From 0545ecb8f7e2caa8a81da3af9fbbfac50529a8b6 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 18 May 2025 06:30:30 -0400 Subject: [PATCH] Fixes for 6.12 Signed-off-by: Sasha Levin --- ...elivery-of-ump-events-to-group-ports.patch | 158 ++++++++ ...snd_aica-should-depend-on-sh_dma_api.patch | 46 +++ ...ypo-of-snd_ump_stream_msg_device_inf.patch | 61 +++ ...-var-som-fix-ldo5-shutdown-causing-s.patch | 70 ++++ ...ip-assign-rt5616-mclk-rate-on-rk3588.patch | 44 +++ ...brk-for-static-pie-even-if-aslr-disa.patch | 198 ++++++++++ ...ix-mgmt_op_add_device-invalid-device.patch | 55 +++ ...tend-kthread_is_per_cpu-check-to-all.patch | 53 +++ ...-x86-amd-pmf-check-for-invalid-sidel.patch | 50 +++ ...-x86-amd-pmf-check-for-invalid-smart.patch | 78 ++++ ...end-hibernate-notification-callback-.patch | 149 ++++++++ ...timestamp-mmio-value-instead-of-lrc-.patch | 81 ++++ ...imple_xattr_list-to-always-include-s.patch | 102 +++++ ...-fix-memory-leak-in-thrustmaster_int.patch | 39 ++ ...null-check-in-uclogic_input_configur.patch | 46 +++ ...ix-potential-timestamp-alignment-iss.patch | 45 +++ ...-fix-insufficient-alignment-of-times.patch | 44 +++ ...ms7003-use-aligned_s64-for-timestamp.patch | 63 ++++ ...-sps30-use-aligned_s64-for-timestamp.patch | 43 +++ ...ls0025pa-use-aligned_s64-for-timesta.patch | 70 ++++ ...o-struct-kvm_gfn_range-to-indicate-p.patch | 153 ++++++++ ...ent-installing-hugepages-when-mem-at.patch | 134 +++++++ ...no-longer-rely-on-net-dev_index_head.patch | 120 ++++++ ...outer-fix-use-after-free-when-deleti.patch | 100 +++++ ...-fix-a-possible-deadlock-in-macb_hal.patch | 64 ++++ ...ent-standalone-from-trying-to-forwar.patch | 139 +++++++ ...discard-incoming-frames-in-br_state_.patch | 92 +++++ ..._eth_soc-fix-typo-for-declaration-mt.patch | 41 ++ ...-don-t-access-ifa_index-when-missing.patch | 68 ++++ ...keys-maintain-only-one-ref-to-corres.patch | 57 +++ ...e-macsec-offload-for-uplink-represen.patch | 156 ++++++++ ...-kernel-panic-when-alloc_page-failed.patch | 61 +++ ...flush-gso_skb-list-too-during-change.patch | 147 ++++++++ ...cs-tc-all-actions-are-indexed-arrays.patch | 48 +++ ...s-tc-fix-a-couple-of-attribute-names.patch | 47 +++ ...re-of-nfs_get_lock_context-in-unlock.patch | 97 +++++ ...-the-layout-state-after-a-layoutretu.patch | 50 +++ ...-cq_poll_lock-in-nvme_poll_irqdisabl.patch | 40 ++ ...-nvme_pci_npages_prp-__always_inline.patch | 64 ++++ ...late-bin_attribute-size-through-bin_.patch | 62 ++++ ...cteontx2-af-fix-cgx-receive-counters.patch | 43 +++ ...do-not-reallocate-all-ntuple-filters.patch | 78 ++++ ...sec-fix-incorrect-max-transmit-size-.patch | 47 +++ ...ate-bin_attribute-size-through-bin_s.patch | 92 +++++ ...-pmc-declare-quirk_spurious_8042-for.patch | 69 ++++ ...s-wmi-fix-wlan_ctrl_by_user-detectio.patch | 76 ++++ ...y-leak-in-qlcnic_sriov_channel_cfg_c.patch | 45 +++ ...san-slab-use-after-free-read-in-ib_r.patch | 93 +++++ ...b-use-after-free-read-in-rxe_queue_c.patch | 69 ++++ ...r-max20086-fix-invalid-memory-access.patch | 73 ++++ ...top-evicting-resources-on-apus-in-su.patch | 114 ++++++ ...-fix-dma-data-width-configuration-fo.patch | 57 +++ ...ssing-rq-lock-in-scx_bpf_cpuperf_set.patch | 81 ++++ ...sts-ncdevmem-make-client_ip-optional.patch | 56 +++ ...em-redirect-all-non-payload-output-t.patch | 223 +++++++++++ ...cdevmem-separate-out-dmabuf-provider.patch | 351 ++++++++++++++++++ ...elftests-ncdevmem-switch-to-af_inet6.patch | 191 ++++++++++ ...ftests-ncdevmem-unify-error-handling.patch | 72 ++++ queue-6.12/series | 75 ++++ ...test-do-not-split-1024-byte-hexdumps.patch | 43 +++ ...-pass-size-to-sysfs_add_bin_file_mod.patch | 99 +++++ ...ce-callback-attribute_group-bin_size.patch | 78 ++++ ...onstify-attribute-callback-of-bin_at.patch | 196 ++++++++++ ...onstify-attribute-callback-of-bin_is.patch | 240 ++++++++++++ ...evmem-fix-double-free-of-queue-array.patch | 147 ++++++++ ...htool-fix-crash-when-hardware-clock-.patch | 71 ++++ .../tpm-tis-double-the-timeout-b-to-4s.patch | 76 ++++ ...ix-a-possible-race-in-trace_probe_lo.patch | 153 ++++++++ ...mestamping-with-a-stacked-dsa-driver.patch | 133 +++++++ ...ix-sysfs-creation-path-for-ring-buff.patch | 311 ++++++++++++++++ ...e-netdev_tx_reset_queue-is-called-on.patch | 41 ++ ...a-func-argument-recycle_done-to-virt.patch | 96 +++++ ...occasional-failure-in-siocoutq-tests.patch | 82 ++++ ...t-n_channels-after-allocating-struct.patch | 55 +++ ...vent-polling-busyloop-if-pending-rx-.patch | 129 +++++++ ...-performance-by-removing-delay-in-tr.patch | 49 +++ 76 files changed, 7139 insertions(+) create mode 100644 queue-6.12/alsa-seq-fix-delivery-of-ump-events-to-group-ports.patch create mode 100644 queue-6.12/alsa-sh-snd_aica-should-depend-on-sh_dma_api.patch create mode 100644 queue-6.12/alsa-ump-fix-a-typo-of-snd_ump_stream_msg_device_inf.patch create mode 100644 queue-6.12/arm64-dts-imx8mp-var-som-fix-ldo5-shutdown-causing-s.patch create mode 100644 queue-6.12/arm64-dts-rockchip-assign-rt5616-mclk-rate-on-rk3588.patch create mode 100644 queue-6.12/binfmt_elf-move-brk-for-static-pie-even-if-aslr-disa.patch create mode 100644 queue-6.12/bluetooth-mgmt-fix-mgmt_op_add_device-invalid-device.patch create mode 100644 queue-6.12/cgroup-cpuset-extend-kthread_is_per_cpu-check-to-all.patch create mode 100644 queue-6.12/drivers-platform-x86-amd-pmf-check-for-invalid-sidel.patch create mode 100644 queue-6.12/drivers-platform-x86-amd-pmf-check-for-invalid-smart.patch create mode 100644 queue-6.12/drm-amd-add-suspend-hibernate-notification-callback-.patch create mode 100644 queue-6.12/drm-xe-save-ctx_timestamp-mmio-value-instead-of-lrc-.patch create mode 100644 queue-6.12/fs-xattr.c-fix-simple_xattr_list-to-always-include-s.patch create mode 100644 queue-6.12/hid-thrustmaster-fix-memory-leak-in-thrustmaster_int.patch create mode 100644 queue-6.12/hid-uclogic-add-null-check-in-uclogic_input_configur.patch create mode 100644 queue-6.12/iio-adc-ad7266-fix-potential-timestamp-alignment-iss.patch create mode 100644 queue-6.12/iio-adc-ad7768-1-fix-insufficient-alignment-of-times.patch create mode 100644 queue-6.12/iio-chemical-pms7003-use-aligned_s64-for-timestamp.patch create mode 100644 queue-6.12/iio-chemical-sps30-use-aligned_s64-for-timestamp.patch create mode 100644 queue-6.12/iio-pressure-mprls0025pa-use-aligned_s64-for-timesta.patch create mode 100644 queue-6.12/kvm-add-member-to-struct-kvm_gfn_range-to-indicate-p.patch create mode 100644 queue-6.12/kvm-x86-mmu-prevent-installing-hugepages-when-mem-at.patch create mode 100644 queue-6.12/mctp-no-longer-rely-on-net-dev_index_head.patch create mode 100644 queue-6.12/mlxsw-spectrum_router-fix-use-after-free-when-deleti.patch create mode 100644 queue-6.12/net-cadence-macb-fix-a-possible-deadlock-in-macb_hal.patch create mode 100644 queue-6.12/net-dsa-b53-prevent-standalone-from-trying-to-forwar.patch create mode 100644 queue-6.12/net-dsa-sja1105-discard-incoming-frames-in-br_state_.patch create mode 100644 queue-6.12/net-ethernet-mtk_eth_soc-fix-typo-for-declaration-mt.patch create mode 100644 queue-6.12/net-mctp-don-t-access-ifa_index-when-missing.patch create mode 100644 queue-6.12/net-mctp-ensure-keys-maintain-only-one-ref-to-corres.patch create mode 100644 queue-6.12/net-mlx5e-disable-macsec-offload-for-uplink-represen.patch create mode 100644 queue-6.12/net-tls-fix-kernel-panic-when-alloc_page-failed.patch create mode 100644 queue-6.12/net_sched-flush-gso_skb-list-too-during-change.patch create mode 100644 queue-6.12/netlink-specs-tc-all-actions-are-indexed-arrays.patch create mode 100644 queue-6.12/netlink-specs-tc-fix-a-couple-of-attribute-names.patch create mode 100644 queue-6.12/nfs-handle-failure-of-nfs_get_lock_context-in-unlock.patch create mode 100644 queue-6.12/nfsv4-pnfs-reset-the-layout-state-after-a-layoutretu.patch create mode 100644 queue-6.12/nvme-pci-acquire-cq_poll_lock-in-nvme_poll_irqdisabl.patch create mode 100644 queue-6.12/nvme-pci-make-nvme_pci_npages_prp-__always_inline.patch create mode 100644 queue-6.12/nvmem-core-calculate-bin_attribute-size-through-bin_.patch create mode 100644 queue-6.12/octeontx2-af-fix-cgx-receive-counters.patch create mode 100644 queue-6.12/octeontx2-pf-do-not-reallocate-all-ntuple-filters.patch create mode 100644 queue-6.12/octeontx2-pf-macsec-fix-incorrect-max-transmit-size-.patch create mode 100644 queue-6.12/pci-sysfs-calculate-bin_attribute-size-through-bin_s.patch create mode 100644 queue-6.12/platform-x86-amd-pmc-declare-quirk_spurious_8042-for.patch create mode 100644 queue-6.12/platform-x86-asus-wmi-fix-wlan_ctrl_by_user-detectio.patch create mode 100644 queue-6.12/qlcnic-fix-memory-leak-in-qlcnic_sriov_channel_cfg_c.patch create mode 100644 queue-6.12/rdma-core-fix-kasan-slab-use-after-free-read-in-ib_r.patch create mode 100644 queue-6.12/rdma-rxe-fix-slab-use-after-free-read-in-rxe_queue_c.patch create mode 100644 queue-6.12/regulator-max20086-fix-invalid-memory-access.patch create mode 100644 queue-6.12/revert-drm-amd-stop-evicting-resources-on-apus-in-su.patch create mode 100644 queue-6.12/riscv-dts-sophgo-fix-dma-data-width-configuration-fo.patch create mode 100644 queue-6.12/sched_ext-fix-missing-rq-lock-in-scx_bpf_cpuperf_set.patch create mode 100644 queue-6.12/selftests-ncdevmem-make-client_ip-optional.patch create mode 100644 queue-6.12/selftests-ncdevmem-redirect-all-non-payload-output-t.patch create mode 100644 queue-6.12/selftests-ncdevmem-separate-out-dmabuf-provider.patch create mode 100644 queue-6.12/selftests-ncdevmem-switch-to-af_inet6.patch create mode 100644 queue-6.12/selftests-ncdevmem-unify-error-handling.patch create mode 100644 queue-6.12/series create mode 100644 queue-6.12/spi-loopback-test-do-not-split-1024-byte-hexdumps.patch create mode 100644 queue-6.12/sysfs-explicitly-pass-size-to-sysfs_add_bin_file_mod.patch create mode 100644 queue-6.12/sysfs-introduce-callback-attribute_group-bin_size.patch create mode 100644 queue-6.12/sysfs-treewide-constify-attribute-callback-of-bin_at.patch create mode 100644 queue-6.12/sysfs-treewide-constify-attribute-callback-of-bin_is.patch create mode 100644 queue-6.12/tests-ncdevmem-fix-double-free-of-queue-array.patch create mode 100644 queue-6.12/tools-net-ynl-ethtool-fix-crash-when-hardware-clock-.patch create mode 100644 queue-6.12/tpm-tis-double-the-timeout-b-to-4s.patch create mode 100644 queue-6.12/tracing-probes-fix-a-possible-race-in-trace_probe_lo.patch create mode 100644 queue-6.12/tsnep-fix-timestamping-with-a-stacked-dsa-driver.patch create mode 100644 queue-6.12/uio_hv_generic-fix-sysfs-creation-path-for-ring-buff.patch create mode 100644 queue-6.12/virtio_net-ensure-netdev_tx_reset_queue-is-called-on.patch create mode 100644 queue-6.12/virtio_ring-add-a-func-argument-recycle_done-to-virt.patch create mode 100644 queue-6.12/vsock-test-fix-occasional-failure-in-siocoutq-tests.patch create mode 100644 queue-6.12/wifi-mac80211-set-n_channels-after-allocating-struct.patch create mode 100644 queue-6.12/xhci-dbc-avoid-event-polling-busyloop-if-pending-rx-.patch create mode 100644 queue-6.12/xhci-dbc-improve-performance-by-removing-delay-in-tr.patch diff --git a/queue-6.12/alsa-seq-fix-delivery-of-ump-events-to-group-ports.patch b/queue-6.12/alsa-seq-fix-delivery-of-ump-events-to-group-ports.patch new file mode 100644 index 0000000000..cec0ee0044 --- /dev/null +++ b/queue-6.12/alsa-seq-fix-delivery-of-ump-events-to-group-ports.patch @@ -0,0 +1,158 @@ +From 4f22ddc07d8c74575e4ee80eaf6aa1c04e55f731 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 May 2025 15:45:27 +0200 +Subject: ALSA: seq: Fix delivery of UMP events to group ports + +From: Takashi Iwai + +[ Upstream commit ff7b190aef6cccdb6f14d20c5753081fe6420e0b ] + +When an event with UMP message is sent to a UMP client, the EP port +receives always no matter where the event is sent to, as it's a +catch-all port. OTOH, if an event is sent to EP port, and if the +event has a certain UMP Group, it should have been delivered to the +associated UMP Group port, too, but this was ignored, so far. + +This patch addresses the behavior. Now a UMP event sent to the +Endpoint port will be delivered to the subscribers of the UMP group +port the event is associated with. + +The patch also does a bit of refactoring to simplify the code about +__deliver_to_subscribers(). + +Fixes: 177ccf811df4 ("ALSA: seq: Support MIDI 2.0 UMP Endpoint port") +Link: https://patch.msgid.link/20250511134528.6314-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/seq/seq_clientmgr.c | 52 ++++++++++++++++++++------------ + sound/core/seq/seq_ump_convert.c | 18 +++++++++++ + sound/core/seq/seq_ump_convert.h | 1 + + 3 files changed, 52 insertions(+), 19 deletions(-) + +diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c +index b30faf731da72..b74de9c0969fc 100644 +--- a/sound/core/seq/seq_clientmgr.c ++++ b/sound/core/seq/seq_clientmgr.c +@@ -732,15 +732,21 @@ static int snd_seq_deliver_single_event(struct snd_seq_client *client, + */ + static int __deliver_to_subscribers(struct snd_seq_client *client, + struct snd_seq_event *event, +- struct snd_seq_client_port *src_port, +- int atomic, int hop) ++ int port, int atomic, int hop) + { ++ struct snd_seq_client_port *src_port; + struct snd_seq_subscribers *subs; + int err, result = 0, num_ev = 0; + union __snd_seq_event event_saved; + size_t saved_size; + struct snd_seq_port_subs_info *grp; + ++ if (port < 0) ++ return 0; ++ src_port = snd_seq_port_use_ptr(client, port); ++ if (!src_port) ++ return 0; ++ + /* save original event record */ + saved_size = snd_seq_event_packet_size(event); + memcpy(&event_saved, event, saved_size); +@@ -775,6 +781,7 @@ static int __deliver_to_subscribers(struct snd_seq_client *client, + read_unlock(&grp->list_lock); + else + up_read(&grp->list_mutex); ++ snd_seq_port_unlock(src_port); + memcpy(event, &event_saved, saved_size); + return (result < 0) ? result : num_ev; + } +@@ -783,25 +790,32 @@ static int deliver_to_subscribers(struct snd_seq_client *client, + struct snd_seq_event *event, + int atomic, int hop) + { +- struct snd_seq_client_port *src_port; +- int ret = 0, ret2; +- +- src_port = snd_seq_port_use_ptr(client, event->source.port); +- if (src_port) { +- ret = __deliver_to_subscribers(client, event, src_port, atomic, hop); +- snd_seq_port_unlock(src_port); +- } +- +- if (client->ump_endpoint_port < 0 || +- event->source.port == client->ump_endpoint_port) +- return ret; ++ int ret; ++#if IS_ENABLED(CONFIG_SND_SEQ_UMP) ++ int ret2; ++#endif + +- src_port = snd_seq_port_use_ptr(client, client->ump_endpoint_port); +- if (!src_port) ++ ret = __deliver_to_subscribers(client, event, ++ event->source.port, atomic, hop); ++#if IS_ENABLED(CONFIG_SND_SEQ_UMP) ++ if (!snd_seq_client_is_ump(client) || client->ump_endpoint_port < 0) + return ret; +- ret2 = __deliver_to_subscribers(client, event, src_port, atomic, hop); +- snd_seq_port_unlock(src_port); +- return ret2 < 0 ? ret2 : ret; ++ /* If it's an event from EP port (and with a UMP group), ++ * deliver to subscribers of the corresponding UMP group port, too. ++ * Or, if it's from non-EP port, deliver to subscribers of EP port, too. ++ */ ++ if (event->source.port == client->ump_endpoint_port) ++ ret2 = __deliver_to_subscribers(client, event, ++ snd_seq_ump_group_port(event), ++ atomic, hop); ++ else ++ ret2 = __deliver_to_subscribers(client, event, ++ client->ump_endpoint_port, ++ atomic, hop); ++ if (ret2 < 0) ++ return ret2; ++#endif ++ return ret; + } + + /* deliver an event to the destination port(s). +diff --git a/sound/core/seq/seq_ump_convert.c b/sound/core/seq/seq_ump_convert.c +index ff7e558b4d51d..db2f169cae11e 100644 +--- a/sound/core/seq/seq_ump_convert.c ++++ b/sound/core/seq/seq_ump_convert.c +@@ -1285,3 +1285,21 @@ int snd_seq_deliver_to_ump(struct snd_seq_client *source, + else + return cvt_to_ump_midi1(dest, dest_port, event, atomic, hop); + } ++ ++/* return the UMP group-port number of the event; ++ * return -1 if groupless or non-UMP event ++ */ ++int snd_seq_ump_group_port(const struct snd_seq_event *event) ++{ ++ const struct snd_seq_ump_event *ump_ev = ++ (const struct snd_seq_ump_event *)event; ++ unsigned char type; ++ ++ if (!snd_seq_ev_is_ump(event)) ++ return -1; ++ type = ump_message_type(ump_ev->ump[0]); ++ if (ump_is_groupless_msg(type)) ++ return -1; ++ /* group-port number starts from 1 */ ++ return ump_message_group(ump_ev->ump[0]) + 1; ++} +diff --git a/sound/core/seq/seq_ump_convert.h b/sound/core/seq/seq_ump_convert.h +index 6c146d8032804..4abf0a7637d70 100644 +--- a/sound/core/seq/seq_ump_convert.h ++++ b/sound/core/seq/seq_ump_convert.h +@@ -18,5 +18,6 @@ int snd_seq_deliver_to_ump(struct snd_seq_client *source, + struct snd_seq_client_port *dest_port, + struct snd_seq_event *event, + int atomic, int hop); ++int snd_seq_ump_group_port(const struct snd_seq_event *event); + + #endif /* __SEQ_UMP_CONVERT_H */ +-- +2.39.5 + diff --git a/queue-6.12/alsa-sh-snd_aica-should-depend-on-sh_dma_api.patch b/queue-6.12/alsa-sh-snd_aica-should-depend-on-sh_dma_api.patch new file mode 100644 index 0000000000..2485fbf00f --- /dev/null +++ b/queue-6.12/alsa-sh-snd_aica-should-depend-on-sh_dma_api.patch @@ -0,0 +1,46 @@ +From a8a0c9dea84b0d211aede2ec926b9d141617aa75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 May 2025 09:31:04 +0200 +Subject: ALSA: sh: SND_AICA should depend on SH_DMA_API + +From: Geert Uytterhoeven + +[ Upstream commit 66e48ef6ef506c89ec1b3851c6f9f5f80b5835ff ] + +If CONFIG_SH_DMA_API=n: + + WARNING: unmet direct dependencies detected for G2_DMA + Depends on [n]: SH_DREAMCAST [=y] && SH_DMA_API [=n] + Selected by [y]: + - SND_AICA [=y] && SOUND [=y] && SND [=y] && SND_SUPERH [=y] && SH_DREAMCAST [=y] + +SND_AICA selects G2_DMA. As the latter depends on SH_DMA_API, the +former should depend on SH_DMA_API, too. + +Fixes: f477a538c14d07f8 ("sh: dma: fix kconfig dependency for G2_DMA") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202505131320.PzgTtl9H-lkp@intel.com/ +Signed-off-by: Geert Uytterhoeven +Link: https://patch.msgid.link/b90625f8a9078d0d304bafe862cbe3a3fab40082.1747121335.git.geert+renesas@glider.be +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/sh/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/sh/Kconfig b/sound/sh/Kconfig +index b75fbb3236a7b..f5fa09d740b4c 100644 +--- a/sound/sh/Kconfig ++++ b/sound/sh/Kconfig +@@ -14,7 +14,7 @@ if SND_SUPERH + + config SND_AICA + tristate "Dreamcast Yamaha AICA sound" +- depends on SH_DREAMCAST ++ depends on SH_DREAMCAST && SH_DMA_API + select SND_PCM + select G2_DMA + help +-- +2.39.5 + diff --git a/queue-6.12/alsa-ump-fix-a-typo-of-snd_ump_stream_msg_device_inf.patch b/queue-6.12/alsa-ump-fix-a-typo-of-snd_ump_stream_msg_device_inf.patch new file mode 100644 index 0000000000..7d7c102787 --- /dev/null +++ b/queue-6.12/alsa-ump-fix-a-typo-of-snd_ump_stream_msg_device_inf.patch @@ -0,0 +1,61 @@ +From 9480e58082f5b4617e46799814380f6dbf25cd46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 May 2025 16:11:45 +0200 +Subject: ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info + +From: Takashi Iwai + +[ Upstream commit dd33993a9721ab1dae38bd37c9f665987d554239 ] + +s/devince/device/ + +It's used only internally, so no any behavior changes. + +Fixes: 37e0e14128e0 ("ALSA: ump: Support UMP Endpoint and Function Block parsing") +Acked-by: Greg Kroah-Hartman +Link: https://patch.msgid.link/20250511141147.10246-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_midi2.c | 2 +- + include/sound/ump_msg.h | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/gadget/function/f_midi2.c b/drivers/usb/gadget/function/f_midi2.c +index 8c9d0074db588..0c45936f51b3d 100644 +--- a/drivers/usb/gadget/function/f_midi2.c ++++ b/drivers/usb/gadget/function/f_midi2.c +@@ -475,7 +475,7 @@ static void reply_ump_stream_ep_info(struct f_midi2_ep *ep) + /* reply a UMP EP device info */ + static void reply_ump_stream_ep_device(struct f_midi2_ep *ep) + { +- struct snd_ump_stream_msg_devince_info rep = { ++ struct snd_ump_stream_msg_device_info rep = { + .type = UMP_MSG_TYPE_STREAM, + .status = UMP_STREAM_MSG_STATUS_DEVICE_INFO, + .manufacture_id = ep->info.manufacturer, +diff --git a/include/sound/ump_msg.h b/include/sound/ump_msg.h +index 72f60ddfea753..9556b4755a1ed 100644 +--- a/include/sound/ump_msg.h ++++ b/include/sound/ump_msg.h +@@ -604,7 +604,7 @@ struct snd_ump_stream_msg_ep_info { + } __packed; + + /* UMP Stream Message: Device Info Notification (128bit) */ +-struct snd_ump_stream_msg_devince_info { ++struct snd_ump_stream_msg_device_info { + #ifdef __BIG_ENDIAN_BITFIELD + /* 0 */ + u32 type:4; +@@ -754,7 +754,7 @@ struct snd_ump_stream_msg_fb_name { + union snd_ump_stream_msg { + struct snd_ump_stream_msg_ep_discovery ep_discovery; + struct snd_ump_stream_msg_ep_info ep_info; +- struct snd_ump_stream_msg_devince_info device_info; ++ struct snd_ump_stream_msg_device_info device_info; + struct snd_ump_stream_msg_stream_cfg stream_cfg; + struct snd_ump_stream_msg_fb_discovery fb_discovery; + struct snd_ump_stream_msg_fb_info fb_info; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-imx8mp-var-som-fix-ldo5-shutdown-causing-s.patch b/queue-6.12/arm64-dts-imx8mp-var-som-fix-ldo5-shutdown-causing-s.patch new file mode 100644 index 0000000000..81bb50fefa --- /dev/null +++ b/queue-6.12/arm64-dts-imx8mp-var-som-fix-ldo5-shutdown-causing-s.patch @@ -0,0 +1,70 @@ +From 6b7070119e649f812b88a325c40c08c7ecd01e7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 May 2025 11:28:27 +0530 +Subject: arm64: dts: imx8mp-var-som: Fix LDO5 shutdown causing SD card timeout + +From: Himanshu Bhavani + +[ Upstream commit c6888983134e2ccc2db8ffd2720b0d4826d952e4 ] + +Fix SD card timeout issue caused by LDO5 regulator getting disabled +after boot. + +The kernel log shows LDO5 being disabled, which leads to a timeout +on USDHC2: +[ 33.760561] LDO5: disabling +[ 81.119861] mmc1: Timeout waiting for hardware interrupt. + +To prevent this, set regulator-boot-on and regulator-always-on for +LDO5. Also add the vqmmc regulator to properly support 1.8V/3.3V +signaling for USDHC2 using a GPIO-controlled regulator. + +Fixes: 6c2a1f4f71258 ("arm64: dts: imx8mp-var-som-symphony: Add Variscite Symphony board and VAR-SOM-MX8MP SoM") +Signed-off-by: Himanshu Bhavani +Acked-by: Tarang Raval +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp-var-som.dtsi | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-var-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-var-som.dtsi +index b2ac2583a5929..b59da91fdd041 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-var-som.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp-var-som.dtsi +@@ -35,7 +35,6 @@ + <0x1 0x00000000 0 0xc0000000>; + }; + +- + reg_usdhc2_vmmc: regulator-usdhc2-vmmc { + compatible = "regulator-fixed"; + regulator-name = "VSD_3V3"; +@@ -46,6 +45,16 @@ + startup-delay-us = <100>; + off-on-delay-us = <12000>; + }; ++ ++ reg_usdhc2_vqmmc: regulator-usdhc2-vqmmc { ++ compatible = "regulator-gpio"; ++ regulator-name = "VSD_VSEL"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <3300000>; ++ gpios = <&gpio2 12 GPIO_ACTIVE_HIGH>; ++ states = <3300000 0x0 1800000 0x1>; ++ vin-supply = <&ldo5>; ++ }; + }; + + &A53_0 { +@@ -205,6 +214,7 @@ + pinctrl-2 = <&pinctrl_usdhc2_200mhz>, <&pinctrl_usdhc2_gpio>; + cd-gpios = <&gpio1 14 GPIO_ACTIVE_LOW>; + vmmc-supply = <®_usdhc2_vmmc>; ++ vqmmc-supply = <®_usdhc2_vqmmc>; + bus-width = <4>; + status = "okay"; + }; +-- +2.39.5 + diff --git a/queue-6.12/arm64-dts-rockchip-assign-rt5616-mclk-rate-on-rk3588.patch b/queue-6.12/arm64-dts-rockchip-assign-rt5616-mclk-rate-on-rk3588.patch new file mode 100644 index 0000000000..501574f011 --- /dev/null +++ b/queue-6.12/arm64-dts-rockchip-assign-rt5616-mclk-rate-on-rk3588.patch @@ -0,0 +1,44 @@ +From c76fff9ec72645bec613dce6bae59351674790e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Apr 2025 09:17:53 +0100 +Subject: arm64: dts: rockchip: Assign RT5616 MCLK rate on + rk3588-friendlyelec-cm3588 + +From: Tom Vincent + +[ Upstream commit 5e6a4ee9799b202fefa8c6264647971f892f0264 ] + +The Realtek RT5616 audio codec on the FriendlyElec CM3588 module fails +to probe correctly due to the missing clock properties. This results +in distorted analogue audio output. + +Assign MCLK to 12.288 MHz, which allows the codec to advertise most of +the standard sample rates per other RK3588 devices. + +Fixes: e23819cf273c ("arm64: dts: rockchip: Add FriendlyElec CM3588 NAS board") +Signed-off-by: Tom Vincent +Link: https://lore.kernel.org/r/20250417081753.644950-1-linux@tlvince.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3588-friendlyelec-cm3588.dtsi | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3588-friendlyelec-cm3588.dtsi b/arch/arm64/boot/dts/rockchip/rk3588-friendlyelec-cm3588.dtsi +index e3a9598b99fca..cacffc851584f 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588-friendlyelec-cm3588.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3588-friendlyelec-cm3588.dtsi +@@ -222,6 +222,10 @@ + compatible = "realtek,rt5616"; + reg = <0x1b>; + #sound-dai-cells = <0>; ++ assigned-clocks = <&cru I2S0_8CH_MCLKOUT>; ++ assigned-clock-rates = <12288000>; ++ clocks = <&cru I2S0_8CH_MCLKOUT>; ++ clock-names = "mclk"; + }; + }; + +-- +2.39.5 + diff --git a/queue-6.12/binfmt_elf-move-brk-for-static-pie-even-if-aslr-disa.patch b/queue-6.12/binfmt_elf-move-brk-for-static-pie-even-if-aslr-disa.patch new file mode 100644 index 0000000000..0f63e21b8d --- /dev/null +++ b/queue-6.12/binfmt_elf-move-brk-for-static-pie-even-if-aslr-disa.patch @@ -0,0 +1,198 @@ +From ac5b1ae0f9eeb0115421d37aa8c901bca0f51064 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Apr 2025 15:45:06 -0700 +Subject: binfmt_elf: Move brk for static PIE even if ASLR disabled + +From: Kees Cook + +[ Upstream commit 11854fe263eb1b9a8efa33b0c087add7719ea9b4 ] + +In commit bbdc6076d2e5 ("binfmt_elf: move brk out of mmap when doing +direct loader exec"), the brk was moved out of the mmap region when +loading static PIE binaries (ET_DYN without INTERP). The common case +for these binaries was testing new ELF loaders, so the brk needed to +be away from mmap to avoid colliding with stack, future mmaps (of the +loader-loaded binary), etc. But this was only done when ASLR was enabled, +in an attempt to minimize changes to memory layouts. + +After adding support to respect alignment requirements for static PIE +binaries in commit 3545deff0ec7 ("binfmt_elf: Honor PT_LOAD alignment +for static PIE"), it became possible to have a large gap after the +final PT_LOAD segment and the top of the mmap region. This means that +future mmap allocations might go after the last PT_LOAD segment (where +brk might be if ASLR was disabled) instead of before them (where they +traditionally ended up). + +On arm64, running with ASLR disabled, Ubuntu 22.04's "ldconfig" binary, +a static PIE, has alignment requirements that leaves a gap large enough +after the last PT_LOAD segment to fit the vdso and vvar, but still leave +enough space for the brk (which immediately follows the last PT_LOAD +segment) to be allocated by the binary. + +fffff7f20000-fffff7fde000 r-xp 00000000 fe:02 8110426 /sbin/ldconfig.real +fffff7fee000-fffff7ff5000 rw-p 000be000 fe:02 8110426 /sbin/ldconfig.real +fffff7ff5000-fffff7ffa000 rw-p 00000000 00:00 0 +***[brk will go here at fffff7ffa000]*** +fffff7ffc000-fffff7ffe000 r--p 00000000 00:00 0 [vvar] +fffff7ffe000-fffff8000000 r-xp 00000000 00:00 0 [vdso] +fffffffdf000-1000000000000 rw-p 00000000 00:00 0 [stack] + +After commit 0b3bc3354eb9 ("arm64: vdso: Switch to generic storage +implementation"), the arm64 vvar grew slightly, and suddenly the brk +collided with the allocation. + +fffff7f20000-fffff7fde000 r-xp 00000000 fe:02 8110426 /sbin/ldconfig.real +fffff7fee000-fffff7ff5000 rw-p 000be000 fe:02 8110426 /sbin/ldconfig.real +fffff7ff5000-fffff7ffa000 rw-p 00000000 00:00 0 +***[oops, no room any more, vvar is at fffff7ffa000!]*** +fffff7ffa000-fffff7ffe000 r--p 00000000 00:00 0 [vvar] +fffff7ffe000-fffff8000000 r-xp 00000000 00:00 0 [vdso] +fffffffdf000-1000000000000 rw-p 00000000 00:00 0 [stack] + +The solution is to unconditionally move the brk out of the mmap region +for static PIE binaries. Whether ASLR is enabled or not does not change if +there may be future mmap allocation collisions with a growing brk region. + +Update memory layout comments (with kernel-doc headings), consolidate +the setting of mm->brk to later (it isn't needed early), move static PIE +brk out of mmap unconditionally, and make sure brk(2) knows to base brk +position off of mm->start_brk not mm->end_data no matter what the cause of +moving it is (via current->brk_randomized). + +For the CONFIG_COMPAT_BRK case, though, leave the logic unchanged, as we +can never safely move the brk. These systems, however, are not using +specially aligned static PIE binaries. + +Reported-by: Ryan Roberts +Closes: https://lore.kernel.org/lkml/f93db308-4a0e-4806-9faf-98f890f5a5e6@arm.com/ +Fixes: bbdc6076d2e5 ("binfmt_elf: move brk out of mmap when doing direct loader exec") +Link: https://lore.kernel.org/r/20250425224502.work.520-kees@kernel.org +Reviewed-by: Ryan Roberts +Tested-by: Ryan Roberts +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + fs/binfmt_elf.c | 71 ++++++++++++++++++++++++++++++++----------------- + 1 file changed, 47 insertions(+), 24 deletions(-) + +diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c +index 0a216a078c315..47335a0f4a618 100644 +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -825,6 +825,7 @@ static int load_elf_binary(struct linux_binprm *bprm) + struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL; + struct elf_phdr *elf_property_phdata = NULL; + unsigned long elf_brk; ++ bool brk_moved = false; + int retval, i; + unsigned long elf_entry; + unsigned long e_entry; +@@ -1092,15 +1093,19 @@ static int load_elf_binary(struct linux_binprm *bprm) + /* Calculate any requested alignment. */ + alignment = maximum_alignment(elf_phdata, elf_ex->e_phnum); + +- /* +- * There are effectively two types of ET_DYN +- * binaries: programs (i.e. PIE: ET_DYN with PT_INTERP) +- * and loaders (ET_DYN without PT_INTERP, since they +- * _are_ the ELF interpreter). The loaders must +- * be loaded away from programs since the program +- * may otherwise collide with the loader (especially +- * for ET_EXEC which does not have a randomized +- * position). For example to handle invocations of ++ /** ++ * DOC: PIE handling ++ * ++ * There are effectively two types of ET_DYN ELF ++ * binaries: programs (i.e. PIE: ET_DYN with ++ * PT_INTERP) and loaders (i.e. static PIE: ET_DYN ++ * without PT_INTERP, usually the ELF interpreter ++ * itself). Loaders must be loaded away from programs ++ * since the program may otherwise collide with the ++ * loader (especially for ET_EXEC which does not have ++ * a randomized position). ++ * ++ * For example, to handle invocations of + * "./ld.so someprog" to test out a new version of + * the loader, the subsequent program that the + * loader loads must avoid the loader itself, so +@@ -1113,6 +1118,9 @@ static int load_elf_binary(struct linux_binprm *bprm) + * ELF_ET_DYN_BASE and loaders are loaded into the + * independently randomized mmap region (0 load_bias + * without MAP_FIXED nor MAP_FIXED_NOREPLACE). ++ * ++ * See below for "brk" handling details, which is ++ * also affected by program vs loader and ASLR. + */ + if (interpreter) { + /* On ET_DYN with PT_INTERP, we do the ASLR. */ +@@ -1229,8 +1237,6 @@ static int load_elf_binary(struct linux_binprm *bprm) + start_data += load_bias; + end_data += load_bias; + +- current->mm->start_brk = current->mm->brk = ELF_PAGEALIGN(elf_brk); +- + if (interpreter) { + elf_entry = load_elf_interp(interp_elf_ex, + interpreter, +@@ -1286,27 +1292,44 @@ static int load_elf_binary(struct linux_binprm *bprm) + mm->end_data = end_data; + mm->start_stack = bprm->p; + +- if ((current->flags & PF_RANDOMIZE) && (snapshot_randomize_va_space > 1)) { ++ /** ++ * DOC: "brk" handling ++ * ++ * For architectures with ELF randomization, when executing a ++ * loader directly (i.e. static PIE: ET_DYN without PT_INTERP), ++ * move the brk area out of the mmap region and into the unused ++ * ELF_ET_DYN_BASE region. Since "brk" grows up it may collide ++ * early with the stack growing down or other regions being put ++ * into the mmap region by the kernel (e.g. vdso). ++ * ++ * In the CONFIG_COMPAT_BRK case, though, everything is turned ++ * off because we're not allowed to move the brk at all. ++ */ ++ if (!IS_ENABLED(CONFIG_COMPAT_BRK) && ++ IS_ENABLED(CONFIG_ARCH_HAS_ELF_RANDOMIZE) && ++ elf_ex->e_type == ET_DYN && !interpreter) { ++ elf_brk = ELF_ET_DYN_BASE; ++ /* This counts as moving the brk, so let brk(2) know. */ ++ brk_moved = true; ++ } ++ mm->start_brk = mm->brk = ELF_PAGEALIGN(elf_brk); ++ ++ if ((current->flags & PF_RANDOMIZE) && snapshot_randomize_va_space > 1) { + /* +- * For architectures with ELF randomization, when executing +- * a loader directly (i.e. no interpreter listed in ELF +- * headers), move the brk area out of the mmap region +- * (since it grows up, and may collide early with the stack +- * growing down), and into the unused ELF_ET_DYN_BASE region. ++ * If we didn't move the brk to ELF_ET_DYN_BASE (above), ++ * leave a gap between .bss and brk. + */ +- if (IS_ENABLED(CONFIG_ARCH_HAS_ELF_RANDOMIZE) && +- elf_ex->e_type == ET_DYN && !interpreter) { +- mm->brk = mm->start_brk = ELF_ET_DYN_BASE; +- } else { +- /* Otherwise leave a gap between .bss and brk. */ ++ if (!brk_moved) + mm->brk = mm->start_brk = mm->brk + PAGE_SIZE; +- } + + mm->brk = mm->start_brk = arch_randomize_brk(mm); ++ brk_moved = true; ++ } ++ + #ifdef compat_brk_randomized ++ if (brk_moved) + current->brk_randomized = 1; + #endif +- } + + if (current->personality & MMAP_PAGE_ZERO) { + /* Why this, you ask??? Well SVr4 maps page 0 as read-only, +-- +2.39.5 + diff --git a/queue-6.12/bluetooth-mgmt-fix-mgmt_op_add_device-invalid-device.patch b/queue-6.12/bluetooth-mgmt-fix-mgmt_op_add_device-invalid-device.patch new file mode 100644 index 0000000000..db41176478 --- /dev/null +++ b/queue-6.12/bluetooth-mgmt-fix-mgmt_op_add_device-invalid-device.patch @@ -0,0 +1,55 @@ +From 41dda7d3eadc991a279378f492714c1c813c896b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Apr 2025 15:05:59 -0400 +Subject: Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags + +From: Luiz Augusto von Dentz + +[ Upstream commit 1e2e3044c1bc64a64aa0eaf7c17f7832c26c9775 ] + +Device flags could be updated in the meantime while MGMT_OP_ADD_DEVICE +is pending on hci_update_passive_scan_sync so instead of setting the +current_flags as cmd->user_data just do a lookup using +hci_conn_params_lookup and use the latest stored flags. + +Fixes: a182d9c84f9c ("Bluetooth: MGMT: Fix Add Device to responding before completing") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/mgmt.