From 3af727e588ed2e8a19d5c719a26e66e7f6e58b69 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 20 Nov 2025 17:34:15 +0100 Subject: [PATCH] 6.17-stable patches added patches: btrfs-do-not-update-last_log_commit-when-logging-inode-due-to-a-new-name.patch btrfs-release-root-after-error-in-data_reloc_print_warning_inode.patch btrfs-scrub-put-bio-after-errors-in-scrub_raid56_parity_stripe.patch btrfs-zoned-fix-conventional-zone-capacity-calculation.patch btrfs-zoned-fix-stripe-width-calculation.patch drm-amdgpu-disable-peer-to-peer-access-for-dcc-enabled-gc12-vram-surfaces.patch drm-amdgpu-fix-lock-warning-in-amdgpu_userq_fence_driver_process.patch drm-amdkfd-relax-checks-for-over-allocation-of-save-area.patch drm-i915-psr-fix-pipe-to-vblank-conversion.patch drm-xe-xe3-add-wa_14024681466-for-xe3_lpg.patch drm-xe-xe3-extend-wa_14023061436.patch drm-xe-xe3lpg-extend-wa_15016589081-for-xe3lpg.patch edac-altera-handle-ocram-ecc-enable-after-warm-reset.patch edac-altera-use-inttest-register-for-ethernet-and-usb-sbe-injection.patch loongarch-consolidate-max_pfn-max_low_pfn-calculation.patch loongarch-use-physical-addresses-for-csr_merrentry-csr_tlbrentry.patch pm-hibernate-emit-an-error-when-image-writing-fails.patch pm-hibernate-use-atomic64_t-for-compressed_size-variable.patch pmdomain-arm-scmi-fix-genpd-leak-on-provider-registration-failure.patch pmdomain-imx-fix-reference-count-leak-in-imx_gpc_remove.patch pmdomain-samsung-plug-potential-memleak-during-probe.patch pmdomain-samsung-rework-legacy-splash-screen-handover-workaround.patch selftests-mptcp-connect-fix-fallback-note-due-to-ooo.patch selftests-mptcp-connect-trunc-read-all-recv-data.patch selftests-mptcp-join-endpoints-longer-transfer.patch selftests-mptcp-join-properly-kill-background-tasks.patch selftests-mptcp-join-rm-set-backup-flag.patch selftests-mptcp-join-userspace-longer-transfer.patch --- ...when-logging-inode-due-to-a-new-name.patch | 108 ++++++++++++ ...or-in-data_reloc_print_warning_inode.patch | 41 +++++ ...errors-in-scrub_raid56_parity_stripe.patch | 45 +++++ ...nventional-zone-capacity-calculation.patch | 50 ++++++ ...s-zoned-fix-stripe-width-calculation.patch | 131 ++++++++++++++ ...s-for-dcc-enabled-gc12-vram-surfaces.patch | 67 +++++++ ...in-amdgpu_userq_fence_driver_process.patch | 80 +++++++++ ...cks-for-over-allocation-of-save-area.patch | 59 +++++++ ...15-psr-fix-pipe-to-vblank-conversion.patch | 46 +++++ ...e-xe3-add-wa_14024681466-for-xe3_lpg.patch | 51 ++++++ .../drm-xe-xe3-extend-wa_14023061436.patch | 35 ++++ ...lpg-extend-wa_15016589081-for-xe3lpg.patch | 36 ++++ ...le-ocram-ecc-enable-after-warm-reset.patch | 55 ++++++ ...r-for-ethernet-and-usb-sbe-injection.patch | 49 ++++++ ...date-max_pfn-max_low_pfn-calculation.patch | 156 +++++++++++++++++ ...sses-for-csr_merrentry-csr_tlbrentry.patch | 34 ++++ ...it-an-error-when-image-writing-fails.patch | 52 ++++++ ...mic64_t-for-compressed_size-variable.patch | 66 +++++++ ...eak-on-provider-registration-failure.patch | 77 ++++++++ ...ference-count-leak-in-imx_gpc_remove.patch | 33 ++++ ...-plug-potential-memleak-during-probe.patch | 67 +++++++ ...cy-splash-screen-handover-workaround.patch | 64 +++++++ ...connect-fix-fallback-note-due-to-ooo.patch | 40 +++++ ...tcp-connect-trunc-read-all-recv-data.patch | 82 +++++++++ ...mptcp-join-endpoints-longer-transfer.patch | 73 ++++++++ ...-join-properly-kill-background-tasks.patch | 142 +++++++++++++++ ...ftests-mptcp-join-rm-set-backup-flag.patch | 165 ++++++++++++++++++ ...mptcp-join-userspace-longer-transfer.patch | 82 +++++++++ queue-6.17/series | 28 +++ 29 files changed, 2014 insertions(+) create mode 100644 queue-6.17/btrfs-do-not-update-last_log_commit-when-logging-inode-due-to-a-new-name.patch create mode 100644 queue-6.17/btrfs-release-root-after-error-in-data_reloc_print_warning_inode.patch create mode 100644 queue-6.17/btrfs-scrub-put-bio-after-errors-in-scrub_raid56_parity_stripe.patch create mode 100644 queue-6.17/btrfs-zoned-fix-conventional-zone-capacity-calculation.patch create mode 100644 queue-6.17/btrfs-zoned-fix-stripe-width-calculation.patch create mode 100644 queue-6.17/drm-amdgpu-disable-peer-to-peer-access-for-dcc-enabled-gc12-vram-surfaces.patch create mode 100644 queue-6.17/drm-amdgpu-fix-lock-warning-in-amdgpu_userq_fence_driver_process.patch create mode 100644 queue-6.17/drm-amdkfd-relax-checks-for-over-allocation-of-save-area.patch create mode 100644 queue-6.17/drm-i915-psr-fix-pipe-to-vblank-conversion.patch create mode 100644 queue-6.17/drm-xe-xe3-add-wa_14024681466-for-xe3_lpg.patch create mode 100644 queue-6.17/drm-xe-xe3-extend-wa_14023061436.patch create mode 100644 queue-6.17/drm-xe-xe3lpg-extend-wa_15016589081-for-xe3lpg.patch create mode 100644 queue-6.17/edac-altera-handle-ocram-ecc-enable-after-warm-reset.patch create mode 100644 queue-6.17/edac-altera-use-inttest-register-for-ethernet-and-usb-sbe-injection.patch create mode 100644 queue-6.17/loongarch-consolidate-max_pfn-max_low_pfn-calculation.patch create mode 100644 queue-6.17/loongarch-use-physical-addresses-for-csr_merrentry-csr_tlbrentry.patch create mode 100644 queue-6.17/pm-hibernate-emit-an-error-when-image-writing-fails.patch create mode 100644 queue-6.17/pm-hibernate-use-atomic64_t-for-compressed_size-variable.patch create mode 100644 queue-6.17/pmdomain-arm-scmi-fix-genpd-leak-on-provider-registration-failure.patch create mode 100644 queue-6.17/pmdomain-imx-fix-reference-count-leak-in-imx_gpc_remove.patch create mode 100644 queue-6.17/pmdomain-samsung-plug-potential-memleak-during-probe.patch create mode 100644 queue-6.17/pmdomain-samsung-rework-legacy-splash-screen-handover-workaround.patch create mode 100644 queue-6.17/selftests-mptcp-connect-fix-fallback-note-due-to-ooo.patch create mode 100644 queue-6.17/selftests-mptcp-connect-trunc-read-all-recv-data.patch create mode 100644 queue-6.17/selftests-mptcp-join-endpoints-longer-transfer.patch create mode 100644 queue-6.17/selftests-mptcp-join-properly-kill-background-tasks.patch create mode 100644 queue-6.17/selftests-mptcp-join-rm-set-backup-flag.patch create mode 100644 queue-6.17/selftests-mptcp-join-userspace-longer-transfer.patch diff --git a/queue-6.17/btrfs-do-not-update-last_log_commit-when-logging-inode-due-to-a-new-name.patch b/queue-6.17/btrfs-do-not-update-last_log_commit-when-logging-inode-due-to-a-new-name.patch new file mode 100644 index 0000000000..73d8b7ebe1 --- /dev/null +++ b/queue-6.17/btrfs-do-not-update-last_log_commit-when-logging-inode-due-to-a-new-name.patch @@ -0,0 +1,108 @@ +From bfe3d755ef7cec71aac6ecda34a107624735aac7 Mon Sep 17 00:00:00 2001 +From: Filipe Manana +Date: Wed, 29 Oct 2025 13:05:32 +0000 +Subject: btrfs: do not update last_log_commit when logging inode due to a new name + +From: Filipe Manana + +commit bfe3d755ef7cec71aac6ecda34a107624735aac7 upstream. + +When logging that a new name exists, we skip updating the inode's +last_log_commit field to prevent a later explicit fsync against the inode +from doing nothing (as updating last_log_commit makes btrfs_inode_in_log() +return true). We are detecting, at btrfs_log_inode(), that logging a new +name is happening by checking the logging mode is not LOG_INODE_EXISTS, +but that is not enough because we may log parent directories when logging +a new name of a file in LOG_INODE_ALL mode - we need to check that the +logging_new_name field of the log context too. + +An example scenario where this results in an explicit fsync against a +directory not persisting changes to the directory is the following: + + $ mkfs.btrfs -f /dev/sdc + $ mount /dev/sdc /mnt + + $ touch /mnt/foo + + $ sync + + $ mkdir /mnt/dir + + # Write some data to our file and fsync it. + $ xfs_io -c "pwrite -S 0xab 0 64K" -c "fsync" /mnt/foo + + # Add a new link to our file. Since the file was logged before, we + # update it in the log tree by calling btrfs_log_new_name(). + $ ln /mnt/foo /mnt/dir/bar + + # fsync the root directory - we expect it to persist the dentry for + # the new directory "dir". + $ xfs_io -c "fsync" /mnt + + + +After mounting the fs the entry for directory "dir" does not exists, +despite the explicit fsync on the root directory. + +Here's why this happens: + +1) When we fsync the file we log the inode, so that it's present in the + log tree; + +2) When adding the new link we enter btrfs_log_new_name(), and since the + inode is in the log tree we proceed to updating the inode in the log + tree; + +3) We first set the inode's last_unlink_trans to the current transaction + (early in btrfs_log_new_name()); + +4) We then eventually enter btrfs_log_inode_parent(), and after logging + the file's inode, we call btrfs_log_all_parents() because the inode's + last_unlink_trans matches the current transaction's ID (updated in the + previous step); + +5) So btrfs_log_all_parents() logs the root directory by calling + btrfs_log_inode() for the root's inode with a log mode of LOG_INODE_ALL + so that new dentries are logged; + +6) At btrfs_log_inode(), because the log mode is LOG_INODE_ALL, we + update root inode's last_log_commit to the last transaction that + changed the inode (->last_sub_trans field of the inode), which + corresponds to the current transaction's ID; + +7) Then later when user space explicitly calls fsync against the root + directory, we enter btrfs_sync_file(), which calls skip_inode_logging() + and that returns true, since its call to btrfs_inode_in_log() returns + true and there are no ordered extents (it's a directory, never has + ordered extents). This results in btrfs_sync_file() returning without + syncing the log or committing the current transaction, so all the + updates we did when logging the new name, including logging the root + directory, are not persisted. + +So fix this by but updating the inode's last_log_commit if we are sure +we are not logging a new name (if ctx->logging_new_name is false). + +A test case for fstests will follow soon. + +Reported-by: Vyacheslav Kovalevsky +Link: https://lore.kernel.org/linux-btrfs/03c5d7ec-5b3d-49d1-95bc-8970a7f82d87@gmail.com/ +Fixes: 130341be7ffa ("btrfs: always update the logged transaction when logging new names") +CC: stable@vger.kernel.org # 6.1+ +Signed-off-by: Filipe Manana +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/tree-log.