node *n; + +- cache = &sdata->u.mesh.tx_cache; + spin_lock_bh(&cache->walk_lock); + hlist_for_each_entry_safe(entry, n, &cache->walk_head, walk_list) + if (rcu_access_pointer(entry->mpath->next_hop) == sta) +@@ -651,7 +648,6 @@ void mesh_fast_tx_flush_addr(struct ieee80211_sub_if_data *sdata, + struct mesh_tx_cache *cache = &sdata->u.mesh.tx_cache; + struct ieee80211_mesh_fast_tx *entry; + +- cache = &sdata->u.mesh.tx_cache; + spin_lock_bh(&cache->walk_lock); + entry = rhashtable_lookup_fast(&cache->rht, addr, fast_tx_rht_params); + if (entry) +-- +2.43.0 + diff --git a/queue-6.8/wifi-mac80211-fix-unaligned-le16-access.patch b/queue-6.8/wifi-mac80211-fix-unaligned-le16-access.patch new file mode 100644 index 00000000000..d2c70493d19 --- /dev/null +++ b/queue-6.8/wifi-mac80211-fix-unaligned-le16-access.patch @@ -0,0 +1,40 @@ +From 9055126943c05c7dead97ca906a8aa78b1cdcd89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 10:52:26 +0200 +Subject: wifi: mac80211: fix unaligned le16 access + +From: Johannes Berg + +[ Upstream commit c53d8a59351e4347452e263e2e5d7446ec93da83 ] + +The AP removal timer field need not be aligned, so the +code shouldn't access it directly, but use unaligned +loads. Use get_unaligned_le16(), which even is shorter +than the current code since it doesn't need a cast. + +Fixes: 8eb8dd2ffbbb ("wifi: mac80211: Support link removal using Reconfiguration ML element") +Reviewed-by: Ilan Peer +Reviewed-by: Miriam Rachel Korenblit +Link: https://msgid.link/20240418105220.356788ba0045.I2b3cdb3644e205d5bb10322c345c0499171cf5d2@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/mlme.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index fb9860d508707..94028b541beba 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -5848,7 +5848,7 @@ static void ieee80211_ml_reconfiguration(struct ieee80211_sub_if_data *sdata, + */ + if (control & + IEEE80211_MLE_STA_RECONF_CONTROL_AP_REM_TIMER_PRESENT) +- link_removal_timeout[link_id] = le16_to_cpu(*(__le16 *)pos); ++ link_removal_timeout[link_id] = get_unaligned_le16(pos); + } + + removed_links &= sdata->vif.valid_links; +-- +2.43.0 + diff --git a/queue-6.8/wifi-mac80211-remove-link-before-ap.patch b/queue-6.8/wifi-mac80211-remove-link-before-ap.patch new file mode 100644 index 00000000000..651ec8d2fdf --- /dev/null +++ b/queue-6.8/wifi-mac80211-remove-link-before-ap.patch @@ -0,0 +1,54 @@ +From b636aee327e855bc116d060ecd8af293883f0fdd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 10:52:25 +0200 +Subject: wifi: mac80211: remove link before AP + +From: Johannes Berg + +[ Upstream commit cb55e08dba3526796e35d24a6d5db4ed6dcb8a4b ] + +If the AP removal timer is long, we don't really want to +remove the link immediately. However, we really should do +it _before_ the AP removes it (which happens at or after +count reaches 0), so subtract 1 from the countdown when +scheduling the timer. This causes the link removal work +to run just after the beacon with value 1 is received. If +the counter is already zero, do it immediately. + +This fixes an issue where we do the removal too late and +receive a beacon from the AP that's no longer associated +with the MLD, but thus removed EHT and ML elements, and +then we disconnect instead from the whole MLD, since one +of the associated APs changed mode from EHT to HE. + +Fixes: 8eb8dd2ffbbb ("wifi: mac80211: Support link removal using Reconfiguration ML element") +Reviewed-by: Ilan Peer +Reviewed-by: Miriam Rachel Korenblit +Link: https://msgid.link/20240418105220.03ac4a09fa74.Ifb8c8d38e3402721a81ce5981568f47b5c5889cb@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/mlme.