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index c019f69c59395..d4700f940e8a1 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -7612,11 +7612,16 @@ static void add_device_complete(struct hci_dev *hdev, void *data, int err) + struct mgmt_cp_add_device *cp = cmd->param; + + if (!err) { ++ struct hci_conn_params *params; ++ ++ params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, ++ le_addr_type(cp->addr.type)); ++ + device_added(cmd->sk, hdev, &cp->addr.bdaddr, cp->addr.type, + cp->action); + device_flags_changed(NULL, hdev, &cp->addr.bdaddr, + cp->addr.type, hdev->conn_flags, +- PTR_UINT(cmd->user_data)); ++ params ? params->flags : 0); + } + + mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_ADD_DEVICE, +@@ -7719,8 +7724,6 @@ static int add_device(struct sock *sk, struct hci_dev *hdev, + goto unlock; + } + +- cmd->user_data = UINT_PTR(current_flags); +- + err = hci_cmd_sync_queue(hdev, add_device_sync, cmd, + add_device_complete); + if (err < 0) { +-- +2.39.5 + diff --git a/queue-6.12/cgroup-cpuset-extend-kthread_is_per_cpu-check-to-all.patch b/queue-6.12/cgroup-cpuset-extend-kthread_is_per_cpu-check-to-all.patch new file mode 100644 index 0000000000..646f32b064 --- /dev/null +++ b/queue-6.12/cgroup-cpuset-extend-kthread_is_per_cpu-check-to-all.patch @@ -0,0 +1,53 @@ +From 642a2050dbb7e73521defb0208b68d70d9e1f100 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 May 2025 15:24:13 -0400 +Subject: cgroup/cpuset: Extend kthread_is_per_cpu() check to all + PF_NO_SETAFFINITY tasks + +From: Waiman Long + +[ Upstream commit 39b5ef791d109dd54c7c2e6e87933edfcc0ad1ac ] + +Commit ec5fbdfb99d1 ("cgroup/cpuset: Enable update_tasks_cpumask() +on top_cpuset") enabled us to pull CPUs dedicated to child partitions +from tasks in top_cpuset by ignoring per cpu kthreads. However, there +can be other kthreads that are not per cpu but have PF_NO_SETAFFINITY +flag set to indicate that we shouldn't mess with their CPU affinity. +For other kthreads, their affinity will be changed to skip CPUs dedicated +to child partitions whether it is an isolating or a scheduling one. + +As all the per cpu kthreads have PF_NO_SETAFFINITY set, the +PF_NO_SETAFFINITY tasks are essentially a superset of per cpu kthreads. +Fix this issue by dropping the kthread_is_per_cpu() check and checking +the PF_NO_SETAFFINITY flag instead. + +Fixes: ec5fbdfb99d1 ("cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset") +Signed-off-by: Waiman Long +Acked-by: Frederic Weisbecker +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cpuset.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index c709a05023cd9..d1fb4bfbbd4c3 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -1100,9 +1100,11 @@ void cpuset_update_tasks_cpumask(struct cpuset *cs, struct cpumask *new_cpus) + + if (top_cs) { + /* +- * Percpu kthreads in top_cpuset are ignored ++ * PF_NO_SETAFFINITY tasks are ignored. ++ * All per cpu kthreads should have PF_NO_SETAFFINITY ++ * flag set, see kthread_set_per_cpu(). + */ +- if (kthread_is_per_cpu(task)) ++ if (task->flags & PF_NO_SETAFFINITY) + continue; + cpumask_andnot(new_cpus, possible_mask, subpartitions_cpus); + } else { +-- +2.39.5 + diff --git a/queue-6.12/drivers-platform-x86-amd-pmf-check-for-invalid-sidel.patch b/queue-6.12/drivers-platform-x86-amd-pmf-check-for-invalid-sidel.patch new file mode 100644 index 0000000000..46a749be90 --- /dev/null +++ b/queue-6.12/drivers-platform-x86-amd-pmf-check-for-invalid-sidel.patch @@ -0,0 +1,50 @@ +From 6bced41d951e54ea3e0ac5ccac72a5485c9e41d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Apr 2025 08:18:44 -0500 +Subject: drivers/platform/x86/amd: pmf: Check for invalid sideloaded Smart PC + Policies +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mario Limonciello + +[ Upstream commit 690d722e02819ef978f90cd7553973eba1007e6c ] + +If a policy is passed into amd_pmf_get_pb_data() that causes the engine +to fail to start there is a memory leak. Free the memory in this failure +path. + +Fixes: 10817f28e5337 ("platform/x86/amd/pmf: Add capability to sideload of policy binary") +Signed-off-by: Mario Limonciello +Link: https://lore.kernel.org/r/20250423132002.3984997-2-superm1@kernel.org +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmf/tee-if.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/amd/pmf/tee-if.c b/drivers/platform/x86/amd/pmf/tee-if.c +index cb5abab2210a7..804c4085b82fb 100644 +--- a/drivers/platform/x86/amd/pmf/tee-if.c ++++ b/drivers/platform/x86/amd/pmf/tee-if.c +@@ -364,9 +364,14 @@ static ssize_t amd_pmf_get_pb_data(struct file *filp, const char __user *buf, + amd_pmf_hex_dump_pb(dev); + ret = amd_pmf_start_policy_engine(dev); + if (ret < 0) +- return ret; ++ goto cleanup; + + return length; ++ ++cleanup: ++ kfree(dev->policy_buf); ++ dev->policy_buf = NULL; ++ return ret; + } + + static const struct file_operations pb_fops = { +-- +2.39.5 + diff --git a/queue-6.12/drivers-platform-x86-amd-pmf-check-for-invalid-smart.patch b/queue-6.12/drivers-platform-x86-amd-pmf-check-for-invalid-smart.patch new file mode 100644 index 0000000000..49138bd654 --- /dev/null +++ b/queue-6.12/drivers-platform-x86-amd-pmf-check-for-invalid-smart.patch @@ -0,0 +1,78 @@ +From acdd9b63ab9001eabfb138fce3d1ae8c21ed9845 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Apr 2025 08:18:45 -0500 +Subject: drivers/platform/x86/amd: pmf: Check for invalid Smart PC Policies +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mario Limonciello + +[ Upstream commit 8e81b9cd6e95188d12c9cc25d40b61dd5ea05ace ] + +commit 376a8c2a14439 ("platform/x86/amd/pmf: Update PMF Driver for +Compatibility with new PMF-TA") added support for platforms that support +an updated TA, however it also exposed a number of platforms that although +they have support for the updated TA don't actually populate a policy +binary. + +Add an explicit check that the policy binary isn't empty before +initializing the TA. + +Reported-by: Christian Heusel +Closes: https://lore.kernel.org/platform-driver-x86/ae644428-5bf2-4b30-81ba-0b259ed3449b@heusel.eu/ +Fixes: 376a8c2a14439 ("platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA") +Signed-off-by: Mario Limonciello +Tested-by: Christian Heusel +Link: https://lore.kernel.org/r/20250423132002.3984997-3-superm1@kernel.org +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmf/tee-if.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmf/tee-if.c b/drivers/platform/x86/amd/pmf/tee-if.c +index 804c4085b82fb..b6bcc1d57f968 100644 +--- a/drivers/platform/x86/amd/pmf/tee-if.c ++++ b/drivers/platform/x86/amd/pmf/tee-if.c +@@ -334,6 +334,11 @@ static int amd_pmf_start_policy_engine(struct amd_pmf_dev *dev) + return 0; + } + ++static inline bool amd_pmf_pb_valid(struct amd_pmf_dev *dev) ++{ ++ return memchr_inv(dev->policy_buf, 0xff, dev->policy_sz); ++} ++ + #ifdef CONFIG_AMD_PMF_DEBUG + static void amd_pmf_hex_dump_pb(struct amd_pmf_dev *dev) + { +@@ -361,6 +366,11 @@ static ssize_t amd_pmf_get_pb_data(struct file *filp, const char __user *buf, + dev->policy_buf = new_policy_buf; + dev->policy_sz = length; + ++ if (!amd_pmf_pb_valid(dev)) { ++ ret = -EINVAL; ++ goto cleanup; ++ } ++ + amd_pmf_hex_dump_pb(dev); + ret = amd_pmf_start_policy_engine(dev); + if (ret < 0) +@@ -533,6 +543,12 @@ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev) + + memcpy_fromio(dev->policy_buf, dev->policy_base, dev->policy_sz); + ++ if (!amd_pmf_pb_valid(dev)) { ++ dev_info(dev->dev, "No Smart PC policy present\n"); ++ ret = -EINVAL; ++ goto err_free_policy; ++ } ++ + amd_pmf_hex_dump_pb(dev); + + dev->prev_data = kzalloc(sizeof(*dev->prev_data), GFP_KERNEL); +-- +2.39.5 + diff --git a/queue-6.12/drm-amd-add-suspend-hibernate-notification-callback-.patch b/queue-6.12/drm-amd-add-suspend-hibernate-notification-callback-.patch new file mode 100644 index 0000000000..66f4c254f9 --- /dev/null +++ b/queue-6.12/drm-amd-add-suspend-hibernate-notification-callback-.patch @@ -0,0 +1,149 @@ +From 1ed91bb2b778b83568076b49e5fbfda5e0a871ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Nov 2024 21:26:56 -0600 +Subject: drm/amd: Add Suspend/Hibernate notification callback support + +From: Mario Limonciello + +[ Upstream commit 2965e6355dcdf157b5fafa25a2715f00064da8bf ] + +As part of the suspend sequence VRAM needs to be evicted on dGPUs. +In order to make suspend/resume more reliable we moved this into +the pmops prepare() callback so that the suspend sequence would fail +but the system could remain operational under high memory usage suspend. + +Another class of issues exist though where due to memory fragementation +there isn't a large enough contiguous space and swap isn't accessible. + +Add support for a suspend/hibernate notification callback that could +evict VRAM before tasks are frozen. This should allow paging out to swap +if necessary. + +Link: https://github.com/ROCm/ROCK-Kernel-Driver/issues/174 +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/3476 +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2362 +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3781 +Reviewed-by: Lijo Lazar +Link: https://lore.kernel.org/r/20241128032656.2090059-2-superm1@kernel.org +Signed-off-by: Mario Limonciello +Signed-off-by: Alex Deucher +Stable-dep-of: d0ce1aaa8531 ("Revert "drm/amd: Stop evicting resources on APUs in suspend"") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 46 +++++++++++++++++++++- + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 - + 3 files changed, 46 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +index b7aad43d9ad07..8050e0960f5e2 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +@@ -853,6 +853,7 @@ struct amdgpu_device { + bool need_swiotlb; + bool accel_working; + struct notifier_block acpi_nb; ++ struct notifier_block pm_nb; + struct amdgpu_i2c_chan *i2c_bus[AMDGPU_MAX_I2C_BUS]; + struct debugfs_blob_wrapper debugfs_vbios_blob; + struct debugfs_blob_wrapper debugfs_discovery_blob; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index 24d007715a14a..e6c8426fa06ec 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -145,6 +145,8 @@ const char *amdgpu_asic_name[] = { + }; + + static inline void amdgpu_device_stop_pending_resets(struct amdgpu_device *adev); ++static int amdgpu_device_pm_notifier(struct notifier_block *nb, unsigned long mode, ++ void *data); + + /** + * DOC: pcie_replay_count +@@ -4519,6 +4521,11 @@ int amdgpu_device_init(struct amdgpu_device *adev, + + amdgpu_device_check_iommu_direct_map(adev); + ++ adev->pm_nb.notifier_call = amdgpu_device_pm_notifier; ++ r = register_pm_notifier(&adev->pm_nb); ++ if (r) ++ goto failed; ++ + return 0; + + release_ras_con: +@@ -4583,6 +4590,8 @@ void amdgpu_device_fini_hw(struct amdgpu_device *adev) + drain_workqueue(adev->mman.bdev.wq); + adev->shutdown = true; + ++ unregister_pm_notifier(&adev->pm_nb); ++ + /* make sure IB test finished before entering exclusive mode + * to avoid preemption on IB test + */ +@@ -4712,6 +4721,41 @@ static int amdgpu_device_evict_resources(struct amdgpu_device *adev) + /* + * Suspend & resume. + */ ++/** ++ * amdgpu_device_pm_notifier - Notification block for Suspend/Hibernate events ++ * @nb: notifier block ++ * @mode: suspend mode ++ * @data: data ++ * ++ * This function is called when the system is about to suspend or hibernate. ++ * It is used to evict resources from the device before the system goes to ++ * sleep while there is still access to swap. ++ */ ++static int amdgpu_device_pm_notifier(struct notifier_block *nb, unsigned long mode, ++ void *data) ++{ ++ struct amdgpu_device *adev = container_of(nb, struct amdgpu_device, pm_nb); ++ int r; ++ ++ switch (mode) { ++ case PM_HIBERNATION_PREPARE: ++ adev->in_s4 = true; ++ fallthrough; ++ case PM_SUSPEND_PREPARE: ++ r = amdgpu_device_evict_resources(adev); ++ /* ++ * This is considered non-fatal at this time because ++ * amdgpu_device_prepare() will also fatally evict resources. ++ * See https://gitlab.freedesktop.org/drm/amd/-/issues/3781 ++ */ ++ if (r) ++ drm_warn(adev_to_drm(adev), "Failed to evict resources, freeze active processes if problems occur: %d\n", r); ++ break; ++ } ++ ++ return NOTIFY_DONE; ++} ++ + /** + * amdgpu_device_prepare - prepare for device suspend + * +@@ -4751,7 +4795,7 @@ int amdgpu_device_prepare(struct drm_device *dev) + return 0; + + unprepare: +- adev->in_s0ix = adev->in_s3 = false; ++ adev->in_s0ix = adev->in_s3 = adev->in_s4 = false; + + return r; + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +index a9eb0927a7664..700be1ac3c64c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -2635,7 +2635,6 @@ static int amdgpu_pmops_freeze(struct device *dev) + struct amdgpu_device *adev = drm_to_adev(drm_dev); + int r; + +- adev->in_s4 = true; + r = amdgpu_device_suspend(drm_dev, true); + if (r) + return r; +-- +2.39.5 + diff --git a/queue-6.12/drm-xe-save-ctx_timestamp-mmio-value-instead-of-lrc-.patch b/queue-6.12/drm-xe-save-ctx_timestamp-mmio-value-instead-of-lrc-.patch new file mode 100644 index 0000000000..61d0014586 --- /dev/null +++ b/queue-6.12/drm-xe-save-ctx_timestamp-mmio-value-instead-of-lrc-.patch @@ -0,0 +1,81 @@ +From 09353ec17a2039378fc31db6f2ddbc0adc772d0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 May 2025 09:12:01 -0700 +Subject: drm/xe: Save CTX_TIMESTAMP mmio value instead of LRC value + +From: Umesh Nerlige Ramappa + +[ Upstream commit 66c8f7b435bddb7d8577ac8a57e175a6cb147227 ] + +For determining actual job execution time, save the current value of the +CTX_TIMESTAMP register rather than the value saved in LRC since the +current register value is the closest to the start time of the job. + +v2: Define MI_STORE_REGISTER_MEM to fix compile error +v3: Place MI_STORE_REGISTER_MEM sorted by MI_INSTR (Lucas) + +Fixes: 65921374c48f ("drm/xe: Emit ctx timestamp copy in ring ops") +Signed-off-by: Umesh Nerlige Ramappa +Reviewed-by: Matthew Brost +Reviewed-by: Lucas De Marchi +Link: https://lore.kernel.org/r/20250509161159.2173069-6-umesh.nerlige.ramappa@intel.com +(cherry picked from commit 38b14233e5deff51db8faec287b4acd227152246) +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/instructions/xe_mi_commands.h | 4 ++++ + drivers/gpu/drm/xe/xe_lrc.c | 2 +- + drivers/gpu/drm/xe/xe_ring_ops.c | 7 ++----- + 3 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/xe/instructions/xe_mi_commands.h b/drivers/gpu/drm/xe/instructions/xe_mi_commands.h +index 10ec2920d31b3..d4033278be9fc 100644 +--- a/drivers/gpu/drm/xe/instructions/xe_mi_commands.h ++++ b/drivers/gpu/drm/xe/instructions/xe_mi_commands.h +@@ -47,6 +47,10 @@ + #define MI_LRI_FORCE_POSTED REG_BIT(12) + #define MI_LRI_LEN(x) (((x) & 0xff) + 1) + ++#define MI_STORE_REGISTER_MEM (__MI_INSTR(0x24) | XE_INSTR_NUM_DW(4)) ++#define MI_SRM_USE_GGTT REG_BIT(22) ++#define MI_SRM_ADD_CS_OFFSET REG_BIT(19) ++ + #define MI_FLUSH_DW __MI_INSTR(0x26) + #define MI_FLUSH_DW_STORE_INDEX REG_BIT(21) + #define MI_INVALIDATE_TLB REG_BIT(18) +diff --git a/drivers/gpu/drm/xe/xe_lrc.c b/drivers/gpu/drm/xe/xe_lrc.c +index aec7db39c061e..2d4e38b3bab19 100644 +--- a/drivers/gpu/drm/xe/xe_lrc.c ++++ b/drivers/gpu/drm/xe/xe_lrc.c +@@ -694,7 +694,7 @@ static inline u32 __xe_lrc_start_seqno_offset(struct xe_lrc *lrc) + + static u32 __xe_lrc_ctx_job_timestamp_offset(struct xe_lrc *lrc) + { +- /* The start seqno is stored in the driver-defined portion of PPHWSP */ ++ /* This is stored in the driver-defined portion of PPHWSP */ + return xe_lrc_pphwsp_offset(lrc) + LRC_CTX_JOB_TIMESTAMP_OFFSET; + } + +diff --git a/drivers/gpu/drm/xe/xe_ring_ops.c b/drivers/gpu/drm/xe/xe_ring_ops.c +index 9f327f27c0726..fb31e09acb519 100644 +--- a/drivers/gpu/drm/xe/xe_ring_ops.c ++++ b/drivers/gpu/drm/xe/xe_ring_ops.c +@@ -229,13 +229,10 @@ static u32 get_ppgtt_flag(struct xe_sched_job *job) + + static int emit_copy_timestamp(struct xe_lrc *lrc, u32 *dw, int i) + { +- dw[i++] = MI_COPY_MEM_MEM | MI_COPY_MEM_MEM_SRC_GGTT | +- MI_COPY_MEM_MEM_DST_GGTT; ++ dw[i++] = MI_STORE_REGISTER_MEM | MI_SRM_USE_GGTT | MI_SRM_ADD_CS_OFFSET; ++ dw[i++] = RING_CTX_TIMESTAMP(0).addr; + dw[i++] = xe_lrc_ctx_job_timestamp_ggtt_addr(lrc); + dw[i++] = 0; +- dw[i++] = xe_lrc_ctx_timestamp_ggtt_addr(lrc); +- dw[i++] = 0; +- dw[i++] = MI_NOOP; + + return i; + } +-- +2.39.5 + diff --git a/queue-6.12/fs-xattr.c-fix-simple_xattr_list-to-always-include-s.patch b/queue-6.12/fs-xattr.c-fix-simple_xattr_list-to-always-include-s.patch new file mode 100644 index 0000000000..392fd6a6af --- /dev/null +++ b/queue-6.12/fs-xattr.c-fix-simple_xattr_list-to-always-include-s.patch @@ -0,0 +1,102 @@ +From cd8c4ce4a3cf5bf77e1e60a5851842dc06047282 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Apr 2025 11:28:20 -0400 +Subject: fs/xattr.c: fix simple_xattr_list to always include security.* xattrs + +From: Stephen Smalley + +[ Upstream commit 8b0ba61df5a1c44e2b3cf683831a4fc5e24ea99d ] + +The vfs has long had a fallback to obtain the security.* xattrs from the +LSM when the filesystem does not implement its own listxattr, but +shmem/tmpfs and kernfs later gained their own xattr handlers to support +other xattrs. Unfortunately, as a side effect, tmpfs and kernfs-based +filesystems like sysfs no longer return the synthetic security.* xattr +names via listxattr unless they are explicitly set by userspace or +initially set upon inode creation after policy load. coreutils has +recently switched from unconditionally invoking getxattr for security.* +for ls -Z via libselinux to only doing so if listxattr returns the xattr +name, breaking ls -Z of such inodes. + +Before: +$ getfattr -m.* /run/initramfs + +$ getfattr -m.* /sys/kernel/fscaps + +$ setfattr -n user.foo /run/initramfs +$ getfattr -m.* /run/initramfs +user.foo + +After: +$ getfattr -m.* /run/initramfs +security.selinux +$ getfattr -m.* /sys/kernel/fscaps +security.selinux +$ setfattr -n user.foo /run/initramfs +$ getfattr -m.* /run/initramfs +security.selinux +user.foo + +Link: https://lore.kernel.org/selinux/CAFqZXNtF8wDyQajPCdGn=iOawX4y77ph0EcfcqcUUj+T87FKyA@mail.gmail.com/ +Link: https://lore.kernel.org/selinux/20250423175728.3185-2-stephen.smalley.work@gmail.com/ +Signed-off-by: Stephen Smalley +Link: https://lore.kernel.org/20250424152822.2719-1-stephen.smalley.work@gmail.com +Fixes: b09e0fa4b4ea66266058ee ("tmpfs: implement generic xattr support") +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/xattr.c | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +diff --git a/fs/xattr.c b/fs/xattr.c +index 05ec7e7d9e87e..4f5a45338a83a 100644 +--- a/fs/xattr.c ++++ b/fs/xattr.c +@@ -1290,6 +1290,15 @@ static bool xattr_is_trusted(const char *name) + return !strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN); + } + ++static bool xattr_is_maclabel(const char *name) ++{ ++ const char *suffix = name + XATTR_SECURITY_PREFIX_LEN; ++ ++ return !strncmp(name, XATTR_SECURITY_PREFIX, ++ XATTR_SECURITY_PREFIX_LEN) && ++ security_ismaclabel(suffix); ++} ++ + /** + * simple_xattr_list - list all xattr objects + * @inode: inode from which to get the xattrs +@@ -1322,6 +1331,17 @@ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs, + if (err) + return err; + ++ err = security_inode_listsecurity(inode, buffer, remaining_size); ++ if (err < 0) ++ return err; ++ ++ if (buffer) { ++ if (remaining_size < err) ++ return -ERANGE; ++ buffer += err; ++ } ++ remaining_size -= err; ++ + read_lock(&xattrs->lock); + for (rbp = rb_first(&xattrs->rb_root); rbp; rbp = rb_next(rbp)) { + xattr = rb_entry(rbp, struct simple_xattr, rb_node); +@@ -1330,6 +1350,10 @@ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs, + if (!trusted && xattr_is_trusted(xattr->name)) + continue; + ++ /* skip MAC labels; these are provided by LSM above */ ++ if (xattr_is_maclabel(xattr->name)) ++ continue; ++ + err = xattr_list_one(&buffer, &remaining_size, xattr->name); + if (err) + break; +-- +2.39.5 + diff --git a/queue-6.12/hid-thrustmaster-fix-memory-leak-in-thrustmaster_int.patch b/queue-6.12/hid-thrustmaster-fix-memory-leak-in-thrustmaster_int.patch new file mode 100644 index 0000000000..796f46498d --- /dev/null +++ b/queue-6.12/hid-thrustmaster-fix-memory-leak-in-thrustmaster_int.patch @@ -0,0 +1,39 @@ +From 9152f055a0b8791ae2646ceda328023ddb47277e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Mar 2025 23:11:46 +0000 +Subject: HID: thrustmaster: fix memory leak in thrustmaster_interrupts() + +From: Qasim Ijaz + +[ Upstream commit 09d546303b370113323bfff456c4e8cff8756005 ] + +In thrustmaster_interrupts(), the allocated send_buf is not +freed if the usb_check_int_endpoints() check fails, leading +to a memory leak. + +Fix this by ensuring send_buf is freed before returning in +the error path. + +Fixes: 50420d7c79c3 ("HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check") +Signed-off-by: Qasim Ijaz +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-thrustmaster.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hid/hid-thrustmaster.c b/drivers/hid/hid-thrustmaster.c +index 3b81468a1df29..0bf70664c35ee 100644 +--- a/drivers/hid/hid-thrustmaster.c ++++ b/drivers/hid/hid-thrustmaster.c +@@ -174,6 +174,7 @@ static void thrustmaster_interrupts(struct hid_device *hdev) + u8 ep_addr[2] = {b_ep, 0}; + + if (!usb_check_int_endpoints(usbif, ep_addr)) { ++ kfree(send_buf); + hid_err(hdev, "Unexpected non-int endpoint\n"); + return; + } +-- +2.39.5 + diff --git a/queue-6.12/hid-uclogic-add-null-check-in-uclogic_input_configur.patch b/queue-6.12/hid-uclogic-add-null-check-in-uclogic_input_configur.patch new file mode 100644 index 0000000000..6169290111 --- /dev/null +++ b/queue-6.12/hid-uclogic-add-null-check-in-uclogic_input_configur.patch @@ -0,0 +1,46 @@ +From 28da7c9532cad5fe9db97715d75a641dadab41e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Apr 2025 17:48:53 +0800 +Subject: HID: uclogic: Add NULL check in uclogic_input_configured() + +From: Henry Martin + +[ Upstream commit bd07f751208ba190f9b0db5e5b7f35d5bb4a8a1e ] + +devm_kasprintf() returns NULL when memory allocation fails. Currently, +uclogic_input_configured() does not check for this case, which results +in a NULL pointer dereference. + +Add NULL check after devm_kasprintf() to prevent this issue. + +Fixes: dd613a4e45f8 ("HID: uclogic: Correct devm device reference for hidinput input_dev name") +Signed-off-by: Henry Martin +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-uclogic-core.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c +index d8008933c052f..321c43fb06ae0 100644 +--- a/drivers/hid/hid-uclogic-core.c ++++ b/drivers/hid/hid-uclogic-core.c +@@ -142,11 +142,12 @@ static int uclogic_input_configured(struct hid_device *hdev, + suffix = "System Control"; + break; + } +- } +- +- if (suffix) ++ } else { + hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL, + "%s %s", hdev->name, suffix); ++ if (!hi->input->name) ++ return -ENOMEM; ++ } + + return 0; + } +-- +2.39.5 + diff --git a/queue-6.12/iio-adc-ad7266-fix-potential-timestamp-alignment-iss.patch b/queue-6.12/iio-adc-ad7266-fix-potential-timestamp-alignment-iss.patch new file mode 100644 index 0000000000..a25bf013a4 --- /dev/null +++ b/queue-6.12/iio-adc-ad7266-fix-potential-timestamp-alignment-iss.patch @@ -0,0 +1,45 @@ +From c46219ecbbeeb61c48152fb3a853d2ee18edbe22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Apr 2025 11:34:24 +0100 +Subject: iio: adc: ad7266: Fix potential timestamp alignment issue. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonathan Cameron + +[ Upstream commit 52d349884738c346961e153f195f4c7fe186fcf4 ] + +On architectures where an s64 is only 32-bit aligned insufficient padding +would be left between the earlier elements and the timestamp. Use +aligned_s64 to enforce the correct placement and ensure the storage is +large enough. + +Fixes: 54e018da3141 ("iio:ad7266: Mark transfer buffer as __be16") # aligned_s64 is much newer. +Reported-by: David Lechner +Reviewed-by: Nuno Sá +Reviewed-by: David Lechner +Link: https://patch.msgid.link/20250413103443.2420727-2-jic23@kernel.org +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/ad7266.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/adc/ad7266.c b/drivers/iio/adc/ad7266.c +index 7949b076fb87e..d4c9b85135f58 100644 +--- a/drivers/iio/adc/ad7266.c ++++ b/drivers/iio/adc/ad7266.c +@@ -45,7 +45,7 @@ struct ad7266_state { + */ + struct { + __be16 sample[2]; +- s64 timestamp; ++ aligned_s64 timestamp; + } data __aligned(IIO_DMA_MINALIGN); + }; + +-- +2.39.5 + diff --git a/queue-6.12/iio-adc-ad7768-1-fix-insufficient-alignment-of-times.patch b/queue-6.12/iio-adc-ad7768-1-fix-insufficient-alignment-of-times.patch new file mode 100644 index 0000000000..f1f0740abf --- /dev/null +++ b/queue-6.12/iio-adc-ad7768-1-fix-insufficient-alignment-of-times.patch @@ -0,0 +1,44 @@ +From 46c048a777d4ef91fc6c95023c6f935a0f30bd62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Apr 2025 11:34:25 +0100 +Subject: iio: adc: ad7768-1: Fix insufficient alignment of timestamp. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonathan Cameron + +[ Upstream commit ffbc26bc91c1f1eb3dcf5d8776e74cbae21ee13a ] + +On architectures where an s64 is not 64-bit aligned, this may result +insufficient alignment of the timestamp and the structure being too small. +Use aligned_s64 to force the alignment. + +Fixes: a1caeebab07e ("iio: adc: ad7768-1: Fix too small buffer passed to iio_push_to_buffers_with_timestamp()") # aligned_s64 newer +Reported-by: David Lechner +Reviewed-by: Nuno Sá +Reviewed-by: David Lechner +Link: https://patch.msgid.link/20250413103443.2420727-3-jic23@kernel.org +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/ad7768-1.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/adc/ad7768-1.c b/drivers/iio/adc/ad7768-1.c +index 157a0df97f971..a9248a85466ea 100644 +--- a/drivers/iio/adc/ad7768-1.c ++++ b/drivers/iio/adc/ad7768-1.c +@@ -169,7 +169,7 @@ struct ad7768_state { + union { + struct { + __be32 chan; +- s64 timestamp; ++ aligned_s64 timestamp; + } scan; + __be32 d32; + u8 d8[2]; +-- +2.39.5 + diff --git a/queue-6.12/iio-chemical-pms7003-use-aligned_s64-for-timestamp.patch b/queue-6.12/iio-chemical-pms7003-use-aligned_s64-for-timestamp.patch new file mode 100644 index 0000000000..5f0d3bd629 --- /dev/null +++ b/queue-6.12/iio-chemical-pms7003-use-aligned_s64-for-timestamp.patch @@ -0,0 +1,63 @@ +From 616d4e8cccd5f19f08b979fea920e4be0382e534 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Apr 2025 11:52:36 -0500 +Subject: iio: chemical: pms7003: use aligned_s64 for timestamp +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David Lechner + +[ Upstream commit 6ffa698674053e82e811520642db2650d00d2c01 ] + +Follow the pattern of other drivers and use aligned_s64 for the +timestamp. This will ensure that the timestamp is correctly aligned on +all architectures. + +Also move the unaligned.h header while touching this since it was the +only one not in alphabetical order. + +Fixes: 13e945631c2f ("iio:chemical:pms7003: Fix timestamp alignment and prevent data leak.") +Signed-off-by: David Lechner +Reviewed-by: Nuno Sá +Link: https://patch.msgid.link/20250417-iio-more-timestamp-alignment-v1-4-eafac1e22318@baylibre.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/chemical/pms7003.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/iio/chemical/pms7003.c b/drivers/iio/chemical/pms7003.c +index d0bd94912e0a3..e05ce1f12065c 100644 +--- a/drivers/iio/chemical/pms7003.c ++++ b/drivers/iio/chemical/pms7003.c +@@ -5,7 +5,6 @@ + * Copyright (c) Tomasz Duszynski + */ + +-#include + #include + #include + #include +@@ -19,6 +18,8 @@ + #include + #include + #include ++#include ++#include + + #define PMS7003_DRIVER_NAME "pms7003" + +@@ -76,7 +77,7 @@ struct pms7003_state { + /* Used to construct scan to push to the IIO buffer */ + struct { + u16 data[3]; /* PM1, PM2P5, PM10 */ +- s64 ts; ++ aligned_s64 ts; + } scan; + }; + +-- +2.39.5 + diff --git a/queue-6.12/iio-chemical-sps30-use-aligned_s64-for-timestamp.patch b/queue-6.12/iio-chemical-sps30-use-aligned_s64-for-timestamp.patch new file mode 100644 index 0000000000..54cb131d8b --- /dev/null +++ b/queue-6.12/iio-chemical-sps30-use-aligned_s64-for-timestamp.patch @@ -0,0 +1,43 @@ +From cdf1f358486f4f9093276f7690fc0bae7d0b61ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Apr 2025 11:52:37 -0500 +Subject: iio: chemical: sps30: use aligned_s64 for timestamp +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David Lechner + +[ Upstream commit bb49d940344bcb8e2b19e69d7ac86f567887ea9a ] + +Follow the pattern of other drivers and use aligned_s64 for the +timestamp. This will ensure that the timestamp is correctly aligned on +all architectures. + +Fixes: a5bf6fdd19c3 ("iio:chemical:sps30: Fix timestamp alignment") +Signed-off-by: David Lechner +Reviewed-by: Nuno Sá +Link: https://patch.msgid.link/20250417-iio-more-timestamp-alignment-v1-5-eafac1e22318@baylibre.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/chemical/sps30.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/chemical/sps30.c b/drivers/iio/chemical/sps30.c +index 814ce0aad1ccc..4085a36cd1db7 100644 +--- a/drivers/iio/chemical/sps30.c ++++ b/drivers/iio/chemical/sps30.c +@@ -108,7 +108,7 @@ static irqreturn_t sps30_trigger_handler(int irq, void *p) + int ret; + struct { + s32 data[4]; /* PM1, PM2P5, PM4, PM10 */ +- s64 ts; ++ aligned_s64 ts; + } scan; + + mutex_lock(&state->lock); +-- +2.39.5 + diff --git a/queue-6.12/iio-pressure-mprls0025pa-use-aligned_s64-for-timesta.patch b/queue-6.12/iio-pressure-mprls0025pa-use-aligned_s64-for-timesta.patch new file mode 100644 index 0000000000..ab45e7c3ac --- /dev/null +++ b/queue-6.12/iio-pressure-mprls0025pa-use-aligned_s64-for-timesta.patch @@ -0,0 +1,70 @@ +From 2d40f89fbeab2a2176387b35e9b8555429351455 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Apr 2025 11:17:14 -0500 +Subject: iio: pressure: mprls0025pa: use aligned_s64 for timestamp + +From: David Lechner + +[ Upstream commit ffcd19e9f4cca0c8f9e23e88f968711acefbb37b ] + +Follow the pattern of other drivers and use aligned_s64 for the +timestamp. This will ensure the struct itself it also 8-byte aligned. + +While touching this, convert struct mpr_chan to an anonymous struct +to consolidate the code a bit to make it easier for future readers. + +Fixes: 713337d9143e ("iio: pressure: Honeywell mprls0025pa pressure sensor") +Signed-off-by: David Lechner +Link: https://patch.msgid.link/20250418-iio-more-timestamp-alignment-v2-2-d6a5d2b1c9fe@baylibre.