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -6812,7 +6812,7 @@ log_extents: + * a power failure unless the log was synced as part of an fsync + * against any other unrelated inode. + */ +- if (inode_only != LOG_INODE_EXISTS) ++ if (!ctx->logging_new_name && inode_only != LOG_INODE_EXISTS) + inode->last_log_commit = inode->last_sub_trans; + spin_unlock(&inode->lock); + diff --git a/queue-6.17/btrfs-release-root-after-error-in-data_reloc_print_warning_inode.patch b/queue-6.17/btrfs-release-root-after-error-in-data_reloc_print_warning_inode.patch new file mode 100644 index 0000000000..c6778b10e2 --- /dev/null +++ b/queue-6.17/btrfs-release-root-after-error-in-data_reloc_print_warning_inode.patch @@ -0,0 +1,41 @@ +From c367af440e03eba7beb0c9f3fe540f9bcb69134a Mon Sep 17 00:00:00 2001 +From: Zilin Guan +Date: Wed, 5 Nov 2025 02:37:22 +0000 +Subject: btrfs: release root after error in data_reloc_print_warning_inode() + +From: Zilin Guan + +commit c367af440e03eba7beb0c9f3fe540f9bcb69134a upstream. + +data_reloc_print_warning_inode() calls btrfs_get_fs_root() to obtain +local_root, but fails to release its reference when paths_from_inode() +returns an error. This causes a potential memory leak. + +Add a missing btrfs_put_root() call in the error path to properly +decrease the reference count of local_root. + +Fixes: b9a9a85059cde ("btrfs: output affected files when relocation fails") +CC: stable@vger.kernel.org # 6.6+ +Reviewed-by: Qu Wenruo +Signed-off-by: Zilin Guan +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/inode.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -174,8 +174,10 @@ static int data_reloc_print_warning_inod + return ret; + } + ret = paths_from_inode(inum, ipath); +- if (ret < 0) ++ if (ret < 0) { ++ btrfs_put_root(local_root); + goto err; ++ } + + /* + * We deliberately ignore the bit ipath might have been too small to diff --git a/queue-6.17/btrfs-scrub-put-bio-after-errors-in-scrub_raid56_parity_stripe.patch b/queue-6.17/btrfs-scrub-put-bio-after-errors-in-scrub_raid56_parity_stripe.patch new file mode 100644 index 0000000000..d9b62ac4b2 --- /dev/null +++ b/queue-6.17/btrfs-scrub-put-bio-after-errors-in-scrub_raid56_parity_stripe.patch @@ -0,0 +1,45 @@ +From 5fea61aa1ca70c4b3738eebad9ce2d7e7938ebbd Mon Sep 17 00:00:00 2001 +From: Zilin Guan +Date: Wed, 5 Nov 2025 03:53:21 +0000 +Subject: btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() + +From: Zilin Guan + +commit 5fea61aa1ca70c4b3738eebad9ce2d7e7938ebbd upstream. + +scrub_raid56_parity_stripe() allocates a bio with bio_alloc(), but +fails to release it on some error paths, leading to a potential +memory leak. + +Add the missing bio_put() calls to properly drop the bio reference +in those error cases. + +Fixes: 1009254bf22a3 ("btrfs: scrub: use scrub_stripe to implement RAID56 P/Q scrub") +CC: stable@vger.kernel.org # 6.6+ +Reviewed-by: Qu Wenruo +Signed-off-by: Zilin Guan +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/scrub.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/btrfs/scrub.c ++++ b/fs/btrfs/scrub.c +@@ -2185,6 +2185,7 @@ static int scrub_raid56_parity_stripe(st + ret = btrfs_map_block(fs_info, BTRFS_MAP_WRITE, full_stripe_start, + &length, &bioc, NULL, NULL); + if (ret < 0) { ++ bio_put(bio); + btrfs_put_bioc(bioc); + btrfs_bio_counter_dec(fs_info); + goto out; +@@ -2194,6 +2195,7 @@ static int scrub_raid56_parity_stripe(st + btrfs_put_bioc(bioc); + if (!rbio) { + ret = -ENOMEM; ++ bio_put(bio); + btrfs_bio_counter_dec(fs_info); + goto out; + } diff --git a/queue-6.17/btrfs-zoned-fix-conventional-zone-capacity-calculation.patch b/queue-6.17/btrfs-zoned-fix-conventional-zone-capacity-calculation.patch new file mode 100644 index 0000000000..4b4e3e5f1e --- /dev/null +++ b/queue-6.17/btrfs-zoned-fix-conventional-zone-capacity-calculation.patch @@ -0,0 +1,50 @@ +From 94f54924b96d3565c6b559294b3401b5496c21ac Mon Sep 17 00:00:00 2001 +From: Naohiro Aota +Date: Fri, 12 Sep 2025 15:43:21 +0900 +Subject: btrfs: zoned: fix conventional zone capacity calculation + +From: Naohiro Aota + +commit 94f54924b96d3565c6b559294b3401b5496c21ac upstream. + +When a block group contains both conventional zone and sequential zone, the +capacity of the block group is wrongly set to the block group's full +length. The capacity should be calculated in btrfs_load_block_group_* using +the last allocation offset. + +Fixes: 568220fa9657 ("btrfs: zoned: support RAID0/1/10 on top of raid stripe tree") +CC: stable@vger.kernel.org # v6.12+ +Signed-off-by: Naohiro Aota +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/zoned.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/zoned.c ++++ b/fs/btrfs/zoned.c +@@ -1317,6 +1317,7 @@ static int btrfs_load_zone_info(struct b + if (!btrfs_dev_is_sequential(device, info->physical)) { + up_read(&dev_replace->rwsem); + info->alloc_offset = WP_CONVENTIONAL; ++ info->capacity = device->zone_info->zone_size; + return 0; + } + +@@ -1683,8 +1684,6 @@ int btrfs_load_block_group_zone_info(str + set_bit(BLOCK_GROUP_FLAG_SEQUENTIAL_ZONE, &cache->runtime_flags); + + if (num_conventional > 0) { +- /* Zone capacity is always zone size in emulation */ +- cache->zone_capacity = cache->length; + ret = calculate_alloc_pointer(cache, &last_alloc, new); + if (ret) { + btrfs_err(fs_info, +@@ -1693,6 +1692,7 @@ int btrfs_load_block_group_zone_info(str + goto out; + } else if (map->num_stripes == num_conventional) { + cache->alloc_offset = last_alloc; ++ cache->zone_capacity = cache->length; + set_bit(BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE, &cache->runtime_flags); + goto out; + } diff --git a/queue-6.17/btrfs-zoned-fix-stripe-width-calculation.patch b/queue-6.17/btrfs-zoned-fix-stripe-width-calculation.patch new file mode 100644 index 0000000000..92ca51f7e4 --- /dev/null +++ b/queue-6.17/btrfs-zoned-fix-stripe-width-calculation.patch @@ -0,0 +1,131 @@ +From 6a1ab50135ce829b834b448ce49867b5210a1641 Mon Sep 17 00:00:00 2001 +From: Naohiro Aota +Date: Tue, 16 Sep 2025 11:46:11 +0900 +Subject: btrfs: zoned: fix stripe width calculation + +From: Naohiro Aota + +commit 6a1ab50135ce829b834b448ce49867b5210a1641 upstream. + +The stripe offset calculation in the zoned code for raid0 and raid10 +wrongly uses map->stripe_size to calculate it. In fact, map->stripe_size is +the size of the device extent composing the block group, which always is +the zone_size on the zoned setup. + +Fix it by using BTRFS_STRIPE_LEN and BTRFS_STRIPE_LEN_SHIFT. Also, optimize +the calculation a bit by doing the common calculation only once. + +Fixes: c0d90a79e8e6 ("btrfs: zoned: fix alloc_offset calculation for partly conventional block groups") +CC: stable@vger.kernel.org # 6.17+ +Signed-off-by: Naohiro Aota +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/zoned.c | 56 +++++++++++++++++++++++++------------------------------ + 1 file changed, 26 insertions(+), 30 deletions(-) + +--- a/fs/btrfs/zoned.c ++++ b/fs/btrfs/zoned.c +@@ -1523,6 +1523,8 @@ static int btrfs_load_block_group_raid0( + u64 last_alloc) + { + struct btrfs_fs_info *fs_info = bg->fs_info; ++ u64 stripe_nr = 0, stripe_offset = 0; ++ u32 stripe_index = 0; + + if ((map->type & BTRFS_BLOCK_GROUP_DATA) && !fs_info->stripe_root) { + btrfs_err(fs_info, "zoned: data %s needs raid-stripe-tree", +@@ -1530,28 +1532,26 @@ static int btrfs_load_block_group_raid0( + return -EINVAL; + } + ++ if (last_alloc) { ++ u32 factor = map->num_stripes; ++ ++ stripe_nr = last_alloc >> BTRFS_STRIPE_LEN_SHIFT; ++ stripe_offset = last_alloc & BTRFS_STRIPE_LEN_MASK; ++ stripe_nr = div_u64_rem(stripe_nr, factor, &stripe_index); ++ } ++ + for (int i = 0; i < map->num_stripes; i++) { + if (zone_info[i].alloc_offset == WP_MISSING_DEV) + continue; + + if (zone_info[i].alloc_offset == WP_CONVENTIONAL) { +- u64 stripe_nr, full_stripe_nr; +- u64 stripe_offset; +- int stripe_index; +- +- stripe_nr = div64_u64(last_alloc, map->stripe_size); +- stripe_offset = stripe_nr * map->stripe_size; +- full_stripe_nr = div_u64(stripe_nr, map->num_stripes); +- div_u64_rem(stripe_nr, map->num_stripes, &stripe_index); + +- zone_info[i].alloc_offset = +- full_stripe_nr * map->stripe_size; ++ zone_info[i].alloc_offset = btrfs_stripe_nr_to_offset(stripe_nr); + + if (stripe_index > i) +- zone_info[i].alloc_offset += map->stripe_size; ++ zone_info[i].alloc_offset += BTRFS_STRIPE_LEN; + else if (stripe_index == i) +- zone_info[i].alloc_offset += +- (last_alloc - stripe_offset); ++ zone_info[i].alloc_offset += stripe_offset; + } + + if (test_bit(0, active) != test_bit(i, active)) { +@@ -1575,6 +1575,8 @@ static int btrfs_load_block_group_raid10 + u64 last_alloc) + { + struct btrfs_fs_info *fs_info = bg->fs_info; ++ u64 stripe_nr = 0, stripe_offset = 0; ++ u32 stripe_index = 0; + + if ((map->type & BTRFS_BLOCK_GROUP_DATA) && !fs_info->stripe_root) { + btrfs_err(fs_info, "zoned: data %s needs raid-stripe-tree", +@@ -1582,6 +1584,14 @@ static int btrfs_load_block_group_raid10 + return -EINVAL; + } + ++ if (last_alloc) { ++ u32 factor = map->num_stripes / map->sub_stripes; ++ ++ stripe_nr = last_alloc >> BTRFS_STRIPE_LEN_SHIFT; ++ stripe_offset = last_alloc & BTRFS_STRIPE_LEN_MASK; ++ stripe_nr = div_u64_rem(stripe_nr, factor, &stripe_index); ++ } ++ + for (int i = 0; i < map->num_stripes; i++) { + if (zone_info[i].alloc_offset == WP_MISSING_DEV) + continue; +@@ -1595,26 +1605,12 @@ static int btrfs_load_block_group_raid10 + } + + if (zone_info[i].alloc_offset == WP_CONVENTIONAL) { +- u64 stripe_nr, full_stripe_nr; +- u64 stripe_offset; +- int stripe_index; +- +- stripe_nr = div64_u64(last_alloc, map->stripe_size); +- stripe_offset = stripe_nr * map->stripe_size; +- full_stripe_nr = div_u64(stripe_nr, +- map->num_stripes / map->sub_stripes); +- div_u64_rem(stripe_nr, +- (map->num_stripes / map->sub_stripes), +- &stripe_index); +- +- zone_info[i].alloc_offset = +- full_stripe_nr * map->stripe_size; ++ zone_info[i].alloc_offset = btrfs_stripe_nr_to_offset(stripe_nr); + + if (stripe_index > (i / map->sub_stripes)) +- zone_info[i].alloc_offset += map->stripe_size; ++ zone_info[i].alloc_offset += BTRFS_STRIPE_LEN; + else if (stripe_index == (i / map->sub_stripes)) +- zone_info[i].alloc_offset += +- (last_alloc - stripe_offset); ++ zone_info[i].alloc_offset += stripe_offset; + } + + if ((i % map->sub_stripes) == 0) { diff --git a/queue-6.17/drm-amdgpu-disable-peer-to-peer-access-for-dcc-enabled-gc12-vram-surfaces.patch b/queue-6.17/drm-amdgpu-disable-peer-to-peer-access-for-dcc-enabled-gc12-vram-surfaces.patch new file mode 100644 index 0000000000..95d406b8ac --- /dev/null +++ b/queue-6.17/drm-amdgpu-disable-peer-to-peer-access-for-dcc-enabled-gc12-vram-surfaces.patch @@ -0,0 +1,67 @@ +From 22a36e660d014925114feb09a2680bb3c2d1e279 Mon Sep 17 00:00:00 2001 +From: Vitaly Prosyak +Date: Thu, 6 Nov 2025 12:35:53 -0500 +Subject: drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vitaly Prosyak + +commit 22a36e660d014925114feb09a2680bb3c2d1e279 upstream. + +Certain multi-GPU configurations (especially GFX12) may hit +data corruption when a DCC-compressed VRAM surface is shared across GPUs +using peer-to-peer (P2P) DMA transfers. + +Such surfaces rely on device-local metadata and cannot be safely accessed +through a remote GPU’s page tables. Attempting to import a DCC-enabled +surface through P2P leads to incorrect