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index 20d863370796d..fb9860d508707 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -5873,8 +5873,11 @@ static void ieee80211_ml_reconfiguration(struct ieee80211_sub_if_data *sdata, + continue; + } + +- link_delay = link_conf->beacon_int * +- link_removal_timeout[link_id]; ++ if (link_removal_timeout[link_id] < 1) ++ link_delay = 0; ++ else ++ link_delay = link_conf->beacon_int * ++ (link_removal_timeout[link_id] - 1); + + if (!delay) + delay = link_delay; +-- +2.43.0 + diff --git a/queue-6.8/wifi-mac80211-split-mesh-fast-tx-cache-into-local-pr.patch b/queue-6.8/wifi-mac80211-split-mesh-fast-tx-cache-into-local-pr.patch new file mode 100644 index 00000000000..e087a72566e --- /dev/null +++ b/queue-6.8/wifi-mac80211-split-mesh-fast-tx-cache-into-local-pr.patch @@ -0,0 +1,249 @@ +From 340c5fd1d6d95dd1f876c88ce9152da4ce6a71bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 14:18:11 +0200 +Subject: wifi: mac80211: split mesh fast tx cache into local/proxied/forwarded + +From: Felix Fietkau + +[ Upstream commit 8c75cdcdf869acabfdc7858827099dcde9f24e6c ] + +Depending on the origin of the packets (and their SA), 802.11 + mesh headers +could be filled in differently. In order to properly deal with that, add a +new field to the lookup key, indicating the type (local, proxied or +forwarded). This can fix spurious packet drop issues that depend on the order +in which nodes/hosts communicate with each other. + +Fixes: d5edb9ae8d56 ("wifi: mac80211: mesh fast xmit support") +Signed-off-by: Felix Fietkau +Link: https://msgid.link/20240415121811.13391-1-nbd@nbd.name +[use sizeof_field() for key_len] +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/mesh.c | 8 +++++++- + net/mac80211/mesh.h | 36 +++++++++++++++++++++++++++++++++--- + net/mac80211/mesh_pathtbl.c | 31 ++++++++++++++++++++++--------- + net/mac80211/rx.c | 13 ++++++++++--- + 4 files changed, 72 insertions(+), 16 deletions(-) + +diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c +index fccbcde3359af..3d4806b7ff6c4 100644 +--- a/net/mac80211/mesh.c ++++ b/net/mac80211/mesh.c +@@ -769,6 +769,9 @@ bool ieee80211_mesh_xmit_fast(struct ieee80211_sub_if_data *sdata, + struct sk_buff *skb, u32 ctrl_flags) + { + struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; ++ struct ieee80211_mesh_fast_tx_key key = { ++ .type = MESH_FAST_TX_TYPE_LOCAL ++ }; + struct ieee80211_mesh_fast_tx *entry; + struct ieee80211s_hdr *meshhdr; + u8 sa[ETH_ALEN] __aligned(2); +@@ -804,7 +807,10 @@ bool ieee80211_mesh_xmit_fast(struct ieee80211_sub_if_data *sdata, + return false; + } + +- entry = mesh_fast_tx_get(sdata, skb->data); ++ ether_addr_copy(key.addr, skb->data); ++ if (!ether_addr_equal(skb->data + ETH_ALEN, sdata->vif.addr)) ++ key.type = MESH_FAST_TX_TYPE_PROXIED; ++ entry = mesh_fast_tx_get(sdata, &key); + if (!entry) + return false; + +diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h +index ad8469293d712..58c619874ca6a 100644 +--- a/net/mac80211/mesh.h ++++ b/net/mac80211/mesh.h +@@ -133,10 +133,39 @@ struct mesh_path { + #define MESH_FAST_TX_CACHE_THRESHOLD_SIZE 384 + #define MESH_FAST_TX_CACHE_TIMEOUT 8000 /* msecs */ + ++/** ++ * enum ieee80211_mesh_fast_tx_type - cached mesh fast tx entry type ++ * ++ * @MESH_FAST_TX_TYPE_LOCAL: tx from the local vif address as SA ++ * @MESH_FAST_TX_TYPE_PROXIED: local tx with a different SA (e.g. bridged) ++ * @MESH_FAST_TX_TYPE_FORWARDED: forwarded from a different mesh point ++ * @NUM_MESH_FAST_TX_TYPE: number of entry types ++ */ ++enum ieee80211_mesh_fast_tx_type { ++ MESH_FAST_TX_TYPE_LOCAL, ++ MESH_FAST_TX_TYPE_PROXIED, ++ MESH_FAST_TX_TYPE_FORWARDED, ++ ++ /* must be last */ ++ NUM_MESH_FAST_TX_TYPE ++}; ++ ++ ++/** ++ * struct ieee80211_mesh_fast_tx_key - cached mesh fast tx entry key ++ * ++ * @addr: The Ethernet DA for this entry ++ * @type: cache entry type ++ */ ++struct ieee80211_mesh_fast_tx_key { ++ u8 addr[ETH_ALEN] __aligned(2); ++ u16 type; ++}; ++ + /** + * struct ieee80211_mesh_fast_tx - cached mesh fast tx entry + * @rhash: rhashtable pointer +- * @addr_key: The Ethernet DA which is the key for this entry ++ * @key: the lookup key for this cache entry + * @fast_tx: base fast_tx data + * @hdr: cached mesh and rfc1042 headers + * @hdrlen: length of mesh + rfc1042 +@@ -147,7 +176,7 @@ struct mesh_path { + */ + struct ieee80211_mesh_fast_tx { + struct rhash_head rhash; +- u8 addr_key[ETH_ALEN] __aligned(2); ++ struct ieee80211_mesh_fast_tx_key key; + + struct ieee80211_fast_tx fast_tx; + u8 hdr[sizeof(struct ieee80211s_hdr) + sizeof(rfc1042_header)]; +@@ -333,7 +362,8 @@ void mesh_path_tx_root_frame(struct ieee80211_sub_if_data *sdata); + + bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt); + struct ieee80211_mesh_fast_tx * +-mesh_fast_tx_get(struct ieee80211_sub_if_data *sdata, const u8 *addr); ++mesh_fast_tx_get(struct ieee80211_sub_if_data *sdata, ++ struct ieee80211_mesh_fast_tx_key *key); + bool ieee80211_mesh_xmit_fast(struct ieee80211_sub_if_data *sdata, + struct sk_buff *skb, u32 ctrl_flags); + void mesh_fast_tx_cache(struct ieee80211_sub_if_data *sdata, +diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c +index 91b55d6a68b97..a6b62169f0848 100644 +--- a/net/mac80211/mesh_pathtbl.c ++++ b/net/mac80211/mesh_pathtbl.c +@@ -37,8 +37,8 @@ static const struct rhashtable_params mesh_rht_params = { + static const struct rhashtable_params fast_tx_rht_params = { + .nelem_hint = 10, + .automatic_shrinking = true, +- .key_len = ETH_ALEN, +- .key_offset = offsetof(struct ieee80211_mesh_fast_tx, addr_key), ++ .key_len = sizeof_field(struct ieee80211_mesh_fast_tx, key), ++ .key_offset = offsetof(struct ieee80211_mesh_fast_tx, key), + .head_offset = offsetof(struct ieee80211_mesh_fast_tx, rhash), + .hashfn = mesh_table_hash, + }; +@@ -431,20 +431,21 @@ static void mesh_fast_tx_entry_free(struct mesh_tx_cache *cache, + } + + struct ieee80211_mesh_fast_tx * +-mesh_fast_tx_get(struct ieee80211_sub_if_data *sdata, const u8 *addr) ++mesh_fast_tx_get(struct ieee80211_sub_if_data *sdata, ++ struct ieee80211_mesh_fast_tx_key *key) + { + struct ieee80211_mesh_fast_tx *entry; + struct mesh_tx_cache *cache; + + cache = &sdata->u.mesh.tx_cache; +- entry = rhashtable_lookup(&cache->rht, addr, fast_tx_rht_params); ++ entry = rhashtable_lookup(&cache->rht, key, fast_tx_rht_params); + if (!entry) + return NULL; + + if (!(entry->mpath->flags & MESH_PATH_ACTIVE) || + mpath_expired(entry->mpath)) { + spin_lock_bh(&cache->walk_lock); +- entry = rhashtable_lookup(&cache->rht, addr, fast_tx_rht_params); ++ entry = rhashtable_lookup(&cache->rht, key, fast_tx_rht_params); + if (entry) + mesh_fast_tx_entry_free(cache, entry); + spin_unlock_bh(&cache->walk_lock); +@@ -489,18 +490,24 @@ void mesh_fast_tx_cache(struct ieee80211_sub_if_data *sdata, + if (!sta) + return; + ++ build.key.type = MESH_FAST_TX_TYPE_LOCAL; + if ((meshhdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6) { + /* This is required to keep the mppath alive */ + mppath = mpp_path_lookup(sdata, meshhdr->eaddr1); + if (!mppath) + return; + build.mppath = mppath; ++ if (!ether_addr_equal(meshhdr->eaddr2, sdata->vif.addr)) ++ build.key.type = MESH_FAST_TX_TYPE_PROXIED; + } else if (ieee80211_has_a4(hdr->frame_control)) { + mppath = mpath; + } else { + return; + } + ++ if (!ether_addr_equal(hdr->addr4, sdata->vif.addr)) ++ build.key.type = MESH_FAST_TX_TYPE_FORWARDED; ++ + /* rate limit, in case fast xmit can't be enabled */ + if (mppath->fast_tx_check == jiffies) + return; +@@ -547,7 +554,7 @@ void mesh_fast_tx_cache(struct ieee80211_sub_if_data *sdata, + } + } + +- memcpy(build.addr_key, mppath->dst, ETH_ALEN); ++ memcpy(build.key.addr, mppath->dst, ETH_ALEN); + build.timestamp = jiffies; + build.fast_tx.band = info->band; + build.fast_tx.da_offs = offsetof(struct ieee80211_hdr, addr3); +@@ -646,12 +653,18 @@ void mesh_fast_tx_flush_addr(struct ieee80211_sub_if_data *sdata, + const u8 *addr) + { + struct mesh_tx_cache *cache = &sdata->u.mesh.tx_cache; ++ struct ieee80211_mesh_fast_tx_key key = {}; + struct ieee80211_mesh_fast_tx *entry; ++ int i; + ++ ether_addr_copy(key.addr, addr); + spin_lock_bh(&cache->walk_lock); +- entry = rhashtable_lookup_fast(&cache->rht, addr, fast_tx_rht_params); +- if (entry) +- mesh_fast_tx_entry_free(cache, entry); ++ for (i = 0; i < NUM_MESH_FAST_TX_TYPE; i++) { ++ key.type = i; ++ entry = rhashtable_lookup_fast(&cache->rht, &key, fast_tx_rht_params); ++ if (entry) ++ mesh_fast_tx_entry_free(cache, entry); ++ } + spin_unlock_bh(&cache->walk_lock); + } + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 0bf72928ccfca..541b0f53c6c35 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2746,7 +2746,10 @@ ieee80211_rx_mesh_fast_forward(struct ieee80211_sub_if_data *sdata, + struct sk_buff *skb, int hdrlen) + { + struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; +- struct ieee80211_mesh_fast_tx *entry = NULL; ++ struct ieee80211_mesh_fast_tx_key key = { ++ .type = MESH_FAST_TX_TYPE_FORWARDED ++ }; ++ struct ieee80211_mesh_fast_tx *entry; + struct ieee80211s_hdr *mesh_hdr; + struct tid_ampdu_tx *tid_tx; + struct sta_info *sta; +@@ -2755,9 +2758,13 @@ ieee80211_rx_mesh_fast_forward(struct ieee80211_sub_if_data *sdata, + + mesh_hdr = (struct ieee80211s_hdr *)(skb->data + sizeof(eth)); + if ((mesh_hdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6) +- entry = mesh_fast_tx_get(sdata, mesh_hdr->eaddr1); ++ ether_addr_copy(key.addr, mesh_hdr->eaddr1); + else if (!(mesh_hdr->flags & MESH_FLAGS_AE)) +- entry = mesh_fast_tx_get(sdata, skb->data); ++ ether_addr_copy(key.addr, skb->data); ++ else ++ return false; ++ ++ entry = mesh_fast_tx_get(sdata, &key); + if (!entry) + return false; + +-- +2.43.0 + diff --git a/queue-6.8/wifi-mac80211_hwsim-init-peer-measurement-result.patch b/queue-6.8/wifi-mac80211_hwsim-init-peer-measurement-result.patch new file mode 100644 index 00000000000..2803f4ae0db --- /dev/null +++ b/queue-6.8/wifi-mac80211_hwsim-init-peer-measurement-result.patch @@ -0,0 +1,38 @@ +From 9f57e05e706ce45fe9e0d42b616b472f53f4bee5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 10:52:24 +0200 +Subject: wifi: mac80211_hwsim: init peer measurement result + +From: Johannes Berg + +[ Upstream commit 2a4e01e5270b9fa9f6e6e0a4c24ac51a758636f9 ] + +If we don't get all the values here, we might pass them to +cfg80211 uninitialized. Fix that, even if the input might +then not make much sense. + +Fixes: 2af3b2a631b1 ("mac80211_hwsim: add PMSR report support via virtio") +Reviewed-by: Miriam Rachel Korenblit +Link: https://msgid.link/20240418105220.e1317621c1f9.If7dd447de24d7493d133284db5e9e482e4e299f8@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/virtual/mac80211_hwsim.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c +index a84340c2075ff..a9c3fb2ccdcdb 100644 +--- a/drivers/net/wireless/virtual/mac80211_hwsim.c ++++ b/drivers/net/wireless/virtual/mac80211_hwsim.c +@@ -3818,7 +3818,7 @@ static int hwsim_pmsr_report_nl(struct sk_buff *msg, struct genl_info *info) + } + + nla_for_each_nested(peer, peers, rem) { +- struct cfg80211_pmsr_result result; ++ struct cfg80211_pmsr_result result = {}; + + err = mac80211_hwsim_parse_pmsr_result(peer, &result, info); + if (err) +-- +2.43.0 +