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/pressure/mprls0025pa.h | 17 ++++++----------- + 1 file changed, 6 insertions(+), 11 deletions(-) + +diff --git a/drivers/iio/pressure/mprls0025pa.h b/drivers/iio/pressure/mprls0025pa.h +index 9d5c30afa9d69..d62a018eaff32 100644 +--- a/drivers/iio/pressure/mprls0025pa.h ++++ b/drivers/iio/pressure/mprls0025pa.h +@@ -34,16 +34,6 @@ struct iio_dev; + struct mpr_data; + struct mpr_ops; + +-/** +- * struct mpr_chan +- * @pres: pressure value +- * @ts: timestamp +- */ +-struct mpr_chan { +- s32 pres; +- s64 ts; +-}; +- + enum mpr_func_id { + MPR_FUNCTION_A, + MPR_FUNCTION_B, +@@ -69,6 +59,8 @@ enum mpr_func_id { + * reading in a loop until data is ready + * @completion: handshake from irq to read + * @chan: channel values for buffered mode ++ * @chan.pres: pressure value ++ * @chan.ts: timestamp + * @buffer: raw conversion data + */ + struct mpr_data { +@@ -87,7 +79,10 @@ struct mpr_data { + struct gpio_desc *gpiod_reset; + int irq; + struct completion completion; +- struct mpr_chan chan; ++ struct { ++ s32 pres; ++ aligned_s64 ts; ++ } chan; + u8 buffer[MPR_MEASUREMENT_RD_SIZE] __aligned(IIO_DMA_MINALIGN); + }; + +-- +2.39.5 + diff --git a/queue-6.12/kvm-add-member-to-struct-kvm_gfn_range-to-indicate-p.patch b/queue-6.12/kvm-add-member-to-struct-kvm_gfn_range-to-indicate-p.patch new file mode 100644 index 0000000000..4e2394ba21 --- /dev/null +++ b/queue-6.12/kvm-add-member-to-struct-kvm_gfn_range-to-indicate-p.patch @@ -0,0 +1,153 @@ +From ce729338122a8d97bc11de68eaa132dd76ef130d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jul 2024 14:12:14 -0700 +Subject: KVM: Add member to struct kvm_gfn_range to indicate private/shared + +From: Isaku Yamahata + +[ Upstream commit dca6c88532322830d5d92486467fcc91b67a9ad8 ] + +Add new members to strut kvm_gfn_range to indicate which mapping +(private-vs-shared) to operate on: enum kvm_gfn_range_filter +attr_filter. Update the core zapping operations to set them appropriately. + +TDX utilizes two GPA aliases for the same memslots, one for memory that is +for private memory and one that is for shared. For private memory, KVM +cannot always perform the same operations it does on memory for default +VMs, such as zapping pages and having them be faulted back in, as this +requires guest coordination. However, some operations such as guest driven +conversion of memory between private and shared should zap private memory. + +Internally to the MMU, private and shared mappings are tracked on separate +roots. Mapping and zapping operations will operate on the respective GFN +alias for each root (private or shared). So zapping operations will by +default zap both aliases. Add fields in struct kvm_gfn_range to allow +callers to specify which aliases so they can only target the aliases +appropriate for their specific operation. + +There was feedback that target aliases should be specified such that the +default value (0) is to operate on both aliases. Several options were +considered. Several variations of having separate bools defined such +that the default behavior was to process both aliases. They either allowed +nonsensical configurations, or were confusing for the caller. A simple +enum was also explored and was close, but was hard to process in the +caller. Instead, use an enum with the default value (0) reserved as a +disallowed value. Catch ranges that didn't have the target aliases +specified by looking for that specific value. + +Set target alias with enum appropriately for these MMU operations: + - For KVM's mmu notifier callbacks, zap shared pages only because private + pages won't have a userspace mapping + - For setting memory attributes, kvm_arch_pre_set_memory_attributes() + chooses the aliases based on the attribute. + - For guest_memfd invalidations, zap private only. + +Link: https://lore.kernel.org/kvm/ZivIF9vjKcuGie3s@google.com/ +Signed-off-by: Isaku Yamahata +Co-developed-by: Rick Edgecombe +Signed-off-by: Rick Edgecombe +Message-ID: <20240718211230.1492011-3-rick.p.edgecombe@intel.com> +Signed-off-by: Paolo Bonzini +Stable-dep-of: 9129633d568e ("KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing") +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/mmu/mmu.c | 6 ++++++ + include/linux/kvm_host.h | 6 ++++++ + virt/kvm/guest_memfd.c | 2 ++ + virt/kvm/kvm_main.c | 14 ++++++++++++++ + 4 files changed, 28 insertions(+) + +diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c +index 9242c0649adf1..4943732e07cd7 100644 +--- a/arch/x86/kvm/mmu/mmu.c ++++ b/arch/x86/kvm/mmu/mmu.c +@@ -7633,6 +7633,12 @@ bool kvm_arch_pre_set_memory_attributes(struct kvm *kvm, + if (WARN_ON_ONCE(!kvm_arch_has_private_mem(kvm))) + return false; + ++ /* Unmap the old attribute page. */ ++ if (range->arg.attributes & KVM_MEMORY_ATTRIBUTE_PRIVATE) ++ range->attr_filter = KVM_FILTER_SHARED; ++ else ++ range->attr_filter = KVM_FILTER_PRIVATE; ++ + return kvm_unmap_gfn_range(kvm, range); + } + +diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h +index 15206450929d5..2e836d44f7386 100644 +--- a/include/linux/kvm_host.h ++++ b/include/linux/kvm_host.h +@@ -260,11 +260,17 @@ union kvm_mmu_notifier_arg { + unsigned long attributes; + }; + ++enum kvm_gfn_range_filter { ++ KVM_FILTER_SHARED = BIT(0), ++ KVM_FILTER_PRIVATE = BIT(1), ++}; ++ + struct kvm_gfn_range { + struct kvm_memory_slot *slot; + gfn_t start; + gfn_t end; + union kvm_mmu_notifier_arg arg; ++ enum kvm_gfn_range_filter attr_filter; + bool may_block; + }; + bool kvm_unmap_gfn_range(struct kvm *kvm, struct kvm_gfn_range *range); +diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c +index 8f079a61a56db..bb062d3d24572 100644 +--- a/virt/kvm/guest_memfd.c ++++ b/virt/kvm/guest_memfd.c +@@ -118,6 +118,8 @@ static void kvm_gmem_invalidate_begin(struct kvm_gmem *gmem, pgoff_t start, + .end = slot->base_gfn + min(pgoff + slot->npages, end) - pgoff, + .slot = slot, + .may_block = true, ++ /* guest memfd is relevant to only private mappings. */ ++ .attr_filter = KVM_FILTER_PRIVATE, + }; + + if (!found_memslot) { +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index 279e03029ce14..b99de3b5ffbc0 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -632,6 +632,11 @@ static __always_inline kvm_mn_ret_t __kvm_handle_hva_range(struct kvm *kvm, + */ + gfn_range.arg = range->arg; + gfn_range.may_block = range->may_block; ++ /* ++ * HVA-based notifications aren't relevant to private ++ * mappings as they don't have a userspace mapping. ++ */ ++ gfn_range.attr_filter = KVM_FILTER_SHARED; + + /* + * {gfn(page) | page intersects with [hva_start, hva_end)} = +@@ -2454,6 +2459,14 @@ static __always_inline void kvm_handle_gfn_range(struct kvm *kvm, + gfn_range.arg = range->arg; + gfn_range.may_block = range->may_block; + ++ /* ++ * If/when KVM supports more attributes beyond private .vs shared, this ++ * _could_ set KVM_FILTER_{SHARED,PRIVATE} appropriately if the entire target ++ * range already has the desired private vs. shared state (it's unclear ++ * if that is a net win). For now, KVM reaches this point if and only ++ * if the private flag is being toggled, i.e. all mappings are in play. ++ */ ++ + for (i = 0; i < kvm_arch_nr_memslot_as_ids(kvm); i++) { + slots = __kvm_memslots(kvm, i); + +@@ -2510,6 +2523,7 @@ static int kvm_vm_set_mem_attributes(struct kvm *kvm, gfn_t start, gfn_t end, + struct kvm_mmu_notifier_range pre_set_range = { + .start = start, + .end = end, ++ .arg.attributes = attributes, + .handler = kvm_pre_set_memory_attributes, + .on_lock = kvm_mmu_invalidate_begin, + .flush_on_ret = true, +-- +2.39.5 + diff --git a/queue-6.12/kvm-x86-mmu-prevent-installing-hugepages-when-mem-at.patch b/queue-6.12/kvm-x86-mmu-prevent-installing-hugepages-when-mem-at.patch new file mode 100644 index 0000000000..2a74c8c46a --- /dev/null +++ b/queue-6.12/kvm-x86-mmu-prevent-installing-hugepages-when-mem-at.patch @@ -0,0 +1,134 @@ +From 8b25c6c43bb6f0f345c5da479af1212224f8c24f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Apr 2025 15:09:54 -0700 +Subject: KVM: x86/mmu: Prevent installing hugepages when mem attributes are + changing + +From: Sean Christopherson + +[ Upstream commit 9129633d568edd36aa22bf703b12835153cec985 ] + +When changing memory attributes on a subset of a potential hugepage, add +the hugepage to the invalidation range tracking to prevent installing a +hugepage until the attributes are fully updated. Like the actual hugepage +tracking updates in kvm_arch_post_set_memory_attributes(), process only +the head and tail pages, as any potential hugepages that are entirely +covered by the range will already be tracked. + +Note, only hugepage chunks whose current attributes are NOT mixed need to +be added to the invalidation set, as mixed attributes already prevent +installing a hugepage, and it's perfectly safe to install a smaller +mapping for a gfn whose attributes aren't changing. + +Fixes: 8dd2eee9d526 ("KVM: x86/mmu: Handle page fault for private memory") +Cc: stable@vger.kernel.org +Reported-by: Michael Roth +Tested-by: Michael Roth +Link: https://lore.kernel.org/r/20250430220954.522672-1-seanjc@google.com +Signed-off-by: Sean Christopherson +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/mmu/mmu.c | 69 ++++++++++++++++++++++++++++++++---------- + 1 file changed, 53 insertions(+), 16 deletions(-) + +diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c +index 4943732e07cd7..4607610ef0628 100644 +--- a/arch/x86/kvm/mmu/mmu.c ++++ b/arch/x86/kvm/mmu/mmu.c +@@ -7616,9 +7616,30 @@ void kvm_mmu_pre_destroy_vm(struct kvm *kvm) + } + + #ifdef CONFIG_KVM_GENERIC_MEMORY_ATTRIBUTES ++static bool hugepage_test_mixed(struct kvm_memory_slot *slot, gfn_t gfn, ++ int level) ++{ ++ return lpage_info_slot(gfn, slot, level)->disallow_lpage & KVM_LPAGE_MIXED_FLAG; ++} ++ ++static void hugepage_clear_mixed(struct kvm_memory_slot *slot, gfn_t gfn, ++ int level) ++{ ++ lpage_info_slot(gfn, slot, level)->disallow_lpage &= ~KVM_LPAGE_MIXED_FLAG; ++} ++ ++static void hugepage_set_mixed(struct kvm_memory_slot *slot, gfn_t gfn, ++ int level) ++{ ++ lpage_info_slot(gfn, slot, level)->disallow_lpage |= KVM_LPAGE_MIXED_FLAG; ++} ++ + bool kvm_arch_pre_set_memory_attributes(struct kvm *kvm, + struct kvm_gfn_range *range) + { ++ struct kvm_memory_slot *slot = range->slot; ++ int level; ++ + /* + * Zap SPTEs even if the slot can't be mapped PRIVATE. KVM x86 only + * supports KVM_MEMORY_ATTRIBUTE_PRIVATE, and so it *seems* like KVM +@@ -7633,6 +7654,38 @@ bool kvm_arch_pre_set_memory_attributes(struct kvm *kvm, + if (WARN_ON_ONCE(!kvm_arch_has_private_mem(kvm))) + return false; + ++ if (WARN_ON_ONCE(range->end <= range->start)) ++ return false; ++ ++ /* ++ * If the head and tail pages of the range currently allow a hugepage, ++ * i.e. reside fully in the slot and don't have mixed attributes, then ++ * add each corresponding hugepage range to the ongoing invalidation, ++ * e.g. to prevent KVM from creating a hugepage in response to a fault ++ * for a gfn whose attributes aren't changing. Note, only the range ++ * of gfns whose attributes are being modified needs to be explicitly ++ * unmapped, as that will unmap any existing hugepages. ++ */ ++ for (level = PG_LEVEL_2M; level <= KVM_MAX_HUGEPAGE_LEVEL; level++) { ++ gfn_t start = gfn_round_for_level(range->start, level); ++ gfn_t end = gfn_round_for_level(range->end - 1, level); ++ gfn_t nr_pages = KVM_PAGES_PER_HPAGE(level); ++ ++ if ((start != range->start || start + nr_pages > range->end) && ++ start >= slot->base_gfn && ++ start + nr_pages <= slot->base_gfn + slot->npages && ++ !hugepage_test_mixed(slot, start, level)) ++ kvm_mmu_invalidate_range_add(kvm, start, start + nr_pages); ++ ++ if (end == start) ++ continue; ++ ++ if ((end + nr_pages) > range->end && ++ (end + nr_pages) <= (slot->base_gfn + slot->npages) && ++ !hugepage_test_mixed(slot, end, level)) ++ kvm_mmu_invalidate_range_add(kvm, end, end + nr_pages); ++ } ++ + /* Unmap the old attribute page. */ + if (range->arg.attributes & KVM_MEMORY_ATTRIBUTE_PRIVATE) + range->attr_filter = KVM_FILTER_SHARED; +@@ -7642,23 +7695,7 @@ bool kvm_arch_pre_set_memory_attributes(struct kvm *kvm, + return kvm_unmap_gfn_range(kvm, range); + } + +-static bool hugepage_test_mixed(struct kvm_memory_slot *slot, gfn_t gfn, +- int level) +-{ +- return lpage_info_slot(gfn, slot, level)->disallow_lpage & KVM_LPAGE_MIXED_FLAG; +-} +- +-static void hugepage_clear_mixed(struct kvm_memory_slot *slot, gfn_t gfn, +- int level) +-{ +- lpage_info_slot(gfn, slot, level)->disallow_lpage &= ~KVM_LPAGE_MIXED_FLAG; +-} + +-static void hugepage_set_mixed(struct kvm_memory_slot *slot, gfn_t gfn, +- int level) +-{ +- lpage_info_slot(gfn, slot, level)->disallow_lpage |= KVM_LPAGE_MIXED_FLAG; +-} + + static bool hugepage_has_attrs(struct kvm *kvm, struct kvm_memory_slot *slot, + gfn_t gfn, int level, unsigned long attrs) +-- +2.39.5 + diff --git a/queue-6.12/mctp-no-longer-rely-on-net-dev_index_head.patch b/queue-6.12/mctp-no-longer-rely-on-net-dev_index_head.patch new file mode 100644 index 0000000000..1ee0af3a84 --- /dev/null +++ b/queue-6.12/mctp-no-longer-rely-on-net-dev_index_head.patch @@ -0,0 +1,120 @@ +From b74413986ae78eea24cd5bacd7903d7616b93d58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 22:38:11 +0000 +Subject: mctp: no longer rely on net->dev_index_head[] + +From: Eric Dumazet + +[ Upstream commit 2d20773aec14996b6cc4db92d885028319be683d ] + +mctp_dump_addrinfo() is one of the last users of +net->dev_index_head[] in the control path. + +Switch to for_each_netdev_dump() for better scalability. + +Use C99 for mctp_device_rtnl_msg_handlers[] to prepare +future RTNL removal from mctp_dump_addrinfo() + +(mdev->addrs is not yet RCU protected) + +Signed-off-by: Eric Dumazet +Cc: Matt Johnston +Reviewed-by: Kuniyuki Iwashima +Acked-by: Jeremy Kerr +Link: https://patch.msgid.link/20241206223811.1343076-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: f11cf946c0a9 ("net: mctp: Don't access ifa_index when missing") +Signed-off-by: Sasha Levin +--- + net/mctp/device.c | 50 ++++++++++++++++++----------------------------- + 1 file changed, 19 insertions(+), 31 deletions(-) + +diff --git a/net/mctp/device.c b/net/mctp/device.c +index 85cc5f31f1e7c..cdb18da96c4bc 100644 +--- a/net/mctp/device.c ++++ b/net/mctp/device.c +@@ -20,8 +20,7 @@ + #include + + struct mctp_dump_cb { +- int h; +- int idx; ++ unsigned long ifindex; + size_t a_idx; + }; + +@@ -115,43 +114,29 @@ static int mctp_dump_addrinfo(struct sk_buff *skb, struct netlink_callback *cb) + { + struct mctp_dump_cb *mcb = (void *)cb->ctx; + struct net *net = sock_net(skb->sk); +- struct hlist_head *head; + struct net_device *dev; + struct ifaddrmsg *hdr; + struct mctp_dev *mdev; +- int ifindex; +- int idx = 0, rc; ++ int ifindex, rc; + + hdr = nlmsg_data(cb->nlh); + // filter by ifindex if requested + ifindex = hdr->ifa_index; + + rcu_read_lock(); +- for (; mcb->h < NETDEV_HASHENTRIES; mcb->h++, mcb->idx = 0) { +- idx = 0; +- head = &net->dev_index_head[mcb->h]; +- hlist_for_each_entry_rcu(dev, head, index_hlist) { +- if (idx >= mcb->idx && +- (ifindex == 0 || ifindex == dev->ifindex)) { +- mdev = __mctp_dev_get(dev); +- if (mdev) { +- rc = mctp_dump_dev_addrinfo(mdev, +- skb, cb); +- mctp_dev_put(mdev); +- // Error indicates full buffer, this +- // callback will get retried. +- if (rc < 0) +- goto out; +- } +- } +- idx++; +- // reset for next iteration +- mcb->a_idx = 0; +- } ++ for_each_netdev_dump(net, dev, mcb->ifindex) { ++ if (ifindex && ifindex != dev->ifindex) ++ continue; ++ mdev = __mctp_dev_get(dev); ++ if (!mdev) ++ continue; ++ rc = mctp_dump_dev_addrinfo(mdev, skb, cb); ++ mctp_dev_put(mdev); ++ if (rc < 0) ++ break; ++ mcb->a_idx = 0; + } +-out: + rcu_read_unlock(); +- mcb->idx = idx; + + return skb->len; + } +@@ -525,9 +510,12 @@ static struct notifier_block mctp_dev_nb = { + }; + + static const struct rtnl_msg_handler mctp_device_rtnl_msg_handlers[] = { +- {THIS_MODULE, PF_MCTP, RTM_NEWADDR, mctp_rtm_newaddr, NULL, 0}, +- {THIS_MODULE, PF_MCTP, RTM_DELADDR, mctp_rtm_deladdr, NULL, 0}, +- {THIS_MODULE, PF_MCTP, RTM_GETADDR, NULL, mctp_dump_addrinfo, 0}, ++ {.owner = THIS_MODULE, .protocol = PF_MCTP, .msgtype = RTM_NEWADDR, ++ .doit = mctp_rtm_newaddr}, ++ {.owner = THIS_MODULE, .protocol = PF_MCTP, .msgtype = RTM_DELADDR, ++ .doit = mctp_rtm_deladdr}, ++ {.owner = THIS_MODULE, .protocol = PF_MCTP, .msgtype = RTM_GETADDR, ++ .dumpit = mctp_dump_addrinfo}, + }; + + int __init mctp_device_init(void) +-- +2.39.5 + diff --git a/queue-6.12/mlxsw-spectrum_router-fix-use-after-free-when-deleti.patch b/queue-6.12/mlxsw-spectrum_router-fix-use-after-free-when-deleti.patch new file mode 100644 index 0000000000..1fc9dae2f6 --- /dev/null +++ b/queue-6.12/mlxsw-spectrum_router-fix-use-after-free-when-deleti.patch @@ -0,0 +1,100 @@ +From 81a9e9797929d70e151e93477d46b3193bff11d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 May 2025 14:48:05 +0200 +Subject: mlxsw: spectrum_router: Fix use-after-free when deleting GRE net + devices + +From: Ido Schimmel + +[ Upstream commit 92ec4855034b2c4d13f117558dc73d20581fa9ff ] + +The driver only offloads neighbors that are constructed on top of net +devices registered by it or their uppers (which are all Ethernet). The +device supports GRE encapsulation and decapsulation of forwarded +traffic, but the driver will not offload dummy neighbors constructed on +top of GRE net devices as they are not uppers of its net devices: + + # ip link add name gre1 up type gre tos inherit local 192.0.2.1 remote 198.51.100.1 + # ip neigh add 0.0.0.0 lladdr 0.0.0.0 nud noarp dev gre1 + $ ip neigh show dev gre1 nud noarp + 0.0.0.0 lladdr 0.0.0.0 NOARP + +(Note that the neighbor is not marked with 'offload') + +When the driver is reloaded and the existing configuration is replayed, +the driver does not perform the same check regarding existing neighbors +and offloads the previously added one: + + # devlink dev reload pci/0000:01:00.0 + $ ip neigh show dev gre1 nud noarp + 0.0.0.0 lladdr 0.0.0.0 offload NOARP + +If the neighbor is later deleted, the driver will ignore the +notification (given the GRE net device is not its upper) and will +therefore keep referencing freed memory, resulting in a use-after-free +[1] when the net device is deleted: + + # ip neigh del 0.0.0.0 lladdr 0.0.0.0 dev gre1 + # ip link del dev gre1 + +Fix by skipping neighbor replay if the net device for which the replay +is performed is not our upper. + +[1] +BUG: KASAN: slab-use-after-free in mlxsw_sp_neigh_entry_update+0x1ea/0x200 +Read of size 8 at addr ffff888155b0e420 by task ip/2282 +[...] +Call Trace: + + dump_stack_lvl+0x6f/0xa0 + print_address_description.constprop.0+0x6f/0x350 + print_report+0x108/0x205 + kasan_report+0xdf/0x110 + mlxsw_sp_neigh_entry_update+0x1ea/0x200 + mlxsw_sp_router_rif_gone_sync+0x2a8/0x440 + mlxsw_sp_rif_destroy+0x1e9/0x750 + mlxsw_sp_netdevice_ipip_ol_event+0x3c9/0xdc0 + mlxsw_sp_router_netdevice_event+0x3ac/0x15e0 + notifier_call_chain+0xca/0x150 + call_netdevice_notifiers_info+0x7f/0x100 + unregister_netdevice_many_notify+0xc8c/0x1d90 + rtnl_dellink+0x34e/0xa50 + rtnetlink_rcv_msg+0x6fb/0xb70 + netlink_rcv_skb+0x131/0x360 + netlink_unicast+0x426/0x710 + netlink_sendmsg+0x75a/0xc20 + __sock_sendmsg+0xc1/0x150 + ____sys_sendmsg+0x5aa/0x7b0 + ___sys_sendmsg+0xfc/0x180 + __sys_sendmsg+0x121/0x1b0 + do_syscall_64+0xbb/0x1d0 + entry_SYSCALL_64_after_hwframe+0x4b/0x53 + +Fixes: 8fdb09a7674c ("mlxsw: spectrum_router: Replay neighbours when RIF is made") +Signed-off-by: Ido Schimmel +Reviewed-by: Petr Machata +Signed-off-by: Petr Machata +Link: https://patch.msgid.link/c53c02c904fde32dad484657be3b1477884e9ad6.1747225701.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +index 7d6d859cef3f9..511cd92e0e3e7 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +@@ -3014,6 +3014,9 @@ static int mlxsw_sp_neigh_rif_made_sync(struct mlxsw_sp *mlxsw_sp, + .rif = rif, + }; + ++ if (!mlxsw_sp_dev_lower_is_port(mlxsw_sp_rif_dev(rif))) ++ return 0; ++ + neigh_for_each(&arp_tbl, mlxsw_sp_neigh_rif_made_sync_each, &rms); + if (rms.err) + goto err_arp; +-- +2.39.5 + diff --git a/queue-6.12/net-cadence-macb-fix-a-possible-deadlock-in-macb_hal.patch b/queue-6.12/net-cadence-macb-fix-a-possible-deadlock-in-macb_hal.patch new file mode 100644 index 0000000000..74823e597c --- /dev/null +++ b/queue-6.12/net-cadence-macb-fix-a-possible-deadlock-in-macb_hal.patch @@ -0,0 +1,64 @@ +From 7fb8b1b650b62a644284939066d85dd3c25e76de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 May 2025 14:19:35 +0200 +Subject: net: cadence: macb: Fix a possible deadlock in macb_halt_tx. + +From: Mathieu Othacehe + +[ Upstream commit c92d6089d8ad7d4d815ebcedee3f3907b539ff1f ] + +There is a situation where after THALT is set high, TGO stays high as +well. Because jiffies are never updated, as we are in a context with +interrupts disabled, we never exit that loop and have a deadlock. + +That deadlock was noticed on a sama5d4 device that stayed locked for days. + +Use retries instead of jiffies so that the timeout really works and we do +not have a deadlock anymore. + +Fixes: e86cd53afc590 ("net/macb: better manage tx errors") +Signed-off-by: Mathieu Othacehe +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250509121935.16282-1-othacehe@gnu.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cadence/macb_main.c | 19 ++++++------------- + 1 file changed, 6 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index 60847cdb516ee..ae100ed8ed6b9 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -1016,22 +1016,15 @@ static void macb_update_stats(struct macb *bp) + + static int macb_halt_tx(struct macb *bp) + { +- unsigned long halt_time, timeout; +- u32 status; ++ u32 status; + + macb_writel(bp, NCR, macb_readl(bp, NCR) | MACB_BIT(THALT)); + +- timeout = jiffies + usecs_to_jiffies(MACB_HALT_TIMEOUT); +- do { +- halt_time = jiffies; +- status = macb_readl(bp, TSR); +- if (!(status & MACB_BIT(TGO))) +- return 0; +- +- udelay(250); +- } while (time_before(halt_time, timeout)); +- +- return -ETIMEDOUT; ++ /* Poll TSR until TGO is cleared or timeout. */ ++ return read_poll_timeout_atomic(macb_readl, status, ++ !(status & MACB_BIT(TGO)), ++ 250, MACB_HALT_TIMEOUT, false, ++ bp, TSR); + } + + static void macb_tx_unmap(struct macb *bp, struct macb_tx_skb *tx_skb, int budget) +-- +2.39.5 + diff --git a/queue-6.12/net-dsa-b53-prevent-standalone-from-trying-to-forwar.patch b/queue-6.12/net-dsa-b53-prevent-standalone-from-trying-to-forwar.patch new file mode 100644 index 0000000000..1ce5dddf4d --- /dev/null +++ b/queue-6.12/net-dsa-b53-prevent-standalone-from-trying-to-forwar.patch @@ -0,0 +1,139 @@ +From de99288e7b62e7fd425733a99835e605cbd7b431 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 May 2025 11:14:24 +0200 +Subject: net: dsa: b53: prevent standalone from trying to forward to other + ports + +From: Jonas Gorski + +[ Upstream commit 4227ea91e2657f7965e34313448e9d0a2b67712e ] + +When bridged ports and standalone ports share a VLAN, e.g. via VLAN +uppers, or untagged traffic with a vlan unaware bridge, the ASIC will +still try to forward traffic to known FDB entries on standalone ports. +But since the port VLAN masks prevent forwarding to bridged ports, this +traffic will be dropped. + +This e.g. can be observed in the bridge_vlan_unaware ping tests, where +this breaks pinging with learning on. + +Work around this by enabling the simplified EAP mode on switches +supporting it for standalone ports, which causes the ASIC to redirect +traffic of unknown source MAC addresses to the CPU port. + +Since standalone ports do not learn, there are no known source MAC +addresses, so effectively this redirects all incoming traffic to the CPU +port. + +Fixes: ff39c2d68679 ("net: dsa: b53: Add bridge support") +Signed-off-by: Jonas Gorski +Reviewed-by: Florian Fainelli +Reviewed-by: Vladimir Oltean +Link: https://patch.msgid.link/20250508091424.26870-1-jonas.gorski@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/b53/b53_common.c | 33 ++++++++++++++++++++++++++++++++ + drivers/net/dsa/b53/b53_regs.h | 14 ++++++++++++++ + 2 files changed, 47 insertions(+) + +diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c +index e072d2b50c987..0168ad495e6c9 100644 +--- a/drivers/net/dsa/b53/b53_common.c ++++ b/drivers/net/dsa/b53/b53_common.c +@@ -326,6 +326,26 @@ static void b53_get_vlan_entry(struct b53_device *dev, u16 vid, + } + } + ++static void b53_set_eap_mode(struct b53_device *dev, int port, int mode) ++{ ++ u64 eap_conf; ++ ++ if (is5325(dev) || is5365(dev) || dev->chip_id == BCM5389_DEVICE_ID) ++ return; ++ ++ b53_read64(dev, B53_EAP_PAGE, B53_PORT_EAP_CONF(port), &eap_conf); ++ ++ if (is63xx(dev)) { ++ eap_conf &= ~EAP_MODE_MASK_63XX; ++ eap_conf |= (u64)mode << EAP_MODE_SHIFT_63XX; ++ } else { ++ eap_conf &= ~EAP_MODE_MASK; ++ eap_conf |= (u64)mode << EAP_MODE_SHIFT; ++ } ++ ++ b53_write64(dev, B53_EAP_PAGE, B53_PORT_EAP_CONF(port), eap_conf); ++} ++ + static void b53_set_forwarding(struct b53_device *dev, int enable) + { + u8 mgmt; +@@ -586,6 +606,13 @@ int b53_setup_port(struct dsa_switch *ds, int port) + b53_port_set_mcast_flood(dev, port, true); + b53_port_set_learning(dev, port, false); + ++ /* Force all traffic to go to the CPU port to prevent the ASIC from ++ * trying to forward to bridged ports on matching FDB entries, then ++ * dropping frames because it isn't allowed to forward there. ++ */ ++ if (dsa_is_user_port(ds, port)) ++ b53_set_eap_mode(dev, port, EAP_MODE_SIMPLIFIED); ++ + return 0; + } + EXPORT_SYMBOL(b53_setup_port); +@@ -2043,6 +2070,9 @@ int b53_br_join(struct dsa_switch *ds, int port, struct dsa_bridge bridge, + pvlan |= BIT(i); + } + ++ /* Disable redirection of unknown SA to the CPU port */ ++ b53_set_eap_mode(dev, port, EAP_MODE_BASIC); ++ + /* Configure the local port VLAN control membership to include + * remote ports and update the local port bitmask + */ +@@ -2078,6 +2108,9 @@ void b53_br_leave(struct dsa_switch *ds, int port, struct dsa_bridge bridge) + pvlan &= ~BIT(i); + } + ++ /* Enable redirection of unknown SA to the CPU port */ ++ b53_set_eap_mode(dev, port, EAP_MODE_SIMPLIFIED); ++ + b53_write16(dev, B53_PVLAN_PAGE, B53_PVLAN_PORT_MASK(port), pvlan); + dev->ports[port].vlan_ctl_mask = pvlan; + +diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h +index bfbcb66bef662..5f7a0e5c5709d 100644 +--- a/drivers/net/dsa/b53/b53_regs.h ++++ b/drivers/net/dsa/b53/b53_regs.h +@@ -50,6 +50,9 @@ + /* Jumbo Frame Registers */ + #define B53_JUMBO_PAGE 0x40 + ++/* EAP Registers */ ++#define B53_EAP_PAGE 0x42 ++ + /* EEE Control Registers Page */ + #define B53_EEE_PAGE 0x92 + +@@ -480,6 +483,17 @@ + #define JMS_MIN_SIZE 1518 + #define JMS_MAX_SIZE 9724 + ++/************************************************************************* ++ * EAP Page Registers ++ *************************************************************************/ ++#define B53_PORT_EAP_CONF(i) (0x20 + 8 * (i)) ++#define EAP_MODE_SHIFT 51 ++#define EAP_MODE_SHIFT_63XX 50 ++#define EAP_MODE_MASK (0x3ull << EAP_MODE_SHIFT) ++#define EAP_MODE_MASK_63XX (0x3ull << EAP_MODE_SHIFT_63XX) ++#define EAP_MODE_BASIC 0 ++#define EAP_MODE_SIMPLIFIED 3 ++ + /************************************************************************* + * EEE Configuration Page Registers + *************************************************************************/ +-- +2.39.5 + diff --git a/queue-6.12/net-dsa-sja1105-discard-incoming-frames-in-br_state_.patch b/queue-6.12/net-dsa-sja1105-discard-incoming-frames-in-br_state_.patch new file mode 100644 index 0000000000..a7ee65353b --- /dev/null +++ b/queue-6.12/net-dsa-sja1105-discard-incoming-frames-in-br_state_.patch @@ -0,0 +1,92 @@ +From 3a2cd75958a0e9b9be6c76ac8269cbda56908c89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 May 2025 14:38:16 +0300 +Subject: net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING + +From: Vladimir Oltean + +[ Upstream commit 498625a8ab2c8e1c9ab5105744310e8d6952cc01 ] + +It has been reported that when under a bridge with stp_state=1, the logs +get spammed with this message: + +[ 251.734607] fsl_dpaa2_eth dpni.5 eth0: Couldn't decode source port + +Further debugging shows the following info associated with packets: +source_port=-1, switch_id=-1, vid=-1, vbid=1 + +In other words, they are data plane packets which are supposed to be +decoded by dsa_tag_8021q_find_port_by_vbid(), but the latter (correctly) +refuses to do so, because no switch port is currently in +BR_STATE_LEARNING or BR_STATE_FORWARDING - so the packet is effectively +unexpected. + +The error goes away after the port progresses to BR_STATE_LEARNING in 15 +seconds (the default forward_time of the bridge), because then, +dsa_tag_8021q_find_port_by_vbid() can correctly associate the data plane +packets with a plausible bridge port in a plausible STP state. + +Re-reading IEEE 802.1D-1990, I see the following: + +"4.4.2 Learning: (...) The Forwarding Process shall discard received +frames." + +IEEE 802.1D-2004 further clarifies: + +"DISABLED, BLOCKING, LISTENING, and BROKEN all correspond to the +DISCARDING port state. While those dot1dStpPortStates serve to +distinguish reasons for discarding frames, the operation of the +Forwarding and Learning processes is the same for all of them. (...) +LISTENING represents a port that the spanning tree algorithm has +selected to be part of the active topology (computing a Root Port or +Designated Port role) but is temporarily discarding frames to guard +against loops or incorrect learning." + +Well, this is not what the driver does - instead it sets +mac[port].ingress = true. + +To get rid of the log spam, prevent unexpected data plane packets to +be received by software by discarding them on ingress in the LISTENING +state. + +In terms of blame attribution: the prints only date back to commit +d7f9787a763f ("net: dsa: tag_8021q: add support for imprecise RX based +on the VBID"). However, the settings would permit a LISTENING port to +forward to a FORWARDING port, and the standard suggests that's not OK. + +Fixes: 640f763f98c2 ("net: dsa: sja1105: Add support for Spanning Tree Protocol") +Signed-off-by: Vladimir Oltean +Link: https://patch.msgid.link/20250509113816.2221992-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/sja1105/sja1105_main.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c +index d0563ef59acf6..fbac2a647b20b 100644 +--- a/drivers/net/dsa/sja1105/sja1105_main.c ++++ b/drivers/net/dsa/sja1105/sja1105_main.c +@@ -2083,6 +2083,7 @@ static void sja1105_bridge_stp_state_set(struct dsa_switch *ds, int port, + switch (state) { + case BR_STATE_DISABLED: + case BR_STATE_BLOCKING: ++ case BR_STATE_LISTENING: + /* From UM10944 description of DRPDTAG (why put this there?): + * "Management traffic flows to the port regardless of the state + * of the INGRESS flag". So BPDUs are still be allowed to pass. +@@ -2092,11 +2093,6 @@ static void sja1105_bridge_stp_state_set(struct dsa_switch *ds, int port, + mac[port].egress = false; + mac[port].dyn_learn = false; + break; +- case BR_STATE_LISTENING: +- mac[port].ingress = true; +- mac[port].egress = false; +- mac[port].dyn_learn = false; +- break; + case BR_STATE_LEARNING: + mac[port].ingress = true; + mac[port].egress = false; +-- +2.39.5 + diff --git a/queue-6.12/net-ethernet-mtk_eth_soc-fix-typo-for-declaration-mt.patch b/queue-6.12/net-ethernet-mtk_eth_soc-fix-typo-for-declaration-mt.patch new file mode 100644 index 0000000000..cfc88cb668 --- /dev/null +++ b/queue-6.12/net-ethernet-mtk_eth_soc-fix-typo-for-declaration-mt.patch @@ -0,0 +1,41 @@ +From e6597b5f62eb9c521ff598022a5d7e8c6d99256a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 May 2025 05:27:30 +0100 +Subject: net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW + capability + +From: Bo-Cun Chen + +[ Upstream commit 1bdea6fad6fb985ff13828373c48e337c4e939f9 ] + +Since MTK_ESW_BIT is a bit number rather than a bitmap, it causes +MTK_HAS_CAPS to produce incorrect results. This leads to the ETH +driver not declaring MAC capabilities correctly for the MT7988 ESW. + +Fixes: 445eb6448ed3 ("net: ethernet: mtk_eth_soc: add basic support for MT7988 SoC") +Signed-off-by: Bo-Cun Chen +Signed-off-by: Daniel Golle +Reviewed-by: Michal Swiatkowski +Link: https://patch.msgid.link/b8b37f409d1280fad9c4d32521e6207f63cd3213.1747110258.git.daniel@makrotopia.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index 0a13f7c4684e0..272f178906d61 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -4685,7 +4685,7 @@ static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np) + } + + if (mtk_is_netsys_v3_or_greater(mac->hw) && +- MTK_HAS_CAPS(mac->hw->soc->caps, MTK_ESW_BIT) && ++ MTK_HAS_CAPS(mac->hw->soc->caps, MTK_ESW) && + id == MTK_GMAC1_ID) { + mac->phylink_config.mac_capabilities = MAC_ASYM_PAUSE | + MAC_SYM_PAUSE | +-- +2.39.5 + diff --git a/queue-6.12/net-mctp-don-t-access-ifa_index-when-missing.patch b/queue-6.12/net-mctp-don-t-access-ifa_index-when-missing.patch new file mode 100644 index 0000000000..3ab1497d4b --- /dev/null +++ b/queue-6.12/net-mctp-don-t-access-ifa_index-when-missing.patch @@ -0,0 +1,68 @@ +From f41830ee89f3e054f66a8fc8301b0f5d83378736 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 May 2025 13:18:32 +0800 +Subject: net: mctp: Don't access ifa_index when missing + +From: Matt Johnston + +[ Upstream commit f11cf946c0a92c560a890d68e4775723353599e1 ] + +In mctp_dump_addrinfo, ifa_index can be used to filter interfaces, but +only when the struct ifaddrmsg is provided. Otherwise it will be +comparing to uninitialised memory - reproducible in the syzkaller case from +dhcpd, or busybox "ip addr show". + +The kernel MCTP implementation has always filtered by ifa_index, so +existing userspace programs expecting to dump MCTP addresses must +already be passing a valid ifa_index value (either 0 or a real index). + +BUG: KMSAN: uninit-value in mctp_dump_addrinfo+0x208/0xac0 net/mctp/device.c:128 + mctp_dump_addrinfo+0x208/0xac0 net/mctp/device.c:128 + rtnl_dump_all+0x3ec/0x5b0 net/core/rtnetlink.c:4380 + rtnl_dumpit+0xd5/0x2f0 net/core/rtnetlink.c:6824 + netlink_dump+0x97b/0x1690 net/netlink/af_netlink.c:2309 + +Fixes: 583be982d934 ("mctp: Add device handling and netlink interface") +Reported-by: syzbot+e76d52dadc089b9d197f@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/68135815.050a0220.3a872c.000e.GAE@google.com/ +Reported-by: syzbot+1065a199625a388fce60@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/681357d6.050a0220.14dd7d.000d.GAE@google.com/ +Signed-off-by: Matt Johnston +Link: https://patch.msgid.link/20250508-mctp-addr-dump-v2-1-c8a53fd2dd66@codeconstruct.com.au +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/mctp/device.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/net/mctp/device.c b/net/mctp/device.c +index cdb18da96c4bc..8d1386601bbe0 100644 +--- a/net/mctp/device.c ++++ b/net/mctp/device.c +@@ -117,11 +117,18 @@ static int mctp_dump_addrinfo(struct sk_buff *skb, struct netlink_callback *cb) + struct net_device *dev; + struct ifaddrmsg *hdr; + struct mctp_dev *mdev; +- int ifindex, rc; +- +- hdr = nlmsg_data(cb->nlh); +- // filter by ifindex if requested +- ifindex = hdr->ifa_index; ++ int ifindex = 0, rc; ++ ++ /* Filter by ifindex if a header is provided */ ++ if (cb->nlh->nlmsg_len >= nlmsg_msg_size(sizeof(*hdr))) { ++ hdr = nlmsg_data(cb->nlh); ++ ifindex = hdr->ifa_index; ++ } else { ++ if (cb->strict_check) { ++ NL_SET_ERR_MSG(cb->extack, "mctp: Invalid header for addr dump request"); ++ return -EINVAL; ++ } ++ } + + rcu_read_lock(); + for_each_netdev_dump(net, dev, mcb->ifindex) { +-- +2.39.5 + diff --git a/queue-6.12/net-mctp-ensure-keys-maintain-only-one-ref-to-corres.patch b/queue-6.12/net-mctp-ensure-keys-maintain-only-one-ref-to-corres.patch new file mode 100644 index 0000000000..9fb8390700 --- /dev/null +++ b/queue-6.12/net-mctp-ensure-keys-maintain-only-one-ref-to-corres.patch @@ -0,0 +1,57 @@ +From f102db7ac60a3b068018734ac51b99023f0447bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 May 2025 14:16:00 +0930 +Subject: net: mctp: Ensure keys maintain only one ref to corresponding dev + +From: Andrew Jeffery + +[ Upstream commit e4f349bd6e58051df698b82f94721f18a02a293d ] + +mctp_flow_prepare_output() is called in mctp_route_output(), which +places outbound packets onto a given interface. The packet may represent +a message fragment, in which case we provoke an unbalanced reference +count to the underlying device. This causes trouble if we ever attempt +to remove the interface: + + [ 48.702195] usb 1-1: USB disconnect, device number 2 + [ 58.883056] unregister_netdevice: waiting for mctpusb0 to become free. Usage count = 2 + [ 69.022548] unregister_netdevice: waiting for mctpusb0 to become free. Usage count = 2 + [ 79.172568] unregister_netdevice: waiting for mctpusb0 to become free. Usage count = 2 + ... + +Predicate the invocation of mctp_dev_set_key() in +mctp_flow_prepare_output() on not already having associated the device +with the key. It's not yet realistic to uphold the property that the key +maintains only one device reference earlier in the transmission sequence +as the route (and therefore the device) may not be known at the time the +key is associated with the socket. + +Fixes: 67737c457281 ("mctp: Pass flow data & flow release events to drivers") +Acked-by: Jeremy Kerr +Signed-off-by: Andrew Jeffery +Link: https://patch.msgid.link/20250508-mctp-dev-refcount-v1-1-d4f965c67bb5@codeconstruct.com.au +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/mctp/route.