rendering or GPU faults. + +This change disables P2P for DCC-enabled VRAM buffers that are contiguous +and allocated on GFX12+ hardware. In these cases, the importer falls back +to the standard system-memory path, avoiding invalid access to compressed +surfaces. + +Future work could consider optional migration (VRAM→System→VRAM) if a +performance regression is observed when `attach->peer2peer = false`. + +Tested on: + - Dual RX 9700 XT (Navi4x) setup + - GNOME and Wayland compositor scenarios + - Confirmed no corruption after disabling P2P under these conditions +v2: Remove check TTM_PL_VRAM & TTM_PL_FLAG_CONTIGUOUS. +v3: simplify for upsteam and fix ip version check (Alex) + +Suggested-by: Christian König +Signed-off-by: Vitaly Prosyak +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +(cherry picked from commit 9dff2bb709e6fbd97e263fd12bf12802d2b5a0cf) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c +@@ -82,6 +82,18 @@ static int amdgpu_dma_buf_attach(struct + struct amdgpu_bo *bo = gem_to_amdgpu_bo(obj); + struct amdgpu_device *adev = amdgpu_ttm_adev(bo->tbo.bdev); + ++ /* ++ * Disable peer-to-peer access for DCC-enabled VRAM surfaces on GFX12+. ++ * Such buffers cannot be safely accessed over P2P due to device-local ++ * compression metadata. Fallback to system-memory path instead. ++ * Device supports GFX12 (GC 12.x or newer) ++ * BO was created with the AMDGPU_GEM_CREATE_GFX12_DCC flag ++ * ++ */ ++ if (amdgpu_ip_version(adev, GC_HWIP, 0) >= IP_VERSION(12, 0, 0) && ++ bo->flags & AMDGPU_GEM_CREATE_GFX12_DCC) ++ attach->peer2peer = false; ++ + if (!amdgpu_dmabuf_is_xgmi_accessible(attach_adev, bo) && + pci_p2pdma_distance(adev->pdev, attach->dev, false) < 0) + attach->peer2peer = false; diff --git a/queue-6.17/drm-amdgpu-fix-lock-warning-in-amdgpu_userq_fence_driver_process.patch b/queue-6.17/drm-amdgpu-fix-lock-warning-in-amdgpu_userq_fence_driver_process.patch new file mode 100644 index 0000000000..14aac0f4da --- /dev/null +++ b/queue-6.17/drm-amdgpu-fix-lock-warning-in-amdgpu_userq_fence_driver_process.patch @@ -0,0 +1,80 @@ +From 6623c5f9fd877868fba133b4ae4dab0052e82dad Mon Sep 17 00:00:00 2001 +From: "Jesse.Zhang" +Date: Fri, 24 Oct 2025 16:09:25 +0800 +Subject: drm/amdgpu: fix lock warning in amdgpu_userq_fence_driver_process +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jesse.Zhang + +commit 6623c5f9fd877868fba133b4ae4dab0052e82dad upstream. + +Fix a potential deadlock caused by inconsistent spinlock usage +between interrupt and process contexts in the userq fence driver. + +The issue occurs when amdgpu_userq_fence_driver_process() is called +from both: +- Interrupt context: gfx_v11_0_eop_irq() -> amdgpu_userq_fence_driver_process() +- Process context: amdgpu_eviction_fence_suspend_worker() -> + amdgpu_userq_fence_driver_force_completion() -> amdgpu_userq_fence_driver_process() + +In interrupt context, the spinlock was acquired without disabling +interrupts, leaving it in {IN-HARDIRQ-W} state. When the same lock +is acquired in process context, the kernel detects inconsistent +locking since the process context acquisition would enable interrupts +while holding a lock previously acquired in interrupt context. + +Kernel log shows: +[ 4039.310790] inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. +[ 4039.310804] kworker/7:2/409 [HC0[0]:SC0[0]:HE1:SE1] takes: +[ 4039.310818] ffff9284e1bed000 (&fence_drv->fence_list_lock){?...}-{3:3}, +[ 4039.310993] {IN-HARDIRQ-W} state was registered at: +[ 4039.311004] lock_acquire+0xc6/0x300 +[ 4039.311018] _raw_spin_lock+0x39/0x80 +[ 4039.311031] amdgpu_userq_fence_driver_process.part.0+0x30/0x180 [amdgpu] +[ 4039.311146] amdgpu_userq_fence_driver_process+0x17/0x30 [amdgpu] +[ 4039.311257] gfx_v11_0_eop_irq+0x132/0x170 [amdgpu] + +Fix by using spin_lock_irqsave()/spin_unlock_irqrestore() to properly +manage interrupt state regardless of calling context. + +Reviewed-by: Christian König +Signed-off-by: Jesse Zhang +Signed-off-by: Alex Deucher +(cherry picked from commit ded3ad780cf97a04927773c4600823b84f7f3cc2) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c +@@ -143,15 +143,16 @@ void amdgpu_userq_fence_driver_process(s + { + struct amdgpu_userq_fence *userq_fence, *tmp; + struct dma_fence *fence; ++ unsigned long flags; + u64 rptr; + int i; + + if (!fence_drv) + return; + ++ spin_lock_irqsave(&fence_drv->fence_list_lock, flags); + rptr = amdgpu_userq_fence_read(fence_drv); + +- spin_lock(&fence_drv->fence_list_lock); + list_for_each_entry_safe(userq_fence, tmp, &fence_drv->fences, link) { + fence = &userq_fence->base; + +@@ -166,7 +167,7 @@ void amdgpu_userq_fence_driver_process(s + list_del(&userq_fence->link); + dma_fence_put(fence); + } +- spin_unlock(&fence_drv->fence_list_lock); ++ spin_unlock_irqrestore(&fence_drv->fence_list_lock, flags); + } + + void amdgpu_userq_fence_driver_destroy(struct kref *ref) diff --git a/queue-6.17/drm-amdkfd-relax-checks-for-over-allocation-of-save-area.patch b/queue-6.17/drm-amdkfd-relax-checks-for-over-allocation-of-save-area.patch new file mode 100644 index 0000000000..234b77f7d4 --- /dev/null +++ b/queue-6.17/drm-amdkfd-relax-checks-for-over-allocation-of-save-area.patch @@ -0,0 +1,59 @@ +From d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 Mon Sep 17 00:00:00 2001 +From: Jonathan Kim +Date: Thu, 6 Nov 2025 10:17:06 -0500 +Subject: drm/amdkfd: relax checks for over allocation of save area + +From: Jonathan Kim + +commit d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 upstream. + +Over allocation of save area is not fatal, only under allocation is. +ROCm has various components that independently claim authority over save +area size. + +Unless KFD decides to claim single authority, relax size checks. + +Signed-off-by: Jonathan Kim +Reviewed-by: Philip Yang +Signed-off-by: Alex Deucher +(cherry picked from commit 15bd4958fe38e763bc17b607ba55155254a01f55) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c +@@ -297,16 +297,16 @@ int kfd_queue_acquire_buffers(struct kfd + goto out_err_unreserve; + } + +- if (properties->ctx_save_restore_area_size != topo_dev->node_props.cwsr_size) { +- pr_debug("queue cwsr size 0x%x not equal to node cwsr size 0x%x\n", ++ if (properties->ctx_save_restore_area_size < topo_dev->node_props.cwsr_size) { ++ pr_debug("queue cwsr size 0x%x not sufficient for node cwsr size 0x%x\n", + properties->ctx_save_restore_area_size, + topo_dev->node_props.cwsr_size); + err = -EINVAL; + goto out_err_unreserve; + } + +- total_cwsr_size = (topo_dev->node_props.cwsr_size + topo_dev->node_props.debug_memory_size) +- * NUM_XCC(pdd->dev->xcc_mask); ++ total_cwsr_size = (properties->ctx_save_restore_area_size + ++ topo_dev->node_props.debug_memory_size) * NUM_XCC(pdd->dev->xcc_mask); + total_cwsr_size = ALIGN(total_cwsr_size, PAGE_SIZE); + + err = kfd_queue_buffer_get(vm, (void *)properties->ctx_save_restore_area_address, +@@ -352,8 +352,8 @@ int kfd_queue_release_buffers(struct kfd + topo_dev = kfd_topology_device_by_id(pdd->dev->id); + if (!topo_dev) + return -EINVAL; +- total_cwsr_size = (topo_dev->node_props.cwsr_size + topo_dev->node_props.debug_memory_size) +- * NUM_XCC(pdd->dev->xcc_mask); ++ total_cwsr_size = (properties->ctx_save_restore_area_size + ++ topo_dev->node_props.debug_memory_size) * NUM_XCC(pdd->dev->xcc_mask); + total_cwsr_size = ALIGN(total_cwsr_size, PAGE_SIZE); + + kfd_queue_buffer_svm_put(pdd, properties->ctx_save_restore_area_address, total_cwsr_size); diff --git a/queue-6.17/drm-i915-psr-fix-pipe-to-vblank-conversion.patch b/queue-6.17/drm-i915-psr-fix-pipe-to-vblank-conversion.patch new file mode 100644 index 0000000000..7c636b0c82 --- /dev/null +++ b/queue-6.17/drm-i915-psr-fix-pipe-to-vblank-conversion.patch @@ -0,0 +1,46 @@ +From 994dec10991b53beac3e16109d876ae363e8a329 Mon Sep 17 00:00:00 2001 +From: Jani Nikula +Date: Thu, 6 Nov 2025 22:00:00 +0200 +Subject: drm/i915/psr: fix pipe to vblank conversion +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jani Nikula + +commit 994dec10991b53beac3e16109d876ae363e8a329 upstream. + +First, we can't assume pipe == crtc index. If a pipe is fused off in +between, it no longer holds. intel_crtc_for_pipe() is the only proper +way to get from a pipe to the corresponding crtc. + +Second, drivers aren't supposed to access or index drm->vblank[] +directly. There's drm_crtc_vblank_crtc() for this. + +Use both functions to fix the pipe to vblank conversion. + +Fixes: f02658c46cf7 ("drm/i915/psr: Add mechanism to notify PSR of pipe enable/disable") +Cc: Jouni Högander +Cc: stable@vger.kernel.org # v6.16+ +Reviewed-by: Jouni Högander +Link: https://patch.msgid.link/20251106200000.1455164-1-jani.nikula@intel.com +Signed-off-by: Jani Nikula +(cherry picked from commit 2750f6765d6974f7e163c5d540a96c8703f6d8dd) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_psr.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/display/intel_psr.c ++++ b/drivers/gpu/drm/i915/display/intel_psr.c +@@ -896,7 +896,8 @@ static bool is_dc5_dc6_blocked(struct in + { + struct intel_display *display = to_intel_display(intel_dp); + u32 current_dc_state = intel_display_power_get_current_dc_state(display); +- struct drm_vblank_crtc *vblank = &display->drm->vblank[intel_dp->psr.pipe]; ++ struct intel_crtc *crtc = intel_crtc_for_pipe(display, intel_dp->psr.pipe); ++ struct drm_vblank_crtc *vblank = drm_crtc_vblank_crtc(&crtc->base); + + return (current_dc_state != DC_STATE_EN_UPTO_DC5 && + current_dc_state != DC_STATE_EN_UPTO_DC6) || diff --git a/queue-6.17/drm-xe-xe3-add-wa_14024681466-for-xe3_lpg.patch b/queue-6.17/drm-xe-xe3-add-wa_14024681466-for-xe3_lpg.patch new file mode 100644 index 0000000000..61296fbde1 --- /dev/null +++ b/queue-6.17/drm-xe-xe3-add-wa_14024681466-for-xe3_lpg.patch @@ -0,0 +1,51 @@ +From 0b2f7be548006b0651e1e8320790f49723265cbc Mon Sep 17 00:00:00 2001 +From: Nitin Gote +Date: Mon, 27 Oct 2025 14:56:43 +0530 +Subject: drm/xe/xe3: Add WA_14024681466 for Xe3_LPG + +From: Nitin Gote + +commit 0b2f7be548006b0651e1e8320790f49723265cbc upstream. + +Apply WA_14024681466 to Xe3_LPG graphics IP versions from 30.00 to 30.05. + +v2: (Matthew Roper) + - Remove stepping filter as workaround applies to all steppings. + - Add an engine class filter so it only applies to the RENDER engine. + +Signed-off-by: Nitin Gote +Link: https://patch.msgid.link/20251027092643.335904-1-nitin.r.gote@intel.com +Reviewed-by: Matt Roper +Signed-off-by: Matt Roper +(cherry picked from commit 071089a69e199bd810ff31c4c933bd528e502743) +Cc: stable@vger.kernel.org # v6.16+ +Signed-off-by: Lucas De Marchi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/regs/xe_gt_regs.h | 1 + + drivers/gpu/drm/xe/xe_wa.c | 4 ++++ + 2 files changed, 5 insertions(+) + +--- a/drivers/gpu/drm/xe/regs/xe_gt_regs.h ++++ b/drivers/gpu/drm/xe/regs/xe_gt_regs.h +@@ -168,6 +168,7 @@ + + #define XEHP_SLICE_COMMON_ECO_CHICKEN1 XE_REG_MCR(0x731c, XE_REG_OPTION_MASKED) + #define MSC_MSAA_REODER_BUF_BYPASS_DISABLE REG_BIT(14) ++#define FAST_CLEAR_VALIGN_FIX REG_BIT(13) + + #define XE2LPM_CCCHKNREG1 XE_REG(0x82a8) + +--- a/drivers/gpu/drm/xe/xe_wa.c ++++ b/drivers/gpu/drm/xe/xe_wa.c +@@ -890,6 +890,10 @@ static const struct xe_rtp_entry_sr lrc_ + ENGINE_CLASS(RENDER)), + XE_RTP_ACTIONS(SET(CHICKEN_RASTER_1, DIS_CLIP_NEGATIVE_BOUNDING_BOX)) + }, ++ { XE_RTP_NAME("14024681466"), ++ XE_RTP_RULES(GRAPHICS_VERSION_RANGE(3000, 3005), ENGINE_CLASS(RENDER)), ++ XE_RTP_ACTIONS(SET(XEHP_SLICE_COMMON_ECO_CHICKEN1, FAST_CLEAR_VALIGN_FIX)) ++ }, + }; + + static __maybe_unused const struct xe_rtp_entry oob_was[] = { diff --git a/queue-6.17/drm-xe-xe3-extend-wa_14023061436.patch b/queue-6.17/drm-xe-xe3-extend-wa_14023061436.patch new file mode 100644 index 0000000000..dc8e94d792 --- /dev/null +++ b/queue-6.17/drm-xe-xe3-extend-wa_14023061436.patch @@ -0,0 +1,35 @@ +From fa3376319b83ba8b7fd55f2c1a268dcbf9d6eedc Mon Sep 17 00:00:00 2001 +From: Tangudu Tilak Tirumalesh +Date: Thu, 30 Oct 2025 21:16:26 +0530 +Subject: drm/xe/xe3: Extend wa_14023061436 + +From: Tangudu Tilak Tirumalesh + +commit fa3376319b83ba8b7fd55f2c1a268dcbf9d6eedc upstream. + +Extend wa_14023061436 to Graphics Versions 30.03, 30.04 +and 30.05. + +Signed-off-by: Tangudu Tilak Tirumalesh +Reviewed-by: Matt Roper +Link: https://patch.msgid.link/20251030154626.3124565-1-tilak.tirumalesh.tangudu@intel.com +Signed-off-by: Matt Roper +(cherry picked from commit 0dd656d06f50ae4cedf160634cf13fd9e0944cf7) +Cc: stable@vger.kernel.org # v6.17+ +Signed-off-by: Lucas De Marchi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_wa.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/xe/xe_wa.c ++++ b/drivers/gpu/drm/xe/xe_wa.c +@@ -653,6 +653,8 @@ static const struct xe_rtp_entry_sr engi + }, + { XE_RTP_NAME("14023061436"), + XE_RTP_RULES(GRAPHICS_VERSION_RANGE(3000, 3001), ++ FUNC(xe_rtp_match_first_render_or_compute), OR, ++ GRAPHICS_VERSION_RANGE(3003, 3005), + FUNC(xe_rtp_match_first_render_or_compute)), + XE_RTP_ACTIONS(SET(TDL_CHICKEN, QID_WAIT_FOR_THREAD_NOT_RUN_DISABLE)) + }, diff --git a/queue-6.17/drm-xe-xe3lpg-extend-wa_15016589081-for-xe3lpg.patch b/queue-6.17/drm-xe-xe3lpg-extend-wa_15016589081-for-xe3lpg.patch new file mode 100644 index 0000000000..4df3aba245 --- /dev/null +++ b/queue-6.17/drm-xe-xe3lpg-extend-wa_15016589081-for-xe3lpg.patch @@ -0,0 +1,36 @@ +From 240372edaf854c9136f5ead45f2d8cd9496a9cb3 Mon Sep 17 00:00:00 2001 +From: Nitin Gote +Date: Thu, 6 Nov 2025 15:35:17 +0530 +Subject: drm/xe/xe3lpg: Extend Wa_15016589081 for xe3lpg + +From: Nitin Gote + +commit 240372edaf854c9136f5ead45f2d8cd9496a9cb3 upstream. + +Wa_15016589081 applies to Xe3_LPG renderCS + +Signed-off-by: Nitin Gote +Link: https://patch.msgid.link/20251106100516.318863-2-nitin.r.gote@intel.com +Signed-off-by: Matt Roper +(cherry picked from commit 715974499a2199bd199fb4630501f55545342ea4) +Cc: stable@vger.kernel.org # v6.16+ +Signed-off-by: Lucas De Marchi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_wa.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/gpu/drm/xe/xe_wa.c ++++ b/drivers/gpu/drm/xe/xe_wa.c +@@ -883,6 +883,11 @@ static const struct xe_rtp_entry_sr lrc_ + XE_RTP_RULES(GRAPHICS_VERSION_RANGE(3000, 3003), ENGINE_CLASS(RENDER)), + XE_RTP_ACTIONS(SET(COMMON_SLICE_CHICKEN4, SBE_PUSH_CONSTANT_BEHIND_FIX_ENABLE)) + }, ++ { XE_RTP_NAME("15016589081"), ++ XE_RTP_RULES(GRAPHICS_VERSION(3000), GRAPHICS_STEP(A0, B0), ++ ENGINE_CLASS(RENDER)), ++ XE_RTP_ACTIONS(SET(CHICKEN_RASTER_1, DIS_CLIP_NEGATIVE_BOUNDING_BOX)) ++ }, + }; + + static __maybe_unused const struct xe_rtp_entry oob_was[] = { diff --git a/queue-6.17/edac-altera-handle-ocram-ecc-enable-after-warm-reset.patch b/queue-6.17/edac-altera-handle-ocram-ecc-enable-after-warm-reset.patch new file mode 100644 index 0000000000..d6d29adbc3 --- /dev/null +++ b/queue-6.17/edac-altera-handle-ocram-ecc-enable-after-warm-reset.patch @@ -0,0 +1,55 @@ +From fd3ecda38fe0cb713d167b5477d25f6b350f0514 Mon Sep 17 00:00:00 2001 +From: Niravkumar L Rabara +Date: Tue, 11 Nov 2025 16:08:01 +0800 +Subject: EDAC/altera: Handle OCRAM ECC enable after warm reset + +From: Niravkumar L Rabara + +commit fd3ecda38fe0cb713d167b5477d25f6b350f0514 upstream. + +The OCRAM ECC is always enabled either by the BootROM or by the Secure Device +Manager (SDM) during a power-on reset on SoCFPGA. + +However, during a warm reset, the OCRAM content is retained to preserve data, +while the control and status registers are reset to their default values. As +a result, ECC must be explicitly re-enabled after a warm reset. + +Fixes: 17e47dc6db4f ("EDAC/altera: Add Stratix10 OCRAM ECC support") +Signed-off-by: Niravkumar L Rabara +Signed-off-by: Borislav Petkov (AMD) +Acked-by: Dinh Nguyen +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20251111080801.1279401-1-niravkumarlaxmidas.rabara@altera.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/edac/altera_edac.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +--- a/drivers/edac/altera_edac.c ++++ b/drivers/edac/altera_edac.c +@@ -1184,10 +1184,22 @@ altr_check_ocram_deps_init(struct altr_e + if (ret) + return ret; + +- /* Verify OCRAM has been initialized */ ++ /* ++ * Verify that OCRAM has been initialized. ++ * During a warm reset, OCRAM contents are retained, but the control ++ * and status registers are reset to their default values. Therefore, ++ * ECC must be explicitly re-enabled in the control register. ++ * Error condition: if INITCOMPLETEA is clear and ECC_EN is already set. ++ */ + if (!ecc_test_bits(ALTR_A10_ECC_INITCOMPLETEA, +- (base + ALTR_A10_ECC_INITSTAT_OFST))) +- return -ENODEV; ++ (base + ALTR_A10_ECC_INITSTAT_OFST))) { ++ if (!ecc_test_bits(ALTR_A10_ECC_EN, ++ (base + ALTR_A10_ECC_CTRL_OFST))) ++ ecc_set_bits(ALTR_A10_ECC_EN, ++ (base + ALTR_A10_ECC_CTRL_OFST)); ++ else ++ return -ENODEV; ++ } + + /* Enable IRQ on Single Bit Error */ + writel(ALTR_A10_ECC_SERRINTEN, (base + ALTR_A10_ECC_ERRINTENS_OFST)); diff --git a/queue-6.17/edac-altera-use-inttest-register-for-ethernet-and-usb-sbe-injection.patch b/queue-6.17/edac-altera-use-inttest-register-for-ethernet-and-usb-sbe-injection.patch new file mode 100644 index 0000000000..474b5c9727 --- /dev/null +++ b/queue-6.17/edac-altera-use-inttest-register-for-ethernet-and-usb-sbe-injection.patch @@ -0,0 +1,49 @@ +From 281326be67252ac5794d1383f67526606b1d6b13 Mon Sep 17 00:00:00 2001 +From: Niravkumar L Rabara +Date: Tue, 11 Nov 2025 16:13:33 +0800 +Subject: EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection + +From: Niravkumar L Rabara + +commit 281326be67252ac5794d1383f67526606b1d6b13 upstream. + +The current single-bit error injection mechanism flips bits directly in ECC RAM +by performing write and read operations. When the ECC RAM is actively used by +the Ethernet or USB controller, this approach sometimes trigger a false +double-bit error. + +Switch both Ethernet and USB EDAC devices to use the INTTEST register +(altr_edac_a10_device_inject_fops) for single-bit error injection, similar to +the existing double-bit error injection method. + +Fixes: 064acbd4f4ab ("EDAC, altera: Add Stratix10 peripheral support") +Signed-off-by: Niravkumar L Rabara +Signed-off-by: Borislav Petkov (AMD) +Acked-by: Dinh Nguyen +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20251111081333.1279635-1-niravkumarlaxmidas.rabara@altera.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/edac/altera_edac.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/edac/altera_edac.c ++++ b/drivers/edac/altera_edac.c +@@ -1369,7 +1369,7 @@ static const struct edac_device_prv_data + .ue_set_mask = ALTR_A10_ECC_TDERRA, + .set_err_ofst = ALTR_A10_ECC_INTTEST_OFST, + .ecc_irq_handler = altr_edac_a10_ecc_irq, +- .inject_fops = &altr_edac_a10_device_inject2_fops, ++ .inject_fops = &altr_edac_a10_device_inject_fops, + }; + + #endif /* CONFIG_EDAC_ALTERA_ETHERNET */ +@@ -1459,7 +1459,7 @@ static const struct edac_device_prv_data + .ue_set_mask = ALTR_A10_ECC_TDERRA, + .set_err_ofst = ALTR_A10_ECC_INTTEST_OFST, + .ecc_irq_handler = altr_edac_a10_ecc_irq, +- .inject_fops = &altr_edac_a10_device_inject2_fops, ++ .inject_fops = &altr_edac_a10_device_inject_fops, + }; + + #endif /* CONFIG_EDAC_ALTERA_USB */ diff --git a/queue-6.17/loongarch-consolidate-max_pfn-max_low_pfn-calculation.patch b/queue-6.17/loongarch-consolidate-max_pfn-max_low_pfn-calculation.patch new file mode 100644 index 0000000000..ef9508b107 --- /dev/null +++ b/queue-6.17/loongarch-consolidate-max_pfn-max_low_pfn-calculation.patch @@ -0,0 +1,156 @@ +From ce5ad03e459ecb3b4993a8f311fd4f2fb3e6ef81 Mon Sep 17 00:00:00 2001 +From: Huacai Chen +Date: Sun, 9 Nov 2025 16:02:01 +0800 +Subject: LoongArch: Consolidate max_pfn & max_low_pfn calculation + +From: Huacai Chen + +commit ce5ad03e459ecb3b4993a8f311fd4f2fb3e6ef81 upstream. + +Now there 5 places which calculate max_pfn & max_low_pfn: +1. in fdt_setup() for FDT systems; +2. in memblock_init() for ACPI systems; +3. in init_numa_memory() for NUMA systems; +4. in arch_mem_init() to recalculate for "mem=" cmdline; +5. in paging_init() to recalculate for NUMA systems. + +Since memblock_init() is called both for ACPI and FDT systems, move the +calculation out of the for_each_efi_memory_desc() loop can eliminate the +first case. The last case is very questionable (may be derived from the +MIPS/Loongson code) and breaks the "mem=" cmdline, so should be removed. +And then the NUMA version of paging_init() can be also eliminated. + +After consolidation there are 3 places of calculation: +1. in memblock_init() for both ACPI and FDT systems; +2. in init_numa_memory() to recalculate for NUMA systems; +3. in arch_mem_init() to recalculate for the "mem=" cmdline. + +For all cases the calculation is: +max_pfn = PFN_DOWN(memblock_end_of_DRAM()); +max_low_pfn = min(PFN_DOWN(HIGHMEM_START), max_pfn); + +Cc: stable@vger.kernel.org +Signed-off-by: Huacai Chen +Signed-off-by: Greg Kroah-Hartman +--- + arch/loongarch/kernel/mem.c | 7 +++---- + arch/loongarch/kernel/numa.c | 23 ++--------------------- + arch/loongarch/kernel/setup.c | 5 ++--- + arch/loongarch/mm/init.c | 2 -- + 4 files changed, 7 insertions(+), 30 deletions(-) + +--- a/arch/loongarch/kernel/mem.c ++++ b/arch/loongarch/kernel/mem.c +@@ -13,7 +13,7 @@ + void __init memblock_init(void) + { + u32 mem_type; +- u64 mem_start, mem_end, mem_size; ++ u64 mem_start, mem_size; + efi_memory_desc_t *md; + + /* Parse memory information */ +@@ -21,7 +21,6 @@ void __init memblock_init(void) + mem_type = md->type; + mem_start = md->phys_addr; + mem_size = md->num_pages << EFI_PAGE_SHIFT; +- mem_end = mem_start + mem_size; + + switch (mem_type) { + case EFI_LOADER_CODE: +@@ -31,8 +30,6 @@ void __init memblock_init(void) + case EFI_PERSISTENT_MEMORY: + case EFI_CONVENTIONAL_MEMORY: + memblock_add(mem_start, mem_size); +- if (max_low_pfn < (mem_end >> PAGE_SHIFT)) +- max_low_pfn = mem_end >> PAGE_SHIFT; + break; + case EFI_PAL_CODE: + case EFI_UNUSABLE_MEMORY: +@@ -49,6 +46,8 @@ void __init memblock_init(void) + } + } + ++ max_pfn = PFN_DOWN(memblock_end_of_DRAM()); ++ max_low_pfn = min(PFN_DOWN(HIGHMEM_START), max_pfn); + memblock_set_current_limit(PFN_PHYS(max_low_pfn)); + + /* Reserve the first 2MB */ +--- a/arch/loongarch/kernel/numa.c ++++ b/arch/loongarch/kernel/numa.c +@@ -272,7 +272,8 @@ int __init init_numa_memory(void) + node_mem_init(node); + node_set_online(node); + } +- max_low_pfn = PHYS_PFN(memblock_end_of_DRAM()); ++ max_pfn = PFN_DOWN(memblock_end_of_DRAM()); ++ max_low_pfn = min(PFN_DOWN(HIGHMEM_START), max_pfn); + + setup_nr_node_ids(); + loongson_sysconf.nr_nodes = nr_node_ids; +@@ -283,26 +284,6 @@ int __init init_numa_memory(void) + + #endif + +-void __init paging_init(void) +-{ +- unsigned int node; +- unsigned long zones_size[MAX_NR_ZONES] = {0, }; +- +- for_each_online_node(node) { +- unsigned long start_pfn, end_pfn; +- +- get_pfn_range_for_nid(node, &start_pfn, &end_pfn); +- +- if (end_pfn > max_low_pfn) +- max_low_pfn = end_pfn; +- } +-#ifdef CONFIG_ZONE_DMA32 +- zones_size[ZONE_DMA32] = MAX_DMA32_PFN; +-#endif +- zones_size[ZONE_NORMAL] = max_low_pfn; +- free_area_init(zones_size); +-} +- + int pcibus_to_node(struct pci_bus *bus) + { + return dev_to_node(&bus->dev); +--- a/arch/loongarch/kernel/setup.c ++++ b/arch/loongarch/kernel/setup.c +@@ -294,8 +294,6 @@ static void __init fdt_setup(void) + + early_init_dt_scan(fdt_pointer, __pa(fdt_pointer)); + early_init_fdt_reserve_self(); +- +- max_low_pfn = PFN_PHYS(memblock_end_of_DRAM()); + #endif + } + +@@ -390,7 +388,8 @@ static void __init check_kernel_sections + static void __init arch_mem_init(char **cmdline_p) + { + /* Recalculate max_low_pfn for "mem=xxx" */ +- max_pfn = max_low_pfn = PHYS_PFN(memblock_end_of_DRAM()); ++ max_pfn = PFN_DOWN(memblock_end_of_DRAM()); ++ max_low_pfn = min(PFN_DOWN(HIGHMEM_START), max_pfn); + + if (usermem) + pr_info("User-defined physical RAM map overwrite\n"); +--- a/arch/loongarch/mm/init.c ++++ b/arch/loongarch/mm/init.c +@@ -60,7 +60,6 @@ int __ref page_is_ram(unsigned long pfn) + return memblock_is_memory(addr) && !memblock_is_reserved(addr); + } + +-#ifndef CONFIG_NUMA + void __init paging_init(void) + { + unsigned long max_zone_pfns[MAX_NR_ZONES]; +@@ -72,7 +71,6 @@ void __init paging_init(void) + + free_area_init(max_zone_pfns); + } +-#endif /* !CONFIG_NUMA */ + + void __ref free_initmem(void) + { diff --git a/queue-6.17/loongarch-use-physical-addresses-for-csr_merrentry-csr_tlbrentry.patch b/queue-6.17/loongarch-use-physical-addresses-for-csr_merrentry-csr_tlbrentry.patch new file mode 100644 index 0000000000..4802ff2e44 --- /dev/null +++ b/queue-6.17/loongarch-use-physical-addresses-for-csr_merrentry-csr_tlbrentry.patch @@ -0,0 +1,34 @@ +From 4e67526840fc55917581b90f6a4b65849a616dd8 Mon Sep 17 00:00:00 2001 +From: Huacai Chen +Date: Sun, 9 Nov 2025 16:02:00 +0800 +Subject: LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY + +From: Huacai Chen + +commit 4e67526840fc55917581b90f6a4b65849a616dd8 upstream. + +Now we use virtual addresses to fill CSR_MERRENTRY/CSR_TLBRENTRY, but +hardware hope physical addresses. Now it works well because the high +bits are ignored above PA_BITS (48 bits), but explicitly use physical +addresses can avoid potential bugs. So fix it. + +Cc: stable@vger.kernel.org +Signed-off-by: Huacai Chen +Signed-off-by: Greg Kroah-Hartman +--- + arch/loongarch/kernel/traps.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/loongarch/kernel/traps.c ++++ b/arch/loongarch/kernel/traps.c +@@ -1131,8 +1131,8 @@ static void configure_exception_vector(v + tlbrentry = (unsigned long)exception_handlers + 80*VECSIZE; + + csr_write64(eentry, LOONGARCH_CSR_EENTRY); +- csr_write64(eentry, LOONGARCH_CSR_MERRENTRY); +- csr_write64(tlbrentry, LOONGARCH_CSR_TLBRENTRY); ++ csr_write64(__pa(eentry), LOONGARCH_CSR_MERRENTRY); ++ csr_write64(__pa(tlbrentry), LOONGARCH_CSR_TLBRENTRY); + } + + void per_cpu_trap_init(int cpu) diff --git a/queue-6.17/pm-hibernate-emit-an-error-when-image-writing-fails.patch b/queue-6.17/pm-hibernate-emit-an-error-when-image-writing-fails.patch new file mode 100644 index 0000000000..1944be096e --- /dev/null +++ b/queue-6.17/pm-hibernate-emit-an-error-when-image-writing-fails.patch @@ -0,0 +1,52 @@ +From 62b9ca1706e1bbb60d945a58de7c7b5826f6b2a2 Mon Sep 17 00:00:00 2001 +From: "Mario Limonciello (AMD)" +Date: Wed, 5 Nov 2025 22:51:05 -0600 +Subject: PM: hibernate: Emit an error when image writing fails + +From: Mario Limonciello (AMD) + +commit 62b9ca1706e1bbb60d945a58de7c7b5826f6b2a2 upstream. + +If image writing fails, a return code is passed up to the caller, but +none of the callers log anything to the log and so the only record +of it is the return code that userspace gets. + +Adjust the logging so that the image size and speed of writing is +only emitted on success and if there is an error, it's saved to the +logs. + +Fixes: a06c6f5d3cc9 ("PM: hibernate: Move to crypto APIs for LZO compression") +Reported-by: Askar Safin +Closes: https://lore.kernel.org/linux-pm/20251105180506.137448-1-safinaskar@gmail.com/ +Signed-off-by: Mario Limonciello (AMD) +Tested-by: Askar Safin +Cc: 6.9+ # 6.9+ +[ rjw: Added missing braces after "else", changelog edits ] +Link: https://patch.msgid.link/20251106045158.3198061-2-superm1@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + kernel/power/swap.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/kernel/power/swap.c ++++ b/kernel/power/swap.c +@@ -877,11 +877,14 @@ out_finish: + stop = ktime_get(); + if (!ret) + ret = err2; +- if (!ret) ++ if (!ret) { ++ swsusp_show_speed(start, stop, nr_to_write, "Wrote"); ++ pr_info("Image size after compression: %d kbytes\n", ++ (atomic_read(&compressed_size) / 1024)); + pr_info("Image saving done\n"); +- swsusp_show_speed(start, stop, nr_to_write, "Wrote"); +- pr_info("Image size after compression: %d kbytes\n", +- (atomic_read(&compressed_size) / 1024)); ++ } else { ++ pr_err("Image saving failed: %d\n", ret); ++ } + + out_clean: + hib_finish_batch(&hb); diff --git a/queue-6.17/pm-hibernate-use-atomic64_t-for-compressed_size-variable.patch b/queue-6.17/pm-hibernate-use-atomic64_t-for-compressed_size-variable.patch new file mode 100644 index 0000000000..1dbef3eba8 --- /dev/null +++ b/queue-6.17/pm-hibernate-use-atomic64_t-for-compressed_size-variable.patch @@ -0,0 +1,66 @@ +From 66ededc694f1d06a71ca35a3c8e3689e9b85b3ce Mon Sep 17 00:00:00 2001 +From: "Mario Limonciello (AMD)" +Date: Wed, 5 Nov 2025 22:51:06 -0600 +Subject: PM: hibernate: Use atomic64_t for compressed_size variable + +From: Mario Limonciello (AMD) + +commit 66ededc694f1d06a71ca35a3c8e3689e9b85b3ce upstream. + +`compressed_size` can overflow, showing nonsensical values. + +Change from `atomic_t` to `atomic64_t` to prevent overflow. + +Fixes: a06c6f5d3cc9 ("PM: hibernate: Move to crypto APIs for LZO compression") +Reported-by: Askar Safin +Closes: https://lore.kernel.org/linux-pm/20251105180506.137448-1-safinaskar@gmail.com/ +Signed-off-by: Mario Limonciello (AMD) +Tested-by: Askar Safin +Cc: 6.9+ # 6.9+ +Link: https://patch.msgid.link/20251106045158.3198061-3-superm1@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + kernel/power/swap.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/kernel/power/swap.c ++++ b/kernel/power/swap.c +@@ -635,7 +635,7 @@ struct cmp_data { + }; + + /* Indicates the image size after compression */ +-static atomic_t compressed_size = ATOMIC_INIT(0); ++static atomic64_t compressed_size = ATOMIC_INIT(0); + + /* + * Compression function that runs in its own thread. +@@ -664,7 +664,7 @@ static int compress_threadfn(void *data) + d->ret = crypto_acomp_compress(d->cr); + d->cmp_len = d->cr->dlen; + +- atomic_set(&compressed_size, atomic_read(&compressed_size) + d->cmp_len); ++ atomic64_add(d->cmp_len, &compressed_size); + atomic_set_release(&d->stop, 1); + wake_up(&d->done); + } +@@ -696,7 +696,7 @@ static int save_compressed_image(struct + + hib_init_batch(&hb); + +- atomic_set(&compressed_size, 0); ++ atomic64_set(&compressed_size, 0); + + /* + * We'll limit the number of threads for compression to limit memory +@@ -879,8 +879,8 @@ out_finish: + ret = err2; + if (!ret) { + swsusp_show_speed(start, stop, nr_to_write, "Wrote"); +- pr_info("Image size after compression: %d kbytes\n", +- (atomic_read(&compressed_size) / 1024)); ++ pr_info("Image size after compression: %lld kbytes\n", ++ (atomic64_read(&compressed_size) / 1024)); + pr_info("Image saving done\n"); + } else { + pr_err("Image saving failed: %d\n", ret); diff --git a/queue-6.17/pmdomain-arm-scmi-fix-genpd-leak-on-provider-registration-failure.patch b/queue-6.17/pmdomain-arm-scmi-fix-genpd-leak-on-provider-registration-failure.patch new file mode 100644 index 0000000000..3b09f5f97d --- /dev/null +++ b/queue-6.17/pmdomain-arm-scmi-fix-genpd-leak-on-provider-registration-failure.patch @@ -0,0 +1,77 @@ +From 7458f72cc28f9eb0de811effcb5376d0ec19094a Mon Sep 17 00:00:00 2001 +From: Sudeep Holla +Date: Fri, 17 Oct 2025 12:03:20 +0100 +Subject: pmdomain: arm: scmi: Fix genpd leak on provider registration failure + +From: Sudeep Holla + +commit 7458f72cc28f9eb0de811effcb5376d0ec19094a upstream. + +If of_genpd_add_provider_onecell() fails during probe, the previously +created generic power domains are not removed, leading to a memory leak +and potential kernel crash later in genpd_debug_add(). + +Add proper error handling to unwind the initialized domains before +returning from probe to ensure all resources are correctly released on +failure. + +Example crash trace observed without this fix: + + | Unable to handle kernel paging request at virtual address fffffffffffffc70 + | CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.0-rc1 #405 PREEMPT + | Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform + | pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) + | pc : genpd_debug_add+0x2c/0x160 + | lr : genpd_debug_init+0x74/0x98 + | Call trace: + | genpd_debug_add+0x2c/0x160 (P) + | genpd_debug_init+0x74/0x98 + | do_one_initcall+0xd0/0x2d8 + | do_initcall_level+0xa0/0x140 + | do_initcalls+0x60/0xa8 + | do_basic_setup+0x28/0x40 + | kernel_init_freeable+0xe8/0x170 + | kernel_init+0x2c/0x140 + | ret_from_fork+0x10/0x20 + +Fixes: 898216c97ed2 ("firmware: arm_scmi: add device power domain support using genpd") +Signed-off-by: Sudeep Holla +Reviewed-by: Peng Fan +Cc: stable@vger.kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pmdomain/arm/scmi_pm_domain.