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/mctp/route.c b/net/mctp/route.c +index 4c460160914f0..d9c8e5a5f9ce9 100644 +--- a/net/mctp/route.c ++++ b/net/mctp/route.c +@@ -313,8 +313,10 @@ static void mctp_flow_prepare_output(struct sk_buff *skb, struct mctp_dev *dev) + + key = flow->key; + +- if (WARN_ON(key->dev && key->dev != dev)) ++ if (key->dev) { ++ WARN_ON(key->dev != dev); + return; ++ } + + mctp_dev_set_key(dev, key); + } +-- +2.39.5 + diff --git a/queue-6.12/net-mlx5e-disable-macsec-offload-for-uplink-represen.patch b/queue-6.12/net-mlx5e-disable-macsec-offload-for-uplink-represen.patch new file mode 100644 index 0000000000..001867af9b --- /dev/null +++ b/queue-6.12/net-mlx5e-disable-macsec-offload-for-uplink-represen.patch @@ -0,0 +1,156 @@ +From e46e92f558a8e2d42c833534fd216ca80fc7004b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 May 2025 13:15:52 +0300 +Subject: net/mlx5e: Disable MACsec offload for uplink representor profile + +From: Carolina Jubran + +[ Upstream commit 588431474eb7572e57a927fa8558c9ba2f8af143 ] + +MACsec offload is not supported in switchdev mode for uplink +representors. When switching to the uplink representor profile, the +MACsec offload feature must be cleared from the netdevice's features. + +If left enabled, attempts to add offloads result in a null pointer +dereference, as the uplink representor does not support MACsec offload +even though the feature bit remains set. + +Clear NETIF_F_HW_MACSEC in mlx5e_fix_uplink_rep_features(). + +Kernel log: + +Oops: general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] SMP KASAN +KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f] +CPU: 29 UID: 0 PID: 4714 Comm: ip Not tainted 6.14.0-rc4_for_upstream_debug_2025_03_02_17_35 #1 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 +RIP: 0010:__mutex_lock+0x128/0x1dd0 +Code: d0 7c 08 84 d2 0f 85 ad 15 00 00 8b 35 91 5c fe 03 85 f6 75 29 49 8d 7e 60 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 a6 15 00 00 4d 3b 76 60 0f 85 fd 0b 00 00 65 ff +RSP: 0018:ffff888147a4f160 EFLAGS: 00010206 +RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000001 +RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000078 +RBP: ffff888147a4f2e0 R08: ffffffffa05d2c19 R09: 0000000000000000 +R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 +R13: dffffc0000000000 R14: 0000000000000018 R15: ffff888152de0000 +FS: 00007f855e27d800(0000) GS:ffff88881ee80000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00000000004e5768 CR3: 000000013ae7c005 CR4: 0000000000372eb0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 +Call Trace: + + ? die_addr+0x3d/0xa0 + ? exc_general_protection+0x144/0x220 + ? asm_exc_general_protection+0x22/0x30 + ? mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core] + ? __mutex_lock+0x128/0x1dd0 + ? lockdep_set_lock_cmp_fn+0x190/0x190 + ? mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core] + ? mutex_lock_io_nested+0x1ae0/0x1ae0 + ? lock_acquire+0x1c2/0x530 + ? macsec_upd_offload+0x145/0x380 + ? lockdep_hardirqs_on_prepare+0x400/0x400 + ? kasan_save_stack+0x30/0x40 + ? kasan_save_stack+0x20/0x40 + ? kasan_save_track+0x10/0x30 + ? __kasan_kmalloc+0x77/0x90 + ? __kmalloc_noprof+0x249/0x6b0 + ? genl_family_rcv_msg_attrs_parse.constprop.0+0xb5/0x240 + ? mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core] + mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core] + ? mlx5e_macsec_add_rxsa+0x11a0/0x11a0 [mlx5_core] + macsec_update_offload+0x26c/0x820 + ? macsec_set_mac_address+0x4b0/0x4b0 + ? lockdep_hardirqs_on_prepare+0x284/0x400 + ? _raw_spin_unlock_irqrestore+0x47/0x50 + macsec_upd_offload+0x2c8/0x380 + ? macsec_update_offload+0x820/0x820 + ? __nla_parse+0x22/0x30 + ? genl_family_rcv_msg_attrs_parse.constprop.0+0x15e/0x240 + genl_family_rcv_msg_doit+0x1cc/0x2a0 + ? genl_family_rcv_msg_attrs_parse.constprop.0+0x240/0x240 + ? cap_capable+0xd4/0x330 + genl_rcv_msg+0x3ea/0x670 + ? genl_family_rcv_msg_dumpit+0x2a0/0x2a0 + ? lockdep_set_lock_cmp_fn+0x190/0x190 + ? macsec_update_offload+0x820/0x820 + netlink_rcv_skb+0x12b/0x390 + ? genl_family_rcv_msg_dumpit+0x2a0/0x2a0 + ? netlink_ack+0xd80/0xd80 + ? rwsem_down_read_slowpath+0xf90/0xf90 + ? netlink_deliver_tap+0xcd/0xac0 + ? netlink_deliver_tap+0x155/0xac0 + ? _copy_from_iter+0x1bb/0x12c0 + genl_rcv+0x24/0x40 + netlink_unicast+0x440/0x700 + ? netlink_attachskb+0x760/0x760 + ? lock_acquire+0x1c2/0x530 + ? __might_fault+0xbb/0x170 + netlink_sendmsg+0x749/0xc10 + ? netlink_unicast+0x700/0x700 + ? __might_fault+0xbb/0x170 + ? netlink_unicast+0x700/0x700 + __sock_sendmsg+0xc5/0x190 + ____sys_sendmsg+0x53f/0x760 + ? import_iovec+0x7/0x10 + ? kernel_sendmsg+0x30/0x30 + ? __copy_msghdr+0x3c0/0x3c0 + ? filter_irq_stacks+0x90/0x90 + ? stack_depot_save_flags+0x28/0xa30 + ___sys_sendmsg+0xeb/0x170 + ? kasan_save_stack+0x30/0x40 + ? copy_msghdr_from_user+0x110/0x110 + ? do_syscall_64+0x6d/0x140 + ? lock_acquire+0x1c2/0x530 + ? __virt_addr_valid+0x116/0x3b0 + ? __virt_addr_valid+0x1da/0x3b0 + ? lock_downgrade+0x680/0x680 + ? __delete_object+0x21/0x50 + __sys_sendmsg+0xf7/0x180 + ? __sys_sendmsg_sock+0x20/0x20 + ? kmem_cache_free+0x14c/0x4e0 + ? __x64_sys_close+0x78/0xd0 + do_syscall_64+0x6d/0x140 + entry_SYSCALL_64_after_hwframe+0x4b/0x53 +RIP: 0033:0x7f855e113367 +Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 +RSP: 002b:00007ffd15e90c88 EFLAGS: 00000246 ORIG_RAX: 000000000000002e +RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f855e113367 +RDX: 0000000000000000 RSI: 00007ffd15e90cf0 RDI: 0000000000000004 +RBP: 00007ffd15e90dbc R08: 0000000000000028 R09: 000000000045d100 +R10: 00007f855e011dd8 R11: 0000000000000246 R12: 0000000000000019 +R13: 0000000067c6b785 R14: 00000000004a1e80 R15: 0000000000000000 + +Modules linked in: 8021q garp mrp sch_ingress openvswitch nsh mlx5_ib mlx5_fwctl mlx5_dpll mlx5_core rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay zram zsmalloc fuse [last unloaded: mlx5_core] +---[ end trace 0000000000000000 ]--- + +Fixes: 8ff0ac5be144 ("net/mlx5: Add MACsec offload Tx command support") +Signed-off-by: Carolina Jubran +Reviewed-by: Shahar Shitrit +Reviewed-by: Dragos Tatulea +Signed-off-by: Tariq Toukan +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/1746958552-561295-1-git-send-email-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 1c087fa1ca269..3e9ad3cb8121d 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -4344,6 +4344,10 @@ static netdev_features_t mlx5e_fix_uplink_rep_features(struct net_device *netdev + if (netdev->features & NETIF_F_HW_VLAN_CTAG_FILTER) + netdev_warn(netdev, "Disabling HW_VLAN CTAG FILTERING, not supported in switchdev mode\n"); + ++ features &= ~NETIF_F_HW_MACSEC; ++ if (netdev->features & NETIF_F_HW_MACSEC) ++ netdev_warn(netdev, "Disabling HW MACsec offload, not supported in switchdev mode\n"); ++ + return features; + } + +-- +2.39.5 + diff --git a/queue-6.12/net-tls-fix-kernel-panic-when-alloc_page-failed.patch b/queue-6.12/net-tls-fix-kernel-panic-when-alloc_page-failed.patch new file mode 100644 index 0000000000..f637561d17 --- /dev/null +++ b/queue-6.12/net-tls-fix-kernel-panic-when-alloc_page-failed.patch @@ -0,0 +1,61 @@ +From c162e980d067ed0fc87494f90ac7426835e1c3e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 May 2025 21:20:13 +0800 +Subject: net/tls: fix kernel panic when alloc_page failed + +From: Pengtao He + +[ Upstream commit 491deb9b8c4ad12fe51d554a69b8165b9ef9429f ] + +We cannot set frag_list to NULL pointer when alloc_page failed. +It will be used in tls_strp_check_queue_ok when the next time +tls_strp_read_sock is called. + +This is because we don't reset full_len in tls_strp_flush_anchor_copy() +so the recv path will try to continue handling the partial record +on the next call but we dettached the rcvq from the frag list. +Alternative fix would be to reset full_len. + +Unable to handle kernel NULL pointer dereference +at virtual address 0000000000000028 + Call trace: + tls_strp_check_rcv+0x128/0x27c + tls_strp_data_ready+0x34/0x44 + tls_data_ready+0x3c/0x1f0 + tcp_data_ready+0x9c/0xe4 + tcp_data_queue+0xf6c/0x12d0 + tcp_rcv_established+0x52c/0x798 + +Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") +Signed-off-by: Pengtao He +Link: https://patch.msgid.link/20250514132013.17274-1-hept.hept.hept@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_strp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/tls/tls_strp.c b/net/tls/tls_strp.c +index 77e33e1e340e3..65b0da6fdf6a7 100644 +--- a/net/tls/tls_strp.c ++++ b/net/tls/tls_strp.c +@@ -396,7 +396,6 @@ static int tls_strp_read_copy(struct tls_strparser *strp, bool qshort) + return 0; + + shinfo = skb_shinfo(strp->anchor); +- shinfo->frag_list = NULL; + + /* If we don't know the length go max plus page for cipher overhead */ + need_spc = strp->stm.full_len ?: TLS_MAX_PAYLOAD_SIZE + PAGE_SIZE; +@@ -412,6 +411,8 @@ static int tls_strp_read_copy(struct tls_strparser *strp, bool qshort) + page, 0, 0); + } + ++ shinfo->frag_list = NULL; ++ + strp->copy_mode = 1; + strp->stm.offset = 0; + +-- +2.39.5 + diff --git a/queue-6.12/net_sched-flush-gso_skb-list-too-during-change.patch b/queue-6.12/net_sched-flush-gso_skb-list-too-during-change.patch new file mode 100644 index 0000000000..7c885011f8 --- /dev/null +++ b/queue-6.12/net_sched-flush-gso_skb-list-too-during-change.patch @@ -0,0 +1,147 @@ +From 8869cacc7736077b3482000c11bcf0fcb588cb9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 May 2025 21:35:58 -0700 +Subject: net_sched: Flush gso_skb list too during ->change() + +From: Cong Wang + +[ Upstream commit 2d3cbfd6d54a2c39ce3244f33f85c595844bd7b8 ] + +Previously, when reducing a qdisc's limit via the ->change() operation, only +the main skb queue was trimmed, potentially leaving packets in the gso_skb +list. This could result in NULL pointer dereference when we only check +sch->limit against sch->q.qlen. + +This patch introduces a new helper, qdisc_dequeue_internal(), which ensures +both the gso_skb list and the main queue are properly flushed when trimming +excess packets. All relevant qdiscs (codel, fq, fq_codel, fq_pie, hhf, pie) +are updated to use this helper in their ->change() routines. + +Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM") +Fixes: 4b549a2ef4be ("fq_codel: Fair Queue Codel AQM") +Fixes: afe4fd062416 ("pkt_sched: fq: Fair Queue packet scheduler") +Fixes: ec97ecf1ebe4 ("net: sched: add Flow Queue PIE packet scheduler") +Fixes: 10239edf86f1 ("net-qdisc-hhf: Heavy-Hitter Filter (HHF) qdisc") +Fixes: d4b36210c2e6 ("net: pkt_sched: PIE AQM scheme") +Reported-by: Will +Reported-by: Savy +Signed-off-by: Cong Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/sch_generic.h | 15 +++++++++++++++ + net/sched/sch_codel.c | 2 +- + net/sched/sch_fq.c | 2 +- + net/sched/sch_fq_codel.c | 2 +- + net/sched/sch_fq_pie.c | 2 +- + net/sched/sch_hhf.c | 2 +- + net/sched/sch_pie.c | 2 +- + 7 files changed, 21 insertions(+), 6 deletions(-) + +diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h +index 24e48af7e8f74..a9d7e9ecee6b5 100644 +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -1031,6 +1031,21 @@ static inline struct sk_buff *__qdisc_dequeue_head(struct qdisc_skb_head *qh) + return skb; + } + ++static inline struct sk_buff *qdisc_dequeue_internal(struct Qdisc *sch, bool direct) ++{ ++ struct sk_buff *skb; ++ ++ skb = __skb_dequeue(&sch->gso_skb); ++ if (skb) { ++ sch->q.qlen--; ++ return skb; ++ } ++ if (direct) ++ return __qdisc_dequeue_head(&sch->q); ++ else ++ return sch->dequeue(sch); ++} ++ + static inline struct sk_buff *qdisc_dequeue_head(struct Qdisc *sch) + { + struct sk_buff *skb = __qdisc_dequeue_head(&sch->q); +diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c +index e1f6e7618debd..afd9805cb68e2 100644 +--- a/net/sched/sch_codel.c ++++ b/net/sched/sch_codel.c +@@ -143,7 +143,7 @@ static int codel_change(struct Qdisc *sch, struct nlattr *opt, + + qlen = sch->q.qlen; + while (sch->q.qlen > sch->limit) { +- struct sk_buff *skb = __qdisc_dequeue_head(&sch->q); ++ struct sk_buff *skb = qdisc_dequeue_internal(sch, true); + + dropped += qdisc_pkt_len(skb); + qdisc_qstats_backlog_dec(sch, skb); +diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c +index afefe124d9039..1af9768cd8ff6 100644 +--- a/net/sched/sch_fq.c ++++ b/net/sched/sch_fq.c +@@ -1113,7 +1113,7 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt, + sch_tree_lock(sch); + } + while (sch->q.qlen > sch->limit) { +- struct sk_buff *skb = fq_dequeue(sch); ++ struct sk_buff *skb = qdisc_dequeue_internal(sch, false); + + if (!skb) + break; +diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c +index 778f6e5966be8..551b7cbdae90c 100644 +--- a/net/sched/sch_fq_codel.c ++++ b/net/sched/sch_fq_codel.c +@@ -440,7 +440,7 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt, + + while (sch->q.qlen > sch->limit || + q->memory_usage > q->memory_limit) { +- struct sk_buff *skb = fq_codel_dequeue(sch); ++ struct sk_buff *skb = qdisc_dequeue_internal(sch, false); + + q->cstats.drop_len += qdisc_pkt_len(skb); + rtnl_kfree_skbs(skb, skb); +diff --git a/net/sched/sch_fq_pie.c b/net/sched/sch_fq_pie.c +index c38f33ff80bde..6ed08b705f8a5 100644 +--- a/net/sched/sch_fq_pie.c ++++ b/net/sched/sch_fq_pie.c +@@ -364,7 +364,7 @@ static int fq_pie_change(struct Qdisc *sch, struct nlattr *opt, + + /* Drop excess packets if new limit is lower */ + while (sch->q.qlen > sch->limit) { +- struct sk_buff *skb = fq_pie_qdisc_dequeue(sch); ++ struct sk_buff *skb = qdisc_dequeue_internal(sch, false); + + len_dropped += qdisc_pkt_len(skb); + num_dropped += 1; +diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c +index 44d9efe1a96a8..5aa434b467073 100644 +--- a/net/sched/sch_hhf.c ++++ b/net/sched/sch_hhf.c +@@ -564,7 +564,7 @@ static int hhf_change(struct Qdisc *sch, struct nlattr *opt, + qlen = sch->q.qlen; + prev_backlog = sch->qstats.backlog; + while (sch->q.qlen > sch->limit) { +- struct sk_buff *skb = hhf_dequeue(sch); ++ struct sk_buff *skb = qdisc_dequeue_internal(sch, false); + + rtnl_kfree_skbs(skb, skb); + } +diff --git a/net/sched/sch_pie.c b/net/sched/sch_pie.c +index b3dcb845b3275..db61cbc21b138 100644 +--- a/net/sched/sch_pie.c ++++ b/net/sched/sch_pie.c +@@ -192,7 +192,7 @@ static int pie_change(struct Qdisc *sch, struct nlattr *opt, + /* Drop excess packets if new limit is lower */ + qlen = sch->q.qlen; + while (sch->q.qlen > sch->limit) { +- struct sk_buff *skb = __qdisc_dequeue_head(&sch->q); ++ struct sk_buff *skb = qdisc_dequeue_internal(sch, true); + + dropped += qdisc_pkt_len(skb); + qdisc_qstats_backlog_dec(sch, skb); +-- +2.39.5 + diff --git a/queue-6.12/netlink-specs-tc-all-actions-are-indexed-arrays.patch b/queue-6.12/netlink-specs-tc-all-actions-are-indexed-arrays.patch new file mode 100644 index 0000000000..f14d196ee0 --- /dev/null +++ b/queue-6.12/netlink-specs-tc-all-actions-are-indexed-arrays.patch @@ -0,0 +1,48 @@ +From c705a6a344230246ec2d88b64cbc1f39fb77e95e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 May 2025 15:16:38 -0700 +Subject: netlink: specs: tc: all actions are indexed arrays + +From: Jakub Kicinski + +[ Upstream commit f3dd5fb2fa494dcbdb10f8d27f2deac8ef61a2fc ] + +Some TC filters have actions listed as indexed arrays of nests +and some as just nests. They are all indexed arrays, the handling +is common across filters. + +Fixes: 2267672a6190 ("doc/netlink/specs: Update the tc spec") +Link: https://patch.msgid.link/20250513221638.842532-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + Documentation/netlink/specs/tc.yaml | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/Documentation/netlink/specs/tc.yaml b/Documentation/netlink/specs/tc.yaml +index a5bde25c89e52..c5579a5412fc9 100644 +--- a/Documentation/netlink/specs/tc.yaml ++++ b/Documentation/netlink/specs/tc.yaml +@@ -2017,7 +2017,8 @@ attribute-sets: + attributes: + - + name: act +- type: nest ++ type: indexed-array ++ sub-type: nest + nested-attributes: tc-act-attrs + - + name: police +@@ -2250,7 +2251,8 @@ attribute-sets: + attributes: + - + name: act +- type: nest ++ type: indexed-array ++ sub-type: nest + nested-attributes: tc-act-attrs + - + name: police +-- +2.39.5 + diff --git a/queue-6.12/netlink-specs-tc-fix-a-couple-of-attribute-names.patch b/queue-6.12/netlink-specs-tc-fix-a-couple-of-attribute-names.patch new file mode 100644 index 0000000000..a665e59e5c --- /dev/null +++ b/queue-6.12/netlink-specs-tc-fix-a-couple-of-attribute-names.patch @@ -0,0 +1,47 @@ +From 0fea5977e3e282bee5d981fab1deb83178aa0e17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 May 2025 15:13:16 -0700 +Subject: netlink: specs: tc: fix a couple of attribute names + +From: Jakub Kicinski + +[ Upstream commit a9fb87b8b86918e34ef6bf3316311f41bc1a5b1f ] + +Fix up spelling of two attribute names. These are clearly typoes +and will prevent C codegen from working. Let's treat this as +a fix to get the correction into users' hands ASAP, and prevent +anyone depending on the wrong names. + +Fixes: a1bcfde83669 ("doc/netlink/specs: Add a spec for tc") +Link: https://patch.msgid.link/20250513221316.841700-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + Documentation/netlink/specs/tc.yaml | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/Documentation/netlink/specs/tc.yaml b/Documentation/netlink/specs/tc.yaml +index b02d59a0349c4..a5bde25c89e52 100644 +--- a/Documentation/netlink/specs/tc.yaml ++++ b/Documentation/netlink/specs/tc.yaml +@@ -2745,7 +2745,7 @@ attribute-sets: + type: u16 + byte-order: big-endian + - +- name: key-l2-tpv3-sid ++ name: key-l2tpv3-sid + type: u32 + byte-order: big-endian + - +@@ -3504,7 +3504,7 @@ attribute-sets: + name: rate64 + type: u64 + - +- name: prate4 ++ name: prate64 + type: u64 + - + name: burst +-- +2.39.5 + diff --git a/queue-6.12/nfs-handle-failure-of-nfs_get_lock_context-in-unlock.patch b/queue-6.12/nfs-handle-failure-of-nfs_get_lock_context-in-unlock.patch new file mode 100644 index 0000000000..0ed29af087 --- /dev/null +++ b/queue-6.12/nfs-handle-failure-of-nfs_get_lock_context-in-unlock.patch @@ -0,0 +1,97 @@ +From 18e55b737e2578833972c27790a81ade44f9d0b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Apr 2025 15:25:08 +0800 +Subject: nfs: handle failure of nfs_get_lock_context in unlock path + +From: Li Lingfeng + +[ Upstream commit c457dc1ec770a22636b473ce5d35614adfe97636 ] + +When memory is insufficient, the allocation of nfs_lock_context in +nfs_get_lock_context() fails and returns -ENOMEM. If we mistakenly treat +an nfs4_unlockdata structure (whose l_ctx member has been set to -ENOMEM) +as valid and proceed to execute rpc_run_task(), this will trigger a NULL +pointer dereference in nfs4_locku_prepare. For example: + +BUG: kernel NULL pointer dereference, address: 000000000000000c +PGD 0 P4D 0 +Oops: Oops: 0000 [#1] SMP PTI +CPU: 15 UID: 0 PID: 12 Comm: kworker/u64:0 Not tainted 6.15.0-rc2-dirty #60 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 +Workqueue: rpciod rpc_async_schedule +RIP: 0010:nfs4_locku_prepare+0x35/0xc2 +Code: 89 f2 48 89 fd 48 c7 c7 68 69 ef b5 53 48 8b 8e 90 00 00 00 48 89 f3 +RSP: 0018:ffffbbafc006bdb8 EFLAGS: 00010246 +RAX: 000000000000004b RBX: ffff9b964fc1fa00 RCX: 0000000000000000 +RDX: 0000000000000000 RSI: fffffffffffffff4 RDI: ffff9ba53fddbf40 +RBP: ffff9ba539934000 R08: 0000000000000000 R09: ffffbbafc006bc38 +R10: ffffffffb6b689c8 R11: 0000000000000003 R12: ffff9ba539934030 +R13: 0000000000000001 R14: 0000000004248060 R15: ffffffffb56d1c30 +FS: 0000000000000000(0000) GS:ffff9ba5881f0000(0000) knlGS:00000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 000000000000000c CR3: 000000093f244000 CR4: 00000000000006f0 +Call Trace: + + __rpc_execute+0xbc/0x480 + rpc_async_schedule+0x2f/0x40 + process_one_work+0x232/0x5d0 + worker_thread+0x1da/0x3d0 + ? __pfx_worker_thread+0x10/0x10 + kthread+0x10d/0x240 + ? __pfx_kthread+0x10/0x10 + ret_from_fork+0x34/0x50 + ? __pfx_kthread+0x10/0x10 + ret_from_fork_asm+0x1a/0x30 + +Modules linked in: +CR2: 000000000000000c +---[ end trace 0000000000000000 ]--- + +Free the allocated nfs4_unlockdata when nfs_get_lock_context() fails and +return NULL to terminate subsequent rpc_run_task, preventing NULL pointer +dereference. + +Fixes: f30cb757f680 ("NFS: Always wait for I/O completion before unlock") +Signed-off-by: Li Lingfeng +Reviewed-by: Jeff Layton +Link: https://lore.kernel.org/r/20250417072508.3850532-1-lilingfeng3@huawei.com +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index e7bc99c69743c..ca01f79c82e4a 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -7040,10 +7040,18 @@ static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl, + struct nfs4_unlockdata *p; + struct nfs4_state *state = lsp->ls_state; + struct inode *inode = state->inode; ++ struct nfs_lock_context *l_ctx; + + p = kzalloc(sizeof(*p), GFP_KERNEL); + if (p == NULL) + return NULL; ++ l_ctx = nfs_get_lock_context(ctx); ++ if (!IS_ERR(l_ctx)) { ++ p->l_ctx = l_ctx; ++ } else { ++ kfree(p); ++ return NULL; ++ } + p->arg.fh = NFS_FH(inode); + p->arg.fl = &p->fl; + p->arg.seqid = seqid; +@@ -7051,7 +7059,6 @@ static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl, + p->lsp = lsp; + /* Ensure we don't close file until we're done freeing locks! */ + p->ctx = get_nfs_open_context(ctx); +- p->l_ctx = nfs_get_lock_context(ctx); + locks_init_lock(&p->fl); + locks_copy_lock(&p->fl, fl); + p->server = NFS_SERVER(inode); +-- +2.39.5 + diff --git a/queue-6.12/nfsv4-pnfs-reset-the-layout-state-after-a-layoutretu.patch b/queue-6.12/nfsv4-pnfs-reset-the-layout-state-after-a-layoutretu.patch new file mode 100644 index 0000000000..49c9edbc00 --- /dev/null +++ b/queue-6.12/nfsv4-pnfs-reset-the-layout-state-after-a-layoutretu.patch @@ -0,0 +1,50 @@ +From 9f453a1e4b268270ee76ac247c97d56df570cce0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 May 2025 10:50:13 -0400 +Subject: NFSv4/pnfs: Reset the layout state after a layoutreturn + +From: Trond Myklebust + +[ Upstream commit 6d6d7f91cc8c111d40416ac9240a3bb9396c5235 ] + +If there are still layout segments in the layout plh_return_lsegs list +after a layout return, we should be resetting the state to ensure they +eventually get returned as well. + +Fixes: 68f744797edd ("pNFS: Do not free layout segments that are marked for return") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/pnfs.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c +index 5f582713bf05e..683e09be25adf 100644 +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -745,6 +745,14 @@ pnfs_mark_matching_lsegs_invalid(struct pnfs_layout_hdr *lo, + return remaining; + } + ++static void pnfs_reset_return_info(struct pnfs_layout_hdr *lo) ++{ ++ struct pnfs_layout_segment *lseg; ++ ++ list_for_each_entry(lseg, &lo->plh_return_segs, pls_list) ++ pnfs_set_plh_return_info(lo, lseg->pls_range.iomode, 0); ++} ++ + static void + pnfs_free_returned_lsegs(struct pnfs_layout_hdr *lo, + struct list_head *free_me, +@@ -1292,6 +1300,7 @@ void pnfs_layoutreturn_free_lsegs(struct pnfs_layout_hdr *lo, + pnfs_mark_matching_lsegs_invalid(lo, &freeme, range, seq); + pnfs_free_returned_lsegs(lo, &freeme, range, seq); + pnfs_set_layout_stateid(lo, stateid, NULL, true); ++ pnfs_reset_return_info(lo); + } else + pnfs_mark_layout_stateid_invalid(lo, &freeme); + out_unlock: +-- +2.39.5 + diff --git a/queue-6.12/nvme-pci-acquire-cq_poll_lock-in-nvme_poll_irqdisabl.patch b/queue-6.12/nvme-pci-acquire-cq_poll_lock-in-nvme_poll_irqdisabl.patch new file mode 100644 index 0000000000..95cc010abc --- /dev/null +++ b/queue-6.12/nvme-pci-acquire-cq_poll_lock-in-nvme_poll_irqdisabl.patch @@ -0,0 +1,40 @@ +From 05e919da3b4d95147480c84fdf651c4a8abc33cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 May 2025 16:57:06 +0200 +Subject: nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable + +From: Keith Busch + +[ Upstream commit 3d8932133dcecbd9bef1559533c1089601006f45 ] + +We need to lock this queue for that condition because the timeout work +executes per-namespace and can poll the poll CQ. + +Reported-by: Hannes Reinecke +Closes: https://lore.kernel.org/all/20240902130728.1999-1-hare@kernel.org/ +Fixes: a0fa9647a54e ("NVMe: add blk polling support") +Signed-off-by: Keith Busch +Signed-off-by: Daniel Wagner +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 504dc05380350..265b3608ae26e 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -1202,7 +1202,9 @@ static void nvme_poll_irqdisable(struct nvme_queue *nvmeq) + WARN_ON_ONCE(test_bit(NVMEQ_POLLED, &nvmeq->flags)); + + disable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)); ++ spin_lock(&nvmeq->cq_poll_lock); + nvme_poll_cq(nvmeq, NULL); ++ spin_unlock(&nvmeq->cq_poll_lock); + enable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)); + } + +-- +2.39.5 + diff --git a/queue-6.12/nvme-pci-make-nvme_pci_npages_prp-__always_inline.patch b/queue-6.12/nvme-pci-make-nvme_pci_npages_prp-__always_inline.patch new file mode 100644 index 0000000000..ff5e32e3f3 --- /dev/null +++ b/queue-6.12/nvme-pci-make-nvme_pci_npages_prp-__always_inline.patch @@ -0,0 +1,64 @@ +From fe7b700a2be39d5d49481c1380141ad64adc3375 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 May 2025 20:35:40 -0700 +Subject: nvme-pci: make nvme_pci_npages_prp() __always_inline + +From: Kees Cook + +[ Upstream commit 40696426b8c8c4f13cf6ac52f0470eed144be4b2 ] + +The only reason nvme_pci_npages_prp() could be used as a compile-time +known result in BUILD_BUG_ON() is because the compiler was always choosing +to inline the function. Under special circumstances (sanitizer coverage +functions disabled for __init functions on ARCH=um), the compiler decided +to stop inlining it: + + drivers/nvme/host/pci.c: In function 'nvme_init': + include/linux/compiler_types.h:557:45: error: call to '__compiletime_assert_678' declared with attribute error: BUILD_BUG_ON failed: nvme_pci_npages_prp() > NVME_MAX_NR_ALLOCATIONS + 557 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) + | ^ + include/linux/compiler_types.h:538:25: note: in definition of macro '__compiletime_assert' + 538 | prefix ## suffix(); \ + | ^~~~~~ + include/linux/compiler_types.h:557:9: note: in expansion of macro '_compiletime_assert' + 557 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) + | ^~~~~~~~~~~~~~~~~~~ + include/linux/build_bug.h:39:37: note: in expansion of macro 'compiletime_assert' + 39 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg) + | ^~~~~~~~~~~~~~~~~~ + include/linux/build_bug.h:50:9: note: in expansion of macro 'BUILD_BUG_ON_MSG' + 50 | BUILD_BUG_ON_MSG(condition, "BUILD_BUG_ON failed: " #condition) + | ^~~~~~~~~~~~~~~~ + drivers/nvme/host/pci.c:3804:9: note: in expansion of macro 'BUILD_BUG_ON' + 3804 | BUILD_BUG_ON(nvme_pci_npages_prp() > NVME_MAX_NR_ALLOCATIONS); + | ^~~~~~~~~~~~ + +Force it to be __always_inline to make sure it is always available for +use with BUILD_BUG_ON(). + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202505061846.12FMyRjj-lkp@intel.com/ +Fixes: c372cdd1efdf ("nvme-pci: iod npages fits in s8") +Signed-off-by: Kees Cook +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 83ee433b69415..504dc05380350 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -390,7 +390,7 @@ static bool nvme_dbbuf_update_and_check_event(u16 value, __le32 *dbbuf_db, + * as it only leads to a small amount of wasted memory for the lifetime of + * the I/O. + */ +-static int nvme_pci_npages_prp(void) ++static __always_inline int nvme_pci_npages_prp(void) + { + unsigned max_bytes = (NVME_MAX_KB_SZ * 1024) + NVME_CTRL_PAGE_SIZE; + unsigned nprps = DIV_ROUND_UP(max_bytes, NVME_CTRL_PAGE_SIZE); +-- +2.39.5 + diff --git a/queue-6.12/nvmem-core-calculate-bin_attribute-size-through-bin_.patch b/queue-6.12/nvmem-core-calculate-bin_attribute-size-through-bin_.patch new file mode 100644 index 0000000000..e9807766aa --- /dev/null +++ b/queue-6.12/nvmem-core-calculate-bin_attribute-size-through-bin_.patch @@ -0,0 +1,62 @@ +From cb126f4a1336cec586d6ed31748ad6e8c84bffcb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Nov 2024 17:03:33 +0000 +Subject: nvmem: core: calculate bin_attribute size through bin_size() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 00ab6e97de0071b21a548e0a823348b3309970ba ] + +Stop abusing the is_bin_visible() callback to calculate the attribute +size. Instead use the new, dedicated bin_size() one. + +Signed-off-by: Thomas Weißschuh +Acked-by: Krzysztof Wilczyński +Link: https://lore.kernel.org/r/20241103-sysfs-const-bin_attr-v2-4-71110628844c@weissschuh.net +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: f31fe8165d36 ("uio_hv_generic: Fix sysfs creation path for ring buffer") +Signed-off-by: Sasha Levin +--- + drivers/nvmem/core.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c +index d00a3b015635c..e4775938b9d40 100644 +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -303,11 +303,19 @@ static umode_t nvmem_bin_attr_is_visible(struct kobject *kobj, + struct device *dev = kobj_to_dev(kobj); + struct nvmem_device *nvmem = to_nvmem_device(dev); + +- attr->size = nvmem->size; +- + return nvmem_bin_attr_get_umode(nvmem); + } + ++static size_t nvmem_bin_attr_size(struct kobject *kobj, ++ const struct bin_attribute *attr, ++ int i) ++{ ++ struct device *dev = kobj_to_dev(kobj); ++ struct nvmem_device *nvmem = to_nvmem_device(dev); ++ ++ return nvmem->size; ++} ++ + static umode_t nvmem_attr_is_visible(struct kobject *kobj, + struct attribute *attr, int i) + { +@@ -383,6 +391,7 @@ static const struct attribute_group nvmem_bin_group = { + .bin_attrs = nvmem_bin_attributes, + .attrs = nvmem_attrs, + .is_bin_visible = nvmem_bin_attr_is_visible, ++ .bin_size = nvmem_bin_attr_size, + .is_visible = nvmem_attr_is_visible, + }; + +-- +2.39.5 + diff --git a/queue-6.12/octeontx2-af-fix-cgx-receive-counters.patch b/queue-6.12/octeontx2-af-fix-cgx-receive-counters.patch new file mode 100644 index 0000000000..41a267079d --- /dev/null +++ b/queue-6.12/octeontx2-af-fix-cgx-receive-counters.patch @@ -0,0 +1,43 @@ +From 76d6b995ff13bc4d2ee14dac6b823d8d6fb96287 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 May 2025 12:45:54 +0530 +Subject: octeontx2-af: Fix CGX Receive counters + +From: Hariprasad Kelam + +[ Upstream commit bf449f35e77fd44017abf991fac1f9ab7705bbe0 ] + +Each CGX block supports 4 logical MACs (LMACS). Receive +counters CGX_CMR_RX_STAT0-8 are per LMAC and CGX_CMR_RX_STAT9-12 +are per CGX. + +Due a bug in previous patch, stale Per CGX counters values observed. + +Fixes: 66208910e57a ("octeontx2-af: Support to retrieve CGX LMAC stats") +Signed-off-by: Hariprasad Kelam +Link: https://patch.msgid.link/20250513071554.728922-1-hkelam@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +index 8216f843a7cd5..e43c4608d3ba3 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +@@ -707,6 +707,11 @@ int cgx_get_rx_stats(void *cgxd, int lmac_id, int idx, u64 *rx_stat) + + if (!is_lmac_valid(cgx, lmac_id)) + return -ENODEV; ++ ++ /* pass lmac as 0 for CGX_CMR_RX_STAT9-12 */ ++ if (idx >= CGX_RX_STAT_GLOBAL_INDEX) ++ lmac_id = 0; ++ + *rx_stat = cgx_read(cgx, lmac_id, CGXX_CMRX_RX_STAT0 + (idx * 8)); + return 0; + } +-- +2.39.5 + diff --git a/queue-6.12/octeontx2-pf-do-not-reallocate-all-ntuple-filters.patch b/queue-6.12/octeontx2-pf-do-not-reallocate-all-ntuple-filters.patch new file mode 100644 index 0000000000..dce39d9571 --- /dev/null +++ b/queue-6.12/octeontx2-pf-do-not-reallocate-all-ntuple-filters.patch @@ -0,0 +1,78 @@ +From 9b94855bdf3ec5c785dcc14ebe626b4a78187035 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 May 2025 18:22:37 +0530 +Subject: octeontx2-pf: Do not reallocate all ntuple filters + +From: Subbaraya Sundeep + +[ Upstream commit dcb479fde00be9a151c047d0a7c0626b64eb0019 ] + +If ntuple filters count is modified followed by +unicast filters count using devlink then the ntuple count +set by user is ignored and all the ntuple filters are +being reallocated. Fix this by storing the ntuple count +set by user. Without this patch, say if user tries +to modify ntuple count as 8 followed by ucast filter count as 4 +using devlink commands then ntuple count is being reverted to +default value 16 i.e, not retaining user set value 8. + +Fixes: 39c469188b6d ("octeontx2-pf: Add ucast filter count configurability via devlink.") +Signed-off-by: Subbaraya Sundeep +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/1747054357-5850-1-git-send-email-sbhatta@marvell.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h | 1 + + drivers/net/ethernet/marvell/octeontx2/nic/otx2_devlink.c | 1 + + drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c | 3 ++- + 3 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h +index f27a3456ae64f..5b45fd78d2825 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h +@@ -364,6 +364,7 @@ struct otx2_flow_config { + struct list_head flow_list_tc; + u8 ucast_flt_cnt; + bool ntuple; ++ u16 ntuple_cnt; + }; + + struct dev_hw_ops { +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_devlink.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_devlink.c +index 53f14aa944bdb..aaea19345750e 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_devlink.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_devlink.c +@@ -41,6 +41,7 @@ static int otx2_dl_mcam_count_set(struct devlink *devlink, u32 id, + if (!pfvf->flow_cfg) + return 0; + ++ pfvf->flow_cfg->ntuple_cnt = ctx->val.vu16; + otx2_alloc_mcam_entries(pfvf, ctx->val.vu16); + + return 0; +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c +index 58720a161ee24..2750326bfcf8b 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c +@@ -252,7 +252,7 @@ int otx2_mcam_entry_init(struct otx2_nic *pfvf) + mutex_unlock(&pfvf->mbox.lock); + + /* Allocate entries for Ntuple filters */ +- count = otx2_alloc_mcam_entries(pfvf, OTX2_DEFAULT_FLOWCOUNT); ++ count = otx2_alloc_mcam_entries(pfvf, flow_cfg->ntuple_cnt); + if (count <= 0) { + otx2_clear_ntuple_flow_info(pfvf, flow_cfg); + return 0; +@@ -312,6 +312,7 @@ int otx2_mcam_flow_init(struct otx2_nic *pf) + INIT_LIST_HEAD(&pf->flow_cfg->flow_list_tc); + + pf->flow_cfg->ucast_flt_cnt = OTX2_DEFAULT_UNICAST_FLOWS; ++ pf->flow_cfg->ntuple_cnt = OTX2_DEFAULT_FLOWCOUNT; + + /* Allocate bare minimum number of MCAM entries needed for + * unicast and ntuple filters. +-- +2.39.5 + diff --git a/queue-6.12/octeontx2-pf-macsec-fix-incorrect-max-transmit-size-.patch b/queue-6.12/octeontx2-pf-macsec-fix-incorrect-max-transmit-size-.patch new file mode 100644 index 0000000000..7c3f7655c1 --- /dev/null +++ b/queue-6.12/octeontx2-pf-macsec-fix-incorrect-max-transmit-size-.patch @@ -0,0 +1,47 @@ +From 6317786cae64c1f620dbf4c35d1b31d120404227 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 May 2025 18:12:36 +0530 +Subject: octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy + +From: Subbaraya Sundeep + +[ Upstream commit 865ab2461375e3a5a2526f91f9a9f17b8931bc9e ] + +MASCEC hardware block has a field called maximum transmit size for +TX secy. Max packet size going out of MCS block has be programmed +taking into account full packet size which has L2 header,SecTag +and ICV. MACSEC offload driver is configuring max transmit size as +macsec interface MTU which is incorrect. Say with 1500 MTU of real +device, macsec interface created on top of real device will have MTU of +1468(1500 - (SecTag + ICV)). This is causing packets from macsec +interface of size greater than or equal to 1468 are not getting +transmitted out because driver programmed max transmit size as 1468 +instead of 1514(1500 + ETH_HDR_LEN). + +Fixes: c54ffc73601c ("octeontx2-pf: mcs: Introduce MACSEC hardware offloading") +Signed-off-by: Subbaraya Sundeep +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/1747053756-4529-1-git-send-email-sbhatta@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c +index 6cc7a78968fc1..74953f67a2bf9 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c +@@ -533,7 +533,8 @@ static int cn10k_mcs_write_tx_secy(struct otx2_nic *pfvf, + if (sw_tx_sc->encrypt) + sectag_tci |= (MCS_TCI_E | MCS_TCI_C); + +- policy = FIELD_PREP(MCS_TX_SECY_PLCY_MTU, secy->netdev->mtu); ++ policy = FIELD_PREP(MCS_TX_SECY_PLCY_MTU, ++ pfvf->netdev->mtu + OTX2_ETH_HLEN); + /* Write SecTag excluding AN bits(1..0) */ + policy |= FIELD_PREP(MCS_TX_SECY_PLCY_ST_TCI, sectag_tci >> 2); + policy |= FIELD_PREP(MCS_TX_SECY_PLCY_ST_OFFSET, tag_offset); +-- +2.39.5 + diff --git a/queue-6.12/pci-sysfs-calculate-bin_attribute-size-through-bin_s.patch b/queue-6.12/pci-sysfs-calculate-bin_attribute-size-through-bin_s.patch new file mode 100644 index 0000000000..b74bdb698b --- /dev/null +++ b/queue-6.12/pci-sysfs-calculate-bin_attribute-size-through-bin_s.patch @@ -0,0 +1,92 @@ +From 393313393982448da3f49f75d27c513a876737bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Nov 2024 17:03:32 +0000 +Subject: PCI/sysfs: Calculate bin_attribute size through bin_size() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit a1ab720ee50686d9e9dcb6935995a75696ed2493 ] + +Stop abusing the is_bin_visible() callback to calculate the attribute +size. Instead use the new, dedicated bin_size() one. + +Signed-off-by: Thomas Weißschuh +Acked-by: Krzysztof Wilczyński +Link: https://lore.kernel.org/r/20241103-sysfs-const-bin_attr-v2-3-71110628844c@weissschuh.net +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: f31fe8165d36 ("uio_hv_generic: Fix sysfs creation path for ring buffer") +Signed-off-by: Sasha Levin +--- + drivers/pci/pci-sysfs.c | 28 ++++++++++++++++------------ + 1 file changed, 16 insertions(+), 12 deletions(-) + +diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c +index 5af4a804a4f89..f62402bafc19b 100644 +--- a/drivers/pci/pci-sysfs.c ++++ b/drivers/pci/pci-sysfs.c +@@ -844,21 +844,20 @@ static struct bin_attribute *pci_dev_config_attrs[] = { + NULL, + }; + +-static umode_t pci_dev_config_attr_is_visible(struct kobject *kobj, +- struct bin_attribute *a, int n) ++static size_t pci_dev_config_attr_bin_size(struct kobject *kobj, ++ const struct bin_attribute *a, ++ int n) + { + struct pci_dev *pdev = to_pci_dev(kobj_to_dev(kobj)); + +- a->size = PCI_CFG_SPACE_SIZE; + if (pdev->cfg_size > PCI_CFG_SPACE_SIZE) +- a->size = PCI_CFG_SPACE_EXP_SIZE; +- +- return a->attr.mode; ++ return PCI_CFG_SPACE_EXP_SIZE; ++ return PCI_CFG_SPACE_SIZE; + } + + static const struct attribute_group pci_dev_config_attr_group = { + .bin_attrs = pci_dev_config_attrs, +- .is_bin_visible = pci_dev_config_attr_is_visible, ++ .bin_size = pci_dev_config_attr_bin_size, + }; + + /* +@@ -1356,21 +1355,26 @@ static umode_t pci_dev_rom_attr_is_visible(struct kobject *kobj, + struct bin_attribute *a, int n) + { + struct pci_dev *pdev = to_pci_dev(kobj_to_dev(kobj)); +- size_t rom_size; + + /* If the device has a ROM, try to expose it in sysfs. */ +- rom_size = pci_resource_len(pdev, PCI_ROM_RESOURCE); +- if (!rom_size) ++ if (!pci_resource_end(pdev, PCI_ROM_RESOURCE)) + return 0; + +- a->size = rom_size; +- + return a->attr.mode; + } + ++static size_t pci_dev_rom_attr_bin_size(struct kobject *kobj, ++ const struct bin_attribute *a, int n) ++{ ++ struct pci_dev *pdev = to_pci_dev(kobj_to_dev(kobj)); ++ ++ return pci_resource_len(pdev, PCI_ROM_RESOURCE); ++} ++ + static const struct attribute_group pci_dev_rom_attr_group = { + .bin_attrs = pci_dev_rom_attrs, + .is_bin_visible = pci_dev_rom_attr_is_visible, ++ .bin_size = pci_dev_rom_attr_bin_size, + }; + + static ssize_t reset_store(struct device *dev, struct device_attribute *attr, +-- +2.39.5 + diff --git a/queue-6.12/platform-x86-amd-pmc-declare-quirk_spurious_8042-for.patch b/queue-6.12/platform-x86-amd-pmc-declare-quirk_spurious_8042-for.patch new file mode 100644 index 0000000000..ef12189e9d --- /dev/null +++ b/queue-6.12/platform-x86-amd-pmc-declare-quirk_spurious_8042-for.patch @@ -0,0 +1,69 @@ +From 0cbb7e1c8bcbd1fe797f111689286e14acff3a25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 May 2025 18:01:03 +0800 +Subject: platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO Wujie + 14XA (GX4HRXL) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Runhua He + +[ Upstream commit 0887817e4953885fbd6a5c1bec2fdd339261eb19 ] + +MECHREVO Wujie 14XA (GX4HRXL) wakes up immediately after s2idle entry. +This happens regardless of whether the laptop is plugged into AC power, +or whether any peripheral is plugged into the laptop. + +Similar to commit a55bdad5dfd1 ("platform/x86/amd/pmc: Disable keyboard +wakeup on AMD Framework 13"), the MECHREVO Wujie 14XA wakes up almost +instantly after s2idle suspend entry (IRQ1 is the keyboard): + +2025-04-18 17:23:57,588 DEBUG: PM: Triggering wakeup from IRQ 9 +2025-04-18 17:23:57,588 DEBUG: PM: Triggering wakeup from IRQ 1 + +Add this model to the spurious_8042 quirk to workaround this. + +This patch does not affect the wake-up function of the built-in keyboard. +Because the firmware of this machine adds an insurance for keyboard +wake-up events, as it always triggers an additional IRQ 9 to wake up the +system. + +Suggested-by: Mingcong Bai +Suggested-by: Xinhui Yang +Suggested-by: Rong Zhang +Fixes: a55bdad5dfd1 ("platform/x86/amd/pmc: Disable keyboard wakeup on AMD Framework 13") +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4166 +Cc: Mario Limonciello +Link: https://zhuanldan.zhihu.com/p/730538041 +Tested-by: Yemu Lu +Signed-off-by: Runhua He +Link: https://lore.kernel.org/r/20250507100103.995395-1-hua@aosc.io +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc/pmc-quirks.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c +index b4f49720c87f6..2e3f6fc67c568 100644 +--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c ++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c +@@ -217,6 +217,13 @@ static const struct dmi_system_id fwbug_list[] = { + DMI_MATCH(DMI_BIOS_VERSION, "03.05"), + } + }, ++ { ++ .ident = "MECHREVO Wujie 14X (GX4HRXL)", ++ .driver_data = &quirk_spurious_8042, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "WUJIE14-GX4HRXL"), ++ } ++ }, + {} + }; + +-- +2.39.5 + diff --git a/queue-6.12/platform-x86-asus-wmi-fix-wlan_ctrl_by_user-detectio.patch b/queue-6.12/platform-x86-asus-wmi-fix-wlan_ctrl_by_user-detectio.patch new file mode 100644 index 0000000000..3b594dc115 --- /dev/null +++ b/queue-6.12/platform-x86-asus-wmi-fix-wlan_ctrl_by_user-detectio.patch @@ -0,0 +1,76 @@ +From 32775d856133f5b401814999e69971fd2b55303e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 May 2025 15:17:02 +0200 +Subject: platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +[ Upstream commit bfcfe6d335a967f8ea0c1980960e6f0205b5de6e ] + +The wlan_ctrl_by_user detection was introduced by commit a50bd128f28c +("asus-wmi: record wlan status while controlled by userapp"). + +Quoting from that commit's commit message: + +""" +When you call WMIMethod(DSTS, 0x00010011) to get WLAN status, it may return + +(1) 0x00050001 (On) +(2) 0x00050000 (Off) +(3) 0x00030001 (On) +(4) 0x00030000 (Off) +(5) 0x00000002 (Unknown) + +(1), (2) means that the model has hardware GPIO for WLAN, you can call +WMIMethod(DEVS, 0x00010011, 1 or 0) to turn WLAN on/off. +(3), (4) means that the model doesn’t have hardware GPIO, you need to use +API or driver library to turn WLAN on/off, and call +WMIMethod(DEVS, 0x00010012, 1 or 0) to set WLAN LED status. +After you set WLAN LED status, you can see the WLAN status is changed with +WMIMethod(DSTS, 0x00010011). Because the status is recorded lastly +(ex: Windows), you can use it for synchronization. +(5) means that the model doesn’t have WLAN device. + +WLAN is the ONLY special case with upper rule. +""" + +The wlan_ctrl_by_user flag should be set on 0x0003000? ((3), (4) above) +return values, but the flag mistakenly also gets set on laptops with +0x0005000? ((1), (2)) return values. This is causing rfkill problems on +laptops where 0x0005000? is returned. + +Fix the check to only set the wlan_ctrl_by_user flag for 0x0003000? +return values. + +Fixes: a50bd128f28c ("asus-wmi: record wlan status while controlled by userapp") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=219786 +Signed-off-by: Hans de Goede +Reviewed-by: Armin Wolf +Link: https://lore.kernel.org/r/20250501131702.103360-2-hdegoede@redhat.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-wmi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index 1101e5b2488e5..a1cff9ff35a92 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -4795,7 +4795,8 @@ static int asus_wmi_add(struct platform_device *pdev) + goto fail_leds; + + asus_wmi_get_devstate(asus, ASUS_WMI_DEVID_WLAN, &result); +- if (result & (ASUS_WMI_DSTS_PRESENCE_BIT | ASUS_WMI_DSTS_USER_BIT)) ++ if ((result & (ASUS_WMI_DSTS_PRESENCE_BIT | ASUS_WMI_DSTS_USER_BIT)) == ++ (ASUS_WMI_DSTS_PRESENCE_BIT | ASUS_WMI_DSTS_USER_BIT)) + asus->driver->wlan_ctrl_by_user = 1; + + if (!(asus->driver->wlan_ctrl_by_user && ashs_present())) { +-- +2.39.5 + diff --git a/queue-6.12/qlcnic-fix-memory-leak-in-qlcnic_sriov_channel_cfg_c.patch b/queue-6.12/qlcnic-fix-memory-leak-in-qlcnic_sriov_channel_cfg_c.patch new file mode 100644 index 0000000000..0cf89c8b68 --- /dev/null +++ b/queue-6.12/qlcnic-fix-memory-leak-in-qlcnic_sriov_channel_cfg_c.patch @@ -0,0 +1,45 @@ +From 0ea42adb6af799c83638883c005e2c8f441c1482 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 May 2025 10:18:27 +0530 +Subject: qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd() + +From: Abdun Nihaal + +[ Upstream commit 9d8a99c5a7c7f4f7eca2c168a4ec254409670035 ] + +In one of the error paths in qlcnic_sriov_channel_cfg_cmd(), the memory +allocated in qlcnic_sriov_alloc_bc_mbx_args() for mailbox arguments is +not freed. Fix that by jumping to the error path that frees them, by +calling qlcnic_free_mbx_args(). This was found using static analysis. + +Fixes: f197a7aa6288 ("qlcnic: VF-PF communication channel implementation") +Signed-off-by: Abdun Nihaal +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250512044829.36400-1-abdun.nihaal@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +index 28d24d59efb84..d57b976b90409 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +@@ -1484,8 +1484,11 @@ static int qlcnic_sriov_channel_cfg_cmd(struct qlcnic_adapter *adapter, u8 cmd_o + } + + cmd_op = (cmd.rsp.arg[0] & 0xff); +- if (cmd.rsp.arg[0] >> 25 == 2) +- return 2; ++ if (cmd.rsp.arg[0] >> 25 == 2) { ++ ret = 2; ++ goto out; ++ } ++ + if (cmd_op == QLCNIC_BC_CMD_CHANNEL_INIT) + set_bit(QLC_BC_VF_STATE, &vf->state); + else +-- +2.39.5 + diff --git a/queue-6.12/rdma-core-fix-kasan-slab-use-after-free-read-in-ib_r.patch b/queue-6.12/rdma-core-fix-kasan-slab-use-after-free-read-in-ib_r.patch new file mode 100644 index 0000000000..bd86df6578 --- /dev/null +++ b/queue-6.12/rdma-core-fix-kasan-slab-use-after-free-read-in-ib_r.patch @@ -0,0 +1,93 @@ +From 18b6ab1f1262d08b13330bc8febad701bd440c2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 May 2025 17:10:08 +0200 +Subject: RDMA/core: Fix "KASAN: slab-use-after-free Read in + ib_register_device" problem + +From: Zhu Yanjun + +[ Upstream commit d0706bfd3ee40923c001c6827b786a309e2a8713 ] + +Call Trace: + + __dump_stack lib/dump_stack.c:94 [inline] + dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 + print_address_description mm/kasan/report.c:408 [inline] + print_report+0xc3/0x670 mm/kasan/report.c:521 + kasan_report+0xe0/0x110 mm/kasan/report.c:634 + strlen+0x93/0xa0 lib/string.c:420 + __fortify_strlen include/linux/fortify-string.h:268 [inline] + get_kobj_path_length lib/kobject.c:118 [inline] + kobject_get_path+0x3f/0x2a0 lib/kobject.c:158 + kobject_uevent_env+0x289/0x1870 lib/kobject_uevent.c:545 + ib_register_device drivers/infiniband/core/device.c:1472 [inline] + ib_register_device+0x8cf/0xe00 drivers/infiniband/core/device.c:1393 + rxe_register_device+0x275/0x320 drivers/infiniband/sw/rxe/rxe_verbs.c:1552 + rxe_net_add+0x8e/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:550 + rxe_newlink+0x70/0x190 drivers/infiniband/sw/rxe/rxe.c:225 + nldev_newlink+0x3a3/0x680 drivers/infiniband/core/nldev.c:1796 + rdma_nl_rcv_msg+0x387/0x6e0 drivers/infiniband/core/netlink.c:195 + rdma_nl_rcv_skb.constprop.0.isra.0+0x2e5/0x450 + netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] + netlink_unicast+0x53a/0x7f0 net/netlink/af_netlink.c:1339 + netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1883 + sock_sendmsg_nosec net/socket.c:712 [inline] + __sock_sendmsg net/socket.c:727 [inline] + ____sys_sendmsg+0xa95/0xc70 net/socket.c:2566 + ___sys_sendmsg+0x134/0x1d0 net/socket.c:2620 + __sys_sendmsg+0x16d/0x220 net/socket.c:2652 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +This problem is similar to the problem that the +commit 1d6a9e7449e2 ("RDMA/core: Fix use-after-free when rename device name") +fixes. + +The root cause is: the function ib_device_rename() renames the name with +lock. But in the function kobject_uevent(), this name is accessed without +lock protection at the same time. + +The solution is to add the lock protection when this name is accessed in +the function kobject_uevent(). + +Fixes: 779e0bf47632 ("RDMA/core: Do not indicate device ready when device enablement fails") +Link: https://patch.msgid.link/r/20250506151008.75701-1-yanjun.zhu@linux.dev +Reported-by: syzbot+e2ce9e275ecc70a30b72@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=e2ce9e275ecc70a30b72 +Signed-off-by: Zhu Yanjun +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/device.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c +index 46102f179955b..df2aa15a5bc9b 100644 +--- a/drivers/infiniband/core/device.c ++++ b/drivers/infiniband/core/device.c +@@ -1368,6 +1368,9 @@ static void ib_device_notify_register(struct ib_device *device) + + down_read(&devices_rwsem); + ++ /* Mark for userspace that device is ready */ ++ kobject_uevent(&device->dev.kobj, KOBJ_ADD); ++ + ret = rdma_nl_notify_event(device, 0, RDMA_REGISTER_EVENT); + if (ret) + goto out; +@@ -1484,10 +1487,9 @@ int ib_register_device(struct ib_device *device, const char *name, + return ret; + } + dev_set_uevent_suppress(&device->dev, false); +- /* Mark for userspace that device is ready */ +- kobject_uevent(&device->dev.kobj, KOBJ_ADD); + + ib_device_notify_register(device); ++ + ib_device_put(device); + + return 0; +-- +2.39.5 + diff --git a/queue-6.12/rdma-rxe-fix-slab-use-after-free-read-in-rxe_queue_c.patch b/queue-6.12/rdma-rxe-fix-slab-use-after-free-read-in-rxe_queue_c.patch new file mode 100644 index 0000000000..08e3d321b3 --- /dev/null +++ b/queue-6.12/rdma-rxe-fix-slab-use-after-free-read-in-rxe_queue_c.patch @@ -0,0 +1,69 @@ +From 881c56e91bd5cb2c05abab8cef86e20bc741ec2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Apr 2025 09:57:14 +0200 +Subject: RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug + +From: Zhu Yanjun + +[ Upstream commit f81b33582f9339d2dc17c69b92040d3650bb4bae ] + +Call Trace: + + __dump_stack lib/dump_stack.c:94 [inline] + dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120 + print_address_description mm/kasan/report.c:378 [inline] + print_report+0xcf/0x610 mm/kasan/report.c:489 + kasan_report+0xb5/0xe0 mm/kasan/report.c:602 + rxe_queue_cleanup+0xd0/0xe0 drivers/infiniband/sw/rxe/rxe_queue.c:195 + rxe_cq_cleanup+0x3f/0x50 drivers/infiniband/sw/rxe/rxe_cq.c:132 + __rxe_cleanup+0x168/0x300 drivers/infiniband/sw/rxe/rxe_pool.c:232 + rxe_create_cq+0x22e/0x3a0 drivers/infiniband/sw/rxe/rxe_verbs.c:1109 + create_cq+0x658/0xb90 drivers/infiniband/core/uverbs_cmd.c:1052 + ib_uverbs_create_cq+0xc7/0x120 drivers/infiniband/core/uverbs_cmd.c:1095 + ib_uverbs_write+0x969/0xc90 drivers/infiniband/core/uverbs_main.c:679 + vfs_write fs/read_write.c:677 [inline] + vfs_write+0x26a/0xcc0 fs/read_write.c:659 + ksys_write+0x1b8/0x200 fs/read_write.c:731 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +In the function rxe_create_cq, when rxe_cq_from_init fails, the function +rxe_cleanup will be called to handle the allocated resources. In fact, +some memory resources have already been freed in the function +rxe_cq_from_init. Thus, this problem will occur. + +The solution is to let rxe_cleanup do all the work. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Link: https://paste.ubuntu.com/p/tJgC42wDf6/ +Tested-by: liuyi +Signed-off-by: Zhu Yanjun +Link: https://patch.msgid.link/20250412075714.3257358-1-yanjun.zhu@linux.dev +Reviewed-by: Daisuke Matsuda +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_cq.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c +index fec87c9030abd..fffd144d509eb 100644 +--- a/drivers/infiniband/sw/rxe/rxe_cq.c ++++ b/drivers/infiniband/sw/rxe/rxe_cq.c +@@ -56,11 +56,8 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe, + + err = do_mmap_info(rxe, uresp ? &uresp->mi : NULL, udata, + cq->queue->buf, cq->queue->buf_size, &cq->queue->ip); +- if (err) { +- vfree(cq->queue->buf); +- kfree(cq->queue); ++ if (err) + return err; +- } + + cq->is_user = uresp; + +-- +2.39.5 + diff --git a/queue-6.12/regulator-max20086-fix-invalid-memory-access.patch b/queue-6.12/regulator-max20086-fix-invalid-memory-access.patch new file mode 100644 index 0000000000..28d3caff30 --- /dev/null +++ b/queue-6.12/regulator-max20086-fix-invalid-memory-access.patch @@ -0,0 +1,73 @@ +From 58c6fe2321685a57548cbfe3fc086dd8a26ccbb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 May 2025 09:49:43 +0300 +Subject: regulator: max20086: fix invalid memory access + +From: Cosmin Tanislav + +[ Upstream commit 6b0cd72757c69bc2d45da42b41023e288d02e772 ] + +max20086_parse_regulators_dt() calls of_regulator_match() using an +array of struct of_regulator_match allocated on the stack for the +matches argument. + +of_regulator_match() calls devm_of_regulator_put_matches(), which calls +devres_alloc() to allocate a struct devm_of_regulator_matches which will +be de-allocated using devm_of_regulator_put_matches(). + +struct devm_of_regulator_matches is populated with the stack allocated +matches array. + +If the device fails to probe, devm_of_regulator_put_matches() will be +called and will try to call of_node_put() on that stack pointer, +generating the following dmesg entries: + +max20086 6-0028: Failed to read DEVICE_ID reg: -121 +kobject: '\xc0$\xa5\x03' (000000002cebcb7a): is not initialized, yet +kobject_put() is being called. + +Followed by a stack trace matching the call flow described above. + +Switch to allocating the matches array using devm_kcalloc() to +avoid accessing the stack pointer long after it's out of scope. + +This also has the advantage of allowing multiple max20086 to probe +without overriding the data stored inside the global of_regulator_match. + +Fixes: bfff546aae50 ("regulator: Add MAX20086-MAX20089 driver") +Signed-off-by: Cosmin Tanislav +Link: https://patch.msgid.link/20250508064947.2567255-1-demonsingur@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/max20086-regulator.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/regulator/max20086-regulator.c b/drivers/regulator/max20086-regulator.c +index 59eb23d467ec0..198d45f8e8849 100644 +--- a/drivers/regulator/max20086-regulator.c ++++ b/drivers/regulator/max20086-regulator.c +@@ -132,7 +132,7 @@ static int max20086_regulators_register(struct max20086 *chip) + + static int max20086_parse_regulators_dt(struct max20086 *chip, bool *boot_on) + { +- struct of_regulator_match matches[MAX20086_MAX_REGULATORS] = { }; ++ struct of_regulator_match *matches; + struct device_node *node; + unsigned int i; + int ret; +@@ -143,6 +143,11 @@ static int max20086_parse_regulators_dt(struct max20086 *chip, bool *boot_on) + return -ENODEV; + } + ++ matches = devm_kcalloc(chip->dev, chip->info->num_outputs, ++ sizeof(*matches), GFP_KERNEL); ++ if (!matches) ++ return -ENOMEM; ++ + for (i = 0; i < chip->info->num_outputs; ++i) + matches[i].name = max20086_output_names[i]; + +-- +2.39.5 + diff --git a/queue-6.12/revert-drm-amd-stop-evicting-resources-on-apus-in-su.patch b/queue-6.12/revert-drm-amd-stop-evicting-resources-on-apus-in-su.patch new file mode 100644 index 0000000000..631faea453 --- /dev/null +++ b/queue-6.12/revert-drm-amd-stop-evicting-resources-on-apus-in-su.patch @@ -0,0 +1,114 @@ +From fcd87bd66823bf3c7a511f4c8b1f9f630c9c03c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 May 2025 13:00:16 -0400 +Subject: Revert "drm/amd: Stop evicting resources on APUs in suspend" + +From: Alex Deucher + +[ Upstream commit d0ce1aaa8531a4a4707711cab5721374751c51b0 ] + +This reverts commit 3a9626c816db901def438dc2513622e281186d39. + +This breaks S4 because we end up setting the s3/s0ix flags +even when we are entering s4 since prepare is used by both +flows. The causes both the S3/s0ix and s4 flags to be set +which breaks several checks in the driver which assume they +are mutually exclusive. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3634 +Cc: Mario Limonciello +Reviewed-by: Mario Limonciello +Signed-off-by: Alex Deucher +(cherry picked from commit ce8f7d95899c2869b47ea6ce0b3e5bf304b2fff4) +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 -- + drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 18 ------------------ + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 11 ++--------- + 3 files changed, 2 insertions(+), 29 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +index 8050e0960f5e2..7edf8d67a0fa5 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +@@ -1571,11 +1571,9 @@ static inline void amdgpu_acpi_get_backlight_caps(struct amdgpu_dm_backlight_cap + #if defined(CONFIG_ACPI) && defined(CONFIG_SUSPEND) + bool amdgpu_acpi_is_s3_active(struct amdgpu_device *adev); + bool amdgpu_acpi_is_s0ix_active(struct amdgpu_device *adev); +-void amdgpu_choose_low_power_state(struct amdgpu_device *adev); + #else + static inline bool amdgpu_acpi_is_s0ix_active(struct amdgpu_device *adev) { return false; } + static inline bool amdgpu_acpi_is_s3_active(struct amdgpu_device *adev) { return false; } +-static inline void amdgpu_choose_low_power_state(struct amdgpu_device *adev) { } + #endif + + void amdgpu_register_gpu_instance(struct amdgpu_device *adev); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +index b8d4e07d2043e..bebfbc1497d8e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +@@ -1533,22 +1533,4 @@ bool amdgpu_acpi_is_s0ix_active(struct amdgpu_device *adev) + #endif /* CONFIG_AMD_PMC */ + } + +-/** +- * amdgpu_choose_low_power_state +- * +- * @adev: amdgpu_device_pointer +- * +- * Choose the target low power state for the GPU +- */ +-void amdgpu_choose_low_power_state(struct amdgpu_device *adev) +-{ +- if (adev->in_runpm) +- return; +- +- if (amdgpu_acpi_is_s0ix_active(adev)) +- adev->in_s0ix = true; +- else if (amdgpu_acpi_is_s3_active(adev)) +- adev->in_s3 = true; +-} +- + #endif /* CONFIG_SUSPEND */ +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index e6c8426fa06ec..1ed84648733ee 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -4770,15 +4770,13 @@ int amdgpu_device_prepare(struct drm_device *dev) + struct amdgpu_device *adev = drm_to_adev(dev); + int i, r; + +- amdgpu_choose_low_power_state(adev); +- + if (dev->switch_power_state == DRM_SWITCH_POWER_OFF) + return 0; + + /* Evict the majority of BOs before starting suspend sequence */ + r = amdgpu_device_evict_resources(adev); + if (r) +- goto unprepare; ++ return r; + + flush_delayed_work(&adev->gfx.gfx_off_delay_work); + +@@ -4789,15 +4787,10 @@ int amdgpu_device_prepare(struct drm_device *dev) + continue; + r = adev->ip_blocks[i].version->funcs->prepare_suspend((void *)adev); + if (r) +- goto unprepare; ++ return r; + } + + return 0; +- +-unprepare: +- adev->in_s0ix = adev->in_s3 = adev->in_s4 = false; +- +- return r; + } + + /** +-- +2.39.5 + diff --git a/queue-6.12/riscv-dts-sophgo-fix-dma-data-width-configuration-fo.patch b/queue-6.12/riscv-dts-sophgo-fix-dma-data-width-configuration-fo.patch new file mode 100644 index 0000000000..ad691a184a --- /dev/null +++ b/queue-6.12/riscv-dts-sophgo-fix-dma-data-width-configuration-fo.patch @@ -0,0 +1,57 @@ +From 574b84ad3675d194c391b9c0b5c3ed70f41feac3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Apr 2025 17:24:36 +0800 +Subject: riscv: dts: sophgo: fix DMA data-width configuration for CV18xx +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ze Huang + +[ Upstream commit 3e6244429ba38f8dee3336b8b805948276b281ab ] + +The "snps,data-width" property[1] defines the AXI data width of the DMA +controller as: + + width = 8 × (2^n) bits + +(0 = 8 bits, 1 = 16 bits, 2 = 32 bits, ..., 6 = 512 bits) +where "n" is the value of "snps,data-width". + +For the CV18xx DMA controller, the correct AXI data width is 32 bits, +corresponding to "snps,data-width = 2". + +Test results on Milkv Duo S can be found here [2]. + +Link: https://github.com/torvalds/linux/blob/master/Documentation/devicetree/bindings/dma/snps%2Cdw-axi-dmac.yaml#L74 [1] +Link: https://gist.github.com/Sutter099/4fa99bb2d89e5af975983124704b3861 [2] + +Fixes: 514951a81a5e ("riscv: dts: sophgo: cv18xx: add DMA controller") +Co-developed-by: Yu Yuan +Signed-off-by: Yu Yuan +Signed-off-by: Ze Huang +Link: https://lore.kernel.org/r/20250428-duo-dma-config-v1-1-eb6ad836ca42@whut.edu.cn +Signed-off-by: Inochi Amaoto +Signed-off-by: Chen Wang +Signed-off-by: Chen Wang +Signed-off-by: Sasha Levin +--- + arch/riscv/boot/dts/sophgo/cv18xx.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/riscv/boot/dts/sophgo/cv18xx.dtsi b/arch/riscv/boot/dts/sophgo/cv18xx.dtsi +index b724fb6d9689e..b8063ba6d6d7f 100644 +--- a/arch/riscv/boot/dts/sophgo/cv18xx.dtsi ++++ b/arch/riscv/boot/dts/sophgo/cv18xx.dtsi +@@ -309,7 +309,7 @@ + 1024 1024 1024 1024>; + snps,priority = <0 1 2 3 4 5 6 7>; + snps,dma-masters = <2>; +- snps,data-width = <4>; ++ snps,data-width = <2>; + status = "disabled"; + }; + +-- +2.39.5 + diff --git a/queue-6.12/sched_ext-fix-missing-rq-lock-in-scx_bpf_cpuperf_set.patch b/queue-6.12/sched_ext-fix-missing-rq-lock-in-scx_bpf_cpuperf_set.patch new file mode 100644 index 0000000000..4e199df784 --- /dev/null +++ b/queue-6.12/sched_ext-fix-missing-rq-lock-in-scx_bpf_cpuperf_set.patch @@ -0,0 +1,81 @@ +From b19ccb5dc4d3d35b83b94fe2514456dc0b3a9ba5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Apr 2025 10:26:33 +0200 +Subject: sched_ext: Fix missing rq lock in scx_bpf_cpuperf_set() + +From: Andrea Righi + +[ Upstream commit a11d6784d7316a6c77ca9f14fb1a698ebbb3c1fb ] + +scx_bpf_cpuperf_set() can be used to set a performance target level on +any CPU. However, it doesn't correctly acquire the corresponding rq +lock, which may lead to unsafe behavior and trigger the following +warning, due to the lockdep_assert_rq_held() check: + +[ 51.713737] WARNING: CPU: 3 PID: 3899 at kernel/sched/sched.h:1512 scx_bpf_cpuperf_set+0x1a0/0x1e0 +... +[ 51.713836] Call trace: +[ 51.713837] scx_bpf_cpuperf_set+0x1a0/0x1e0 (P) +[ 51.713839] bpf_prog_62d35beb9301601f_bpfland_init+0x168/0x440 +[ 51.713841] bpf__sched_ext_ops_init+0x54/0x8c +[ 51.713843] scx_ops_enable.constprop.0+0x2c0/0x10f0 +[ 51.713845] bpf_scx_reg+0x18/0x30 +[ 51.713847] bpf_struct_ops_link_create+0x154/0x1b0 +[ 51.713849] __sys_bpf+0x1934/0x22a0 + +Fix by properly acquiring the rq lock when possible or raising an error +if we try to operate on a CPU that is not the one currently locked. + +Fixes: d86adb4fc0655 ("sched_ext: Add cpuperf support") +Signed-off-by: Andrea Righi +Acked-by: Changwoo Min +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/sched/ext.c | 27 +++++++++++++++++++++++---- + 1 file changed, 23 insertions(+), 4 deletions(-) + +diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c +index 7ed25654820fd..0147c4452f4df 100644 +--- a/kernel/sched/ext.c ++++ b/kernel/sched/ext.c +@@ -7018,13 +7018,32 @@ __bpf_kfunc void scx_bpf_cpuperf_set(s32 cpu, u32 perf) + } + + if (ops_cpu_valid(cpu, NULL)) { +- struct rq *rq = cpu_rq(cpu); ++ struct rq *rq = cpu_rq(cpu), *locked_rq = scx_locked_rq(); ++ struct rq_flags rf; ++ ++ /* ++ * When called with an rq lock held, restrict the operation ++ * to the corresponding CPU to prevent ABBA deadlocks. ++ */ ++ if (locked_rq && rq != locked_rq) { ++ scx_ops_error("Invalid target CPU %d", cpu); ++ return; ++ } ++ ++ /* ++ * If no rq lock is held, allow to operate on any CPU by ++ * acquiring the corresponding rq lock. ++ */ ++ if (!locked_rq) { ++ rq_lock_irqsave(rq, &rf); ++ update_rq_clock(rq); ++ } + + rq->scx.cpuperf_target = perf; ++ cpufreq_update_util(rq, 0); + +- rcu_read_lock_sched_notrace(); +- cpufreq_update_util(cpu_rq(cpu), 0); +- rcu_read_unlock_sched_notrace(); ++ if (!locked_rq) ++ rq_unlock_irqrestore(rq, &rf); + } + } + +-- +2.39.5 + diff --git a/queue-6.12/selftests-ncdevmem-make-client_ip-optional.patch b/queue-6.12/selftests-ncdevmem-make-client_ip-optional.patch new file mode 100644 index 0000000000..440ee88e8b --- /dev/null +++ b/queue-6.12/selftests-ncdevmem-make-client_ip-optional.patch @@ -0,0 +1,56 @@ +From 0da407a691c585dc214f57224fcd4180929f94b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 10:12:03 -0800 +Subject: selftests: ncdevmem: Make client_ip optional + +From: Stanislav Fomichev + +[ Upstream commit 0ebd75f5f2392c2ada04c6e11447415911fe1506 ] + +Support 3-tuple filtering by making client_ip optional. When -c is +not passed, don't specify src-ip/src-port in the filter. + +Reviewed-by: Mina Almasry +Reviewed-by: Joe Damato +Signed-off-by: Stanislav Fomichev +Link: https://patch.msgid.link/20241107181211.3934153-5-sdf@fomichev.me +Signed-off-by: Jakub Kicinski +Stable-dep-of: 97c4e094a4b2 ("tests/ncdevmem: Fix double-free of queue array") +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/ncdevmem.