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/pmdomain/arm/scmi_pm_domain.c ++++ b/drivers/pmdomain/arm/scmi_pm_domain.c +@@ -41,7 +41,7 @@ static int scmi_pd_power_off(struct gene + + static int scmi_pm_domain_probe(struct scmi_device *sdev) + { +- int num_domains, i; ++ int num_domains, i, ret; + struct device *dev = &sdev->dev; + struct device_node *np = dev->of_node; + struct scmi_pm_domain *scmi_pd; +@@ -108,9 +108,18 @@ static int scmi_pm_domain_probe(struct s + scmi_pd_data->domains = domains; + scmi_pd_data->num_domains = num_domains; + ++ ret = of_genpd_add_provider_onecell(np, scmi_pd_data); ++ if (ret) ++ goto err_rm_genpds; ++ + dev_set_drvdata(dev, scmi_pd_data); + +- return of_genpd_add_provider_onecell(np, scmi_pd_data); ++ return 0; ++err_rm_genpds: ++ for (i = num_domains - 1; i >= 0; i--) ++ pm_genpd_remove(domains[i]); ++ ++ return ret; + } + + static void scmi_pm_domain_remove(struct scmi_device *sdev) diff --git a/queue-6.17/pmdomain-imx-fix-reference-count-leak-in-imx_gpc_remove.patch b/queue-6.17/pmdomain-imx-fix-reference-count-leak-in-imx_gpc_remove.patch new file mode 100644 index 0000000000..58ea89c3ee --- /dev/null +++ b/queue-6.17/pmdomain-imx-fix-reference-count-leak-in-imx_gpc_remove.patch @@ -0,0 +1,33 @@ +From bbde14682eba21d86f5f3d6fe2d371b1f97f1e61 Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Tue, 28 Oct 2025 11:16:20 +0800 +Subject: pmdomain: imx: Fix reference count leak in imx_gpc_remove + +From: Miaoqian Lin + +commit bbde14682eba21d86f5f3d6fe2d371b1f97f1e61 upstream. + +of_get_child_by_name() returns a node pointer with refcount incremented, we +should use of_node_put() on it when not needed anymore. Add the missing +of_node_put() to avoid refcount leak. + +Fixes: 721cabf6c660 ("soc: imx: move PGC handling to a new GPC driver") +Cc: stable@vger.kernel.org +Signed-off-by: Miaoqian Lin +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pmdomain/imx/gpc.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/pmdomain/imx/gpc.c ++++ b/drivers/pmdomain/imx/gpc.c +@@ -537,6 +537,8 @@ static void imx_gpc_remove(struct platfo + return; + } + } ++ ++ of_node_put(pgc_node); + } + + static struct platform_driver imx_gpc_driver = { diff --git a/queue-6.17/pmdomain-samsung-plug-potential-memleak-during-probe.patch b/queue-6.17/pmdomain-samsung-plug-potential-memleak-during-probe.patch new file mode 100644 index 0000000000..24e4398b44 --- /dev/null +++ b/queue-6.17/pmdomain-samsung-plug-potential-memleak-during-probe.patch @@ -0,0 +1,67 @@ +From 90c82941adf1986364e0f82c35cf59f2bf5f6a1d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Andr=C3=A9=20Draszik?= +Date: Thu, 16 Oct 2025 16:58:37 +0100 +Subject: pmdomain: samsung: plug potential memleak during probe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: André Draszik + +commit 90c82941adf1986364e0f82c35cf59f2bf5f6a1d upstream. + +of_genpd_add_provider_simple() could fail, in which case this code +leaks the domain name, pd->pd.name. + +Use devm_kstrdup_const() to plug this leak. As a side-effect, we can +simplify existing error handling. + +Fixes: c09a3e6c97f0 ("soc: samsung: pm_domains: Convert to regular platform driver") +Cc: stable@vger.kernel.org +Reviewed-by: Peter Griffin +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: André Draszik +Tested-by: Marek Szyprowski +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pmdomain/samsung/exynos-pm-domains.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/pmdomain/samsung/exynos-pm-domains.c ++++ b/drivers/pmdomain/samsung/exynos-pm-domains.c +@@ -92,13 +92,14 @@ static const struct of_device_id exynos_ + { }, + }; + +-static const char *exynos_get_domain_name(struct device_node *node) ++static const char *exynos_get_domain_name(struct device *dev, ++ struct device_node *node) + { + const char *name; + + if (of_property_read_string(node, "label", &name) < 0) + name = kbasename(node->full_name); +- return kstrdup_const(name, GFP_KERNEL); ++ return devm_kstrdup_const(dev, name, GFP_KERNEL); + } + + static int exynos_pd_probe(struct platform_device *pdev) +@@ -115,15 +116,13 @@ static int exynos_pd_probe(struct platfo + if (!pd) + return -ENOMEM; + +- pd->pd.name = exynos_get_domain_name(np); ++ pd->pd.name = exynos_get_domain_name(dev, np); + if (!pd->pd.name) + return -ENOMEM; + + pd->base = of_iomap(np, 0); +- if (!pd->base) { +- kfree_const(pd->pd.name); ++ if (!pd->base) + return -ENODEV; +- } + + pd->pd.power_off = exynos_pd_power_off; + pd->pd.power_on = exynos_pd_power_on; diff --git a/queue-6.17/pmdomain-samsung-rework-legacy-splash-screen-handover-workaround.patch b/queue-6.17/pmdomain-samsung-rework-legacy-splash-screen-handover-workaround.patch new file mode 100644 index 0000000000..af5019acf5 --- /dev/null +++ b/queue-6.17/pmdomain-samsung-rework-legacy-splash-screen-handover-workaround.patch @@ -0,0 +1,64 @@ +From fccac54b0d3d0602f177bb79f203ae6fbea0e32a Mon Sep 17 00:00:00 2001 +From: Marek Szyprowski +Date: Mon, 27 Oct 2025 13:55:15 +0100 +Subject: pmdomain: samsung: Rework legacy splash-screen handover workaround + +From: Marek Szyprowski + +commit fccac54b0d3d0602f177bb79f203ae6fbea0e32a upstream. + +Limit the workaround for the lack of the proper splash-screen handover +handling to the legacy ARM 32bit systems and replace forcing a sync_state +by explicite power domain shutdown. This approach lets compiler to +optimize it out on newer ARM 64bit systems. + +Suggested-by: Ulf Hansson +Fixes: 0745658aebbe ("pmdomain: samsung: Fix splash-screen handover by enforcing a sync_state") +Signed-off-by: Marek Szyprowski +Acked-by: Krzysztof Kozlowski +Cc: stable@vger.kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pmdomain/samsung/exynos-pm-domains.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/pmdomain/samsung/exynos-pm-domains.c b/drivers/pmdomain/samsung/exynos-pm-domains.c +index f53e1bd24798..5c3aa8983087 100644 +--- a/drivers/pmdomain/samsung/exynos-pm-domains.c ++++ b/drivers/pmdomain/samsung/exynos-pm-domains.c +@@ -128,6 +128,15 @@ static int exynos_pd_probe(struct platform_device *pdev) + pd->pd.power_on = exynos_pd_power_on; + pd->local_pwr_cfg = pm_domain_cfg->local_pwr_cfg; + ++ /* ++ * Some Samsung platforms with bootloaders turning on the splash-screen ++ * and handing it over to the kernel, requires the power-domains to be ++ * reset during boot. ++ */ ++ if (IS_ENABLED(CONFIG_ARM) && ++ of_device_is_compatible(np, "samsung,exynos4210-pd")) ++ exynos_pd_power_off(&pd->pd); ++ + on = readl_relaxed(pd->base + 0x4) & pd->local_pwr_cfg; + + pm_genpd_init(&pd->pd, NULL, !on); +@@ -146,15 +155,6 @@ static int exynos_pd_probe(struct platform_device *pdev) + parent.np, child.np); + } + +- /* +- * Some Samsung platforms with bootloaders turning on the splash-screen +- * and handing it over to the kernel, requires the power-domains to be +- * reset during boot. As a temporary hack to manage this, let's enforce +- * a sync_state. +- */ +- if (!ret) +- of_genpd_sync_state(np); +- + pm_runtime_enable(dev); + return ret; + } +-- +2.52.0 + diff --git a/queue-6.17/selftests-mptcp-connect-fix-fallback-note-due-to-ooo.patch b/queue-6.17/selftests-mptcp-connect-fix-fallback-note-due-to-ooo.patch new file mode 100644 index 0000000000..89a2f5a91a --- /dev/null +++ b/queue-6.17/selftests-mptcp-connect-fix-fallback-note-due-to-ooo.patch @@ -0,0 +1,40 @@ +From 63c643aa7b7287fdbb0167063785f89ece3f000f Mon Sep 17 00:00:00 2001 +From: "Matthieu Baerts (NGI0)" +Date: Mon, 10 Nov 2025 19:23:40 +0100 +Subject: selftests: mptcp: connect: fix fallback note due to OoO + +From: Matthieu Baerts (NGI0) + +commit 63c643aa7b7287fdbb0167063785f89ece3f000f upstream. + +The "fallback due to TCP OoO" was never printed because the stat_ooo_now +variable was checked twice: once in the parent if-statement, and one in +the child one. The second condition was then always true then, and the +'else' branch was never taken. + +The idea is that when there are more ACK + MP_CAPABLE than expected, the +test either fails if there was no out of order packets, or a notice is +printed. + +Fixes: 69ca3d29a755 ("mptcp: update selftest for fallback due to OoO") +Cc: stable@vger.kernel.org +Reviewed-by: Geliang Tang +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-1-a4332c714e10@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/mptcp/mptcp_connect.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/testing/selftests/net/mptcp/mptcp_connect.sh ++++ b/tools/testing/selftests/net/mptcp/mptcp_connect.sh +@@ -492,7 +492,7 @@ do_transfer() + "than expected (${expect_synrx})" + retc=1 + fi +- if [ ${stat_ackrx_now_l} -lt ${expect_ackrx} ] && [ ${stat_ooo_now} -eq 0 ]; then ++ if [ ${stat_ackrx_now_l} -lt ${expect_ackrx} ]; then + if [ ${stat_ooo_now} -eq 0 ]; then + mptcp_lib_pr_fail "lower MPC ACK rx (${stat_ackrx_now_l})" \ + "than expected (${expect_ackrx})" diff --git a/queue-6.17/selftests-mptcp-connect-trunc-read-all-recv-data.patch b/queue-6.17/selftests-mptcp-connect-trunc-read-all-recv-data.patch new file mode 100644 index 0000000000..881fa9f099 --- /dev/null +++ b/queue-6.17/selftests-mptcp-connect-trunc-read-all-recv-data.patch @@ -0,0 +1,82 @@ +From ee79980f7a428ec299f6261bea4c1084dcbc9631 Mon Sep 17 00:00:00 2001 +From: "Matthieu Baerts (NGI0)" +Date: Mon, 10 Nov 2025 19:23:44 +0100 +Subject: selftests: mptcp: connect: trunc: read all recv data + +From: Matthieu Baerts (NGI0) + +commit ee79980f7a428ec299f6261bea4c1084dcbc9631 upstream. + +MPTCP Join "fastclose server" selftest is sometimes failing because the +client output file doesn't have the expected size, e.g. 296B instead of +1024B. + +When looking at a packet trace when this happens, the server sent the +expected 1024B in two parts -- 100B, then 924B -- then the MP_FASTCLOSE. +It is then strange to see the client only receiving 296B, which would +mean it only got a part of the second packet. The problem is then not on +the networking side, but rather on the data reception side. + +When mptcp_connect is launched with '-f -1', it means the connection +might stop before having sent everything, because a reset has been +received. When this happens, the program was directly stopped. But it is +also possible there are still some data to read, simply because the +previous 'read' step was done with a buffer smaller than the pending +data, see do_rnd_read(). In this case, it is important to read what's +left in the kernel buffers before stopping without error like before. + +SIGPIPE is now ignored, not to quit the app before having read +everything. + +Fixes: 6bf41020b72b ("selftests: mptcp: update and extend fastclose test-cases") +Cc: stable@vger.kernel.org +Reviewed-by: Geliang Tang +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-5-a4332c714e10@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/mptcp/mptcp_connect.