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/net/ncdevmem.c b/tools/testing/selftests/net/ncdevmem.c +index 4733d1a0aab5d..faa9dce121c72 100644 +--- a/tools/testing/selftests/net/ncdevmem.c ++++ b/tools/testing/selftests/net/ncdevmem.c +@@ -62,7 +62,7 @@ + */ + + static char *server_ip = "192.168.1.4"; +-static char *client_ip = "192.168.1.2"; ++static char *client_ip; + static char *port = "5201"; + static size_t do_validation; + static int start_queue = 8; +@@ -236,8 +236,14 @@ static int configure_channels(unsigned int rx, unsigned int tx) + + static int configure_flow_steering(void) + { +- return run_command("sudo ethtool -N %s flow-type tcp4 src-ip %s dst-ip %s src-port %s dst-port %s queue %d >&2", +- ifname, client_ip, server_ip, port, port, start_queue); ++ return run_command("sudo ethtool -N %s flow-type tcp4 %s %s dst-ip %s %s %s dst-port %s queue %d >&2", ++ ifname, ++ client_ip ? "src-ip" : "", ++ client_ip ?: "", ++ server_ip, ++ client_ip ? "src-port" : "", ++ client_ip ? port : "", ++ port, start_queue); + } + + static int bind_rx_queue(unsigned int ifindex, unsigned int dmabuf_fd, +-- +2.39.5 + diff --git a/queue-6.12/selftests-ncdevmem-redirect-all-non-payload-output-t.patch b/queue-6.12/selftests-ncdevmem-redirect-all-non-payload-output-t.patch new file mode 100644 index 0000000000..7d1a247f87 --- /dev/null +++ b/queue-6.12/selftests-ncdevmem-redirect-all-non-payload-output-t.patch @@ -0,0 +1,223 @@ +From fb439d1b06f5d666e04f9776445ac738bddc8199 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 10:12:00 -0800 +Subject: selftests: ncdevmem: Redirect all non-payload output to stderr + +From: Stanislav Fomichev + +[ Upstream commit 6891f0b523e1ef452523ba43d67ca2a654760e78 ] + +That should make it possible to do expected payload validation on +the caller side. + +Reviewed-by: Mina Almasry +Reviewed-by: Joe Damato +Signed-off-by: Stanislav Fomichev +Link: https://patch.msgid.link/20241107181211.3934153-2-sdf@fomichev.me +Signed-off-by: Jakub Kicinski +Stable-dep-of: 97c4e094a4b2 ("tests/ncdevmem: Fix double-free of queue array") +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/ncdevmem.c | 61 +++++++++++++------------- + 1 file changed, 30 insertions(+), 31 deletions(-) + +diff --git a/tools/testing/selftests/net/ncdevmem.c b/tools/testing/selftests/net/ncdevmem.c +index 64d6805381c50..9245d3f158dd3 100644 +--- a/tools/testing/selftests/net/ncdevmem.c ++++ b/tools/testing/selftests/net/ncdevmem.c +@@ -88,7 +88,6 @@ void print_nonzero_bytes(void *ptr, size_t size) + + for (i = 0; i < size; i++) + putchar(p[i]); +- printf("\n"); + } + + void validate_buffer(void *line, size_t size) +@@ -120,7 +119,7 @@ void validate_buffer(void *line, size_t size) + char command[256]; \ + memset(command, 0, sizeof(command)); \ + snprintf(command, sizeof(command), cmd, ##__VA_ARGS__); \ +- printf("Running: %s\n", command); \ ++ fprintf(stderr, "Running: %s\n", command); \ + system(command); \ + }) + +@@ -128,22 +127,22 @@ static int reset_flow_steering(void) + { + int ret = 0; + +- ret = run_command("sudo ethtool -K %s ntuple off", ifname); ++ ret = run_command("sudo ethtool -K %s ntuple off >&2", ifname); + if (ret) + return ret; + +- return run_command("sudo ethtool -K %s ntuple on", ifname); ++ return run_command("sudo ethtool -K %s ntuple on >&2", ifname); + } + + static int configure_headersplit(bool on) + { +- return run_command("sudo ethtool -G %s tcp-data-split %s", ifname, ++ return run_command("sudo ethtool -G %s tcp-data-split %s >&2", ifname, + on ? "on" : "off"); + } + + static int configure_rss(void) + { +- return run_command("sudo ethtool -X %s equal %d", ifname, start_queue); ++ return run_command("sudo ethtool -X %s equal %d >&2", ifname, start_queue); + } + + static int configure_channels(unsigned int rx, unsigned int tx) +@@ -153,7 +152,7 @@ static int configure_channels(unsigned int rx, unsigned int tx) + + static int configure_flow_steering(void) + { +- return run_command("sudo ethtool -N %s flow-type tcp4 src-ip %s dst-ip %s src-port %s dst-port %s queue %d", ++ return run_command("sudo ethtool -N %s flow-type tcp4 src-ip %s dst-ip %s src-port %s dst-port %s queue %d >&2", + ifname, client_ip, server_ip, port, port, start_queue); + } + +@@ -187,7 +186,7 @@ static int bind_rx_queue(unsigned int ifindex, unsigned int dmabuf_fd, + goto err_close; + } + +- printf("got dmabuf id=%d\n", rsp->id); ++ fprintf(stderr, "got dmabuf id=%d\n", rsp->id); + dmabuf_id = rsp->id; + + netdev_bind_rx_req_free(req); +@@ -314,8 +313,8 @@ int do_server(void) + if (ret) + error(errno, errno, "%s: [FAIL, set sock opt]\n", TEST_PREFIX); + +- printf("binding to address %s:%d\n", server_ip, +- ntohs(server_sin.sin_port)); ++ fprintf(stderr, "binding to address %s:%d\n", server_ip, ++ ntohs(server_sin.sin_port)); + + ret = bind(socket_fd, &server_sin, sizeof(server_sin)); + if (ret) +@@ -329,14 +328,14 @@ int do_server(void) + + inet_ntop(server_sin.sin_family, &server_sin.sin_addr, buffer, + sizeof(buffer)); +- printf("Waiting or connection on %s:%d\n", buffer, +- ntohs(server_sin.sin_port)); ++ fprintf(stderr, "Waiting or connection on %s:%d\n", buffer, ++ ntohs(server_sin.sin_port)); + client_fd = accept(socket_fd, &client_addr, &client_addr_len); + + inet_ntop(client_addr.sin_family, &client_addr.sin_addr, buffer, + sizeof(buffer)); +- printf("Got connection from %s:%d\n", buffer, +- ntohs(client_addr.sin_port)); ++ fprintf(stderr, "Got connection from %s:%d\n", buffer, ++ ntohs(client_addr.sin_port)); + + while (1) { + struct iovec iov = { .iov_base = iobuf, +@@ -349,14 +348,13 @@ int do_server(void) + ssize_t ret; + + is_devmem = false; +- printf("\n\n"); + + msg.msg_iov = &iov; + msg.msg_iovlen = 1; + msg.msg_control = ctrl_data; + msg.msg_controllen = sizeof(ctrl_data); + ret = recvmsg(client_fd, &msg, MSG_SOCK_DEVMEM); +- printf("recvmsg ret=%ld\n", ret); ++ fprintf(stderr, "recvmsg ret=%ld\n", ret); + if (ret < 0 && (errno == EAGAIN || errno == EWOULDBLOCK)) + continue; + if (ret < 0) { +@@ -364,7 +362,7 @@ int do_server(void) + continue; + } + if (ret == 0) { +- printf("client exited\n"); ++ fprintf(stderr, "client exited\n"); + goto cleanup; + } + +@@ -373,7 +371,7 @@ int do_server(void) + if (cm->cmsg_level != SOL_SOCKET || + (cm->cmsg_type != SCM_DEVMEM_DMABUF && + cm->cmsg_type != SCM_DEVMEM_LINEAR)) { +- fprintf(stdout, "skipping non-devmem cmsg\n"); ++ fprintf(stderr, "skipping non-devmem cmsg\n"); + continue; + } + +@@ -384,7 +382,7 @@ int do_server(void) + /* TODO: process data copied from skb's linear + * buffer. + */ +- fprintf(stdout, ++ fprintf(stderr, + "SCM_DEVMEM_LINEAR. dmabuf_cmsg->frag_size=%u\n", + dmabuf_cmsg->frag_size); + +@@ -395,12 +393,13 @@ int do_server(void) + token.token_count = 1; + + total_received += dmabuf_cmsg->frag_size; +- printf("received frag_page=%llu, in_page_offset=%llu, frag_offset=%llu, frag_size=%u, token=%u, total_received=%lu, dmabuf_id=%u\n", +- dmabuf_cmsg->frag_offset >> PAGE_SHIFT, +- dmabuf_cmsg->frag_offset % getpagesize(), +- dmabuf_cmsg->frag_offset, dmabuf_cmsg->frag_size, +- dmabuf_cmsg->frag_token, total_received, +- dmabuf_cmsg->dmabuf_id); ++ fprintf(stderr, ++ "received frag_page=%llu, in_page_offset=%llu, frag_offset=%llu, frag_size=%u, token=%u, total_received=%lu, dmabuf_id=%u\n", ++ dmabuf_cmsg->frag_offset >> PAGE_SHIFT, ++ dmabuf_cmsg->frag_offset % getpagesize(), ++ dmabuf_cmsg->frag_offset, ++ dmabuf_cmsg->frag_size, dmabuf_cmsg->frag_token, ++ total_received, dmabuf_cmsg->dmabuf_id); + + if (dmabuf_cmsg->dmabuf_id != dmabuf_id) + error(1, 0, +@@ -438,15 +437,15 @@ int do_server(void) + if (!is_devmem) + error(1, 0, "flow steering error\n"); + +- printf("total_received=%lu\n", total_received); ++ fprintf(stderr, "total_received=%lu\n", total_received); + } + +- fprintf(stdout, "%s: ok\n", TEST_PREFIX); ++ fprintf(stderr, "%s: ok\n", TEST_PREFIX); + +- fprintf(stdout, "page_aligned_frags=%lu, non_page_aligned_frags=%lu\n", ++ fprintf(stderr, "page_aligned_frags=%lu, non_page_aligned_frags=%lu\n", + page_aligned_frags, non_page_aligned_frags); + +- fprintf(stdout, "page_aligned_frags=%lu, non_page_aligned_frags=%lu\n", ++ fprintf(stderr, "page_aligned_frags=%lu, non_page_aligned_frags=%lu\n", + page_aligned_frags, non_page_aligned_frags); + + cleanup: +@@ -551,7 +550,7 @@ int main(int argc, char *argv[]) + ifname = optarg; + break; + case '?': +- printf("unknown option: %c\n", optopt); ++ fprintf(stderr, "unknown option: %c\n", optopt); + break; + } + } +@@ -559,7 +558,7 @@ int main(int argc, char *argv[]) + ifindex = if_nametoindex(ifname); + + for (; optind < argc; optind++) +- printf("extra arguments: %s\n", argv[optind]); ++ fprintf(stderr, "extra arguments: %s\n", argv[optind]); + + run_devmem_tests(); + +-- +2.39.5 + diff --git a/queue-6.12/selftests-ncdevmem-separate-out-dmabuf-provider.patch b/queue-6.12/selftests-ncdevmem-separate-out-dmabuf-provider.patch new file mode 100644 index 0000000000..1f6e18e985 --- /dev/null +++ b/queue-6.12/selftests-ncdevmem-separate-out-dmabuf-provider.patch @@ -0,0 +1,351 @@ +From 21cc6cabde4349a8d2a4b2e3d33216dd268a0956 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 10:12:01 -0800 +Subject: selftests: ncdevmem: Separate out dmabuf provider + +From: Stanislav Fomichev + +[ Upstream commit 8b9049af8066b4705d83bb7847ee3c960fc58d09 ] + +So we can plug the other ones in the future if needed. + +Reviewed-by: Mina Almasry +Reviewed-by: Joe Damato +Signed-off-by: Stanislav Fomichev +Link: https://patch.msgid.link/20241107181211.3934153-3-sdf@fomichev.me +Signed-off-by: Jakub Kicinski +Stable-dep-of: 97c4e094a4b2 ("tests/ncdevmem: Fix double-free of queue array") +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/ncdevmem.c | 203 +++++++++++++++---------- + 1 file changed, 119 insertions(+), 84 deletions(-) + +diff --git a/tools/testing/selftests/net/ncdevmem.c b/tools/testing/selftests/net/ncdevmem.c +index 9245d3f158dd3..3e7ef2eedd60b 100644 +--- a/tools/testing/selftests/net/ncdevmem.c ++++ b/tools/testing/selftests/net/ncdevmem.c +@@ -71,17 +71,101 @@ static char *ifname = "eth1"; + static unsigned int ifindex; + static unsigned int dmabuf_id; + +-void print_bytes(void *ptr, size_t size) ++struct memory_buffer { ++ int fd; ++ size_t size; ++ ++ int devfd; ++ int memfd; ++ char *buf_mem; ++}; ++ ++struct memory_provider { ++ struct memory_buffer *(*alloc)(size_t size); ++ void (*free)(struct memory_buffer *ctx); ++ void (*memcpy_from_device)(void *dst, struct memory_buffer *src, ++ size_t off, int n); ++}; ++ ++static struct memory_buffer *udmabuf_alloc(size_t size) + { +- unsigned char *p = ptr; +- int i; ++ struct udmabuf_create create; ++ struct memory_buffer *ctx; ++ int ret; + +- for (i = 0; i < size; i++) +- printf("%02hhX ", p[i]); +- printf("\n"); ++ ctx = malloc(sizeof(*ctx)); ++ if (!ctx) ++ error(1, ENOMEM, "malloc failed"); ++ ++ ctx->size = size; ++ ++ ctx->devfd = open("/dev/udmabuf", O_RDWR); ++ if (ctx->devfd < 0) ++ error(1, errno, ++ "%s: [skip,no-udmabuf: Unable to access DMA buffer device file]\n", ++ TEST_PREFIX); ++ ++ ctx->memfd = memfd_create("udmabuf-test", MFD_ALLOW_SEALING); ++ if (ctx->memfd < 0) ++ error(1, errno, "%s: [skip,no-memfd]\n", TEST_PREFIX); ++ ++ ret = fcntl(ctx->memfd, F_ADD_SEALS, F_SEAL_SHRINK); ++ if (ret < 0) ++ error(1, errno, "%s: [skip,fcntl-add-seals]\n", TEST_PREFIX); ++ ++ ret = ftruncate(ctx->memfd, size); ++ if (ret == -1) ++ error(1, errno, "%s: [FAIL,memfd-truncate]\n", TEST_PREFIX); ++ ++ memset(&create, 0, sizeof(create)); ++ ++ create.memfd = ctx->memfd; ++ create.offset = 0; ++ create.size = size; ++ ctx->fd = ioctl(ctx->devfd, UDMABUF_CREATE, &create); ++ if (ctx->fd < 0) ++ error(1, errno, "%s: [FAIL, create udmabuf]\n", TEST_PREFIX); ++ ++ ctx->buf_mem = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, ++ ctx->fd, 0); ++ if (ctx->buf_mem == MAP_FAILED) ++ error(1, errno, "%s: [FAIL, map udmabuf]\n", TEST_PREFIX); ++ ++ return ctx; ++} ++ ++static void udmabuf_free(struct memory_buffer *ctx) ++{ ++ munmap(ctx->buf_mem, ctx->size); ++ close(ctx->fd); ++ close(ctx->memfd); ++ close(ctx->devfd); ++ free(ctx); + } + +-void print_nonzero_bytes(void *ptr, size_t size) ++static void udmabuf_memcpy_from_device(void *dst, struct memory_buffer *src, ++ size_t off, int n) ++{ ++ struct dma_buf_sync sync = {}; ++ ++ sync.flags = DMA_BUF_SYNC_START; ++ ioctl(src->fd, DMA_BUF_IOCTL_SYNC, &sync); ++ ++ memcpy(dst, src->buf_mem + off, n); ++ ++ sync.flags = DMA_BUF_SYNC_END; ++ ioctl(src->fd, DMA_BUF_IOCTL_SYNC, &sync); ++} ++ ++static struct memory_provider udmabuf_memory_provider = { ++ .alloc = udmabuf_alloc, ++ .free = udmabuf_free, ++ .memcpy_from_device = udmabuf_memcpy_from_device, ++}; ++ ++static struct memory_provider *provider = &udmabuf_memory_provider; ++ ++static void print_nonzero_bytes(void *ptr, size_t size) + { + unsigned char *p = ptr; + unsigned int i; +@@ -201,42 +285,7 @@ static int bind_rx_queue(unsigned int ifindex, unsigned int dmabuf_fd, + return -1; + } + +-static void create_udmabuf(int *devfd, int *memfd, int *buf, size_t dmabuf_size) +-{ +- struct udmabuf_create create; +- int ret; +- +- *devfd = open("/dev/udmabuf", O_RDWR); +- if (*devfd < 0) { +- error(70, 0, +- "%s: [skip,no-udmabuf: Unable to access DMA buffer device file]\n", +- TEST_PREFIX); +- } +- +- *memfd = memfd_create("udmabuf-test", MFD_ALLOW_SEALING); +- if (*memfd < 0) +- error(70, 0, "%s: [skip,no-memfd]\n", TEST_PREFIX); +- +- /* Required for udmabuf */ +- ret = fcntl(*memfd, F_ADD_SEALS, F_SEAL_SHRINK); +- if (ret < 0) +- error(73, 0, "%s: [skip,fcntl-add-seals]\n", TEST_PREFIX); +- +- ret = ftruncate(*memfd, dmabuf_size); +- if (ret == -1) +- error(74, 0, "%s: [FAIL,memfd-truncate]\n", TEST_PREFIX); +- +- memset(&create, 0, sizeof(create)); +- +- create.memfd = *memfd; +- create.offset = 0; +- create.size = dmabuf_size; +- *buf = ioctl(*devfd, UDMABUF_CREATE, &create); +- if (*buf < 0) +- error(75, 0, "%s: [FAIL, create udmabuf]\n", TEST_PREFIX); +-} +- +-int do_server(void) ++int do_server(struct memory_buffer *mem) + { + char ctrl_data[sizeof(int) * 20000]; + struct netdev_queue_id *queues; +@@ -244,23 +293,18 @@ int do_server(void) + struct sockaddr_in client_addr; + struct sockaddr_in server_sin; + size_t page_aligned_frags = 0; +- int devfd, memfd, buf, ret; + size_t total_received = 0; + socklen_t client_addr_len; + bool is_devmem = false; +- char *buf_mem = NULL; ++ char *tmp_mem = NULL; + struct ynl_sock *ys; +- size_t dmabuf_size; + char iobuf[819200]; + char buffer[256]; + int socket_fd; + int client_fd; + size_t i = 0; + int opt = 1; +- +- dmabuf_size = getpagesize() * NUM_PAGES; +- +- create_udmabuf(&devfd, &memfd, &buf, dmabuf_size); ++ int ret; + + if (reset_flow_steering()) + error(1, 0, "Failed to reset flow steering\n"); +@@ -284,13 +328,12 @@ int do_server(void) + queues[i].id = start_queue + i; + } + +- if (bind_rx_queue(ifindex, buf, queues, num_queues, &ys)) ++ if (bind_rx_queue(ifindex, mem->fd, queues, num_queues, &ys)) + error(1, 0, "Failed to bind\n"); + +- buf_mem = mmap(NULL, dmabuf_size, PROT_READ | PROT_WRITE, MAP_SHARED, +- buf, 0); +- if (buf_mem == MAP_FAILED) +- error(1, 0, "mmap()"); ++ tmp_mem = malloc(mem->size); ++ if (!tmp_mem) ++ error(1, ENOMEM, "malloc failed"); + + server_sin.sin_family = AF_INET; + server_sin.sin_port = htons(atoi(port)); +@@ -341,7 +384,6 @@ int do_server(void) + struct iovec iov = { .iov_base = iobuf, + .iov_len = sizeof(iobuf) }; + struct dmabuf_cmsg *dmabuf_cmsg = NULL; +- struct dma_buf_sync sync = { 0 }; + struct cmsghdr *cm = NULL; + struct msghdr msg = { 0 }; + struct dmabuf_token token; +@@ -410,22 +452,16 @@ int do_server(void) + else + page_aligned_frags++; + +- sync.flags = DMA_BUF_SYNC_READ | DMA_BUF_SYNC_START; +- ioctl(buf, DMA_BUF_IOCTL_SYNC, &sync); ++ provider->memcpy_from_device(tmp_mem, mem, ++ dmabuf_cmsg->frag_offset, ++ dmabuf_cmsg->frag_size); + + if (do_validation) +- validate_buffer( +- ((unsigned char *)buf_mem) + +- dmabuf_cmsg->frag_offset, +- dmabuf_cmsg->frag_size); ++ validate_buffer(tmp_mem, ++ dmabuf_cmsg->frag_size); + else +- print_nonzero_bytes( +- ((unsigned char *)buf_mem) + +- dmabuf_cmsg->frag_offset, +- dmabuf_cmsg->frag_size); +- +- sync.flags = DMA_BUF_SYNC_READ | DMA_BUF_SYNC_END; +- ioctl(buf, DMA_BUF_IOCTL_SYNC, &sync); ++ print_nonzero_bytes(tmp_mem, ++ dmabuf_cmsg->frag_size); + + ret = setsockopt(client_fd, SOL_SOCKET, + SO_DEVMEM_DONTNEED, &token, +@@ -450,12 +486,9 @@ int do_server(void) + + cleanup: + +- munmap(buf_mem, dmabuf_size); ++ free(tmp_mem); + close(client_fd); + close(socket_fd); +- close(buf); +- close(memfd); +- close(devfd); + ynl_sock_destroy(ys); + + return 0; +@@ -464,14 +497,11 @@ int do_server(void) + void run_devmem_tests(void) + { + struct netdev_queue_id *queues; +- int devfd, memfd, buf; ++ struct memory_buffer *mem; + struct ynl_sock *ys; +- size_t dmabuf_size; + size_t i = 0; + +- dmabuf_size = getpagesize() * NUM_PAGES; +- +- create_udmabuf(&devfd, &memfd, &buf, dmabuf_size); ++ mem = provider->alloc(getpagesize() * NUM_PAGES); + + /* Configure RSS to divert all traffic from our devmem queues */ + if (configure_rss()) +@@ -482,7 +512,7 @@ void run_devmem_tests(void) + if (configure_headersplit(1)) + error(1, 0, "Failed to configure header split\n"); + +- if (!bind_rx_queue(ifindex, buf, queues, num_queues, &ys)) ++ if (!bind_rx_queue(ifindex, mem->fd, queues, num_queues, &ys)) + error(1, 0, "Binding empty queues array should have failed\n"); + + for (i = 0; i < num_queues; i++) { +@@ -495,7 +525,7 @@ void run_devmem_tests(void) + if (configure_headersplit(0)) + error(1, 0, "Failed to configure header split\n"); + +- if (!bind_rx_queue(ifindex, buf, queues, num_queues, &ys)) ++ if (!bind_rx_queue(ifindex, mem->fd, queues, num_queues, &ys)) + error(1, 0, "Configure dmabuf with header split off should have failed\n"); + + if (configure_headersplit(1)) +@@ -508,7 +538,7 @@ void run_devmem_tests(void) + queues[i].id = start_queue + i; + } + +- if (bind_rx_queue(ifindex, buf, queues, num_queues, &ys)) ++ if (bind_rx_queue(ifindex, mem->fd, queues, num_queues, &ys)) + error(1, 0, "Failed to bind\n"); + + /* Deactivating a bound queue should not be legal */ +@@ -517,11 +547,15 @@ void run_devmem_tests(void) + + /* Closing the netlink socket does an implicit unbind */ + ynl_sock_destroy(ys); ++ ++ provider->free(mem); + } + + int main(int argc, char *argv[]) + { ++ struct memory_buffer *mem; + int is_server = 0, opt; ++ int ret; + + while ((opt = getopt(argc, argv, "ls:c:p:v:q:t:f:")) != -1) { + switch (opt) { +@@ -562,8 +596,9 @@ int main(int argc, char *argv[]) + + run_devmem_tests(); + +- if (is_server) +- return do_server(); ++ mem = provider->alloc(getpagesize() * NUM_PAGES); ++ ret = is_server ? do_server(mem) : 1; ++ provider->free(mem); + +- return 0; ++ return ret; + } +-- +2.39.5 + diff --git a/queue-6.12/selftests-ncdevmem-switch-to-af_inet6.patch b/queue-6.12/selftests-ncdevmem-switch-to-af_inet6.patch new file mode 100644 index 0000000000..ad808b7711 --- /dev/null +++ b/queue-6.12/selftests-ncdevmem-switch-to-af_inet6.patch @@ -0,0 +1,191 @@ +From 64d0a5fa81ef68462d0bc4138d50b0f070db8dea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 10:12:05 -0800 +Subject: selftests: ncdevmem: Switch to AF_INET6 + +From: Stanislav Fomichev + +[ Upstream commit 933056357a8cf0c9b3fb2ecc4d2d8d142614f0a3 ] + +Use dualstack socket to support both v4 and v6. v4-mapped-v6 address +can be used to do v4. + +Reviewed-by: Mina Almasry +Reviewed-by: Joe Damato +Signed-off-by: Stanislav Fomichev +Link: https://patch.msgid.link/20241107181211.3934153-7-sdf@fomichev.me +Signed-off-by: Jakub Kicinski +Stable-dep-of: 97c4e094a4b2 ("tests/ncdevmem: Fix double-free of queue array") +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/ncdevmem.c | 97 ++++++++++++++++++-------- + 1 file changed, 68 insertions(+), 29 deletions(-) + +diff --git a/tools/testing/selftests/net/ncdevmem.c b/tools/testing/selftests/net/ncdevmem.c +index faa9dce121c72..7c671b246d80f 100644 +--- a/tools/testing/selftests/net/ncdevmem.c ++++ b/tools/testing/selftests/net/ncdevmem.c +@@ -234,13 +234,26 @@ static int configure_channels(unsigned int rx, unsigned int tx) + return run_command("sudo ethtool -L %s rx %u tx %u", ifname, rx, tx); + } + +-static int configure_flow_steering(void) ++static int configure_flow_steering(struct sockaddr_in6 *server_sin) + { +- return run_command("sudo ethtool -N %s flow-type tcp4 %s %s dst-ip %s %s %s dst-port %s queue %d >&2", ++ const char *type = "tcp6"; ++ const char *server_addr; ++ char buf[40]; ++ ++ inet_ntop(AF_INET6, &server_sin->sin6_addr, buf, sizeof(buf)); ++ server_addr = buf; ++ ++ if (IN6_IS_ADDR_V4MAPPED(&server_sin->sin6_addr)) { ++ type = "tcp4"; ++ server_addr = strrchr(server_addr, ':') + 1; ++ } ++ ++ return run_command("sudo ethtool -N %s flow-type %s %s %s dst-ip %s %s %s dst-port %s queue %d >&2", + ifname, ++ type, + client_ip ? "src-ip" : "", + client_ip ?: "", +- server_ip, ++ server_addr, + client_ip ? "src-port" : "", + client_ip ? port : "", + port, start_queue); +@@ -291,13 +304,51 @@ static int bind_rx_queue(unsigned int ifindex, unsigned int dmabuf_fd, + return -1; + } + ++static void enable_reuseaddr(int fd) ++{ ++ int opt = 1; ++ int ret; ++ ++ ret = setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &opt, sizeof(opt)); ++ if (ret) ++ error(1, errno, "%s: [FAIL, SO_REUSEPORT]\n", TEST_PREFIX); ++ ++ ret = setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt)); ++ if (ret) ++ error(1, errno, "%s: [FAIL, SO_REUSEADDR]\n", TEST_PREFIX); ++} ++ ++static int parse_address(const char *str, int port, struct sockaddr_in6 *sin6) ++{ ++ int ret; ++ ++ sin6->sin6_family = AF_INET6; ++ sin6->sin6_port = htons(port); ++ ++ ret = inet_pton(sin6->sin6_family, str, &sin6->sin6_addr); ++ if (ret != 1) { ++ /* fallback to plain IPv4 */ ++ ret = inet_pton(AF_INET, str, &sin6->sin6_addr.s6_addr32[3]); ++ if (ret != 1) ++ return -1; ++ ++ /* add ::ffff prefix */ ++ sin6->sin6_addr.s6_addr32[0] = 0; ++ sin6->sin6_addr.s6_addr32[1] = 0; ++ sin6->sin6_addr.s6_addr16[4] = 0; ++ sin6->sin6_addr.s6_addr16[5] = 0xffff; ++ } ++ ++ return 0; ++} ++ + int do_server(struct memory_buffer *mem) + { + char ctrl_data[sizeof(int) * 20000]; + struct netdev_queue_id *queues; + size_t non_page_aligned_frags = 0; +- struct sockaddr_in client_addr; +- struct sockaddr_in server_sin; ++ struct sockaddr_in6 client_addr; ++ struct sockaddr_in6 server_sin; + size_t page_aligned_frags = 0; + size_t total_received = 0; + socklen_t client_addr_len; +@@ -309,9 +360,12 @@ int do_server(struct memory_buffer *mem) + int socket_fd; + int client_fd; + size_t i = 0; +- int opt = 1; + int ret; + ++ ret = parse_address(server_ip, atoi(port), &server_sin); ++ if (ret < 0) ++ error(1, 0, "parse server address"); ++ + if (reset_flow_steering()) + error(1, 0, "Failed to reset flow steering\n"); + +@@ -320,7 +374,7 @@ int do_server(struct memory_buffer *mem) + error(1, 0, "Failed to configure rss\n"); + + /* Flow steer our devmem flows to start_queue */ +- if (configure_flow_steering()) ++ if (configure_flow_steering(&server_sin)) + error(1, 0, "Failed to configure flow steering\n"); + + sleep(1); +@@ -341,29 +395,14 @@ int do_server(struct memory_buffer *mem) + if (!tmp_mem) + error(1, ENOMEM, "malloc failed"); + +- server_sin.sin_family = AF_INET; +- server_sin.sin_port = htons(atoi(port)); +- +- ret = inet_pton(server_sin.sin_family, server_ip, &server_sin.sin_addr); +- if (ret < 0) +- error(1, errno, "%s: [FAIL, create socket]\n", TEST_PREFIX); +- +- socket_fd = socket(server_sin.sin_family, SOCK_STREAM, 0); ++ socket_fd = socket(AF_INET6, SOCK_STREAM, 0); + if (socket_fd < 0) + error(1, errno, "%s: [FAIL, create socket]\n", TEST_PREFIX); + +- ret = setsockopt(socket_fd, SOL_SOCKET, SO_REUSEPORT, &opt, +- sizeof(opt)); +- if (ret) +- error(1, errno, "%s: [FAIL, set sock opt]\n", TEST_PREFIX); +- +- ret = setsockopt(socket_fd, SOL_SOCKET, SO_REUSEADDR, &opt, +- sizeof(opt)); +- if (ret) +- error(1, errno, "%s: [FAIL, set sock opt]\n", TEST_PREFIX); ++ enable_reuseaddr(socket_fd); + + fprintf(stderr, "binding to address %s:%d\n", server_ip, +- ntohs(server_sin.sin_port)); ++ ntohs(server_sin.sin6_port)); + + ret = bind(socket_fd, &server_sin, sizeof(server_sin)); + if (ret) +@@ -375,16 +414,16 @@ int do_server(struct memory_buffer *mem) + + client_addr_len = sizeof(client_addr); + +- inet_ntop(server_sin.sin_family, &server_sin.sin_addr, buffer, ++ inet_ntop(AF_INET6, &server_sin.sin6_addr, buffer, + sizeof(buffer)); + fprintf(stderr, "Waiting or connection on %s:%d\n", buffer, +- ntohs(server_sin.sin_port)); ++ ntohs(server_sin.sin6_port)); + client_fd = accept(socket_fd, &client_addr, &client_addr_len); + +- inet_ntop(client_addr.sin_family, &client_addr.sin_addr, buffer, ++ inet_ntop(AF_INET6, &client_addr.sin6_addr, buffer, + sizeof(buffer)); + fprintf(stderr, "Got connection from %s:%d\n", buffer, +- ntohs(client_addr.sin_port)); ++ ntohs(client_addr.sin6_port)); + + while (1) { + struct iovec iov = { .iov_base = iobuf, +-- +2.39.5 + diff --git a/queue-6.12/selftests-ncdevmem-unify-error-handling.patch b/queue-6.12/selftests-ncdevmem-unify-error-handling.patch new file mode 100644 index 0000000000..6f4db88661 --- /dev/null +++ b/queue-6.12/selftests-ncdevmem-unify-error-handling.patch @@ -0,0 +1,72 @@ +From ebc7c38fb20bc37caa9dbf07a0ffe6bd6f20033d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 10:12:02 -0800 +Subject: selftests: ncdevmem: Unify error handling + +From: Stanislav Fomichev + +[ Upstream commit bfccbaac1b45f9af7d76589d7e31ad921b50c0d7 ] + +There is a bunch of places where error() calls look out of place. +Use the same error(1, errno, ...) pattern everywhere. + +Reviewed-by: Mina Almasry +Reviewed-by: Joe Damato +Signed-off-by: Stanislav Fomichev +Link: https://patch.msgid.link/20241107181211.3934153-4-sdf@fomichev.me +Signed-off-by: Jakub Kicinski +Stable-dep-of: 97c4e094a4b2 ("tests/ncdevmem: Fix double-free of queue array") +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/ncdevmem.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/tools/testing/selftests/net/ncdevmem.c b/tools/testing/selftests/net/ncdevmem.c +index 3e7ef2eedd60b..4733d1a0aab5d 100644 +--- a/tools/testing/selftests/net/ncdevmem.c ++++ b/tools/testing/selftests/net/ncdevmem.c +@@ -339,33 +339,33 @@ int do_server(struct memory_buffer *mem) + server_sin.sin_port = htons(atoi(port)); + + ret = inet_pton(server_sin.sin_family, server_ip, &server_sin.sin_addr); +- if (socket < 0) +- error(79, 0, "%s: [FAIL, create socket]\n", TEST_PREFIX); ++ if (ret < 0) ++ error(1, errno, "%s: [FAIL, create socket]\n", TEST_PREFIX); + + socket_fd = socket(server_sin.sin_family, SOCK_STREAM, 0); +- if (socket < 0) +- error(errno, errno, "%s: [FAIL, create socket]\n", TEST_PREFIX); ++ if (socket_fd < 0) ++ error(1, errno, "%s: [FAIL, create socket]\n", TEST_PREFIX); + + ret = setsockopt(socket_fd, SOL_SOCKET, SO_REUSEPORT, &opt, + sizeof(opt)); + if (ret) +- error(errno, errno, "%s: [FAIL, set sock opt]\n", TEST_PREFIX); ++ error(1, errno, "%s: [FAIL, set sock opt]\n", TEST_PREFIX); + + ret = setsockopt(socket_fd, SOL_SOCKET, SO_REUSEADDR, &opt, + sizeof(opt)); + if (ret) +- error(errno, errno, "%s: [FAIL, set sock opt]\n", TEST_PREFIX); ++ error(1, errno, "%s: [FAIL, set sock opt]\n", TEST_PREFIX); + + fprintf(stderr, "binding to address %s:%d\n", server_ip, + ntohs(server_sin.sin_port)); + + ret = bind(socket_fd, &server_sin, sizeof(server_sin)); + if (ret) +- error(errno, errno, "%s: [FAIL, bind]\n", TEST_PREFIX); ++ error(1, errno, "%s: [FAIL, bind]\n", TEST_PREFIX); + + ret = listen(socket_fd, 1); + if (ret) +- error(errno, errno, "%s: [FAIL, listen]\n", TEST_PREFIX); ++ error(1, errno, "%s: [FAIL, listen]\n", TEST_PREFIX); + + client_addr_len = sizeof(client_addr); + +-- +2.39.5 + diff --git a/queue-6.12/series b/queue-6.12/series new file mode 100644 index 0000000000..51207cec46 --- /dev/null +++ b/queue-6.12/series @@ -0,0 +1,75 @@ +sched_ext-fix-missing-rq-lock-in-scx_bpf_cpuperf_set.patch +arm64-dts-rockchip-assign-rt5616-mclk-rate-on-rk3588.patch +fs-xattr.c-fix-simple_xattr_list-to-always-include-s.patch +drivers-platform-x86-amd-pmf-check-for-invalid-sidel.patch +drivers-platform-x86-amd-pmf-check-for-invalid-smart.patch +riscv-dts-sophgo-fix-dma-data-width-configuration-fo.patch +binfmt_elf-move-brk-for-static-pie-even-if-aslr-disa.patch +platform-x86-amd-pmc-declare-quirk_spurious_8042-for.patch +platform-x86-asus-wmi-fix-wlan_ctrl_by_user-detectio.patch +arm64-dts-imx8mp-var-som-fix-ldo5-shutdown-causing-s.patch +cgroup-cpuset-extend-kthread_is_per_cpu-check-to-all.patch +tracing-probes-fix-a-possible-race-in-trace_probe_lo.patch +tpm-tis-double-the-timeout-b-to-4s.patch +sysfs-explicitly-pass-size-to-sysfs_add_bin_file_mod.patch +sysfs-introduce-callback-attribute_group-bin_size.patch +pci-sysfs-calculate-bin_attribute-size-through-bin_s.patch +nvmem-core-calculate-bin_attribute-size-through-bin_.patch +sysfs-treewide-constify-attribute-callback-of-bin_is.patch +sysfs-treewide-constify-attribute-callback-of-bin_at.patch +uio_hv_generic-fix-sysfs-creation-path-for-ring-buff.patch +kvm-add-member-to-struct-kvm_gfn_range-to-indicate-p.patch +kvm-x86-mmu-prevent-installing-hugepages-when-mem-at.patch +iio-adc-ad7266-fix-potential-timestamp-alignment-iss.patch +iio-chemical-pms7003-use-aligned_s64-for-timestamp.patch +iio-pressure-mprls0025pa-use-aligned_s64-for-timesta.patch +drm-amd-add-suspend-hibernate-notification-callback-.patch +revert-drm-amd-stop-evicting-resources-on-apus-in-su.patch +xhci-dbc-improve-performance-by-removing-delay-in-tr.patch +xhci-dbc-avoid-event-polling-busyloop-if-pending-rx-.patch +iio-adc-ad7768-1-fix-insufficient-alignment-of-times.patch +iio-chemical-sps30-use-aligned_s64-for-timestamp.patch +virtio_ring-add-a-func-argument-recycle_done-to-virt.patch +virtio_net-ensure-netdev_tx_reset_queue-is-called-on.patch +rdma-rxe-fix-slab-use-after-free-read-in-rxe_queue_c.patch +hid-thrustmaster-fix-memory-leak-in-thrustmaster_int.patch +hid-uclogic-add-null-check-in-uclogic_input_configur.patch +nfs-handle-failure-of-nfs_get_lock_context-in-unlock.patch +spi-loopback-test-do-not-split-1024-byte-hexdumps.patch +rdma-core-fix-kasan-slab-use-after-free-read-in-ib_r.patch +bluetooth-mgmt-fix-mgmt_op_add_device-invalid-device.patch +net_sched-flush-gso_skb-list-too-during-change.patch +tools-net-ynl-ethtool-fix-crash-when-hardware-clock-.patch +mctp-no-longer-rely-on-net-dev_index_head.patch +net-mctp-don-t-access-ifa_index-when-missing.patch +selftests-ncdevmem-redirect-all-non-payload-output-t.patch +selftests-ncdevmem-separate-out-dmabuf-provider.patch +selftests-ncdevmem-unify-error-handling.patch +selftests-ncdevmem-make-client_ip-optional.patch +selftests-ncdevmem-switch-to-af_inet6.patch +tests-ncdevmem-fix-double-free-of-queue-array.patch +net-mctp-ensure-keys-maintain-only-one-ref-to-corres.patch +alsa-seq-fix-delivery-of-ump-events-to-group-ports.patch +alsa-ump-fix-a-typo-of-snd_ump_stream_msg_device_inf.patch +net-cadence-macb-fix-a-possible-deadlock-in-macb_hal.patch +net-dsa-sja1105-discard-incoming-frames-in-br_state_.patch +nvme-pci-make-nvme_pci_npages_prp-__always_inline.patch +nvme-pci-acquire-cq_poll_lock-in-nvme_poll_irqdisabl.patch +alsa-sh-snd_aica-should-depend-on-sh_dma_api.patch +net-dsa-b53-prevent-standalone-from-trying-to-forwar.patch +vsock-test-fix-occasional-failure-in-siocoutq-tests.patch +net-mlx5e-disable-macsec-offload-for-uplink-represen.patch +qlcnic-fix-memory-leak-in-qlcnic_sriov_channel_cfg_c.patch +regulator-max20086-fix-invalid-memory-access.patch +drm-xe-save-ctx_timestamp-mmio-value-instead-of-lrc-.patch +netlink-specs-tc-fix-a-couple-of-attribute-names.patch +netlink-specs-tc-all-actions-are-indexed-arrays.patch +octeontx2-pf-macsec-fix-incorrect-max-transmit-size-.patch +net-ethernet-mtk_eth_soc-fix-typo-for-declaration-mt.patch +octeontx2-af-fix-cgx-receive-counters.patch +octeontx2-pf-do-not-reallocate-all-ntuple-filters.patch +wifi-mac80211-set-n_channels-after-allocating-struct.patch +mlxsw-spectrum_router-fix-use-after-free-when-deleti.patch +net-tls-fix-kernel-panic-when-alloc_page-failed.patch +tsnep-fix-timestamping-with-a-stacked-dsa-driver.patch +nfsv4-pnfs-reset-the-layout-state-after-a-layoutretu.patch diff --git a/queue-6.12/spi-loopback-test-do-not-split-1024-byte-hexdumps.patch b/queue-6.12/spi-loopback-test-do-not-split-1024-byte-hexdumps.patch new file mode 100644 index 0000000000..1eafcffa55 --- /dev/null +++ b/queue-6.12/spi-loopback-test-do-not-split-1024-byte-hexdumps.patch @@ -0,0 +1,43 @@ +From 4fcddc27f32e13e37f36406874f00180db6e682e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 May 2025 13:10:35 +0200 +Subject: spi: loopback-test: Do not split 1024-byte hexdumps + +From: Geert Uytterhoeven + +[ Upstream commit a73fa3690a1f3014d6677e368dce4e70767a6ba2 ] + +spi_test_print_hex_dump() prints buffers holding less than 1024 bytes in +full. Larger buffers are truncated: only the first 512 and the last 512 +bytes are printed, separated by a truncation message. The latter is +confusing in case the buffer holds exactly 1024 bytes, as all data is +printed anyway. + +Fix this by printing buffers holding up to and including 1024 bytes in +full. + +Fixes: 84e0c4e5e2c4ef42 ("spi: add loopback test driver to allow for spi_master regression tests") +Signed-off-by: Geert Uytterhoeven +Link: https://patch.msgid.link/37ee1bc90c6554c9347040adabf04188c8f704aa.1746184171.git.geert+renesas@glider.be +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-loopback-test.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c +index 31a878d9458d9..7740f94847a88 100644 +--- a/drivers/spi/spi-loopback-test.c ++++ b/drivers/spi/spi-loopback-test.c +@@ -420,7 +420,7 @@ MODULE_LICENSE("GPL"); + static void spi_test_print_hex_dump(char *pre, const void *ptr, size_t len) + { + /* limit the hex_dump */ +- if (len < 1024) { ++ if (len <= 1024) { + print_hex_dump(KERN_INFO, pre, + DUMP_PREFIX_OFFSET, 16, 1, + ptr, len, 0); +-- +2.39.5 + diff --git a/queue-6.12/sysfs-explicitly-pass-size-to-sysfs_add_bin_file_mod.patch b/queue-6.12/sysfs-explicitly-pass-size-to-sysfs_add_bin_file_mod.patch new file mode 100644 index 0000000000..dce58757ff --- /dev/null +++ b/queue-6.12/sysfs-explicitly-pass-size-to-sysfs_add_bin_file_mod.patch @@ -0,0 +1,99 @@ +From a306c38bd23f3a59dbc618fc44a3a8ccb430185b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Nov 2024 17:03:30 +0000 +Subject: sysfs: explicitly pass size to sysfs_add_bin_file_mode_ns() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 0afcee132bbc9d7ef9c5bb4da9b6fe014a9afaa9 ] + +Upcoming changes to the sysfs core require the size of the created file +to be overridable by the caller. +Add a parameter to enable this. +For now keep using attr->size in all cases. + +Signed-off-by: Thomas Weißschuh +Acked-by: Krzysztof Wilczyński +Link: https://lore.kernel.org/r/20241103-sysfs-const-bin_attr-v2-1-71110628844c@weissschuh.net +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: f31fe8165d36 ("uio_hv_generic: Fix sysfs creation path for ring buffer") +Signed-off-by: Sasha Levin +--- + fs/sysfs/file.c | 8 ++++---- + fs/sysfs/group.c | 3 ++- + fs/sysfs/sysfs.h | 2 +- + 3 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c +index d1995e2d6c943..6d39696b43069 100644 +--- a/fs/sysfs/file.c ++++ b/fs/sysfs/file.c +@@ -315,7 +315,7 @@ int sysfs_add_file_mode_ns(struct kernfs_node *parent, + } + + int sysfs_add_bin_file_mode_ns(struct kernfs_node *parent, +- const struct bin_attribute *battr, umode_t mode, ++ const struct bin_attribute *battr, umode_t mode, size_t size, + kuid_t uid, kgid_t gid, const void *ns) + { + const struct attribute *attr = &battr->attr; +@@ -340,7 +340,7 @@ int sysfs_add_bin_file_mode_ns(struct kernfs_node *parent, + #endif + + kn = __kernfs_create_file(parent, attr->name, mode & 0777, uid, gid, +- battr->size, ops, (void *)attr, ns, key); ++ size, ops, (void *)attr, ns, key); + if (IS_ERR(kn)) { + if (PTR_ERR(kn) == -EEXIST) + sysfs_warn_dup(parent, attr->name); +@@ -580,8 +580,8 @@ int sysfs_create_bin_file(struct kobject *kobj, + return -EINVAL; + + kobject_get_ownership(kobj, &uid, &gid); +- return sysfs_add_bin_file_mode_ns(kobj->sd, attr, attr->attr.mode, uid, +- gid, NULL); ++ return sysfs_add_bin_file_mode_ns(kobj->sd, attr, attr->attr.mode, ++ attr->size, uid, gid, NULL); + } + EXPORT_SYMBOL_GPL(sysfs_create_bin_file); + +diff --git a/fs/sysfs/group.c b/fs/sysfs/group.c +index d22ad67a0f329..45b2e92941da1 100644 +--- a/fs/sysfs/group.c ++++ b/fs/sysfs/group.c +@@ -87,6 +87,7 @@ static int create_files(struct kernfs_node *parent, struct kobject *kobj, + if (grp->bin_attrs) { + for (i = 0, bin_attr = grp->bin_attrs; *bin_attr; i++, bin_attr++) { + umode_t mode = (*bin_attr)->attr.mode; ++ size_t size = (*bin_attr)->size; + + if (update) + kernfs_remove_by_name(parent, +@@ -104,7 +105,7 @@ static int create_files(struct kernfs_node *parent, struct kobject *kobj, + + mode &= SYSFS_PREALLOC | 0664; + error = sysfs_add_bin_file_mode_ns(parent, *bin_attr, +- mode, uid, gid, ++ mode, size, uid, gid, + NULL); + if (error) + break; +diff --git a/fs/sysfs/sysfs.h b/fs/sysfs/sysfs.h +index 3f28c9af57562..8e012f25e1c06 100644 +--- a/fs/sysfs/sysfs.h ++++ b/fs/sysfs/sysfs.h +@@ -31,7 +31,7 @@ int sysfs_add_file_mode_ns(struct kernfs_node *parent, + const struct attribute *attr, umode_t amode, kuid_t uid, + kgid_t gid, const void *ns); + int sysfs_add_bin_file_mode_ns(struct kernfs_node *parent, +- const struct bin_attribute *battr, umode_t mode, ++ const struct bin_attribute *battr, umode_t mode, size_t size, + kuid_t uid, kgid_t gid, const void *ns); + + /* +-- +2.39.5 + diff --git a/queue-6.12/sysfs-introduce-callback-attribute_group-bin_size.patch b/queue-6.12/sysfs-introduce-callback-attribute_group-bin_size.patch new file mode 100644 index 0000000000..8dfaab034f --- /dev/null +++ b/queue-6.12/sysfs-introduce-callback-attribute_group-bin_size.patch @@ -0,0 +1,78 @@ +From f0551860dbe3ab315f1bfcff207a7359c8d905ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Nov 2024 17:03:31 +0000 +Subject: sysfs: introduce callback attribute_group::bin_size +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit bebf29b18f34620e25f7e2bd9e4e4d8e34a8977d ] + +Several drivers need to dynamically calculate the size of an binary +attribute. Currently this is done by assigning attr->size from the +is_bin_visible() callback. + +This has drawbacks: +* It is not documented. +* A single attribute can be instantiated multiple times, overwriting the + shared size field. +* It prevents the structure to be moved to read-only memory. + +Introduce a new dedicated callback to calculate the size of the +attribute. + +Signed-off-by: Thomas Weißschuh +Acked-by: Krzysztof Wilczyński +Link: https://lore.kernel.org/r/20241103-sysfs-const-bin_attr-v2-2-71110628844c@weissschuh.net +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: f31fe8165d36 ("uio_hv_generic: Fix sysfs creation path for ring buffer") +Signed-off-by: Sasha Levin +--- + fs/sysfs/group.c | 2 ++ + include/linux/sysfs.h | 8 ++++++++ + 2 files changed, 10 insertions(+) + +diff --git a/fs/sysfs/group.c b/fs/sysfs/group.c +index 45b2e92941da1..8b01a7eda5fb3 100644 +--- a/fs/sysfs/group.c ++++ b/fs/sysfs/group.c +@@ -98,6 +98,8 @@ static int create_files(struct kernfs_node *parent, struct kobject *kobj, + if (!mode) + continue; + } ++ if (grp->bin_size) ++ size = grp->bin_size(kobj, *bin_attr, i); + + WARN(mode & ~(SYSFS_PREALLOC | 0664), + "Attribute %s: Invalid permissions 0%o\n", +diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h +index c4e64dc112063..4746cccb95898 100644 +--- a/include/linux/sysfs.h ++++ b/include/linux/sysfs.h +@@ -87,6 +87,11 @@ do { \ + * SYSFS_GROUP_VISIBLE() when assigning this callback to + * specify separate _group_visible() and _attr_visible() + * handlers. ++ * @bin_size: ++ * Optional: Function to return the size of a binary attribute ++ * of the group. Will be called repeatedly for each binary ++ * attribute in the group. Overwrites the size field embedded ++ * inside the attribute itself. + * @attrs: Pointer to NULL terminated list of attributes. + * @bin_attrs: Pointer to NULL terminated list of binary attributes. + * Either attrs or bin_attrs or both must be provided. +@@ -97,6 +102,9 @@ struct attribute_group { + struct attribute *, int); + umode_t (*is_bin_visible)(struct kobject *, + struct bin_attribute *, int); ++ size_t (*bin_size)(struct kobject *, ++ const struct bin_attribute *, ++ int); + struct attribute **attrs; + struct bin_attribute **bin_attrs; + }; +-- +2.39.5 + diff --git a/queue-6.12/sysfs-treewide-constify-attribute-callback-of-bin_at.patch b/queue-6.12/sysfs-treewide-constify-attribute-callback-of-bin_at.patch new file mode 100644 index 0000000000..bac5fd18eb --- /dev/null +++ b/queue-6.12/sysfs-treewide-constify-attribute-callback-of-bin_at.patch @@ -0,0 +1,196 @@ +From b5282192aedfc2ea9b70a72626474c5d9fb8a422 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Nov 2024 17:03:35 +0000 +Subject: sysfs: treewide: constify attribute callback of bin_attribute::mmap() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 94a20fb9af16417ab5fd17bcde3d906926f15ef6 ] + +The mmap() callbacks should not modify the struct +bin_attribute passed as argument. +Enforce this by marking the argument as const. + +As there are not many callback implementers perform this change +throughout the tree at once. + +Signed-off-by: Thomas Weißschuh +Acked-by: Andrew Donnellan # ocxl +Acked-by: Krzysztof Wilczyński +Link: https://lore.kernel.org/r/20241103-sysfs-const-bin_attr-v2-6-71110628844c@weissschuh.net +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: f31fe8165d36 ("uio_hv_generic: Fix sysfs creation path for ring buffer") +Signed-off-by: Sasha Levin +--- + arch/alpha/kernel/pci-sysfs.c | 6 +++--- + drivers/cdx/cdx.c | 2 +- + drivers/misc/ocxl/sysfs.c | 2 +- + drivers/pci/p2pdma.c | 2 +- + drivers/pci/pci-sysfs.c | 10 +++++----- + drivers/platform/x86/intel/pmt/class.c | 2 +- + drivers/uio/uio_hv_generic.c | 2 +- + include/linux/sysfs.h | 2 +- + 8 files changed, 14 insertions(+), 14 deletions(-) + +diff --git a/arch/alpha/kernel/pci-sysfs.c b/arch/alpha/kernel/pci-sysfs.c +index 5808a66e2a81f..3048758304b57 100644 +--- a/arch/alpha/kernel/pci-sysfs.c ++++ b/arch/alpha/kernel/pci-sysfs.c +@@ -64,7 +64,7 @@ static int __pci_mmap_fits(struct pci_dev *pdev, int num, + * Return: %0 on success, negative error code otherwise + */ + static int pci_mmap_resource(struct kobject *kobj, +- struct bin_attribute *attr, ++ const struct bin_attribute *attr, + struct vm_area_struct *vma, int sparse) + { + struct pci_dev *pdev = to_pci_dev(kobj_to_dev(kobj)); +@@ -93,14 +93,14 @@ static int pci_mmap_resource(struct kobject *kobj, + } + + static int pci_mmap_resource_sparse(struct file *filp, struct kobject *kobj, +- struct bin_attribute *attr, ++ const struct bin_attribute *attr, + struct vm_area_struct *vma) + { + return pci_mmap_resource(kobj, attr, vma, 1); + } + + static int pci_mmap_resource_dense(struct file *filp, struct kobject *kobj, +- struct bin_attribute *attr, ++ const struct bin_attribute *attr, + struct vm_area_struct *vma) + { + return pci_mmap_resource(kobj, attr, vma, 0); +diff --git a/drivers/cdx/cdx.c b/drivers/cdx/cdx.c +index 4af1901c9d524..8228b0d91629a 100644 +--- a/drivers/cdx/cdx.c ++++ b/drivers/cdx/cdx.c +@@ -711,7 +711,7 @@ static const struct vm_operations_struct cdx_phys_vm_ops = { + * Return: true on success, false otherwise. + */ + static int cdx_mmap_resource(struct file *fp, struct kobject *kobj, +- struct bin_attribute *attr, ++ const struct bin_attribute *attr, + struct vm_area_struct *vma) + { + struct cdx_device *cdx_dev = to_cdx_device(kobj_to_dev(kobj)); +diff --git a/drivers/misc/ocxl/sysfs.c b/drivers/misc/ocxl/sysfs.c +index 405180d47d9bf..07520d6e6dc55 100644 +--- a/drivers/misc/ocxl/sysfs.c ++++ b/drivers/misc/ocxl/sysfs.c +@@ -125,7 +125,7 @@ static const struct vm_operations_struct global_mmio_vmops = { + }; + + static int global_mmio_mmap(struct file *filp, struct kobject *kobj, +- struct bin_attribute *bin_attr, ++ const struct bin_attribute *bin_attr, + struct vm_area_struct *vma) + { + struct ocxl_afu *afu = to_afu(kobj_to_dev(kobj)); +diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c +index 4f47a13cb500f..7abd4f546d3c0 100644 +--- a/drivers/pci/p2pdma.c ++++ b/drivers/pci/p2pdma.c +@@ -90,7 +90,7 @@ static ssize_t published_show(struct device *dev, struct device_attribute *attr, + static DEVICE_ATTR_RO(published); + + static int p2pmem_alloc_mmap(struct file *filp, struct kobject *kobj, +- struct bin_attribute *attr, struct vm_area_struct *vma) ++ const struct bin_attribute *attr, struct vm_area_struct *vma) + { + struct pci_dev *pdev = to_pci_dev(kobj_to_dev(kobj)); + size_t len = vma->vm_end - vma->vm_start; +diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c +index c5725f5185620..f31eb80c1c38b 100644 +--- a/drivers/pci/pci-sysfs.c ++++ b/drivers/pci/pci-sysfs.c +@@ -936,7 +936,7 @@ static ssize_t pci_write_legacy_io(struct file *filp, struct kobject *kobj, + * memory space. + */ + static int pci_mmap_legacy_mem(struct file *filp, struct kobject *kobj, +- struct bin_attribute *attr, ++ const struct bin_attribute *attr, + struct vm_area_struct *vma) + { + struct pci_bus *bus = to_pci_bus(kobj_to_dev(kobj)); +@@ -956,7 +956,7 @@ static int pci_mmap_legacy_mem(struct file *filp, struct kobject *kobj, + * memory space. Returns -ENOSYS if the operation isn't supported + */ + static int pci_mmap_legacy_io(struct file *filp, struct kobject *kobj, +- struct bin_attribute *attr, ++ const struct bin_attribute *attr, + struct vm_area_struct *vma) + { + struct pci_bus *bus = to_pci_bus(kobj_to_dev(kobj)); +@@ -1060,7 +1060,7 @@ void pci_remove_legacy_files(struct pci_bus *b) + * + * Use the regular PCI mapping routines to map a PCI resource into userspace. + */ +-static int pci_mmap_resource(struct kobject *kobj, struct bin_attribute *attr, ++static int pci_mmap_resource(struct kobject *kobj, const struct bin_attribute *attr, + struct vm_area_struct *vma, int write_combine) + { + struct pci_dev *pdev = to_pci_dev(kobj_to_dev(kobj)); +@@ -1085,14 +1085,14 @@ static int pci_mmap_resource(struct kobject *kobj, struct bin_attribute *attr, + } + + static int pci_mmap_resource_uc(struct file *filp, struct kobject *kobj, +- struct bin_attribute *attr, ++ const struct bin_attribute *attr, + struct vm_area_struct *vma) + { + return pci_mmap_resource(kobj, attr, vma, 0); + } + + static int pci_mmap_resource_wc(struct file *filp, struct kobject *kobj, +- struct bin_attribute *attr, ++ const struct bin_attribute *attr, + struct vm_area_struct *vma) + { + return pci_mmap_resource(kobj, attr, vma, 1); +diff --git a/drivers/platform/x86/intel/pmt/class.c b/drivers/platform/x86/intel/pmt/class.c +index c3ca2ac91b056..4cd46323001e0 100644 +--- a/drivers/platform/x86/intel/pmt/class.c ++++ b/drivers/platform/x86/intel/pmt/class.c +@@ -105,7 +105,7 @@ intel_pmt_read(struct file *filp, struct kobject *kobj, + + static int + intel_pmt_mmap(struct file *filp, struct kobject *kobj, +- struct bin_attribute *attr, struct vm_area_struct *vma) ++ const struct bin_attribute *attr, struct vm_area_struct *vma) + { + struct intel_pmt_entry *entry = container_of(attr, + struct intel_pmt_entry, +diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c +index 8704095994118..3976360d0096d 100644 +--- a/drivers/uio/uio_hv_generic.c ++++ b/drivers/uio/uio_hv_generic.c +@@ -135,7 +135,7 @@ static void hv_uio_rescind(struct vmbus_channel *channel) + * The ring buffer is allocated as contiguous memory by vmbus_open + */ + static int hv_uio_ring_mmap(struct file *filp, struct kobject *kobj, +- struct bin_attribute *attr, ++ const struct bin_attribute *attr, + struct vm_area_struct *vma) + { + struct vmbus_channel *channel +diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h +index d1b22d56198b5..9fcdc8cd3118f 100644 +--- a/include/linux/sysfs.h ++++ b/include/linux/sysfs.h +@@ -309,7 +309,7 @@ struct bin_attribute { + char *, loff_t, size_t); + loff_t (*llseek)(struct file *, struct kobject *, struct bin_attribute *, + loff_t, int); +- int (*mmap)(struct file *, struct kobject *, struct bin_attribute *attr, ++ int (*mmap)(struct file *, struct kobject *, const struct bin_attribute *attr, + struct vm_area_struct *vma); + }; + +-- +2.39.5 + diff --git a/queue-6.12/sysfs-treewide-constify-attribute-callback-of-bin_is.patch b/queue-6.12/sysfs-treewide-constify-attribute-callback-of-bin_is.patch new file mode 100644 index 0000000000..59687e1760 --- /dev/null +++ b/queue-6.12/sysfs-treewide-constify-attribute-callback-of-bin_is.patch @@ -0,0 +1,240 @@ +From b1f4c72ffbd27e7d32208270d27af0e8a43de265 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Nov 2024 17:03:34 +0000 +Subject: sysfs: treewide: constify attribute callback of bin_is_visible() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit b626816fdd7f9beb841856ba049396cff46e99aa ] + +The is_bin_visible() callbacks should not modify the struct +bin_attribute passed as argument. +Enforce this by marking the argument as const. + +As there are not many callback implementers perform this change +throughout the tree at once. + +Signed-off-by: Thomas Weißschuh +Acked-by: Martin K. Petersen +Acked-by: Jason Gunthorpe +Acked-by: Ira Weiny +Acked-by: Krzysztof Wilczyński +Link: https://lore.kernel.org/r/20241103-sysfs-const-bin_attr-v2-5-71110628844c@weissschuh.net +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: f31fe8165d36 ("uio_hv_generic: Fix sysfs creation path for ring buffer") +Signed-off-by: Sasha Levin +--- + drivers/cxl/port.c | 2 +- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +- + drivers/infiniband/hw/qib/qib_sysfs.c | 2 +- + drivers/mtd/spi-nor/sysfs.c | 2 +- + drivers/nvmem/core.c | 3 ++- + drivers/pci/pci-sysfs.c | 2 +- + drivers/pci/vpd.c | 2 +- + drivers/platform/x86/amd/hsmp.c | 2 +- + drivers/platform/x86/intel/sdsi.c | 2 +- + drivers/scsi/scsi_sysfs.c | 2 +- + drivers/usb/core/sysfs.c | 2 +- + include/linux/sysfs.h | 30 ++++++++++++------------- + 12 files changed, 27 insertions(+), 26 deletions(-) + +diff --git a/drivers/cxl/port.c b/drivers/cxl/port.c +index 9dc394295e1fc..24041cf85cfbe 100644 +--- a/drivers/cxl/port.c ++++ b/drivers/cxl/port.c +@@ -173,7 +173,7 @@ static ssize_t CDAT_read(struct file *filp, struct kobject *kobj, + static BIN_ATTR_ADMIN_RO(CDAT, 0); + + static umode_t cxl_port_bin_attr_is_visible(struct kobject *kobj, +- struct bin_attribute *attr, int i) ++ const struct bin_attribute *attr, int i) + { + struct device *dev = kobj_to_dev(kobj); + struct cxl_port *port = to_cxl_port(dev); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index d70855d7c61c1..3c8ef0cb5e567 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -4000,7 +4000,7 @@ static umode_t amdgpu_flash_attr_is_visible(struct kobject *kobj, struct attribu + } + + static umode_t amdgpu_bin_flash_attr_is_visible(struct kobject *kobj, +- struct bin_attribute *attr, ++ const struct bin_attribute *attr, + int idx) + { + struct device *dev = kobj_to_dev(kobj); +diff --git a/drivers/infiniband/hw/qib/qib_sysfs.c b/drivers/infiniband/hw/qib/qib_sysfs.c +index 53ec7510e4ebf..ba2cd68b53e6c 100644 +--- a/drivers/infiniband/hw/qib/qib_sysfs.c ++++ b/drivers/infiniband/hw/qib/qib_sysfs.c +@@ -283,7 +283,7 @@ static struct bin_attribute *port_ccmgta_attributes[] = { + }; + + static umode_t qib_ccmgta_is_bin_visible(struct kobject *kobj, +- struct bin_attribute *attr, int n) ++ const struct bin_attribute *attr, int n) + { + struct qib_pportdata *ppd = qib_get_pportdata_kobj(kobj); + +diff --git a/drivers/mtd/spi-nor/sysfs.c b/drivers/mtd/spi-nor/sysfs.c +index 96064e4babf01..5e9eb268073d1 100644 +--- a/drivers/mtd/spi-nor/sysfs.c ++++ b/drivers/mtd/spi-nor/sysfs.c +@@ -87,7 +87,7 @@ static umode_t spi_nor_sysfs_is_visible(struct kobject *kobj, + } + + static umode_t spi_nor_sysfs_is_bin_visible(struct kobject *kobj, +- struct bin_attribute *attr, int n) ++ const struct bin_attribute *attr, int n) + { + struct spi_device *spi = to_spi_device(kobj_to_dev(kobj)); + struct spi_mem *spimem = spi_get_drvdata(spi); +diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c +index e4775938b9d40..026c0bfdad268 100644 +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -298,7 +298,8 @@ static umode_t nvmem_bin_attr_get_umode(struct nvmem_device *nvmem) + } + + static umode_t nvmem_bin_attr_is_visible(struct kobject *kobj, +- struct bin_attribute *attr, int i) ++ const struct bin_attribute *attr, ++ int i) + { + struct device *dev = kobj_to_dev(kobj); + struct nvmem_device *nvmem = to_nvmem_device(dev); +diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c +index f62402bafc19b..c5725f5185620 100644 +--- a/drivers/pci/pci-sysfs.c ++++ b/drivers/pci/pci-sysfs.c +@@ -1352,7 +1352,7 @@ static struct bin_attribute *pci_dev_rom_attrs[] = { + }; + + static umode_t pci_dev_rom_attr_is_visible(struct kobject *kobj, +- struct bin_attribute *a, int n) ++ const struct bin_attribute *a, int n) + { + struct pci_dev *pdev = to_pci_dev(kobj_to_dev(kobj)); + +diff --git a/drivers/pci/vpd.c b/drivers/pci/vpd.c +index e4300f5f304f3..a469bcbc0da7f 100644 +--- a/drivers/pci/vpd.c ++++ b/drivers/pci/vpd.c +@@ -325,7 +325,7 @@ static struct bin_attribute *vpd_attrs[] = { + }; + + static umode_t vpd_attr_is_visible(struct kobject *kobj, +- struct bin_attribute *a, int n) ++ const struct bin_attribute *a, int n) + { + struct pci_dev *pdev = to_pci_dev(kobj_to_dev(kobj)); + +diff --git a/drivers/platform/x86/amd/hsmp.c b/drivers/platform/x86/amd/hsmp.c +index 8fcf38eed7f00..8f00850c139fa 100644 +--- a/drivers/platform/x86/amd/hsmp.c ++++ b/drivers/platform/x86/amd/hsmp.c +@@ -620,7 +620,7 @@ static int hsmp_get_tbl_dram_base(u16 sock_ind) + } + + static umode_t hsmp_is_sock_attr_visible(struct kobject *kobj, +- struct bin_attribute *battr, int id) ++ const struct bin_attribute *battr, int id) + { + if (plat_dev.proto_ver == HSMP_PROTO_VER6) + return battr->attr.mode; +diff --git a/drivers/platform/x86/intel/sdsi.c b/drivers/platform/x86/intel/sdsi.c +index 9d137621f0e6e..33f33b1070fdc 100644 +--- a/drivers/platform/x86/intel/sdsi.c ++++ b/drivers/platform/x86/intel/sdsi.c +@@ -541,7 +541,7 @@ static struct bin_attribute *sdsi_bin_attrs[] = { + }; + + static umode_t +-sdsi_battr_is_visible(struct kobject *kobj, struct bin_attribute *attr, int n) ++sdsi_battr_is_visible(struct kobject *kobj, const struct bin_attribute *attr, int n) + { + struct device *dev = kobj_to_dev(kobj); + struct sdsi_priv *priv = dev_get_drvdata(dev); +diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c +index 32f94db6d6bf5..f3a1ecb42128a 100644 +--- a/drivers/scsi/scsi_sysfs.c ++++ b/drivers/scsi/scsi_sysfs.c +@@ -1274,7 +1274,7 @@ static umode_t scsi_sdev_attr_is_visible(struct kobject *kobj, + } + + static umode_t scsi_sdev_bin_attr_is_visible(struct kobject *kobj, +- struct bin_attribute *attr, int i) ++ const struct bin_attribute *attr, int i) + { + struct device *dev = kobj_to_dev(kobj); + struct scsi_device *sdev = to_scsi_device(dev); +diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c +index 61b6d978892c7..b4cba23831acd 100644 +--- a/drivers/usb/core/sysfs.c ++++ b/drivers/usb/core/sysfs.c +@@ -925,7 +925,7 @@ static struct bin_attribute *dev_bin_attrs[] = { + }; + + static umode_t dev_bin_attrs_are_visible(struct kobject *kobj, +- struct bin_attribute *a, int n) ++ const struct bin_attribute *a, int n) + { + struct device *dev = kobj_to_dev(kobj); + struct usb_device *udev = to_usb_device(dev); +diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h +index 4746cccb95898..d1b22d56198b5 100644 +--- a/include/linux/sysfs.h ++++ b/include/linux/sysfs.h +@@ -101,7 +101,7 @@ struct attribute_group { + umode_t (*is_visible)(struct kobject *, + struct attribute *, int); + umode_t (*is_bin_visible)(struct kobject *, +- struct bin_attribute *, int); ++ const struct bin_attribute *, int); + size_t (*bin_size)(struct kobject *, + const struct bin_attribute *, + int); +@@ -199,22 +199,22 @@ struct attribute_group { + * attributes, the group visibility is determined by the function + * specified to is_visible() not is_bin_visible() + */ +-#define DEFINE_SYSFS_BIN_GROUP_VISIBLE(name) \ +- static inline umode_t sysfs_group_visible_##name( \ +- struct kobject *kobj, struct bin_attribute *attr, int n) \ +- { \ +- if (n == 0 && !name##_group_visible(kobj)) \ +- return SYSFS_GROUP_INVISIBLE; \ +- return name##_attr_visible(kobj, attr, n); \ ++#define DEFINE_SYSFS_BIN_GROUP_VISIBLE(name) \ ++ static inline umode_t sysfs_group_visible_##name( \ ++ struct kobject *kobj, const struct bin_attribute *attr, int n) \ ++ { \ ++ if (n == 0 && !name##_group_visible(kobj)) \ ++ return SYSFS_GROUP_INVISIBLE; \ ++ return name##_attr_visible(kobj, attr, n); \ + } + +-#define DEFINE_SIMPLE_SYSFS_BIN_GROUP_VISIBLE(name) \ +- static inline umode_t sysfs_group_visible_##name( \ +- struct kobject *kobj, struct bin_attribute *a, int n) \ +- { \ +- if (n == 0 && !name##_group_visible(kobj)) \ +- return SYSFS_GROUP_INVISIBLE; \ +- return a->mode; \ ++#define DEFINE_SIMPLE_SYSFS_BIN_GROUP_VISIBLE(name) \ ++ static inline umode_t sysfs_group_visible_##name( \ ++ struct kobject *kobj, const struct bin_attribute *a, int n) \ ++ { \ ++ if (n == 0 && !name##_group_visible(kobj)) \ ++ return SYSFS_GROUP_INVISIBLE; \ ++ return a->mode; \ + } + + #define SYSFS_GROUP_VISIBLE(fn) sysfs_group_visible_##fn +-- +2.39.5 + diff --git a/queue-6.12/tests-ncdevmem-fix-double-free-of-queue-array.patch b/queue-6.12/tests-ncdevmem-fix-double-free-of-queue-array.patch new file mode 100644 index 0000000000..c73d769736 --- /dev/null +++ b/queue-6.12/tests-ncdevmem-fix-double-free-of-queue-array.patch @@ -0,0 +1,147 @@ +From 39227e98346a6c7448ee223c9f5cc83fd041ab02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 May 2025 11:44:34 +0300 +Subject: tests/ncdevmem: Fix double-free of queue array + +From: Cosmin Ratiu + +[ Upstream commit 97c4e094a4b2edbb4fffeda718f8e806f825a18f ] + +netdev_bind_rx takes ownership of the queue array passed as parameter +and frees it, so a queue array buffer cannot be reused across multiple +netdev_bind_rx calls. + +This commit fixes that by always passing in a newly created queue array +to all netdev_bind_rx calls in ncdevmem. + +Fixes: 85585b4bc8d8 ("selftests: add ncdevmem, netcat for devmem TCP") +Signed-off-by: Cosmin Ratiu +Acked-by: Stanislav Fomichev +Reviewed-by: Joe Damato +Reviewed-by: Mina Almasry +Link: https://patch.msgid.link/20250508084434.1933069-1-cratiu@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/ncdevmem.c | 55 +++++++++++--------------- + 1 file changed, 22 insertions(+), 33 deletions(-) + +diff --git a/tools/testing/selftests/net/ncdevmem.c b/tools/testing/selftests/net/ncdevmem.c +index 7c671b246d80f..8617e6d7698de 100644 +--- a/tools/testing/selftests/net/ncdevmem.c ++++ b/tools/testing/selftests/net/ncdevmem.c +@@ -342,6 +342,22 @@ static int parse_address(const char *str, int port, struct sockaddr_in6 *sin6) + return 0; + } + ++static struct netdev_queue_id *create_queues(void) ++{ ++ struct netdev_queue_id *queues; ++ size_t i = 0; ++ ++ queues = calloc(num_queues, sizeof(*queues)); ++ for (i = 0; i < num_queues; i++) { ++ queues[i]._present.type = 1; ++ queues[i]._present.id = 1; ++ queues[i].type = NETDEV_QUEUE_TYPE_RX; ++ queues[i].id = start_queue + i; ++ } ++ ++ return queues; ++} ++ + int do_server(struct memory_buffer *mem) + { + char ctrl_data[sizeof(int) * 20000]; +@@ -359,7 +375,6 @@ int do_server(struct memory_buffer *mem) + char buffer[256]; + int socket_fd; + int client_fd; +- size_t i = 0; + int ret; + + ret = parse_address(server_ip, atoi(port), &server_sin); +@@ -379,16 +394,7 @@ int do_server(struct memory_buffer *mem) + + sleep(1); + +- queues = malloc(sizeof(*queues) * num_queues); +- +- for (i = 0; i < num_queues; i++) { +- queues[i]._present.type = 1; +- queues[i]._present.id = 1; +- queues[i].type = NETDEV_QUEUE_TYPE_RX; +- queues[i].id = start_queue + i; +- } +- +- if (bind_rx_queue(ifindex, mem->fd, queues, num_queues, &ys)) ++ if (bind_rx_queue(ifindex, mem->fd, create_queues(), num_queues, &ys)) + error(1, 0, "Failed to bind\n"); + + tmp_mem = malloc(mem->size); +@@ -453,7 +459,6 @@ int do_server(struct memory_buffer *mem) + goto cleanup; + } + +- i++; + for (cm = CMSG_FIRSTHDR(&msg); cm; cm = CMSG_NXTHDR(&msg, cm)) { + if (cm->cmsg_level != SOL_SOCKET || + (cm->cmsg_type != SCM_DEVMEM_DMABUF && +@@ -541,10 +546,8 @@ int do_server(struct memory_buffer *mem) + + void run_devmem_tests(void) + { +- struct netdev_queue_id *queues; + struct memory_buffer *mem; + struct ynl_sock *ys; +- size_t i = 0; + + mem = provider->alloc(getpagesize() * NUM_PAGES); + +@@ -552,38 +555,24 @@ void run_devmem_tests(void) + if (configure_rss()) + error(1, 0, "rss error\n"); + +- queues = calloc(num_queues, sizeof(*queues)); +- + if (configure_headersplit(1)) + error(1, 0, "Failed to configure header split\n"); + +- if (!bind_rx_queue(ifindex, mem->fd, queues, num_queues, &ys)) ++ if (!bind_rx_queue(ifindex, mem->fd, ++ calloc(num_queues, sizeof(struct netdev_queue_id)), ++ num_queues, &ys)) + error(1, 0, "Binding empty queues array should have failed\n"); + +- for (i = 0; i < num_queues; i++) { +- queues[i]._present.type = 1; +- queues[i]._present.id = 1; +- queues[i].type = NETDEV_QUEUE_TYPE_RX; +- queues[i].id = start_queue + i; +- } +- + if (configure_headersplit(0)) + error(1, 0, "Failed to configure header split\n"); + +- if (!bind_rx_queue(ifindex, mem->fd, queues, num_queues, &ys)) ++ if (!bind_rx_queue(ifindex, mem->fd, create_queues(), num_queues, &ys)) + error(1, 0, "Configure dmabuf with header split off should have failed\n"); + + if (configure_headersplit(1)) + error(1, 0, "Failed to configure header split\n"); + +- for (i = 0; i < num_queues; i++) { +- queues[i]._present.type = 1; +- queues[i]._present.id = 1; +- queues[i].type = NETDEV_QUEUE_TYPE_RX; +- queues[i].id = start_queue + i; +- } +- +- if (bind_rx_queue(ifindex, mem->fd, queues, num_queues, &ys)) ++ if (bind_rx_queue(ifindex, mem->fd, create_queues(), num_queues, &ys)) + error(1, 0, "Failed to bind\n"); + + /* Deactivating a bound queue should not be legal */ +-- +2.39.5 + diff --git a/queue-6.12/tools-net-ynl-ethtool-fix-crash-when-hardware-clock-.patch b/queue-6.12/tools-net-ynl-ethtool-fix-crash-when-hardware-clock-.patch new file mode 100644 index 0000000000..598f5f2b69 --- /dev/null +++ b/queue-6.12/tools-net-ynl-ethtool-fix-crash-when-hardware-clock-.patch @@ -0,0 +1,71 @@ +From 2e2dd0088f18c340aec73c341c5b493a5868c0a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 May 2025 03:54:14 +0000 +Subject: tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing + +From: Hangbin Liu + +[ Upstream commit 45375814eb3f4245956c0c85092a4eee4441d167 ] + +Fix a crash in the ethtool YNL implementation when Hardware Clock information +is not present in the response. This ensures graceful handling of devices or +drivers that do not provide this optional field. e.g. + + Traceback (most recent call last): + File "/net/tools/net/ynl/pyynl/./ethtool.py", line 438, in + main() + ~~~~^^ + File "/net/tools/net/ynl/pyynl/./ethtool.py", line 341, in main + print(f'PTP Hardware Clock: {tsinfo["phc-index"]}') + ~~~~~~^^^^^^^^^^^^^ + KeyError: 'phc-index' + +Fixes: f3d07b02b2b8 ("tools: ynl: ethtool testing tool") +Signed-off-by: Hangbin Liu +Acked-by: Stanislav Fomichev +Link: https://patch.msgid.link/20250508035414.82974-1-liuhangbin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/net/ynl/ethtool.py | 22 +++++++++++++++------- + 1 file changed, 15 insertions(+), 7 deletions(-) + +diff --git a/tools/net/ynl/ethtool.py b/tools/net/ynl/ethtool.py +index 63c471f075abf..7e8342f914816 100755 +--- a/tools/net/ynl/ethtool.py ++++ b/tools/net/ynl/ethtool.py +@@ -337,16 +337,24 @@ def main(): + print('Capabilities:') + [print(f'\t{v}') for v in bits_to_dict(tsinfo['timestamping'])] + +- print(f'PTP Hardware Clock: {tsinfo["phc-index"]}') ++ print(f'PTP Hardware Clock: {tsinfo.get("phc-index", "none")}') + +- print('Hardware Transmit Timestamp Modes:') +- [print(f'\t{v}') for v in bits_to_dict(tsinfo['tx-types'])] ++ if 'tx-types' in tsinfo: ++ print('Hardware Transmit Timestamp Modes:') ++ [print(f'\t{v}') for v in bits_to_dict(tsinfo['tx-types'])] ++ else: ++ print('Hardware Transmit Timestamp Modes: none') ++ ++ if 'rx-filters' in tsinfo: ++ print('Hardware Receive Filter Modes:') ++ [print(f'\t{v}') for v in bits_to_dict(tsinfo['rx-filters'])] ++ else: ++ print('Hardware Receive Filter Modes: none') + +- print('Hardware Receive Filter Modes:') +- [print(f'\t{v}') for v in bits_to_dict(tsinfo['rx-filters'])] ++ if 'stats' in tsinfo and tsinfo['stats']: ++ print('Statistics:') ++ [print(f'\t{k}: {v}') for k, v in tsinfo['stats'].items()] + +- print('Statistics:') +- [print(f'\t{k}: {v}') for k, v in tsinfo['stats'].items()] + return + + print(f'Settings for {args.device}:') +-- +2.39.5 + diff --git a/queue-6.12/tpm-tis-double-the-timeout-b-to-4s.patch b/queue-6.12/tpm-tis-double-the-timeout-b-to-4s.patch new file mode 100644 index 0000000000..652e63b13b --- /dev/null +++ b/queue-6.12/tpm-tis-double-the-timeout-b-to-4s.patch @@ -0,0 +1,76 @@ +From db830ff52d040de645acd16bdec040af01735068 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Apr 2025 10:23:14 +0200 +Subject: tpm: tis: Double the timeout B to 4s + +From: Michal Suchanek + +[ Upstream commit 2f661f71fda1fc0c42b7746ca5b7da529eb6b5be ] + +With some Infineon chips the timeouts in tpm_tis_send_data (both B and +C) can reach up to about 2250 ms. + +Timeout C is retried since +commit de9e33df7762 ("tpm, tpm_tis: Workaround failed command reception on Infineon devices") + +Timeout B still needs to be extended. + +The problem is most commonly encountered with context related operation +such as load context/save context. These are issued directly by the +kernel, and there is no retry logic for them. + +When a filesystem is set up to use the TPM for unlocking the boot fails, +and restarting the userspace service is ineffective. This is likely +because ignoring a load context/save context result puts the real TPM +state and the TPM state expected by the kernel out of sync. + +Chips known to be affected: +tpm_tis IFX1522:00: 2.0 TPM (device-id 0x1D, rev-id 54) +Description: SLB9672 +Firmware Revision: 15.22 + +tpm_tis MSFT0101:00: 2.0 TPM (device-id 0x1B, rev-id 22) +Firmware Revision: 7.83 + +tpm_tis MSFT0101:00: 2.0 TPM (device-id 0x1A, rev-id 16) +Firmware Revision: 5.63 + +Link: https://lore.kernel.org/linux-integrity/Z5pI07m0Muapyu9w@kitsune.suse.cz/ +Signed-off-by: Michal Suchanek +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.h | 2 +- + include/linux/tpm.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_core.h b/drivers/char/tpm/tpm_tis_core.h +index 970d02c337c7f..6c3aa480396b6 100644 +--- a/drivers/char/tpm/tpm_tis_core.h ++++ b/drivers/char/tpm/tpm_tis_core.h +@@ -54,7 +54,7 @@ enum tis_int_flags { + enum tis_defaults { + TIS_MEM_LEN = 0x5000, + TIS_SHORT_TIMEOUT = 750, /* ms */ +- TIS_LONG_TIMEOUT = 2000, /* 2 sec */ ++ TIS_LONG_TIMEOUT = 4000, /* 4 secs */ + TIS_TIMEOUT_MIN_ATML = 14700, /* usecs */ + TIS_TIMEOUT_MAX_ATML = 15000, /* usecs */ + }; +diff --git a/include/linux/tpm.h b/include/linux/tpm.h +index 6c3125300c009..3db0b6a87d454 100644 +--- a/include/linux/tpm.h ++++ b/include/linux/tpm.h +@@ -224,7 +224,7 @@ enum tpm2_const { + + enum tpm2_timeouts { + TPM2_TIMEOUT_A = 750, +- TPM2_TIMEOUT_B = 2000, ++ TPM2_TIMEOUT_B = 4000, + TPM2_TIMEOUT_C = 200, + TPM2_TIMEOUT_D = 30, + TPM2_DURATION_SHORT = 20, +-- +2.39.5 + diff --git a/queue-6.12/tracing-probes-fix-a-possible-race-in-trace_probe_lo.patch b/queue-6.12/tracing-probes-fix-a-possible-race-in-trace_probe_lo.patch new file mode 100644 index 0000000000..8648b9e1e5 --- /dev/null +++ b/queue-6.12/tracing-probes-fix-a-possible-race-in-trace_probe_lo.patch @@ -0,0 +1,153 @@ +From def059ab3d6700cfa401a631139cc446662bb5bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 May 2025 12:44:41 +0900 +Subject: tracing: probes: Fix a possible race in trace_probe_log APIs + +From: Masami Hiramatsu (Google) + +[ Upstream commit fd837de3c9cb1a162c69bc1fb1f438467fe7f2f5 ] + +Since the shared trace_probe_log variable can be accessed and +modified via probe event create operation of kprobe_events, +uprobe_events, and dynamic_events, it should be protected. +In the dynamic_events, all operations are serialized by +`dyn_event_ops_mutex`. But kprobe_events and uprobe_events +interfaces are not serialized. + +To solve this issue, introduces dyn_event_create(), which runs +create() operation under the mutex, for kprobe_events and +uprobe_events. This also uses lockdep to check the mutex is +held when using trace_probe_log* APIs. + +Link: https://lore.kernel.org/all/174684868120.551552.3068655787654268804.stgit@devnote2/ + +Reported-by: Paul Cacheux +Closes: https://lore.kernel.org/all/20250510074456.805a16872b591e2971a4d221@kernel.org/ +Fixes: ab105a4fb894 ("tracing: Use tracing error_log with probe events") +Signed-off-by: Masami Hiramatsu (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_dynevent.c | 16 +++++++++++++++- + kernel/trace/trace_dynevent.h | 1 + + kernel/trace/trace_kprobe.c | 2 +- + kernel/trace/trace_probe.c | 9 +++++++++ + kernel/trace/trace_uprobe.c | 2 +- + 5 files changed, 27 insertions(+), 3 deletions(-) + +diff --git a/kernel/trace/trace_dynevent.c b/kernel/trace/trace_dynevent.c +index 4376887e0d8aa..c9b0533407ede 100644 +--- a/kernel/trace/trace_dynevent.c ++++ b/kernel/trace/trace_dynevent.c +@@ -16,7 +16,7 @@ + #include "trace_output.h" /* for trace_event_sem */ + #include "trace_dynevent.h" + +-static DEFINE_MUTEX(dyn_event_ops_mutex); ++DEFINE_MUTEX(dyn_event_ops_mutex); + static LIST_HEAD(dyn_event_ops_list); + + bool trace_event_dyn_try_get_ref(struct trace_event_call *dyn_call) +@@ -125,6 +125,20 @@ int dyn_event_release(const char *raw_command, struct dyn_event_operations *type + return ret; + } + ++/* ++ * Locked version of event creation. The event creation must be protected by ++ * dyn_event_ops_mutex because of protecting trace_probe_log. ++ */ ++int dyn_event_create(const char *raw_command, struct dyn_event_operations *type) ++{ ++ int ret; ++ ++ mutex_lock(&dyn_event_ops_mutex); ++ ret = type->create(raw_command); ++ mutex_unlock(&dyn_event_ops_mutex); ++ return ret; ++} ++ + static int create_dyn_event(const char *raw_command) + { + struct dyn_event_operations *ops; +diff --git a/kernel/trace/trace_dynevent.h b/kernel/trace/trace_dynevent.h +index 936477a111d3e..beee3f8d75444 100644 +--- a/kernel/trace/trace_dynevent.h ++++ b/kernel/trace/trace_dynevent.h +@@ -100,6 +100,7 @@ void *dyn_event_seq_next(struct seq_file *m, void *v, loff_t *pos); + void dyn_event_seq_stop(struct seq_file *m, void *v); + int dyn_events_release_all(struct dyn_event_operations *type); + int dyn_event_release(const char *raw_command, struct dyn_event_operations *type); ++int dyn_event_create(const char *raw_command, struct dyn_event_operations *type); + + /* + * for_each_dyn_event - iterate over the dyn_event list +diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c +index 935a886af40c9..6b9c3f3f870f4 100644 +--- a/kernel/trace/trace_kprobe.c ++++ b/kernel/trace/trace_kprobe.c +@@ -1090,7 +1090,7 @@ static int create_or_delete_trace_kprobe(const char *raw_command) + if (raw_command[0] == '-') + return dyn_event_release(raw_command, &trace_kprobe_ops); + +- ret = trace_kprobe_create(raw_command); ++ ret = dyn_event_create(raw_command, &trace_kprobe_ops); + return ret == -ECANCELED ? -EINVAL : ret; + } + +diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c +index 578919962e5df..ae20ad7f74616 100644 +--- a/kernel/trace/trace_probe.c ++++ b/kernel/trace/trace_probe.c +@@ -154,9 +154,12 @@ static const struct fetch_type *find_fetch_type(const char *type, unsigned long + } + + static struct trace_probe_log trace_probe_log; ++extern struct mutex dyn_event_ops_mutex; + + void trace_probe_log_init(const char *subsystem, int argc, const char **argv) + { ++ lockdep_assert_held(&dyn_event_ops_mutex); ++ + trace_probe_log.subsystem = subsystem; + trace_probe_log.argc = argc; + trace_probe_log.argv = argv; +@@ -165,11 +168,15 @@ void trace_probe_log_init(const char *subsystem, int argc, const char **argv) + + void trace_probe_log_clear(void) + { ++ lockdep_assert_held(&dyn_event_ops_mutex); ++ + memset(&trace_probe_log, 0, sizeof(trace_probe_log)); + } + + void trace_probe_log_set_index(int index) + { ++ lockdep_assert_held(&dyn_event_ops_mutex); ++ + trace_probe_log.index = index; + } + +@@ -178,6 +185,8 @@ void __trace_probe_log_err(int offset, int err_type) + char *command, *p; + int i, len = 0, pos = 0; + ++ lockdep_assert_held(&dyn_event_ops_mutex); ++ + if (!trace_probe_log.argv) + return; + +diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c +index b085a8a164ea0..9916677acf24e 100644 +--- a/kernel/trace/trace_uprobe.c ++++ b/kernel/trace/trace_uprobe.c +@@ -739,7 +739,7 @@ static int create_or_delete_trace_uprobe(const char *raw_command) + if (raw_command[0] == '-') + return dyn_event_release(raw_command, &trace_uprobe_ops); + +- ret = trace_uprobe_create(raw_command); ++ ret = dyn_event_create(raw_command, &trace_uprobe_ops); + return ret == -ECANCELED ? -EINVAL : ret; + } + +-- +2.39.5 + diff --git a/queue-6.12/tsnep-fix-timestamping-with-a-stacked-dsa-driver.patch b/queue-6.12/tsnep-fix-timestamping-with-a-stacked-dsa-driver.patch new file mode 100644 index 0000000000..5b2a8b8826 --- /dev/null +++ b/queue-6.12/tsnep-fix-timestamping-with-a-stacked-dsa-driver.patch @@ -0,0 +1,133 @@ +From 8fabb2e9d159833a2799d64715993382585dcc1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 May 2025 21:56:57 +0200 +Subject: tsnep: fix timestamping with a stacked DSA driver + +From: Gerhard Engleder + +[ Upstream commit b3ca9eef6646576ad506a96d941d87a69f66732a ] + +This driver is susceptible to a form of the bug explained in commit +c26a2c2ddc01 ("gianfar: Fix TX timestamping with a stacked DSA driver") +and in Documentation/networking/timestamping.rst section "Other caveats +for MAC drivers", specifically it timestamps any skb which has +SKBTX_HW_TSTAMP, and does not consider if timestamping has been enabled +in adapter->hwtstamp_config.tx_type. + +Evaluate the proper TX timestamping condition only once on the TX +path (in tsnep_xmit_frame_ring()) and store the result in an additional +TX entry flag. Evaluate the new TX entry flag in the TX confirmation path +(in tsnep_tx_poll()). + +This way SKBTX_IN_PROGRESS is set by the driver as required, but never +evaluated. SKBTX_IN_PROGRESS shall not be evaluated as it can be set +by a stacked DSA driver and evaluating it would lead to unwanted +timestamps. + +Fixes: 403f69bbdbad ("tsnep: Add TSN endpoint Ethernet MAC driver") +Suggested-by: Vladimir Oltean +Signed-off-by: Gerhard Engleder +Reviewed-by: Vladimir Oltean +Link: https://patch.msgid.link/20250514195657.25874-1-gerhard@engleder-embedded.