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +--- a/tools/testing/selftests/net/mptcp/mptcp_connect.c ++++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c +@@ -710,8 +710,14 @@ static int copyfd_io_poll(int infd, int + + bw = do_rnd_write(peerfd, winfo->buf + winfo->off, winfo->len); + if (bw < 0) { +- if (cfg_rcv_trunc) +- return 0; ++ /* expected reset, continue to read */ ++ if (cfg_rcv_trunc && ++ (errno == ECONNRESET || ++ errno == EPIPE)) { ++ fds.events &= ~POLLOUT; ++ continue; ++ } ++ + perror("write"); + return 111; + } +@@ -737,8 +743,10 @@ static int copyfd_io_poll(int infd, int + } + + if (fds.revents & (POLLERR | POLLNVAL)) { +- if (cfg_rcv_trunc) +- return 0; ++ if (cfg_rcv_trunc) { ++ fds.events &= ~(POLLERR | POLLNVAL); ++ continue; ++ } + fprintf(stderr, "Unexpected revents: " + "POLLERR/POLLNVAL(%x)\n", fds.revents); + return 5; +@@ -1433,7 +1441,7 @@ static void parse_opts(int argc, char ** + */ + if (cfg_truncate < 0) { + cfg_rcv_trunc = true; +- signal(SIGPIPE, handle_signal); ++ signal(SIGPIPE, SIG_IGN); + } + break; + case 'j': diff --git a/queue-6.17/selftests-mptcp-join-endpoints-longer-transfer.patch b/queue-6.17/selftests-mptcp-join-endpoints-longer-transfer.patch new file mode 100644 index 0000000000..e70eb9afcd --- /dev/null +++ b/queue-6.17/selftests-mptcp-join-endpoints-longer-transfer.patch @@ -0,0 +1,73 @@ +From 6457595db9870298ee30b6d75287b8548e33fe19 Mon Sep 17 00:00:00 2001 +From: "Matthieu Baerts (NGI0)" +Date: Mon, 10 Nov 2025 19:23:42 +0100 +Subject: selftests: mptcp: join: endpoints: longer transfer + +From: Matthieu Baerts (NGI0) + +commit 6457595db9870298ee30b6d75287b8548e33fe19 upstream. + +In rare cases, when the test environment is very slow, some userspace +tests can fail because some expected events have not been seen. + +Because the tests are expecting a long on-going connection, and they are +not waiting for the end of the transfer, it is fine to make the +connection longer. This connection will be killed at the end, after the +verifications, so making it longer doesn't change anything, apart from +avoid it to end before the end of the verifications + +To play it safe, all endpoints tests not waiting for the end of the +transfer are now sharing a longer file (128KB) at slow speed. + +Fixes: 69c6ce7b6eca ("selftests: mptcp: add implicit endpoint test case") +Cc: stable@vger.kernel.org +Fixes: e274f7154008 ("selftests: mptcp: add subflow limits test-cases") +Fixes: b5e2fb832f48 ("selftests: mptcp: add explicit test case for remove/readd") +Fixes: e06959e9eebd ("selftests: mptcp: join: test for flush/re-add endpoints") +Reviewed-by: Geliang Tang +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-3-a4332c714e10@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/mptcp/mptcp_join.sh | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh ++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh +@@ -3757,7 +3757,7 @@ endpoint_tests() + pm_nl_set_limits $ns1 2 2 + pm_nl_set_limits $ns2 2 2 + pm_nl_add_endpoint $ns1 10.0.2.1 flags signal +- { speed=slow \ ++ { test_linkfail=128 speed=slow \ + run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null + local tests_pid=$! + +@@ -3784,7 +3784,7 @@ endpoint_tests() + pm_nl_set_limits $ns2 0 3 + pm_nl_add_endpoint $ns2 10.0.1.2 id 1 dev ns2eth1 flags subflow + pm_nl_add_endpoint $ns2 10.0.2.2 id 2 dev ns2eth2 flags subflow +- { test_linkfail=4 speed=5 \ ++ { test_linkfail=128 speed=5 \ + run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null + local tests_pid=$! + +@@ -3862,7 +3862,7 @@ endpoint_tests() + # broadcast IP: no packet for this address will be received on ns1 + pm_nl_add_endpoint $ns1 224.0.0.1 id 2 flags signal + pm_nl_add_endpoint $ns1 10.0.1.1 id 42 flags signal +- { test_linkfail=4 speed=5 \ ++ { test_linkfail=128 speed=5 \ + run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null + local tests_pid=$! + +@@ -3935,7 +3935,7 @@ endpoint_tests() + # broadcast IP: no packet for this address will be received on ns1 + pm_nl_add_endpoint $ns1 224.0.0.1 id 2 flags signal + pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow +- { test_linkfail=4 speed=20 \ ++ { test_linkfail=128 speed=20 \ + run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null + local tests_pid=$! + diff --git a/queue-6.17/selftests-mptcp-join-properly-kill-background-tasks.patch b/queue-6.17/selftests-mptcp-join-properly-kill-background-tasks.patch new file mode 100644 index 0000000000..0f504a631e --- /dev/null +++ b/queue-6.17/selftests-mptcp-join-properly-kill-background-tasks.patch @@ -0,0 +1,142 @@ +From 852b644acbce1529307a4bb283752c4e77b5cda7 Mon Sep 17 00:00:00 2001 +From: "Matthieu Baerts (NGI0)" +Date: Mon, 10 Nov 2025 19:23:45 +0100 +Subject: selftests: mptcp: join: properly kill background tasks + +From: Matthieu Baerts (NGI0) + +commit 852b644acbce1529307a4bb283752c4e77b5cda7 upstream. + +The 'run_tests' function is executed in the background, but killing its +associated PID would not kill the children tasks running in the +background. + +To properly kill all background tasks, 'kill -- -PID' could be used, but +this requires kill from procps-ng. Instead, all children tasks are +listed using 'ps', and 'kill' is called with all PIDs of this group. + +Fixes: 31ee4ad86afd ("selftests: mptcp: join: stop transfer when check is done (part 1)") +Cc: stable@vger.kernel.org +Fixes: 04b57c9e096a ("selftests: mptcp: join: stop transfer when check is done (part 2)") +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-6-a4332c714e10@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/mptcp/mptcp_join.sh | 18 +++++++++--------- + tools/testing/selftests/net/mptcp/mptcp_lib.sh | 21 +++++++++++++++++++++ + 2 files changed, 30 insertions(+), 9 deletions(-) + +--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh ++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh +@@ -3645,7 +3645,7 @@ userspace_tests() + chk_mptcp_info subflows 0 subflows 0 + chk_subflows_total 1 1 + kill_events_pids +- mptcp_lib_kill_wait $tests_pid ++ mptcp_lib_kill_group_wait $tests_pid + fi + + # userspace pm create destroy subflow +@@ -3673,7 +3673,7 @@ userspace_tests() + chk_mptcp_info subflows 0 subflows 0 + chk_subflows_total 1 1 + kill_events_pids +- mptcp_lib_kill_wait $tests_pid ++ mptcp_lib_kill_group_wait $tests_pid + fi + + # userspace pm create id 0 subflow +@@ -3694,7 +3694,7 @@ userspace_tests() + chk_mptcp_info subflows 1 subflows 1 + chk_subflows_total 2 2 + kill_events_pids +- mptcp_lib_kill_wait $tests_pid ++ mptcp_lib_kill_group_wait $tests_pid + fi + + # userspace pm remove initial subflow +@@ -3718,7 +3718,7 @@ userspace_tests() + chk_mptcp_info subflows 1 subflows 1 + chk_subflows_total 1 1 + kill_events_pids +- mptcp_lib_kill_wait $tests_pid ++ mptcp_lib_kill_group_wait $tests_pid + fi + + # userspace pm send RM_ADDR for ID 0 +@@ -3744,7 +3744,7 @@ userspace_tests() + chk_mptcp_info subflows 1 subflows 1 + chk_subflows_total 1 1 + kill_events_pids +- mptcp_lib_kill_wait $tests_pid ++ mptcp_lib_kill_group_wait $tests_pid + fi + } + +@@ -3774,7 +3774,7 @@ endpoint_tests() + pm_nl_add_endpoint $ns2 10.0.2.2 flags signal + pm_nl_check_endpoint "modif is allowed" \ + $ns2 10.0.2.2 id 1 flags signal +- mptcp_lib_kill_wait $tests_pid ++ mptcp_lib_kill_group_wait $tests_pid + fi + + if reset_with_tcp_filter "delete and re-add" ns2 10.0.3.2 REJECT OUTPUT && +@@ -3829,7 +3829,7 @@ endpoint_tests() + chk_mptcp_info subflows 3 subflows 3 + done + +- mptcp_lib_kill_wait $tests_pid ++ mptcp_lib_kill_group_wait $tests_pid + + kill_events_pids + chk_evt_nr ns1 MPTCP_LIB_EVENT_LISTENER_CREATED 1 +@@ -3903,7 +3903,7 @@ endpoint_tests() + wait_mpj $ns2 + chk_subflow_nr "after re-re-add ID 0" 3 + chk_mptcp_info subflows 3 subflows 3 +- mptcp_lib_kill_wait $tests_pid ++ mptcp_lib_kill_group_wait $tests_pid + + kill_events_pids + chk_evt_nr ns1 MPTCP_LIB_EVENT_LISTENER_CREATED 1 +@@ -3951,7 +3951,7 @@ endpoint_tests() + wait_mpj $ns2 + pm_nl_add_endpoint $ns1 10.0.3.1 id 2 flags signal + wait_mpj $ns2 +- mptcp_lib_kill_wait $tests_pid ++ mptcp_lib_kill_group_wait $tests_pid + + join_syn_tx=3 join_connect_err=1 \ + chk_join_nr 2 2 2 +--- a/tools/testing/selftests/net/mptcp/mptcp_lib.sh ++++ b/tools/testing/selftests/net/mptcp/mptcp_lib.sh +@@ -350,6 +350,27 @@ mptcp_lib_kill_wait() { + wait "${1}" 2>/dev/null + } + ++# $1: PID ++mptcp_lib_pid_list_children() { ++ local curr="${1}" ++ # evoke 'ps' only once ++ local pids="${2:-"$(ps o pid,ppid)"}" ++ ++ echo "${curr}" ++ ++ local pid ++ for pid in $(echo "${pids}" | awk "\$2 == ${curr} { print \$1 }"); do ++ mptcp_lib_pid_list_children "${pid}" "${pids}" ++ done ++} ++ ++# $1: PID ++mptcp_lib_kill_group_wait() { ++ # Some users might not have procps-ng: cannot use "kill -- -PID" ++ mptcp_lib_pid_list_children "${1}" | xargs -r kill &>/dev/null ++ wait "${1}" 2>/dev/null ++} ++ + # $1: IP address + mptcp_lib_is_v6() { + [ -z "${1##*:*}" ] diff --git a/queue-6.17/selftests-mptcp-join-rm-set-backup-flag.patch b/queue-6.17/selftests-mptcp-join-rm-set-backup-flag.patch new file mode 100644 index 0000000000..14114d72e7 --- /dev/null +++ b/queue-6.17/selftests-mptcp-join-rm-set-backup-flag.patch @@ -0,0 +1,165 @@ +From aea73bae662a0e184393d6d7d0feb18d2577b9b9 Mon Sep 17 00:00:00 2001 +From: "Matthieu Baerts (NGI0)" +Date: Mon, 10 Nov 2025 19:23:41 +0100 +Subject: selftests: mptcp: join: rm: set backup flag + +From: Matthieu Baerts (NGI0) + +commit aea73bae662a0e184393d6d7d0feb18d2577b9b9 upstream. + +Some of these 'remove' tests rarely fail because a subflow has been +reset instead of cleanly removed. This can happen when one extra subflow +which has never carried data is being closed (FIN) on one side, while +the other is sending data for the first time. + +To avoid such subflows to be used right at the end, the backup flag has +been added. With that, data will be only carried on the initial subflow. + +Fixes: d2c4333a801c ("selftests: mptcp: add testcases for removing addrs") +Cc: stable@vger.kernel.org +Reviewed-by: Geliang Tang +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-2-a4332c714e10@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/mptcp/mptcp_join.sh | 54 ++++++++++++------------ + 1 file changed, 27 insertions(+), 27 deletions(-) + +--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh ++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh +@@ -2347,7 +2347,7 @@ remove_tests() + if reset "remove single subflow"; then + pm_nl_set_limits $ns1 0 1 + pm_nl_set_limits $ns2 0 1 +- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow ++ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup + addr_nr_ns2=-1 speed=slow \ + run_tests $ns1 $ns2 10.0.1.1 + chk_join_nr 1 1 1 +@@ -2360,8 +2360,8 @@ remove_tests() + if reset "remove multiple subflows"; then + pm_nl_set_limits $ns1 0 2 + pm_nl_set_limits $ns2 0 2 +- pm_nl_add_endpoint $ns2 10.0.2.2 flags subflow +- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow ++ pm_nl_add_endpoint $ns2 10.0.2.2 flags subflow,backup ++ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup + addr_nr_ns2=-2 speed=slow \ + run_tests $ns1 $ns2 10.0.1.1 + chk_join_nr 2 2 2 +@@ -2372,7 +2372,7 @@ remove_tests() + # single address, remove + if reset "remove single address"; then + pm_nl_set_limits $ns1 0 1 +- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal ++ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup + pm_nl_set_limits $ns2 1 1 + addr_nr_ns1=-1 speed=slow \ + run_tests $ns1 $ns2 10.0.1.1 +@@ -2385,9 +2385,9 @@ remove_tests() + # subflow and signal, remove + if reset "remove subflow and signal"; then + pm_nl_set_limits $ns1 0 2 +- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal ++ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup + pm_nl_set_limits $ns2 1 2 +- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow ++ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup + addr_nr_ns1=-1 addr_nr_ns2=-1 speed=slow \ + run_tests $ns1 $ns2 10.0.1.1 + chk_join_nr 2 2 2 +@@ -2399,10 +2399,10 @@ remove_tests() + # subflows and signal, remove + if reset "remove subflows and signal"; then + pm_nl_set_limits $ns1 0 3 +- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal ++ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup + pm_nl_set_limits $ns2 1 3 +- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow +- pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow ++ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup ++ pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow,backup + addr_nr_ns1=-1 addr_nr_ns2=-2 speed=10 \ + run_tests $ns1 $ns2 10.0.1.1 + chk_join_nr 3 3 3 +@@ -2414,9 +2414,9 @@ remove_tests() + # addresses remove + if reset "remove addresses"; then + pm_nl_set_limits $ns1 3 3 +- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal id 250 +- pm_nl_add_endpoint $ns1 10.0.3.1 flags signal +- pm_nl_add_endpoint $ns1 10.0.4.1 flags signal ++ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup id 250 ++ pm_nl_add_endpoint $ns1 10.0.3.1 flags signal,backup ++ pm_nl_add_endpoint $ns1 10.0.4.1 flags signal,backup + pm_nl_set_limits $ns2 3 3 + addr_nr_ns1=-3 speed=10 \ + run_tests $ns1 $ns2 10.0.1.1 +@@ -2429,10 +2429,10 @@ remove_tests() + # invalid addresses remove + if reset "remove invalid addresses"; then + pm_nl_set_limits $ns1 3 3 +- pm_nl_add_endpoint $ns1 10.0.12.1 flags signal ++ pm_nl_add_endpoint $ns1 10.0.12.1 flags signal,backup + # broadcast IP: no packet for this address will be received on ns1 +- pm_nl_add_endpoint $ns1 224.0.0.1 flags signal +- pm_nl_add_endpoint $ns1 10.0.3.1 flags signal ++ pm_nl_add_endpoint $ns1 224.0.0.1 flags signal,backup ++ pm_nl_add_endpoint $ns1 10.0.3.1 flags signal,backup + pm_nl_set_limits $ns2 2 2 + addr_nr_ns1=-3 speed=10 \ + run_tests $ns1 $ns2 10.0.1.1 +@@ -2446,10 +2446,10 @@ remove_tests() + # subflows and signal, flush + if reset "flush subflows and signal"; then + pm_nl_set_limits $ns1 0 3 +- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal ++ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup + pm_nl_set_limits $ns2 1 3 +- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow +- pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow ++ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup ++ pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow,backup + addr_nr_ns1=-8 addr_nr_ns2=-8 speed=slow \ + run_tests $ns1 $ns2 10.0.1.1 + chk_join_nr 3 3 3 +@@ -2462,9 +2462,9 @@ remove_tests() + if reset "flush subflows"; then + pm_nl_set_limits $ns1 3 3 + pm_nl_set_limits $ns2 3 3 +- pm_nl_add_endpoint $ns2 10.0.2.2 flags subflow id 150 +- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow +- pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow ++ pm_nl_add_endpoint $ns2 10.0.2.2 flags subflow,backup id 150 ++ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup ++ pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow,backup + addr_nr_ns1=-8 addr_nr_ns2=-8 speed=slow \ + run_tests $ns1 $ns2 10.0.1.1 + chk_join_nr 3 3 3 +@@ -2481,9 +2481,9 @@ remove_tests() + # addresses flush + if reset "flush addresses"; then + pm_nl_set_limits $ns1 3 3 +- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal id 250 +- pm_nl_add_endpoint $ns1 10.0.3.1 flags signal +- pm_nl_add_endpoint $ns1 10.0.4.1 flags signal ++ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup id 250 ++ pm_nl_add_endpoint $ns1 10.0.3.1 flags signal,backup ++ pm_nl_add_endpoint $ns1 10.0.4.1 flags signal,backup + pm_nl_set_limits $ns2 3 3 + addr_nr_ns1=-8 addr_nr_ns2=-8 speed=slow \ + run_tests $ns1 $ns2 10.0.1.1 +@@ -2496,9 +2496,9 @@ remove_tests() + # invalid addresses flush + if reset "flush invalid addresses"; then + pm_nl_set_limits $ns1 3 3 +- pm_nl_add_endpoint $ns1 10.0.12.1 flags signal +- pm_nl_add_endpoint $ns1 10.0.3.1 flags signal +- pm_nl_add_endpoint $ns1 10.0.14.1 flags signal ++ pm_nl_add_endpoint $ns1 10.0.12.1 flags signal,backup ++ pm_nl_add_endpoint $ns1 10.0.3.1 flags signal,backup ++ pm_nl_add_endpoint $ns1 10.0.14.1 flags signal,backup + pm_nl_set_limits $ns2 3 3 + addr_nr_ns1=-8 speed=slow \ + run_tests $ns1 $ns2 10.0.1.1 diff --git a/queue-6.17/selftests-mptcp-join-userspace-longer-transfer.patch b/queue-6.17/selftests-mptcp-join-userspace-longer-transfer.patch new file mode 100644 index 0000000000..afd0a35112 --- /dev/null +++ b/queue-6.17/selftests-mptcp-join-userspace-longer-transfer.patch @@ -0,0 +1,82 @@ +From 290493078b96ce2ce3e60f55c23654acb678042a Mon Sep 17 00:00:00 2001 +From: "Matthieu Baerts (NGI0)" +Date: Mon, 10 Nov 2025 19:23:43 +0100 +Subject: selftests: mptcp: join: userspace: longer transfer + +From: Matthieu Baerts (NGI0) + +commit 290493078b96ce2ce3e60f55c23654acb678042a upstream. + +In rare cases, when the test environment is very slow, some userspace +tests can fail because some expected events have not been seen. + +Because the tests are expecting a long on-going connection, and they are +not waiting for the end of the transfer, it is fine to make the +connection longer. This connection will be killed at the end, after the +verifications, so making it longer doesn't change anything, apart from +avoid it to end before the end of the verifications + +To play it safe, all userspace tests not waiting for the end of the +transfer are now sharing a longer file (128KB) at slow speed. + +Fixes: 4369c198e599 ("selftests: mptcp: test userspace pm out of transfer") +Cc: stable@vger.kernel.org +Fixes: b2e2248f365a ("selftests: mptcp: userspace pm create id 0 subflow") +Fixes: e3b47e460b4b ("selftests: mptcp: userspace pm remove initial subflow") +Fixes: b9fb176081fb ("selftests: mptcp: userspace pm send RM_ADDR for ID 0") +Reviewed-by: Geliang Tang +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-4-a4332c714e10@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/mptcp/mptcp_join.sh | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh ++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh +@@ -3620,7 +3620,7 @@ userspace_tests() + continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then + set_userspace_pm $ns1 + pm_nl_set_limits $ns2 2 2 +- { speed=5 \ ++ { test_linkfail=128 speed=5 \ + run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null + local tests_pid=$! + wait_mpj $ns1 +@@ -3653,7 +3653,7 @@ userspace_tests() + continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then + set_userspace_pm $ns2 + pm_nl_set_limits $ns1 0 1 +- { speed=5 \ ++ { test_linkfail=128 speed=5 \ + run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null + local tests_pid=$! + wait_mpj $ns2 +@@ -3681,7 +3681,7 @@ userspace_tests() + continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then + set_userspace_pm $ns2 + pm_nl_set_limits $ns1 0 1 +- { speed=5 \ ++ { test_linkfail=128 speed=5 \ + run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null + local tests_pid=$! + wait_mpj $ns2 +@@ -3702,7 +3702,7 @@ userspace_tests() + continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then + set_userspace_pm $ns2 + pm_nl_set_limits $ns1 0 1 +- { speed=5 \ ++ { test_linkfail=128 speed=5 \ + run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null + local tests_pid=$! + wait_mpj $ns2 +@@ -3726,7 +3726,7 @@ userspace_tests() + continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then + set_userspace_pm $ns1 + pm_nl_set_limits $ns2 1 1 +- { speed=5 \ ++ { test_linkfail=128 speed=5 \ + run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null + local tests_pid=$! + wait_mpj $ns1 diff --git a/queue-6.17/series b/queue-6.17/series index c05747ee1e..5a61c45b24 100644 --- a/queue-6.17/series +++ b/queue-6.17/series @@ -205,3 +205,31 @@ selftests-user_events-fix-type-cast-for-write_index-packed-member-in-perf_test.p gendwarfksyms-skip-files-with-no-exports.patch io_uring-rw-ensure-allocated-iovec-gets-cleared-for-early-failure.patch ftrace-fix-bpf-fexit-with-livepatch.patch +loongarch-consolidate-max_pfn-max_low_pfn-calculation.patch +loongarch-use-physical-addresses-for-csr_merrentry-csr_tlbrentry.patch +edac-altera-handle-ocram-ecc-enable-after-warm-reset.patch +edac-altera-use-inttest-register-for-ethernet-and-usb-sbe-injection.patch +pm-hibernate-emit-an-error-when-image-writing-fails.patch +pm-hibernate-use-atomic64_t-for-compressed_size-variable.patch +btrfs-zoned-fix-conventional-zone-capacity-calculation.patch +btrfs-zoned-fix-stripe-width-calculation.patch +btrfs-scrub-put-bio-after-errors-in-scrub_raid56_parity_stripe.patch +btrfs-do-not-update-last_log_commit-when-logging-inode-due-to-a-new-name.patch +btrfs-release-root-after-error-in-data_reloc_print_warning_inode.patch +drm-amdkfd-relax-checks-for-over-allocation-of-save-area.patch +drm-amdgpu-fix-lock-warning-in-amdgpu_userq_fence_driver_process.patch +drm-amdgpu-disable-peer-to-peer-access-for-dcc-enabled-gc12-vram-surfaces.patch +drm-i915-psr-fix-pipe-to-vblank-conversion.patch +drm-xe-xe3lpg-extend-wa_15016589081-for-xe3lpg.patch +drm-xe-xe3-extend-wa_14023061436.patch +drm-xe-xe3-add-wa_14024681466-for-xe3_lpg.patch +pmdomain-arm-scmi-fix-genpd-leak-on-provider-registration-failure.patch +pmdomain-imx-fix-reference-count-leak-in-imx_gpc_remove.patch +pmdomain-samsung-plug-potential-memleak-during-probe.patch +pmdomain-samsung-rework-legacy-splash-screen-handover-workaround.patch +selftests-mptcp-connect-fix-fallback-note-due-to-ooo.patch +selftests-mptcp-join-rm-set-backup-flag.patch +selftests-mptcp-join-endpoints-longer-transfer.patch +selftests-mptcp-connect-trunc-read-all-recv-data.patch +selftests-mptcp-join-userspace-longer-transfer.patch +selftests-mptcp-join-properly-kill-background-tasks.patch -- 2.47.3