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/engleder/tsnep_main.c | 30 ++++++++++++++-------- + 1 file changed, 19 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/engleder/tsnep_main.c b/drivers/net/ethernet/engleder/tsnep_main.c +index 44da335d66bda..6a6efe2b2bc51 100644 +--- a/drivers/net/ethernet/engleder/tsnep_main.c ++++ b/drivers/net/ethernet/engleder/tsnep_main.c +@@ -67,6 +67,8 @@ + #define TSNEP_TX_TYPE_XDP_NDO_MAP_PAGE (TSNEP_TX_TYPE_XDP_NDO | TSNEP_TX_TYPE_MAP_PAGE) + #define TSNEP_TX_TYPE_XDP (TSNEP_TX_TYPE_XDP_TX | TSNEP_TX_TYPE_XDP_NDO) + #define TSNEP_TX_TYPE_XSK BIT(12) ++#define TSNEP_TX_TYPE_TSTAMP BIT(13) ++#define TSNEP_TX_TYPE_SKB_TSTAMP (TSNEP_TX_TYPE_SKB | TSNEP_TX_TYPE_TSTAMP) + + #define TSNEP_XDP_TX BIT(0) + #define TSNEP_XDP_REDIRECT BIT(1) +@@ -387,8 +389,7 @@ static void tsnep_tx_activate(struct tsnep_tx *tx, int index, int length, + if (entry->skb) { + entry->properties = length & TSNEP_DESC_LENGTH_MASK; + entry->properties |= TSNEP_DESC_INTERRUPT_FLAG; +- if ((entry->type & TSNEP_TX_TYPE_SKB) && +- (skb_shinfo(entry->skb)->tx_flags & SKBTX_IN_PROGRESS)) ++ if ((entry->type & TSNEP_TX_TYPE_SKB_TSTAMP) == TSNEP_TX_TYPE_SKB_TSTAMP) + entry->properties |= TSNEP_DESC_EXTENDED_WRITEBACK_FLAG; + + /* toggle user flag to prevent false acknowledge +@@ -480,7 +481,8 @@ static int tsnep_tx_map_frag(skb_frag_t *frag, struct tsnep_tx_entry *entry, + return mapped; + } + +-static int tsnep_tx_map(struct sk_buff *skb, struct tsnep_tx *tx, int count) ++static int tsnep_tx_map(struct sk_buff *skb, struct tsnep_tx *tx, int count, ++ bool do_tstamp) + { + struct device *dmadev = tx->adapter->dmadev; + struct tsnep_tx_entry *entry; +@@ -506,6 +508,9 @@ static int tsnep_tx_map(struct sk_buff *skb, struct tsnep_tx *tx, int count) + entry->type = TSNEP_TX_TYPE_SKB_INLINE; + mapped = 0; + } ++ ++ if (do_tstamp) ++ entry->type |= TSNEP_TX_TYPE_TSTAMP; + } else { + skb_frag_t *frag = &skb_shinfo(skb)->frags[i - 1]; + +@@ -559,11 +564,12 @@ static int tsnep_tx_unmap(struct tsnep_tx *tx, int index, int count) + static netdev_tx_t tsnep_xmit_frame_ring(struct sk_buff *skb, + struct tsnep_tx *tx) + { +- int count = 1; + struct tsnep_tx_entry *entry; ++ bool do_tstamp = false; ++ int count = 1; + int length; +- int i; + int retval; ++ int i; + + if (skb_shinfo(skb)->nr_frags > 0) + count += skb_shinfo(skb)->nr_frags; +@@ -580,7 +586,13 @@ static netdev_tx_t tsnep_xmit_frame_ring(struct sk_buff *skb, + entry = &tx->entry[tx->write]; + entry->skb = skb; + +- retval = tsnep_tx_map(skb, tx, count); ++ if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) && ++ tx->adapter->hwtstamp_config.tx_type == HWTSTAMP_TX_ON) { ++ skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS; ++ do_tstamp = true; ++ } ++ ++ retval = tsnep_tx_map(skb, tx, count, do_tstamp); + if (retval < 0) { + tsnep_tx_unmap(tx, tx->write, count); + dev_kfree_skb_any(entry->skb); +@@ -592,9 +604,6 @@ static netdev_tx_t tsnep_xmit_frame_ring(struct sk_buff *skb, + } + length = retval; + +- if (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) +- skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS; +- + for (i = 0; i < count; i++) + tsnep_tx_activate(tx, (tx->write + i) & TSNEP_RING_MASK, length, + i == count - 1); +@@ -845,8 +854,7 @@ static bool tsnep_tx_poll(struct tsnep_tx *tx, int napi_budget) + + length = tsnep_tx_unmap(tx, tx->read, count); + +- if ((entry->type & TSNEP_TX_TYPE_SKB) && +- (skb_shinfo(entry->skb)->tx_flags & SKBTX_IN_PROGRESS) && ++ if (((entry->type & TSNEP_TX_TYPE_SKB_TSTAMP) == TSNEP_TX_TYPE_SKB_TSTAMP) && + (__le32_to_cpu(entry->desc_wb->properties) & + TSNEP_DESC_EXTENDED_WRITEBACK_FLAG)) { + struct skb_shared_hwtstamps hwtstamps; +-- +2.39.5 + diff --git a/queue-6.12/uio_hv_generic-fix-sysfs-creation-path-for-ring-buff.patch b/queue-6.12/uio_hv_generic-fix-sysfs-creation-path-for-ring-buff.patch new file mode 100644 index 0000000000..90e770ffec --- /dev/null +++ b/queue-6.12/uio_hv_generic-fix-sysfs-creation-path-for-ring-buff.patch @@ -0,0 +1,311 @@ +From e3abc1558c667ce40d14d2a2e54748640a1fee1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 May 2025 13:18:10 +0530 +Subject: uio_hv_generic: Fix sysfs creation path for ring buffer + +From: Naman Jain + +[ Upstream commit f31fe8165d365379d858c53bef43254c7d6d1cfd ] + +On regular bootup, devices get registered to VMBus first, so when +uio_hv_generic driver for a particular device type is probed, +the device is already initialized and added, so sysfs creation in +hv_uio_probe() works fine. However, when the device is removed +and brought back, the channel gets rescinded and the device again gets +registered to VMBus. However this time, the uio_hv_generic driver is +already registered to probe for that device and in this case sysfs +creation is tried before the device's kobject gets initialized +completely. + +Fix this by moving the core logic of sysfs creation of ring buffer, +from uio_hv_generic to HyperV's VMBus driver, where the rest of the +sysfs attributes for the channels are defined. While doing that, make +use of attribute groups and macros, instead of creating sysfs +directly, to ensure better error handling and code flow. + +Problematic path: +vmbus_process_offer (A new offer comes for the VMBus device) + vmbus_add_channel_work + vmbus_device_register + |-> device_register + | |... + | |-> hv_uio_probe + | |... + | |-> sysfs_create_bin_file (leads to a warning as + | the primary channel's kobject, which is used to + | create the sysfs file, is not yet initialized) + |-> kset_create_and_add + |-> vmbus_add_channel_kobj (initialization of the primary + channel's kobject happens later) + +Above code flow is sequential and the warning is always reproducible in +this path. + +Fixes: 9ab877a6ccf8 ("uio_hv_generic: make ring buffer attribute for primary channel") +Cc: stable@kernel.org +Suggested-by: Saurabh Sengar +Suggested-by: Michael Kelley +Reviewed-by: Michael Kelley +Tested-by: Michael Kelley +Reviewed-by: Dexuan Cui +Signed-off-by: Naman Jain +Link: https://lore.kernel.org/r/20250502074811.2022-2-namjain@linux.microsoft.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hv/hyperv_vmbus.h | 6 +++ + drivers/hv/vmbus_drv.c | 100 ++++++++++++++++++++++++++++++++++- + drivers/uio/uio_hv_generic.c | 39 ++++++-------- + include/linux/hyperv.h | 6 +++ + 4 files changed, 128 insertions(+), 23 deletions(-) + +diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h +index 52cb744b4d7fd..e4136cbaa4d40 100644 +--- a/drivers/hv/hyperv_vmbus.h ++++ b/drivers/hv/hyperv_vmbus.h +@@ -485,4 +485,10 @@ static inline int hv_debug_add_dev_dir(struct hv_device *dev) + + #endif /* CONFIG_HYPERV_TESTING */ + ++/* Create and remove sysfs entry for memory mapped ring buffers for a channel */ ++int hv_create_ring_sysfs(struct vmbus_channel *channel, ++ int (*hv_mmap_ring_buffer)(struct vmbus_channel *channel, ++ struct vm_area_struct *vma)); ++int hv_remove_ring_sysfs(struct vmbus_channel *channel); ++ + #endif /* _HYPERV_VMBUS_H */ +diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c +index 2b6749c9712ef..410df07ef983a 100644 +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -1792,6 +1792,27 @@ static ssize_t subchannel_id_show(struct vmbus_channel *channel, + } + static VMBUS_CHAN_ATTR_RO(subchannel_id); + ++static int hv_mmap_ring_buffer_wrapper(struct file *filp, struct kobject *kobj, ++ const struct bin_attribute *attr, ++ struct vm_area_struct *vma) ++{ ++ struct vmbus_channel *channel = container_of(kobj, struct vmbus_channel, kobj); ++ ++ /* ++ * hv_(create|remove)_ring_sysfs implementation ensures that mmap_ring_buffer ++ * is not NULL. ++ */ ++ return channel->mmap_ring_buffer(channel, vma); ++} ++ ++static struct bin_attribute chan_attr_ring_buffer = { ++ .attr = { ++ .name = "ring", ++ .mode = 0600, ++ }, ++ .size = 2 * SZ_2M, ++ .mmap = hv_mmap_ring_buffer_wrapper, ++}; + static struct attribute *vmbus_chan_attrs[] = { + &chan_attr_out_mask.attr, + &chan_attr_in_mask.attr, +@@ -1811,6 +1832,11 @@ static struct attribute *vmbus_chan_attrs[] = { + NULL + }; + ++static struct bin_attribute *vmbus_chan_bin_attrs[] = { ++ &chan_attr_ring_buffer, ++ NULL ++}; ++ + /* + * Channel-level attribute_group callback function. Returns the permission for + * each attribute, and returns 0 if an attribute is not visible. +@@ -1831,9 +1857,24 @@ static umode_t vmbus_chan_attr_is_visible(struct kobject *kobj, + return attr->mode; + } + ++static umode_t vmbus_chan_bin_attr_is_visible(struct kobject *kobj, ++ const struct bin_attribute *attr, int idx) ++{ ++ const struct vmbus_channel *channel = ++ container_of(kobj, struct vmbus_channel, kobj); ++ ++ /* Hide ring attribute if channel's ring_sysfs_visible is set to false */ ++ if (attr == &chan_attr_ring_buffer && !channel->ring_sysfs_visible) ++ return 0; ++ ++ return attr->attr.mode; ++} ++ + static const struct attribute_group vmbus_chan_group = { + .attrs = vmbus_chan_attrs, +- .is_visible = vmbus_chan_attr_is_visible ++ .bin_attrs = vmbus_chan_bin_attrs, ++ .is_visible = vmbus_chan_attr_is_visible, ++ .is_bin_visible = vmbus_chan_bin_attr_is_visible, + }; + + static const struct kobj_type vmbus_chan_ktype = { +@@ -1841,6 +1882,63 @@ static const struct kobj_type vmbus_chan_ktype = { + .release = vmbus_chan_release, + }; + ++/** ++ * hv_create_ring_sysfs() - create "ring" sysfs entry corresponding to ring buffers for a channel. ++ * @channel: Pointer to vmbus_channel structure ++ * @hv_mmap_ring_buffer: function pointer for initializing the function to be called on mmap of ++ * channel's "ring" sysfs node, which is for the ring buffer of that channel. ++ * Function pointer is of below type: ++ * int (*hv_mmap_ring_buffer)(struct vmbus_channel *channel, ++ * struct vm_area_struct *vma)) ++ * This has a pointer to the channel and a pointer to vm_area_struct, ++ * used for mmap, as arguments. ++ * ++ * Sysfs node for ring buffer of a channel is created along with other fields, however its ++ * visibility is disabled by default. Sysfs creation needs to be controlled when the use-case ++ * is running. ++ * For example, HV_NIC device is used either by uio_hv_generic or hv_netvsc at any given point of ++ * time, and "ring" sysfs is needed only when uio_hv_generic is bound to that device. To avoid ++ * exposing the ring buffer by default, this function is reponsible to enable visibility of ++ * ring for userspace to use. ++ * Note: Race conditions can happen with userspace and it is not encouraged to create new ++ * use-cases for this. This was added to maintain backward compatibility, while solving ++ * one of the race conditions in uio_hv_generic while creating sysfs. ++ * ++ * Returns 0 on success or error code on failure. ++ */ ++int hv_create_ring_sysfs(struct vmbus_channel *channel, ++ int (*hv_mmap_ring_buffer)(struct vmbus_channel *channel, ++ struct vm_area_struct *vma)) ++{ ++ struct kobject *kobj = &channel->kobj; ++ ++ channel->mmap_ring_buffer = hv_mmap_ring_buffer; ++ channel->ring_sysfs_visible = true; ++ ++ return sysfs_update_group(kobj, &vmbus_chan_group); ++} ++EXPORT_SYMBOL_GPL(hv_create_ring_sysfs); ++ ++/** ++ * hv_remove_ring_sysfs() - remove ring sysfs entry corresponding to ring buffers for a channel. ++ * @channel: Pointer to vmbus_channel structure ++ * ++ * Hide "ring" sysfs for a channel by changing its is_visible attribute and updating sysfs group. ++ * ++ * Returns 0 on success or error code on failure. ++ */ ++int hv_remove_ring_sysfs(struct vmbus_channel *channel) ++{ ++ struct kobject *kobj = &channel->kobj; ++ int ret; ++ ++ channel->ring_sysfs_visible = false; ++ ret = sysfs_update_group(kobj, &vmbus_chan_group); ++ channel->mmap_ring_buffer = NULL; ++ return ret; ++} ++EXPORT_SYMBOL_GPL(hv_remove_ring_sysfs); ++ + /* + * vmbus_add_channel_kobj - setup a sub-directory under device/channels + */ +diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c +index 3976360d0096d..c2759bbeed849 100644 +--- a/drivers/uio/uio_hv_generic.c ++++ b/drivers/uio/uio_hv_generic.c +@@ -131,15 +131,12 @@ static void hv_uio_rescind(struct vmbus_channel *channel) + vmbus_device_unregister(channel->device_obj); + } + +-/* Sysfs API to allow mmap of the ring buffers ++/* Function used for mmap of ring buffer sysfs interface. + * The ring buffer is allocated as contiguous memory by vmbus_open + */ +-static int hv_uio_ring_mmap(struct file *filp, struct kobject *kobj, +- const struct bin_attribute *attr, +- struct vm_area_struct *vma) ++static int ++hv_uio_ring_mmap(struct vmbus_channel *channel, struct vm_area_struct *vma) + { +- struct vmbus_channel *channel +- = container_of(kobj, struct vmbus_channel, kobj); + void *ring_buffer = page_address(channel->ringbuffer_page); + + if (channel->state != CHANNEL_OPENED_STATE) +@@ -149,15 +146,6 @@ static int hv_uio_ring_mmap(struct file *filp, struct kobject *kobj, + channel->ringbuffer_pagecount << PAGE_SHIFT); + } + +-static const struct bin_attribute ring_buffer_bin_attr = { +- .attr = { +- .name = "ring", +- .mode = 0600, +- }, +- .size = 2 * SZ_2M, +- .mmap = hv_uio_ring_mmap, +-}; +- + /* Callback from VMBUS subsystem when new channel created. */ + static void + hv_uio_new_channel(struct vmbus_channel *new_sc) +@@ -178,8 +166,7 @@ hv_uio_new_channel(struct vmbus_channel *new_sc) + /* Disable interrupts on sub channel */ + new_sc->inbound.ring_buffer->interrupt_mask = 1; + set_channel_read_mode(new_sc, HV_CALL_ISR); +- +- ret = sysfs_create_bin_file(&new_sc->kobj, &ring_buffer_bin_attr); ++ ret = hv_create_ring_sysfs(new_sc, hv_uio_ring_mmap); + if (ret) { + dev_err(device, "sysfs create ring bin file failed; %d\n", ret); + vmbus_close(new_sc); +@@ -350,10 +337,18 @@ hv_uio_probe(struct hv_device *dev, + goto fail_close; + } + +- ret = sysfs_create_bin_file(&channel->kobj, &ring_buffer_bin_attr); +- if (ret) +- dev_notice(&dev->device, +- "sysfs create ring bin file failed; %d\n", ret); ++ /* ++ * This internally calls sysfs_update_group, which returns a non-zero value if it executes ++ * before sysfs_create_group. This is expected as the 'ring' will be created later in ++ * vmbus_device_register() -> vmbus_add_channel_kobj(). Thus, no need to check the return ++ * value and print warning. ++ * ++ * Creating/exposing sysfs in driver probe is not encouraged as it can lead to race ++ * conditions with userspace. For backward compatibility, "ring" sysfs could not be removed ++ * or decoupled from uio_hv_generic probe. Userspace programs can make use of inotify ++ * APIs to make sure that ring is created. ++ */ ++ hv_create_ring_sysfs(channel, hv_uio_ring_mmap); + + hv_set_drvdata(dev, pdata); + +@@ -375,7 +370,7 @@ hv_uio_remove(struct hv_device *dev) + if (!pdata) + return; + +- sysfs_remove_bin_file(&dev->channel->kobj, &ring_buffer_bin_attr); ++ hv_remove_ring_sysfs(dev->channel); + uio_unregister_device(&pdata->info); + hv_uio_cleanup(dev, pdata); + +diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h +index 02a226bcf0edc..6e331b7adfcd8 100644 +--- a/include/linux/hyperv.h ++++ b/include/linux/hyperv.h +@@ -1067,6 +1067,12 @@ struct vmbus_channel { + + /* The max size of a packet on this channel */ + u32 max_pkt_size; ++ ++ /* function to mmap ring buffer memory to the channel's sysfs ring attribute */ ++ int (*mmap_ring_buffer)(struct vmbus_channel *channel, struct vm_area_struct *vma); ++ ++ /* boolean to control visibility of sysfs for ring buffer */ ++ bool ring_sysfs_visible; + }; + + #define lock_requestor(channel, flags) \ +-- +2.39.5 + diff --git a/queue-6.12/virtio_net-ensure-netdev_tx_reset_queue-is-called-on.patch b/queue-6.12/virtio_net-ensure-netdev_tx_reset_queue-is-called-on.patch new file mode 100644 index 0000000000..a28bbdeeff --- /dev/null +++ b/queue-6.12/virtio_net-ensure-netdev_tx_reset_queue-is-called-on.patch @@ -0,0 +1,41 @@ +From 9e77233212419591f427adaaf64dc1aa1057bc30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 10:10:47 +0900 +Subject: virtio_net: ensure netdev_tx_reset_queue is called on bind xsk for tx + +From: Koichiro Den + +[ Upstream commit 76a771ec4c9adfd75fe53c8505cf656a075d7101 ] + +virtnet_sq_bind_xsk_pool() flushes tx skbs and then resets tx queue, so +DQL counters need to be reset when flushing has actually occurred, Add +virtnet_sq_free_unused_buf_done() as a callback for virtqueue_resize() +to handle this. + +Fixes: 21a4e3ce6dc7 ("virtio_net: xsk: bind/unbind xsk for tx") +Signed-off-by: Koichiro Den +Acked-by: Jason Wang +Reviewed-by: Xuan Zhuo +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index bb444972693a0..6d36cb204f9bc 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -5576,7 +5576,8 @@ static int virtnet_sq_bind_xsk_pool(struct virtnet_info *vi, + + virtnet_tx_pause(vi, sq); + +- err = virtqueue_reset(sq->vq, virtnet_sq_free_unused_buf, NULL); ++ err = virtqueue_reset(sq->vq, virtnet_sq_free_unused_buf, ++ virtnet_sq_free_unused_buf_done); + if (err) { + netdev_err(vi->dev, "reset tx fail: tx queue index: %d err: %d\n", qindex, err); + pool = NULL; +-- +2.39.5 + diff --git a/queue-6.12/virtio_ring-add-a-func-argument-recycle_done-to-virt.patch b/queue-6.12/virtio_ring-add-a-func-argument-recycle_done-to-virt.patch new file mode 100644 index 0000000000..ab7652f1da --- /dev/null +++ b/queue-6.12/virtio_ring-add-a-func-argument-recycle_done-to-virt.patch @@ -0,0 +1,96 @@ +From fc3420e50e645a7796d8d2e16ffeaec9f911826f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 10:10:46 +0900 +Subject: virtio_ring: add a func argument 'recycle_done' to virtqueue_reset() + +From: Koichiro Den + +[ Upstream commit 8d2da07c813ad333c20eb803e15f8c4541f25350 ] + +When virtqueue_reset() has actually recycled all unused buffers, +additional work may be required in some cases. Relying solely on its +return status is fragile, so introduce a new function argument +'recycle_done', which is invoked when it really occurs. + +Signed-off-by: Koichiro Den +Acked-by: Jason Wang +Reviewed-by: Xuan Zhuo +Signed-off-by: Paolo Abeni +Stable-dep-of: 76a771ec4c9a ("virtio_net: ensure netdev_tx_reset_queue is called on bind xsk for tx") +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 4 ++-- + drivers/virtio/virtio_ring.c | 6 +++++- + include/linux/virtio.h | 3 ++- + 3 files changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index fbd1150c33cce..bb444972693a0 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -5547,7 +5547,7 @@ static int virtnet_rq_bind_xsk_pool(struct virtnet_info *vi, struct receive_queu + + virtnet_rx_pause(vi, rq); + +- err = virtqueue_reset(rq->vq, virtnet_rq_unmap_free_buf); ++ err = virtqueue_reset(rq->vq, virtnet_rq_unmap_free_buf, NULL); + if (err) { + netdev_err(vi->dev, "reset rx fail: rx queue index: %d err: %d\n", qindex, err); + +@@ -5576,7 +5576,7 @@ static int virtnet_sq_bind_xsk_pool(struct virtnet_info *vi, + + virtnet_tx_pause(vi, sq); + +- err = virtqueue_reset(sq->vq, virtnet_sq_free_unused_buf); ++ err = virtqueue_reset(sq->vq, virtnet_sq_free_unused_buf, NULL); + if (err) { + netdev_err(vi->dev, "reset tx fail: tx queue index: %d err: %d\n", qindex, err); + pool = NULL; +diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c +index 0112742e4504b..1f8a322eb00be 100644 +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -2815,6 +2815,7 @@ EXPORT_SYMBOL_GPL(virtqueue_set_dma_premapped); + * virtqueue_reset - detach and recycle all unused buffers + * @_vq: the struct virtqueue we're talking about. + * @recycle: callback to recycle unused buffers ++ * @recycle_done: callback to be invoked when recycle for all unused buffers done + * + * Caller must ensure we don't call this with other virtqueue operations + * at the same time (except where noted). +@@ -2826,7 +2827,8 @@ EXPORT_SYMBOL_GPL(virtqueue_set_dma_premapped); + * -EPERM: Operation not permitted + */ + int virtqueue_reset(struct virtqueue *_vq, +- void (*recycle)(struct virtqueue *vq, void *buf)) ++ void (*recycle)(struct virtqueue *vq, void *buf), ++ void (*recycle_done)(struct virtqueue *vq)) + { + struct vring_virtqueue *vq = to_vvq(_vq); + int err; +@@ -2834,6 +2836,8 @@ int virtqueue_reset(struct virtqueue *_vq, + err = virtqueue_disable_and_recycle(_vq, recycle); + if (err) + return err; ++ if (recycle_done) ++ recycle_done(_vq); + + if (vq->packed_ring) + virtqueue_reinit_packed(vq); +diff --git a/include/linux/virtio.h b/include/linux/virtio.h +index 73c8922e69e09..d791d47eb00ed 100644 +--- a/include/linux/virtio.h ++++ b/include/linux/virtio.h +@@ -103,7 +103,8 @@ int virtqueue_resize(struct virtqueue *vq, u32 num, + void (*recycle)(struct virtqueue *vq, void *buf), + void (*recycle_done)(struct virtqueue *vq)); + int virtqueue_reset(struct virtqueue *vq, +- void (*recycle)(struct virtqueue *vq, void *buf)); ++ void (*recycle)(struct virtqueue *vq, void *buf), ++ void (*recycle_done)(struct virtqueue *vq)); + + struct virtio_admin_cmd { + __le16 opcode; +-- +2.39.5 + diff --git a/queue-6.12/vsock-test-fix-occasional-failure-in-siocoutq-tests.patch b/queue-6.12/vsock-test-fix-occasional-failure-in-siocoutq-tests.patch new file mode 100644 index 0000000000..fd892a70ec --- /dev/null +++ b/queue-6.12/vsock-test-fix-occasional-failure-in-siocoutq-tests.patch @@ -0,0 +1,82 @@ +From f581625e26e4dd9287c4a3aeadf2b07b36a5a626 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 May 2025 10:14:56 -0500 +Subject: vsock/test: Fix occasional failure in SIOCOUTQ tests + +From: Konstantin Shkolnyy + +[ Upstream commit 7fd7ad6f36af36f30a06d165eff3780cb139fa79 ] + +These tests: + "SOCK_STREAM ioctl(SIOCOUTQ) 0 unsent bytes" + "SOCK_SEQPACKET ioctl(SIOCOUTQ) 0 unsent bytes" +output: "Unexpected 'SIOCOUTQ' value, expected 0, got 64 (CLIENT)". + +They test that the SIOCOUTQ ioctl reports 0 unsent bytes after the data +have been received by the other side. However, sometimes there is a delay +in updating this "unsent bytes" counter, and the test fails even though +the counter properly goes to 0 several milliseconds later. + +The delay occurs in the kernel because the used buffer notification +callback virtio_vsock_tx_done(), called upon receipt of the data by the +other side, doesn't update the counter itself. It delegates that to +a kernel thread (via vsock->tx_work). Sometimes that thread is delayed +more than the test expects. + +Change the test to poll SIOCOUTQ until it returns 0 or a timeout occurs. + +Signed-off-by: Konstantin Shkolnyy +Reviewed-by: Stefano Garzarella +Fixes: 18ee44ce97c1 ("test/vsock: add ioctl unsent bytes test") +Link: https://patch.msgid.link/20250507151456.2577061-1-kshk@linux.ibm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/vsock/vsock_test.c | 28 ++++++++++++++++------------ + 1 file changed, 16 insertions(+), 12 deletions(-) + +diff --git a/tools/testing/vsock/vsock_test.c b/tools/testing/vsock/vsock_test.c +index 0b7f5bf546da5..0c22ff7a8de2a 100644 +--- a/tools/testing/vsock/vsock_test.c ++++ b/tools/testing/vsock/vsock_test.c +@@ -1283,21 +1283,25 @@ static void test_unsent_bytes_client(const struct test_opts *opts, int type) + send_buf(fd, buf, sizeof(buf), 0, sizeof(buf)); + control_expectln("RECEIVED"); + +- ret = ioctl(fd, SIOCOUTQ, &sock_bytes_unsent); +- if (ret < 0) { +- if (errno == EOPNOTSUPP) { +- fprintf(stderr, "Test skipped, SIOCOUTQ not supported.\n"); +- } else { ++ /* SIOCOUTQ isn't guaranteed to instantly track sent data. Even though ++ * the "RECEIVED" message means that the other side has received the ++ * data, there can be a delay in our kernel before updating the "unsent ++ * bytes" counter. Repeat SIOCOUTQ until it returns 0. ++ */ ++ timeout_begin(TIMEOUT); ++ do { ++ ret = ioctl(fd, SIOCOUTQ, &sock_bytes_unsent); ++ if (ret < 0) { ++ if (errno == EOPNOTSUPP) { ++ fprintf(stderr, "Test skipped, SIOCOUTQ not supported.\n"); ++ break; ++ } + perror("ioctl"); + exit(EXIT_FAILURE); + } +- } else if (ret == 0 && sock_bytes_unsent != 0) { +- fprintf(stderr, +- "Unexpected 'SIOCOUTQ' value, expected 0, got %i\n", +- sock_bytes_unsent); +- exit(EXIT_FAILURE); +- } +- ++ timeout_check("SIOCOUTQ"); ++ } while (sock_bytes_unsent != 0); ++ timeout_end(); + close(fd); + } + +-- +2.39.5 + diff --git a/queue-6.12/wifi-mac80211-set-n_channels-after-allocating-struct.patch b/queue-6.12/wifi-mac80211-set-n_channels-after-allocating-struct.patch new file mode 100644 index 0000000000..30a387d24e --- /dev/null +++ b/queue-6.12/wifi-mac80211-set-n_channels-after-allocating-struct.patch @@ -0,0 +1,55 @@ +From 845ec86128cd2593f17bf7afb8a575a9af2f6b32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 May 2025 11:46:45 -0700 +Subject: wifi: mac80211: Set n_channels after allocating struct + cfg80211_scan_request + +From: Kees Cook + +[ Upstream commit 82bbe02b2500ef0a62053fe2eb84773fe31c5a0a ] + +Make sure that n_channels is set after allocating the +struct cfg80211_registered_device::int_scan_req member. Seen with +syzkaller: + +UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1208:5 +index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]') + +This was missed in the initial conversions because I failed to locate +the allocation likely due to the "sizeof(void *)" not matching the +"channels" array type. + +Reported-by: syzbot+4bcdddd48bb6f0be0da1@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/lkml/680fd171.050a0220.2b69d1.045e.GAE@google.com/ +Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by") +Signed-off-by: Kees Cook +Reviewed-by: Gustavo A. R. Silva +Link: https://patch.msgid.link/20250509184641.work.542-kees@kernel.org +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/main.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/main.c b/net/mac80211/main.c +index ee1211a213d70..caedc939eea19 100644 +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -1344,10 +1344,12 @@ int ieee80211_register_hw(struct ieee80211_hw *hw) + hw->wiphy->software_iftypes |= BIT(NL80211_IFTYPE_MONITOR); + + +- local->int_scan_req = kzalloc(sizeof(*local->int_scan_req) + +- sizeof(void *) * channels, GFP_KERNEL); ++ local->int_scan_req = kzalloc(struct_size(local->int_scan_req, ++ channels, channels), ++ GFP_KERNEL); + if (!local->int_scan_req) + return -ENOMEM; ++ local->int_scan_req->n_channels = channels; + + eth_broadcast_addr(local->int_scan_req->bssid); + +-- +2.39.5 + diff --git a/queue-6.12/xhci-dbc-avoid-event-polling-busyloop-if-pending-rx-.patch b/queue-6.12/xhci-dbc-avoid-event-polling-busyloop-if-pending-rx-.patch new file mode 100644 index 0000000000..74da041646 --- /dev/null +++ b/queue-6.12/xhci-dbc-avoid-event-polling-busyloop-if-pending-rx-.patch @@ -0,0 +1,129 @@ +From d5739aa7de3eb34b07c51ff012574ca46a581206 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 May 2025 15:56:30 +0300 +Subject: xhci: dbc: Avoid event polling busyloop if pending rx transfers are + inactive. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mathias Nyman + +[ Upstream commit cab63934c33b12c0d1e9f4da7450928057f2c142 ] + +Event polling delay is set to 0 if there are any pending requests in +either rx or tx requests lists. Checking for pending requests does +not work well for "IN" transfers as the tty driver always queues +requests to the list and TRBs to the ring, preparing to receive data +from the host. + +This causes unnecessary busylooping and cpu hogging. + +Only set the event polling delay to 0 if there are pending tx "write" +transfers, or if it was less than 10ms since last active data transfer +in any direction. + +Cc: Łukasz Bartosik +Fixes: fb18e5bb9660 ("xhci: dbc: poll at different rate depending on data transfer activity") +Cc: stable@vger.kernel.org +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20250505125630.561699-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-dbgcap.c | 19 ++++++++++++++++--- + drivers/usb/host/xhci-dbgcap.h | 3 +++ + 2 files changed, 19 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/host/xhci-dbgcap.c b/drivers/usb/host/xhci-dbgcap.c +index 6b239b3770d15..d35f3a18dd13b 100644 +--- a/drivers/usb/host/xhci-dbgcap.c ++++ b/drivers/usb/host/xhci-dbgcap.c +@@ -822,6 +822,7 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc) + { + dma_addr_t deq; + union xhci_trb *evt; ++ enum evtreturn ret = EVT_DONE; + u32 ctrl, portsc; + bool update_erdp = false; + +@@ -906,6 +907,7 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc) + break; + case TRB_TYPE(TRB_TRANSFER): + dbc_handle_xfer_event(dbc, evt); ++ ret = EVT_XFER_DONE; + break; + default: + break; +@@ -924,7 +926,7 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc) + lo_hi_writeq(deq, &dbc->regs->erdp); + } + +- return EVT_DONE; ++ return ret; + } + + static void xhci_dbc_handle_events(struct work_struct *work) +@@ -933,6 +935,7 @@ static void xhci_dbc_handle_events(struct work_struct *work) + struct xhci_dbc *dbc; + unsigned long flags; + unsigned int poll_interval; ++ unsigned long busypoll_timelimit; + + dbc = container_of(to_delayed_work(work), struct xhci_dbc, event_work); + poll_interval = dbc->poll_interval; +@@ -951,11 +954,21 @@ static void xhci_dbc_handle_events(struct work_struct *work) + dbc->driver->disconnect(dbc); + break; + case EVT_DONE: +- /* set fast poll rate if there are pending data transfers */ ++ /* ++ * Set fast poll rate if there are pending out transfers, or ++ * a transfer was recently processed ++ */ ++ busypoll_timelimit = dbc->xfer_timestamp + ++ msecs_to_jiffies(DBC_XFER_INACTIVITY_TIMEOUT); ++ + if (!list_empty(&dbc->eps[BULK_OUT].list_pending) || +- !list_empty(&dbc->eps[BULK_IN].list_pending)) ++ time_is_after_jiffies(busypoll_timelimit)) + poll_interval = 0; + break; ++ case EVT_XFER_DONE: ++ dbc->xfer_timestamp = jiffies; ++ poll_interval = 0; ++ break; + default: + dev_info(dbc->dev, "stop handling dbc events\n"); + return; +diff --git a/drivers/usb/host/xhci-dbgcap.h b/drivers/usb/host/xhci-dbgcap.h +index 9dc8f4d8077cc..47ac72c2286d9 100644 +--- a/drivers/usb/host/xhci-dbgcap.h ++++ b/drivers/usb/host/xhci-dbgcap.h +@@ -96,6 +96,7 @@ struct dbc_ep { + #define DBC_WRITE_BUF_SIZE 8192 + #define DBC_POLL_INTERVAL_DEFAULT 64 /* milliseconds */ + #define DBC_POLL_INTERVAL_MAX 5000 /* milliseconds */ ++#define DBC_XFER_INACTIVITY_TIMEOUT 10 /* milliseconds */ + /* + * Private structure for DbC hardware state: + */ +@@ -142,6 +143,7 @@ struct xhci_dbc { + enum dbc_state state; + struct delayed_work event_work; + unsigned int poll_interval; /* ms */ ++ unsigned long xfer_timestamp; + unsigned resume_required:1; + struct dbc_ep eps[2]; + +@@ -187,6 +189,7 @@ struct dbc_request { + enum evtreturn { + EVT_ERR = -1, + EVT_DONE, ++ EVT_XFER_DONE, + EVT_GSER, + EVT_DISC, + }; +-- +2.39.5 + diff --git a/queue-6.12/xhci-dbc-improve-performance-by-removing-delay-in-tr.patch b/queue-6.12/xhci-dbc-improve-performance-by-removing-delay-in-tr.patch new file mode 100644 index 0000000000..5adbcc6d06 --- /dev/null +++ b/queue-6.12/xhci-dbc-improve-performance-by-removing-delay-in-tr.patch @@ -0,0 +1,49 @@ +From e502738982aac42e10d05e673529d16c5cfab3c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Dec 2024 14:01:38 +0200 +Subject: xhci: dbc: Improve performance by removing delay in transfer event + polling. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mathias Nyman + +[ Upstream commit 03e3d9c2bd85cda941b3cf78e895c1498ac05c5f ] + +Queue event polling work with 0 delay in case there are pending transfers +queued up. This is part 2 of a 3 part series that roughly triples dbc +performace when using adb push and pull over dbc. + +Max/min push rate after patches is 210/118 MB/s, pull rate 171/133 MB/s, +tested with large files (300MB-9GB) by Łukasz Bartosik + +First performance improvement patch was commit 31128e7492dc +("xhci: dbc: add dbgtty request to end of list once it completes") + +Cc: Łukasz Bartosik +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20241227120142.1035206-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: cab63934c33b ("xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive.") +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-dbgcap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/xhci-dbgcap.c b/drivers/usb/host/xhci-dbgcap.c +index 241d7aa1fbc20..6b239b3770d15 100644 +--- a/drivers/usb/host/xhci-dbgcap.c ++++ b/drivers/usb/host/xhci-dbgcap.c +@@ -954,7 +954,7 @@ static void xhci_dbc_handle_events(struct work_struct *work) + /* set fast poll rate if there are pending data transfers */ + if (!list_empty(&dbc->eps[BULK_OUT].list_pending) || + !list_empty(&dbc->eps[BULK_IN].list_pending)) +- poll_interval = 1; ++ poll_interval = 0; + break; + default: + dev_info(dbc->dev, "stop handling dbc events\n"); +-- +2.39.5 + -- 2.47.3